#arbitrary code execution

ACE and RNG manipulation explained (kinda)

first off a quick overview of ACE, ACE stands for arbitrary code execution, which is the ability to run your own (arbitrary!) code within the game. this can be set up with a series of elaborate glitches, that break open the gen 3 pokemon games into letting you run your PC box names as code, enabling you to do pretty much anything you want. to be upfront, i'm not an expert on ACE - i understand it in an overarching conceptual sense and am able to follow ACE guides just fine, but i cannot write my own ACE code, which essentially requires you to know some GBA assembly. doesn't really matter for the purpose of this story though.

you can see an example of a tiny snippet of a larger ACE code with the PC box name below. it looks like gibberish but that's because every character used in the name corresponds to a specific internal value, which when all run together, is code!

i need ACE in FRLG because resetting for, or RNG manipulating (more on that in a moment), trainer ID (and secret ID, also more on that later) is pretty much impossible. ACE will allow me to change my TID to 02018 by essentially just telling the game to do so with my PC boxes. this requires me to set up ACE in emerald first since that's the only game with a viable entrypoint, and then use emerald ACE to make glitch pokemon that can activate ACE in FRLG when traded over.

as for RNG manipulation, that's a bit more straightforward, especially if you've ever watched a speedrun of... pretty much anything with random chance in it. games with random chance are not actually fully random because computers can't really be fully random, and in the older pokemon games with unencrypted and less advanced RNG (random number generator) algorithms, this is pretty easy to exploit.

this is a heavy simplification, but whenever you encounter a wild pokemon in RSE or FRLG, the amount of frames that have passed since the game was turned on are compared to a number that was generated upon boot, called the RNG seed. if you've ever played minecraft you can compare this to world seeds - the pokemon RNG seed determines all possible wild encounters in that play session in a similar fashion as minecraft determining the infinite terrain layout. this comparison determines every aspect of an encountered pokemon; its species, nature, IVs, and so on. so, if you were able to time your wild encounter (or any other type of pokemon encounter) down to the 1/60th of a second frame, you can get the game to spit out whatever pokemon you want at you! you just need a bit of typically invisible information first - the RNG seed, and if you're RNGing a shiny, your secret ID aka SID, which is like an invisible second trainer ID generated alongside your TID that is paired up with the TID and compared against any pokemon you encounter to determine if it should be shiny or not. both of these things can be figured out without hacking or tampering with games/save files.

the most common program used for all things RNG manipulation is called pokefinder and you can see an example of it spitting out what shinies are available on hoenn's first route in the first 100000 frames of the game being on with an RNG seed of 0 and my old TID/SID combo below. it's pretty damn cool to me tbh, i love RNG manipulation and i'm way more versed on it/experienced than i am with ACE

TLDR; rng manipulation is essentially a frame perfect, speedrunning-adjacent trick to get the game to roll the RNG in your favor, including for perfect IVs or shininess. for reasons that will become clear later, this is much easier to do in emerald than any other gen 3 game, so i will be using emerald for the RNG manipulation of the girafarig egg

with ALL of that context out of the way, this was the gameplan:

play through a fresh file of japanese firered (i don't own japanese leafgreen, RIP) all the way through the postgame to unlock trading with hoenn with the name PPさん, not worrying about TID for now. the guide i was following did not have a code for changing name with ACE in japanese FRLG specifically, so i figured playing the game again real quick would be a better alternative to trying to teach myself assembly in an afternoon LOL

set up ACE in my new emerald file i completed recently

use ACE in emerald to generate the glitch pokemon needed to run ACE in FRLG and trade them over. finalize the setup process over in FRLG too

look up possible gentle, ability 2, female, and shiny egg frames, and pick one that looks good to RNG manipulate in emerald, noting its PID (an encounter-specific ID number, pretty much)

figure out what SID, when combined with a TID of 02018, will cause that egg frame to be shiny - that way when the egg is traded over and hatched in firered, it will be shiny

do the RNG in emerald, trade over the to-be-shiny egg to firered, and hatch it after changing the TID/SID with ACE appropriately!! bam female, gentle, early bird, shiny, JP origin girafarig with an OT of PPさん and a visible TID of 02018. Pog!!

to execute that gameplan would take me an entire day, though...

step 1: play through firered

ok gonna be honest this is the ONE part of this entire process that i did not play on original hardware. i wanted to get to the Cool Parts of this process so i decided to play through firered on emulator. absolutely terrible picture sorry but i do actually own japanese firered, so i could dump the game legally to my computer to use speedup in mGBA with a little device called the Joey JR which connects the cart to my computer by USB like so

after that it was pretty much a relatively normal playthrough but obviously with emulator speedup. i used solely my starter blastoise to, well, blast through the rest of the game LMAO. after just a couple of hours or so i was right before the elite four, which i completed while in the car after moving the save file back to my cartridge with the same device, since i had to leave the house to go to a doctor appointment. i tried to take pictures of me beating the game but the sun was not doing the photos any favors lol. blastoise ended up being level 76 by the end. was easy with surf and an ice beam TM from the game corner (i just bought the coins)

