Post by feos

It turns out the infamous "Pokemon ripoff" has ACE as well, just like Pokemon.

Game objectives

Emulator used: BizHawk 2.5, GB player
<List the objectives of your movie here>
<Another objective>
<And so on>

Comments

I always knew this game could have a game end glitch, but wasn't able to figure out how it worked. After some guidance from CasualPokePlayer, I managed to discover that various NPC ID combinations jump to various parts of the game's memory, leading to crashes. The gameboy player was used, since the previous run relied on an emulator bug regarding STOP (opcode #10 10), so I wanted the run to have a chance to get console verified one day.

While CasualPokePlayer and Mister Chess did not contribute to the input directly, I made them coauthors since they were very helpful in finding out how the NPCs glitched up, while CasualPokePlayer also gave a payload to jump to the controller directly (which unfortunately ended up unused) along with where to jump to.

Map bug

This is the main bug in all iterations of the any% Telefang TAS. When you do the following actions: 1. Open the map with Start 2. Entering a building 3. Trigger a battle

the game writes the bytes for you and the NPCs from WRAM to CartRAM, one byte at a time. Onc the battle is over, or when you close the map, the values are written back to WRAM. Given enough lag however, the game fails to write all the addresses. In the case for this run:

5F47:  1A        LD   A,(DE)         A:a3 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3  Cy:1320480764
5F48:  22        LD   (HL+),A        A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3  Cy:1320480772
5F49:  13        INC  DE             A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480780
5F4A:  0B        DEC  BC             A:00 B:00 C:a3 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480788
5F4B:  78        LD   A,B            A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480796
5F4C:  B1        OR   C              A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480800
5F4D:  20 F8     JR   NZ,5F47h       A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480804
5F47:  1A        LD   A,(DE)         A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480816
5F48:  22        LD   (HL+),A        A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3  Cy:1320480824
5F49:  13        INC  DE             A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5f LY:37 SP:dff3  Cy:1320480832
0040:  C3 E7 02  JP   #02E7h         A:db B:00 C:a2 D:c2 E:ff F:00 H:a2 L:5f LY:90 SP:dff1  Cy:1320480860

The process took too long, so it gets interrupted. The reason I call it map bug however, is because that's the only action you can use to trigger this. There's no area where you can trigger either a battle, or enter a room with tons of lag.

While this might seem to indicate you only need lag, I have never managed to trigger this bug without the phone ringing. The phone only rings once every 5 minutes when you have at least 2 Denjuu, so I'm forced to wait 5 minutes.

The very first Telefang TAS took advantage of the game failing to copy my game position to get to the final dungeon. The subsequent TASes uses this bug to get glitched combinations of NPC values to jump to WRAM.

NPCs

The following NPCs are reachable within the first 5 minutes of the game, while also reachable to each other without triggering combat.

Map ID	Map Coord	NPC 1	NPC 2
4	20	3	76
4	19	207	75
4	19	219	75
4	11	207	73
4	19	219	73
4	11	0	0
4	18	167	75
4	4	104	72
2	60	210	70
2	59	170	70

The addresses for their IDs are: 0xC2BE, 0xC2BF 0xC2DE, 0xC2DF 0xC2FE, 0xC2FF 0xC31E, 0xC31F 0xC33E, 0xC33F

There are more, but these are the ones the above uses. Not every one of them can be mixed together with the map bug. Moving around map coordinates change the address the NPC is on, but since the maps are connected, some only get written to specific addresses. For instance: You start at Map 4, Coord 19. You can only go north and east. The values right now are:

0xC2BE, 0xC2BF = 207, 75
0xC2DE, 0xC2DF = 219, 75
0xC2FE, 0xC2FF = 0,0 
0xC31E, 0xC31F = 0,0 
0xC33E, 0xC33F = 0,0

Going east gives

0xC2BE, 0xC2BF = 207, 75
0xC2DE, 0xC2DF = 219, 75
0xC2FE, 0xC2FF = 3,76 
0xC31E, 0xC31F = 0,0 
0xC33E, 0xC33F = 0,0

Backtracking, then going north gives

0xC2BE, 0xC2BF = 207, 75
0xC2DE, 0xC2DF = 219, 75
0xC2FE, 0xC2FF = 207, 73 
0xC31E, 0xC31F = 219, 73 
0xC33E, 0xC33F = 0,0

As you can see, the IDs: 3, 76 got overwritten. Attempting to reload the NPC only places them to 0xC2BE, 0xC2BF. This means there's no way to get addresses

0xC2DE, 0xC2DF, 
0xC31E, 0xC31F,
0xC33E, 0xC33F

to have the values of 3, 76.

Similarrly, there's no way to get the values of 3, 76 to be at 0xC2BE, 0xC2BF. This restricts me to only 1 room possible for the bug.

