It turns out the infamous "Pokemon ripoff" has ACE as well, just like Pokemon.
Game objectives
- Emulator used: BizHawk 2.5, GB player
- <List the objectives of your movie here>
- <Another objective>
- <And so on>
I always knew this game could have a game end glitch, but wasn't able to figure out how it worked. After some guidance from CasualPokePlayer, I managed to discover that various NPC ID combinations jump to various parts of the game's memory, leading to crashes. The gameboy player was used, since the previous run relied on an emulator bug regarding STOP (opcode #10 10), so I wanted the run to have a chance to get console verified one day.
While CasualPokePlayer and Mister Chess did not contribute to the input directly, I made them coauthors since they were very helpful in finding out how the NPCs glitched up, while CasualPokePlayer also gave a payload to jump to the controller directly (which unfortunately ended up unused) along with where to jump to.
Map bug
This is the main bug in all iterations of the any% Telefang TAS. When you do the following actions:
1. Open the map with Start
2. Entering a building
3. Trigger a battle
the game writes the bytes for you and the NPCs from WRAM to CartRAM, one byte at a time. Onc the battle is over, or when you close the map, the values are written back to WRAM. Given enough lag however, the game fails to write all the addresses. In the case for this run:
5F47: 1A LD A,(DE) A:a3 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3 Cy:1320480764
5F48: 22 LD (HL+),A A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5d LY:37 SP:dff3 Cy:1320480772
5F49: 13 INC DE A:00 B:00 C:a3 D:c2 E:fd F:00 H:a2 L:5e LY:37 SP:dff3 Cy:1320480780
5F4A: 0B DEC BC A:00 B:00 C:a3 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3 Cy:1320480788
5F4B: 78 LD A,B A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3 Cy:1320480796
5F4C: B1 OR C A:00 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3 Cy:1320480800
5F4D: 20 F8 JR NZ,5F47h A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3 Cy:1320480804
5F47: 1A LD A,(DE) A:a2 B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3 Cy:1320480816
5F48: 22 LD (HL+),A A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5e LY:37 SP:dff3 Cy:1320480824
5F49: 13 INC DE A:db B:00 C:a2 D:c2 E:fe F:00 H:a2 L:5f LY:37 SP:dff3 Cy:1320480832
0040: C3 E7 02 JP #02E7h A:db B:00 C:a2 D:c2 E:ff F:00 H:a2 L:5f LY:90 SP:dff1 Cy:1320480860
The process took too long, so it gets interrupted. The reason I call it map bug however, is because that's the only action you can use to trigger this. There's no area where you can trigger either a battle, or enter a room with tons of lag.
While this might seem to indicate you only need lag, I have never managed to trigger this bug without the phone ringing. The phone only rings once every 5 minutes when you have at least 2 Denjuu, so I'm forced to wait 5 minutes.
The very first Telefang TAS took advantage of the game failing to copy my game position to get to the final dungeon. The subsequent TASes uses this bug to get glitched combinations of NPC values to jump to WRAM.
NPCs
The following NPCs are reachable within the first 5 minutes of the game, while also reachable to each other without triggering combat.
| Map ID | Map Coord | NPC 1 | NPC 2 |
|---|
| 4 | 20 | 3 | 76 |
| 4 | 19 | 207 | 75 |
| 4 | 19 | 219 | 75 |
| 4 | 11 | 207 | 73 |
| 4 | 19 | 219 | 73 |
| 4 | 11 | 0 | 0 |
| 4 | 18 | 167 | 75 |
| 4 | 4 | 104 | 72 |
| 2 | 60 | 210 | 70 |
| 2 | 59 | 170 | 70 |
The addresses for their IDs are:
0xC2BE, 0xC2BF
0xC2DE, 0xC2DF
0xC2FE, 0xC2FF
0xC31E, 0xC31F
0xC33E, 0xC33F
There are more, but these are the ones the above uses. Not every one of them can be mixed together with the map bug. Moving around map coordinates change the address the NPC is on, but since the maps are connected, some only get written to specific addresses. For instance:
You start at Map 4, Coord 19. You can only go north and east. The values right now are:
0xC2BE, 0xC2BF = 207, 75
0xC2DE, 0xC2DF = 219, 75
0xC2FE, 0xC2FF = 0,0
0xC31E, 0xC31F = 0,0
0xC33E, 0xC33F = 0,0
Going east gives
0xC2BE, 0xC2BF = 207, 75
0xC2DE, 0xC2DF = 219, 75
0xC2FE, 0xC2FF = 3,76
0xC31E, 0xC31F = 0,0
0xC33E, 0xC33F = 0,0
Backtracking, then going north gives
0xC2BE, 0xC2BF = 207, 75
0xC2DE, 0xC2DF = 219, 75
0xC2FE, 0xC2FF = 207, 73
0xC31E, 0xC31F = 219, 73
0xC33E, 0xC33F = 0,0
As you can see, the IDs: 3, 76 got overwritten. Attempting to reload the NPC only places them to 0xC2BE, 0xC2BF.
This means there's no way to get addresses
0xC2DE, 0xC2DF,
0xC31E, 0xC31F,
0xC33E, 0xC33F
to have the values of 3, 76.
Similarrly, there's no way to get the values of 3, 76 to be at 0xC2BE, 0xC2BF. This restricts me to only 1 room possible for the bug.
