Submission #7053: jlun2, CasualPokePlayer, MisterChess's GBC Keitai Denjuu Telefang: Speed Version "game end glitch" in 05:15.98

Console Game Boy Color Emulator BizHawk 2.5
Game Version JPN Frame Count 18874
ROM Filename Keitai Denjuu Telefang - Speed Version (J) [C][!].gbc Frame Rate 59.7312505142698
Branch game end glitch Rerecord Count 16924
Unknown Authors jlun2, CasualPokePlayer
(Additionally: MisterChess)
Game Keitai Denjuu Telefang: Speed Version
Submitted by jlun2 on 4/1/2021 12:03:23 AM

Submission Comments

Syntax Error

Syntax Error on line 644
  1. It turns out the infamous "Pokemon ripoff" has ACE as well, just like Pokemon.
  2.  
  3. !! Game objectives
  4. 
  5. * Emulator used: BizHawk 2.5, GB player 
  6. * <List the objectives of your movie here>
  7. * <Another objective>
  8. * <And so on>
  9. 
 10. !! Comments
 11. 
 12. I always knew this game could have a game end glitch, but wasn't able to figure out how it worked. After some guidance from CasualPokePlayer, I managed to discover that various NPC ID combinations jump to various parts of the game's memory, leading to crashes. The gameboy player was used, since the previous run relied on an emulator bug regarding STOP (opcode #10 10), so I wanted the run to have a chance to get console verified one day.
 13. 
 14. While CasualPokePlayer and Mister Chess did not contribute to the input directly, I made them coauthors since they were very helpful in finding out how the NPCs glitched up, while CasualPokePlayer also gave a payload to jump to the controller directly (which unfortunately ended up unused) along with where to jump to.
 15. 
 16. ! Map bug
 17. 
 18. This is the main bug in all iterations of the any% Telefang TAS. When you do the following actions: 
 19. 1. Open the map with Start
 20. 2. Entering a building 
 21. 3. Trigger a battle
 22. 
 23. the game writes the bytes for you and the NPCs from WRAM to CartRAM, one byte at a time. Onc the battle is over, or when you close the map, the values are written back to WRAM. Given enough lag however, the game fails to write all the addresses. In the case for this run:
 24. 
 25.  5F47:  1A        LD   A,(DE)         A:a3 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3  Cy:1320480764
 26.  5F48:  22        LD   (HL+),A        A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3  Cy:1320480772
 27.  5F49:  13        INC  DE             A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480780
 28.  5F4A:  0B        DEC  BC             A:00 B:00 C:a3 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480788
 29.  5F4B:  78        LD   A,B            A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480796
 30.  5F4C:  B1        OR   C              A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480800
 31.  5F4D:  20 F8     JR   NZ,5F47h       A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480804
 32.  5F47:  1A        LD   A,(DE)         A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480816
 33.  5F48:  22        LD   (HL+),A        A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480824
 34.  5F49:  13        INC  DE             A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5f LY:37 SP:dff3  Cy:1320480832
 35.  0040:  C3 E7 02  JP   #02E7h         A:db B:00 C:a2 D:c2 E:ff F:00 H:a2 L:5f LY:90 SP:dff1  Cy:1320480860
 36. 
 37. The process took too long, so it gets interrupted. The reason I call it map bug however, is because that's the only action you can use to trigger this. There's no area where you can trigger either a battle, or enter a room with tons of lag. 
 38. 
 39. While this might seem to indicate you only need lag, I have never managed to trigger this bug without the phone ringing. The phone only rings once every 5 minutes when you have at least 2 Denjuu, so I'm forced to wait 5 minutes.
 40. 
 41. The very first Telefang TAS took advantage of the game failing to copy my game position to get to the final dungeon. The subsequent TASes uses this bug to get glitched combinations of NPC values to jump to WRAM.
 42. 
 43. ! NPCs
 44. The following NPCs are reachable within the first 5 minutes of the game, while also reachable to each other without triggering combat.
 45. ||Map ID||Map Coord||NPC 1||NPC 2||
 46. |4|20|3|76|
 47. |4|19|207|75|
 48. |4|19|219|75|
 49. |4|11|207|73|
 50. |4|19|219|73|
 51. |4|11|0|0|
 52. |4|18|167|75|
 53. |4|4|104|72|
 54. |2|60|210|70|
 55. |2|59|170|70|
 56. 
 57. The addresses for their IDs are:
 58. 0xC2BE, 0xC2BF
 59. 0xC2DE, 0xC2DF
 60. 0xC2FE, 0xC2FF
 61. 0xC31E, 0xC31F
 62. 0xC33E, 0xC33F
 63. 
 64. There are more, but these are the ones the above uses. Not every one of them can be mixed together with the map bug. Moving around map coordinates change the address the NPC is on, but since the maps are connected, some only get written to specific addresses. For instance:
 65. You start at Map 4, Coord 19. You can only go north and east. The values right now are:
 66.  0xC2BE, 0xC2BF = 207, 75
 67.  0xC2DE, 0xC2DF = 219, 75
 68.  0xC2FE, 0xC2FF = 0,0 
 69.  0xC31E, 0xC31F = 0,0 
 70.  0xC33E, 0xC33F = 0,0 
 71. 
 72. Going east gives 
 73.  0xC2BE, 0xC2BF = 207, 75
 74.  0xC2DE, 0xC2DF = 219, 75
 75.  0xC2FE, 0xC2FF = 3,76 
 76.  0xC31E, 0xC31F = 0,0 
 77.  0xC33E, 0xC33F = 0,0 
 78. 