Possible values for 0xC2BE, 0xC2BF

0, 0 (By resetting)
3, 76
104, 72
167, 75
170, 70
207, 73
207, 75

Possible values for 0xC2DE, 0xC2DF

Possible values for 0xC2FE, 0xC2FF

Possible values for 0xC31E, 0xC31F

0, 0 (By resetting)
207, 75
219, 73

Collision effects

If 2 NPC IDs can exist at the same pair of addresses, it's possible to get a combination of them using the map bug. The following collisions are possible:

3, 0 -> The NPC starts floating up and down. They cannot be talked to.
3, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD
3, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD
3, 73 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F
3, 75 -> Nothing wrong; this is a valid NPC
3, 76 -> Nothing wrong; this is a valid NPC

104, 0 -> Glitches the graphics and lags the game badly.
104, 70 -> They become a Denjuu trainer with a level 0 Tsunonasu
104, 72 -> Nothing wrong; this is a valid NPC
104, 73 -> Spins around in circles
104, 75 -> Crashes at 0x47DA due to 0xE4
104, 76 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F

167, 0 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62.
167, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 75 -> Nothing wrong; this is a valid NPC
167, 76 -> Jumps to 0x84FA via 0xE9 JP (HL) at 0x4EFB, then crashes 1 instruction later by 0xFC

170, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then crashes due to 0xF4
170, 70 -> Nothing wrong; this is a valid NPC
170, 72 -> Nothing wrong; this is a valid NPC
170, 73 -> Makes the NPC run in place. Talkng to them triggers a fight with trainer with 3 Denjuu at level 10
170, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
170, 76 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62. While the values earlier can be slightly manipulated by having different amounts of money, the sequence 0x10 10 is from the character "ル", which is unavoidable. The currently published TAS emulates the instruction wrong by simply ignoring it. Therefore, the currently published route using this combination is impossible.

207, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then eventually jumps to 0xFAFA via 0xE9 JP (HL) at 0x049D before jumping to 0x0000 via 0xE9 JP (HL) at 0xFD12. It gets stuck in a loop at 0x0028 to 0x0030.
207, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
207, 72 -> Nothing wrong; this is a valid NPC
207, 73 -> Nothing wrong; this is a valid NPC
207, 75 -> Nothing wrong; this is a valid NPC
207, 76 -> Jumps to 0x8005 via 0xD9 RETI at 0x0323. It then crashes at 0x8059 via 0xFC.

210, 0 -> The NPC becomes untalkable
210, 70 -> Nothing wrong; this is a valid NPC
210, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
210, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD

219, 0 -> Jumps to 0x0000 via 0xE9 JP (HL) at 0x049D, then gets stuck in a loop from 0x0028 to 0x0030.
219, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). It then gets stuck in a loop from 0x0028 to 0x0030.
219, 73 -> Nothing wrong; this is a valid NPC
219, 75 -> Nothing wrong; this is a valid NPC
219, 76 -> Jumps to 0xC6C9 via 0xE9 JP (HL) at 0x4EFB, then NOP slides to player data at 0xC900

Based on the above, the only useable combination is 219, 76.

Player data

Now that we have a way to jump into player data, we need to document what is possible. 0xC800 region gets set much much later in the game, so for the purpose of the run, everything from 0xC6C9 to 0xC8FF is 0.

All values are in hex:

Address	Purpose	Values possible during run	Opcode
C900	Defaults to 1. Setting to 0 takes me back to start of game human world. 2 makes me fall from sky. Changing from 1 disables menus.	1	LD BC, 5048
C901	Spawn X (where you appear on room load) + X pos on phone use	09-98
C902	Spawn Y (where you appear on room load) + Y pos on phone use	10-80
C903	Acre	93	SUB E
C904	Map ID	04	INC B
C905	Map type	00	NOP
C906	Map Coord	13	INC DE
C907	??	02	NOP
C908	??	00	NOP
C909	??	00	NOP
C90A	??	00	NOP
C90B	??	00	NOP
C90C	??	00	NOP
C90D	??	00	NOP
C90E	??	00	NOP
C90F	Last visited map coord	0B, 14	DEC BC

Address	Purpose	Values possible during run	Opcode
C910	Money	00-FF	Varies
C911	Money	0-4*	Varies
C912	Follower sprite ID	Varies*	Varies
C913	Map Coord	13	INC DE
C914	Map type	04	INC B
C915	Ranges from 0-9 as you go left to right screen	2-9	Varies
C916	Ranges from 0-7 as you go up to down the screen	0-7	Varies
C917	Music? Overworld is 3	03	INC (BC)
C918	??	00	NOP
C919	1 if walking. else 0	0	NOP
C91A	Idle timer	0	NOP
C91B	??	00	NOP
C91C	??	00	NOP
C91D	Change to 1 to trigger battle	0	NOP
C91E	Set to E0 at start. Changes to F0 in battle	E0	LD (FF00 + C0), A
C91F	Set to C0 at start. Changing it affects text	C0

