Glitch City Laboratories Archives

Apparently there is a Discord for Mobile Adapter stuff according to an article by Shonumi (this link is a great read by the way). Perhaps some of us could join it in an effort to reverse the other Mobile Adapter supported Game Boy Color/Game Boy Advance games (originally documented by rikkyjp), but I don't know the link sadly.

Apparently there is a Discord for Mobile Adapter stuff according to an article by Shonumi (this link is a great read by the way). Perhaps some of us could join it in an effort to reverse the other Mobile Adapter supported Game Boy Color/Game Boy Advance games (originally documented by rikkyjp), but I don't know the link sadly.

Bumping this because of good news and progress. Before I say, the link is above, but I'll paste it here for you: https://discord.gg/vHwmNBY


Anyways, we are testing a web server and today got a trade done using the Pokecom services. Got a video here: https://twitter.com/_Incineroar/status/1162502177149132800?s=19

Okay, tomorrow was two days ago, but I have this silly, old-fashioned obsession with factual accuracy and needed to recheck a bunch of things. I guess it would be easier if I posted more often :)

Question: If we connect to a server from a client, but it's over Dial-Up, is it still technically considered to be running on an actual adapter and therefore valid in TAS?

I think more research is needed to determine accurate timings for the adapter ;D

---

[size=12pt]HTTP authentication scheme[/size]
Nintendos mobile library will attempt to authenticate the user with the Mobile System GB server only when a POST request is made for [tt]http://gameboy.datacenter.ne.jp/cgb/upload[/tt] or [tt]http://gameboy.datacenter.ne.jp/cgb/ranking[/tt], and only if the filename at the end of the URI begins with a number indicating a service fee (even if its ¥0).

Even when those conditions are met, the library has a bug that can cause it to fail to detect whether authentication is required:

; Find the string terminator at the end of the URI
.asm_1112a0
ld a, [hli]
or a
jr nz, .asm_1112a0

; Now back up and find the last slash
; Right now, hl points to the byte *after* the string terminator!
; If that byte happens to be a slash ($2F), this code may
; fail to properly detect whether this is a paid upload.
; There ought to be a dec hl here.
.asm_1112a4
ld a, [hld]
cp $2f
jr nz, .asm_1112a4

Since Pokémon Crystal does not erase the last URI in memory before writing the next in a series of requests, it is possible that the residual byte after the string terminator could be a slash if a previous URI was longer than the current one. A careful choice of URIs avoids this issue.

An authentication attempt begins by sending an HTTP GET request, to which the server responds with [tt]401 Unauthorized[/tt] and a [tt]WWW-Authenticate: GB00 name=""[/tt] header, where the [tt]name[/tt] is an arbitrary 36-byte value encoded in Base64.

The game then sends another GET request, this time with the header [tt]Authorization: GB00 name=""[/tt], where the [tt]name[/tt] is a concatenation of two separate Base64-encoded values: the first is the first 32 bytes from the [tt]WWW-Authenticate[/tt] name, and the second is a 36-byte value determined by a byzantine procedure:

[li]The login password is appended to the 48-character Base64-encoded [tt]WWW-Authenticate[/tt] name, and then this string is hashed with MD5.[/li]
[li]The 36-byte [tt]WWW-Authenticate[/tt] value is split into two 18-byte values, the first containing all of the even-numbered bits of the original and the second containing all of the odd-numbered bits. The first byte of each two-byte pair fills the most significant bits of each output byte, and the second byte fills the least significant bits. These values are concatenated into a new 36-byte string.[/li]
[li]The login ID is appended to the MD5 hash from step 1. This string is padded with $FF until it is 35 bytes long, then a $00 is added to make it 36 bytes.[/li]
[li]The 36-byte strings produced in steps 2 and 3 are xord.[/li]
[li]But that would have been too simple, so then each byte has bits 0, 3, and 6 rotated into bits 3, 6, and 0.[/li]

The first step necessitates that the server retains users plaintext passwords in order to calculate arbitrary MD5 hashes from themunless the value in the [tt]WWW-Authenticate[/tt] header is predetermined, which would allow the hash to be precalculated, but would make the rest of this shell game even more pointless as a successful authentication attempt could be replayed.

