This is a translation of the original article:
It was mostly processed by Claude 3 Opus.
The RAM Writer is the ultimate tool for arbitrary code execution in the first generation Pokémon games. The RAM Writer introduced here is a version ported for the second generation games. Using this writer, you can read and write any value to any memory address. Furthermore, you can even write and execute entire programs, making it a very powerful tool that even allows you to install and play games.
This article serves as an accompanying guide for the following video.
RAM Writer Installation Procedure
Environment
This guide only works with the Japanese versions of Pokémon Crystal. It does not work with Pokémon Gold/Silver or non-Japanese versions. It also does not work with Pokémon Stadium 2's GB Tower or some emulators.
Step 1: Have 2 Pokémon in your party
If starting a new game, you need to progress until you obtain Poké Balls. The gender, time, player’s name, day of the week, first Pokémon, and rival's name can be anything. Do not have 3 or more Pokémon in your party until you use TM17 to start the RAM Writer.
Step 2: Change Box Names
Change the Box names as follows.
Box 2: ダだゲムよダだガ
Box 3: よノゥネろてエろ
Box 4: にらヅノるひジデ
Box 5: にテゥキリゅゅの
Box 6: へブひひ はムろ
Box 7: どダれアろダだや
Box 8: ざダれむをダリ
Box 9: だかがをぜジだを
Step 3: Obtain Pokémon with an Unterminated Name
- Obtain a Pokémon with an unterminated name by doing a hard reset at a specific timing when saving.
- If starting a new game, switch to Box 3. If using an existing save file, switch to a Box that has never been full. It is recommended to use a Box that has never been used before. Make sure to save when switching Boxes.
- Deposit a single Pokémon. Select "ボックスせいり／メールはずしてね", choose "はい" to "レポートにうえからかいてもいいですか？", and do a hard reset right after "でんげんをきらないでください" is fully displayed.
- After rebooting the game, open the Bag first, then check the Box.
- If the newly deposited Pokémon's nickname was changed to a bunch of question marks, you can continue with the next step. If not, redo step b. If the Pokémon is not deposited at all, the reset was too early. If the Pokémon is deposited normally, the reset was too late.
- Once you obtain the Pokémon with an unterminated name, put it at the top of Box 3.
- (If using an existing save file) Switch to Box 3.
Step 4: 0x1500 Control Code Arbitrary Code Execution
- After obtaining the Pokémon with an unterminated name, make the 1st item in the Bag an unwanted item and save and reset in front of the PC.
- After reloading the save, take 1 step to the left and 1 step down from in front of the PC and open the Pokédex. Make sure to open the Pokédex at this spot.
- In the Pokédex, put the cursor on Spearow.
- In case the only wild Pokémon you have seen is Pidgey, Spearow would be out of reach in new Pokédex mode, so the player will need to go to old Pokédex mode
- The new Pokédex mode’s order is as follows, so even if you haven't encountered Spearow, you can use this as a reference to put the cursor on it:🔍ワニノコ (Totodile)
アリゲイツ (Croconaw)
オーダイル (Feraligatr)
ポッポ (Pidgey)
ピジョン (Pidgeotto)
ピジョット (Pidgeot)
オニスズメ (Spearow)
オニドリル (Fearow)
ホーホー (Hoothoot)
ヨルノズク (Noctowl)
コラッタ (Rattata)
ラッタ (Raticate)
オタチ (Sentret)
- After closing the Pokédex, take 1 step to the right, 1 step up. Open the PC and display the unterminated name Pokémon’s name. Make sure to follow this movement order. It will fail if you don't follow this order.
The setup was success if it does’t crash and the following occurs:
- The name of Box 6 became "へブばん どうろひ はムろ".
- The 1st item in the Bag became a はながらメール (Flower Mail).
Step 5: Simplified RAM Writer Setup
Change the names of Box 3 to Box 5 as follows. Do not change the names of Box 6.