Possible values for 0xC2BE, 0xC2BF
0, 0 (By resetting)
3, 76
104, 72
167, 75
170, 70
207, 73
207, 75
Possible values for 0xC2DE, 0xC2DF
0, 0
207, 75
210, 70
219, 73
219, 75
Possible values for 0xC2FE, 0xC2FF
0, 0
3, 76
207, 73
219, 75
Possible values for 0xC31E, 0xC31F
0, 0 (By resetting)
207, 75
219, 73
Collision effects
If 2 NPC IDs can exist at the same pair of addresses, it's possible to get a combination of them using the map bug. The following collisions are possible:
3, 0 -> The NPC starts floating up and down. They cannot be talked to.
3, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD
3, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD
3, 73 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F
3, 75 -> Nothing wrong; this is a valid NPC
3, 76 -> Nothing wrong; this is a valid NPC
104, 0 -> Glitches the graphics and lags the game badly.
104, 70 -> They become a Denjuu trainer with a level 0 Tsunonasu
104, 72 -> Nothing wrong; this is a valid NPC
104, 73 -> Spins around in circles
104, 75 -> Crashes at 0x47DA due to 0xE4
104, 76 -> Jumps to 0xFF7F, then gets stuck in a loop of 0x0038, 0x0039, 0x003A, 0x003B, 0xFF7F
167, 0 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62.
167, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 72 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). The game then resets with a blue tint.
167, 75 -> Nothing wrong; this is a valid NPC
167, 76 -> Jumps to 0x84FA via 0xE9 JP (HL) at 0x4EFB, then crashes 1 instruction later by 0xFC
170, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then crashes due to 0xF4
170, 70 -> Nothing wrong; this is a valid NPC
170, 72 -> Nothing wrong; this is a valid NPC
170, 73 -> Makes the NPC run in place. Talkng to them triggers a fight with trainer with 3 Denjuu at level 10
170, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
170, 76 -> Jumps to 0x8BFA via 0xE9 JP (HL) at 0x4D47. This is the graphics for the store's "money" interface. Eventually, the game crashes at 0x8C62 due to 0x10 10 STOP #10h at 0x8C62. While the values earlier can be slightly manipulated by having different amounts of money, the sequence 0x10 10 is from the character "ル", which is unavoidable. The currently published TAS emulates the instruction wrong by simply ignoring it. Therefore, the currently published route using this combination is impossible.
207, 0 -> Jumps to 0x8AFA via 0xE9 JP (HL) at 0x4EFB, then eventually jumps to 0xFAFA via 0xE9 JP (HL) at 0x049D before jumping to 0x0000 via 0xE9 JP (HL) at 0xFD12. It gets stuck in a loop at 0x0028 to 0x0030.
207, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
207, 72 -> Nothing wrong; this is a valid NPC
207, 73 -> Nothing wrong; this is a valid NPC
207, 75 -> Nothing wrong; this is a valid NPC
207, 76 -> Jumps to 0x8005 via 0xD9 RETI at 0x0323. It then crashes at 0x8059 via 0xFC.
210, 0 -> The NPC becomes untalkable
210, 70 -> Nothing wrong; this is a valid NPC
210, 73 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 80 (JP NZ, #8000h). The game then crashes at 0x8076 via 0xE3
210, 75 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 60 80 (JP NZ, #8060h). The game then crashes at 0x8061 via 0xFD
219, 0 -> Jumps to 0x0000 via 0xE9 JP (HL) at 0x049D, then gets stuck in a loop from 0x0028 to 0x0030.
219, 70 -> Jumps to 0xC98B via 0xE9 JP (HL) at 0x4EFB, then immediately jumps to 0x0000 due to C2 00 00 (JP NZ, #0000h). It then gets stuck in a loop from 0x0028 to 0x0030.
219, 73 -> Nothing wrong; this is a valid NPC
219, 75 -> Nothing wrong; this is a valid NPC
219, 76 -> Jumps to 0xC6C9 via 0xE9 JP (HL) at 0x4EFB, then NOP slides to player data at 0xC900
Based on the above, the only useable combination is 219, 76.
Player data
Now that we have a way to jump into player data, we need to document what is possible. 0xC800 region gets set much much later in the game, so for the purpose of the run, everything from 0xC6C9 to 0xC8FF is 0.