If the [tt]Authorization[/tt] header is valid, the server responds with [tt]200 OK[/tt] and a [tt]Gb-Auth-ID[/tt] header which contains an arbitrary string. The game then sends its POST request and includes the same [tt]Gb-Auth-ID[/tt] header.


[size=12pt]Pokémon News[/size]
A Pokémon News download begins by accessing [tt]http://gameboy.datacenter.ne.jp/cgb/download?name=/01/CGB-BXTJ/news/index.txt[/tt], a text file containing four URIs which are used to:

[li]Download metadata for the current News issue[/li]
[li]Upload selected data from the save file[/li]
[li]Upload scores to be added to the rankings, and receive the updated rankings in response[/li]
[li]Download the current News issue[/li]

The cost of Pokémon News was ¥100 per issue. The fourth URI should be tagged with that cost so that it is displayed by the game; the two upload URIs should be tagged with a cost of ¥0 so that the game will authenticate and upload the data.


Metadata
The metadata file is an unstructured hodgepodge of variable-length fields, the boundaries of which can only be determined by parsing each field in its own unique way. In typical Game Freak style, the game makes no effort to validate the data received from the server or protect against buffer overflows. A malformed metadata file can certainly crash the game and corrupt the save file (Ive done it more than once), and could probably execute arbitrary code.

Unique ID: This is a fixed-width field which, inexplicably, is 12 bytes long. If this ID is the same as the last News that was downloaded, then the download is aborted with the message はまで There was no new News.

Description: A text string, terminated with $50, that is displayed in the lower text box when the player is asked to confirm whether he or she wants to upload the save data and proceed with the News download.

Rankings save address: This 2-byte field contains the address where the rankings data will be stored in SRAM bank 6. Since the main News data will be written starting at 6:A000, the rankings data should be placed somewhere around 6:B000, such that the News does not overwrite the rankings.

Rankings metadata: This field begins with a 16-bit value denoting the length of the data that follows. The data is a series of 16-bit values, one for each rankings table that will be sent, indicating the width of a record in each rankings table. (For example, if there are 9 different rankings tables and each table contains 26-byte records, this field would be [tt]12 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00 1A 00[/tt].)

Save data selection: This is a list of the regions of save data that will be sent to the server. Each region is specified by four bytes: the first byte is an SRAM bank, the second and third are an address, and the fourth is the number of bytes to send. The end of the list is marked with $FF. The requested data is concatenated and uploaded as a binary file.

Rankings data selection: This specifies the data that will be submitted for the rankings. The rankings data is submitted as keyvalue pairs in the manner of an HTML form submission, with the values encoded in ASCII hexadecimal. Each key is a string literal (in ASCII?) terminated with $50 (ASCII [tt]"P"[/tt]). Each value is specified with a bank number, address, and length in the same manner as the save data upload. The list of keyvalue pairs is terminated with $50 (i.e., an empty string where the name of the next key would be expected).

Although data can technically be read from anywhere in SRAM, there is a block of data at 5:A001A082 which exists specifically for use in the rankings. With the exception of 5:A016A017, which doesnt seem to be referenced at all, this block comprises 2-, 3-, or 4-byte big-endian values which are managed by a series of functions in bank $41. (Except for the Battle Tower win counter, these functions are still called in the English version in the relevant situations, but theyve been dummied out, and wouldnt work anyway since SRAM bank 5 doesnt exist.)

