TASVideos

Tool-assisted game movies
When human skills are just not enough

Submission #7053: jlun2, MisterChess & CasualPokePlayer's GBC Keitai Denjuu Telefang: Speed Version "game end glitch" in 05:15.98

Console: Game Boy Color
Game name: Keitai Denjuu Telefang: Speed Version
Game version: JPN
ROM filename: Keitai Denjuu Telefang - Speed Version (J) [C][!].gbc
Branch: game end glitch
Emulator: BizHawk 2.5
Movie length: 05:15.98
FrameCount: 18874
Re-record count: 16924
Author's real name:
Author's nickname: jlun2, MisterChess & CasualPokePlayer
Submitter: jlun2
Submitted at: 2021-04-01 00:03:23
Text last edited at: 2021-04-19 11:32:12
Text last edited by: jlun2
Download: Download (5268 bytes)
Status: published
Click to view the actual publication
Submission instructions
Discuss this submission (also rating / voting)
List all submissions by this submitter
List pages on this site that refer to this submission
View submission text history
Back to the submission list
Author's comments and explanations:
It turns out the infamous "Pokemon ripoff" has ACE as well, just like Pokemon.

Game objectives

  • Emulator used: BizHawk 2.5, GB player
  • <List the objectives of your movie here>
  • <Another objective>
  • <And so on>

Comments

I always knew this game could have a game end glitch, but wasn't able to figure out how it worked. After some guidance from CasualPokePlayer, I managed to discover that various NPC ID combinations jump to various parts of the game's memory, leading to crashes. The gameboy player was used, since the previous run relied on an emulator bug regarding STOP (opcode #10 10), so I wanted the run to have a chance to get console verified one day.

While CasualPokePlayer and Mister Chess did not contribute to the input directly, I made them coauthors since they were very helpful in finding out how the NPCs glitched up, while CasualPokePlayer also gave a payload to jump to the controller directly (which unfortunately ended up unused) along with where to jump to.

Map bug

This is the main bug in all iterations of the any% Telefang TAS. When you do the following actions: 1. Open the map with Start 2. Entering a building 3. Trigger a battle

the game writes the bytes for you and the NPCs from WRAM to CartRAM, one byte at a time. Onc the battle is over, or when you close the map, the values are written back to WRAM. Given enough lag however, the game fails to write all the addresses. In the case for this run:

  5F47:  1A        LD   A,(DE)         A:a3 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3  Cy:1320480764
  5F48:  22        LD   (HL+),A        A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3  Cy:1320480772
  5F49:  13        INC  DE             A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480780
  5F4A:  0B        DEC  BC             A:00 B:00 C:a3 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480788
  5F4B:  78        LD   A,B            A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480796
  5F4C:  B1        OR   C              A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480800
  5F4D:  20 F8     JR   NZ,5F47h       A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480804
  5F47:  1A        LD   A,(DE)         A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480816
  5F48:  22        LD   (HL+),A        A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480824
  5F49:  13        INC  DE             A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5f LY:37 SP:dff3  Cy:1320480832
  0040:  C3 E7 02  JP   #02E7h         A:db B:00 C:a2 D:c2 E:ff F:00 H:a2 L:5f LY:90 SP:dff1  Cy:1320480860
The process took too long, so it gets interrupted. The reason I call it map bug however, is because that's the only action you can use to trigger this. There's no area where you can trigger either a battle, or enter a room with tons of lag.

While this might seem to indicate you only need lag, I have never managed to trigger this bug without the phone ringing. The phone only rings once every 5 minutes when you have at least 2 Denjuu, so I'm forced to wait 5 minutes.

The very first Telefang TAS took advantage of the game failing to copy my game position to get to the final dungeon. The subsequent TASes uses this bug to get glitched combinations of NPC values to jump to WRAM.

NPCs

The following NPCs are reachable within the first 5 minutes of the game, while also reachable to each other without triggering combat.
Map ID Map Coord NPC 1 NPC 2
4 20 3 76
4 19 207 75
4 19 219 75
4 11 207 73
4 19 219 73
4 11 0 0
4 18 167 75
4 4 104 72
2 60 210 70
2 59 170 70

The addresses for their IDs are: 0xC2BE, 0xC2BF 0xC2DE, 0xC2DF 0xC2FE, 0xC2FF 0xC31E, 0xC31F 0xC33E, 0xC33F

There are more, but these are the ones the above uses. Not every one of them can be mixed together with the map bug. Moving around map coordinates change the address the NPC is on, but since the maps are connected, some only get written to specific addresses. For instance: You start at Map 4, Coord 19. You can only go north and east. The values right now are:

  0xC2BE, 0xC2BF = 207, 75
  0xC2DE, 0xC2DF = 219, 75
  0xC2FE, 0xC2FF = 0,0
  0xC31E, 0xC31F = 0,0
  0xC33E, 0xC33F = 0,0
Going east gives
  0xC2BE, 0xC2BF = 207, 75
  0xC2DE, 0xC2DF = 219, 75
  0xC2FE, 0xC2FF = 3,76
  0xC31E, 0xC31F = 0,0
  0xC33E, 0xC33F = 0,0
Backtracking, then going north gives
  0xC2BE, 0xC2BF = 207, 75
  0xC2DE, 0xC2DF = 219, 75
  0xC2FE, 0xC2FF = 207, 73
  0xC31E, 0xC31F = 219, 73
  0xC33E, 0xC33F = 0,0
As you can see, the IDs: 3, 76 got overwritten. Attempting to reload the NPC only places them to 0xC2BE, 0xC2BF. This means there's no way to get addresses
  0xC2DE, 0xC2DF,
  0xC31E, 0xC31F,
  0xC33E, 0xC33F
to have the values of 3, 76.

Similarrly, there's no way to get the values of 3, 76 to be at 0xC2BE, 0xC2BF. This restricts me to only 1 room possible for the bug.

Possible values for 0xC2BE, 0xC2BF

  0, 0 (By resetting)
  3, 76
  104, 72
  167, 75
  170, 70
  207, 73
  207, 75
Possible values for 0xC2DE, 0xC2DF
  0, 0
  207, 75
  210, 70
  219, 73
  219, 75
Possible values for 0xC2FE, 0xC2FF
  0, 0
  3, 76
  207, 73
  219, 75
Possible values for 0xC31E, 0xC31F
  0, 0 (By resetting)
  207, 75
  219, 73

Collision effects

If 2 NPC IDs can exist at the same pair of addresses, it's possible to get a combination of them using the map bug. The following collisions are possible:

3, 0 -> The NPC starts floating up and down. They cannot be talked to.
3, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD
3, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD
3, 73 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F
3, 75 -> Nothing wrong; this is a valid NPC
3, 76 -> Nothing wrong; this is a valid NPC

104, 0 -> Glitches the graphics and lags the game badly.
104, 70 -> They become a Denjuu trainer with a level 0 Tsunonasu
104, 72 -> Nothing wrong; this is a valid NPC
104, 73 -> Spins around in circles
104, 75 -> Crashes at 0x47DA due to 0xE4
104, 76 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F

167, 0 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62.
167, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 75 -> Nothing wrong; this is a valid NPC
167, 76 -> Jumps to 0x84FA via 0xE9 JP (HL) at 0x4EFB, then crashes 1 instruction later by 0xFC

170, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then crashes due to 0xF4
170, 70 -> Nothing wrong; this is a valid NPC
170, 72 -> Nothing wrong; this is a valid NPC
170, 73 -> Makes the NPC run in place. Talkng to them triggers a fight with trainer with 3 Denjuu at level 10
170, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
170, 76 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62. While the values earlier can be slightly manipulated by having different amounts of money, the sequence 0x10 10 is from the character "ル", which is unavoidable. The currently published TAS emulates the instruction wrong by simply ignoring it. Therefore, the currently published route using this combination is impossible.

207, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then eventually jumps to 0xFAFA via 0xE9 JP (HL) at 0x049D before jumping to 0x0000 via 0xE9 JP (HL) at 0xFD12. It gets stuck in a loop at 0x0028 to 0x0030.
207, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
207, 72 -> Nothing wrong; this is a valid NPC
207, 73 -> Nothing wrong; this is a valid NPC
207, 75 -> Nothing wrong; this is a valid NPC
207, 76 -> Jumps to 0x8005 via 0xD9 RETI at 0x0323. It then crashes at 0x8059 via 0xFC.

210, 0 -> The NPC becomes untalkable
210, 70 -> Nothing wrong; this is a valid NPC
210, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
210, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD

219, 0 -> Jumps to 0x0000 via 0xE9 JP (HL) at 0x049D, then gets stuck in a loop from 0x0028 to 0x0030.
219, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). It then gets stuck in a loop from 0x0028 to 0x0030.
219, 73 -> Nothing wrong; this is a valid NPC
219, 75 -> Nothing wrong; this is a valid NPC
219, 76 -> Jumps to 0xC6C9 via 0xE9 JP (HL) at 0x4EFB, then NOP slides to player data at 0xC900

Based on the above, the only useable combination is 219, 76.