Address	Purpose	Values possible during run	Opcode
C920	Randomly assigned on start	Varies**	Varies
C921	Randomly assigned on start	Varies**	Varies
C922	Goes up on grass	00-3F	Varies
C923	Randomly changes	??	Varies
C924	??	05	DEC B
C925	??	00	NOP
C926	Map ID	04	INC B
C927	Map Coord	13	INC DE
C928	Spawn X (where you appear on room load) + X pos on phone use	09-98	Varies
C929	Spawn Y (where you appear on room load) + Y pos on phone use	10-80	Varies
C92A	??	00	NOP
C92B	??	00	NOP
C92C	Player Name Character 1	CD	Call 3D6A
C92D	Player Name Character 2	6A
C92E	Player Name Character 3	3D
C92F	Player Name Character 4	21	LD HL, 5903

Address	Purpose	Values possible during run	Opcode
C930	Player Name Character 5	03	LD HL, 5903
C931	Player Name Character 6	59
C932	Player Name Character 7	29	ADD HL, HL
C933	Player Name Character 8	E0	LD (FF00 + E0), A
C934	Player Name String Terminator	E0
C935	??	00	NOP
C936	Sets to 1 at game start	01	LD BC, 1101
C937	Sets to 1 after intro cutscene	01
C938	Frame	00-FF
C9C9	Seconds	04	INC B
C9CA	Minutes	05	DEC B
C9CB	Hours	00	NOP
C9CC	??	00	NOP
C9CD	??	00	NOP
C9CE	Sets to 1 at game start	01	LD BC, 0500
C9CF	??	00

Address	Purpose	Values possible during run	Opcode
C940	Decrements from 5?	05	LD BC, 0500
C941	??	00	NOP
C942	??	00	NOP
C943	Randomly assigned on start	Varies**	Varies
C944	??	00	NOP
C945	??	01	LD BC, 0000
C946	Shop item you picked up	00
C947	Using phone bool	00
C948	Follower X pos on phone use	00-FF	Varies
C949	Follower X pos on phone use	00-FF	Varies
C94A	Follower Y pos on phone use	00-FF	Varies
C94B	Follower Y pos on phone use	00-FF	Varies
C94C	Turned to 1 at 1st screen of Denjuu World?	00	NOP
C94D	Calling Denjuu name	Varies	Varies
C94E	Calling Denjuu name? Seems to be A0	Varies	Varies
C94F	Phone timer	Varies	Varies

*Values for C912

Value	Denjuu	Opcode
00	Tsunonasu	NOP
01	Kochia	LD BC, _ _ _ _
02	Oshe	LD (BC) A
03	Keshi*	INC (BC)
04	Crypto*	INC B
05	Monstera	DEC B
06	Fungus	LD B, _ _
2F	Musa	CPL
36	Hagumanoki	LD (HL), _ _
64	Hiyu	LD H, H
67	Gamuru	LD H, A
69	Gaultheria	LD L, C
6B	Kaya	LD L, E
6C	Denfare	LD L, H
82	Beebalm	ADD D
83	Salal	ADD E
84	Enishida	ADD H
92	Ruscus	SUB D
94	Zea	SUB H
A5	Kanzou	AND L
A6	Ornithogalum	AND (HL)

Power version only

**Values for C920, C921, C943

The following are all the 256 possible combinations of the values for C920, C921, C943