Box 4: ヅまとへゲみぴよ
Box 5: へゲみボぷへゲみ
After changing the Box names, please confirm that they are as follows:
Box 2: ダだゲムよダだガ
Box 3: だじダムキづごぱ
Box 4: ヅまとへゲみぴよ
Box 5: へゲみボぷへゲみ
Box 6: へブばん どうろひ はムろ
Box 7: どダれアろダだや
Box 8: ざダれむをダリ
Box 9: だかがをぜジだを
Give a Pokémon the following Mail:
に０ぞ？ムぞボデののののののだっ
After creating the Mail, read the contents of the Mail. Then you can start the simplified RAM Writer by opening the Pokédex.
Simplified RAM Writer
From now on, you can start the simplified RAM Writer each time you read the above Mail and then open the Pokédex.
DD0B on the left is the memory address being written to, and 00 on the right is its content. Note that the display of A, B, C is abnormal in this simplified RAM Writer. A is g, B is a horizontal line, and C is a phone icon.
B: Address -01
A: Address +01
↑: Value -01
↓: Value +01
←: Value -10
→: Value +10
START: Exit
SELECT: Execute code from DDD1 (be careful not to press this until you have entered the program)
Step 6: RAM Writer Setup
Use the simplified RAM Writer to input the RAM Writer program. Once input is complete, you can start the RAM Writer by pressing the Select button. It is recommended to press the Start button to exit the simplified RAM Writer and save before launching the RAM Writer.
| Address | Value |
|---|---|
| DD0B | CD |
| DD0C | C5 |
| DD0D | 32 |
| DD0E | CD |
| DD0F | C2 |
| DD10 | 31 |
| DD11 | CD |
| DD12 | 3B |
| DD13 | 0E |
| DD14 | CD |
| DD15 | 49 |
| DD16 | 0E |
| DD17 | 11 |
| DD18 | 00 |
| DD19 | 40 |
| DD1A | 21 |
| DD1B | 00 |
| DD1C | 96 |
| DD1D | 01 |
| DD1E | 19 |
| DD1F | 3E |
| DD20 | CD |
| DD21 | B3 |
| DD22 | 0D |
| DD23 | F0 |
| DD24 | 9D |
| DD25 | F5 |
| DD26 | 21 |
| DD27 | 00 |
| DD28 | D0 |
| DD29 | CD |
| DD2A | 5C |
| DD2B | C8 |
| DD2C | E5 |
| DD2D | 11 |
| DD2E | F8 |
| DD2F | FF |
| DD30 | 19 |
| DD31 | E5 |
| DD32 | D1 |
| DD33 | 21 |
| DD34 | A9 |
| DD35 | C4 |
| DD36 | F0 |
| DD37 | 9D |
| DD38 | CD |
| DD39 | 9D |
| DD3A | 2F |
| DD3B | CD |
| DD3C | AB |
| DD3D | C8 |
| DD3E | 01 |
| DD3F | 0C |
| DD40 | 00 |
| DD41 | 36 |
| DD42 | 7C |
| DD43 | 23 |
| DD44 | 7A |
| DD45 | CD |
| DD46 | AB |
| DD47 | C8 |
| DD48 | 7B |
| DD49 | CD |
| DD4A | AB |
| DD4B | C8 |
| DD4C | 36 |
| DD4D | 7F |
| DD4E | 23 |
| DD4F | 1A |
| DD50 | CD |
| DD51 | AB |
| DD52 | C8 |
| DD53 | 13 |
| DD54 | 36 |
| DD55 | 7C |
| DD56 | 09 |
| DD57 | 7C |
| DD58 | FE |
| DD59 | C6 |
| DD5A | 20 |
| DD5B | E5 |
| DD5C | CD |
| DD5D | AD |
| DD5E | 2F |
| DD5F | 3E |
| DD60 | ED |
| DD61 | EA |
| DD62 | 4B |
| DD63 | C5 |
| DD64 | E1 |
| DD65 | 18 |
| DD66 | C2 |
| DD67 | CD |
| DD68 | 1B |
| DD69 | 35 |
| DD6A | F0 |
| DD6B | A9 |
| DD6C | 5F |
| DD6D | 01 |
| DD6E | 01 |
| DD6F | 00 |
| DD70 | 07 |
| DD71 | 38 |