Player data

Now that we have a way to jump into player data, we need to document what is possible. 0xC800 region gets set much much later in the game, so for the purpose of the run, everything from 0xC6C9 to 0xC8FF is 0.

All values are in hex:

Address Purpose Values possible during run Opcode
C900 Defaults to 1. Setting to 0 takes me back to start of game human world. 2 makes me fall from sky. Changing from 1 disables menus. 1 LD BC, 5048
C901 Spawn X (where you appear on room load) + X pos on phone use 09-98
C902 Spawn Y (where you appear on room load) + Y pos on phone use 10-80
C903 Acre 93 SUB E
C904 Map ID 04 INC B
C905 Map type 00 NOP
C906 Map Coord 13 INC DE
C907 ?? 02 NOP
C908 ?? 00 NOP
C909 ?? 00 NOP
C90A ?? 00 NOP
C90B ?? 00 NOP
C90C ?? 00 NOP
C90D ?? 00 NOP
C90E ?? 00 NOP
C90F Last visited map coord 0B, 14 DEC BC
Address Purpose Values possible during run Opcode
C910 Money 00-FF Varies
C911 Money 0-4* Varies
C912 Follower sprite ID Varies* Varies
C913 Map Coord 13 INC DE
C914 Map type 04 INC B
C915 Ranges from 0-9 as you go left to right screen 2-9 Varies
C916 Ranges from 0-7 as you go up to down the screen 0-7 Varies
C917 Music? Overworld is 3 03 INC (BC)
C918 ?? 00 NOP
C919 1 if walking. else 0 0 NOP
C91A Idle timer 0 NOP
C91B ?? 00 NOP
C91C ?? 00 NOP
C91D Change to 1 to trigger battle 0 NOP
C91E Set to E0 at start. Changes to F0 in battle E0 LD (FF00 + C0), A
C91F Set to C0 at start. Changing it affects text C0

Address Purpose Values possible during run Opcode
C920 Randomly assigned on start Varies** Varies
C921 Randomly assigned on start Varies** Varies
C922 Goes up on grass 00-3F Varies
C923 Randomly changes ?? Varies
C924 ?? 05 DEC B
C925 ?? 00 NOP
C926 Map ID 04 INC B
C927 Map Coord 13 INC DE
C928 Spawn X (where you appear on room load) + X pos on phone use 09-98 Varies
C929 Spawn Y (where you appear on room load) + Y pos on phone use 10-80 Varies
C92A ?? 00 NOP
C92B ?? 00 NOP
C92C Player Name Character 1 CD Call 3D6A
C92D Player Name Character 2 6A
C92E Player Name Character 3 3D
C92F Player Name Character 4 21 LD HL, 5903

Address Purpose Values possible during run Opcode
C930 Player Name Character 5 03 LD HL, 5903
C931 Player Name Character 6 59
C932 Player Name Character 7 29 ADD HL, HL
C933 Player Name Character 8 E0 LD (FF00 + E0), A
C934 Player Name String Terminator E0
C935 ?? 00 NOP
C936 Sets to 1 at game start 01 LD BC, 1101
C937 Sets to 1 after intro cutscene 01
C938 Frame 00-FF
C9C9 Seconds 04 INC B
C9CA Minutes 05 DEC B
C9CB Hours 00 NOP
C9CC ?? 00 NOP
C9CD ?? 00 NOP
C9CE Sets to 1 at game start 01 LD BC, 0500
C9CF ?? 00

Address Purpose Values possible during run Opcode
C940 Decrements from 5? 05 LD BC, 0500
C941 ?? 00 NOP
C942 ?? 00 NOP
C943 Randomly assigned on start Varies** Varies
C944 ?? 00 NOP
C945 ?? 01 LD BC, 0000
C946 Shop item you picked up 00
C947 Using phone bool 00
C948 Follower X pos on phone use 00-FF Varies
C949 Follower X pos on phone use 00-FF Varies
C94A Follower Y pos on phone use 00-FF Varies
C94B Follower Y pos on phone use 00-FF Varies
C94C Turned to 1 at 1st screen of Denjuu World? 00 NOP
C94D Calling Denjuu name Varies Varies
C94E Calling Denjuu name? Seems to be A0 Varies Varies
C94F Phone timer Varies Varies

*Values for C912

Value Denjuu Opcode
00 Tsunonasu NOP
01 Kochia LD BC, _ _ _ _
02 Oshe LD (BC) A
03 Keshi* INC (BC)
04 Crypto* INC B
05 Monstera DEC B
06 Fungus LD B, _ _
2F Musa CPL
36 Hagumanoki LD (HL), _ _
64 Hiyu LD H, H
67 Gamuru LD H, A
69 Gaultheria LD L, C
6B Kaya LD L, E
6C Denfare LD L, H
82 Beebalm ADD D
83 Salal ADD E
84 Enishida ADD H
92 Ruscus SUB D
94 Zea SUB H
A5 Kanzou AND L
A6 Ornithogalum AND (HL)
  • Power version only