[table]
[tr][td]Address[/td][td]Length[/td][td]Description[/td][/tr]
[tr][td]A001[/td][td]4[/td][td]Play time when last entered the Hall of Fame (2 bytes hours, 1 byte minutes, 1 byte seconds)[/td][/tr]
[tr][td]A005[/td][td]4[/td][td]Step count when last entered the Hall of Fame[/td][/tr]
[tr][td]A009[/td][td]3[/td][td]Number of times the party was healed when last entered the Hall of Fame[/td][/tr]
[tr][td]A00C[/td][td]1[/td][td]Extraneous byte copied from 5:A03C when last entered the Hall of Fame[/td][/tr]
[tr][td]A00D[/td][td]3[/td][td]Number of battles when last entered the Hall of Fame[/td][/tr]
[tr][td]A010[/td][td]4[/td][td]Step count[/td][/tr]
[tr][td]A014[/td][td]2[/td][td]Number of Battle Tower wins[/td][/tr]
[tr][td]A018[/td][td]3[/td][td]Number of times TMs and HMs have been taught[/td][/tr]
[tr][td]A01B[/td][td]3[/td][td]Number of battles[/td][/tr]
[tr][td]A01E[/td][td]3[/td][td]Number of wild Pokémon battles[/td][/tr]
[tr][td]A021[/td][td]3[/td][td]Number of Trainer battles[/td][/tr]
[tr][td]A024[/td][td]3[/td][td]Unused[/td][/tr]
[tr][td]A027[/td][td]3[/td][td]Number of Hall of Fame inductions[/td][/tr]
[tr][td]A02A[/td][td]3[/td][td]Number of wild Pokémon caught[/td][/tr]
[tr][td]A02D[/td][td]3[/td][td]Number of hooked Pokémon encounters[/td][/tr]
[tr][td]A030[/td][td]3[/td][td]Number of Eggs hatched[/td][/tr]
[tr][td]A033[/td][td]3[/td][td]Number of Pokémon evolved[/td][/tr]
[tr][td]A036[/td][td]3[/td][td]Number of Berries and Apricorns picked[/td][/tr]
[tr][td]A039[/td][td]3[/td][td]Number of times the party is healed[/td][/tr]
[tr][td]A03C[/td][td]3[/td][td]Number of times Mystery Gift is used[/td][/tr]
[tr][td]A03F[/td][td]3[/td][td]Number of trades[/td][/tr]
[tr][td]A042[/td][td]3[/td][td]Number of uses of field move Fly[/td][/tr]
[tr][td]A045[/td][td]3[/td][td]Number of uses of field move Surf[/td][/tr]
[tr][td]A048[/td][td]3[/td][td]Number of uses of field move Waterfall[/td][/tr]
[tr][td]A04B[/td][td]3[/td][td]Number of times the player whited out[/td][/tr]
[tr][td]A04E[/td][td]3[/td][td]Number of Lucky Number Show prizes won[/td][/tr]
[tr][td]A051[/td][td]3[/td][td]Number of Phone calls made and received[/td][/tr]
[tr][td]A054[/td][td]3[/td][td]Unused[/td][/tr]
[tr][td]A057[/td][td]3[/td][td]Number of Colosseum battles[/td][/tr]
[tr][td]A05A[/td][td]3[/td][td]Number of times players Pokémon used Splash[/td][/tr]
[tr][td]A05D[/td][td]3[/td][td]Number of tree Pokémon encounters[/td][/tr]
[tr][td]A060[/td][td]3[/td][td]Unused[/td][/tr]
[tr][td]A063[/td][td]3[/td][td]Number of Colosseum wins[/td][/tr]
[tr][td]A066[/td][td]3[/td][td]Number of Colosseum losses[/td][/tr]
[tr][td]A069[/td][td]3[/td][td]Number of Colosseum ties[/td][/tr]
[tr][td]A06C[/td][td]3[/td][td]Number of times players Pokémon used SelfDestruct or Explosion[/td][/tr]
[tr][td]A06F[/td][td]2[/td][td]Current streak of consecutive slot machine wins[/td][/tr]
[tr][td]A071[/td][td]2[/td][td]Longest streak of consecutive slot machine wins[/td][/tr]
[tr][td]A073[/td][td]4[/td][td]Total coins won from slot machines[/td][/tr]
[tr][td]A077[/td][td]4[/td][td]Total money earned from battles (including Pay Day)[/td][/tr]
[tr][td]A07B[/td][td]2[/td][td]Largest Magikarp measured[/td][/tr]
[tr][td]A07D[/td][td]2[/td][td]Smallest Magikarp measured[/td][/tr]
[tr][td]A07F[/td][td]2[/td][td]Bug-Catching Contest high score[/td][/tr]
[tr][td]A081[/td][td]2[/td][td]Bytewise checksum of A001A080[/td][/tr]
[/table]

There are functions which would increment the three-byte values at 5:A024, 5:A054, and 5:A060, but these functions dont appear to be referenced even in the Japanese version.

