1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
|
/*
* Example Gen3-multiboot payload by slipstream/RoL 2017.
*
* This software may be modified and distributed under the terms
* of the MIT license. See the LICENSE file for details.
*
* main.c: setup, call payload, return gracefully back to game
*/
#include <gba.h>
#include "payload.h"
void call_into_middle_of_titlescreen_func(u32 addr,u32 stackspace);
int main(void) {
// check the ROM code, make sure this game is supported.
u8* ROM = (u8*) 0x8000000;
u32 gamecode = (*(u32*)(&ROM[0xAC]));
void(*loadsave)(char a1);
void(*mainloop)();
pSaveBlock1 gSaveBlock1;
pSaveBlock2 gSaveBlock2;
pSaveBlock3 gSaveBlock3;
u32 titlemid = 0;
// get the address of the save loading function.
switch (gamecode) {
// --- R/S ---
case 'DVXA': // Ruby German
case 'DPXA': // Sapphire German
// TODO: detect debug ROM?
gSaveBlock1 = (pSaveBlock1) 0x2025734;
gSaveBlock2 = (pSaveBlock2) 0x2024EA4;
gSaveBlock3 = (pSaveBlock3) 0x20300A0;
loadsave = (void(*)(char)) 0x8126249; // same for v1.0 + v1.1
mainloop = (void(*)()) 0x80003D9;
break;
case 'FVXA': // Ruby French
case 'FPXA': // Sapphire French
gSaveBlock1 = (pSaveBlock1) 0x2025734;
gSaveBlock2 = (pSaveBlock2) 0x2024EA4;
gSaveBlock3 = (pSaveBlock3) 0x20300A0;
loadsave = (void(*)(char)) 0x8126351; // same for v1.0 + v1.1
mainloop = (void(*)()) 0x80003D9;
break;
case 'IVXA': // Ruby Italian
case 'IPXA': // Sapphire Italian
gSaveBlock1 = (pSaveBlock1) 0x2025734;
gSaveBlock2 = (pSaveBlock2) 0x2024EA4;
gSaveBlock3 = (pSaveBlock3) 0x20300A0;
loadsave = (void(*)(char)) 0x8126249; // same for v1.0 + v1.1
mainloop = (void(*)()) 0x80003D9;
break;
case 'SVXA': // Ruby Spanish
case 'SPXA': // Sapphire Spanish
gSaveBlock1 = (pSaveBlock1) 0x2025734;
gSaveBlock2 = (pSaveBlock2) 0x2024EA4;
gSaveBlock3 = (pSaveBlock3) 0x20300A0;
loadsave = (void(*)(char)) 0x8126349; // same for v1.0 + v1.1
mainloop = (void(*)()) 0x80003D9;
break;
case 'EVXA': // Ruby English
case 'EPXA': // Sapphire English
gSaveBlock1 = (pSaveBlock1) 0x2025734;
gSaveBlock2 = (pSaveBlock2) 0x2024EA4;
gSaveBlock3 = (pSaveBlock3) 0x20300A0;
mainloop = (void(*)()) 0x80002A5;
switch (ROM[0xBC]) { // version number
case 0:
loadsave = (void(*)(char)) 0x8125EC9;
break;
case 1:
case 2:
loadsave = (void(*)(char)) 0x8125EE9;
break;
default:
return 0; // unsupported version
}
break;
case 'JVXA': // Ruby Japanese
case 'JPXA': // Sapphire Japanese
gSaveBlock1 = (pSaveBlock1) 0x2025494;
gSaveBlock2 = (pSaveBlock2) 0x2024C04;
gSaveBlock3 = (pSaveBlock3) 0x202FDBC;
loadsave = (void(*)(char)) 0x8120d05; // same for v1.0 + v1.1
mainloop = (void(*)()) 0x80002A9;
break;
/// --- FR/LG ---
// In FR/LG, the function that initialises the save-block pointers to default does not set up saveblock3.
// Which will need to be set up before loading the save if we want boxed Pokémon to not disappear.