**Values for C920, C921, C943

The following are all the 256 possible combinations of the values for C920, C921, C943
C920 Opcode C921 Opcode C943 Opcode
89 ADC C E5 PUSH HL A2 AND D
A9 XOR C 98 SBC B AD XOR L
8C ADC H 65 LD H, L AC XOR H
E4 INVALID 5D LD E, L 35 DEC (HL)
32 LDD (HL), A 8E ADC (HL) AB XOR E
BF CP A 3F CCF 5A LD E, D
ED INVALID 25 DEC H 35 DEC (HL)
78 LD A, B B1 OR C 57 LD D, A
D9 RETI 3D DEC A AF XOR A
E0 LD (FF00 + 83), A 83 1E LD E, _ _
83 ADD E 09 ADD HL, BC 76 HALT
68 LD L, B AC XOR H B0 OR B
FD INVALID 07 RLCA 8F ADC A
B7 OR A CD CALL _ _ _ _ 7A LD A, D
40 LD B, B 8D ADC L 19 ADD HL,DE
FB EI F1 POP AF 32 LDD (HL), A
C2 JP NZ, _ _ 8E 8E 28 JR Z, _ _
A7 AND A B8 CP B C6 ADD A, _ _
9B SBC E F7 RST 30 37 SCF
66 LD H, (HL) A5 AND L 8C ADC H
42 LD B, D 1D DEC E 92 SUB D
9C SBC H F6 OR A, _ _ 6E LD L, (HL)
A3 AND E FB EI A8 XOR B
D2 JP NC, _ _ 99 99 28 JR Z, _ _
D7 RST 10 5D LD E, L 02 LD (BC) A
7E LD A, (HL) CF RST 08 97 SUB A
91 SUB C 99 SBC C 65 LD H, L
7A LD A, D 0A LD A, (BC) 45 LD B, L
67 LD H, A 87 ADD A 4B LD C, E
18 JR 2F 2F 68 LD L, B
89 ADC C 2C INC L 00 NOP
2F CPL 55 LD D, L 15 DEC D
D6 SUB A, 6D 6D 0E LD C, _ _
E5 PUSH HL 7B LD A, E 25 DEC H
9C SBC H FB EI 95 SUB L
A5 AND L 7F LD A, A 28 JR Z, _ _
E1 POP HL 18 JR _ _ B2 OR D
1A LD A,(DE) A3 AND E 97 SUB A
F0 LD A, (FF00 + C0) C0 1E LD E, _ _
C3 JP _ _ 2E 2E 88 ADC B
DF RST 18 B4 OR H 86 ADD (HL)
96 SUB (HL) 86 ADD (HL) 42 LD B, D
76 HALT B8 CP B 9B SBC E
01 LD BC, _ _ 16 16 B1 OR C
29 ADD HL, HL 61 LD H, C 64 LD H, H
16 LD D, BE BE A0 AND B
15 DEC D 79 LD A, C 18 JR _ _
E3 INVALID F4 INVALID 2E LD L, _ _
B8 CP B 45 LD B, L B2 OR D
AE XOR (HL) CF RST 08 5A LD E, D
7F LD A, A CE ADC A, _ _ 5D LD E, L
3B DEC SP F3 DI B3 OR E
57 LD D, A 3C INC A 6C LD L, H
D8 RET C 59 LD E, C 08 LD (_ _ _ _), SP
73 LD (HL), E 56 LD D, (HL) 6C LD L, H
DE SBC A, D8 D8 58 LD E, B
D0 RET NC AA XOR D 45 LD B, L
18 JR 3F 3F 99 SBC C
27 DAA BB CP E 4B LD C, E
7E LD A, (HL) D0 RET NC B0 OR B
5C LD E, H 86 ADD (HL) 73 LD (HL), E
A9 XOR C 26 LD H, _ _ 3B DEC SP
F6 OR A, 56 56 84 ADD H
DA JP N, _ _ 04 04 34 INC (HL)
D1 POP DE AB XOR E A0 AND B
9A SBC D 27 DAA 9C SBC H
F2 LD A, (FF00 + C) D8 RET C 23 INC HL
7F LD A, A 54 LD D, H 4C LD C, H
8C ADC H D1 POP DE 0A LD A, (BC)
95 SUB L 34 INC (HL) 52 LD D, D
A9 XOR C 93 SUB E 2C INC L
DD INVALID D3 INVALID 0D DEC C
40 LD B, B 97 SUB A 6F LD L, A
89 ADC C 6B LD L, E 78 LD A, B
70 LD (HL), B C8 RET Z 30 JR NC, _ _
59 LD E, C 3B DEC SP B7 OR A
F3 DI CD CALL _ _ _ _ 1E LD E, _ _
1D DEC E DF RST 18 23 INC HL
E8 ADD SP, 75 75 73 LD (HL), E
D5 PUSH DE C2 JP NZ, _ _ _ _ 96 SUB (HL)
11 LD DE, _ _ 64 64 8F ADC A
98 SBC B 47 LD B, A B4 OR H
75 LD (HL), L C8 RET Z A7 AND A
64 LD H, H 64 LD H, H 37 SCF