| DD72 | 1E |
| DD73 | 0B |
| DD74 | 0B |
| DD75 | 07 |
| DD76 | 38 |
| DD77 | 19 |
| DD78 | 0E |
| DD79 | F0 |
| DD7A | 07 |
| DD7B | 38 |
| DD7C | 14 |
| DD7D | 01 |
| DD7E | 10 |
| DD7F | 00 |
| DD80 | 07 |
| DD81 | 38 |
| DD82 | 0E |
| DD83 | 48 |
| DD84 | 07 |
| DD85 | 30 |
| DD86 | 0A |
| DD87 | E1 |
| DD88 | F1 |
| DD89 | D7 |
| DD8A | 3E |
| DD8B | F9 |
| DD8C | E0 |
| DD8D | 70 |
| DD8E | C3 |
| DD8F | ED |
| DD90 | 21 |
| DD91 | 7B |
| DD92 | 0F |
| DD93 | 30 |
| DD94 | 10 |
| DD95 | 0F |
| DD96 | 0F |
| DD97 | 30 |
| DD98 | 01 |
| DD99 | E9 |
| DD9A | F0 |
| DD9B | 9D |
| DD9C | CD |
| DD9D | 9D |
| DD9E | 2F |
| DD9F | 79 |
| DDA0 | 86 |
| DDA1 | 77 |
| DDA2 | C3 |
| DDA3 | AD |
| DDA4 | 2F |
| DDA5 | 0F |
| DDA6 | 38 |
| DDA7 | 05 |
| DDA8 | 0F |
| DDA9 | 38 |
| DDAA | 06 |
| DDAB | 09 |
| DDAC | C9 |
| DDAD | 79 |
| DDAE | 84 |
| DDAF | 67 |
| DDB0 | C9 |
| DDB1 | F0 |
| DDB2 | 9D |
| DDB3 | 81 |
| DDB4 | D7 |
| DDB5 | C9 |
| DDB6 | F5 |
| DDB7 | CB |
| DDB8 | 37 |
| DDB9 | CD |
| DDBA | B2 |
| DDBB | C8 |
| DDBC | F1 |
| DDBD | E6 |
| DDBE | 0F |
| DDBF | C6 |
| DDC0 | F6 |
| DDC1 | F6 |
| DDC2 | 60 |
| DDC3 | 22 |
| DDC4 | C9 |
| DDD1 | 11 |
| DDD2 | DE |
| DDD3 | AF |
| DDD4 | CD |
| DDD5 | DB |
| DDD6 | DD |
| DDD7 | 11 |
| DDD8 | 00 |
| DDD9 | C8 |
| DDDA | D5 |
| DDDB | 3E |
| DDDC | 03 |
| DDDD | 01 |
| DDDE | BA |
| DDDF | 00 |
| DDE0 | 21 |
| DDE1 | 0B |
| DDE2 | DD |
| DDE3 | CD |
| DDE4 | 9D |
| DDE5 | 2F |
| DDE6 | C3 |
| DDE7 | F2 |
| DDE8 | 2F |
RAM Writer
From now on, you can start the RAM Writer each time you start the simplified RAM Writer and press the Select button.
The 10 on the top of the screen is the current ROM bank and SRAM bank.
↑: Address -01
↓: Address +01
←: Address -10
→: Address +10
B+↑: Address -100
B+↓: Address +100
B+←: Address -1000
B+→: Address +1000
A+↑: Value -01
A+↓: Value +01
A+←: Value -10
A+→: Value +10
START: Exit
SELECT+↑: Bank -01
SELECT+↓: Bank +01
SELECT+←: Bank -10
SELECT+→: Bank +10
SELECT+A: Execute code from the current address (use with caution)
Use the RAM Writer to change the contents of addresses D300-D30B and DA47-DA55 as follows:
| Address | Value |
|---|---|
| D300 | 3E |
| D301 | D0 |
| D302 | EA |
| D303 | C6 |
| D304 | D0 |
| D305 | 3E |
| D306 | 03 |
| D307 | 21 |
| D308 | D7 |
| D309 | 55 |
| D30A | CF |
| D30B | C9 |
| DA47 | 3E |
| DA48 | 03 |
| DA49 | 01 |
| DA4A | BA |
| DA4B | 00 |
| DA4C | 11 |
| DA4D | 00 |
| DA4E | C8 |
| DA4F | 21 |
| DA50 | DE |
| DA51 | AF |
| DA52 | D5 |
| DA53 | C3 |
| DA54 | 8C |
| DA55 | 68 |
After changing, put the cursor on address D300 and press SELECT+A to obtain TM17 in the key items pocket. Each time you use this TM17, you can directly start the RAM Writer.
