Game:

Pokémon Red and Blue (1996)

Category:

Let's Play

Duration: 6:39

15,074 views

280

Read description for more information:

It is possible to have Pokémon Red play itself by making it press random buttons determined by the first D-sum byte, with bit 2 disabled (to disable the select button) with either memory hacking or arbitrary code execution with 8F (or -g m maybe). This does not work in Super Game Boy mode, sadly.

Thank you to luckytyphlosion for making a memory hacking method for "RNG plays Pokémon".

His method is:

At FF86, write "jr FFF9".
At FFF9, write "dec a" ; decrease 'a' by 1
At FFFA, write "jr nz, FFF9" ; if 'a' is not 00, go back to FFF9. The processor will only go to the next line when 'a' has been decreased to 00, and this takes a little time for the processor. This delay is needed for "DMA to complete". I don't know exactly what that means, but if you omit dec a jr nz,FFF9 from the code, it won't work on a real Game Boy, even though it can work on an emulator due to emulation error.
At FFFC, write "jp D34A" ; our main code is stored here at the Rival's name, which can never be changed in normal gameplay after it has been chosen. Use a different region if you want, but it shouldn't be a region that would change during the code flow.

At D34A, write "ld a,(FFD3)" ; a=random "D-sum" byte 1 number.
At D34D, write "ld (FFF8),a" ; put a into FFF8, which controls what buttons are being pressed.
At D350, write "ret" ; Don't execute any code after D350.

Thanks to TheZZAZZGlitch for arbitrary code execution with 8F and his method for executing "large" programs (https://www.youtube.com/watch?v=D3EvpRHL_vk), I made it so you can do this without cheating, even though it's a little tricky.

You need a bootstrap code to the items pack (as always), such as this one to item 3 http://forums.glitchcity.info/index.php/topic,6638.msg194471.html#msg194471 and certain items.

Assuming you redirect the code to item 3; you can prepare these items, (copy and pasted from TheZZAZZGlitch's jailbreaking the Game Boy video and edited slightly):

Item list from item 1:
Bicycle (or Max Repel)
8F
X Accuracy, x97
Burn Heal, x126
Parlyz Heal, x15
HP UP, x15
Ice Heal, x15
Potion, x134
TM34, x20
TM17, x46
Leaf Stone, x52
Great Ball, x201
TM10, x1
TM15, x46

Swap TM17 x46 with TM15 x46, use 8F and jump off a ledge to walk through walls.
Then swap TM17 and TM15 back, toss TM34 until only one of them remains and use a Bicycle. The program is now in entering mode, and upon using 8F one byte is written, with its value depending on your X and Y positions.
To run the created code, swap TM10 x1 with TM34 and use 8F.

When the program is in "entering mode", using 8F will write data to D901 and onward, with the most significant nybble being taken from the y coordinate and the least significant nybble being taken from the x coordinate, so if you want 3E, y must equal 3 and x must equal E (dec:14).

You need to place the following code at D901 by using 8F a total of 59 times at different coordinates:

3E F0 EA 1E D3 26 D3 2E 4A 22 3E D3 22 3E CB 22 3E 97 22 3E E0 22 3E F8 22 3E C9 22
26 FF 2E 86 3E 18 22 3E 71 22 2E F9 3E 3D 22 3E 20 22 3E FD 22 3E C3 22 3E 4A 22 3E D3 22 C9

If you're hacking, you can place it at D53B (stored item 1) and get there with 8F with a jp D53B at item 3 (C3 3B D5), then use 8F. It's more convenient this way, but you'll get crazy PC items that would probably be impossible to get.

I was going to try to get reasonable PC items, but decided not.

The code as ASM (commented):
Part 1:
ld a,F0
ld (D31E),a - Just replaces 8F with a TM40 if it is in the first position so you don't risk the game causing a freeze with 8F in someway. This line can be omitted. If you want to make it a Helix Fossil use ld a,2A instead of ld a,F0, but you'd need to place ld a,F0 after this line.
ld h,D3
ld l,4A ; hl=D34A (rival's name)
ldi (hl),a ; F0 into D34A
ld a,D3
ldi (hl),a ; D3 into D34B
ld a,CB
ldi (hl),a ; CB into D34C
ld a,97
ldi (hl),a ; 97 into D34D
ld a,E0
ldi (hl),a ; E0 into D34E
ld a,F8
ldi (hl),a ; F8 into D34F
ld a,C9
ldi (hl),a ; C9 into D350

This is effectively the following memory editing method.

At D34A, write "ld a,(FFD3)"
At D34C, write "res 2,a"
At D34E, write "ld (FFF8),a"
At D350, write "ret"

Note the slightly different places to place the code. With the E0 xx instruction (ld $FFxx, a) and the F0 xx instruction (ld a, $FFxx), you can save space. There is also an added CB 97 (res 2,a) which removes bit 2 of the randomized button value, to disable the select button.

Part 2 (at D71D):
ld h,FF
ld l,86 ; hl = FF86 - some HRAM value
ld a,18
ldi (hl),a; store 18h at FF86, after, hl= FF87
ld a,71
ldi (hl),a; store 71h at FF87, after, hl= FF88
ld l,F9 ; hl=FFF9 after
ld a,3D
ldi (hl),a; 3D into FFF9
ld a,20
ldi (hl),a ; 20 into FFFA
ld a,FD
ldi (hl),a ; FD into FFFB
ld a,C3
ldi (hl),a ; C3 into FFFC
ld a,4A
ldi (hl),a ; 4A into FFFD
ld a,D3
ldi (hl),a ; D3 into FFFE

What this does:
At FF86, write "jr FFF9".
At FFF9, write "dec a"
At FFFA, write "jr nz, FFF9"
At FFFC, write "jp D34A"

Other Statistics