🐾flag3

This is a translation of the original article:

📄ポケットモンスター 赤・緑・青 バイナリエディタ

It was mostly processed by Claude 3 Opus.

The RAM Writer is the ultimate tool for arbitrary code execution in the first generation Pokémon games. Using this writer, you can read and write any value to any memory address. Furthermore, you can even write and execute entire programs, making it a very powerful tool that even allows you to install and play games such as Tetris and Reversi.

This article serves as an accompanying guide for the following video.

This guide only works with the Japanese versions of Pokémon Red, Green, and Blue. It does not work with Pokémon Yellow or non-Japanese versions. It also does not work with Pokémon Stadium's GB Tower or some emulators. The guide starts from the perspective of a player starting a new game, the latter half of the guide contains details on how to perform the setup for existing saves.

Pokémon Red and Green each have v1.0 and v1.1 versions.

• If the engraving on the lower right corner of the cartridge's surface package seal contains only numbers, it is v1.0
• If it contains numbers + A, it is v1.1.

Note that the VC release uses the V1.1 release.

In the following step 3,

• if the 23rd item is "ぼチへぴゾの4ぽレ", it can also be identified as v1.0.
• otherwise, it is v1.1.

Note that Pokémon Blue only has one version.

The player's name can be anything, but set the rival's name to "レレレオ". Either take the Potion from the PC or obtain it from the NPC on Route 1, then progress through the game normally until you obtain the Oak's Parcel.

1. Head to the southernmost patch of grass on route 1. It is recommended to save.
2. Press the Select button on the second item in the Bag and encounter a wild Pokémon.
3. Open the Party menu and select the first Pokémon. It will automatically swap with the non-existent second Pokémon.
4. Choose Fight and then Run. If you Run without choosing Fight, the screen will go black every 4 steps and the game will lock up.
5. Enter Pallet Town, take 48-49 steps, then enter the rival's house.
6. You will be transported to Route 16. Take 4 steps to the right so that you are right above the top-right corner of the house. Take a step down to enter the guard gate.
7. Exit from the right side of the guard gate. After exiting, walk 3 steps right, then 2 steps down, then 6 steps right. Go down and walk through the tiles to the left of the Cut tree and head towards Celadon City.
8. Upon entering Celadon City, follow the wall, go to the Celadon Department Store, and enter through the left door.

Go to the 2nd floor of the Celadon Department Store and purchase items in the following order:

After purchasing, take 6-9 steps and talk to the clerk again.

• Select Sell, verify that there are 255 Awakenings in the Bag.
• Swap the Oak's Parcel with the Antidote × 8.
• Sell all items except the Awakening and Oak's Parcel. The first item in the Bag should be Awakening × 1, followed by Awakening × 255.
• If you won the rival battle, sell 251 of the second Awakening to set your money to 26725 yen. If you lost, sell 253 to set it to 26750 yen.

After shopping, open the Bag from the menu.

• Swap the first and second Awakening 4 times.
• The number of items held will become 255, so swap the first Awakening with the 22nd item, the なかよしバッヂ.
• Swap the 25th item, ピーピーエイド (Ether) × 0, with the 26th item.
• Swap the 24th item with the 76th item.
  • The 70th through 78th items are as follows, which can serve as a guide when swapping 24th item with the 76th item.
    🔍

    70th item: まひなおし (Paralyze Heal) × 3

    71st item: マスターボール (Master Ball) × 12

    72nd item: モンスターボール (Poké Ball) × 122

    73rd item: マスターボール (Master Ball) × 16

    74th item: マスターボール (Master Ball) × 124

    75th item: マスターボール (Master Ball) × 1

    76th item

    77th item: ？？？？？

    78th item: マスターボール (Master Ball)

Enter the elevator. This will lead you to the Celadon Mansion Rooftop. Once there, open the Bag.

• Toss 59 of the 74th item, ハイパーボール (Ultra Balls), leaving 72.

It is recommended to save and reset at the entrance of the Celadon Mansion Rooftop. It is also recommended not to save again until you have finished setting up the simplified RAM Writer.

Obtain Eevee and nickname them in the following order. You can obtain as many Eevee as you like at this point. If Eevee's Poké Ball disappears, reset and walk at least 4 steps before obtaining Eevee.

After nicknaming Eevee, head downwards and exit through the rightmost side of the door. This will lead you directly to the Pokémon Day Care.

Deposit the Eevee with the nickname "ーゆてぽん" in the second slot of your party.

Using the なかよしバッヂ will launch the simplified RAM Writer.

From now on, using the なかよしバッヂ should launch the simplified RAM Writer each time.

D5E3 on the left is the memory address you are trying to write to, 00 on the right is the current value at that address.

Use the simplified RAM Writer to input the RAM Writer program. Once you have finished inputting, pressing the Select button will launch the RAM Writer. It is recommended to close the simplified RAM writer and save prior to launching the full RAM Writer.

From now on, launching the simplified RAM Writer and pressing the Select button should launch the RAM Writer each time.

By making the following changes using the RAM Writer, you can make it so that using the なかよしバッヂ directly launches the RAM Writer.

