Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Emulation & ROM Hacking

Emulating the Mobile Adapter GB - Page 2

Re: Emulating the Mobile Adapter GB

Posted by: ravioli
Date: 2017-07-23 08:18:00
I know that GCF has such a reputation for having an excellent and eagerly helpful community when it comes to this kind of stuff, but I would like to see if anybody can/help me in making a legitimate emulator that connects to DION or any homebrew server we chose.

It shouldn't be so difficult right? The Dolphin team emulated the SP1 Broadband board quite successfully iirc.

Also, does the mobile phone adapter still work in 2017? As in, if I edited the rom of Crystal and the Mobile Trainer to not connect to gameboy.datacenter.ne.jp but instead to our own server, would it work?

Re: Emulating the Mobile Adapter GB

Posted by: MissingNo
Date: 2017-07-23 19:30:13
Thoughts I wanna throw out there from my limited Japanese phone system knowledge:

AFAIK, the PHS network allowed for the use of "personal" cells that interconnected to the Japanese PTSN (eg, to use your PHS phone as a cordless home phone). PHS phone + DDI PHS adapter + PHS base station + Asterisk magic(?)/dial up server/email system for comms = "real life" Mobile Adapter GB emulation?

Re: Emulating the Mobile Adapter GB

Posted by: SatoMew
Date: 2017-07-31 09:23:03
There is already an emulator that supports the Mobile Adapter GB.

https://github.com/shonumi/gbe-plus

Re: Emulating the Mobile Adapter GB

Posted by: ravioli
Date: 2017-08-05 20:33:19

There is already an emulator that supports the Mobile Adapter GB.

https://github.com/shonumi/gbe-plus


I can't find any documentation on that.

Re: Emulating the Mobile Adapter GB

Posted by: Torchickens
Date: 2017-08-06 07:57:12

There is already an emulator that supports the Mobile Adapter GB.

https://github.com/shonumi/gbe-plus




There is already an emulator that supports the Mobile Adapter GB.

https://github.com/shonumi/gbe-plus


I can't find any documentation on that.


Wow that's news to me too. How do you use it on Windows and get Pokémon Mobile System GB to work with it?

Re: Emulating the Mobile Adapter GB

Posted by: Stackout
Date: 2017-08-06 09:44:12
I looked at the code, the emulation there is incomplete, and seems only there to get Mobile Trainer to work.

Re: Emulating the Mobile Adapter GB

Posted by: Torchickens
Date: 2017-08-06 09:47:54

I looked at the code, the emulation there is incomplete, and seems only there to get Mobile Trainer to work.


I see, thanks.  :) That's a shame. :/

A little later I found a Windows download link on the Emu Gen wiki, but I still don't know how to get Mobile Trainer to work on it.

http://emulation.gametechwiki.com/index.php/GBE%2B

Re: Emulating the Mobile Adapter GB

Posted by: XOlifreX
Date: 2017-08-10 17:27:04
Fantastic that this is being worked on!
I would love to see the Mobile Adapter GB being fully emulated, not only for Pokémon, but for other games aswell!

I, myself, would love to see the GBA game Mario Kart Super Circuit work with the Mobile Adapter. The game only used the platform for time trail rankings & exchanging ghosts.

Re: Emulating the Mobile Adapter GB

Posted by: PokeAcer549
Date: 2017-08-11 07:23:13
It'd be cool to see the actual web servers this used brought back; a null-modem cable could be constructed using the real Mobile Adapter GB, which could then plug into a PC for actual Internet connection.
(Or, find a way to make one that works with newer phones using USB-OTG on Android devices)

Re: Emulating the Mobile Adapter GB

Posted by: ravioli
Date: 2017-08-12 22:25:10
I am going to begin working on this to connect to the actual internet. I would like someone like Hacky who has an actual mobile gb adapter too.

I made a discord for people who would like to help!

https://discord.gg/DFkW5KU

Re: Emulating the Mobile Adapter GB

Posted by: Háčky
Date: 2017-08-13 02:59:33
I have actually been working on this occasionally over the past several months, but never found the time to compile my notes into something coherent.

Ive figured out how the HTTP authentication scheme is supposed to work (an essential prerequisite for creating a server), and have also mostly documented the Pokémon News system. I need to put together a video to show that off, which I should do tomorrow.

I have some design plans for a server and client, but havent implemented anything. I might start on that this week, although Im torn on whether to do that first or decipher the Battle Tower system.