5:A039 is incremented when the party is healed at a Pokémon Center, by the machine in Elms Lab, by Mr. Pokémon after giving the Mystery Egg, by Lance in the Rocket Hideout, by the old woman on Route 26, by resting in the bed on the S.S. Aqua, or before a Battle Tower or mobile Colosseum battle. It is not incremented when the party is healed after whiting out, by using a Sacred Ash, after winning or losing the first rival battle in Cherrygrove City, or after defeating the last Rocket Grunt in Slowpoke Well, Sailor Stanly on the S.S. Aqua, Lance at the Pokémon League, or Red at Mt. Silver.

The value from 5:A039 is then copied into 5:A009 when entering the Hall of Fame, but 4 bytes are copied rather than 3, so the high byte of the number of times Mystery Gift was used is copied into 5:A00C. (That byte will still always be $00, because Mystery Gift cant be used more than 65535 times before the SRAM battery runs out. ;))

5:A05A and 5:A06C are incremented when the effect of the move is executed during the players turn, regardless of whether it was chosen by the player, chosen by a disobedient Pokémon, or called through Metronome, Mirror Move, or Sleep Talk.

Save data upload
The game uploads the save data as specified in the metadata file. The body of the servers response is of no consequence.

Rankings upload
The game uploads the rankings data as specified in the metadata file. The server responds with the updated rankings tables. The game saves that data to the address specified in the metadata file. Each table begins with a 12-byte header:

[table]
[tr][td]Offset[/td][td]Length[/td][td]Description[/td][/tr]
[tr][td]$0[/td][td]4[/td][td]Number of ranked players (big-endian)[/td][/tr]
[tr][td]$4[/td][td]2[/td][td]Unknown[/td][/tr]
[tr][td]$6[/td][td]4[/td][td]Players rank (big-endian; will be treated as unranked if this value is greater than the number of ranked players)[/td][/tr]
[tr][td]$A[/td][td]2[/td][td]Number of entries in the table (big-endian)[/td][/tr]
[/table]

The number of ranked players may be greater than the number of entries in the table; e.g., 1000 players might be given ranks (shown only to themselves) even though the table only lists the top 10 (shown to everyone).

Each entry in the table is of the length specified in the metadata file. The first 24 bytes follow a fixed format and the remaining bytes (up to 4?) are the score value.

[table]
[tr][td]Offset[/td][td]Length[/td][td]Description[/td][/tr]
[tr][td]$00[/td][td]7[/td][td]Trainer name[/td][/tr]
[tr][td]$07[/td][td]1[/td][td]Prefecture (values assigned in gojūon order from $01 = Aichi-ken to $2F = Wakayama-ken)[/td][/tr]
[tr][td]$08[/td][td]2[/td][td]Unknown[/td][/tr]
[tr][td]$0A[/td][td]1[/td][td]Age[/td][/tr]
[tr][td]$0B[/td][td]1[/td][td]Gender ($00 = male, $01 = female)[/td][/tr]
[tr][td]$0C[/td][td]12[/td][td]Message (six two-byte little-endian easy chat words)[/td][/tr]
[tr][td]$18[/td][td]?[/td][td]Score (big-endian)[/td][/tr]
[/table]

News download
The game downloads the News issue, stores it at 6:A000, and then executes it.

Based on the historical accounts of Pokémon News (particularly Kakerus transcripts of the last seven issues), which describe various quizzes, minigames, and rewards (including, of course, the GS Ball), it can be surmised that the News involves a scripting language with many different commands. Without access to any of the original News downloads, it could be quite a challenge to determine how the data is packaged and what the available commands are, and then reconstruct something resembling a News issue.



Good news, everyone! Game Freak left us some samples in ROM bank $7D.

There are three unused functions in that bank which each copy a different block of data to 6:A000. If a News issue has already been downloaded, these functions overwrite it with data from the ROM. (If no News had been downloaded, the game will say まのま！ There is no old NEWS when attempting to view it. This can be manually overridden by setting 5:AA72 to $01.)

This data in the ROM does not include any of the metadata or rankings tables, only the main News download. (This means we dont know what data from the save file would be requested by the server, or what message would be displayed before downloading the News.) Also, dispointingly, none of the text of these News issues was translated in Vietnamese Crystal.