Values
Minimize tab

C920	Opcode	C921	Opcode	C943	Opcode
89	ADC C	E5	PUSH HL	A2	AND D
A9	XOR C	98	SBC B	AD	XOR L
8C	ADC H	65	LD H, L	AC	XOR H
E4	INVALID	5D	LD E, L	35	DEC (HL)
32	LDD (HL), A	8E	ADC (HL)	AB	XOR E
BF	CP A	3F	CCF	5A	LD E, D
ED	INVALID	25	DEC H	35	DEC (HL)
78	LD A, B	B1	OR C	57	LD D, A
D9	RETI	3D	DEC A	AF	XOR A
E0	LD (FF00 + 83), A	83		1E	LD E, _ _
83	ADD E	09	ADD HL, BC	76	HALT
68	LD L, B	AC	XOR H	B0	OR B
FD	INVALID	07	RLCA	8F	ADC A
B7	OR A	CD	CALL _ _ _ _	7A	LD A, D
40	LD B, B	8D	ADC L	19	ADD HL,DE
FB	EI	F1	POP AF	32	LDD (HL), A
C2	JP NZ, _ _ 8E	8E		28	JR Z, _ _
A7	AND A	B8	CP B	C6	ADD A, _ _
9B	SBC E	F7	RST 30	37	SCF
66	LD H, (HL)	A5	AND L	8C	ADC H
42	LD B, D	1D	DEC E	92	SUB D
9C	SBC H	F6	OR A, _ _	6E	LD L, (HL)
A3	AND E	FB	EI	A8	XOR B
D2	JP NC, _ _ 99	99		28	JR Z, _ _
D7	RST 10	5D	LD E, L	02	LD (BC) A
7E	LD A, (HL)	CF	RST 08	97	SUB A
91	SUB C	99	SBC C	65	LD H, L
7A	LD A, D	0A	LD A, (BC)	45	LD B, L
67	LD H, A	87	ADD A	4B	LD C, E
18	JR 2F	2F		68	LD L, B
89	ADC C	2C	INC L	00	NOP
2F	CPL	55	LD D, L	15	DEC D
D6	SUB A, 6D	6D		0E	LD C, _ _
E5	PUSH HL	7B	LD A, E	25	DEC H
9C	SBC H	FB	EI	95	SUB L
A5	AND L	7F	LD A, A	28	JR Z, _ _
E1	POP HL	18	JR _ _	B2	OR D
1A	LD A,(DE)	A3	AND E	97	SUB A
F0	LD A, (FF00 + C0)	C0		1E	LD E, _ _
C3	JP _ _ 2E	2E		88	ADC B
DF	RST 18	B4	OR H	86	ADD (HL)
96	SUB (HL)	86	ADD (HL)	42	LD B, D
76	HALT	B8	CP B	9B	SBC E
01	LD BC, _ _ 16	16		B1	OR C
29	ADD HL, HL	61	LD H, C	64	LD H, H
16	LD D, BE	BE		A0	AND B
15	DEC D	79	LD A, C	18	JR _ _
E3	INVALID	F4	INVALID	2E	LD L, _ _
B8	CP B	45	LD B, L	B2	OR D
AE	XOR (HL)	CF	RST 08	5A	LD E, D
7F	LD A, A	CE	ADC A, _ _	5D	LD E, L
3B	DEC SP	F3	DI	B3	OR E
57	LD D, A	3C	INC A	6C	LD L, H
D8	RET C	59	LD E, C	08	LD (_ _ _ _), SP
73	LD (HL), E	56	LD D, (HL)	6C	LD L, H
DE	SBC A, D8	D8		58	LD E, B
D0	RET NC	AA	XOR D	45	LD B, L
18	JR 3F	3F		99	SBC C
27	DAA	BB	CP E	4B	LD C, E
7E	LD A, (HL)	D0	RET NC	B0	OR B
5C	LD E, H	86	ADD (HL)	73	LD (HL), E
A9	XOR C	26	LD H, _ _	3B	DEC SP
F6	OR A, 56	56		84	ADD H
DA	JP N, _ _ 04	04		34	INC (HL)
D1	POP DE	AB	XOR E	A0	AND B
9A	SBC D	27	DAA	9C	SBC H
F2	LD A, (FF00 + C)	D8	RET C	23	INC HL
7F	LD A, A	54	LD D, H	4C	LD C, H
8C	ADC H	D1	POP DE	0A	LD A, (BC)
95	SUB L	34	INC (HL)	52	LD D, D
A9	XOR C	93	SUB E	2C	INC L
DD	INVALID	D3	INVALID	0D	DEC C
40	LD B, B	97	SUB A	6F	LD L, A
89	ADC C	6B	LD L, E	78	LD A, B
70	LD (HL), B	C8	RET Z	30	JR NC, _ _
59	LD E, C	3B	DEC SP	B7	OR A
F3	DI	CD	CALL _ _ _ _	1E	LD E, _ _
1D	DEC E	DF	RST 18	23	INC HL
E8	ADD SP, 75	75		73	LD (HL), E
D5	PUSH DE	C2	JP NZ, _ _ _ _	96	SUB (HL)
11	LD DE, _ _ 64	64		8F	ADC A
98	SBC B	47	LD B, A	B4	OR H
75	LD (HL), L	C8	RET Z	A7	AND A
64	LD H, H	64	LD H, H	37	SCF
35	DEC (HL)	5D	LD E, L	8C	ADC H
FA	LD A, (_ _ 08)	08		C3	JP _ _ _ _