Also, does the mobile phone adapter still work in 2017? As in, if I edited the rom of Crystal and the Mobile Trainer to not connect to gameboy.datacenter.ne.jp but instead to our own server, would it work?


The adapter still works for peer-to-peer communication (Pokémon Cable Club) as long as the handsets are able to receive service. The last PDC network shut down in March 2012, and the original frequency allocation for CDMA service in Japan was changed in July 2012, so it is likely that only DDI Pocket handsets still work, as their service continues under the Y!mobile brand.

To allow the adapter to connect to the Internet, an alternative to the DION dial-up service would need to be provided. Assuming that were possible, the adapter would need to be reconfigured to dial that service instead of DION; this could be achieved by running a specially-prepared ROM off a flash cartridge, or perhaps through an elaborate arbitrary code execution exploit. But if you could connect to your own dial-up ISP, you wouldnt need to edit the domain names in the ROM; you could just intercept requests at the ISP end and redirect them to the server of your choice.

If the goal is just to connect a real Pokémon Crystal (or other compatible game) cartridge to a reconstructed server, then a much simpler way to achieve that would be to plug a device directly into the link port and emulate the Mobile Adapter GB in exactly the same way that a PC-based emulator would. (Can a Raspberry Pi bit-bang at 256 Kib/s?)

It'd be cool to see the actual web servers this used brought back; a null-modem cable could be constructed using the real Mobile Adapter GB, which could then plug into a PC for actual Internet connection.


Thats another possibility, but would require knowing the protocol the adapter uses to control the handset (surely its documented somewhere?). Also, I doubt the requisite connectors are still manufactured, so some disassembly may be required :)

Eventually Ill want to do something like that anyway, in order to test the actual behavior of the adapter and find out what those missing numbers in the command list are for.

Re: Emulating the Mobile Adapter GB

Posted by: Torchickens
Date: 2017-08-13 07:06:05

I have some design plans for a server and client, but havent implemented anything. I might start on that this week, although Im torn on whether to do that first or decipher the Battle Tower system.


I'd personally love to see a server and client even if it doesn't support the Battle Tower first. :) Though it may be a good idea to make sure the Battle Tower system works first, if online battles/trades work sooner rather than later then it's really exciting and doing a few test battles could be fun, you could release it in a video for people to use, and you could always incorporate the Battle Tower functionality later for a later release.

On the other hand it may be fun to learn how the Battle Tower works.

Up to you of course though, I would feel torn as well.

Re: Emulating the Mobile Adapter GB

Posted by: Parzival
Date: 2017-08-13 20:16:44
Question: If we connect to a server from a client, but it's over Dial-Up, is it still technically considered to be running on an actual adapter and therefore valid in TAS?

Re: Emulating the Mobile Adapter GB

Posted by: Háčky
Date: 2017-08-15 22:38:22
Okay, tomorrow was two days ago, but I have this silly, old-fashioned obsession with factual accuracy and needed to recheck a bunch of things. I guess it would be easier if I posted more often :)


Question: If we connect to a server from a client, but it's over Dial-Up, is it still technically considered to be running on an actual adapter and therefore valid in TAS?


I think more research is needed to determine accurate timings for the adapter ;D




[size=12pt]HTTP authentication scheme[/size]
Nintendos mobile library will attempt to authenticate the user with the Mobile System GB server only when a POST request is made for [tt]http://gameboy.datacenter.ne.jp/cgb/upload[/tt] or [tt]http://gameboy.datacenter.ne.jp/cgb/ranking[/tt], and only if the filename at the end of the URI begins with a number indicating a service fee (even if its ¥0).

Even when those conditions are met, the library has a bug that can cause it to fail to detect whether authentication is required:

; Find the string terminator at the end of the URI
.asm_1112a0
ld a, [hli]
or a
jr nz, .asm_1112a0

; Now back up and find the last slash
; Right now, hl points to the byte *after* the string terminator!
; If that byte happens to be a slash ($2F), this code may
; fail to properly detect whether this is a paid upload.
; There ought to be a dec hl here.
.asm_1112a4
ld a, [hld]
cp $2f
jr nz, .asm_1112a4

Since Pokémon Crystal does not erase the last URI in memory before writing the next in a series of requests, it is possible that the residual byte after the string terminator could be a slash if a previous URI was longer than the current one. A careful choice of URIs avoids this issue.