 79. Backtracking, then going north gives
 80.  0xC2BE, 0xC2BF = 207, 75
 81.  0xC2DE, 0xC2DF = 219, 75
 82.  0xC2FE, 0xC2FF = 207, 73 
 83.  0xC31E, 0xC31F = 219, 73 
 84.  0xC33E, 0xC33F = 0,0 
 85. 
 86. As you can see, the IDs: 3, 76 got overwritten. Attempting to reload the NPC only places them to 0xC2BE, 0xC2BF.
 87. This means there's no way to get addresses 
 88.  0xC2DE, 0xC2DF, 
 89.  0xC31E, 0xC31F,
 90.  0xC33E, 0xC33F
 91. to have the values of 3, 76. 
 92. 
 93. Similarrly, there's no way to get the values of 3, 76 to be at 0xC2BE, 0xC2BF. This restricts me to only 1 room possible for the bug.
 94. 
 95. Possible values for 0xC2BE, 0xC2BF
 96.  0, 0 (By resetting)
 97.  3, 76
 98.  104, 72
 99.  167, 75
100.  170, 70
101.  207, 73
102.  207, 75
103. 
104. Possible values for 0xC2DE, 0xC2DF
105.  0, 0
106.  207, 75
107.  210, 70
108.  219, 73
109.  219, 75
110. 
111. Possible values for 0xC2FE, 0xC2FF
112.  0, 0
113.  3, 76
114.  207, 73
115.  219, 75
116. 
117. Possible values for 0xC31E, 0xC31F
118.  0, 0 (By resetting)
119.  207, 75
120.  219, 73
121. 
122. ! Collision effects
123. If 2 NPC IDs can exist at the same pair of addresses, it's possible to get a combination of them using the map bug. The following collisions are possible:
124. 
125. 3, 0 -> The NPC starts floating up and down. They cannot be talked to. %%%
126. 3, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD %%%
127. 3, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD %%%
128. 3, 73 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F %%%
129. 3, 75 -> Nothing wrong; this is a valid NPC %%%
130. 3, 76 -> Nothing wrong; this is a valid NPC %%%
131. 
132. 104, 0 -> Glitches the graphics and lags the game badly. %%%
133. 104, 70 -> They become a Denjuu trainer with a level 0 Tsunonasu %%%
134. 104, 72 -> Nothing wrong; this is a valid NPC %%%
135. 104, 73 -> Spins around in circles %%%
136. 104, 75 -> Crashes at 0x47DA due to 0xE4 %%%
137. 104, 76 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F %%%
138. 
139. 167, 0 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62. %%%
140. 167, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint. %%%
141. 167, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint. %%%
142. 167, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint. %%%
143. 167, 75 -> Nothing wrong; this is a valid NPC %%%
144. 167, 76 -> Jumps to 0x84FA via 0xE9 JP (HL) at 0x4EFB, then crashes 1 instruction later by 0xFC %%%
145. 
146. 170, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then crashes due to 0xF4 %%%
147. 170, 70 -> Nothing wrong; this is a valid NPC %%%
148. 170, 72 -> Nothing wrong; this is a valid NPC %%%
149. 170, 73 -> Makes the NPC run in place. Talkng to them triggers a fight with trainer with 3 Denjuu at level 10 %%%
150. 170, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3 %%%
151. 170, 76 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62. While the values earlier can be slightly manipulated by having different amounts of money, the sequence 0x10 10 is from the character "ル", which is unavoidable. The currently published TAS emulates the instruction wrong by simply ignoring it. Therefore, the currently published route using this combination is impossible. %%%
152. 
153. 207, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then eventually jumps to 0xFAFA via 0xE9 JP (HL) at 0x049D before jumping to 0x0000 via 0xE9 JP (HL) at 0xFD12. It gets stuck in a loop at 0x0028 to 0x0030. %%%
154. 207, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3 %%%
155. 207, 72 -> Nothing wrong; this is a valid NPC %%%
156. 207, 73 -> Nothing wrong; this is a valid NPC %%%
157. 207, 75 -> Nothing wrong; this is a valid NPC %%%
158. 207, 76 -> Jumps to 0x8005 via 0xD9 RETI at 0x0323. It then crashes at 0x8059 via 0xFC. %%%
159. 
160. 210, 0 -> The NPC becomes untalkable %%%
161. 210, 70 -> Nothing wrong; this is a valid NPC %%%
162. 210, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3 %%%
163. 210, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD %%%
164. 
165. 219, 0 -> Jumps to 0x0000 via 0xE9 JP (HL) at 0x049D, then gets stuck in a loop from 0x0028 to 0x0030. %%%
166. 219, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). It then gets stuck in a loop from 0x0028 to 0x0030. %%%
167. 219, 73	-> Nothing wrong; this is a valid NPC %%%
168. 219, 75	-> Nothing wrong; this is a valid NPC %%%
169. 219, 76 -> Jumps to 0xC6C9 via 0xE9 JP (HL) at 0x4EFB, then NOP slides to player data at 0xC900
170. 
171. Based on the above, the only useable combination is 219, 76. 
172. 
173. ! Player data
174. Now that we have a way to jump into player data, we need to document what is possible. 0xC800 region gets set much much later in the game, so for the purpose of the run, everything from 0xC6C9 to 0xC8FF is 0.
175. 