The above procedure assumes starting a new game, but you can also install the RAM Writer on existing save data using the simplified RAM Writer. If you have entered the Safari Zone before, enter the Safari Zone and use an Escape Rope. Deposit a Pokémon nicknamed "ーゆてょん" in the Day Care, nickname the Pokémon in the box as follows, then use the なかよしバッヂ to launch the simplified RAM Writer.

• If you haven't reached Celadon City, reduce your party to 2-5 Pokémon, press the Select button on the (number of Pokémon in party + 1)th item in the Bag, encounter a wild Pokémon, select the (number of Pokémon in party)th Pokémon on the Pokémon screen to obtain a Pokémon with internal number FF, and place a Pokémon with the nickname "アアアゾッ" after the Pokémon with internal number FF.
• Press the Select button on the 13th item in the Bag, encounter a wild Pokémon, select the Pokémon that had the nickname "アアアゾッ" on the Pokémon screen to increase the number of items held.
• Go to the Celadon Department Store and sell the Awakening in the first slot of the Bag to set the thousands and hundreds digits of your money to 6 and 7, respectively.
• Swap the なかよしバッヂ in the 22nd slot with an unnecessary item from somewhere within the 3rd to 20th slots. The unnecessary item should have internal numbers without A-F in hexadecimal and have a quantity of 9 or less, to ensure the money display will only contain normal values. For example, you could set it to Potion × 1.
• Press the Select button on the 13th item in the Bag again, encounter a wild Pokémon, select the Pokémon whose nickname was "アアアゾッ" on the Pokémon screen to restore the Bag.
• If you obtained a Pokémon with internal number FF, press the Select button on the (number of Pokémon in party + 1)th item in the Bag, encounter a wild Pokémon, select the Pokémon with internal number FF to restore the Pokémon's state.

This step is unnecessary if you installed the RAM Writer on existing save data. If you started a new game, various side effects have occurred due to the RAM Writer Installation.

• Pokédex
• Bag
• Money
• Current location
• PC Box
• Rival name
• Party Pokémon information
• Eevee acquisition flag

By setting the contents of addresses D28B and D29E to 00, you can remove Eevee's seen and caught information from the Pokédex. This will allow you to give the Oak's Parcel to Professor Oak.

Bag information is managed from address D2A1 onward. By setting the contents from address D2A1 onward to 03 67 00 14 01 46 01 FF, you can normalize the number of items held, make the なかよしバッヂ the first item, the Potion the second item, and the Oak's Parcel the third item.

The amount of money is managed from address D2CB to D2CD. By setting the contents from address D2CB to D2CD to 00 30 00, you can set the current money to 3000 yen.

By entering a building with only one exit, setting the contents of addresses D330, D331, D334, and D335 to 00, and then exiting, you will exit out to Pallet Town.

By setting the content of address D9B2 to 00 and the content of address D9B3 to FF, you can set the number of Pokémon deposited in the PC Box to 0.

Use the RAM Writer to change the contents of addresses D000 to D00D as follows:

After the change, press the Select button with the cursor at address D000 to choose the rival's name.

For the remaining, execute a program to restore it. Use the RAM Writer to change the contents of addresses D010 to D024 as follows.

After the change, press the Select button with the cursor at address D010 to obtain your first Pokémon again. This program also has the following effects:

• Makes your party only contain the newly obtained Pokémon.
• Allows you to obtain Eevee again.

However, note that the first Pokémon you receive is not the same individual as the one that disappeared in Step 2. From here on, you can progress through the story normally.

After installing the RAM Writer, do not throw balls in the Safari Zone or use the Pokémon Day Care. If you accidentally throw a ball in the Safari Zone, re-enter the Safari Zone and exit immediately without throwing any balls. If you accidentally use the Pokémon Day Care, deposit a Pokémon with the nickname "アアてじよ" and withdraw it immediately. Also, do not edit addresses D5E9-D661 and D983-D989 with the RAM Writer.

In Step 2, when you swap the second Pokémon with the first Pokémon, the termination code FF indicating the end of your party disappears and the game mistakenly treats the 7th and subsequent Pokémon as actual Pokémon. Specifically, Pokémon-related processes are performed on non-Pokémon data. In particular, the process of reducing the HP of poisoned Pokémon by 1 every 4 steps will be applied on this non-Pokémon data.

The Dokokashira Door Glitch is a glitch where the destination of the rival's house door is changed.

The Dokokashira Door Glitch is related to the 199th Pokémon being poisoned. The addresses related to the 199th Pokémon are as follows:

In order for the 199th Pokémon to be considered poisoned, there must be no FF values present from address D125 to D1EA. If there are any FF values in the original trainer ID, experience, effort values, or individual values of the first Pokémon you receive, the destination will not change. Experience and effort values can be avoided by not gaining experience outside of the first rival battle, but original trainer ID and individual values may sometimes contain FF values due to bad luck.

If the 3rd bit of the status condition address is set, the Pokémon is considered poisoned. When you enter Pallet Town, the content of address F337 becomes 0C, setting the 3rd bit. This content corresponds to the X coordinate of Professor Oak's Lab door.