An authentication attempt begins by sending an HTTP GET request, to which the server responds with [tt]401 Unauthorized[/tt] and a [tt]WWW-Authenticate: GB00 name=""[/tt] header, where the [tt]name[/tt] is an arbitrary 36-byte value encoded in Base64.

The game then sends another GET request, this time with the header [tt]Authorization: GB00 name=""[/tt], where the [tt]name[/tt] is a concatenation of two separate Base64-encoded values: the first is the first 32 bytes from the [tt]WWW-Authenticate[/tt] name, and the second is a 36-byte value determined by a byzantine procedure:

The first step necessitates that the server retains users plaintext passwords in order to calculate arbitrary MD5 hashes from themunless the value in the [tt]WWW-Authenticate[/tt] header is predetermined, which would allow the hash to be precalculated, but would make the rest of this shell game even more pointless as a successful authentication attempt could be replayed.

If the [tt]Authorization[/tt] header is valid, the server responds with [tt]200 OK[/tt] and a [tt]Gb-Auth-ID[/tt] header which contains an arbitrary string. The game then sends its POST request and includes the same [tt]Gb-Auth-ID[/tt] header.


[size=12pt]Pokémon News[/size]
A Pokémon News download begins by accessing [tt]http://gameboy.datacenter.ne.jp/cgb/download?name=/01/CGB-BXTJ/news/index.txt[/tt], a text file containing four URIs which are used to:

The cost of Pokémon News was ¥100 per issue. The fourth URI should be tagged with that cost so that it is displayed by the game; the two upload URIs should be tagged with a cost of ¥0 so that the game will authenticate and upload the data.


Metadata
The metadata file is an unstructured hodgepodge of variable-length fields, the boundaries of which can only be determined by parsing each field in its own unique way. In typical Game Freak style, the game makes no effort to validate the data received from the server or protect against buffer overflows. A malformed metadata file can certainly crash the game and corrupt the save file (Ive done it more than once), and could probably execute arbitrary code.

Unique ID: This is a fixed-width field which, inexplicably, is 12 bytes long. If this ID is the same as the last News that was downloaded, then the download is aborted with the message はまで There was no new News.

Description: A text string, terminated with $50, that is displayed in the lower text box when the player is asked to confirm whether he or she wants to upload the save data and proceed with the News download.

Rankings save address: This 2-byte field contains the address where the rankings data will be stored in SRAM bank 6. Since the main News data will be written starting at 6:A000, the rankings data should be placed somewhere around 6:B000, such that the News does not overwrite the rankings.

Rankings metadata: This field begins with a 16-bit value denoting the length of the data that follows. The data is a series of 16-bit values, one for each rankings table that will be sent, indicating the width of a record in each rankings table. (For example, if there are 9 different rankings tables and each table contains 26-byte records, this field would be [tt]12 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00[/tt].)

Save data selection: This is a list of the regions of save data that will be sent to the server. Each region is specified by four bytes: the first byte is an SRAM bank, the second and third are an address, and the fourth is the number of bytes to send. The end of the list is marked with $FF. The requested data is concatenated and uploaded as a binary file.

Rankings data selection: This specifies the data that will be submitted for the rankings. The rankings data is submitted as keyvalue pairs in the manner of an HTML form submission, with the values encoded in ASCII hexadecimal. Each key is a string literal (in ASCII?) terminated with $50 (ASCII [tt]"P"[/tt]). Each value is specified with a bank number, address, and length in the same manner as the save data upload. The list of keyvalue pairs is terminated with $50 (i.e., an empty string where the name of the next key would be expected).

Although data can technically be read from anywhere in SRAM, there is a block of data at 5:A001A082 which exists specifically for use in the rankings. With the exception of 5:A016A017, which doesnt seem to be referenced at all, this block comprises 2-, 3-, or 4-byte big-endian values which are managed by a series of functions in bank $41. (Except for the Battle Tower win counter, these functions are still called in the English version in the relevant situations, but theyve been dummied out, and wouldnt work anyway since SRAM bank 5 doesnt exist.)