All values are in hex:
| Address | Purpose | Values possible during run | Opcode |
|---|
| C900 | Defaults to 1. Setting to 0 takes me back to start of game human world. 2 makes me fall from sky. Changing from 1 disables menus. | 1 | LD BC, 5048
|
| C901 | Spawn X (where you appear on room load) + X pos on phone use | 09-98 | |
| C902 | Spawn Y (where you appear on room load) + Y pos on phone use | 10-80 | |
| C903 | Acre | 93 | SUB E |
| C904 | Map ID | 04 | INC B |
| C905 | Map type | 00 | NOP |
| C906 | Map Coord | 13 | INC DE |
| C907 | ?? | 02 | NOP |
| C908 | ?? | 00 | NOP |
| C909 | ?? | 00 | NOP |
| C90A | ?? | 00 | NOP |
| C90B | ?? | 00 | NOP |
| C90C | ?? | 00 | NOP |
| C90D | ?? | 00 | NOP |
| C90E | ?? | 00 | NOP |
| C90F | Last visited map coord | 0B, 14 | DEC BC |
| Address | Purpose | Values possible during run | Opcode |
|---|
| C910 | Money | 00-FF | Varies |
| C911 | Money | 0-4* | Varies |
| C912 | Follower sprite ID | Varies* | Varies |
| C913 | Map Coord | 13 | INC DE |
| C914 | Map type | 04 | INC B |
| C915 | Ranges from 0-9 as you go left to right screen | 2-9 | Varies |
| C916 | Ranges from 0-7 as you go up to down the screen | 0-7 | Varies |
| C917 | Music? Overworld is 3 | 03 | INC (BC) |
| C918 | ?? | 00 | NOP |
| C919 | 1 if walking. else 0 | 0 | NOP |
| C91A | Idle timer | 0 | NOP |
| C91B | ?? | 00 | NOP |
| C91C | ?? | 00 | NOP |
| C91D | Change to 1 to trigger battle | 0 | NOP |
| C91E | Set to E0 at start. Changes to F0 in battle | E0 | LD (FF00 + C0), A |
| C91F | Set to C0 at start. Changing it affects text | C0 | |
| Address | Purpose | Values possible during run | Opcode |
|---|
| C920 | Randomly assigned on start | Varies** | Varies |
| C921 | Randomly assigned on start | Varies** | Varies |
| C922 | Goes up on grass | 00-3F | Varies |
| C923 | Randomly changes | ?? | Varies |
| C924 | ?? | 05 | DEC B |
| C925 | ?? | 00 | NOP |
| C926 | Map ID | 04 | INC B |
| C927 | Map Coord | 13 | INC DE |
| C928 | Spawn X (where you appear on room load) + X pos on phone use | 09-98 | Varies |
| C929 | Spawn Y (where you appear on room load) + Y pos on phone use | 10-80 | Varies |
| C92A | ?? | 00 | NOP |
| C92B | ?? | 00 | NOP |
| C92C | Player Name Character 1 | CD | Call 3D6A |
| C92D | Player Name Character 2 | 6A | |
| C92E | Player Name Character 3 | 3D | |
| C92F | Player Name Character 4 | 21 | LD HL, 5903 |
| Address | Purpose | Values possible during run | Opcode |
|---|
| C930 | Player Name Character 5 | 03 | LD HL, 5903 |
| C931 | Player Name Character 6 | 59 | |
| C932 | Player Name Character 7 | 29 | ADD HL, HL |
| C933 | Player Name Character 8 | E0 | LD (FF00 + E0), A |
| C934 | Player Name String Terminator | E0 | |
| C935 | ?? | 00 | NOP |
| C936 | Sets to 1 at game start | 01 | LD BC, 1101 |
| C937 | Sets to 1 after intro cutscene | 01 | |
| C938 | Frame | 00-FF | |
| C9C9 | Seconds | 04 | INC B |
| C9CA | Minutes | 05 | DEC B |
| C9CB | Hours | 00 | NOP |
| C9CC | ?? | 00 | NOP |
| C9CD | ?? | 00 | NOP |
| C9CE | Sets to 1 at game start | 01 | LD BC, 0500 |
| C9CF | ?? | 00 | |
| Address | Purpose | Values possible during run | Opcode |
|---|
| C940 | Decrements from 5? | 05 | LD BC, 0500 |
| C941 | ?? | 00 | NOP |
| C942 | ?? | 00 | NOP |
| C943 | Randomly assigned on start | Varies** | Varies |
| C944 | ?? | 00 | NOP |
| C945 | ?? | 01 | LD BC, 0000 |
| C946 | Shop item you picked up | 00 | |
| C947 | Using phone bool | 00 | |
| C948 | Follower X pos on phone use | 00-FF | Varies |