Address F335 stores the destination of the rival's house. The content of address F335 is initially 27, but it decreases by 1 each time the poison check is performed. By taking 48-49 steps (more precisely, performing the poison check 12 times) in Step 2, the content of address F335 becomes 1B, allowing you to move to the corresponding Route 16.

Addresses E000 to FDFF are mirrors of C000 to DDFF, also known as echo RAM. Pokémon Stadium's GB Tower does not have E000 to FDFF as mirrors, so it does not work. It also does not work on emulators without proper echo RAM support.

The reason for being able to pass through the tile to the left of the Cut tree is related to the 132nd Pokémon being poisoned. The addresses related to the 132nd Pokémon are as follows:

Addresses E6E8 to EBFB store the background tiles. The tiles are divided into blocks of 2×2, and each block is assigned the following IDs.

The blocks corresponding to addresses E7B1 and E7B3 are located in the following image. The block corresponding to address E7B3 has an ID of 0F, with the 3rd bit set, so the 132nd Pokémon is considered poisoned. Therefore, the content of address E7B1 decreases by 1 each time the poison check is performed, causing the block to change. When attempting to pass through the tile to the left of the Cut tree via the shortest route from the right side of the gate, the content of address E7B1 changes from 6F to 6D, allowing you to pass through the tile to the left of the Cut tree.

Dry Underflow is a glitch that causes an underflow (more precisely, negative overflow) by further decreasing the number of items held when it is already 0, setting the number of items to 255. Originally, it was a method of giving a drink to the guard in Saffron City when the number of items held was 0, but it became possible through the item swap manipulation in Step 3, which is why it is called "Dry".

To perform Dry Underflow, you need to obtain 255 items. To obtain 255 items, the fact that the 196th Pokémon is poisoned is used. The addresses related to the 196th Pokémon are as follows:

Address F2B3 stores the item quantity of the 9th item slot. The shopping list in Step 3 is set up so that the number of items held becomes 9. For it to be considered poisoned, the 3rd bit must be set, so the item quantity of the 9th item slot is set to 8.

Addresses F2B0 and F2B1 store the ID and quantity of the 8th item slot, respectively. If you shop as described in Step 3, the 8th item will be Paralyze Heal × 1, so the contents will be 0F 01. After taking 6-9 steps, performing the poison check twice, the contents become 0E FF, so the 8th item becomes Awakening × 255.

When removing an item from the Bag, if the remaining number becomes 0, the process removes the item that became 0 and shifts all subsequent items up. Normally, this process shifts items up until it reaches the termination code FF, which indicates the end of the item list. When there is Awakening × 255, FF in hexadecimal corresponds to 255 in decimal, so this FF is processed as the end, making it appear as if Awakening × 255 is multiplying.

In Step 3, swapping the first and second Awakening 4 times sets the number of items held to 255. Before swapping, the number of items held is 3, so swapping 4 times causes an underflow (negative overflow).

When the number of items held is 0, you normally cannot move the cursor to the second item or beyond, but you can move the cursor to the second item during the above swap manipulation. This is related to the internal variable wMaxMenuItem. When the Bag is open, wMaxMenuItem contains 2, allowing you to move to the third item on the screen. When the number of items held is 1 or 0, wMaxMenuItem contains 1 or 0 to prevent moving below "CANCEL".

When performing the swap process that reduces the number of items held for two items together, it checks if the number of items held became 1 and, if so, changes wMaxMenuItem to 1. Since you normally cannot set the number of items held to 0, it does not check if the number of items held became 0 and does not change wMaxMenuItem. Therefore, you can move the cursor to the second item.

The reason Eevee's Poké Ball doesn't disappear is because the 25th Pokémon is poisoned. The addresses related to the 25th Pokémon are as follows:

Address D54D onward stores disappearing objects. Each entry consists of 2 bytes: the object's number and the flag number of the disappearing object, with the termination indicated by FF. When you enter the Celadon Mansion Rooftop, address D54D onward becomes 02 45 FF. Since address D54F is FF, after taking 4 steps, D54D onward becomes 01 45 FF, and when you obtain Eevee, a different object disappears. Since address D54E does not change, the flag indicating that you obtained Eevee is set, so if you return to the Celadon Mansion Rooftop after obtaining Eevee, Eevee's Poké Ball will disappear.

After setting the number of items held to 255, the following manipulations are performed:

1. Swap the first Awakening with the 22nd item, the なかよしバッヂ.
2. Swap the 25th item, PP Up × 80, with the 26th item.
3. Swap the 24th item with the 76th item.

The addresses for the 22nd, 24th, 25th, 26th, and 76th items are as follows:

The purpose of the first manipulation is to make the なかよしバッヂ the first item. Making the なかよしバッヂ the first item makes it easier to use. The reason the 22nd item is the なかよしバッヂ is because address D2CC contains 67, the internal number of the なかよしバッヂ, which corresponds to the thousands and hundreds digits of the money. This is why the money is adjusted to 26725 or 26750 yen in Step 3.