[table]
[tr][td]Address[/td][td]Length[/td][td]Description[/td][/tr]
[tr][td]A001[/td][td]4[/td][td]Play time when last entered the Hall of Fame (2 bytes hours, 1 byte minutes, 1 byte seconds)[/td][/tr]
[tr][td]A005[/td][td]4[/td][td]Step count when last entered the Hall of Fame[/td][/tr]
[tr][td]A009[/td][td]3[/td][td]Number of times the party was healed when last entered the Hall of Fame[/td][/tr]
[tr][td]A00C[/td][td]1[/td][td]Extraneous byte copied from 5:A03C when last entered the Hall of Fame[/td][/tr]
[tr][td]A00D[/td][td]3[/td][td]Number of battles when last entered the Hall of Fame[/td][/tr]
[tr][td]A010[/td][td]4[/td][td]Step count[/td][/tr]
[tr][td]A014[/td][td]2[/td][td]Number of Battle Tower wins[/td][/tr]
[tr][td]A018[/td][td]3[/td][td]Number of times TMs and HMs have been taught[/td][/tr]
[tr][td]A01B[/td][td]3[/td][td]Number of battles[/td][/tr]
[tr][td]A01E[/td][td]3[/td][td]Number of wild Pokémon battles[/td][/tr]
[tr][td]A021[/td][td]3[/td][td]Number of Trainer battles[/td][/tr]
[tr][td]A024[/td][td]3[/td][td]Unused[/td][/tr]
[tr][td]A027[/td][td]3[/td][td]Number of Hall of Fame inductions[/td][/tr]
[tr][td]A02A[/td][td]3[/td][td]Number of wild Pokémon caught[/td][/tr]
[tr][td]A02D[/td][td]3[/td][td]Number of hooked Pokémon encounters[/td][/tr]
[tr][td]A030[/td][td]3[/td][td]Number of Eggs hatched[/td][/tr]
[tr][td]A033[/td][td]3[/td][td]Number of Pokémon evolved[/td][/tr]
[tr][td]A036[/td][td]3[/td][td]Number of Berries and Apricorns picked[/td][/tr]
[tr][td]A039[/td][td]3[/td][td]Number of times the party is healed[/td][/tr]
[tr][td]A03C[/td][td]3[/td][td]Number of times Mystery Gift is used[/td][/tr]
[tr][td]A03F[/td][td]3[/td][td]Number of trades[/td][/tr]
[tr][td]A042[/td][td]3[/td][td]Number of uses of field move Fly[/td][/tr]
[tr][td]A045[/td][td]3[/td][td]Number of uses of field move Surf[/td][/tr]
[tr][td]A048[/td][td]3[/td][td]Number of uses of field move Waterfall[/td][/tr]
[tr][td]A04B[/td][td]3[/td][td]Number of times the player whited out[/td][/tr]
[tr][td]A04E[/td][td]3[/td][td]Number of Lucky Number Show prizes won[/td][/tr]
[tr][td]A051[/td][td]3[/td][td]Number of Phone calls made and received[/td][/tr]
[tr][td]A054[/td][td]3[/td][td]Unused[/td][/tr]
[tr][td]A057[/td][td]3[/td][td]Number of Colosseum battles[/td][/tr]
[tr][td]A05A[/td][td]3[/td][td]Number of times players Pokémon used Splash[/td][/tr]
[tr][td]A05D[/td][td]3[/td][td]Number of tree Pokémon encounters[/td][/tr]
[tr][td]A060[/td][td]3[/td][td]Unused[/td][/tr]
[tr][td]A063[/td][td]3[/td][td]Number of Colosseum wins[/td][/tr]
[tr][td]A066[/td][td]3[/td][td]Number of Colosseum losses[/td][/tr]
[tr][td]A069[/td][td]3[/td][td]Number of Colosseum ties[/td][/tr]
[tr][td]A06C[/td][td]3[/td][td]Number of times players Pokémon used SelfDestruct or Explosion[/td][/tr]
[tr][td]A06F[/td][td]2[/td][td]Current streak of consecutive slot machine wins[/td][/tr]
[tr][td]A071[/td][td]2[/td][td]Longest streak of consecutive slot machine wins[/td][/tr]
[tr][td]A073[/td][td]4[/td][td]Total coins won from slot machines[/td][/tr]
[tr][td]A077[/td][td]4[/td][td]Total money earned from battles (including Pay Day)[/td][/tr]
[tr][td]A07B[/td][td]2[/td][td]Largest Magikarp measured[/td][/tr]
[tr][td]A07D[/td][td]2[/td][td]Smallest Magikarp measured[/td][/tr]
[tr][td]A07F[/td][td]2[/td][td]Bug-Catching Contest high score[/td][/tr]
[tr][td]A081[/td][td]2[/td][td]Bytewise checksum of A001A080[/td][/tr]
[/table]

There are functions which would increment the three-byte values at 5:A024, 5:A054, and 5:A060, but these functions dont appear to be referenced even in the Japanese version.