35 DEC (HL) 5D LD E, L 8C ADC H
FA LD A, (_ _ 08) 08 C3 JP _ _ _ _
14 INC D 89 ADC C 23 INC HL
C7 RST 00 87 ADD A 8E ADC (HL)
4E LD C, (HL) B6 OR (HL) 86 ADD (HL)
94 SUB H D6 SUB A, _ _ B2 OR D
4B LD C, E 88 ADC B 1E LD E, _ _
7E LD A, (HL) D0 RET NC B0 OR B
89 ADC C 02 LD (BC) A 30 JR NC, _ _
8C ADC H 99 SBC C 97 SUB A
FD INVALID E6 AND A, _ _ 63 LD H, E
52 LD D, D 68 LD L, B 7A LD A, D
4D LD C, L C6 ADD A, _ _ 92 SUB D
B6 OR (HL) 4C LD C, H 85 ADD L
8C ADC H E1 POP HL 68 LD L, B
63 LD H, E 9B SBC E 2F CPL
52 LD D, D A5 AND L 39 ADD HL, SP
B3 OR E 73 LD (HL), E 18 JR _ _
04 INC B ED INVALID 43 LD B, E
70 LD (HL), B 32 LDD (HL), A BC CP H
89 ADC C A4 AND H 34 INC (HL)
9D SBC L F2 LD A, (FF00 + C) 9C SBC H
15 DEC D 3B DEC SP 76 HALT
71 LD (HL), C B3 OR E 44 LD B, H
E4 INVALID EF RST 28 73 LD (HL), E
15 DEC D F3 DI 0F RRCA
8B ADC E E2 LD (FF00 + C), A 9C SBC H
D4 CALL NZ, _ _ 83 83 1C INC E
8F ADC A 85 ADD L 58 LD E, B
FC INVALID B5 OR L 08 LD (_ _ _ _), SP
7A LD A, D 57 LD D, A 64 LD H, H
51 LD D, C 0B DEC BC 15 DEC D
5B LD E, E 03 INC (BC) 1D DEC E
EE XOR A, 9F 9F 6C LD L, H
14 INC D 66 LD H, (HL) 99 SBC C
C3 JP _ _ C7 C7 BF CP A
D9 RETI 15 DEC D 0A LD A, (BC)
B2 OR D 86 ADD (HL) A5 AND L
02 LD (BC) A 94 SUB H 5D LD E, L
F2 LD A, (FF00 + C) 6D LD L, L A9 XOR C
B6 OR (HL) 9A SBC D 88 ADC B
2E LD L, 20 20 37 SCF
7B LD A, E 40 LD B, B 74 LD (HL), H
DF RST 18 B2 OR D 14 INC D
C1 POP BC 17 RLA 49 LD C, C
61 LD H, C 68 LD L, B 42 LD B, D
9C SBC H E8 ADD SP, _ _ A1 AND C
0E LD C, 45 45 0F RRCA
20 JR NZ, 58 58 B5 OR L
36 LD (HL), 44 44 7F LD A, A
84 ADD H 7C LD A, H 3E LD A, _ _
28 JR Z, 18 18 34 INC (HL)
BB CP E 43 LD B, E 54 LD D, H
45 LD B, L D9 RETI 6F LD L, A
83 ADD E F5 PUSH AF 56 LD D, (HL)
20 JR NZ, 7C 7C 51 LD D, C
96 SUB (HL) 3B DEC SP 97 SUB A
12 LD (DE), A 8F ADC A B3 OR E
A4 AND H E3 INVALID 6A LD L, D
74 LD (HL), H 45 LD B, L 7E LD A, (HL)
C1 POP BC B5 OR L 43 LD B, E
6F LD L, A 87 ADD A 5A LD E, D
14 INC D 4B LD C, E 83 ADD E
A8 XOR B CD CALL _ _ _ _ 73 LD (HL), E
A9 XOR C C7 RST 00 BB CP E
11 LD DE, _ _ 0F 0F 0C INC C
8A ADC D F2 LD A, (FF00 + C) A8 XOR B
83 ADD E F5 PUSH AF 78 LD A, B
B9 CP C 63 LD H, E 6D LD L, L
33 INC SP 59 LD E, C 8E ADC (HL)
73 LD (HL), E 8E ADC (HL) A3 AND E
F2 LD A, (FF00 + C) 6D LD L, L A9 XOR C
2D DEC L 87 ADD A 14 INC D
BD CP L 6D LD L, L 2F CPL
F8 LD HL, SP + 7F 7F 83 ADD E
EC INVALID 4D LD C, L 54 LD D, H
D7 RST 10 DE SBC A, _ _ B6 OR (HL)
83 ADD E 12 LD (DE), A 0C INC C
CD CALL _ _ FC FC 89 ADC C
74 LD (HL), H 7E LD A, (HL) 34 INC (HL)
C8 RET Z 1F RRA 05 DEC B
DC CALL C, _ _ 3F 3F 76 HALT
7A LD A, D 50 LD D, B 81 ADD C
D5 PUSH DE 54 LD D, H 72 LD (HL), D
B1 OR C AA XOR D C5 PUSH BC
24 INC H 7E LD A, (HL) 7F LD A, A
1F RRA BC CP H 50 LD D, B
58 LD E, B 31 LD SP, _ _ _ _ AA XOR D