The purpose of the second manipulation is to maximize the text speed. Address D2D4 stores option-related information, with bits 0-3 corresponding to the number of frames to delay after displaying text. "FAST" text speed corresponds to 1 frame, and bits 0-3 of address D2D4 contain 1. By swapping the 25th and 26th items, bits 0-3 of address D2D4 are set to 0, minimizing the number of frames to delay after displaying text. Address D2D2 stores the 5th character of the rival's name, and if you give them a 4-character name as instructed, a 50 terminator value indicating the end of the name will be stored as the 5th character of the rival's name.

The purpose of the third manipulation is to set the elevator destination to the Celadon Mansion Rooftop. Address D339 stores the internal number of the destination map of the elevator, and address D338 stores the number of the destination exit. On the other hand, addresses D2D2 and D2D3 store the 3rd and 4th characters of the rival's name, respectively. Therefore, by adjusting the rival's name, you can change the destination. Note that the 1st and 2nd characters of the rival's name are not used in the RAM Writer Installation.

Since the internal number of the Celadon Mansion Rooftop is 84, the 4th character of the rival's name is set to "オ", corresponding to the value 84, to move to the Celadon Mansion Rooftop. The valid exit numbers for the Celadon Mansion Rooftop are 00 and 01. Other numbers will move you to a glitched area, but by coincidence, 26 and 27 can reference the coordinates of the Fuchsia Mart's exit and move you there. Among the exit numbers 00, 01, 26, and 27, the coordinate closest to Eevee's Poké Ball is 27, and since the process determining the coordinates ignores bits 6 and 7, the 3rd character of the rival's name is set to "レ" corresponding to the value A7.

Tossing 59 Ultra Balls is done to set the exit to the Pokémon Day Care. Tossing 59 changes the number of Ultra Balls from 131 to 72, changing it from 83 to 48 in hexadecimal, which changes the destination from the Celadon Mansion Rooftop to the Pokémon Day Care.

This is used on existing save data. The reason for being able to increase the number of items held by selecting the 13th item in the Bag is related to the nickname of the 13th Pokémon.

Address D2A1 stores the number of items held, and subsequent addresses store the ID and quantity of items. By selecting a Pokémon with the nickname "アアアゾッ", the number of items held is set to 128, the first item is set to Awakening × 172, and the second item is set to Ether.

Using the なかよしバッヂ will jump to address D983. Address D983 stores the number of Safari Balls, and addresses D984 and beyond store the nickname of the Pokémon deposited in the Pokémon Day Care. After installing the RAM Writer, by refraining from throwing balls in the Safari Zone and using the Pokémon Day Care, you can prevent these addresses from changing.

The simplified RAM Writer is a program that outputs the address pointed to by the hl register and its contents. It is set up to change the address pointed to by the hl register and its contents based on key input. JoypadLowSensitivity is called to input the keys.

The content of address DE72 is BF in the Red/Green v1.0, D1 in the Red/Green v1.1(VC), and A9 in the Blue version.

WRA1:D983 00               nop
WRA1:D984 01 E3 D5         ld   bc,D5E3
WRA1:D987 C3 48 DE         jp   DE48