// Oh, and loadsave() offset is different between FR and LG...
case 'DRPB': // FireRed German
case 'DGPB': // LeafGreen German
gSaveBlock1 = (pSaveBlock1) 0x202552C;
gSaveBlock2 = (pSaveBlock2) 0x2024588;
gSaveBlock3 = (pSaveBlock3) 0x2029314;
*(pSaveBlock3*)(0x3004f60) = gSaveBlock3;
loadsave = (void(*)(char)) ( (gamecode << 8) == 'RPB\x00' ? 0x80da721 : 0x80da6f5 );
mainloop = (void(*)()) 0x8000425;
titlemid = 0x80791df;
break;
case 'FRPB': // FireRed French
case 'FGPB': // LeafGreen French
gSaveBlock1 = (pSaveBlock1) 0x202552C;
gSaveBlock2 = (pSaveBlock2) 0x2024588;
gSaveBlock3 = (pSaveBlock3) 0x2029314;
*(pSaveBlock3*)(0x3004f60) = gSaveBlock3;
loadsave = (void(*)(char)) ( (gamecode << 8) == 'RPB\x00' ? 0x80da7e1 : 0x80da7b5 );
mainloop = (void(*)()) 0x8000417;
titlemid = 0x807929f;
break;
case 'IRPB': // FireRed Italian
case 'IGPB': // LeafGreen Italian
gSaveBlock1 = (pSaveBlock1) 0x202552C;
gSaveBlock2 = (pSaveBlock2) 0x2024588;
gSaveBlock3 = (pSaveBlock3) 0x2029314;
*(pSaveBlock3*)(0x3004f60) = gSaveBlock3;
loadsave = (void(*)(char)) ( (gamecode << 8) == 'RPB\x00' ? 0x80da721 : 0x80da6f5 );
mainloop = (void(*)()) 0x8000425;
titlemid = 0x80791cb;
break;
case 'SRPB': // FireRed Spanish
case 'SGPB': // LeafGreen Spanish
gSaveBlock1 = (pSaveBlock1) 0x202552C;
gSaveBlock2 = (pSaveBlock2) 0x2024588;
gSaveBlock3 = (pSaveBlock3) 0x2029314;
*(pSaveBlock3*)(0x3004f60) = gSaveBlock3;
loadsave = (void(*)(char)) ( (gamecode << 8) == 'RPB\x00' ? 0x80da809 : 0x80da7dd );
mainloop = (void(*)()) 0x8000417;
titlemid = 0x80792b3;
break;
case 'ERPB': // FireRed English
case 'EGPB': // LeafGreen English
gSaveBlock1 = (pSaveBlock1) 0x202552C;
gSaveBlock2 = (pSaveBlock2) 0x2024588;
gSaveBlock3 = (pSaveBlock3) 0x2029314;
*(pSaveBlock3*)(0x3005010) = gSaveBlock3;
switch (ROM[0xBC]) { // version number
case 0:
loadsave = (void(*)(char)) ( (gamecode << 8) == 'RPB\x00' ? 0x80da4fd : 0x80da4d1 );
mainloop = (void(*)()) 0x800041b;
titlemid = 0x807927b;
break;
case 1:
loadsave = (void(*)(char)) ( (gamecode << 8) == 'RPB\x00' ? 0x80da511 : 0x80da4e5 );
mainloop = (void(*)()) 0x8000429;
titlemid = 0x807928f;
break;
default:
return 0; // unsupported version
}
break;
case 'JRPB': // FireRed Japanese
case 'JGPB': // LeafGreen Japanese
gSaveBlock1 = (pSaveBlock1) 0x202548C;
gSaveBlock2 = (pSaveBlock2) 0x20244E8;
gSaveBlock3 = (pSaveBlock3) 0x202924C;
*(pSaveBlock3*)(0x3005050) = gSaveBlock3;
switch (ROM[0xBC]) { // version number
case 0:
loadsave = (void(*)(char)) ( (gamecode << 8) == 'RPB\x00' ? 0x80db4e5 : 0x80db4b9 );
mainloop = (void(*)()) 0x800041b;
titlemid = ( (gamecode << 8) == 'RPB\x00' ? 0x8078a0d : 0x8078a0f );
break;
case 1:
if ((gamecode << 8) == 'GPB\x00') {
// LeafGreen v1.1 Japanese is undumped.
// Therefore, it is unsupported.
// I will make guesses at the offsets in the comments, but I will not actually implement them until LeafGreen v1.1 is dumped.
return 0;
}
loadsave = (void(*)(char)) 0x80db529; // potential LG1.1 address: 0x80db4fd
mainloop = (void(*)()) 0x8000417;
titlemid = 0x8078987; // potential LG1.1 address: 0x8078989
break;
default:
return 0; // unsupported version
}
break;
/// --- Emerald ---
// In Emerald, the saveblock pointer that isn't set up is saveblock1 (in FR/LG it was saveblock3).