14	INC D	89	ADC C	23	INC HL
C7	RST 00	87	ADD A	8E	ADC (HL)
4E	LD C, (HL)	B6	OR (HL)	86	ADD (HL)
94	SUB H	D6	SUB A, _ _	B2	OR D
4B	LD C, E	88	ADC B	1E	LD E, _ _
7E	LD A, (HL)	D0	RET NC	B0	OR B
89	ADC C	02	LD (BC) A	30	JR NC, _ _
8C	ADC H	99	SBC C	97	SUB A
FD	INVALID	E6	AND A, _ _	63	LD H, E
52	LD D, D	68	LD L, B	7A	LD A, D
4D	LD C, L	C6	ADD A, _ _	92	SUB D
B6	OR (HL)	4C	LD C, H	85	ADD L
8C	ADC H	E1	POP HL	68	LD L, B
63	LD H, E	9B	SBC E	2F	CPL
52	LD D, D	A5	AND L	39	ADD HL, SP
B3	OR E	73	LD (HL), E	18	JR _ _
04	INC B	ED	INVALID	43	LD B, E
70	LD (HL), B	32	LDD (HL), A	BC	CP H
89	ADC C	A4	AND H	34	INC (HL)
9D	SBC L	F2	LD A, (FF00 + C)	9C	SBC H
15	DEC D	3B	DEC SP	76	HALT
71	LD (HL), C	B3	OR E	44	LD B, H
E4	INVALID	EF	RST 28	73	LD (HL), E
15	DEC D	F3	DI	0F	RRCA
8B	ADC E	E2	LD (FF00 + C), A	9C	SBC H
D4	CALL NZ, _ _ 83	83		1C	INC E
8F	ADC A	85	ADD L	58	LD E, B
FC	INVALID	B5	OR L	08	LD (_ _ _ _), SP
7A	LD A, D	57	LD D, A	64	LD H, H
51	LD D, C	0B	DEC BC	15	DEC D
5B	LD E, E	03	INC (BC)	1D	DEC E
EE	XOR A, 9F	9F		6C	LD L, H
14	INC D	66	LD H, (HL)	99	SBC C
C3	JP _ _ C7	C7		BF	CP A
D9	RETI	15	DEC D	0A	LD A, (BC)
B2	OR D	86	ADD (HL)	A5	AND L
02	LD (BC) A	94	SUB H	5D	LD E, L
F2	LD A, (FF00 + C)	6D	LD L, L	A9	XOR C
B6	OR (HL)	9A	SBC D	88	ADC B
2E	LD L, 20	20		37	SCF
7B	LD A, E	40	LD B, B	74	LD (HL), H
DF	RST 18	B2	OR D	14	INC D
C1	POP BC	17	RLA	49	LD C, C
61	LD H, C	68	LD L, B	42	LD B, D
9C	SBC H	E8	ADD SP, _ _	A1	AND C
0E	LD C, 45	45		0F	RRCA
20	JR NZ, 58	58		B5	OR L
36	LD (HL), 44	44		7F	LD A, A
84	ADD H	7C	LD A, H	3E	LD A, _ _
28	JR Z, 18	18		34	INC (HL)
BB	CP E	43	LD B, E	54	LD D, H
45	LD B, L	D9	RETI	6F	LD L, A
83	ADD E	F5	PUSH AF	56	LD D, (HL)
20	JR NZ, 7C	7C		51	LD D, C
96	SUB (HL)	3B	DEC SP	97	SUB A
12	LD (DE), A	8F	ADC A	B3	OR E
A4	AND H	E3	INVALID	6A	LD L, D
74	LD (HL), H	45	LD B, L	7E	LD A, (HL)
C1	POP BC	B5	OR L	43	LD B, E
6F	LD L, A	87	ADD A	5A	LD E, D
14	INC D	4B	LD C, E	83	ADD E
A8	XOR B	CD	CALL _ _ _ _	73	LD (HL), E
A9	XOR C	C7	RST 00	BB	CP E
11	LD DE, _ _ 0F	0F		0C	INC C
8A	ADC D	F2	LD A, (FF00 + C)	A8	XOR B
83	ADD E	F5	PUSH AF	78	LD A, B
B9	CP C	63	LD H, E	6D	LD L, L
33	INC SP	59	LD E, C	8E	ADC (HL)
73	LD (HL), E	8E	ADC (HL)	A3	AND E
F2	LD A, (FF00 + C)	6D	LD L, L	A9	XOR C
2D	DEC L	87	ADD A	14	INC D
BD	CP L	6D	LD L, L	2F	CPL
F8	LD HL, SP + 7F	7F		83	ADD E
EC	INVALID	4D	LD C, L	54	LD D, H
D7	RST 10	DE	SBC A, _ _	B6	OR (HL)
83	ADD E	12	LD (DE), A	0C	INC C
CD	CALL _ _ FC	FC		89	ADC C
74	LD (HL), H	7E	LD A, (HL)	34	INC (HL)
C8	RET Z	1F	RRA	05	DEC B
DC	CALL C, _ _ 3F	3F		76	HALT
7A	LD A, D	50	LD D, B	81	ADD C
D5	PUSH DE	54	LD D, H	72	LD (HL), D
B1	OR C	AA	XOR D	C5	PUSH BC
24	INC H	7E	LD A, (HL)	7F	LD A, A
1F	RRA	BC	CP H	50	LD D, B
58	LD E, B	31	LD SP, _ _ _ _	AA	XOR D
CF	RST 08	C7	RST 00	84	ADD H