unfortunately beating the game isn't the only requirement for trading with the hoenn games, so i also had to complete the whole sevii islands postgame quest... which required me to have 60 registered owned entries in the pokedex, which i wasn't really doing while speeding through the game initially, so i had a lot of mons to catch. i was still out of the house at this point (and playing at normal speed lol) so i wasn't really taking pictures, but i did make a stop at the power plant to look for an electabuzz despite it being an inefficient 5% since i needed a spare anyways for my leafgreen file unrelated to this story lmao. took a pic of it since it took a while to show up. anyway soon enough the dex had 60+ entries! i've played FRLG so many times that the encounter locations are memorized in my mind... i did all of this with no googling asdfkasfd

at this point i got home and was able to do the ruby/sapphire postgame quest on emulator with speedup again, so it was pretty easy. moved the save back to cart and i was done with step 1! obviously this didn't actually take me 21 hours of playtime, that was the emulator speedup's fault loool. from here on out i didn't touch any emulators again!

step 2: set up ACE in emerald

ACE time! i've actually set up ACE in an old emerald file before but i wanted to do it again fresh. i was following a guide pretty much to a T so i'm actually going to skip over the details of some of the steps since you can read about those more in depth over at the guide i was using if you want

TLDR; you have to trade for the NPC trade pokemon, DOTS the seedot and PLUSES the plusle, then EV train DOTS a specific way. these EV values cause DOTS to turn into a glitch pokemon egg 0x0611 when corrupted with the pomeg glitch (more on that in a bit), which, when hatched, runs the PC box names as code, aka ACE! why does it work? if you really want to know, there's plenty of stuff online about it, i'm not the best person to ask haha

it's worth noting that volbeat is really annoying to capture in emerald as it's literally only available as a 1% in one patch of grass, so i caught an illumise instead and bred them until a volbeat hatched lol. was much more efficient

also lol "Take good care of DOTS!" sorry i will be corrupting your son into demonspawn that lets me wield godlike control over your universe

after getting the necessary NPC trade pokemon all ready and moving them into a specific pattern in box 2 (i cloned them with the emerald tower cloning glitch) i had to perform the pomeg glitch. this involves using a pomeg berry to decrease a pokemon's health to 0 without causing a whiteout. this is achieved by getting a pokemon with at least 8 HP EVs to 1 HP and then using the pomeg berry on it, decreasing the EVs and taking off a point of health in the process (it's slightly more steps than this but whatever). i decided to use the camerupt i had during my playthrough of the game for this purpose. just took him to fiery path to get poisoned and walked until he was on 1 HP and healed him with an antidote lol

by doing the pomeg glitch and entering a wild battle, the game gets a bit confused since all the pokemon in your party are fainted and just sends out some sort of glitch decamark pokemon. in this situation, after viewing my camerupt's summary in battle and exiting back out of the summary screen, i was able to corrupt the DOTS and PLUSES sitting in my PC by scrolling up above the usual limit of the party menu, which reaches into data used by the first two PC boxes and fucks them up, ending up with, assuming that i EV trained correctly, a glitched egg that is about to hatch in a nest ball named DOTS with pokerus. this will run ACE when hatched! (if you want more info on this corruption pomeg stuff, check out the bulbapedia article for glitzer popping. yes that's what they named it)

step 3: use emerald ACE to set up firered ACE

so once again you can find a lot more detail on this process over at the guide i was using, but the TLDR of the matter was, i needed to put a bunch of codes into my PC box names to generate a few different glitch mons. specifically, i needed a egg that would hatch into a crobat (yes, fully evolved lol) with a singular glitched out move, that when used in battle in firered, would cause ACE to happen similar to how hatching the corrupted DOTS egg causes ACE to happen in emerald. i also needed a specific buggy shiny umbreon and a very strange glitchy egg.

even though this step was mostly a lot of tedious typing on the gen 3 keyboard (+ i had to redo things once because i made a typo at one point in the process LOL) it was so much fun! the game breaks in so many ways that you would just... never see during normal gameplay and it makes for some really good pictures and whatnot

first of all, when you hatch the 0x0611 egg, it hatches into a decamark of varying colors, in the case of the picture below it's almost imperceptible because the whole sprite is just a black circle, blending in with the background (sorry for the quality on this one, it's a screencap of a video clip i took).

additionally, trying to scroll over the hatched decamark in the PC or viewing its summary screen will crash the game, so to get rid of it, it has to be moved to the front of your party in the party menu, and then you go to the PC to release it through the deposit menu. since the cursor just defaults to the first position of the party and you don't have to scroll over to it, it's possible to release it from here.

oh yes and the umbreon/other glitch egg? similarly screwy - actually after generating them, their sprites are glitched out until you reset the game, so they look like this. behold their nonsense summaries:

after i had all i needed to trade to FRLG, i cloned an extra set of them with the emerald tower glitch again just in case i messed something up and got to trading! here's me receiving them on the firered side:

and last but not least, i'm a little obsessed with the way the glitch move looks in FRLG on the hatched crobat, absolute nonsense:

i finalized setting up the FRLG ACE (check out the guide i linked earlier for more info) and put everything into their proper positions, but before i could actually execute any code... i needed to know what SID i was going for!

