Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Use ACE to make a Pokemon Rom Hack? - Page 1

Use ACE to make a Pokemon Rom Hack?

Posted by: zdrmonster12
Date: 2018-08-07 17:01:09
i want to ask this, is it possible to use ACE to make a Pokemon Rom Hack?

if it is, what things can be modified?

i doubt it will be possible, because ROM is read only.

i have seen stuff about new sprites and new maps with ACE.

but is that it?

maybe, or maybe not.

Re: Use ACE to make a Pokemon Rom Hack?

Posted by: Guy
Date: 2018-08-07 17:07:59
You'd be surprised at the SRAM hacks out there. Game Freak did it for the e-Reader events in Gen III, so why can't we in Gen I?

Ho-Oh on a real Red cartridge
Pikablu on Red
Another Pikablu (through VRAM instead)
Missingno.sav (watch and be amazed)

Re: Use ACE to make a Pokemon Rom Hack?

Posted by: Torchickens
Date: 2018-08-07 17:33:06
Thanks for linking my Pikablu video. For April Fools Day I decided to make Shrek a Pokémon as well.

https://www.youtube.com/watch?v=WWWlKjNbCSc

What you need to make your own is generally an access point for arbitrary code. These include level-script pointer ACE (executes code continuously anywhere on the overworld), meta-map script ACE (executes code continuously when on a specific overworld map), and the best one is OAM DMA hijacking (executes code continuously anywhere in the game), as well as a little coding knowledge/knowledge of the game's ROM routines and RAM.

This is how I made Shrek basically:
1. I converted the sprite into raw bytes for the sprite decompression. I've included the tools for this here; compatible with any regular PNG
2. I used ws m to set up OAM DMA hijacking
3. OAM DMA hijacking was used to run code which can be stored previously with ws m (e.g. with one of TheZZAZZGlitch's memory writers or mine)
4. I made logic for the code so if the Pokémon has a certain ID number on the summary (65535 if I remember correctly; by reading the text characters on the screen) it displays Shrek's front sprite, which was previously stored somewhere in RAM e.g. box Pokémon data. This was done by locking the following:


wMonHSpriteDim:: ; d0c2
ds 1
wMonHFrontSprite:: ; d0c3
ds 2
wMonHBackSprite:: ; d0c5
ds 2


I can't remember what I did for the back sprite anymore, but it probably locked the pointer at D0C5 (D0C4 in Yellow) as well.

Also you can do something similar without one of the above access points in Yellow if you have a 9 (E6), although only with the backsprite.

9 (E6) takes its back sprite from FAC9 in RAM (within the box Pokémon data), which can be modified with one of the memory writers. Specifically these: https://glitchcity.info/wiki/Player_coordinates_RAM_writer ; https://www.youtube.com/watch?v=6NuisafQBkc ; https://forums.glitchcity.info/index.php?topic=6638.msg200510.html#msg200510

However, in Red/Blue Family 175 glitch Pokémon (specifically 0xE4, 0xE9, 0xEE) take their frontsprite from screen data at CDE5. It's possible to view a custom front sprite with this method, as you can manipulate this with an access point (OAM DMA hijacking) as well, but I don't know if you can reliably do that otherwise.