Step 7: Restoring to Normal State
Various side effects occur from the RAM Writer setup.
- Pokédex
- Box names
- Pokémon with an unterminated name
Pokédex
You can fix the Pokédex by changing the content of address D94C to 00.
Box Names
After setup of the TM17 RAM Writer, you can change the Box names to anything you like.
The addresses corresponding to the Box names are DB68-DBB8 and the default values are as follows:
1C AC 87 8C F7 50 00 00 00
1C AC 87 8C F8 50 00 00 00
1C AC 87 8C F9 50 00 00 00
1C AC 87 8C FA 50 00 00 00
1C AC 87 8C FB 50 00 00 00
1C AC 87 8C FC 50 00 00 00
1C AC 87 8C FD 50 00 00 00
1C AC 87 8C FE 50 00 00 00
1C AC 87 8C FF 50 00 00 00Pokémon with an Unterminated Name
Open the Bag first, then open the Box and release the Pokémon with an unterminated name.
Precautions
Do not edit addresses AFDE-B097 in SRAM bank 03 and C800-C8B9, DA47-DA55 with the RAM Writer.
Technical Notes
Arbitrary Code Execution with 0x1500 Control Code
Arbitrary code execution using the 0x1500 control code is a method discovered in Pokémon Crystal and cannot be used in Pokémon Gold/Silver. It involves the combination of the 0x15 control character followed by 0x00 in a text string.
Reading the 0x15 control character causes the next character to be used as an argument to execute a mobile script. If the internal ID of the next character is 0x01-0x0F, it executes a mobile function, and if it is 0x10 or higher, it is supposed to end the mobile script. However, 0x00 is not handled properly and address CD46 is executed instead. Address CD46 is an address used by some mobile functions. Therefore, by finding a text combination of 0x15, 0x00, you can execute address CD46.
| Address | Function |
|---|---|
| D05B | Address where the names of Pokémon and item are buffered. |
| D0C8 | Address where the current selected party Pokémon’s species is buffered. |
| D0C9 | Address where the current selected party Pokémon’s party slot is buffered. |
| D0CE | Address for temporarily storing Pokémon. |
| D296 | Address for temporarily storing Pokémon species. |
| D297 | Address failed to flee from battle. |
When the game is reset, the contents of addresses D05B and onward become 0x00. The Pokémon with an unterminated name does not have the 0x50 that indicates the end of the name, so when trying to display its nickname, it tries to read the text until it outputs the 0x50 that indicates the end.
If you follow the steps above after reopening the game, the content of address D0C8 is the species ID of the Pokémon last seen in the Pokédex, the content of address D0C9 is 0x02, the content of address D0CE is 0x00, the content of address D296 is 0x15, and the content of address D297 is 0x00. The reason the content of address D0C9 is 0x02 is for poison status judgment and it becomes the same as the number of Pokémon you have.
If you haven't seen Spearow, the content of address D0C8 will not be 0x15. Therefore, when trying to read the content 0x15 of address D296 as text, it executes address CD46 by using the content 0x00 of the next address D297 as an argument for the mobile script.
If you have seen Spearow, the content of address D0C8 becomes 0x15, and it executes the mobile function corresponding to 0x02, the content of the next address D0C9. By executing the mobile function for 0x02, it executes address CD46 by using the content 0x00 of address D0CE as an argument for the mobile script.
By opening the Pokédex at the specified location, moving 1 step to the right, and moving 1 step up, it changes the contents of addresses CD64 onward to C2 9B C4 (jp nz, C49B). Since addresses CD46 to CD63 contain 0x00, after executing address CD46, it will execute address C49B.
