🐾 flag3

This is a translation of the original article:

📄ポケットモンスター ピカチュウ バイナリエディタ

It was mostly processed by Claude 3 Opus.

The RAM Writer is the ultimate arbitrary code execution tool for first generation Pokémon games. With this writer, you can read and write any value to any memory address. You can even write and execute entire programs, making it a very powerful tool that even allows you to install and play games like Tetris and Reversi.

This article serves as an accompanying guide for the following video.

This guide only works with the Japanese versions of Pokémon Yellow. It does not work with Pokémon Red, Green, Blue, or non-Japanese versions. This guide assumes that you are starting a new game and using the SRAM Glitch, which involves performing a hard reset at some point during the save. Please see the following article for information on installing RAM Writer in the Japanese versions of Pokémon Red, Green, and Blue.

📄RAM Writer in Pokémon Red/Green/Blue (JP)

Pokémon Yellow has v1.0, v1.1, v1.2, and v1.3.

• If the engraving on the lower right corner of the cartridge's surface package seal contains only numbers or numbers + A, it is v1.0.
• If it contains numbers + B, it is v1.1.
• If it contains numbers + C, it is v1.2.
• If it contains numbers + D, it is v1.3.

Note that the VC release uses the v1.3 release.

In the following step 2,

• If the 25th item is "ぬ゙のづ", it can also be identified as v1.1, v1.2, or v1.3.
• If not, it is v1.0.

This installation procedure has no differences between v1.1, v1.2, and v1.3.

1. Clear all saved data by pressing ↑ + B + SELECT on the title screen
2. Set the player's name to "がんョぜメ" and the rival's name to "てんんオオ".
3. Press the Start button to open the menu and select "レポート" (Save).
4. Press "はい" (Yes) when asked if you want to save, and power off or hard reset at a very precise moment.
   • A soft reset by pressing A + B + START + SELECT will not work.
   • The timing to power off or hard reset is after the "はい/いいえ" (Yes/No) display disappears but before the text changes to "ポケモンレポートにかきこんでいます".
     • The window to successfully perform this glitch is only 4 frames, which occurs 31-34 frames after pressing "はい".
5. If you can continue the game and open your party Pokémon, the SRAM Glitch has been successful. If not, start over from step 1.

• Open your party Pokémon and swap the 1st Pokémon with the 9th Pokémon. This will set the number of items held to 255.
• Open the settings and set them as follows:
  ⚙

  はなしのはやさ：おそい (Text speed: Slow)

  せんとうアニメ：じっくりみる (Battle animations: On)

  しあいのルール：かちぬきタイプ (Battle style: Set)

  サウンド：イヤホン２ (Sound: Head phone 2)

• Exit the house. This will lead you to the Celadon Mansion Rooftop.

1. Obtain Eevee, a nickname "ヅずゆデの", and use the はやぶさバッヂ. This will cause Eevee's Poké Ball to reappear.
2. Obtain Eevee, a nickname "ゴづ", and use the はやぶさバッヂ. This will cause Eevee's Poké Ball to reappear once more.
3. Obtain Eevee, a nickname "がやぜカ", and use the はやぶさバッヂ. This will allow you to obtain as many Eevee as you like.

Obtain Eevee and nickname them in the following order:

After nicknaming Eevee, using the はやぶさバッヂ will start the simplified RAM Writer.

From now on, using the はやぶさバッヂ should start the simplified RAM Writer each time.

D5E3 on the left is the memory address you are trying to write to, and 00 on the right is the current value at that address.

Use the simplified RAM Writer to input the RAM Writer program. When you are finished inputting, press the Select button to start the RAM Writer. It is recommended that you close the simplified RAM Writer and save the game before starting the full RAM Writer.

From now on, starting the simplified RAM Writer and pressing the Select button should start the RAM Writer each time.

By making the following changes using the RAM Writer, you can make it so that using the はやぶさバッヂ directly starts the RAM Writer.

Various side effects have occurred due to the RAM Writer installation.

• Current location
• Player's name
• Rival's name
• Party Pokémon information
• Pokédex
• Bag
• Eevee acquisition flag
• PC Box
• PC item (v1.1-v1.3 (VC))

By setting the contents of addresses D330, D331, D334, and D335 to 00 in the Celadon Mansion Rooftop and then leaving the room, you will exit out to Pallet Town.