|---|
| C949 | Follower X pos on phone use | 00-FF | Varies |
|---|
| C94A | Follower Y pos on phone use | 00-FF | Varies |
|---|
| C94B | Follower Y pos on phone use | 00-FF | Varies |
|---|
| C94C | Turned to 1 at 1st screen of Denjuu World? | 00 | NOP |
| C94D | Calling Denjuu name | Varies | Varies |
| C94E | Calling Denjuu name? Seems to be A0 | Varies | Varies |
| C94F | Phone timer | Varies | Varies |
*Values for C912
| Value | Denjuu | Opcode |
|---|
| 00 | Tsunonasu | NOP |
| 01 | Kochia | LD BC, _ _ _ _ |
| 02 | Oshe | LD (BC) A |
| 03 | Keshi* | INC (BC) |
| 04 | Crypto* | INC B |
| 05 | Monstera | DEC B |
| 06 | Fungus | LD B, _ _ |
| 2F | Musa | CPL |
| 36 | Hagumanoki | LD (HL), _ _ |
| 64 | Hiyu | LD H, H |
| 67 | Gamuru | LD H, A |
| 69 | Gaultheria | LD L, C |
| 6B | Kaya | LD L, E |
| 6C | Denfare | LD L, H |
| 82 | Beebalm | ADD D |
| 83 | Salal | ADD E |
| 84 | Enishida | ADD H |
| 92 | Ruscus | SUB D |
| 94 | Zea | SUB H |
| A5 | Kanzou | AND L |
| A6 | Ornithogalum | AND (HL) |
**Values for C920, C921, C943
The following are all the 256 possible combinations of the values for C920, C921, C943
| C920 | Opcode | C921 | Opcode | C943 | Opcode
|
|---|
| 89 | ADC C | E5 | PUSH HL | A2 | AND D |
| A9 | XOR C | 98 | SBC B | AD | XOR L |
| 8C | ADC H | 65 | LD H, L | AC | XOR H |
| E4 | INVALID | 5D | LD E, L | 35 | DEC (HL) |
| 32 | LDD (HL), A | 8E | ADC (HL) | AB | XOR E |
| BF | CP A | 3F | CCF | 5A | LD E, D |
| ED | INVALID | 25 | DEC H | 35 | DEC (HL) |
| 78 | LD A, B | B1 | OR C | 57 | LD D, A |
| D9 | RETI | 3D | DEC A | AF | XOR A |
| E0 | LD (FF00 + 83), A | 83 | | 1E | LD E, _ _ |
| 83 | ADD E | 09 | ADD HL, BC | 76 | HALT |
| 68 | LD L, B | AC | XOR H | B0 | OR B |
| FD | INVALID | 07 | RLCA | 8F | ADC A |
| B7 | OR A | CD | CALL _ _ _ _ | 7A | LD A, D |
| 40 | LD B, B | 8D | ADC L | 19 | ADD HL,DE |
| FB | EI | F1 | POP AF | 32 | LDD (HL), A |
| C2 | JP NZ, _ _ 8E | 8E | | 28 | JR Z, _ _ |
| A7 | AND A | B8 | CP B | C6 | ADD A, _ _ |
| 9B | SBC E | F7 | RST 30 | 37 | SCF |
| 66 | LD H, (HL) | A5 | AND L | 8C | ADC H |
| 42 | LD B, D | 1D | DEC E | 92 | SUB D |
| 9C | SBC H | F6 | OR A, _ _ | 6E | LD L, (HL) |
| A3 | AND E | FB | EI | A8 | XOR B |
| D2 | JP NC, _ _ 99 | 99 | | 28 | JR Z, _ _ |
| D7 | RST 10 | 5D | LD E, L | 02 | LD (BC) A |
| 7E | LD A, (HL) | CF | RST 08 | 97 | SUB A |
| 91 | SUB C | 99 | SBC C | 65 | LD H, L |
| 7A | LD A, D | 0A | LD A, (BC) | 45 | LD B, L |
| 67 | LD H, A | 87 | ADD A | 4B | LD C, E |
| 18 | JR 2F | 2F | | 68 | LD L, B |
| 89 | ADC C | 2C | INC L | 00 | NOP |
| 2F | CPL | 55 | LD D, L | 15 | DEC D |
| D6 | SUB A, 6D | 6D | | 0E | LD C, _ _ |
| E5 | PUSH HL | 7B | LD A, E | 25 | DEC H |
| 9C | SBC H | FB | EI | 95 | SUB L |
| A5 | AND L | 7F | LD A, A | 28 | JR Z, _ _ |
| E1 | POP HL | 18 | JR _ _ | B2 | OR D |
| 1A | LD A,(DE) | A3 | AND E | 97 | SUB A |
| F0 | LD A, (FF00 + C0) | C0 | | 1E | LD E, _ _ |
| C3 | JP _ _ 2E | 2E | | 88 | ADC B |
| DF | RST 18 | B4 | OR H | 86 | ADD (HL) |
| 96 | SUB (HL) | 86 | ADD (HL) | 42 | LD B, D |
| 76 | HALT | B8 | CP B | 9B | SBC E |
| 01 | LD BC, _ _ 16 | 16 | | B1 | OR C |
| 29 | ADD HL, HL | 61 | LD H, C | 64 | LD H, H |
| 16 | LD D, BE | BE | | A0 | AND B |
| 15 | DEC D | 79 | LD A, C | 18 | JR _ _ |
| E3 | INVALID | F4 | INVALID | 2E | LD L, _ _ |
| B8 | CP B | 45 | LD B, L | B2 | OR D |
| AE | XOR (HL) | CF | RST 08 | 5A | LD E, D |
| 7F | LD A, A | CE | ADC A, _ _ | 5D | LD E, L |