Screen Data
Addresses C49B to C49F contain 00. Address C4A0 onward contains screen data as follows:
WRA0:C4A0 7F ld a,a
WRA0:C4A1 7F ld a,a
WRA0:C4A2 7F ld a,a
WRA0:C4A3 7F ld a,a
WRA0:C4A4 7F ld a,a
WRA0:C4A5 7F ld a,a
WRA0:C4A6 7F ld a,a
WRA0:C4A7 7F ld a,a
WRA0:C4A8 7F ld a,a
WRA0:C4A9 79 ld a,c
WRA0:C4AA 7A ld a,d
WRA0:C4AB 7A ld a,d
WRA0:C4AC 7A ld a,d
WRA0:C4AD 7A ld a,d
WRA0:C4AE 7A ld a,d
WRA0:C4AF 7A ld a,d
WRA0:C4B0 7A ld a,d
WRA0:C4B1 7A ld a,d
WRA0:C4B2 7A ld a,d
WRA0:C4B3 7B ld a,e
WRA0:C4B4 7F ld a,a
WRA0:C4B5 7F ld a,a
WRA0:C4B6 7F ld a,a
WRA0:C4B7 7F ld a,a
WRA0:C4B8 7F ld a,a
WRA0:C4B9 7F ld a,a
WRA0:C4BA 7F ld a,a
WRA0:C4BB 7F ld a,a
WRA0:C4BC 7F ld a,a
WRA0:C4BD 7C ld a,h
WRA0:C4BE 7F ld a,a
WRA0:C4BF 7F ld a,a
WRA0:C4C0 7F ld a,a
WRA0:C4C1 7F ld a,a
WRA0:C4C2 7F ld a,a
WRA0:C4C3 7F ld a,a
WRA0:C4C4 7F ld a,a
WRA0:C4C5 7F ld a,a
WRA0:C4C6 7F ld a,a
WRA0:C4C7 7C ld a,h
WRA0:C4C8 7F ld a,a
WRA0:C4C9 7F ld a,a
WRA0:C4CA 7F ld a,a
WRA0:C4CB 7F ld a,a
WRA0:C4CC 7F ld a,a
WRA0:C4CD 7F ld a,a
WRA0:C4CE 7F ld a,a
WRA0:C4CF 7F ld a,a
WRA0:C4D0 7F ld a,a
WRA0:C4D1 7C ld a,h
WRA0:C4D2 D6 98 sub a,98
WRA0:C4D4 EA A0 DB ld (DBA0),a
WRA0:C4D7 C3 83 DB jp DB83Box Names
Explanation
The arbitrary code execution using the 0x1500 control code utilizes the names of Box 3 to Box 6. Address C4D2 onward contains screen data related to the name of the current Box, and if you follow the steps, it will be the name of Box 3.
By executing up to address C4D1, the a register contains CD, so the effect of this arbitrary code execution is to change the content of address DB97 to 35, the content of address D94C to 0C, and the content of address D886 to 9E.
Address DB97 stores the Box names and are overwritten to execute the simplified RAM Writer. Address D94C stores the Pokédex mode, and by putting an abnormal value, it enables arbitrary code execution using the Pokédex. Address D886 stores the type of the 1st item in the Bag, and setting it to 9E makes the 1st item a Flower Mail.
WRA0:C4D2 D6 98 sub a,98
WRA0:C4D4 EA 97 DB ld (DB97),a
WRA0:C4D7 C3 83 DB jp DB83
WRA1:DB83 C6 D7 add a,D7
WRA1:DB85 11 98 D9 ld de,D998
WRA1:DB88 CB 0B rrc e
WRA1:DB8A 12 ld (de),a
WRA1:DB8B 50 ld d,b
WRA1:DB8C C6 92 add a,92
WRA1:DB8E EA 86 D8 ld (D886),a
WRA1:DB91 E1 pop hl
WRA1:DB92 E1 pop hl
WRA1:DB93 C9 ret
WRA1:DB94 50 ld d,bBinary
C4D2:
D6 98 EA A0 DB C3 83 DB
DB83:
C6 D7 11 98 D9 CB 0B 12 50
C6 92 EA 86 D8 E1 E1 C9 50Simplified RAM Writer
Explanation
By setting the Pokédex mode to 0C and opening the Pokédex, it executes address D021. Addresses D002 to D022 store the contents of the last viewed Mail, so by reading a Mail and then opening the Pokédex, you can start the simplified RAM Writer.
The simplified RAM Writer is a program that outputs the address pointed to by the hl register and its contents. It changes the address pointed to by the hl register and its contents based on key inputs.