WRA1:DE64 26 DE            ld   h,DE
WRA1:DE66 2E A6            ld   l,A6
WRA1:DE68 AF               xor  a
WRA1:DE69 50               ld   d,b
WRA1:DE6A D6 10            sub  a,10
WRA1:DE6C 32               ldd  (hl),a
WRA1:DE6D D6 B8            sub  a,B8
WRA1:DE6F 50               ld   d,b
WRA1:DE70 32               ldd  (hl),a
WRA1:DE71 D6 ??            sub  a,??
WRA1:DE73 32               ldd  (hl),a
WRA1:DE74 C5               push bc
WRA1:DE75 50               ld   d,b
WRA1:DE76 E1               pop  hl
WRA1:DE77 AF               xor  a
WRA1:DE78 0F               rrca 
WRA1:DE79 30 07            jr   nc,DE82
WRA1:DE7B 50               ld   d,b
WRA1:DE7C 3E 10            ld   a,10
WRA1:DE7E C3 8E DE         jp   DE8E
WRA1:DE81 50               ld   d,b
WRA1:DE82 0F               rrca 
WRA1:DE83 30 06            jr   nc,DE8B
WRA1:DE85 9F               sbc  a
WRA1:DE86 91               sub  c
WRA1:DE87 50               ld   d,b
WRA1:DE88 C3 8E DE         jp   DE8E
WRA1:DE8B 0F               rrca 
WRA1:DE8C 9F               sbc  a
WRA1:DE8D 50               ld   d,b
WRA1:DE8E 86               add  (hl)
WRA1:DE8F 32               ldd  (hl),a
WRA1:DE90 2A               ldi  a,(hl)
WRA1:DE91 11 E3 50         ld   de,50E3
WRA1:DE94 44               ld   b,h
WRA1:DE95 CD C6 DE         call DEC6
WRA1:DE98 45               ld   b,l
WRA1:DE99 50               ld   d,b
WRA1:DE9A CD C6 DE         call DEC6
WRA1:DE9D 1C               inc  e
WRA1:DE9E 46               ld   b,(hl)
WRA1:DE9F 50               ld   d,b
WRA1:DEA0 CD C6 DE         call DEC6
WRA1:DEA3 CD 50 50         call 5050
WRA1:DEA6 B3               or   e
WRA1:DEA7 B3               or   e
WRA1:DEA8 0E 0F            ld   c,0F
WRA1:DEAA 07               rlca 
WRA1:DEAB 50               ld   d,b
WRA1:DEAC 0F               rrca 
WRA1:DEAD D2 B2 DE         jp   nc,DEB2
WRA1:DEB0 34               inc  (hl)
WRA1:DEB1 50               ld   d,b
WRA1:DEB2 0F               rrca 
WRA1:DEB3 DA 90 DE         jp   c,DE90
WRA1:DEB6 0F               rrca 
WRA1:DEB7 50               ld   d,b
WRA1:DEB8 D2 BC DE         jp   nc,DEBC
WRA1:DEBB 2B               dec  hl
WRA1:DEBC 0F               rrca 
WRA1:DEBD 50               ld   d,b
WRA1:DEBE DA 2C D6         jp   c,D62C
WRA1:DEC1 0F               rrca 
WRA1:DEC2 D8               ret  c
WRA1:DEC3 50               ld   d,b
WRA1:DEC4 30 B2            jr   nc,DE78
WRA1:DEC6 C5               push bc
WRA1:DEC7 CB 30            swap b
WRA1:DEC9 50               ld   d,b
WRA1:DECA CD D0 DE         call DED0
WRA1:DECD C1               pop  bc
WRA1:DECE 50               ld   d,b
WRA1:DECF 50               ld   d,b
WRA1:DED0 3E 0F            ld   a,0F
WRA1:DED2 A0               and  b
WRA1:DED3 06 C3            ld   b,C3
WRA1:DED5 50               ld   d,b
WRA1:DED6 D6 0A            sub  a,0A
WRA1:DED8 DA DE DE         jp   c,DEDE
WRA1:DEDB 50               ld   d,b
WRA1:DEDC D6 A0            sub  a,A0
WRA1:DEDE 1C               inc  e
WRA1:DEDF 12               ld   (de),a
WRA1:DEE0 C9               ret  
WRA1:DEE1 50               ld   d,b

D983:
00 01 E3 D5 C3 48 DE

DE64:
26 DE 2E A6 AF 50
D6 10 32 D6 B8 50
32 D6 ?? 32 C5 50
E1 AF 0F 30 07 50
3E 10 C3 8E DE 50
0F 30 06 9F 91 50
C3 8E DE 0F 9F 50
86 32 2A 11 E3 50
44 CD C6 DE 45 50
CD C6 DE 1C 46 50
CD C6 DE CD 50 50
B3 B3 0E 0F 07 50
0F D2 B2 DE 34 50
0F DA 90 DE 0F 50
D2 BC DE 2B 0F 50
DA 2C D6 0F D8 50
30 B2 C5 CB 30 50
CD D0 DE C1 50 50
3E 0F A0 06 C3 50
D6 0A DA DE DE 50
D6 A0 1C 12 C9 50

The above-mentioned simplified RAM Writer program assumes that the contents from address DE48 to DE63 are filled with 00. When executing on existing save data, it is set up to jump to address DEE2 with a jp instruction and then jump to DE64 with a jr instruction.

WRA1:D983 00               nop
WRA1:D984 01 E3 D5         ld   bc,D5E3
WRA1:D987 C3 E2 DE         jp   DEE2