| 3B | DEC SP | F3 | DI | B3 | OR E |
| 57 | LD D, A | 3C | INC A | 6C | LD L, H |
| D8 | RET C | 59 | LD E, C | 08 | LD (_ _ _ _), SP |
| 73 | LD (HL), E | 56 | LD D, (HL) | 6C | LD L, H |
| DE | SBC A, D8 | D8 | | 58 | LD E, B |
| D0 | RET NC | AA | XOR D | 45 | LD B, L |
| 18 | JR 3F | 3F | | 99 | SBC C |
| 27 | DAA | BB | CP E | 4B | LD C, E |
| 7E | LD A, (HL) | D0 | RET NC | B0 | OR B |
| 5C | LD E, H | 86 | ADD (HL) | 73 | LD (HL), E |
| A9 | XOR C | 26 | LD H, _ _ | 3B | DEC SP |
| F6 | OR A, 56 | 56 | | 84 | ADD H |
| DA | JP N, _ _ 04 | 04 | | 34 | INC (HL) |
| D1 | POP DE | AB | XOR E | A0 | AND B |
| 9A | SBC D | 27 | DAA | 9C | SBC H |
| F2 | LD A, (FF00 + C) | D8 | RET C | 23 | INC HL |
| 7F | LD A, A | 54 | LD D, H | 4C | LD C, H |
| 8C | ADC H | D1 | POP DE | 0A | LD A, (BC) |
| 95 | SUB L | 34 | INC (HL) | 52 | LD D, D |
| A9 | XOR C | 93 | SUB E | 2C | INC L |
| DD | INVALID | D3 | INVALID | 0D | DEC C |
| 40 | LD B, B | 97 | SUB A | 6F | LD L, A |
| 89 | ADC C | 6B | LD L, E | 78 | LD A, B |
| 70 | LD (HL), B | C8 | RET Z | 30 | JR NC, _ _ |
| 59 | LD E, C | 3B | DEC SP | B7 | OR A |
| F3 | DI | CD | CALL _ _ _ _ | 1E | LD E, _ _ |
| 1D | DEC E | DF | RST 18 | 23 | INC HL |
| E8 | ADD SP, 75 | 75 | | 73 | LD (HL), E |
| D5 | PUSH DE | C2 | JP NZ, _ _ _ _ | 96 | SUB (HL) |
| 11 | LD DE, _ _ 64 | 64 | | 8F | ADC A |
| 98 | SBC B | 47 | LD B, A | B4 | OR H |
| 75 | LD (HL), L | C8 | RET Z | A7 | AND A |
| 64 | LD H, H | 64 | LD H, H | 37 | SCF |
| 35 | DEC (HL) | 5D | LD E, L | 8C | ADC H |
| FA | LD A, (_ _ 08) | 08 | | C3 | JP _ _ _ _ |
| 14 | INC D | 89 | ADC C | 23 | INC HL |
| C7 | RST 00 | 87 | ADD A | 8E | ADC (HL) |
| 4E | LD C, (HL) | B6 | OR (HL) | 86 | ADD (HL) |
| 94 | SUB H | D6 | SUB A, _ _ | B2 | OR D |
| 4B | LD C, E | 88 | ADC B | 1E | LD E, _ _ |
| 7E | LD A, (HL) | D0 | RET NC | B0 | OR B |
| 89 | ADC C | 02 | LD (BC) A | 30 | JR NC, _ _ |
| 8C | ADC H | 99 | SBC C | 97 | SUB A |
| FD | INVALID | E6 | AND A, _ _ | 63 | LD H, E |
| 52 | LD D, D | 68 | LD L, B | 7A | LD A, D |
| 4D | LD C, L | C6 | ADD A, _ _ | 92 | SUB D |
| B6 | OR (HL) | 4C | LD C, H | 85 | ADD L |
| 8C | ADC H | E1 | POP HL | 68 | LD L, B |
| 63 | LD H, E | 9B | SBC E | 2F | CPL |
| 52 | LD D, D | A5 | AND L | 39 | ADD HL, SP |
| B3 | OR E | 73 | LD (HL), E | 18 | JR _ _ |
| 04 | INC B | ED | INVALID | 43 | LD B, E |
| 70 | LD (HL), B | 32 | LDD (HL), A | BC | CP H |
| 89 | ADC C | A4 | AND H | 34 | INC (HL) |
| 9D | SBC L | F2 | LD A, (FF00 + C) | 9C | SBC H |
| 15 | DEC D | 3B | DEC SP | 76 | HALT |
| 71 | LD (HL), C | B3 | OR E | 44 | LD B, H |
| E4 | INVALID | EF | RST 28 | 73 | LD (HL), E |
| 15 | DEC D | F3 | DI | 0F | RRCA |
| 8B | ADC E | E2 | LD (FF00 + C), A | 9C | SBC H |
| D4 | CALL NZ, _ _ 83 | 83 | | 1C | INC E |
| 8F | ADC A | 85 | ADD L | 58 | LD E, B |
| FC | INVALID | B5 | OR L | 08 | LD (_ _ _ _), SP |
| 7A | LD A, D | 57 | LD D, A | 64 | LD H, H |
| 51 | LD D, C | 0B | DEC BC | 15 | DEC D |
| 5B | LD E, E | 03 | INC (BC) | 1D | DEC E |
| EE | XOR A, 9F | 9F | | 6C | LD L, H |
| 14 | INC D | 66 | LD H, (HL) | 99 | SBC C |
| C3 | JP _ _ C7 | C7 | | BF | CP A |
| D9 | RETI | 15 | DEC D | 0A | LD A, (BC) |
| B2 | OR D | 86 | ADD (HL) | A5 | AND L |
| 02 | LD (BC) A | 94 | SUB H | 5D | LD E, L |
| F2 | LD A, (FF00 + C) | 6D | LD L, L | A9 | XOR C |
| B6 | OR (HL) | 9A | SBC D | 88 | ADC B |
| 2E | LD L, 20 | 20 | | 37 | SCF |
| 7B | LD A, E | 40 | LD B, B | 74 | LD (HL), H |
| DF | RST 18 | B2 | OR D | 14 | INC D |