Heres a video showing each of the News issues found in the ROM.


Trainer Rankings
A News issue entitled Trainer Rankings appears at 7D:5C6B in the Japanese ROM and at 7D:5DB4 in the localized ROMs. The function to copy this data into SRAM is at 7D:5C56 in the Japanese ROM and at 7D:5D9F in the localized ROMs.

This is the simplest News issue found in the ROM, having no features other than the rankings. It matches the screenshots on pages 2526 of the Pocket Monsters: Crystal Version: Mobile Guide ( のてびき) packaged with the Mobile Adapter GB.

The main menu has four options:
[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]み
View Rankings[/td][td]なみま
View the different rankings.[/td][/tr]
[tr][td]のつ
Rankings Description[/td][td]のつで
A description of the rankings.[/td][/tr]
[tr][td]の
Update Rankings[/td][td]のま
Download the latest rankings.[/td][/tr]
[tr][td]
Quit[/td][td]みのま
Quit viewing the News.[/td][/tr][/table]

The background music for these menus is Elm Pokémon Lab.

Quit (or pressing B) returns to the News Machine menu. Update Rankings downloads the News metadata from the server, and then proceeds to submit the save data and rankings again only if the unique ID of the News issue has not changed. The description of the rankings says:

つので！
まくっ
なににはって
ま！

Rankings in three categories!
Now something from the save file you sent could be in the rankings!

View Rankings brings up a submenu to select from three ranking categories:

[li]でっ Number of Colosseum wins[/li]
[li]ととくて Bug-Catching Contest high score[/li]
[li]つっのき Size of caught Magikarp[/li]

In each category, there are three rankings:

[li]くの National ranking[/li]
[li]とどふの Prefectural ranking[/li]
[li]びばの Postal code ranking[/li]

The latter two rankings would depend on the prefecture and the three-digit prefix of the postal code entered in the Mobile Profile. If the player has opted not to enter a postal code, its treated as 000 (no actual Japanese postal code starts with 000).

The first of the downloaded rankings tables is expected to contain the national ranking for Colosseum wins, the second one the prefectural ranking for the same, the fourth one the national ranking for the Bug-Catching Contest, et cetera.

Selecting any ranking shows the top 10 entries; for each entry, the trainer name, score, gender, age, prefecture can be seen, as well as the message they set in the Mobile menu. At the bottom of each top-10 ranking, the player can see their own current score (read from the corresponding address in SRAM: 5:A063 for the Colosseum, 5:A07F for the Bug-Catching Contest, and 5:A07B for the largest Magikarp) and ranking (as of the last rankings download, so not necessarily consistent with the score read from SRAM). If the player is not ranked, their score is followed by the message なっね You were not ranked Sorry

The message ま[]のばみとできま There is no rankings data. You can see it by updating the rankings. appears in this News data (and all the other ones, too), but I dont know what circumstances would cause it to appear.

In the Japanese ROM only, there is a near-identical copy of this News data at 7E:4000. (In the localized ROMs, bank $7E instead contains data for the offline Battle Tower and Odd Egg event.) The only difference is that the copy at 7E:4000 is missing four bytes at offset $002. Two of these missing bytes represent the length of the remaining data and the other two bytes are a bytewise checksum of that data. Since the checksum fails, the game refuses to load this version of the data, saying のてま[]みみなてくだ The NEWS data is corrupted. Please download the NEWS again.


Trainer Rankings (bis)
Another News issue entitled Trainer Rankings appears at 7D:4015 in the Japanese ROM and 7D:4018 in the localized ROMs. The corresponding function to copy this data into SRAM is at 7D:4000 in the Japanese ROM and 7D:4003 in the localized ROMs.

The most obvious difference between this News issue and the other one is that the main menu has an additional option called なき Pokémon Cries Quiz, with the description のなきててね！ Guess the Pokémon cries!. The quiz has ten Pokémon to choose from: Suicune, Clefairy, Spearow, Gastly, Togepi, Zubat, Jynx, Espeon, Mewtwo, and Dunsparce. For each one, the player can listen to three different cries and guess which one is the correct cry for that Pokémon. Theres no scoring and no reward for guessing correctly. The background music for the quiz is Hurry Along 2.