BE	CP (HL)	C2	JP NZ, _ _ _ _	55	LD D, L
16	LD D, EA	EA		C0	RET NZ
AB	XOR E	C3	JP _ _ _ _	7C	LD A, H
D7	RST 10	4B	LD C, E	55	LD D, L
AD	XOR L	F6	OR A, _ _	76	HALT
20	JR NZ, 2C	2C		A3	AND E
FF	RST 38	9C	SBC H	C1	POP BC
4B	LD C, E	7E	LD A, (HL)	8D	ADC L
13	INC DE	79	LD A, C	18	JR _ _
E0	LD (FF00 + 4C), A	4C		45	LD B, L
8F	ADC A	35	DEC (HL)	AA	XOR D
83	ADD E	05	DEC B	7F	LD A, A
B6	OR (HL)	5D	LD E, L	57	LD D, A
C2	JP NZ, _ _ 65	65		06	LD B, _ _
DF	RST 18	C2	JP NZ, _ _ _ _	39	ADD HL, SP
8C	ADC H	FE	CP A, _ _	84	ADD H
6C	LD L, H	F0	LD A, (FF00 + _ _)	79	LD A, C
15	DEC D	51	LD D, C	39	ADD HL, SP
44	LD B, H	1E	LD E, _ _	38	JR C, _ _
B2	OR D	A5	AND L	37	SCF
B9	CP C	2D	DEC L	31	LD SP, _ _ _ _
46	LD B, (HL)	D8	RET C	5C	LD E, H
7E	LD A, (HL)	E2	LD (FF00 + C), A	68	LD L, B
DC	CALL C, _ _ 7B	7B		2D	DEC L
03	INC (BC)	1A	LD A,(DE)	1F	RRA
F8	LD HL, SP + 37	37		A2	AND D
CB	RLC B	AD	XOR L	25	DEC H
69	LD L, C	9F	SBC A	61	LD H, C
20	JR NZ, B2	B2		74	LD (HL), H
F9	LD, SP, HL	68	LD L, B	93	SUB E
54	LD D, H	65	LD H, L	15	DEC D
89	ADC C	3B	DEC SP	88	ADC B
86	ADD (HL)	F9	LD, SP, HL	1B	DEC DE
FD	INVALID	10	STOP _ _	B9	CP C
51	LD D, C	AB	XOR E	27	DAA
D2	JP NC, _ _ 98	98		54	LD D, H
B7	OR A	4D	LD C, L	4A	LD C, D
F0	LD A, (FF00 + B1)	B1		2C	INC L
D3	INVALID	38	JR C, _ _	02	LD (BC) A
12	LD (DE), A	A5	AND L	7C	LD A, H
BF	CP A	90	SUB B	C4	CALL NZ, _ _ _ _
F5	PUSH AF	AF	XOR A	A7	AND A
6E	LD L, (HL)	DD	INVALID	88	ADC B
67	LD H, A	BF	CP A	7A	LD A, D
3D	DEC A	DA	JP N, _ _ _ _	5B	LD E, E
98	SBC B	2E	LD L, _ _	AB	XOR E
DF	RST 18	C2	JP NZ, _ _ _ _	39	ADD HL, SP
58	LD E, B	22	LDI (HL), A	A1	AND C
13	INC DE	70	LD (HL), B	93	SUB E
A6	AND (HL)	CB	RLC B	84	ADD H
EA	LD (_ _ 0C), A	0C		BA	CP D
32	LDD (HL), A	D2	JP NC, _ _ _ _	B2	OR D
30	JR NC, 28	28		48	LD C, B
8B	ADC E	19	ADD HL,DE	91	SUB C
64	LD H, H	64	LD H, H	07	RLCA
53	LD D, E	17	RLA	1C	INC E
7F	LD A, A	AC	XOR H	28	JR Z, _ _
14	INC D	61	LD H, C	45	LD B, L
20	JR NZ, 98	98		97	SUB A
D6	SUB A, 4A	4A		C0	RET NZ
A8	XOR B	88	ADC B	93	SUB E
50	LD D, B	A2	AND D	74	LD (HL), H
53	LD D, E	C9	RET	BC	CP H
80	ADD B	89	ADC C	22	LDI (HL), A
FF	RST 38	B7	OR A	84	ADD H
70	LD (HL), B	FE	CP A, _ _	0E	LD C, _ _
F3	DI	89	ADC C	85	ADD L
C7	RST 00	B6	OR (HL)	C4	CALL NZ, _ _ _ _
BE	CP (HL)	D9	RETI	87	ADD A
0B	DEC BC	04	INC B	B3	OR E
DC	CALL C, _ _ F2	F2		5E	LD E, (HL)
3C	INC A	0D	DEC C	94	SUB H
64	LD H, H	8D	ADC L	01	LD BC, _ _ _ _
40	LD B, B	44	LD B, H	08	LD (_ _ _ _), SP
6A	LD L, D	1E	LD E, _ _	BB	CP E
BB	CP E	0A	LD A, (BC)	49	LD C, C
A6	AND (HL)	C8	RET Z	00	NOP
6B	LD L, E	4D	LD C, L	61	LD H, C
7A	LD A, D	0A	LD A, (BC)	45	LD B, L
C1	POP BC	8F	ADC A	5C	LD E, H
13	INC DE	9B	SBC E	4C	LD C, H
CE	ADC A, 50	50		C5	PUSH BC
75	LD (HL), L	E1	POP HL	7D	LD A, L
89	ADC C	E5	PUSH HL	A2	AND D