Use the RAM Writer to change the contents of addresses D000 to D00D as follows:

After the change, place the cursor on address D000 and press the Select button to choose the player’s or rival’s name. To change both the player's and the rival's name, modify D003 and execute again.

Use the RAM Writer to change the contents of addresses D010 to D02E as follows:

After the change, place the cursor on address D010 and press the Select button to execute the program. This program also has the following effects:

• Sets the number of party Pokémon to 0.
• Initializes the Pokédex information.
• Set the Bag to contain only the はやぶさバッヂ.
• Allows you to obtain Eevee again.

By setting the content of address D9B2 to 00 and the content of address D9B3 to FF, you can set the number of Pokémon deposited in the PC Box to 0. However, for v1.0, it is recommended to leave the Pokémon in the PC Box as is without setting it to 0.

By setting addresses D4B9 to D4C9 as follows, you can normalize the information of items stored in the PC. Do not withdraw the 1st to 11th items.

0B C9 01 CA 01 CB 01 CC 01 CD 01 CE 01 CF 01 D0 01

Regardless of the version, do not edit addresses D5E9-D661 with the RAM Writer.

When you press ↑+B+SELECT on the title screen to clear the saved data, the SRAM data is filled with FF. After that, if you power off at a specific time when saving after starting a new game, the contents from address D123 to D27A, which correspond to the party Pokémon data, will be filled with FF. Address D123 stores the number of party Pokémon, and by filling it with FF, you can set the number of party Pokémon to 255.

After the SRAM Glitch, by swapping the 1st Pokémon with the 9th Pokémon, you can set the number of items held to 255. The addresses corresponding to the status of the 9th Pokémon are D28B to D2B6, and the addresses corresponding to the nickname of the 9th Pokémon are D287 to D28C. By swapping the 1st Pokémon with the 9th Pokémon, you can fill the contents from address D287 to D2B6 with FF. Address D2A1 stores the number of items held, and by filling it with FF, you can set the number of items held to 255.

Using the はやぶさバッヂ jumps to address DDCA in v1.0 and address D4CA in v1.1-v1.3 (VC). Address DDCA stores the 3rd character of the original trainer name of the 5th Pokémon in the PC Box, and address D4CA stores the item ID of the 9th item stored in the PC. After installing the RAM Writer, by fixing the Pokémon in the PC Box or the items stored in the PC, you can prevent these addresses from changing.

The Bag manipulation performs the following common to all versions:

• Swap the 14th to 20th items with the 26th item, the はやぶさバッヂ.
• Swap the 25th item with the 34th item.

The addresses corresponding to the 25th, 26th, and 34th items are as follows:

Swapping the 14th to 20th items with the 26th item, the はやぶさバッヂ, aims to obtain the はやぶさバッヂ and maximize the text speed. Address D2D4 stores option-related information, and if you follow the steps for the settings, the 26th item will be the はやぶさバッヂ. Also, bits 0-3 of address D2D4 correspond to the number of frames to delay after displaying text. Swapping the 14th to 20th items with the 26th item sets bits 0-3 of address D2D4 to 0, minimizing the number of frames to delay after displaying text.

Swapping the 25th item with the 34th item aims to set the house exit to the Celadon Mansion Rooftop. Address D2E4 stores the internal number of the previous map. On the other hand, addresses D2D2 and D2D3 store the 5th character and terminator of the rival's name, respectively. Therefore, by adjusting the 5th character of the rival's name, you can change the destination. Since the internal number of the Celadon Mansion Rooftop is 84, the 5th character of the rival's name is set to "オ", which corresponds to 84, to move to the Celadon Mansion Rooftop.

For v1.1-v1.3 (VC), the following additional steps are performed during the item manipulation:

• Deposit 1 やめる (CANCEL).
• Deposit the カードキー (Card Key) 6 times.
• Deposit 1 ポケモン.
• Deposit 1 わざマシン22 (TM22).