176. All values are in hex:
177. %%TAB C900%%
178. ||Address||Purpose||Values possible during run||Opcode||
179. |C900|Defaults to 1. Setting to 0 takes me back to start of game human world. 2 makes me fall from sky. Changing from 1 disables menus.|1|LD BC, 5048		
180. |C901|Spawn X (where you appear on room load) + X pos on phone use|09-98| |
181. |C902|Spawn Y (where you appear on room load) + Y pos on phone use|10-80| |
182. |C903|Acre|93|SUB E|
183. |C904|Map ID|04|INC B|
184. |C905|Map type|00|NOP|
185. |C906|Map Coord|13|INC DE|
186. |C907|??|02|NOP|
187. |C908|??|00|NOP|
188. |C909|??|00|NOP|
189. |C90A|??|00|NOP|
190. |C90B|??|00|NOP|
191. |C90C|??|00|NOP|
192. |C90D|??|00|NOP|
193. |C90E|??|00|NOP|
194. |C90F|Last visited map coord|0B, 14|DEC BC|
195. %%TAB C910%%
196. ||Address||Purpose||Values possible during run||Opcode||
197. |C910|Money|00-FF|Varies|
198. |C911|Money|0-4*|Varies|
199. |C912|Follower sprite ID|Varies*|Varies|
200. |C913|Map Coord|13|INC DE|
201. |C914|Map type|04|INC B|
202. |C915|Ranges from 0-9 as you go left to right screen|2-9|Varies|
203. |C916|Ranges from 0-7 as you go up to down the screen|0-7|Varies|
204. |C917|Music? Overworld is 3|03|INC (BC)|
205. |C918|??|00|NOP|
206. |C919|1 if walking. else 0|0|NOP|
207. |C91A|Idle timer|0|NOP|
208. |C91B|??|00|NOP|
209. |C91C|??|00|NOP|
210. |C91D|Change to 1 to trigger battle|0|NOP|
211. |C91E|Set to E0 at start. Changes to F0 in battle|E0|LD (FF00 + C0), A|
212. |C91F|Set to C0 at start. Changing it affects text|C0| |
213. 
214. 
215. %%TAB C920%%
216. ||Address||Purpose||Values possible during run||Opcode||
217. |C920|Randomly assigned on start|Varies**|Varies|
218. |C921|Randomly assigned on start|Varies**|Varies|
219. |C922|Goes up on grass|00-3F|Varies|
220. |C923|Randomly changes|??|Varies|
221. |C924|??|05|DEC B|
222. |C925|??|00|NOP|
223. |C926|Map ID|04|INC B|
224. |C927|Map Coord|13|INC DE|
225. |C928|Spawn X (where you appear on room load) + X pos on phone use|09-98|Varies|
226. |C929|Spawn Y (where you appear on room load) + Y pos on phone use|10-80|Varies|
227. |C92A|??|00|NOP|
228. |C92B|??|00|NOP|
229. |C92C|Player Name Character 1|CD|Call 3D6A|
230. |C92D|Player Name Character 2|6A| |
231. |C92E|Player Name Character 3|3D| |
232. |C92F|Player Name Character 4|21|LD HL, 5903|
233. 
234. %%TAB C930%%
235. ||Address||Purpose||Values possible during run||Opcode||
236. |C930|Player Name Character 5|03|LD HL, 5903|
237. |C931|Player Name Character 6|59| |
238. |C932|Player Name Character 7|29|ADD HL, HL|
239. |C933|Player Name Character 8|E0|LD (FF00 + E0), A|
240. |C934|Player Name String Terminator|E0| |
241. |C935|??|00|NOP|
242. |C936|Sets to 1 at game start|01|LD BC, 1101|
243. |C937|Sets to 1 after intro cutscene|01| |
244. |C938|Frame|00-FF| |
245. |C9C9|Seconds|04|INC B|
246. |C9CA|Minutes|05|DEC B|
247. |C9CB|Hours|00|NOP|
248. |C9CC|??|00|NOP|
249. |C9CD|??|00|NOP|
250. |C9CE|Sets to 1 at game start|01|LD BC, 0500|
251. |C9CF|??|00| |
252. 
253. %%TAB C940%%
254. ||Address||Purpose||Values possible during run||Opcode||
255. |C940|Decrements from 5?|05|LD BC, 0500|
256. |C941|??|00|NOP|
257. |C942|??|00|NOP|
258. |C943|Randomly assigned on start|Varies**|Varies|
259. |C944|??|00|NOP|
260. |C945|??|01|LD BC, 0000|
261. |C946|Shop item you picked up|00| |
262. |C947|Using phone bool|00| |
263. |C948|Follower X pos on phone use|00-FF||Varies|
264. |C949|Follower X pos on phone use|00-FF||Varies|
265. |C94A|Follower Y pos on phone use|00-FF||Varies|
266. |C94B|Follower Y pos on phone use|00-FF||Varies|
267. |C94C|Turned to 1 at 1st screen of Denjuu World?|00|NOP|
268. |C94D|Calling Denjuu name|Varies|Varies|
269. |C94E|Calling Denjuu name? Seems to be A0|Varies|Varies|
270. |C94F|Phone timer|Varies|Varies|
271. 
272. %%TAB Minimize tab%%
273. %%TAB_END%%
274. 
275. ! *Values for C912
276. ||Value||Denjuu||Opcode||
277. |00|Tsunonasu|NOP|
278. |01|Kochia|LD BC,  _ _ _ _|
279. |02|Oshe|LD (BC) A|
280. |03|Keshi*|INC (BC)|
281. |04|Crypto*|INC B|
282. |05|Monstera|DEC B|
283. |06|Fungus|LD B, _ _|
284. |2F|Musa|CPL|
285. |36|Hagumanoki|LD (HL), _ _|
286. |64|Hiyu|LD H, H|
287. |67|Gamuru|LD H, A|
288. |69|Gaultheria|LD L, C|
289. |6B|Kaya|LD L, E|
290. |6C|Denfare|LD L, H|
291. |82|Beebalm|ADD D|
292. |83|Salal|ADD E|
293. |84|Enishida|ADD H|
294. |92|Ruscus|SUB D|
295. |94|Zea|SUB H|
296. |A5|Kanzou|AND L|
297. |A6|Ornithogalum|AND (HL)|
298. * Power version only
299. 
