Smogon Community - View Single Post

Did a little bit of observational research using a memory analysis with cheat engine to get some opcodes and memory locations.

observations + opcodes Using the new Cheat Engine 5.6.1

other things I have noticed about PID locations:

dumped PID locations to check PID on encounter

When the game freezes you and starts the battle scene (after any encounter text), the PID for the Pokemon is already set (as in gen 4)

Oct 10th, 2010, 4:47:16 AM	#342
Kaphotics Remodeling Kitchens Join Date: Apr 2009 Posts: 758 Berkeley, CA	Did a little bit of observational research using a memory analysis with cheat engine to get some opcodes and memory locations. observations + opcodes Using the new Cheat Engine 5.6.1 Seed1+Seed2 Address in Memory: 022160A4 and 022160A8 Address in Cheat Engine: 00F525A4 and 00F525A8 Cheat Engine's memory locations are -011C3B00 off for these 2 values. -- CE Addr - Bytes - Opcode Victini or Kyuremu Engaged (00F525A4 and 00F525A8) [022160A4 and 022160A8] Code: Reads this address when battling victini CE Addr - Bytes - Opcode 004fb7e8 - 8b 81 00 c5 d3 00 - mov eax,[ecx+00d3c500] 004fb682 - 89 81 00 c5 d3 00 - mov [ecx+00d3c500],eax Writes to this address when battling Victini 004fb682 - 89 81 00 c5 d3 00 - mov [ecx+00d3c500],eax - Standing by egg man with world running and Starting the game, both Seed values are influenced by Code: Read by 0043ba5f - 89 82 00 c5 d3 00 - mov [edx+00d3c500],eax 004fb7e8 - 8b 81 00 c5 d3 00 - mov eax,[ecx+00d3c500] 004fb682 - 89 81 00 c5 d3 00 - mov [ecx+00d3c500],eax Written by 0043ba5f - 89 82 00 c5 d3 00 - mov [edx+00d3c500],eax 004fb682 - 89 81 00 c5 d3 00 - mov [ecx+00d3c500],eax Automatic advancement based on NPCs/other memory locations? ------- Other Places Eggs Code: Eggs (0107B0FC) -- this is the one I saw earlier [0223EBFC] Read by 004fcdbc - 89 82 00 c5 d3 00 - mov [edx+00d3c500],eax Written by 0043cfb7 - 89 82 00 c5 d3 00 - mov [edx+00d3c500],eax 004fb682 - 89 81 00 c5 d3 00 - mov [ecx+00d3c500],eax Eggs (00F71180) -- Party location (irrelevant) [2134C80] Read by 004fb7e8 - 8b 81 00 c5 d3 00 - mov eax,[ecx+00d3c500] Written by 004fcdbc - 89 82 00 c5 d3 00 - mov [edx+00d3c500],eax Looks like the egg PID is made, read and copied to the party when it is received. Outside Daycare at man, npcs move -- observing RNG Seeds 1+2 (00F525A4 and 00F525A8) Code: Read by (both locations are) 004d8e51 - 8a 80 00 c5 d3 00 - mov al,[eax+00d3c500] 004fb7e8 - 8b 81 00 c5 d3 00 - mov eax,[ecx+00d3c500] 004fb682 - 89 81 00 c5 d3 00 - mov [ecx+00d3c500],eax Written by (Both again) 004fb682 - 89 81 00 c5 d3 00 - mov [ecx+00d3c500],eax All of these memory locations in context: Code: http://dl.dropbox.com/u/12206225/Debugger/0043BA5F.png http://dl.dropbox.com/u/12206225/Debugger/004FB682.png http://dl.dropbox.com/u/12206225/Debugger/004FB7E8.png http://dl.dropbox.com/u/12206225/Debugger/004FCDBC.png other things I have noticed about PID locations: dumped PID locations to check PID on encounter When encountering a Pokemon the PID is stored before you even catch it. These are off by 12C3B00 in CE instead of 11C3B00... Encountering Kyuremu, PID is stored on encounter at: 00F99660 (0225D160) 00F99CD0 (0225D7D0) Encountering Victini, PID is stored on encounter at: 00F998C8 (0225D3C8) 00F99F38 (0225DA38) Possible differences for all the legends? Encountering a Wild Pokemon Tile not scenting(At Kyuremu and Forest), PID is at: 00F96158 (02259C58) 00F967C8 (0225A2C8) Also has the PID for for the shaking tile Pokemon (forest +etc??) Interesting that the interval between all of these is 670 hex... Setting and Freezing these values (or changing them) and then encountering the respective Pokemon results in the blue screen error. (tested Kyuremu, set the 2 to E2D36280). Setting and freezing them after the Sprite appears during battle will not change the PID from what it was originally calculated as. When the game freezes you and starts the battle scene (after any encounter text), the PID for the Pokemon is already set (as in gen 4)