These operations aim to set the 9th item stored in the PC to ポケモン × 1 and the 10th item to わざマシン22 (TM22). The addresses corresponding to the 9th and 10th items stored in the PC are as follows. By performing the above operations, the content of address D4CA is set to C3, the content of address D4CB is set to 01, and the content of address D4CC is set to DE. This allows the instruction C3 01 DE to be executed when executing address D4CA with the はやぶさバッヂ, which jumps to address DE01.

The addresses corresponding to the 22nd to 24th items in the Bag are as follows. The reason the 22nd item is the Card Key is because address D2CC contains 30, the internal number of the Card Key, which originates from the initial money being 3000 yen. Addresses D2CE to D2D1, corresponding to the 23rd and 24th items in the Bag, correspond to the 1st to 4th characters of the rival's name. To set D4CA onward to C3 01 DE with the above operations, the 1st character of the rival's name is set to "て" and the 3rd character is set to "ん".

By changing the content of address D54D from 02, you can change the object that disappears when obtaining Eevee. Also, by setting the 5th bit of address D52D to 0, you can make it possible to obtain Eevee again. When executing address DE64, the a register contains CA, the bc register contains 00C8, and the hl register contains DDCA for v1.0 and D4CA for v1.1-v1.3 (VC), so the effects of using the はやぶさバッヂ are as follows:

• 1st use of はやぶさバッヂ: Sets the content of address D52D to CA.
• 2nd use of はやぶさバッヂ (v1.0): Sets the content of address DE92 to CA and the content of address D52D to 14.
• 2nd use of はやぶさバッヂ (v1.1-v1.3 (VC)): Sets the content of address D592 to CA and the content of address D52D to 1F.
• 3rd use of はやぶさバッヂ: Sets the content of address D54D to 1E and the content of address D52D to CB.

WRA1:D4CA C3 01 DE         jp   DE01

WRA1:DE64 26 D4            ld   h,D4
WRA1:DE66 2E 85            ld   l,85
WRA1:DE68 50               ld   d,b
WRA1:DE69 AC               xor  h
WRA1:DE6A 09               add  hl,bc
WRA1:DE6B 32               ldd  (hl),a
WRA1:DE6C 50               ld   d,b
WRA1:DE6D BB               cp   e
WRA1:DE6E 19               add  hl,de
WRA1:DE6F AC               xor  h
WRA1:DE70 11 2D D5         ld   de,D52D
WRA1:DE73 12               ld   (de),a
WRA1:DE74 C9               ret  
WRA1:DE75 50               ld   d,b

26 D4 2E 85 50 AC
09 32 50 BB 19 AC
11 2D D5 12 C9 50

The simplified RAM Writer is a program that outputs the address pointed to by the hl register and its contents. It is set up to change the address pointed to by the hl register and its contents based on key input. JoypadLowSensitivity is called to input the keys.

The content of address DE9D is BF in v1.0 and C0 in v1.1-v1.3 (VC).

WRA1:D4CA C3 01 DE         jp   DE01

WRA1:DDCA AF               xor  a

WRA1:DE01 2E A0            ld   l,A0

WRA1:DE34 26 DE            ld   h,DE
WRA1:DE36 AF               xor  a
WRA1:DE37 2E A0            ld   l,A0
WRA1:DE39 50               ld   d,b