WRA1:DE64 26 DE            ld   h,DE
WRA1:DE66 2E A6            ld   l,A6
WRA1:DE68 AF               xor  a
WRA1:DE69 50               ld   d,b
WRA1:DE6A D6 10            sub  a,10
WRA1:DE6C 32               ldd  (hl),a
WRA1:DE6D D6 B8            sub  a,B8
WRA1:DE6F 50               ld   d,b
WRA1:DE70 32               ldd  (hl),a
WRA1:DE71 D6 ??            sub  a,??
WRA1:DE73 32               ldd  (hl),a
WRA1:DE74 C5               push bc
WRA1:DE75 50               ld   d,b
WRA1:DE76 E1               pop  hl
WRA1:DE77 AF               xor  a
WRA1:DE78 0F               rrca 
WRA1:DE79 30 07            jr   nc,DE82
WRA1:DE7B 50               ld   d,b
WRA1:DE7C 3E 10            ld   a,10
WRA1:DE7E C3 8E DE         jp   DE8E
WRA1:DE81 50               ld   d,b
WRA1:DE82 0F               rrca 
WRA1:DE83 30 06            jr   nc,DE8B
WRA1:DE85 9F               sbc  a
WRA1:DE86 91               sub  c
WRA1:DE87 50               ld   d,b
WRA1:DE88 C3 8E DE         jp   DE8E
WRA1:DE8B 0F               rrca 
WRA1:DE8C 9F               sbc  a
WRA1:DE8D 50               ld   d,b
WRA1:DE8E 86               add  (hl)
WRA1:DE8F 32               ldd  (hl),a
WRA1:DE90 2A               ldi  a,(hl)
WRA1:DE91 11 E3 50         ld   de,50E3
WRA1:DE94 44               ld   b,h
WRA1:DE95 CD C6 DE         call DEC6
WRA1:DE98 45               ld   b,l
WRA1:DE99 50               ld   d,b
WRA1:DE9A CD C6 DE         call DEC6
WRA1:DE9D 1C               inc  e
WRA1:DE9E 46               ld   b,(hl)
WRA1:DE9F 50               ld   d,b
WRA1:DEA0 CD C6 DE         call DEC6
WRA1:DEA3 CD 50 50         call 5050
WRA1:DEA6 B3               or   e
WRA1:DEA7 B3               or   e
WRA1:DEA8 0E 0F            ld   c,0F
WRA1:DEAA 07               rlca 
WRA1:DEAB 50               ld   d,b
WRA1:DEAC 0F               rrca 
WRA1:DEAD D2 B2 DE         jp   nc,DEB2
WRA1:DEB0 34               inc  (hl)
WRA1:DEB1 50               ld   d,b
WRA1:DEB2 0F               rrca 
WRA1:DEB3 DA 90 DE         jp   c,DE90
WRA1:DEB6 0F               rrca 
WRA1:DEB7 50               ld   d,b
WRA1:DEB8 D2 BC DE         jp   nc,DEBC
WRA1:DEBB 2B               dec  hl
WRA1:DEBC 0F               rrca 
WRA1:DEBD 50               ld   d,b
WRA1:DEBE DA 2C D6         jp   c,D62C
WRA1:DEC1 0F               rrca 
WRA1:DEC2 D8               ret  c
WRA1:DEC3 50               ld   d,b
WRA1:DEC4 30 B2            jr   nc,DE78
WRA1:DEC6 C5               push bc
WRA1:DEC7 CB 30            swap b
WRA1:DEC9 50               ld   d,b
WRA1:DECA CD D0 DE         call DED0
WRA1:DECD C1               pop  bc
WRA1:DECE A7               and  a
WRA1:DECF 50               ld   d,b
WRA1:DED0 3E 0F            ld   a,0F
WRA1:DED2 A0               and  b
WRA1:DED3 06 C3            ld   b,C3
WRA1:DED5 50               ld   d,b
WRA1:DED6 D6 0A            sub  a,0A
WRA1:DED8 DA DE DE         jp   c,DEDE
WRA1:DEDB 50               ld   d,b
WRA1:DEDC D6 A0            sub  a,A0
WRA1:DEDE 1C               inc  e
WRA1:DEDF 12               ld   (de),a
WRA1:DEE0 C9               ret  
WRA1:DEE1 50               ld   d,b
WRA1:DEE2 30 80            jr   nc,DE64

D983:
00 01 E3 D5 C3 E2 DE

DE64:
26 DE 2E A6 AF 50
D6 10 32 D6 B8 50
32 D6 ?? 32 C5 50
E1 AF 0F 30 07 50
3E 10 C3 8E DE 50
0F 30 06 9F 91 50
C3 8E DE 0F 9F 50
86 32 2A 11 E3 50
44 CD C6 DE 45 50
CD C6 DE 1C 46 50
CD C6 DE CD 50 50
B3 B3 0E 0F 07 50
0F D2 B2 DE 34 50
0F DA 90 DE 0F 50
D2 BC DE 2B 0F 50
DA 2C D6 0F D8 50
30 B2 C5 CB 30 50
CD D0 DE C1 A7 50
3E 0F A0 06 C3 50
D6 0A DA DE DE 50
D6 A0 1C 12 C9 50
30 80 50

The RAM Writer is a program that outputs 18 addresses including the address pointed to by the hl register and their contents. Executing address D62C enables the RAM Writer to be launched. The 134 bytes from address D5E9 to D66E are unused areas, and the RAM Writer program is written in this area.

The content of address D5EA is 79 in the Red/Green v1.0, 67 in the Red/Green v1.1(VC), and 8F in the Blue version.