| C1 | POP BC | 17 | RLA | 49 | LD C, C |
| 61 | LD H, C | 68 | LD L, B | 42 | LD B, D |
| 9C | SBC H | E8 | ADD SP, _ _ | A1 | AND C |
| 0E | LD C, 45 | 45 | | 0F | RRCA |
| 20 | JR NZ, 58 | 58 | | B5 | OR L |
| 36 | LD (HL), 44 | 44 | | 7F | LD A, A |
| 84 | ADD H | 7C | LD A, H | 3E | LD A, _ _ |
| 28 | JR Z, 18 | 18 | | 34 | INC (HL) |
| BB | CP E | 43 | LD B, E | 54 | LD D, H |
| 45 | LD B, L | D9 | RETI | 6F | LD L, A |
| 83 | ADD E | F5 | PUSH AF | 56 | LD D, (HL) |
| 20 | JR NZ, 7C | 7C | | 51 | LD D, C |
| 96 | SUB (HL) | 3B | DEC SP | 97 | SUB A |
| 12 | LD (DE), A | 8F | ADC A | B3 | OR E |
| A4 | AND H | E3 | INVALID | 6A | LD L, D |
| 74 | LD (HL), H | 45 | LD B, L | 7E | LD A, (HL) |
| C1 | POP BC | B5 | OR L | 43 | LD B, E |
| 6F | LD L, A | 87 | ADD A | 5A | LD E, D |
| 14 | INC D | 4B | LD C, E | 83 | ADD E |
| A8 | XOR B | CD | CALL _ _ _ _ | 73 | LD (HL), E |
| A9 | XOR C | C7 | RST 00 | BB | CP E |
| 11 | LD DE, _ _ 0F | 0F | | 0C | INC C |
| 8A | ADC D | F2 | LD A, (FF00 + C) | A8 | XOR B |
| 83 | ADD E | F5 | PUSH AF | 78 | LD A, B |
| B9 | CP C | 63 | LD H, E | 6D | LD L, L |
| 33 | INC SP | 59 | LD E, C | 8E | ADC (HL) |
| 73 | LD (HL), E | 8E | ADC (HL) | A3 | AND E |
| F2 | LD A, (FF00 + C) | 6D | LD L, L | A9 | XOR C |
| 2D | DEC L | 87 | ADD A | 14 | INC D |
| BD | CP L | 6D | LD L, L | 2F | CPL |
| F8 | LD HL, SP + 7F | 7F | | 83 | ADD E |
| EC | INVALID | 4D | LD C, L | 54 | LD D, H |
| D7 | RST 10 | DE | SBC A, _ _ | B6 | OR (HL) |
| 83 | ADD E | 12 | LD (DE), A | 0C | INC C |
| CD | CALL _ _ FC | FC | | 89 | ADC C |
| 74 | LD (HL), H | 7E | LD A, (HL) | 34 | INC (HL) |
| C8 | RET Z | 1F | RRA | 05 | DEC B |
| DC | CALL C, _ _ 3F | 3F | | 76 | HALT |
| 7A | LD A, D | 50 | LD D, B | 81 | ADD C |
| D5 | PUSH DE | 54 | LD D, H | 72 | LD (HL), D |
| B1 | OR C | AA | XOR D | C5 | PUSH BC |
| 24 | INC H | 7E | LD A, (HL) | 7F | LD A, A |
| 1F | RRA | BC | CP H | 50 | LD D, B |
| 58 | LD E, B | 31 | LD SP, _ _ _ _ | AA | XOR D |
| CF | RST 08 | C7 | RST 00 | 84 | ADD H |
| BE | CP (HL) | C2 | JP NZ, _ _ _ _ | 55 | LD D, L |
| 16 | LD D, EA | EA | | C0 | RET NZ |
| AB | XOR E | C3 | JP _ _ _ _ | 7C | LD A, H |
| D7 | RST 10 | 4B | LD C, E | 55 | LD D, L |
| AD | XOR L | F6 | OR A, _ _ | 76 | HALT |
| 20 | JR NZ, 2C | 2C | | A3 | AND E |
| FF | RST 38 | 9C | SBC H | C1 | POP BC |
| 4B | LD C, E | 7E | LD A, (HL) | 8D | ADC L |
| 13 | INC DE | 79 | LD A, C | 18 | JR _ _ |
| E0 | LD (FF00 + 4C), A | 4C | | 45 | LD B, L |
| 8F | ADC A | 35 | DEC (HL) | AA | XOR D |
| 83 | ADD E | 05 | DEC B | 7F | LD A, A |
| B6 | OR (HL) | 5D | LD E, L | 57 | LD D, A |
| C2 | JP NZ, _ _ 65 | 65 | | 06 | LD B, _ _ |
| DF | RST 18 | C2 | JP NZ, _ _ _ _ | 39 | ADD HL, SP |
| 8C | ADC H | FE | CP A, _ _ | 84 | ADD H |
| 6C | LD L, H | F0 | LD A, (FF00 + _ _) | 79 | LD A, C |
| 15 | DEC D | 51 | LD D, C | 39 | ADD HL, SP |
| 44 | LD B, H | 1E | LD E, _ _ | 38 | JR C, _ _ |
| B2 | OR D | A5 | AND L | 37 | SCF |
| B9 | CP C | 2D | DEC L | 31 | LD SP, _ _ _ _ |
| 46 | LD B, (HL) | D8 | RET C | 5C | LD E, H |
| 7E | LD A, (HL) | E2 | LD (FF00 + C), A | 68 | LD L, B |
| DC | CALL C, _ _ 7B | 7B | | 2D | DEC L |
| 03 | INC (BC) | 1A | LD A,(DE) | 1F | RRA |
| F8 | LD HL, SP + 37 | 37 | | A2 | AND D |
| CB | RLC B | AD | XOR L | 25 | DEC H |
| 69 | LD L, C | 9F | SBC A | 61 | LD H, C |
| 20 | JR NZ, B2 | B2 | | 74 | LD (HL), H |
| F9 | LD, SP, HL | 68 | LD L, B | 93 | SUB E |
| 54 | LD D, H | 65 | LD H, L | 15 | DEC D |