5:A039 is incremented when the party is healed at a Pokémon Center, by the machine in Elms Lab, by Mr. Pokémon after giving the Mystery Egg, by Lance in the Rocket Hideout, by the old woman on Route 26, by resting in the bed on the S.S. Aqua, or before a Battle Tower or mobile Colosseum battle. It is not incremented when the party is healed after whiting out, by using a Sacred Ash, after winning or losing the first rival battle in Cherrygrove City, or after defeating the last Rocket Grunt in Slowpoke Well, Sailor Stanly on the S.S. Aqua, Lance at the Pokémon League, or Red at Mt. Silver.

The value from 5:A039 is then copied into 5:A009 when entering the Hall of Fame, but 4 bytes are copied rather than 3, so the high byte of the number of times Mystery Gift was used is copied into 5:A00C. (That byte will still always be $00, because Mystery Gift cant be used more than 65535 times before the SRAM battery runs out. ;))

5:A05A and 5:A06C are incremented when the effect of the move is executed during the players turn, regardless of whether it was chosen by the player, chosen by a disobedient Pokémon, or called through Metronome, Mirror Move, or Sleep Talk.

Save data upload
The game uploads the save data as specified in the metadata file. The body of the servers response is of no consequence.

Rankings upload
The game uploads the rankings data as specified in the metadata file. The server responds with the updated rankings tables. The game saves that data to the address specified in the metadata file. Each table begins with a 12-byte header:

[table]
[tr][td]Offset[/td][td]Length[/td][td]Description[/td][/tr]
[tr][td]$0[/td][td]4[/td][td]Number of ranked players (big-endian)[/td][/tr]
[tr][td]$4[/td][td]2[/td][td]Unknown[/td][/tr]
[tr][td]$6[/td][td]4[/td][td]Players rank (big-endian; will be treated as unranked if this value is greater than the number of ranked players)[/td][/tr]
[tr][td]$A[/td][td]2[/td][td]Number of entries in the table (big-endian)[/td][/tr]
[/table]

The number of ranked players may be greater than the number of entries in the table; e.g., 1000 players might be given ranks (shown only to themselves) even though the table only lists the top 10 (shown to everyone).

Each entry in the table is of the length specified in the metadata file. The first 24 bytes follow a fixed format and the remaining bytes (up to 4?) are the score value.

[table]
[tr][td]Offset[/td][td]Length[/td][td]Description[/td][/tr]
[tr][td]$00[/td][td]7[/td][td]Trainer name[/td][/tr]
[tr][td]$07[/td][td]1[/td][td]Prefecture (values assigned in gojūon order from $01 = Aichi-ken to $2F = Wakayama-ken)[/td][/tr]
[tr][td]$08[/td][td]2[/td][td]Unknown[/td][/tr]
[tr][td]$0A[/td][td]1[/td][td]Age[/td][/tr]
[tr][td]$0B[/td][td]1[/td][td]Gender ($00 = male, $01 = female)[/td][/tr]
[tr][td]$0C[/td][td]12[/td][td]Message (six two-byte little-endian easy chat words)[/td][/tr]
[tr][td]$18[/td][td]?[/td][td]Score (big-endian)[/td][/tr]
[/table]

News download
The game downloads the News issue, stores it at 6:A000, and then executes it.

Based on the historical accounts of Pokémon News (particularly Kakerus transcripts of the last seven issues), which describe various quizzes, minigames, and rewards (including, of course, the GS Ball), it can be surmised that the News involves a scripting language with many different commands. Without access to any of the original News downloads, it could be quite a challenge to determine how the data is packaged and what the available commands are, and then reconstruct something resembling a News issue.



Good news, everyone! Game Freak left us some samples in ROM bank $7D.

There are three unused functions in that bank which each copy a different block of data to 6:A000. If a News issue has already been downloaded, these functions overwrite it with data from the ROM. (If no News had been downloaded, the game will say まのま！ There is no old NEWS when attempting to view it. This can be manually overridden by setting 5:AA72 to $01.)

This data in the ROM does not include any of the metadata or rankings tables, only the main News download. (This means we dont know what data from the save file would be requested by the server, or what message would be displayed before downloading the News.) Also, dispointingly, none of the text of these News issues was translated in Vietnamese Crystal.

Heres a video showing each of the News issues found in the ROM.