WRA1:D5E9 CD ?? 38         call 38??
WRA1:D5EC F0 B3            ld   a,(ff00+B3)
WRA1:D5EE 01 01 00         ld   bc,0001
WRA1:D5F1 07               rlca 
WRA1:D5F2 38 18            jr   c,D60C
WRA1:D5F4 0B               dec  bc
WRA1:D5F5 0B               dec  bc
WRA1:D5F6 07               rlca 
WRA1:D5F7 38 13            jr   c,D60C
WRA1:D5F9 0E F0            ld   c,F0
WRA1:D5FB 07               rlca 
WRA1:D5FC 38 0E            jr   c,D60C
WRA1:D5FE 01 10 00         ld   bc,0010
WRA1:D601 07               rlca 
WRA1:D602 38 08            jr   c,D60C
WRA1:D604 07               rlca 
WRA1:D605 38 03            jr   c,D60A
WRA1:D607 07               rlca 
WRA1:D608 D0               ret  nc
WRA1:D609 E9               jp   hl
WRA1:D60A E1               pop  hl
WRA1:D60B C9               ret  
WRA1:D60C 79               ld   a,c
WRA1:D60D CB 43            bit  0,e
WRA1:D60F 20 06            jr   nz,D617
WRA1:D611 CB 4B            bit  1,e
WRA1:D613 20 05            jr   nz,D61A
WRA1:D615 09               add  hl,bc
WRA1:D616 C9               ret  
WRA1:D617 86               add  (hl)
WRA1:D618 77               ld   (hl),a
WRA1:D619 C9               ret  
WRA1:D61A 84               add  h
WRA1:D61B 67               ld   h,a
WRA1:D61C C9               ret  
WRA1:D61D F5               push af
WRA1:D61E CB 37            swap a
WRA1:D620 CD 24 D6         call D624
WRA1:D623 F1               pop  af
WRA1:D624 E6 0F            and  a,0F
WRA1:D626 C6 F6            add  a,F6
WRA1:D628 F6 60            or   a,60
WRA1:D62A 22               ldi  (hl),a
WRA1:D62B C9               ret  
WRA1:D62C 21 00 D0         ld   hl,D000
WRA1:D62F CD E9 D5         call D5E9
WRA1:D632 E5               push hl
WRA1:D633 11 F8 FF         ld   de,FFF8
WRA1:D636 19               add  hl,de
WRA1:D637 E5               push hl
WRA1:D638 D1               pop  de
WRA1:D639 21 AB C3         ld   hl,C3AB
WRA1:D63C 01 0C 00         ld   bc,000C
WRA1:D63F 36 7C            ld   (hl),7C
WRA1:D641 23               inc  hl
WRA1:D642 7A               ld   a,d
WRA1:D643 CD 1D D6         call D61D
WRA1:D646 7B               ld   a,e
WRA1:D647 CD 1D D6         call D61D
WRA1:D64A 36 7F            ld   (hl),7F
WRA1:D64C 23               inc  hl
WRA1:D64D 1A               ld   a,(de)
WRA1:D64E CD 1D D6         call D61D
WRA1:D651 13               inc  de
WRA1:D652 36 7C            ld   (hl),7C
WRA1:D654 09               add  hl,bc
WRA1:D655 7C               ld   a,h
WRA1:D656 FE C5            cp   a,C5
WRA1:D658 20 E5            jr   nz,D63F
WRA1:D65A 3E ED            ld   a,ED
WRA1:D65C EA 4B C4         ld   (C44B),a
WRA1:D65F E1               pop  hl
WRA1:D660 18 CD            jr   D62F

WRA1:D983 00               nop
WRA1:D984 00               nop
WRA1:D985 00               nop
WRA1:D986 00               nop
WRA1:D987 C3 2C D6         jp   D62C

                           CD ?? 38 F0 B3 01 01
00 07 38 18 0B 0B 07 38 13 0E F0 07 38 0E 01 10
00 07 38 08 07 38 03 07 D0 E9 E1 C9 79 CB 43 20
06 CB 4B 20 05 09 C9 86 77 C9 84 67 C9 F5 CB 37
CD 24 D6 F1 E6 0F C6 F6 F6 60 22 C9 21 00 D0 CD
E9 D5 E5 11 F8 FF 19 E5 D1 21 AB C3 01 0C 00 36
7C 23 7A CD 1D D6 7B CD 1D D6 36 7F 23 1A CD 1D
D6 13 36 7C 09 7C FE C5 20 E5 3E ED EA 4B C4 E1
18 CD

ChooseRivalName is directly called. However, after calling it, the player's sprite becomes a Pokémon icon and the map display is corrupted, so ReloadMapData and RestoreScreenTilesAndReloadTilePatterns are also called.

Red v1.0

WRA1:DA00 3E 01            ld   a,01
WRA1:DA02 21 2D 69         ld   hl,692D
WRA1:DA05 CD 20 36         call 3620
WRA1:DA08 CD 86 1B         call 1B86
WRA1:DA0B C3 EE 3D         jp   3DEE

Green v1.0

WRA1:DA00 3E 01            ld   a,01
WRA1:DA02 21 2E 69         ld   hl,692E
WRA1:DA05 CD 20 36         call 3620
WRA1:DA08 CD 86 1B         call 1B86
WRA1:DA0B C3 EE 3D         jp   3DEE

Red v1.1(VC)

WRA1:DA00 3E 01            ld   a,01
WRA1:DA02 21 D2 68         ld   hl,68D2
WRA1:DA05 CD 0E 36         call 360E
WRA1:DA08 CD 74 1B         call 1B74
WRA1:DA0B C3 DC 3D         jp   3DDC

Green v1.1(VC)

WRA1:DA00 3E 01            ld   a,01
WRA1:DA02 21 D3 68         ld   hl,68D3
WRA1:DA05 CD 0E 36         call 360E
WRA1:DA08 CD 74 1B         call 1B74
WRA1:DA0B C3 DC 3D         jp   3DDC

Blue version

WRA1:DA00 3E 01            ld   a,01
WRA1:DA02 21 40 6A         ld   hl,6A40
WRA1:DA05 CD 36 36         call 3636
WRA1:DA08 CD CF 30         call 30CF
WRA1:DA0B C3 02 3E         jp   3E02

Red/Green v1.0

3E 01 21 2E 69 CD 20 36 CD 86 1B C3 EE 3D

Red/Green v1.1(VC)

3E 01 21 D2 68 CD 0E 36 CD 74 1B C3 DC 3D

Blue

3E 01 21 40 6A CD 36 36 CD CF 30 C3 02 3E

For the remaining information, a program is written to achieve the following:

• Lower the 5th bit of address D52D to clear the Eevee acquisition flag.
• Temporarily empty the party by setting the content of address D123 to 00 and the content of address D124 to FF.
• GivePokemon using address D696, which stores the internal number of the first Pokémon.