The rankings menus have several changes:

The Update Rankings option has beenupdatedto give some feedback after the download: If successful, のま！ Rankings update done! If the news ID has changed, のにっぱみでくだ Rankings update failed Please load the new News. If cancelled by the user (or an error occurs?), のま Rankings update cancelled.

The category Number of Colosseum wins has been replaced by でっ Number of Battle Tower wins. Notably, this ranking tries to read the players score from the unused location 5:A016, rather than the correct address 5:A014.

The local rankings now have the players prefecture and postal code in the title of the rankings (e.g., mine are called ときとの and ０００の because I set my prefecture to Tōkyō-to and didnt set a postal code).

Selecting a blank entry in the top 10 now displays the message にはだてま No one is ranked here.

If the players score in any ranking is checked using the [players name]の option and the player is #1 in that ranking, this message is displayed:

でとっ
なに
てきなま
のみに！

For earning the top spot in the ranking
Here is a wonderful gift! Enjoy!

This triggers the GS Ball event; the player will receive the GS Ball upon leaving the PokéCom Center.


Pokémon News Debug Starting Issue
A News issue entitled Pokémon News Debug Starting Issue appears only in the Japanese ROM at 7D:4DD0.  The function to copy this data into SRAM is at 7D:4DBB.

The main menu options are:
[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]
Trainer Rankings[/td][td]なみま
View the different rankings.[/td][/tr]
[tr][td]なき
Pokémon Cries Quiz[/td][td]のなきててね！
Guess the Pokémon cries![/td][/tr]
[tr][td]の
Message from Game Freak[/td][td]ので
A message from Game Freak.[/td][/tr]
[tr][td]
Quit[/td][td]みのま
Quit viewing the News.[/td][/tr][/table]

Trainer Rankings leads to a submenu identical to the first Trainer Rankings news data. The Pokémon Cries Quiz is identical to the one in the second Trainer Rankings news data. The Message from Game Freak could probably be translated better by someone who knows what theyre doing, but Ill give it a shot:

なきふきぬ
きので
みなまで
っまで

は
まにちみてに
ひだてにぶに
ねくなばなぐ
にてはでま

のはに
つくてま

でのでなきなどで
にな！
とぱは
でま

そではひきつづきの
くねま

ちほのと
くねま


As the refreshing autumn breeze now blows through, is everyone getting along well?

Every day our Crystal Team is striving to finish the game, with our right hands holding our mice, and our left hands clenched in fists to hit each other if we get sleepy.

We made this News for debugging use.

Thus, in the Cries Quiz for example, you dont need to worry about things like, That Pokémons not in the Pokédex!

That said, we ask that you continue with debugging the News.

Of course, wed like you to work on other things as well

This message seems to be directed at Nintendos product testers, which suggests it may have been deliberately included in the final build that Game Freak submitted for testing. The background music for the message is National Park.


Pokémon News First Issue
In the localized ROMs, the Pokémon News Debug Starting Issue is replaced by an entirely different issue entitled そ Pokémon News First Issue, found at 7D:4DD3. The function to copy this data into SRAM is at 7D:4DBE.

The fact that it appears in the localized ROMs and not the Japanese ROM suggests it may have been developed after the Japanese ROM was finalized. The name implies that it could be the actual first issue of Pokémon News that was published when the Mobile System GB launched in January 2001. However, I dont think it is, because it contains the same script as the second Trainer Rankings data for awarding the GS Ball to a player who is #1 in any ranking, and Im not aware of any documentation that the GS Ball was actually distributed in this manner.

The main menu options are:
[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]
News Guide[/td][td]みだにつま
A brief description of the loaded News.[/td][/tr]
[tr][td]
Trainer Rankings[/td][td]つのでま！
Rankings in three categories![/td][/tr]
[tr][td]
Pokémon Cult[/td][td]までのぼどまでだま！
Test how well you remember your adventure so far![/td][/tr]
[tr][td]
Quit[/td][td]みのま
Quit viewing the News.[/td][/tr][/table]

The News Guide says:

そでは
と
で
のみくだ！

なののきは
のば
などできので
ばばにな！

In the Pokémon News First Issue, please enjoy Trainer Rankings and the Pokémon Cult Quiz!