WRA1:DE64 D6 10            sub  a,10
WRA1:DE66 32               ldd  (hl),a
WRA1:DE67 D6 B8            sub  a,B8
WRA1:DE69 50               ld   d,b
WRA1:DE6A 32               ldd  (hl),a
WRA1:DE6B CB BE            res  7,(hl)
WRA1:DE6D 26 D5            ld   h,D5
WRA1:DE6F 50               ld   d,b
WRA1:DE70 2E E3            ld   l,E3
WRA1:DE72 0F               rrca 
WRA1:DE73 30 07            jr   nc,DE7C
WRA1:DE75 50               ld   d,b
WRA1:DE76 3E 10            ld   a,10
WRA1:DE78 C3 88 DE         jp   DE88
WRA1:DE7B 50               ld   d,b
WRA1:DE7C 0F               rrca 
WRA1:DE7D 30 06            jr   nc,DE85
WRA1:DE7F 9F               sbc  a
WRA1:DE80 91               sub  c
WRA1:DE81 50               ld   d,b
WRA1:DE82 C3 88 DE         jp   DE88
WRA1:DE85 0F               rrca 
WRA1:DE86 9F               sbc  a
WRA1:DE87 50               ld   d,b
WRA1:DE88 86               add  (hl)
WRA1:DE89 32               ldd  (hl),a
WRA1:DE8A 2A               ldi  a,(hl)
WRA1:DE8B 11 E3 50         ld   de,50E3
WRA1:DE8E 44               ld   b,h
WRA1:DE8F CD C0 DE         call DEC0
WRA1:DE92 45               ld   b,l
WRA1:DE93 50               ld   d,b
WRA1:DE94 CD C0 DE         call DEC0
WRA1:DE97 1C               inc  e
WRA1:DE98 46               ld   b,(hl)
WRA1:DE99 50               ld   d,b
WRA1:DE9A CD C0 DE         call DEC0
WRA1:DE9D CD ?? 50         call 50??
WRA1:DEA0 B3               or   e
WRA1:DEA1 B3               or   e
WRA1:DEA2 0E 0F            ld   c,0F
WRA1:DEA4 07               rlca 
WRA1:DEA5 50               ld   d,b
WRA1:DEA6 0F               rrca 
WRA1:DEA7 D2 AC DE         jp   nc,DEAC
WRA1:DEAA 34               inc  (hl)
WRA1:DEAB 50               ld   d,b
WRA1:DEAC 0F               rrca 
WRA1:DEAD DA 8A DE         jp   c,DE8A
WRA1:DEB0 0F               rrca 
WRA1:DEB1 50               ld   d,b
WRA1:DEB2 D2 B6 DE         jp   nc,DEB6
WRA1:DEB5 2B               dec  hl
WRA1:DEB6 0F               rrca 
WRA1:DEB7 50               ld   d,b
WRA1:DEB8 DA 2C D6         jp   c,D62C
WRA1:DEBB 0F               rrca 
WRA1:DEBC D8               ret  c
WRA1:DEBD 50               ld   d,b
WRA1:DEBE 30 B2            jr   nc,DE72
WRA1:DEC0 C5               push bc
WRA1:DEC1 CB 30            swap b
WRA1:DEC3 50               ld   d,b
WRA1:DEC4 CD CA DE         call DECA
WRA1:DEC7 C1               pop  bc
WRA1:DEC8 50               ld   d,b
WRA1:DEC9 50               ld   d,b
WRA1:DECA 3E 0F            ld   a,0F
WRA1:DECC A0               and  b
WRA1:DECD 06 C3            ld   b,C3
WRA1:DECF 50               ld   d,b
WRA1:DED0 D6 0A            sub  a,0A
WRA1:DED2 DA D8 DE         jp   c,DED8
WRA1:DED5 50               ld   d,b
WRA1:DED6 D6 A0            sub  a,A0
WRA1:DED8 1C               inc  e
WRA1:DED9 12               ld   (de),a
WRA1:DEDA C9               ret  
WRA1:DEDB 50               ld   d,b

D4CA:
C3 01 DE

DDCA:
AF

DE01:
2E A0

DE34:
26 DE AF 2E A0 50

DE64:
D6 10 32 D6 B8 50
32 CB BE 26 D5 50
2E E3 0F 30 07 50
3E 10 C3 88 DE 50
0F 30 06 9F 91 50
C3 88 DE 0F 9F 50
86 32 2A 11 E3 50
44 CD C0 DE 45 50
CD C0 DE 1C 46 50
CD C0 DE CD ?? 50
B3 B3 0E 0F 07 50
0F D2 AC DE 34 50
0F DA 8A DE 0F 50
D2 B6 DE 2B 0F 50
DA 2C D6 0F D8 50
30 B2 C5 CB 30 50
CD CA DE C1 50 50
3E 0F A0 06 C3 50
D6 0A DA D8 DE 50
D6 A0 1C 12 C9 50

The RAM Writer program outputs 18 addresses including the address pointed to by the hl register and their contents. Executing address D62C enables the RAM Writer to be started. The 134 bytes from address D5E9 to D66E are unused areas, and the RAM Writer program is written in this area.

The content of address D5EA is 3F in v1.0 and 40 in v1.1-v1.3 (VC).