CF RST 08 C7 RST 00 84 ADD H
BE CP (HL) C2 JP NZ, _ _ _ _ 55 LD D, L
16 LD D, EA EA C0 RET NZ
AB XOR E C3 JP _ _ _ _ 7C LD A, H
D7 RST 10 4B LD C, E 55 LD D, L
AD XOR L F6 OR A, _ _ 76 HALT
20 JR NZ, 2C 2C A3 AND E
FF RST 38 9C SBC H C1 POP BC
4B LD C, E 7E LD A, (HL) 8D ADC L
13 INC DE 79 LD A, C 18 JR _ _
E0 LD (FF00 + 4C), A 4C 45 LD B, L
8F ADC A 35 DEC (HL) AA XOR D
83 ADD E 05 DEC B 7F LD A, A
B6 OR (HL) 5D LD E, L 57 LD D, A
C2 JP NZ, _ _ 65 65 06 LD B, _ _
DF RST 18 C2 JP NZ, _ _ _ _ 39 ADD HL, SP
8C ADC H FE CP A, _ _ 84 ADD H
6C LD L, H F0 LD A, (FF00 + _ _) 79 LD A, C
15 DEC D 51 LD D, C 39 ADD HL, SP
44 LD B, H 1E LD E, _ _ 38 JR C, _ _
B2 OR D A5 AND L 37 SCF
B9 CP C 2D DEC L 31 LD SP, _ _ _ _
46 LD B, (HL) D8 RET C 5C LD E, H
7E LD A, (HL) E2 LD (FF00 + C), A 68 LD L, B
DC CALL C, _ _ 7B 7B 2D DEC L
03 INC (BC) 1A LD A,(DE) 1F RRA
F8 LD HL, SP + 37 37 A2 AND D
CB RLC B AD XOR L 25 DEC H
69 LD L, C 9F SBC A 61 LD H, C
20 JR NZ, B2 B2 74 LD (HL), H
F9 LD, SP, HL 68 LD L, B 93 SUB E
54 LD D, H 65 LD H, L 15 DEC D
89 ADC C 3B DEC SP 88 ADC B
86 ADD (HL) F9 LD, SP, HL 1B DEC DE
FD INVALID 10 STOP _ _ B9 CP C
51 LD D, C AB XOR E 27 DAA
D2 JP NC, _ _ 98 98 54 LD D, H
B7 OR A 4D LD C, L 4A LD C, D
F0 LD A, (FF00 + B1) B1 2C INC L
D3 INVALID 38 JR C, _ _ 02 LD (BC) A
12 LD (DE), A A5 AND L 7C LD A, H
BF CP A 90 SUB B C4 CALL NZ, _ _ _ _
F5 PUSH AF AF XOR A A7 AND A
6E LD L, (HL) DD INVALID 88 ADC B
67 LD H, A BF CP A 7A LD A, D
3D DEC A DA JP N, _ _ _ _ 5B LD E, E
98 SBC B 2E LD L, _ _ AB XOR E
DF RST 18 C2 JP NZ, _ _ _ _ 39 ADD HL, SP
58 LD E, B 22 LDI (HL), A A1 AND C
13 INC DE 70 LD (HL), B 93 SUB E
A6 AND (HL) CB RLC B 84 ADD H
EA LD (_ _ 0C), A 0C BA CP D
32 LDD (HL), A D2 JP NC, _ _ _ _ B2 OR D
30 JR NC, 28 28 48 LD C, B
8B ADC E 19 ADD HL,DE 91 SUB C
64 LD H, H 64 LD H, H 07 RLCA
53 LD D, E 17 RLA 1C INC E
7F LD A, A AC XOR H 28 JR Z, _ _
14 INC D 61 LD H, C 45 LD B, L
20 JR NZ, 98 98 97 SUB A
D6 SUB A, 4A 4A C0 RET NZ
A8 XOR B 88 ADC B 93 SUB E
50 LD D, B A2 AND D 74 LD (HL), H
53 LD D, E C9 RET BC CP H
80 ADD B 89 ADC C 22 LDI (HL), A
FF RST 38 B7 OR A 84 ADD H
70 LD (HL), B FE CP A, _ _ 0E LD C, _ _
F3 DI 89 ADC C 85 ADD L
C7 RST 00 B6 OR (HL) C4 CALL NZ, _ _ _ _
BE CP (HL) D9 RETI 87 ADD A
0B DEC BC 04 INC B B3 OR E
DC CALL C, _ _ F2 F2 5E LD E, (HL)
3C INC A 0D DEC C 94 SUB H
64 LD H, H 8D ADC L 01 LD BC, _ _ _ _
40 LD B, B 44 LD B, H 08 LD (_ _ _ _), SP
6A LD L, D 1E LD E, _ _ BB CP E
BB CP E 0A LD A, (BC) 49 LD C, C
A6 AND (HL) C8 RET Z 00 NOP
6B LD L, E 4D LD C, L 61 LD H, C
7A LD A, D 0A LD A, (BC) 45 LD B, L
C1 POP BC 8F ADC A 5C LD E, H
13 INC DE 9B SBC E 4C LD C, H
CE ADC A, 50 50 C5 PUSH BC
75 LD (HL), L E1 POP HL 7D LD A, L
89 ADC C E5 PUSH HL A2 AND D