// The initial save loading code after the copyright screen is also updated, now it sets up ASLR/crypto here before loading the save.
case 'DEPB': // Emerald German
gSaveBlock1 = (pSaveBlock1) 0x2025A00;
gSaveBlock2 = (pSaveBlock2) 0x2024A54;
gSaveBlock3 = (pSaveBlock3) 0x2029808;
*(pSaveBlock1*)(0x3005d8c) = gSaveBlock1;
loadsave = (void(*)(char)) 0x8153075;
mainloop = (void(*)()) 0x800042b;
titlemid = 0x816fdb5;
break;
case 'FEPB': // Emerald French
gSaveBlock1 = (pSaveBlock1) 0x2025A00;
gSaveBlock2 = (pSaveBlock2) 0x2024A54;
gSaveBlock3 = (pSaveBlock3) 0x2029808;
*(pSaveBlock1*)(0x3005d8c) = gSaveBlock1;
loadsave = (void(*)(char)) 0x815319d;
mainloop = (void(*)()) 0x800042b;
titlemid = 0x816fedd;
break;
case 'IEPB': // Emerald Italian
gSaveBlock1 = (pSaveBlock1) 0x2025A00;
gSaveBlock2 = (pSaveBlock2) 0x2024A54;
gSaveBlock3 = (pSaveBlock3) 0x2029808;
*(pSaveBlock1*)(0x3005d8c) = gSaveBlock1;
loadsave = (void(*)(char)) 0x8153065;
mainloop = (void(*)()) 0x800042b;
titlemid = 0x816fda5;
break;
case 'SEPB': // Emerald Spanish
gSaveBlock1 = (pSaveBlock1) 0x2025A00;
gSaveBlock2 = (pSaveBlock2) 0x2024A54;
gSaveBlock3 = (pSaveBlock3) 0x2029808;
*(pSaveBlock1*)(0x3005d8c) = gSaveBlock1;
loadsave = (void(*)(char)) 0x8153175;
mainloop = (void(*)()) 0x800042b;
titlemid = 0x816feb5;
break;
case 'EEPB': // Emerald English
gSaveBlock1 = (pSaveBlock1) 0x2025A00;
gSaveBlock2 = (pSaveBlock2) 0x2024A54;
gSaveBlock3 = (pSaveBlock3) 0x2029808;
*(pSaveBlock1*)(0x3005d8c) = gSaveBlock1;
loadsave = (void(*)(char)) 0x81534d1;
mainloop = (void(*)()) 0x800042b;
titlemid = 0x817014d;
break;
case 'JEPB': // Emerald Japanese
gSaveBlock1 = (pSaveBlock1) 0x20256A4;
gSaveBlock2 = (pSaveBlock2) 0x20246F8;
gSaveBlock3 = (pSaveBlock3) 0x20294AC;
*(pSaveBlock1*)(0x3005aec) = gSaveBlock1;
loadsave = (void(*)(char)) 0x815340d;
mainloop = (void(*)()) 0x800042b;
titlemid = 0x816ff45;
break;
default:
return 0; // this game isn't supported
}
loadsave(0);
// now the save is loaded, we can do what we want with the loaded blocks.
// time to call the payload.
payload(gSaveBlock1,gSaveBlock2,gSaveBlock3);
// In FR/LG/Emerald, just returning to the game is unwise.
// The game reloads the savefile.
// In FR/LG, this is done at the title screen after setting ASLR/saveblock-crypto up. (probably because at initial save-load, SaveBlock3 ptr isn't set up lol)
// So, better bypass the title screen and get the game to return directly to the Continue/New Game screen.
// In Emerald, the save reload happens after the Continue option was chosen, so we have no choice but to bypass everything and get the game to go straight to the overworld.
// Easiest way to do this is to call into the middle of the function we want, using an ASM wrapper to set up the stack.
// Here goes...
if (titlemid) {
// Function reserves an extra 4 bytes of stack space in FireRed, and none in Emerald.
call_into_middle_of_titlescreen_func(titlemid,((gamecode << 8) == 'EPB\x00' ? 0 : 4));
}
// Now we've done what we want, time to return to the game.
// Can't just return, the game will reload the save.
// So let's just call the main-loop directly ;)
// turn the sound back on before we head back to the game
*(vu16 *)(REG_BASE + 0x84) = 0x8f;
// re-enable interrupts
REG_IME = 1;
mainloop();
// Anything past here will not be executed.
return 0;
}
|