300. ! **Values for C920, C921, C943
301. The following are all the 256 possible combinations of the values for C920, C921, C943
302. %%TAB Values%%
303. ||C920||Opcode||C921||Opcode||C943||Opcode
304. |89|ADC C|E5|PUSH HL|A2|AND D|
305. |A9|XOR C|98|SBC B|AD|XOR L|
306. |8C|ADC H|65|LD H, L|AC|XOR H|
307. |E4|INVALID|5D|LD E, L|35|DEC (HL)|
308. |32|LDD (HL), A|8E|ADC (HL)|AB|XOR E|
309. |BF|CP A|3F|CCF|5A|LD E, D|
310. |ED|INVALID|25|DEC H|35|DEC (HL)|
311. |78|LD A, B|B1|OR C|57|LD D, A|
312. |D9|RETI|3D|DEC A|AF|XOR A|
313. |E0|LD (FF00 + 83), A|83| |1E|LD E, _ _|
314. |83|ADD E|09|ADD HL, BC|76|HALT|
315. |68|LD L, B|AC|XOR H|B0|OR B|
316. |FD|INVALID|07|RLCA|8F|ADC A|
317. |B7|OR A|CD|CALL _ _ _ _|7A|LD A, D|
318. |40|LD B, B|8D|ADC L|19|ADD HL,DE|
319. |FB|EI|F1|POP AF|32|LDD (HL), A|
320. |C2|JP NZ, _ _ 8E|8E| |28|JR Z, _ _|
321. |A7|AND A|B8|CP B|C6|ADD A, _ _|
322. |9B|SBC E|F7|RST 30|37|SCF|
323. |66|LD H, (HL)|A5|AND L|8C|ADC H|
324. |42|LD B, D|1D|DEC E|92|SUB D|
325. |9C|SBC H|F6|OR A, _ _|6E|LD L, (HL)|
326. |A3|AND E|FB|EI|A8|XOR B|
327. |D2|JP NC, _ _ 99|99| |28|JR Z, _ _|
328. |D7|RST 10|5D|LD E, L|02|LD (BC) A|
329. |7E|LD A, (HL)|CF|RST 08|97|SUB A|
330. |91|SUB C|99|SBC C|65|LD H, L|
331. |7A|LD A, D|0A|LD A, (BC)|45|LD B, L|
332. |67|LD H, A|87|ADD A|4B|LD C, E|
333. |18|JR 2F|2F| |68|LD L, B|
334. |89|ADC C|2C|INC L|00|NOP|
335. |2F|CPL|55|LD D, L|15|DEC D|
336. |D6|SUB A, 6D|6D| |0E|LD C, _ _|
337. |E5|PUSH HL|7B|LD A, E|25|DEC H|
338. |9C|SBC H|FB|EI|95|SUB L|
339. |A5|AND L|7F|LD A, A|28|JR Z, _ _|
340. |E1|POP HL|18|JR _ _|B2|OR D|
341. |1A|LD A,(DE)|A3|AND E|97|SUB A|
342. |F0|LD A, (FF00 + C0)|C0| |1E|LD E, _ _|
343. |C3|JP _ _ 2E|2E| |88|ADC B|
344. |DF|RST 18|B4|OR H|86|ADD (HL)|
345. |96|SUB (HL)|86|ADD (HL)|42|LD B, D|
346. |76|HALT|B8|CP B|9B|SBC E|
347. |01|LD BC,  _ _ 16|16| |B1|OR C|
348. |29|ADD HL, HL|61|LD H, C|64|LD H, H|
349. |16|LD D, BE|BE| |A0|AND B|
350. |15|DEC D|79|LD A, C|18|JR _ _|
351. |E3|INVALID|F4|INVALID|2E|LD L, _ _|
352. |B8|CP B|45|LD B, L|B2|OR D|
353. |AE|XOR (HL)|CF|RST 08|5A|LD E, D|
354. |7F|LD A, A|CE|ADC A, _ _|5D|LD E, L|
355. |3B|DEC SP|F3|DI|B3|OR E|
356. |57|LD D, A|3C|INC A|6C|LD L, H|
357. |D8|RET C|59|LD E, C|08|LD (_ _ _ _), SP|
358. |73|LD (HL), E|56|LD D, (HL)|6C|LD L, H|
359. |DE|SBC A, D8|D8| |58|LD E, B|
360. |D0|RET NC|AA|XOR D|45|LD B, L|
361. |18|JR 3F|3F| |99|SBC C|
362. |27|DAA|BB|CP E|4B|LD C, E|
363. |7E|LD A, (HL)|D0|RET NC|B0|OR B|
364. |5C|LD E, H|86|ADD (HL)|73|LD (HL), E|
365. |A9|XOR C|26|LD H, _ _|3B|DEC SP|
366. |F6|OR A, 56|56| |84|ADD H|
367. |DA|JP N, _ _ 04|04| |34|INC (HL)|
368. |D1|POP DE|AB|XOR E|A0|AND B|
369. |9A|SBC D|27|DAA|9C|SBC H|
370. |F2|LD A, (FF00 + C)|D8|RET C|23|INC HL|
371. |7F|LD A, A|54|LD D, H|4C|LD C, H|
372. |8C|ADC H|D1|POP DE|0A|LD A, (BC)|
373. |95|SUB L|34|INC (HL)|52|LD D, D|
374. |A9|XOR C|93|SUB E|2C|INC L|
375. |DD|INVALID|D3|INVALID|0D|DEC C|
376. |40|LD B, B|97|SUB A|6F|LD L, A|
377. |89|ADC C|6B|LD L, E|78|LD A, B|
378. |70|LD (HL), B|C8|RET Z|30|JR NC, _ _|
379. |59|LD E, C|3B|DEC SP|B7|OR A|
380. |F3|DI|CD|CALL _ _ _ _|1E|LD E, _ _|
381. |1D|DEC E|DF|RST 18|23|INC HL|
382. |E8|ADD SP, 75|75| |73|LD (HL), E|
383. |D5|PUSH DE|C2|JP NZ, _ _ _ _|96|SUB (HL)|
384. |11|LD DE,  _ _ 64|64| |8F|ADC A|
385. |98|SBC B|47|LD B, A|B4|OR H|