WRA1:D002 CD C5 32 call 32C5
WRA1:D005 C3 B2 DB jp DBB2
WRA1:D008 C5 push bc
WRA1:D009 CB 30 swap b
WRA1:D00B CD 0F D0 call D00F
WRA1:D00E C1 pop bc
WRA1:D00F 3E 0F ld a,0F
WRA1:D011 A0 and b
WRA1:D012 4E ld c,(hl)
WRA1:D013 C6 F6 add a,F6
WRA1:D015 2F cpl
WRA1:D016 E6 9F and a,9F
WRA1:D018 2F cpl
WRA1:D019 1C inc e
WRA1:D01A 12 ld (de),a
WRA1:D01B C9 ret
WRA1:D01C C9 ret
WRA1:D01D C9 ret
WRA1:D01E C9 ret
WRA1:D01F C9 ret
WRA1:D020 C9 ret
WRA1:D021 30 DF jr nc,D002
WRA1:DB68 0F rrca
WRA1:DB69 30 06 jr nc,DB71
WRA1:DB6B AF xor a
WRA1:DB6C C6 10 add a,10
WRA1:DB6E 30 0E jr nc,DB7E
WRA1:DB70 50 ld d,b
WRA1:DB71 0F rrca
WRA1:DB72 30 08 jr nc,DB7C
WRA1:DB74 9F sbc a
WRA1:DB75 D6 0F sub a,0F
WRA1:DB77 30 05 jr nc,DB7E
WRA1:DB79 50 ld d,b
WRA1:DB7A 30 2C jr nc,DBA8
WRA1:DB7C 0F rrca
WRA1:DB7D 9F sbc a
WRA1:DB7E 86 add (hl)
WRA1:DB7F 32 ldd (hl),a
WRA1:DB80 2A ldi a,(hl)
WRA1:DB81 44 ld b,h
WRA1:DB82 50 ld d,b
WRA1:DB83 11 CF C4 ld de,C4CF
WRA1:DB86 CD 08 D0 call D008
WRA1:DB89 45 ld b,l
WRA1:DB8A D6 50 sub a,50
WRA1:DB8C CD 08 D0 call D008
WRA1:DB8F 1C inc e
WRA1:DB90 46 ld b,(hl)
WRA1:DB91 CD 08 D0 call D008
WRA1:DB94 50 ld d,b
WRA1:DB95 CD 1B 35 call 351B
WRA1:DB98 CB 7F bit 7,a
WRA1:DB9A CA 9F DB jp z,DB9F
WRA1:DB9D 50 ld d,b
WRA1:DB9E 34 inc (hl)
WRA1:DB9F 0F rrca
WRA1:DBA0 DA 80 DB jp c,DB80
WRA1:DBA3 0F rrca
WRA1:DBA4 30 D4 jr nc,DB7A
WRA1:DBA6 50 ld d,b
WRA1:DBA7 2B dec hl
WRA1:DBA8 0F rrca
WRA1:DBA9 DA D1 DD jp c,DDD1
WRA1:DBAC 0F rrca
WRA1:DBAD D8 ret c
WRA1:DBAE 50 ld d,b
WRA1:DBAF 50 ld d,b
WRA1:DBB0 30 B6 jr nc,DB68
WRA1:DBB2 26 DD ld h,DD
WRA1:DBB4 2E 0B ld l,0B
WRA1:DBB6 30 DD jr nc,DB95
WRA1:DBB8 50 ld d,bBinary
D002:
CD C5 32 C3 B2 DB C5 CB 30 CD 0F D0 C1 3E 0F A0 4E
C6 F6 2F E6 9F 2F 1C 12 C9 C9 C9 C9 C9 C9 30 DF
DB68:
0F 30 06 AF C6 10 30 0E 50
0F 30 08 9F D6 0F 30 05 50
30 2C 0F 9F 86 32 2A 44 50
11 CF C4 CD 08 D0 45 D6 50
CD 08 D0 1C 46 CD 08 D0 50
CD 1B 35 CB 7F CA 9F DB 50
34 0F DA 80 DB 0F 30 D4 50
2B 0F DA D1 DD 0F D8 50 50
30 B6 26 DD 2E 0B 30 DD 50Code Execution by Select Button in Simplified RAM Writer
Explanation
The contents of address DD0B onward are copied to SRAM bank 03 address AFDE onward and address C800 onward, and then C800 is executed.
