Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation IV Glitch Discussion

Technical writeup of my new HoO route - Page 1

Technical writeup of my new HoO route

Posted by: RETIRE
Date: 2019-03-20 02:19:42
Since wrongwarps were discovered and understood I had been wondering: is a faster Hall of Origin capture location route for Arceus possible?

I never attempted to make a faster one because any method I could think of would only save about 1500 steps. I needed some other section of ram that I could get to quickly that I could modify to give me a Pal Park map and a Hall Of Origin map. And I accomplished this using warpdata, coordinate data, two independent Wrong Warps and a Spear Pillar warp.

The new route is only 5551 steps, which is a 10 000 step improvement over the old route. It is also 1200 steps from startup, and allows for infinite captures with 'Jubilife City' as capture location. Therefore it's also the best shinyhunt route out there. It's also the first completely consistent route that works across all languages.

Here is a youtube video showing everything, if you'd like to follow along:
https://www.youtube.com/watch?v=JrWct9U9rhM

Here are all the locations for [base] in all releases of D/P.
DS games have randomised RAM layouts. The RAM layout can have 64 patterns, and is assigned on booting of the game.
Therefore all calculations for RAM offsets use [base], the value that shows the randomisation.

base = 0x02106FC0  US/EU
base = 0x02107100  DE
base = 0x02107140  FR
base = 0x021070A0  IT
base = 0x02108818  JP
base = 0x021045C0  KR
base = 0x02107160  ES

Expected knowledge is understanding the concepts in this Void Guide: https://forums.glitchcity.info/index.php?topic=8499.0

Route explanation:

All map IDs above 0x22E (558 in decimal), are forced to 3 due to an error handler.

When entering Poketch Co
Map Id read from [base] + 22ADA = Matrix_center = 0008 = Poketch Co.

1 S
17 W
22 S

use Bicycle (key item)

32 N
415 W
Map Id = over 558 => 0003 = Jubilife City

Save reset
Map width 1x1 => 30x30

380 E
Explorer kit, back out of message

This writes current Map Id followed by X and Y coordinates at [Base] + 1488
X = FFFF FFE1 but is written as 16 bit => FFE1
Y= 0000 0000 but is written as 16 bit => 0000

480 N
260 E
Map Id = 0007 = Jubilife City top floor pokémoncenter

Save reset
Map width 30x30 => 1x1

214 W
479 S
X = 0000 000C
Y = FFFF FFFF

graphic reload
Y coordinate is underflowed, collision is now read from a different part of ram, and due to update orders we can move 2 tiles down if we run or move at full speed with bike, into a wall
Y = 0000 0001

graphic reload
Y coordinate is positive, collision is fixed and we walk down into the room.
Y= 0000 0003
3 W

talk to NPC from this spot
Reset after the saving is done
By talking to the Union Room npc, a Map Id and coordinate check is performed. If it matches, it overwrites data at [base] + 1488 with those values.

It will then warp you to them if you would reset the console. But since the check fails (we are at a wrong Y value) we will warp to our earlier written Explorer kit values at [Base] + 1488
X = FFE1
Y = 0000

Since Explorer Kit is used in an Outdoor map
Matrix id 1x1 => 30x30

X ram change (65505/32*2) = 4094 = 0FFE
Y ram change (0/32*2*30) = 0 = 0000

We add 0FFE to [base] + 22ADA.
This puts us at [base] + 23AD8.
This us really close to warp coordinates, sprite coordinates, sprite Id's, events, flagdata,… which we will now abuse heavily.


Register Town Map
Town map will be used to refresh graphics, which will unload models in Fake Sinnoh that block our path

100 E
320 S

We have reached warp coordinates, sprite coordinate, Id's, events, flags… which all get loaded when entering a Map.
Since their written values are read as Map Id, you can chain entering Maps and writing new ones.

32 E
Map Id =  0002 = Underground
Writes 0188 and 002D

191 S
32 E
1 S
Map Id =  0188 = route 221
Writes 0132 , 0189 and 0028

32 E
1 N
192 E


Town Map

65 S
96 E
Map Id =  0028 = Canalave City Library - 03
Writes 01D4

1 N
128 W

Town Map

8 W
14 N

Map ID = 01D4 = route 223
X = FFFF 0138
Y = 0000 0232

Explorer Kit
Back out of message

Writes to [base] + 1488
X = 0138
Y = 0232

In the overworld, this equals to above the door of Eterna city's gym

56 W
Town Map
1 W
47 S
Map Id = 0132 = Galactic HQ
Clears a path through ram
Writes 0010

1 N
32 E

Town Map

1 E
1 S (cutscene if first time entering)
Map Id = 0189 = inside Pal Park
Writes 00FB

32 N

Town Map

32 N
64 E (63 if cutscene played)

Town Map

96 N
1 N
Cutscene

Map Id = 00FB = outdoors Pal Park
Grants the Pal Park menu with RETIRE function

1 S
96 W
Map Id =  0010 = Jubilife City Jubilife TV-06
Writes 0006

97 N

Map Id = 0006 = Jubilife City Pokemon Center
Writes 0004
+
Map Id = 0004 = Jubilife City Mart
Writes 0002

1 W
Go through map 0002 = Underground
Writes 00B9

1 E
Go through 00B9 = Cynthia's room
Mapscript runs to start battle
Lose battle (except for dig, this is the fastest way to leave the void with the Pal Park menu without overwriting [base] + 1488)

We are now in a Pokémoncenter with the Pal Park menu

Take some strong Pokémon from a box

Walk up left elevator
Mapscript pushes you into void

4 W
15 N
6 E

graphic reload
full speed south
graphic reload

2 S
2 E
talk to NPC from this spot
Reset after the saving is done

This is all the same as earlier, we warp to the values written earlier at [base] + 1488, above Eterna City Gym's door

Graphic reload
1 S
enter warp

Map Id read from [base] + 22ADA = Matrixcenter = 0043 = Eterna City Gym

Has matrix ID 00DC

1 S
243 E
332 N
Map ID read from [base] + 22AD6 = Matrix ID
= 00DC = Spear Pillar
RETIRE

X = 0000 00FB
Y = FFFF FEC1

When we pressed RETIRE we activated a cutscene that stores our
Map id = 00DC
X = 0000 00FB but is written as 16 bit => 00FB
Y = FFFF FFC1 but is written as 16 bit => FFC1

And warps us back to the void of spear pillar and 16 bit equivalent of the coordinates. This does the following

X ram change: (251/32*2) = 14 = 000E
Y ram change: (65217/32*2*2) =  8152 = 1FD8

We add 1FE6 to [base] + 22ADA.
This puts us at [base] + 24AC0.
This is really close to coordinate, warp, animation, sprite… data. (the thing is a mess)
We will be abusing coordinates, and warpdata.

Writes 00FB = Outdoor Pal Park as the X value of a warp

479 N
259 E
Adds 0103 to 00FB => X = 01FE
64 N
Enter X coordinate data = 01FE = Hall of Origin

————–
HoO Arceus runaway:
————–
RETIRE (runaway)
1 N
3 S
repeat until you capture an Arceus
————–
65 N
Enter X value of warp = 00FB = Outdoor Pal Park
RETIRE

————–
Jubilife Arceus infinite capture:
1 N
————–
RETIRE (capture/runaway)
2 S
repeat until you have captures all Arceus youd like
————–
64 N
Enter X value of warp = 00FB = Outdoor Pal Park
RETIRE

If you have any questions, shoot them! I am not the best at writing technical writeups but I tried, and had some feedback from ISSO a while ago.