386. |75|LD (HL), L|C8|RET Z|A7|AND A|
387. |64|LD H, H|64|LD H, H|37|SCF|
388. |35|DEC (HL)|5D|LD E, L|8C|ADC H|
389. |FA|LD A, (_ _ 08)|08| |C3|JP _ _ _ _|
390. |14|INC D|89|ADC C|23|INC HL|
391. |C7|RST 00|87|ADD A|8E|ADC (HL)|
392. |4E|LD C, (HL)|B6|OR (HL)|86|ADD (HL)|
393. |94|SUB H|D6|SUB A, _ _|B2|OR D|
394. |4B|LD C, E|88|ADC B|1E|LD E, _ _|
395. |7E|LD A, (HL)|D0|RET NC|B0|OR B|
396. |89|ADC C|02|LD (BC) A|30|JR NC, _ _|
397. |8C|ADC H|99|SBC C|97|SUB A|
398. |FD|INVALID|E6|AND A, _ _|63|LD H, E|
399. |52|LD D, D|68|LD L, B|7A|LD A, D|
400. |4D|LD C, L|C6|ADD A, _ _|92|SUB D|
401. |B6|OR (HL)|4C|LD C, H|85|ADD L|
402. |8C|ADC H|E1|POP HL|68|LD L, B|
403. |63|LD H, E|9B|SBC E|2F|CPL|
404. |52|LD D, D|A5|AND L|39|ADD HL, SP|
405. |B3|OR E|73|LD (HL), E|18|JR _ _|
406. |04|INC B|ED|INVALID|43|LD B, E|
407. |70|LD (HL), B|32|LDD (HL), A|BC|CP H|
408. |89|ADC C|A4|AND H|34|INC (HL)|
409. |9D|SBC L|F2|LD A, (FF00 + C)|9C|SBC H|
410. |15|DEC D|3B|DEC SP|76|HALT|
411. |71|LD (HL), C|B3|OR E|44|LD B, H|
412. |E4|INVALID|EF|RST 28|73|LD (HL), E|
413. |15|DEC D|F3|DI|0F|RRCA|
414. |8B|ADC E|E2|LD (FF00 +  C), A|9C|SBC H|
415. |D4|CALL NZ, _ _ 83|83| |1C|INC E|
416. |8F|ADC A|85|ADD L|58|LD E, B|
417. |FC|INVALID|B5|OR L|08|LD (_ _ _ _), SP|
418. |7A|LD A, D|57|LD D, A|64|LD H, H|
419. |51|LD D, C|0B|DEC BC|15|DEC D|
420. |5B|LD E, E|03|INC (BC)|1D|DEC E|
421. |EE|XOR A, 9F|9F| |6C|LD L, H|
422. |14|INC D|66|LD H, (HL)|99|SBC C|
423. |C3|JP _ _ C7|C7| |BF|CP A|
424. |D9|RETI|15|DEC D|0A|LD A, (BC)|
425. |B2|OR D|86|ADD (HL)|A5|AND L|
426. |02|LD (BC) A|94|SUB H|5D|LD E, L|
427. |F2|LD A, (FF00 + C)|6D|LD L, L|A9|XOR C|
428. |B6|OR (HL)|9A|SBC D|88|ADC B|
429. |2E|LD L, 20|20| |37|SCF|
430. |7B|LD A, E|40|LD B, B|74|LD (HL), H|
431. |DF|RST 18|B2|OR D|14|INC D|
432. |C1|POP BC|17|RLA|49|LD C, C|
433. |61|LD H, C|68|LD L, B|42|LD B, D|
434. |9C|SBC H|E8|ADD SP, _ _|A1|AND C|
435. |0E|LD C, 45|45| |0F|RRCA|
436. |20|JR NZ, 58|58| |B5|OR L|
437. |36|LD (HL), 44|44| |7F|LD A, A|
438. |84|ADD H|7C|LD A, H|3E|LD A, _ _|
439. |28|JR Z, 18|18| |34|INC (HL)|
440. |BB|CP E|43|LD B, E|54|LD D, H|
441. |45|LD B, L|D9|RETI|6F|LD L, A|
442. |83|ADD E|F5|PUSH AF|56|LD D, (HL)|
443. |20|JR NZ, 7C|7C| |51|LD D, C|
444. |96|SUB (HL)|3B|DEC SP|97|SUB A|
445. |12|LD (DE), A |8F|ADC A|B3|OR E|
446. |A4|AND H|E3|INVALID|6A|LD L, D|
447. |74|LD (HL), H|45|LD B, L|7E|LD A, (HL)|
448. |C1|POP BC|B5|OR L|43|LD B, E|
449. |6F|LD L, A|87|ADD A|5A|LD E, D|
450. |14|INC D|4B|LD C, E|83|ADD E|
451. |A8|XOR B|CD|CALL _ _ _ _|73|LD (HL), E|
452. |A9|XOR C|C7|RST 00|BB|CP E|
453. |11|LD DE,  _ _ 0F|0F| |0C|INC C|
454. |8A|ADC D|F2|LD A, (FF00 + C)|A8|XOR B|
455. |83|ADD E|F5|PUSH AF|78|LD A, B|
456. |B9|CP C|63|LD H, E|6D|LD L, L|
457. |33|INC SP|59|LD E, C|8E|ADC (HL)|
458. |73|LD (HL), E|8E|ADC (HL)|A3|AND E|
459. |F2|LD A, (FF00 + C)|6D|LD L, L|A9|XOR C|
460. |2D|DEC L|87|ADD A|14|INC D|
461. |BD|CP L|6D|LD L, L|2F|CPL|
462. |F8|LD HL, SP + 7F|7F| |83|ADD E|
463. |EC|INVALID|4D|LD C, L|54|LD D, H|
464. |D7|RST 10|DE|SBC A, _ _|B6|OR (HL)|
465. |83|ADD E|12|LD (DE), A |0C|INC C|
466. |CD|CALL _ _ FC|FC| |89|ADC C|
467. |74|LD (HL), H|7E|LD A, (HL)|34|INC (HL)|
468. |C8|RET Z|1F|RRA|05|DEC B|
469. |DC|CALL C, _ _ 3F|3F| |76|HALT|
470. |7A|LD A, D|50|LD D, B|81|ADD C|