WRA1:DDD1 11 DE AF ld de,AFDE
WRA1:DDD4 CD DB DD call DDDB
WRA1:DDD7 11 00 C8 ld de,C800
WRA1:DDDA D5 push de
WRA1:DDDB 3E 03 ld a,03
WRA1:DDDD 01 BA 00 ld bc,00BA
WRA1:DDE0 21 0B DD ld hl,DD0B
WRA1:DDE3 CD 9D 2F call 2F9D
WRA1:DDE6 C3 F2 2F jp 2FF2Binary
11 DE AF CD DB DD 11 00 C8 D5 3E 03 01 BA 00 21
0B DD CD 9D 2F C3 F2 2FRAM Writer
Explanation
The RAM Writer is a program that outputs the 18 addresses including the one pointed to by the hl register and their contents. It also displays the ROM bank and SRAM bank at the top of the screen to make them easy to change. You can start the RAM Writer by executing address C800.
WRA0:C800 CD C5 32 call 32C5
WRA0:C803 CD C2 31 call 31C2
WRA0:C806 CD 3B 0E call 0E3B
WRA0:C809 CD 49 0E call 0E49
WRA0:C80C 11 00 40 ld de,4000
WRA0:C80F 21 00 96 ld hl,9600
WRA0:C812 01 19 3E ld bc,3E19
WRA0:C815 CD B3 0D call 0DB3
WRA0:C818 F0 9D ld a,(ff00+9D)
WRA0:C81A F5 push af
WRA0:C81B 21 00 D0 ld hl,D000
WRA0:C81E CD 5C C8 call C85C
WRA0:C821 E5 push hl
WRA0:C822 11 F8 FF ld de,FFF8
WRA0:C825 19 add hl,de
WRA0:C826 E5 push hl
WRA0:C827 D1 pop de
WRA0:C828 21 A9 C4 ld hl,C4A9
WRA0:C82B F0 9D ld a,(ff00+9D)
WRA0:C82D CD 9D 2F call 2F9D
WRA0:C830 CD AB C8 call C8AB
WRA0:C833 01 0C 00 ld bc,000C
WRA0:C836 36 7C ld (hl),7C
WRA0:C838 23 inc hl
WRA0:C839 7A ld a,d
WRA0:C83A CD AB C8 call C8AB
WRA0:C83D 7B ld a,e
WRA0:C83E CD AB C8 call C8AB
WRA0:C841 36 7F ld (hl),7F
WRA0:C843 23 inc hl
WRA0:C844 1A ld a,(de)
WRA0:C845 CD AB C8 call C8AB
WRA0:C848 13 inc de
WRA0:C849 36 7C ld (hl),7C
WRA0:C84B 09 add hl,bc
WRA0:C84C 7C ld a,h
WRA0:C84D FE C6 cp a,C6
WRA0:C84F 20 E5 jr nz,C836
WRA0:C851 CD AD 2F call 2FAD
WRA0:C854 3E ED ld a,ED
WRA0:C856 EA 4B C5 ld (C54B),a
WRA0:C859 E1 pop hl
WRA0:C85A 18 C2 jr C81E
WRA0:C85C CD 1B 35 call 351B
WRA0:C85F F0 A9 ld a,(ff00+A9)
WRA0:C861 5F ld e,a
WRA0:C862 01 01 00 ld bc,0001
WRA0:C865 07 rlca
WRA0:C866 38 1E jr c,C886
WRA0:C868 0B dec bc
WRA0:C869 0B dec bc
WRA0:C86A 07 rlca
WRA0:C86B 38 19 jr c,C886
WRA0:C86D 0E F0 ld c,F0
WRA0:C86F 07 rlca
WRA0:C870 38 14 jr c,C886
WRA0:C872 01 10 00 ld bc,0010
WRA0:C875 07 rlca
WRA0:C876 38 0E jr c,C886
WRA0:C878 48 ld c,b
WRA0:C879 07 rlca
WRA0:C87A 30 0A jr nc,C886
WRA0:C87C E1 pop hl
WRA0:C87D F1 pop af