The content of address D013 is 78 in the Red/Green v1.0, 66 in the Red/Green v1.1(VC), and 8C in the Blue version.

WRA1:D000 21 2D D5         ld   hl,D52D
WRA1:D003 CB AE            res  5,(hl)
WRA1:D005 AF               xor  a
WRA1:D006 21 23 D1         ld   hl,D123
WRA1:D009 22               ldi  (hl),a
WRA1:D00A 3D               dec  a
WRA1:D00B 77               ld   (hl),a
WRA1:D00C FA 96 D6         ld   a,(D696)
WRA1:D00F 47               ld   b,a
WRA1:D010 0E 05            ld   c,05
WRA1:D012 C3 ?? 3E         jp   3E??

21 2D D5 CB AE AF 21 23 D1 22 3D 77 FA 96 D6 47
0E 05 C3 ?? 3E

【初代ポケモン】なかよしバッヂ導入チャート【任意コード実行】 - Wonderland Seeker

なかよしバッヂ（初代ポケモンにおける任意コード実行）を入手および理解するまでのチャート。

https://alice-wreath.hatenablog.com

どこかしらドアを解明してみた - Wonderland Seeker

どうも、バグポケ投稿者のありす*です。 なんでも、2021/10/25にガナヒビ様の動画においてこちらの記事が参考にされたようで、久しぶりに自分で読み返したところ気になっていた箇所が残っていたので追記・編集をしてみました。(2021/10/27) では、【どこかしらドア】についての解説をしましょう。 ググれば、ポケモンの裏技サイトが出てくるしバグをよくしているトレーナーなら使ったこともあるかと思うくらいにはメジャーなバグ技のひとつです。 このなかよしバッヂ導入チャートでも使っていますね。 このドアを使った方は歩数を変えながらどこにワープできるのか試した方もいることでしょう。 しかし、なぜワープ…

https://alice-wreath.hatenablog.com

13番目セレクトバグ---鞄は13で出来ている。アンリミテッドアイテムワークス--- - Wonderland Seeker

今回取り上げるのはいわゆる13番目セレクトバグと呼ばれる、どうぐ欄のやめるよりも下にスクロールすることができるわざの仕組みについてです。 なかよしバッヂを導入する際にも活用していますね。 該当記事においても 13番目のポケモンのニックネームで管理していた20という枠が 【ーーーぐー】というニックネームになったことで外れたわけです 3文字目の文字でどうぐの枠を管理しているのですが”ー”は文字コード227なので 制御文字である終端のコードである50まで枠が増えた(ものと思います) と記していましたが、もう少しかみくだく話をしましょうか。 まず13番目のポケモンはRAM領域のD250～で管理されてい…

https://alice-wreath.hatenablog.com

【初代ポケモン】お手軽20分。バイナリエディタ作成チャート解説【バグ技 任意コード実行】

世間がSV発売で盛り上がってる中、相変わらず26年前のポケモンの研究をしてるやつがいるらしい。※動画23:40あたりに「ずかんをもらう」の表記に誤りがありました。正しくはアドレス「D6CA」を「AF」に変更です。※バイナリエディタ完成後にボックス1をいじるとバイナリエディタが壊れてしまうので、ボックスを使用したい…

https://www.youtube.com

【初代ポケモン】初心者必見！5列バイナリエディタ導入チャート　任意コード実行

サファリゾーンでボールを投げたり、そだてやを利用したりするとなかよしバッヂが使えなくなることがありますサファリゾーンに入ってボールを投げてしまったらもう一度入りなおしてすぐ出てくださいそだてやを利用してしまったら「イ゛え゜てEん」をそだてやに預けてすぐに引き出して下さい11:05　青版のニックネームは「空なゅへタ…

https://www.youtube.com

Custom maps - Glitch City Wiki

Using arbitrary code execution and mass memory editing of the RAM, it is possible to create custom maps in the Pokémon games.

https://glitchcity.wiki

Dry underflow glitch - Glitch City Wiki

Dry underflow glitch is a glitch in Pokémon Red, Blue, and Yellow and a major sub-glitch of having a x255 item stack. Similar to the item underflow glitch (event…

https://glitchcity.wiki

Dokokashira door glitch - Glitch City Wiki

https://glitchcity.wiki

Guides:SRAM Glitch ACE Setups (EN) - Glitch City Wiki

https://glitchcity.wiki