Ending

There are multiple ways to trigger the credits: 1. Change game state to 48 2. Warp to final area, then beat the boss 3. Trigger the ending scene. 4. Trigger the event right before the credits play

Method 1 only triggers the credits, but has no effect on the game whatsoever; the final boss flag at C5A1 does not get set, nor does the post game content flags. I do not think this counts as beating the game.

For method 2, this is the way the first 3 runs submitted uses method 2. Run 1 warps to the final area by taking advantage of the fact the map for the indoor areas and the antenna trees are all connected to each other. This means it's possible to run to the final antenna tree from the mountain one.

The 2nd and 3rd TAS jumps to VRAM, then due to an emulator bug regarding the STOP opcode (10 10), it doesn't crash, and instead coincidentally changes the map id to the final, upper left quadrant of the map, which is the final antenna tree's location.

This sets the final boss flag, along with post credits content, but is the slowest.

Method 3 sets the final boss flag. This can be done by setting the following values: CD00 = 01 CD02 = 0B CD03 = 01 CD06 = 6A This sets up the script for the scene right before you get teleported to the beginning area. There's still a final scene afterwards however, so while it's faster than method 2, it's not ideal.

This submission uses method 4. This can be done by setting the following values: CD00 = 01 CD02 = 1A CD03 = 01 CD06 = 6F This sets up the script for the very end part of the final dialogue, right before the post credits content flags are set. While this does not trigger the final boss flag, it does update the game into thinking you beat it. The reason why this even works is because the game does the following: 1. Dialogue with boss -> Method 2 2. Fight boss 3. Dialogue with boss 4. Update final boss flag -> Method 3 5. Ending scene 6. Update post credits content flags -> Method 4

Payload

There's multiple ways to handle this.

I initially wanted to just call the function that sets the game state to 48. That function is located at ROM bank 0F however. So I tried to somehow swap to bank 0F to call the credits, then somehow jump back. This was basically method 1 however, so CasualPokePlayer suggested to skip manpulating all those values to get :

ld bc,1d18 add hl,bc ; hl = e3e1 ld (hl),$30 jp somewhereitdontcrash?