471. |D5|PUSH DE|54|LD D, H|72|LD (HL), D|
472. |B1|OR C|AA|XOR D|C5|PUSH BC|
473. |24|INC H|7E|LD A, (HL)|7F|LD A, A|
474. |1F|RRA|BC|CP H|50|LD D, B|
475. |58|LD E, B|31|LD SP, _ _ _ _|AA|XOR D|
476. |CF|RST 08|C7|RST 00|84|ADD H|
477. |BE|CP (HL)|C2|JP NZ, _ _ _ _|55|LD D, L|
478. |16|LD D, EA|EA| |C0|RET NZ|
479. |AB|XOR E|C3|JP _ _ _ _|7C|LD A, H|
480. |D7|RST 10|4B|LD C, E|55|LD D, L|
481. |AD|XOR L|F6|OR A, _ _|76|HALT|
482. |20|JR NZ, 2C|2C| |A3|AND E|
483. |FF|RST 38|9C|SBC H|C1|POP BC|
484. |4B|LD C, E|7E|LD A, (HL)|8D|ADC L|
485. |13|INC DE|79|LD A, C|18|JR _ _|
486. |E0|LD (FF00 + 4C), A|4C| |45|LD B, L|
487. |8F|ADC A|35|DEC (HL)|AA|XOR D|
488. |83|ADD E|05|DEC B|7F|LD A, A|
489. |B6|OR (HL)|5D|LD E, L|57|LD D, A|
490. |C2|JP NZ, _ _ 65|65| |06|LD B, _ _|
491. |DF|RST 18|C2|JP NZ, _ _ _ _|39|ADD HL, SP|
492. |8C|ADC H|FE|CP A, _ _|84|ADD H|
493. |6C|LD L, H|F0|LD A, (FF00 + _ _)|79|LD A, C|
494. |15|DEC D|51|LD D, C|39|ADD HL, SP|
495. |44|LD B, H|1E|LD E, _ _|38|JR C, _ _|
496. |B2|OR D|A5|AND L|37|SCF|
497. |B9|CP C|2D|DEC L|31|LD SP, _ _ _ _|
498. |46|LD B, (HL)|D8|RET C|5C|LD E, H|
499. |7E|LD A, (HL)|E2|LD (FF00 +  C), A|68|LD L, B|
500. |DC|CALL C, _ _ 7B|7B| |2D|DEC L|
501. |03|INC (BC)|1A|LD A,(DE)|1F|RRA|
502. |F8|LD HL, SP + 37|37| |A2|AND D|
503. |CB|RLC B|AD|XOR L|25|DEC H|
504. |69|LD L, C|9F|SBC A|61|LD H, C|
505. |20|JR NZ, B2|B2| |74|LD (HL), H|
506. |F9|LD, SP, HL|68|LD L, B|93|SUB E|
507. |54|LD D, H|65|LD H, L|15|DEC D|
508. |89|ADC C|3B|DEC SP|88|ADC B|
509. |86|ADD (HL)|F9|LD, SP, HL|1B|DEC DE|
510. |FD|INVALID|10|STOP _ _|B9|CP C|
511. |51|LD D, C|AB|XOR E|27|DAA|
512. |D2|JP NC, _ _ 98|98| |54|LD D, H|
513. |B7|OR A|4D|LD C, L|4A|LD C, D|
514. |F0|LD A, (FF00 + B1)|B1| |2C|INC L|
515. |D3|INVALID|38|JR C, _ _|02|LD (BC) A|
516. |12|LD (DE), A |A5|AND L|7C|LD A, H|
517. |BF|CP A|90|SUB B|C4|CALL NZ, _ _ _ _|
518. |F5|PUSH AF|AF|XOR A|A7|AND A|
519. |6E|LD L, (HL)|DD|INVALID|88|ADC B|
520. |67|LD H, A|BF|CP A|7A|LD A, D|
521. |3D|DEC A|DA|JP N, _ _ _ _|5B|LD E, E|
522. |98|SBC B|2E|LD L, _ _|AB|XOR E|
523. |DF|RST 18|C2|JP NZ, _ _ _ _|39|ADD HL, SP|
524. |58|LD E, B|22|LDI (HL), A|A1|AND C|
525. |13|INC DE|70|LD (HL), B|93|SUB E|
526. |A6|AND (HL)|CB|RLC B|84|ADD H|
527. |EA|LD (_ _ 0C), A|0C| |BA|CP D|
528. |32|LDD (HL), A|D2|JP NC, _ _ _ _|B2|OR D|
529. |30|JR NC, 28|28| |48|LD C, B|
530. |8B|ADC E|19|ADD HL,DE|91|SUB C|
531. |64|LD H, H|64|LD H, H|07|RLCA|
532. |53|LD D, E|17|RLA|1C|INC E|
533. |7F|LD A, A|AC|XOR H|28|JR Z, _ _|
534. |14|INC D|61|LD H, C|45|LD B, L|
535. |20|JR NZ, 98|98| |97|SUB A|
536. |D6|SUB A, 4A|4A| |C0|RET NZ|
537. |A8|XOR B|88|ADC B|93|SUB E|
538. |50|LD D, B|A2|AND D|74|LD (HL), H|
539. |53|LD D, E|C9|RET|BC|CP H|
540. |80|ADD B|89|ADC C|22|LDI (HL), A|
541. |FF|RST 38|B7|OR A|84|ADD H|
542. |70|LD (HL), B|FE|CP A, _ _|0E|LD C, _ _|
543. |F3|DI|89|ADC C|85|ADD L|
544. |C7|RST 00|B6|OR (HL)|C4|CALL NZ, _ _ _ _|
545. |BE|CP (HL)|D9|RETI|87|ADD A|
546. |0B|DEC BC|04|INC B|B3|OR E|
547. |DC|CALL C, _ _ F2|F2| |5E|LD E, (HL)|
548. |3C|INC A|0D|DEC C|94|SUB H|
549. |64|LD H, H|8D|ADC L|01|LD BC,  _ _ _ _|
550. |40|LD B, B|44|LD B, H|08|LD (_ _ _ _), SP|
551. |6A|LD L, D|1E|LD E, _ _|BB|CP E|
552. |BB|CP E|0A|LD A, (BC)|49|LD C, C|
553. |A6|AND (HL)|C8|RET Z|00|NOP|
554. |6B|LD L, E|4D|LD C, L|61|LD H, C|