Trainer Rankings
A News issue entitled Trainer Rankings appears at 7D:5C6B in the Japanese ROM and at 7D:5DB4 in the localized ROMs. The function to copy this data into SRAM is at 7D:5C56 in the Japanese ROM and at 7D:5D9F in the localized ROMs.

This is the simplest News issue found in the ROM, having no features other than the rankings. It matches the screenshots on pages 2526 of the Pocket Monsters: Crystal Version: Mobile Guide ( のてびき) packaged with the Mobile Adapter GB.

The main menu has four options:
[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]み
View Rankings[/td][td]なみま
View the different rankings.[/td][/tr]
[tr][td]のつ
Rankings Description[/td][td]のつで
A description of the rankings.[/td][/tr]
[tr][td]の
Update Rankings[/td][td]のま
Download the latest rankings.[/td][/tr]
[tr][td]
Quit[/td][td]みのま
Quit viewing the News.[/td][/tr][/table]

The background music for these menus is Elm Pokémon Lab.

Quit (or pressing B) returns to the News Machine menu. Update Rankings downloads the News metadata from the server, and then proceeds to submit the save data and rankings again only if the unique ID of the News issue has not changed. The description of the rankings says:

つので！
まくっ
なににはって
ま！

Rankings in three categories!
Now something from the save file you sent could be in the rankings!


View Rankings brings up a submenu to select from three ranking categories:

In each category, there are three rankings:

The latter two rankings would depend on the prefecture and the three-digit prefix of the postal code entered in the Mobile Profile. If the player has opted not to enter a postal code, its treated as 000 (no actual Japanese postal code starts with 000).

The first of the downloaded rankings tables is expected to contain the national ranking for Colosseum wins, the second one the prefectural ranking for the same, the fourth one the national ranking for the Bug-Catching Contest, et cetera.

Selecting any ranking shows the top 10 entries; for each entry, the trainer name, score, gender, age, prefecture can be seen, as well as the message they set in the Mobile menu. At the bottom of each top-10 ranking, the player can see their own current score (read from the corresponding address in SRAM: 5:A063 for the Colosseum, 5:A07F for the Bug-Catching Contest, and 5:A07B for the largest Magikarp) and ranking (as of the last rankings download, so not necessarily consistent with the score read from SRAM). If the player is not ranked, their score is followed by the message なっね You were not ranked Sorry

The message ま[]のばみとできま There is no rankings data. You can see it by updating the rankings. appears in this News data (and all the other ones, too), but I dont know what circumstances would cause it to appear.

In the Japanese ROM only, there is a near-identical copy of this News data at 7E:4000. (In the localized ROMs, bank $7E instead contains data for the offline Battle Tower and Odd Egg event.) The only difference is that the copy at 7E:4000 is missing four bytes at offset $002. Two of these missing bytes represent the length of the remaining data and the other two bytes are a bytewise checksum of that data. Since the checksum fails, the game refuses to load this version of the data, saying のてま[]みみなてくだ The NEWS data is corrupted. Please download the NEWS again.


Trainer Rankings (bis)
Another News issue entitled Trainer Rankings appears at 7D:4015 in the Japanese ROM and 7D:4018 in the localized ROMs. The corresponding function to copy this data into SRAM is at 7D:4000 in the Japanese ROM and 7D:4003 in the localized ROMs.

The most obvious difference between this News issue and the other one is that the main menu has an additional option called なき Pokémon Cries Quiz, with the description のなきててね！ Guess the Pokémon cries!. The quiz has ten Pokémon to choose from: Suicune, Clefairy, Spearow, Gastly, Togepi, Zubat, Jynx, Espeon, Mewtwo, and Dunsparce. For each one, the player can listen to three different cries and guess which one is the correct cry for that Pokémon. Theres no scoring and no reward for guessing correctly. The background music for the quiz is Hurry Along 2.

The rankings menus have several changes:

The Update Rankings option has beenupdatedto give some feedback after the download: If successful, のま！ Rankings update done! If the news ID has changed, のにっぱみでくだ Rankings update failed Please load the new News. If cancelled by the user (or an error occurs?), のま Rankings update cancelled.

The category Number of Colosseum wins has been replaced by でっ Number of Battle Tower wins. Notably, this ranking tries to read the players score from the unused location 5:A016, rather than the correct address 5:A014.

The local rankings now have the players prefecture and postal code in the title of the rankings (e.g., mine are called ときとの and ０００の because I set my prefecture to Tōkyō-to and didnt set a postal code).