WRA0:C87E D7 rst 10
WRA0:C87F 3E F9 ld a,F9
WRA0:C881 E0 70 ld (ff00+70),a
WRA0:C883 C3 ED 21 jp 21ED
WRA0:C886 7B ld a,e
WRA0:C887 0F rrca
WRA0:C888 30 10 jr nc,C89A
WRA0:C88A 0F rrca
WRA0:C88B 0F rrca
WRA0:C88C 30 01 jr nc,C88F
WRA0:C88E E9 jp hl
WRA0:C88F F0 9D ld a,(ff00+9D)
WRA0:C891 CD 9D 2F call 2F9D
WRA0:C894 79 ld a,c
WRA0:C895 86 add (hl)
WRA0:C896 77 ld (hl),a
WRA0:C897 C3 AD 2F jp 2FAD
WRA0:C89A 0F rrca
WRA0:C89B 38 05 jr c,C8A2
WRA0:C89D 0F rrca
WRA0:C89E 38 06 jr c,C8A6
WRA0:C8A0 09 add hl,bc
WRA0:C8A1 C9 ret
WRA0:C8A2 79 ld a,c
WRA0:C8A3 84 add h
WRA0:C8A4 67 ld h,a
WRA0:C8A5 C9 ret
WRA0:C8A6 F0 9D ld a,(ff00+9D)
WRA0:C8A8 81 add c
WRA0:C8A9 D7 rst 10
WRA0:C8AA C9 ret
WRA0:C8AB F5 push af
WRA0:C8AC CB 37 swap a
WRA0:C8AE CD B2 C8 call C8B2
WRA0:C8B1 F1 pop af
WRA0:C8B2 E6 0F and a,0F
WRA0:C8B4 C6 F6 add a,F6
WRA0:C8B6 F6 60 or a,60
WRA0:C8B8 22 ldi (hl),a
WRA0:C8B9 C9 ret Binary
CD C5 32 CD C2 31 CD 3B 0E CD 49 0E 11 00 40 21
00 96 01 19 3E CD B3 0D F0 9D F5 21 00 D0 CD 5C
C8 E5 11 F8 FF 19 E5 D1 21 A9 C4 F0 9D CD 9D 2F
CD AB C8 01 0C 00 36 7C 23 7A CD AB C8 7B CD AB
C8 36 7F 23 1A CD AB C8 13 36 7C 09 7C FE C6 20
E5 CD AD 2F 3E ED EA 4B C5 E1 18 C2 CD 1B 35 F0
A9 5F 01 01 00 07 38 1E 0B 0B 07 38 19 0E F0 07
38 14 01 10 00 07 38 0E 48 07 30 0A E1 F1 D7 3E
F9 E0 70 C3 ED 21 7B 0F 30 10 0F 0F 30 01 E9 F0
9D CD 9D 2F 79 86 77 C3 AD 2F 0F 38 05 0F 38 06
09 C9 79 84 67 C9 F0 9D 81 D7 C9 F5 CB 37 CD B2
C8 F1 E6 0F C6 F6 F6 60 22 C9TM17 in Key Items Pocket
Explanation
By executing address 55D7 in ROM bank 03, you can obtain the item corresponding to the content of address D0C6 in the key items pocket.
By using TM17 outside the TM pocket, it executes address FA47. The program from address FA47 onward copies the contents of SRAM bank 03 address AFDE onward to address C800 onward and executes address C800.
WRA1:D300 3E D0 ld a,D0
WRA1:D302 EA C6 D0 ld (D0C6),a
WRA1:D305 3E 03 ld a,03
WRA1:D307 21 D7 55 ld hl,55D7
WRA1:D30A CF rst 08
WRA1:D30B C9 ret
ECH1:FA47 3E 03 ld a,03
ECH1:FA49 01 BA 00 ld bc,00BA
ECH1:FA4C 11 00 C8 ld de,C800
ECH1:FA4F 21 DE AF ld hl,AFDE
ECH1:FA52 D5 push de
ECH1:FA53 C3 8C 68 jp 688CBinary
D300:
3E D0 EA C6 D0 3E 03 21 D7 55 CF C9
FA47:
3E 03 01 BA 00 11 00 C8 21 DE AF D5 C3 8C 68