555. |7A|LD A, D|0A|LD A, (BC)|45|LD B, L|
556. |C1|POP BC|8F|ADC A|5C|LD E, H|
557. |13|INC DE|9B|SBC E|4C|LD C, H|
558. |CE|ADC A, 50|50| |C5|PUSH BC|
559. |75|LD (HL), L|E1|POP HL|7D|LD A, L|
560. |89|ADC C|E5|PUSH HL|A2|AND D|
561. 
562. %%TAB Minimize tab%%
563. %%TAB_END%%
564. 
565. ! Ending
566. There are multiple ways to trigger the credits:
567. 1. Change game state to 48
568. 2. Warp to final area, then beat the boss
569. 3. Trigger the ending scene.
570. 4. Trigger the event right before the credits play
571. 
572. Method 1 only triggers the credits, but has no effect on the game whatsoever; the final boss flag at C5A1 does not get set, nor does the post game content flags. I do not think this counts as beating the game.
573. 
574. For method 2, this is the way the first 3 runs submitted uses method 2. Run 1 warps to the final area by taking advantage of the fact the map for the indoor areas and the antenna trees are all connected to each other. This means it's possible to run to the final antenna tree from the mountain one.
575. 
576. The 2nd and 3rd TAS jumps to VRAM, then due to an emulator bug regarding the STOP opcode (10 10), it doesn't crash, and instead coincidentally changes the map id to the final, upper left quadrant of the map, which is the final antenna tree's location.
577. 
578. This sets the final boss flag, along with post credits content, but is the slowest.
579. 
580. Method 3 sets the final boss flag. This can be done by setting the following values:
581. CD00 = 01
582. CD02 = 0B
583. CD03 = 01
584. CD06 = 6A
585. This sets up the script for the scene right before you get teleported to the beginning area. There's still a final scene afterwards however, so while it's faster than method 2, it's not ideal.
586. 
587. This submission uses method 4. This can be done by setting the following values:
588. CD00 = 01
589. CD02 = 1A
590. CD03 = 01
591. CD06 = 6F
592. This sets up the script for the very end part of the final dialogue, right before the post credits content flags are set. While this does not trigger the final boss flag, it does update the game into thinking you beat it. The reason why this even works is because the game does the following:
593. 1. Dialogue with boss -> Method 2
594. 2. Fight boss
595. 3. Dialogue with boss
596. 4. Update final boss flag -> Method 3
597. 5. Ending scene
598. 6. Update post credits content flags -> Method 4
599. 
600. ! Payload
601. 
602. There's multiple ways to handle this. 
603. 
604. I initially wanted to just call the function that sets the game state to 48. That function is located at ROM bank 0F however. So I tried to somehow swap to bank 0F to call the credits, then somehow jump back. This was basically method 1 however, so CasualPokePlayer suggested to skip manpulating all those values to get :
605. 
606. ld bc,1d18
607. add hl,bc ; hl = e3e1
608. ld (hl),$30
609. jp somewhereitdontcrash?
610. 
611. After looking at the telefang translation github however, I found out the game's script function was partially documented:
612. https://github.com/telefang/telefang/blob/master/components/eventscript/interpreter.asm
613. In this case:
614. CD00 - trigger event
615. CD02 - Event ID
616. CD03 - something about jp pointer
617. CD06 - Event's sequence (how far you're in to event)
618. 