Selecting a blank entry in the top 10 now displays the message にはだてま No one is ranked here.

If the players score in any ranking is checked using the [players name]の option and the player is #1 in that ranking, this message is displayed:

でとっ
なに
てきなま
のみに！

For earning the top spot in the ranking
Here is a wonderful gift! Enjoy!


This triggers the GS Ball event; the player will receive the GS Ball upon leaving the PokéCom Center.


Pokémon News Debug Starting Issue
A News issue entitled Pokémon News Debug Starting Issue appears only in the Japanese ROM at 7D:4DD0.  The function to copy this data into SRAM is at 7D:4DBB.

The main menu options are:
[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]
Trainer Rankings[/td][td]なみま
View the different rankings.[/td][/tr]
[tr][td]なき
Pokémon Cries Quiz[/td][td]のなきててね！
Guess the Pokémon cries![/td][/tr]
[tr][td]の
Message from Game Freak[/td][td]ので
A message from Game Freak.[/td][/tr]
[tr][td]
Quit[/td][td]みのま
Quit viewing the News.[/td][/tr][/table]

Trainer Rankings leads to a submenu identical to the first Trainer Rankings news data. The Pokémon Cries Quiz is identical to the one in the second Trainer Rankings news data. The Message from Game Freak could probably be translated better by someone who knows what theyre doing, but Ill give it a shot:

なきふきぬ
きので
みなまで
っまで

は
まにちみてに
ひだてにぶに
ねくなばなぐ
にてはでま

のはに
つくてま

でのでなきなどで
にな！
とぱは
でま

そではひきつづきの
くねま

ちほのと
くねま


As the refreshing autumn breeze now blows through, is everyone getting along well?

Every day our Crystal Team is striving to finish the game, with our right hands holding our mice, and our left hands clenched in fists to hit each other if we get sleepy.

We made this News for debugging use.

Thus, in the Cries Quiz for example, you dont need to worry about things like, That Pokémons not in the Pokédex!

That said, we ask that you continue with debugging the News.

Of course, wed like you to work on other things as well


This message seems to be directed at Nintendos product testers, which suggests it may have been deliberately included in the final build that Game Freak submitted for testing. The background music for the message is National Park.


Pokémon News First Issue
In the localized ROMs, the Pokémon News Debug Starting Issue is replaced by an entirely different issue entitled そ Pokémon News First Issue, found at 7D:4DD3. The function to copy this data into SRAM is at 7D:4DBE.

The fact that it appears in the localized ROMs and not the Japanese ROM suggests it may have been developed after the Japanese ROM was finalized. The name implies that it could be the actual first issue of Pokémon News that was published when the Mobile System GB launched in January 2001. However, I dont think it is, because it contains the same script as the second Trainer Rankings data for awarding the GS Ball to a player who is #1 in any ranking, and Im not aware of any documentation that the GS Ball was actually distributed in this manner.

The main menu options are:
[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]
News Guide[/td][td]みだにつま
A brief description of the loaded News.[/td][/tr]
[tr][td]
Trainer Rankings[/td][td]つのでま！
Rankings in three categories![/td][/tr]
[tr][td]
Pokémon Cult[/td][td]までのぼどまでだま！
Test how well you remember your adventure so far![/td][/tr]
[tr][td]
Quit[/td][td]みのま
Quit viewing the News.[/td][/tr][/table]

The News Guide says:

そでは
と
で
のみくだ！

なののきは
のば
などできので
ばばにな！

In the Pokémon News First Issue, please enjoy Trainer Rankings and the Pokémon Cult Quiz!

Your rankings can be updated as many times as you like; try your best and you might reach the top!


The Trainer Rankings submenu is pretty much the same as the second Trainer Rankings data (including the GS Ball reward), except that the players score for Number of Battle Tower wins is read from the correct address, 5:A014. The menu items have been rearranged and most of the descriptions rewritten:

[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]み
View Rankings[/td][td]なみま
View the different rankings.[/td][/tr]
[tr][td]の
Update Rankings[/td][td]みみなま
なのきま
Reloads the rankings. Your results will also change.[/td][/tr]
[tr][td]のつ
Rankings Description[/td][td]ののにつてつま
Describes the current rankings categories.[/td][/tr]
[tr][td]
Quit[/td][td]のにどま
Return to the first page.[/td][/tr][/table]

The Rankings Description is more descriptive:

でっは
０ばどので
なまでになにの
とのぶにっ
にできそま

のきは
のみみに
つにはってっ
のちちば
きっのできそま

ととくては
でな
とでまでに
とっちば
てできそま

Number of Battle Tower wins is ranked by the number of trainers youve won battles against so far in the Battle Tower on Route 40.