Your rankings can be updated as many times as you like; try your best and you might reach the top!

The Trainer Rankings submenu is pretty much the same as the second Trainer Rankings data (including the GS Ball reward), except that the players score for Number of Battle Tower wins is read from the correct address, 5:A014. The menu items have been rearranged and most of the descriptions rewritten:

[table][tr][td]Name[/td][td]Description[/td][/tr]
[tr][td]み
View Rankings[/td][td]なみま
View the different rankings.[/td][/tr]
[tr][td]の
Update Rankings[/td][td]みみなま
なのきま
Reloads the rankings. Your results will also change.[/td][/tr]
[tr][td]のつ
Rankings Description[/td][td]ののにつてつま
Describes the current rankings categories.[/td][/tr]
[tr][td]
Quit[/td][td]のにどま
Return to the first page.[/td][/tr][/table]

The Rankings Description is more descriptive:

でっは
０ばどので
なまでになにの
とのぶにっ
にできそま

のきは
のみみに
つにはってっ
のちちば
きっのできそま

ととくては
でな
とでまでに
とっちば
てできそま

Number of Battle Tower wins is ranked by the number of trainers youve won battles against so far in the Battle Tower on Route 40.

Size of caught Magikarp is ranked by the largest Magikarp measured by the Fishing Guru at Lake of Rage.

Bug-Catching Contest high score is ranked by the highest score earned so far in the Bug-Catching Contest held in the National Park.

The Pokémon Cult Quiz, unlike the cries quiz, is a proper quiz with scoring. Ten multiple-choice questions are presented in sequence, varying from mildly obscure (Is Moms specialty a Cinnabar Volcano bakemeat burger, curry, or yakisoba?) to incredibly obscure (How many times did Earl spin around before he entered the Pokémon Academy?). After youve answered all of the questions, Professor Oak evaluates your performance, although he doesnt give any reward. The background music during the quiz is Goldenrod Game Corner, and the music for the evaluation is Pokégear Radio: Professor Oaks Pokémon Talk.


News data structure
While I havent yet endeavored to write my own fake news, I have done some basic analysis of the structure of the existing data:

Header
The data has a six-byte header; the first two bytes are [tt]00 A0[/tt], the next two bytes are a bytewise checksum of the data (excluding the header), and the final two bytes are the length of the data (excluding the header). As mentioned above, the duplicate News data at 7E:4000 in the Japanese ROM omits these checksum and length values, and therefore doesnt work in the final game.

Screen data
Data for the opening screen of the News issue begins immediately after the header. Other screens use the same data structure, which may be placed anywhere in the file and called using script command $01.

[table]
[tr][td]Length[/td][td]Description[/td][/tr]
[tr][td]1[/td][td]Background music ID[/td][/tr]
[tr][td]1[/td][td]Number of custom palettes[/td][/tr]
[tr][td]8[/td][td]Custom palette data. Four two-byte color values. Repeat number of custom palettes.[/td][/tr]
[tr][td]1[/td][td]Number of boxes to draw[/td][/tr]
[tr][td]6[/td][td]Box data. The first two bytes are origin x and y coordinates, the next two bytes are length and width, the fifth byte is the border type, and the sixth byte is the palette. Repeat number of boxes to draw.[/td][/tr]
[tr][td]1[/td][td]Number of strings to print[/td][/tr]
[tr][td]?[/td][td]Position to print a string, expressed as an offset into the screen buffer, followed by the string itself ($50-terminated). Repeat number of strings to print.[/td][/tr]
[tr][td]12[/td][td]Menu origin x and y coordinates, number of columns and rows, column width and row height, plus six more bytes of menu parameters?[/td][/tr]
[tr][td]16[/td][td]Offsets to script data for each of the eight joypad buttons (A B Select Start ). These offsets are relative to the start of the current screen data. The value $FFFF is used for a button which has no script.[/td][/tr]
[tr][td]1[/td][td]Number of menu items.[/td][/tr]
[tr][td]4[/td][td]Position to print menu descriptions, expressed as an offset into the screen buffer, and width and height of the area to be blanked before printing a description. (The blanked area begins one row above the given text position, to account for diacritics.)[/td][/tr]
[tr][td]1[/td][td]If not $00, loads the rankings table specified in 0:CD62. (That address should have been set by a script on the prior screen.)[/td][/tr]
[tr][td]2[/td][td]Pointer to the name of each menu item. Repeat number of items.[/td][/tr]
[tr][td]2[/td][td]Pointer to script data for each menu item. Repeat number of items.[/td][/tr]
[tr][td]2[/td][td]Pointer to description text for each menu item. Repeat number of items.[/td][/tr]
[/table]