Ending

There are multiple ways to trigger the credits: 1. Change game state to 48 2. Warp to final area, then beat the boss 3. Trigger the ending scene. 4. Trigger the event right before the credits play

Method 1 only triggers the credits, but has no effect on the game whatsoever; the final boss flag at C5A1 does not get set, nor does the post game content flags. I do not think this counts as beating the game.

For method 2, this is the way the first 3 runs submitted uses method 2. Run 1 warps to the final area by taking advantage of the fact the map for the indoor areas and the antenna trees are all connected to each other. This means it's possible to run to the final antenna tree from the mountain one.

The 2nd and 3rd TAS jumps to VRAM, then due to an emulator bug regarding the STOP opcode (10 10), it doesn't crash, and instead coincidentally changes the map id to the final, upper left quadrant of the map, which is the final antenna tree's location.

This sets the final boss flag, along with post credits content, but is the slowest.

Method 3 sets the final boss flag. This can be done by setting the following values: CD00 = 01 CD02 = 0B CD03 = 01 CD06 = 6A This sets up the script for the scene right before you get teleported to the beginning area. There's still a final scene afterwards however, so while it's faster than method 2, it's not ideal.

This submission uses method 4. This can be done by setting the following values: CD00 = 01 CD02 = 1A CD03 = 01 CD06 = 6F This sets up the script for the very end part of the final dialogue, right before the post credits content flags are set. While this does not trigger the final boss flag, it does update the game into thinking you beat it. The reason why this even works is because the game does the following: 1. Dialogue with boss -> Method 2 2. Fight boss 3. Dialogue with boss 4. Update final boss flag -> Method 3 5. Ending scene 6. Update post credits content flags -> Method 4

Payload

There's multiple ways to handle this.

I initially wanted to just call the function that sets the game state to 48. That function is located at ROM bank 0F however. So I tried to somehow swap to bank 0F to call the credits, then somehow jump back. This was basically method 1 however, so CasualPokePlayer suggested to skip manpulating all those values to get :

ld bc,1d18 add hl,bc ; hl = e3e1 ld (hl),$30 jp somewhereitdontcrash?

After looking at the telefang translation github however, I found out the game's script function was partially documented: https://github.com/telefang/telefang/blob/master/components/eventscript/interpreter.asm In this case: CD00 - trigger event CD02 - Event ID CD03 - something about jp pointer CD06 - Event's sequence (how far you're in to event)

I initially had no idea how would I set multiple values up with the limited amount of addresses, until I found out recruited Telefang names are all stored side by side in CartRAM at 5200. To get to this to appear at System Bus however, I neded a way to swap SWRAM banks. Luckily, CasualPokePlayer found out there's a function located at 3D6A that does that: https://github.com/telefang/telefang/blob/3ec7bf14bf4b6686cbd2067f7e3e204724dd3648/components/saveclock/sram_lock.asm#L3-L11

This meant that rather that finding some combination of values to manpulate to somehow swap SWRAM banks, I could just call 3D6A. My name is long enough to do this:

Opcode	Name	Function
CD 6A 3D	ーゃか	Call 3D6A
21 03 59	ムウも	LD HL, 5903
29	ル	ADD HL, HL
E0 E0	null	LD (FF00 + E0), A

To jump to HL, I initially wanted to use the frame counter at C938 to E9 (JP HL), but it turns out C937 is always 01, which makes C938 unuseable due to the opcode being 2 bytes. Instead, I used C948 (Follower X pos on phone use) to get to E9 for the jump. The 03 offset for 5903 is because the 1st Denjuu's name last character (E0) is a 2 byte opcode, so it would mess up the payload.