After looking at the telefang translation github however, I found out the game's script function was partially documented: https://github.com/telefang/telefang/blob/master/components/eventscript/interpreter.asm In this case: CD00 - trigger event CD02 - Event ID CD03 - something about jp pointer CD06 - Event's sequence (how far you're in to event)

I initially had no idea how would I set multiple values up with the limited amount of addresses, until I found out recruited Telefang names are all stored side by side in CartRAM at 5200. To get to this to appear at System Bus however, I neded a way to swap SWRAM banks. Luckily, CasualPokePlayer found out there's a function located at 3D6A that does that: https://github.com/telefang/telefang/blob/3ec7bf14bf4b6686cbd2067f7e3e204724dd3648/components/saveclock/sram_lock.asm#L3-L11

This meant that rather that finding some combination of values to manpulate to somehow swap SWRAM banks, I could just call 3D6A. My name is long enough to do this:

Opcode Name Function
CD 6A 3D ーゃか Call 3D6A
21 03 59 ムウも LD HL, 5903
29 ADD HL, HL
E0 E0 null LD (FF00 + E0), A

To jump to HL, I initially wanted to use the frame counter at C938 to E9 (JP HL), but it turns out C937 is always 01, which makes C938 unuseable due to the opcode being 2 bytes. Instead, I used C948 (Follower X pos on phone use) to get to E9 for the jump. The 03 offset for 5903 is because the 1st Denjuu's name last character (E0) is a 2 byte opcode, so it would mess up the payload.

Now that I could jump to the names, CasualPokePlayer suggested the following payload:

Opcode Name Function
DENJUU ONE ム ユュア
21 00 00 LD HL,0000
25 DEC HL ; HL = ffff
36 01 ュア LD HL,$01 ; only enable vblank interrupts
DENJUU TWO ンちルヤア5
2E 48 ンち LD l,$48 ; workaround no $90
29 add HL,HL
24 INC H ; HL = FF90
01 C0 ア5 LD BC
DENJUU THREE キコェあネェ
07 LD BC,$07C0
0A LD A,
32 LDD (HL), A
3E 18 あネ LD A,$18
32 LDD (HL), A
DENJUU FOUR アけモコェ8
01 40 23 アけモ LD BC,$2340
0A LD A,BC ; load A with 76
32 LDD (HL), A
C3 8 JP
DENJUU FIVE け ア
40 00 JP to HL
01 To get the 00 above

This didn't seem to work out however, so instead the payload was:

Stage by stage comments

<Put the name of the first stage here>

<Explain the first stage here>

<Put the name of the second stage here>

<Explain the second stage here>

<And so on>

Other comments

<Explain here things the audience would probably like to see> <Explain also things that could be improved in your movie> <You may also suggest screenshots.>
Samsara: wait i think this one's legit. anyway here's my number, so call me maybe (hands you a slip of paper with 69 written on it in crayon)

Samsara: Aw, here it goes.

feos: Fixed code embed (by replacing with monospaced, since code embeds don't have linbreaks in the forum view).

Samsara: Adding GEG branch due to ACE usage.

Samsara: The ending thing hasn't quite been explained in the submission text yet I don't think, so I'll summarize it here: This run triggers the very end of the ending, just before the credits. This plays the credits, of course, but more importantly it sets the game completion state by unlocking postgame content. Triggering the credits directly would not have done this, and triggering anything before this would have lost time. I've verified that the postgame state was triggered in this run by locating and accessing a piece of postgame content, meaning that for our purposes, the game is considered complete. Note that other event flags are NOT triggered, most notably the flag for the final boss's defeat. Flags like these are not necessary for GEG runs: Since a majority of the game is skipped anyway, so are a majority of normally required event flags. As long as these flags do not adversely affect the ending by not being triggered, then triggering them is unnecessary. In this case, since the final boss flag does not directly trigger the postgame content, it is fine that it is skipped.

That leaves the nature of the ACE itself: The currently published "map glitch" run has the same issue that the Wario Land GEG has. To simplify the explanation: VBA bad. To expound on the simplifying of the explanation: The previous Telefang runs and that Wario Land GEG run were only possible because VBA did not crash where an actual (or properly emulated) GBA would crash. This run avoids that through different methodology while also being a couple minutes faster to boot. Given that the run was performed on BizHawk, I am far more confident that this is legit given the incredible dedication of the GB/C emulation community to accuracy for console verification purposes.

I'm accepting this to obsolete the map glitch run, as it serves the same purpose with actual legitimacy this time. Thanks, VBA!

EDIT: Since this judgement, the TAS has been console verified, so... I guess it's double accepted now. Hooray!

fsvgm777: Processing. EZGames69 is handling the encodes for this one.


Similar submissions (by title and categories where applicable):