Size of caught Magikarp is ranked by the largest Magikarp measured by the Fishing Guru at Lake of Rage.

Bug-Catching Contest high score is ranked by the highest score earned so far in the Bug-Catching Contest held in the National Park.


The Pokémon Cult Quiz, unlike the cries quiz, is a proper quiz with scoring. Ten multiple-choice questions are presented in sequence, varying from mildly obscure (Is Moms specialty a Cinnabar Volcano bakemeat burger, curry, or yakisoba?) to incredibly obscure (How many times did Earl spin around before he entered the Pokémon Academy?). After youve answered all of the questions, Professor Oak evaluates your performance, although he doesnt give any reward. The background music during the quiz is Goldenrod Game Corner, and the music for the evaluation is Pokégear Radio: Professor Oaks Pokémon Talk.


News data structure
While I havent yet endeavored to write my own fake news, I have done some basic analysis of the structure of the existing data:

Header
The data has a six-byte header; the first two bytes are [tt]00 A0[/tt], the next two bytes are a bytewise checksum of the data (excluding the header), and the final two bytes are the length of the data (excluding the header). As mentioned above, the duplicate News data at 7E:4000 in the Japanese ROM omits these checksum and length values, and therefore doesnt work in the final game.

Screen data
Data for the opening screen of the News issue begins immediately after the header. Other screens use the same data structure, which may be placed anywhere in the file and called using script command $01.

[table]
[tr][td]Length[/td][td]Description[/td][/tr]
[tr][td]1[/td][td]Background music ID[/td][/tr]
[tr][td]1[/td][td]Number of custom palettes[/td][/tr]
[tr][td]8[/td][td]Custom palette data. Four two-byte color values. Repeat number of custom palettes.[/td][/tr]
[tr][td]1[/td][td]Number of boxes to draw[/td][/tr]
[tr][td]6[/td][td]Box data. The first two bytes are origin x and y coordinates, the next two bytes are length and width, the fifth byte is the border type, and the sixth byte is the palette. Repeat number of boxes to draw.[/td][/tr]
[tr][td]1[/td][td]Number of strings to print[/td][/tr]
[tr][td]?[/td][td]Position to print a string, expressed as an offset into the screen buffer, followed by the string itself ($50-terminated). Repeat number of strings to print.[/td][/tr]
[tr][td]12[/td][td]Menu origin x and y coordinates, number of columns and rows, column width and row height, plus six more bytes of menu parameters?[/td][/tr]
[tr][td]16[/td][td]Offsets to script data for each of the eight joypad buttons (A B Select Start ). These offsets are relative to the start of the current screen data. The value $FFFF is used for a button which has no script.[/td][/tr]
[tr][td]1[/td][td]Number of menu items.[/td][/tr]
[tr][td]4[/td][td]Position to print menu descriptions, expressed as an offset into the screen buffer, and width and height of the area to be blanked before printing a description. (The blanked area begins one row above the given text position, to account for diacritics.)[/td][/tr]
[tr][td]1[/td][td]If not $00, loads the rankings table specified in 0:CD62. (That address should have been set by a script on the prior screen.)[/td][/tr]
[tr][td]2[/td][td]Pointer to the name of each menu item. Repeat number of items.[/td][/tr]
[tr][td]2[/td][td]Pointer to script data for each menu item. Repeat number of items.[/td][/tr]
[tr][td]2[/td][td]Pointer to description text for each menu item. Repeat number of items.[/td][/tr]
[/table]

If anyone wants to have a go at documenting the News script commands, theyre in [tt]Jumptable17d72a[/tt] in pokecrystals misc/mobile_5f.asm. Also of interest is the text character $15, which invokes another, smaller scripting language within a text string; this is used extensively in the Pokémon News data to insert variables into strings. Those commands are defined by the jumptable in [tt]Function17f047[/tt].

Re: Emulating the Mobile Adapter GB

Posted by: ravioli
Date: 2017-08-16 10:48:30
Cool! I've backed up all your documentation on http://42chan.org/mgb/gb.html. I always have a server if you need it for emulating the GB adapter..