WRA1:D5E9 CD ?? 38         call 38??
WRA1:D5EC F0 B3            ld   a,(ff00+B3)
WRA1:D5EE 01 01 00         ld   bc,0001
WRA1:D5F1 07               rlca 
WRA1:D5F2 38 18            jr   c,D60C
WRA1:D5F4 0B               dec  bc
WRA1:D5F5 0B               dec  bc
WRA1:D5F6 07               rlca 
WRA1:D5F7 38 13            jr   c,D60C
WRA1:D5F9 0E F0            ld   c,F0
WRA1:D5FB 07               rlca 
WRA1:D5FC 38 0E            jr   c,D60C
WRA1:D5FE 01 10 00         ld   bc,0010
WRA1:D601 07               rlca 
WRA1:D602 38 08            jr   c,D60C
WRA1:D604 07               rlca 
WRA1:D605 38 03            jr   c,D60A
WRA1:D607 07               rlca 
WRA1:D608 D0               ret  nc
WRA1:D609 E9               jp   hl
WRA1:D60A E1               pop  hl
WRA1:D60B C9               ret  
WRA1:D60C 79               ld   a,c
WRA1:D60D CB 43            bit  0,e
WRA1:D60F 20 06            jr   nz,D617
WRA1:D611 CB 4B            bit  1,e
WRA1:D613 20 05            jr   nz,D61A
WRA1:D615 09               add  hl,bc
WRA1:D616 C9               ret  
WRA1:D617 86               add  (hl)
WRA1:D618 77               ld   (hl),a
WRA1:D619 C9               ret  
WRA1:D61A 84               add  h
WRA1:D61B 67               ld   h,a
WRA1:D61C C9               ret  
WRA1:D61D F5               push af
WRA1:D61E CB 37            swap a
WRA1:D620 CD 24 D6         call D624
WRA1:D623 F1               pop  af
WRA1:D624 E6 0F            and  a,0F
WRA1:D626 C6 F6            add  a,F6
WRA1:D628 F6 60            or   a,60
WRA1:D62A 22               ldi  (hl),a
WRA1:D62B C9               ret  
WRA1:D62C 21 00 D0         ld   hl,D000
WRA1:D62F CD E9 D5         call D5E9
WRA1:D632 E5               push hl
WRA1:D633 11 F8 FF         ld   de,FFF8
WRA1:D636 19               add  hl,de
WRA1:D637 E5               push hl
WRA1:D638 D1               pop  de
WRA1:D639 21 AB C3         ld   hl,C3AB
WRA1:D63C 01 0C 00         ld   bc,000C
WRA1:D63F 36 7C            ld   (hl),7C
WRA1:D641 23               inc  hl
WRA1:D642 7A               ld   a,d
WRA1:D643 CD 1D D6         call D61D
WRA1:D646 7B               ld   a,e
WRA1:D647 CD 1D D6         call D61D
WRA1:D64A 36 7F            ld   (hl),7F
WRA1:D64C 23               inc  hl
WRA1:D64D 1A               ld   a,(de)
WRA1:D64E CD 1D D6         call D61D
WRA1:D651 13               inc  de
WRA1:D652 36 7C            ld   (hl),7C
WRA1:D654 09               add  hl,bc
WRA1:D655 7C               ld   a,h
WRA1:D656 FE C5            cp   a,C5
WRA1:D658 20 E5            jr   nz,D63F
WRA1:D65A 3E ED            ld   a,ED
WRA1:D65C EA 4B C4         ld   (C44B),a
WRA1:D65F E1               pop  hl
WRA1:D660 18 CD            jr   D62F

                           CD ?? 38 F0 B3 01 01
00 07 38 18 0B 0B 07 38 13 0E F0 07 38 0E 01 10
00 07 38 08 07 38 03 07 D0 E9 E1 C9 79 CB 43 20
06 CB 4B 20 05 09 C9 86 77 C9 84 67 C9 F5 CB 37
CD 24 D6 F1 E6 0F C6 F6 F6 60 22 C9 21 00 D0 CD
E9 D5 E5 11 F8 FF 19 E5 D1 21 AB C3 01 0C 00 36
7C 23 7A CD 1D D6 7B CD 1D D6 36 7F 23 1A CD 1D
D6 13 36 7C 09 7C FE C5 20 E5 3E ED EA 4B C4 E1
18 CD