619. I initially had no idea how would I set multiple values up with the limited amount of addresses, until I found out recruited Telefang names are all stored side by side in CartRAM at 5200. To get to this to appear at System Bus however, I neded a way to swap SWRAM banks. Luckily, CasualPokePlayer found out there's a function located at 3D6A that does that:
620. https://github.com/telefang/telefang/blob/3ec7bf14bf4b6686cbd2067f7e3e204724dd3648/components/saveclock/sram_lock.asm#L3-L11
621. 
622. This meant that rather that finding some combination of values to manpulate to somehow swap SWRAM banks, I could just call 3D6A. My name is long enough to do this:
623. ||Opcode||Name||Function||
624. |CD 6A 3D|ーゃか|Call 3D6A|
625. |21 03 59|ムウも|LD HL, 5903|
626. |29|ル|ADD HL, HL|
627. |E0 E0|null|LD (FF00 + E0), A|
628. 
629. To jump to HL, I initially wanted to use the frame counter at C938 to E9 (JP HL), but it turns out C937 is always 01, which makes C938 unuseable due to the opcode being 2 bytes. Instead, I used C948 (Follower X pos on phone use) to get to E9 for the jump. The 03 offset for 5903 is because the 1st Denjuu's name last character (E0) is a 2 byte opcode, so it would mess up the payload.
630. 
631. Now that I could jump to the names, CasualPokePlayer suggested the following payload:
632. ||Opcode||Name||Function||
633. |DENJUU|ONE|ム  ユュア|
634. |21 00 00|ム  |LD HL,0000|
635. |25|ユ|DEC HL ; HL = ffff|
636. |36 01|ュア|LD [HL],$01 ; only enable vblank interrupts|
637. |DENJUU|TWO|ンちルヤア5|
638. |2E 48|ンち|LD l,$48 ; workaround no $90|
639. |29|ル|add HL,HL|
640. |24|ヤ|INC H ; HL = FF90|
641. |01 C0|ア5|LD BC|
642. |DENJUU|THREE|キコェあネェ|
643. |07|キ|LD BC,$07C0|
644. |0A|コ|LD A,[Unexpected EOL parsing text in []BC ; A = FC|
645. |32|ェ|LDD (HL), A|
646. |3E 18|あネ|LD A,$18|
647. |32|ェ|LDD (HL), A|
648. |DENJUU|FOUR|アけモコェ8|
649. |01 40 23|アけモ|	LD BC,$2340|
650. |0A|コ||LD A,[BC] ; load A with 76|
651. |32|ェ|LDD (HL), A|
652. |C3|8|JP|
653. |DENJUU|FIVE|け ア|
654. |40 00|け |JP to HL|
655. |01|ア|To get the 00 above|
656. 
657. This didn't seem to work out however, so instead the payload was:
658. 
659. 
660. !! Stage by stage comments
661. 
662. ! <Put the name of the first stage here>
663. 
664. <Explain the first stage here>
665. 
666. ! <Put the name of the second stage here>
667. 
668. <Explain the second stage here>
669. 
670. <And so on>
671. 
672. !! Other comments
673. 
674. <Explain here things the audience would probably like to see>
675. <Explain also things that could be improved in your movie>   
676. <You may also suggest screenshots.>
677. ----
678. [user:Samsara]: wait i think this one's legit. anyway here's my number, so call me maybe (hands you a slip of paper with 69 written on it in crayon)
679. 
680. [user:Samsara]: Aw, here it goes.
681. 
682. [user:feos]: Fixed code embed (by replacing with monospaced, since code embeds don't have linbreaks in the forum view).
683. 
684. [user:Samsara]: Adding GEG branch due to ACE usage.
685. 
686. [user:Samsara]: The ending thing hasn't quite been explained in the submission text yet I don't think, so I'll summarize it here: This run triggers the ''very'' end of the ending, just before the credits. This plays the credits, of course, but more importantly it sets the game completion state by unlocking postgame content. Triggering the credits directly would not have done this, and triggering anything before this would have lost time. I've verified that the postgame state was triggered in this run by locating and accessing a piece of postgame content, meaning that for our purposes, the game is considered complete. Note that other event flags are NOT triggered, most notably the flag for the final boss's defeat. Flags like these are not necessary for GEG runs: Since a majority of the game is skipped anyway, so are a majority of normally required event flags. As long as these flags do not adversely affect the ending by not being triggered, then triggering them is unnecessary. In this case, since the final boss flag does not directly trigger the postgame content, it is fine that it is skipped.
687. 
688. That leaves the nature of the ACE itself: The currently published "map glitch" run has the same issue that the [2749M|Wario Land GEG] has. To simplify the explanation: VBA bad. To expound on the simplifying of the explanation: The previous Telefang runs and that Wario Land GEG run were only possible because VBA did not crash where an actual (or properly emulated) GBA ''would'' crash. This run avoids that through different methodology while also being a couple minutes faster to boot. Given that the run was performed on BizHawk, I am ''far'' more confident that this is legit given the incredible dedication of the GB/C emulation community to accuracy for console verification purposes.
689. 
690. I'm accepting this to obsolete the [2225M|map glitch] run, as it serves the same purpose with actual legitimacy this time. Thanks, VBA!
691. 
692. EDIT: Since this judgement, the TAS has been [=forum/p/504715#504715|console verified], so... I guess it's double accepted now. Hooray!
693. 
694. [user:fsvgm777]: Processing. [user:EZGames69] is handling the encodes for this one.

Last Edited by admin@tasvideos.org on 1/1/2022 6:14:02 PM
Page History Latest diff List Referrers