step 4 + 5: look up potential egg frames in emerald and find an SID

soo now for looking at potential girafarig eggs. instead of using the program pokefinder which i mentioned earlier, i used a program called pokenav egg rng tool, which is exactly what it sounds like, a tool specialized for rng manipulating eggs with the pokenav in emerald. using it, i was quickly able to generate a whole list of gentle, female, ability 2 (early bird) eggs, and i picked one that was around 1300 frames in since that made for quick resetting attempts, but not so quick that i could barely make my inputs in time. the one i picked was frame 1381. with a TID of 02018, the PID D2C5EF55 would be shiny with an SID of 14962, so i noted that for later in firered. (i figured this out using an old program called RNG Reporter which is what i'm familiar with but i don't recommend using lmao. it's the "Pandora's Box" feature of that software though if you happen to look it up)

i won't make an entire guide on how to do emerald egg RNG here because it's a lot of steps, but i might at some point because the most up to date method isn't super well documented. anyways, here's a very paraphrased version of the process (this is also assuming that you aren't dealing with "redraws", which i wasn't... like i said very paraphrased):

get a pokemon with the ability lightningrod in the front of your party (i used electrike) to make pokenav calls happen more frequently, and a pokemon with flame body or magma armor (i used slugma) to make eggs hatch faster

get a male and a female of the pokemon you want to hatch, in my case girafarig. if you were RNGing IVs, the parent's IVs would be relevant, but i am not RNGing IVs so i didn't care and just caught the first girafarig i could in the safari zone

an egg is attempted to be generated every 255 steps after the parents are deposited in the daycare together, so by timing the usage of a max repel in such a way, it's easy to save the game exactly 10 steps before an egg is generated. do this

using a timer such as eontimer, soft reset and try to take that last 10th step on your target frame. this will also trigger a pokenav call (or lack thereof) and by looking for the phone call you got in the call column of the egg rng tool and whether or not an egg generated at the daycare, you can tell what frame you hit. didn't hit your target? just soft reset and try again, calibrating the timer for your own human error. this can take a while since the timing is precise to 1/60th of a second

once you hit your target frame, woohoo you did it just take the egg and hatch it! if you're RNGing IVs you would actually save before taking the egg and then RNG the IVs separately but that's a whole different thing i'm not explaining here since i wasn't RNGing IVs

i've avoided mentioning it this entire time till now, but emerald is particularly easy to do rng manipulation in because due to a programming error, the rng seed is always 0 - all encounters are predictable and you don't have to dedicate a frame perfect input to getting the right seed, making emerald rng a matter of one frame perfect input instead of two (there ARE ways to get emerald to generate a proper rng seed but that's unrelated here). additionally, its pokenav system means you can see if you got the right egg BEFORE taking it and hatching it... doing egg RNG in any other gen 3 game is basically a death sentence due to multiple untelegraphed frame perfect inputs that have to be executed in a row, plus really long wait times due to hatching eggs on a slower bike without flame body. there's a reason i was not doing this on four island in frlg.

but yeah now i knew what egg frame i was going for and was all prepared to do the RNG, so now it was onto actually executing it all:

step 6: getting kaf girafarig babey!!

before doing the RNG manipulation in emerald, i needed to change my SID and TID in firered finally! this required me to run two different codes, one for SID and one for TID. it was actually pretty painless since the code is nearly identical for both, you just swap out the values of each ID and one character changes in one box name to decide whether you're changing TID or SID. you can find the list of codes i was referencing here.

i was saving my one allotted video clip in this post for changing the TID with the glitched crobat move though because LMAO

^ shoutout to my qpp @/spikyearr for this one i fucking chokedSKFDDSFK

anyway, after doing that i went through the process of the egg rng in emerald (unfortunately no pictures because it's kind of hard to take pics mid-rng) and actually saved before taking the egg so that i'd be able to soft reset after hatching it - i just needed to check to make sure it was gentle and everything, and then i could soft reset, take the egg again, bike around to decrease the egg cycles in emerald since hatching in firered is super slow, and then trade it off before hatching it to go be hatched in firered. i knew it wouldn't be shiny in emerald, so i wasn't concerned with that. it only took 40 or so minutes of attempts before i got her!

and then AT LAST after spending my ENTIRE DAY ON THIS SHIT (like 10x the amount of time on the ACE stuff for the TID instead of the actual RNG itself LOOOL) i just had to trade the egg to firered and hatch it and i was golden!!!!! AAAGH here she is next to my kaf plushies!!!

also a picture of her summary screen after being traded to my english leafgreen!! i am assuming this will be easier to read for most of the people reading this post LOL

THAT'S IT. POST OVER THIS WAS SO LONG. IF YOU MADE IT THROUGH MY RAMBLING GOOD JOB. I HIT THE PHOTO LIMIT HELP ME