| 89 | ADC C | 3B | DEC SP | 88 | ADC B |
| 86 | ADD (HL) | F9 | LD, SP, HL | 1B | DEC DE |
| FD | INVALID | 10 | STOP _ _ | B9 | CP C |
| 51 | LD D, C | AB | XOR E | 27 | DAA |
| D2 | JP NC, _ _ 98 | 98 | | 54 | LD D, H |
| B7 | OR A | 4D | LD C, L | 4A | LD C, D |
| F0 | LD A, (FF00 + B1) | B1 | | 2C | INC L |
| D3 | INVALID | 38 | JR C, _ _ | 02 | LD (BC) A |
| 12 | LD (DE), A | A5 | AND L | 7C | LD A, H |
| BF | CP A | 90 | SUB B | C4 | CALL NZ, _ _ _ _ |
| F5 | PUSH AF | AF | XOR A | A7 | AND A |
| 6E | LD L, (HL) | DD | INVALID | 88 | ADC B |
| 67 | LD H, A | BF | CP A | 7A | LD A, D |
| 3D | DEC A | DA | JP N, _ _ _ _ | 5B | LD E, E |
| 98 | SBC B | 2E | LD L, _ _ | AB | XOR E |
| DF | RST 18 | C2 | JP NZ, _ _ _ _ | 39 | ADD HL, SP |
| 58 | LD E, B | 22 | LDI (HL), A | A1 | AND C |
| 13 | INC DE | 70 | LD (HL), B | 93 | SUB E |
| A6 | AND (HL) | CB | RLC B | 84 | ADD H |
| EA | LD (_ _ 0C), A | 0C | | BA | CP D |
| 32 | LDD (HL), A | D2 | JP NC, _ _ _ _ | B2 | OR D |
| 30 | JR NC, 28 | 28 | | 48 | LD C, B |
| 8B | ADC E | 19 | ADD HL,DE | 91 | SUB C |
| 64 | LD H, H | 64 | LD H, H | 07 | RLCA |
| 53 | LD D, E | 17 | RLA | 1C | INC E |
| 7F | LD A, A | AC | XOR H | 28 | JR Z, _ _ |
| 14 | INC D | 61 | LD H, C | 45 | LD B, L |
| 20 | JR NZ, 98 | 98 | | 97 | SUB A |
| D6 | SUB A, 4A | 4A | | C0 | RET NZ |
| A8 | XOR B | 88 | ADC B | 93 | SUB E |
| 50 | LD D, B | A2 | AND D | 74 | LD (HL), H |
| 53 | LD D, E | C9 | RET | BC | CP H |
| 80 | ADD B | 89 | ADC C | 22 | LDI (HL), A |
| FF | RST 38 | B7 | OR A | 84 | ADD H |
| 70 | LD (HL), B | FE | CP A, _ _ | 0E | LD C, _ _ |
| F3 | DI | 89 | ADC C | 85 | ADD L |
| C7 | RST 00 | B6 | OR (HL) | C4 | CALL NZ, _ _ _ _ |
| BE | CP (HL) | D9 | RETI | 87 | ADD A |
| 0B | DEC BC | 04 | INC B | B3 | OR E |
| DC | CALL C, _ _ F2 | F2 | | 5E | LD E, (HL) |
| 3C | INC A | 0D | DEC C | 94 | SUB H |
| 64 | LD H, H | 8D | ADC L | 01 | LD BC, _ _ _ _ |
| 40 | LD B, B | 44 | LD B, H | 08 | LD (_ _ _ _), SP |
| 6A | LD L, D | 1E | LD E, _ _ | BB | CP E |
| BB | CP E | 0A | LD A, (BC) | 49 | LD C, C |
| A6 | AND (HL) | C8 | RET Z | 00 | NOP |
| 6B | LD L, E | 4D | LD C, L | 61 | LD H, C |
| 7A | LD A, D | 0A | LD A, (BC) | 45 | LD B, L |
| C1 | POP BC | 8F | ADC A | 5C | LD E, H |
| 13 | INC DE | 9B | SBC E | 4C | LD C, H |
| CE | ADC A, 50 | 50 | | C5 | PUSH BC |
| 75 | LD (HL), L | E1 | POP HL | 7D | LD A, L |
| 89 | ADC C | E5 | PUSH HL | A2 | AND D |
Ending
There are multiple ways to trigger the credits:
1. Change game state to 48
2. Warp to final area, then beat the boss
3. Trigger the ending scene.
4. Trigger the event right before the credits play
Method 1 only triggers the credits, but has no effect on the game whatsoever; the final boss flag at C5A1 does not get set, nor does the post game content flags. I do not think this counts as beating the game.
For method 2, this is the way the first 3 runs submitted uses method 2. Run 1 warps to the final area by taking advantage of the fact the map for the indoor areas and the antenna trees are all connected to each other. This means it's possible to run to the final antenna tree from the mountain one.
The 2nd and 3rd TAS jumps to VRAM, then due to an emulator bug regarding the STOP opcode (10 10), it doesn't crash, and instead coincidentally changes the map id to the final, upper left quadrant of the map, which is the final antenna tree's location.
This sets the final boss flag, along with post credits content, but is the slowest.