If anyone wants to have a go at documenting the News script commands, theyre in [tt]Jumptable17d72a[/tt] in pokecrystals misc/mobile_5f.asm. Also of interest is the text character $15, which invokes another, smaller scripting language within a text string; this is used extensively in the Pokémon News data to insert variables into strings. Those commands are defined by the jumptable in [tt]Function17f047[/tt].

What measures would need to be done to bypass the checksum/could you bypass the check with Game Genie codes? I'm wondering if we could use this to make our own minigames with arbitrary code execution. Like instead of the normal quizzes, theme one around glitch Pokémon.

• If any of the easy chat words have invalid values, all of the trainers messages are replaced by the defaults:
  

  く ? く !
  っ っ ! !!
  く ! ど そ つ

  
  
• If the trainer class is invalid ($00 or $44FF), its replaced with Youngster. (Leader, Rival, Pokémon Prof., Elite Four, Pkmn Trainer, Champion, Rocket, Twins, and Mysticalman are allowed, even though they probably shouldnt be.)
  
• If a Pokémons species is invalid ($00 or $FCFF), its replaced with Smeargle.
  
• If a Pokémons level is less than 2, its raised to level 2. If its greater than the maximum level of this Battle Tower challenge, its reduced to the maximum level.
  
• If a Pokémons first move is blank or invalid ($FCFF), its replaced with Pound and the remaining move slots are cleared. If its second, third, or fourth move is invalid, that move slot is cleared.
  
• As mentioned before, all Pokémons stats are recalculated.
  
• If a Pokémons nickname contains invalid characters ($0104, $1418, $1D25, $3539, $3F, $495F), its renamed to its species name. (The set of accepted characters still includes many characters that are unavailable on the nickname screen.) In any case, the sixth character of the name is overwritten with the termination byte $50.
  
• Then the Pokémons moves are checked again, apparently forgetting that this was already done. If the Pokémons first move were somehow still invalid (but not if it were blank) at this point, it would be replaced by Pound without clearing the rest of the move set. If its second, third, or fourth move is blank or invalid, then it and the subsequent slots are cleared. The net effect of these two checks is that blank or invalid moves and all moves that follow them are cleared, and if a Pokémons first move is blank or invalid, it will only know Pound.
  
• If the trainers name contains invalid characters (using the same list as for Pokémon nicknames), it becomes (Chris/Kris).

だの1人のは績に人の中選ばま
However, the next days first trainer will be selected from among the people who submitted, irrespective of their score.

走ののと水砲と人っ使
そばのとの名はどでとので調べてみと
任天HPのに場て任天
不正置きのだで
で楽にち稼ぐと来ので！の人き！

Against Biker Enomoto, the Pokémon Im using devoured a Water Gun Quagsire.
Come to think of it, Ive heard the name Enomoto somewhere, so I tried looking it up, and
It also appears in the Nintendo websites Battle Tower hands-on preview. Is it a trainer Nintendo prepared?
I wonder if an illegal trainer might have been replaced? Its a mystery.
Thanks to that, I was able to record a comfortable win. With this momentum, I cleared Room 7! First seven-win streak!

^ I know this is an old post, but does the code to actually load Pokémon News remain in English Crystal? What measures would need to be done to bypass the checksum/could you bypass the check with Game Genie codes? I'm wondering if we could use this to make our own minigames with arbitrary code execution. Like instead of the normal quizzes, theme one around glitch Pokémon.

inb4 Mobile Adapter spoofing is an ACE vector
(funnily enough, we could send the vector AND THEN AN ENTIRE PAYLOAD as well from the server if this is indeed an ACE vector.)