Now that I could jump to the names, CasualPokePlayer suggested the following payload:

Opcode	Name	Function
DENJUU	ONE	ムユュア
21 00 00	ム	LD HL,0000
25	ユ	DEC HL ; HL = ffff
36 01	ュア	LD [HL],$01 ; only enable vblank interrupts
DENJUU	TWO	ンちルヤア5
2E 48	ンち	LD l,$48 ; workaround no $90
29	ル	add HL,HL
24	ヤ	INC H ; HL = FF90
01 C0	ア5	LD BC
DENJUU	THREE	キコェあネェ
07	キ	LD BC,$07C0
0A	コ	LD A,[BC ; A = FC
32	ェ	LDD (HL), A
3E 18	あネ	LD A,$18
32	ェ	LDD (HL), A
DENJUU	FOUR	アけモコェ8
01 40 23	アけモ	LD BC,$2340
0A	コ	LD A,[BC] ; load A with 76
32	ェ	LDD (HL), A
C3	8	JP
DENJUU	FIVE	けア
40 00	け	JP to HL
01	ア	To get the 00 above

This didn't seem to work out however, so instead the payload was:

Stage by stage comments

<Put the name of the first stage here>

<Put the name of the second stage here>

Other comments

Samsara: wait i think this one's legit. anyway here's my number, so call me maybe (hands you a slip of paper with 69 written on it in crayon)

Samsara: Aw, here it goes.

feos: Fixed code embed (by replacing with monospaced, since code embeds don't have linbreaks in the forum view).

Samsara: Adding GEG branch due to ACE usage.

Samsara: The ending thing hasn't quite been explained in the submission text yet I don't think, so I'll summarize it here: This run triggers the very end of the ending, just before the credits. This plays the credits, of course, but more importantly it sets the game completion state by unlocking postgame content. Triggering the credits directly would not have done this, and triggering anything before this would have lost time. I've verified that the postgame state was triggered in this run by locating and accessing a piece of postgame content, meaning that for our purposes, the game is considered complete. Note that other event flags are NOT triggered, most notably the flag for the final boss's defeat. Flags like these are not necessary for GEG runs: Since a majority of the game is skipped anyway, so are a majority of normally required event flags. As long as these flags do not adversely affect the ending by not being triggered, then triggering them is unnecessary. In this case, since the final boss flag does not directly trigger the postgame content, it is fine that it is skipped.

That leaves the nature of the ACE itself: The currently published "map glitch" run has the same issue that the Wario Land GEG has. To simplify the explanation: VBA bad. To expound on the simplifying of the explanation: The previous Telefang runs and that Wario Land GEG run were only possible because VBA did not crash where an actual (or properly emulated) GBA would crash. This run avoids that through different methodology while also being a couple minutes faster to boot. Given that the run was performed on BizHawk, I am far more confident that this is legit given the incredible dedication of the GB/C emulation community to accuracy for console verification purposes.

I'm accepting this to obsolete the map glitch run, as it serves the same purpose with actual legitimacy this time. Thanks, VBA!

EDIT: Since this judgement, the TAS has been console verified, so... I guess it's double accepted now. Hooray!

fsvgm777: Processing. EZGames69 is handling the encodes for this one.

Game objectives

Comments

Map bug

NPCs

Collision effects

Player data

*Values for C912

**Values for C920, C921, C943

Ending

Payload

Stage by stage comments

<Put the name of the first stage here>

<Put the name of the second stage here>

Other comments

Show more

Hide

TASVideoAgent

xxezrabxxx

brunovalads

Sanqui

feos

jlun2

feos

jlun2

feos

CasualPokePlayer

EZGames69

jlun2

EZGames69

TASVideoAgent

Map ID	Map Coord	NPC 1	NPC 2
4	20	3	76
4	19	207	75
4	19	219	75
4	11	207	73
4	19	219	73
4	11	0	0
4	18	167	75
4	4	104	72
2	60	210	70
2	59	170	70

Map ID	Map Coord	NPC 1	NPC 2
4	20	3	76
4	19	207	75
4	19	219	75
4	11	207	73
4	19	219	73
4	11	0	0
4	18	167	75
4	4	104	72
2	60	210	70
2	59	170	70

Map ID	Map Coord	NPC 1	NPC 2
4	20	3	76
4	19	207	75
4	19	219	75
4	11	207	73
4	19	219	73
4	11	0	0
4	18	167	75
4	4	104	72
2	60	210	70
2	59	170	70