Method 3 sets the final boss flag. This can be done by setting the following values:
CD00 = 01
CD02 = 0B
CD03 = 01
CD06 = 6A
This sets up the script for the scene right before you get teleported to the beginning area. There's still a final scene afterwards however, so while it's faster than method 2, it's not ideal.
This submission uses method 4. This can be done by setting the following values:
CD00 = 01
CD02 = 1A
CD03 = 01
CD06 = 6F
This sets up the script for the very end part of the final dialogue, right before the post credits content flags are set. While this does not trigger the final boss flag, it does update the game into thinking you beat it. The reason why this even works is because the game does the following:
1. Dialogue with boss -> Method 2
2. Fight boss
3. Dialogue with boss
4. Update final boss flag -> Method 3
5. Ending scene
6. Update post credits content flags -> Method 4
Payload
There's multiple ways to handle this.
I initially wanted to just call the function that sets the game state to 48. That function is located at ROM bank 0F however. So I tried to somehow swap to bank 0F to call the credits, then somehow jump back. This was basically method 1 however, so CasualPokePlayer suggested to skip manpulating all those values to get :
ld bc,1d18
add hl,bc ; hl = e3e1
ld (hl),$30
jp somewhereitdontcrash?
This meant that rather that finding some combination of values to manpulate to somehow swap SWRAM banks, I could just call 3D6A. My name is long enough to do this:
| Opcode | Name | Function |
|---|
| CD 6A 3D | ーゃか | Call 3D6A |
| 21 03 59 | ムウも | LD HL, 5903 |
| 29 | ル | ADD HL, HL |
| E0 E0 | null | LD (FF00 + E0), A |
To jump to HL, I initially wanted to use the frame counter at C938 to E9 (JP HL), but it turns out C937 is always 01, which makes C938 unuseable due to the opcode being 2 bytes. Instead, I used C948 (Follower X pos on phone use) to get to E9 for the jump. The 03 offset for 5903 is because the 1st Denjuu's name last character (E0) is a 2 byte opcode, so it would mess up the payload.
Now that I could jump to the names, CasualPokePlayer suggested the following payload:
| Opcode | Name | Function |
|---|
| DENJUU | ONE | ム ユュア |
| 21 00 00 | ム | LD HL,0000 |
| 25 | ユ | DEC HL ; HL = ffff |
| 36 01 | ュア | LD [HL],$01 ; only enable vblank interrupts |
| DENJUU | TWO | ンちルヤア5 |
| 2E 48 | ンち | LD l,$48 ; workaround no $90 |
| 29 | ル | add HL,HL |
| 24 | ヤ | INC H ; HL = FF90 |
| 01 C0 | ア5 | LD BC |
| DENJUU | THREE | キコェあネェ |
| 07 | キ | LD BC,$07C0 |
| 0A | コ | LD A,[BC ; A = FC |
| 32 | ェ | LDD (HL), A |
| 3E 18 | あネ | LD A,$18 |
| 32 | ェ | LDD (HL), A |
| DENJUU | FOUR | アけモコェ8 |
| 01 40 23 | アけモ | LD BC,$2340 |
| 0A | コ | LD A,[BC] ; load A with 76 |
|---|
| 32 | ェ | LDD (HL), A |
| C3 | 8 | JP |
| DENJUU | FIVE | け ア |
| 40 00 | け | JP to HL |
| 01 | ア | To get the 00 above |
This didn't seem to work out however, so instead the payload was:
<Put the name of the first stage here>
<Explain the first stage here>
<Put the name of the second stage here>
<Explain the second stage here>
<And so on>
<Explain here things the audience would probably like to see>
<Explain also things that could be improved in your movie>
<You may also suggest screenshots.>
Samsara: wait i think this one's legit. anyway here's my number, so call me maybe (hands you a slip of paper with 69 written on it in crayon)
feos: Fixed code embed (by replacing with monospaced, since code embeds don't have linbreaks in the forum view).
Samsara: Adding GEG branch due to ACE usage.
Samsara: The ending thing hasn't quite been explained in the submission text yet I don't think, so I'll summarize it here: This run triggers the
very end of the ending, just before the credits. This plays the credits, of course, but more importantly it sets the game completion state by unlocking postgame content. Triggering the credits directly would not have done this, and triggering anything before this would have lost time. I've verified that the postgame state was triggered in this run by locating and accessing a piece of postgame content, meaning that for our purposes, the game is considered complete. Note that other event flags are NOT triggered, most notably the flag for the final boss's defeat. Flags like these are not necessary for GEG runs: Since a majority of the game is skipped anyway, so are a majority of normally required event flags. As long as these flags do not adversely affect the ending by not being triggered, then triggering them is unnecessary. In this case, since the final boss flag does not directly trigger the postgame content, it is fine that it is skipped.
That leaves the nature of the ACE itself: The currently published "map glitch" run has the same issue that the
Wario Land GEG has. To simplify the explanation: VBA bad. To expound on the simplifying of the explanation: The previous Telefang runs and that Wario Land GEG run were only possible because VBA did not crash where an actual (or properly emulated) GBA
would crash. This run avoids that through different methodology while also being a couple minutes faster to boot. Given that the run was performed on BizHawk, I am
far more confident that this is legit given the incredible dedication of the GB/C emulation community to accuracy for console verification purposes.
I'm accepting this to obsolete the
map glitch run, as it serves the same purpose with actual legitimacy this time. Thanks, VBA!
EDIT: Since this judgement, the TAS has been
console verified, so... I guess it's double accepted now. Hooray!