ChoosePlayerName and ChooseRivalName are directly called. However, after calling it, the player's sprite becomes a Pokémon icon and the map display is corrupted, so ReloadMapData and RestoreScreenTilesAndReloadTilePatterns are also called. The content of address D003 is 5F for changing the player's name and B3 for changing the rival's name.

v1.0

WRA1:D000 3E 01            ld   a,01
WRA1:D002 21 ?? 67         ld   hl,67??
WRA1:D005 CD 7D 3E         call 3E7D
WRA1:D008 CD FD 2F         call 2FFD
WRA1:D00B C3 CD 3D         jp   3DCD

v1.1-v1.3 (VC)

WRA1:D000 3E 01            ld   a,01
WRA1:D002 21 ?? 67         ld   hl,67??
WRA1:D005 CD 7E 3E         call 3E7E
WRA1:D008 CD 02 30         call 3002
WRA1:D00B C3 CE 3D         jp   3DCE

v1.0

3E 01 21 ?? 67 CD 7D 3E CD FD 2F C3 CD 3D

v1.1-v1.3 (VC)

3E 01 21 ?? 67 CD 7E 3E CD 02 30 C3 CE 3D

This program achieves the following:

• Sets the contents from addresses D123 and D125 to D2CB to 00 to initialize the information related to party Pokémon, Pokédex, and Bag.
• Sets the content of address CC36, which is wListScrollOffset, to 00 to set the scroll of the Bag to the top.
• Sets the content of address D592 to 00 to fix the effect of the second use of the はやぶさバッヂ.
• Sets the content of address D52D to 16 to initialize the flag related to obtaining Eevee.
• Obtains the はやぶさバッヂ using GiveItem and sets the Bag to only contain the はやぶさバッヂ.

WRA1:D010 01 A6 01         ld   bc,01A6
WRA1:D013 21 CA D2         ld   hl,D2CA
WRA1:D016 AF               xor  a
WRA1:D017 32               ldd  (hl),a
WRA1:D018 0B               dec  bc
WRA1:D019 78               ld   a,b
WRA1:D01A B1               or   c
WRA1:D01B 20 F9            jr   nz,D016
WRA1:D01D 2B               dec  hl
WRA1:D01E 77               ld   (hl),a
WRA1:D01F EA 36 CC         ld   (CC36),a
WRA1:D022 EA 92 D5         ld   (D592),a
WRA1:D025 3E 16            ld   a,16
WRA1:D027 EA 2D D5         ld   (D52D),a
WRA1:D02A 06 65            ld   b,65
WRA1:D02C C3 38 3E         jp   3E38

01 A6 01 21 CA D2 AF 32 0B 78 B1 20 F9 2B 77 EA 
36 CC EA 92 D5 3E 16 EA 2D D5 06 65 C3 38 3E

レポートバグ(SRAM glitch) (初代) - まへっちのポケモンメモ

はじめに 初代ポケモンには、メニューからレポートを書く際に特定のタイミングで強制リセット*1をすると、手持ちデータのみセーブされていない状態で続きから始めることができます。 手順は以下のとおりです[1]。 メニューを開き、レポートを書くかどうかの確認画面まで進む(「ここまでの かつやくを～」というメッセージが表示されるところまで)。 以下のタイミングで強制リセットをする。 赤緑青版では、「～かきのこした！」が出た直後*2 ピカチュウ版では、「はい」を押してから約0.5秒後 強制リセットのタイミングが適切であれば、レポートバグが成功する。適切でなかった場合は、セーブされない・レポートが壊れる・正…

https://mahetti-poke.hatenablog.com

Guides:SRAM Glitch ACE Setups (EN Yellow) - Glitch City Wiki

https://glitchcity.wiki

SRAM glitch - Glitch City Wiki

The SRAM glitch, also known as the save corruption glitch or the save abuse glitch, is a method of performing a partial save in Pokémon Red, Blue, and Yellow with…

https://glitchcity.wiki

User:TimoVM/JP Pikachu ACE Translation - Glitch City Wiki

This page is based on a translation/analysis of an ACE setup used in the Japanese version of Pokémon Yellow. The original article was written by flag3833753 and…

https://glitchcity.wiki