Emulation Pokemon Emerald Clock Fix for flashcarts. How does it work?

[Jibib]

Hey, I recently picked up my gba micro with ez flash iv, decided that I wanted to play emerald and was looking to see if anyone had patched it yet.

I came across this from a dude called Gamer2020:

Hi everyone. Today I bring you a clock fix for Emerald (BPEE). You may remember that there was an rtc patch made for R/S that allowed the clock to be based on playtime. A patch like this was never made for Emerald. I took the one for Ruby, disassembled it, and made it work for Emerald. Keep in mind that while this does work it has not been fully tested.

Memory address 0x0200F024 may not be safe. It is the same one used in the Ruby routine. This can be changed without affecting functionality.

Just assemble the code below and follow the included instructions.

.text
.align 2
.thumb
.thumb_func
.global emeraldclockfix
 
/*At 80005e6 write 01B400480047xxxxxxxx01BC with xxxxxxxx being the offset for this routine.
To disable the error code text write C046C046 at 0802FB06
Offset 0200F024 may not be safe in emerald but this can be changed to anything desired.
This code seems to work but is not fully tested. Use at your own risk.*/
main:
 
push    {r0-r7}
ldr    r0,.PLAYER_DATA
ldr    r0, [r0]
add    r0,r0, #0x11
str    r0,[sp]
ldr    r4,.PLAYER_DATA
ldr    r4, [r4]
add    r4,r4, #0x9A
add    r3,r4,#0x1
ldr    r7,.SUM_BUFF
ldrb    r5,[r7]
ldrb    r0,[r0]
add    r2,r7,#0x1
cmp    r5,r0
beq    Game_Code_and_Return
strb    r0,[r7]
ldrb    r0,[r2]
add    r6,r0,#0x1
lsl    r0,r6,#0x18
lsr    r0,r0,#0x18
strb    r0,[r2]
cmp    r0,#0x3B
ble    Game_Code_and_Return
mov    r6,#0x0
strb    r6,[r2]
ldrb    r6,[r3]
sub    r6,#0x1
lsl    r1,r6,#0x18
lsr    r1,r1,#0x18
cmp    r1,#0xFF
bne    SOMETHING3
mov    r6,#0x3B
strb    r6,[r3]
ldrb    r6,[r4]
sub    r6,#0x1
and    r1,r6
cmp    r1,#0xFF
bne    SOMETHING2
mov    r1,#0x17
bl      SOMETHING4
 
SOMETHING2:
 
strb    r1,[r4]
b      Game_Code_and_Return
 
SOMETHING3:
                       
strb    r1,[r3]
 
Game_Code_and_Return:
 
pop    {r0-r7}
ldr    r0,.SUM_GAME_OFF
ldrh    r1,[r0]
ldr    r2,.SUM_VAL
mov    r0,r2
mov    r3,r0
eor    r3,r1
ldr    r0,.RETURN_OFFSET
bx      r0
 
SOMETHING4:
                     
push    {r0-r2}
ldr    r0,.PLAYER_DATA
ldr    r0, [r0]
add    r0,r0, #0x98
ldrh    r1,[r0]
sub    r1,#0x1
ldr    r2,=.SUM_VAL2
cmp    r1,r2
blt    SOMETHING1
ldr    r1,.SUM_VAL3
 
SOMETHING1:                     
 
strh    r1,[r0]
pop    {r0-r2}
mov    r15,r14
 
.align 2
 
.PLAYER_DATA:
.word 0x03005D90
.SUM_BUFF:
.word 0x0200F024
.SUM_GAME_OFF:
.word 0x04000130
.RETURN_OFFSET:
.word 0x080005F1
.SUM_VAL2:
.hword 0x8000
.hword 0x0000         
.SUM_VAL3:
.hword 0xFFFF
.hword 0x0000
.SUM_VAL:
.hword 0x3FF

I've been trying to figure out how to use this, but with a lack of hacking knowledge I have absolutely no idea.

Does anyone have a clue how to utilize this?

Cheers.

(Sources) : http://www.pokemonhackersonline.com/showthread.php?t=14004-Emerald-Clock-Fix
http://www.pokecommunity.com/showthread.php?t=297913

 

[FAST6191]

What about the patch from edit. Messed up the link http://www.mediafire.com/download/8i0uzs2bd99u7l8/Emerald_Clock_v2.zip (from http://gbatemp.net/threads/any-rtc-...emerald-using-ez-flash-4.354231/#post-4767363 )?

It should all be good to go rather than fiddling with assembly, thanks for that though. I had not seen that before and it might be interesting to pick through.

 

[Jibib]

What about the patch from http://gbatemp.net/threads/pokemon-...shcarts-how-does-it-work.369848/#post-5067270 ?

It should all be good to go rather than fiddling with assembly, thanks for that though. I had not seen that before and it might be interesting to pick through.

Sorry, I don't quite understand. How would I apply this patch to a ROM? I have relatively zero coding experience. :/

 

[FAST6191]

The linked patch is an IPS file (actually two different ones, one allowing you to set the clocks if you want which should be better than what you have there).

There are any number of IPS patching tools (before the DS it was probably the most common patch type, give or take some made for CD/DVD using systems). GBATA from http://www.no-intro.org/tools.htm being a good one. You can patch it before you save patch the game, after probably works too. Whether it works with other hacks will vary.

As for the code above... I have actually never before seen a patch intended for the end user to come in that form and doubt I ever will again. It is not really all that useful to other hackers looking to see how it works either as it is not commented, though it does have nice variable names/location names so there is that. I guess it is made this way so other pokemon hackers could work around it if they use space it might have wanted to occupy otherwise.
What it is is an assembly fragment/set of routines, and a fairly high level/developer oriented version at that, and instructions on where to patch it into the ROM (though seemingly using runtime memory addressing rather than ROM level addressing like most people normally would), as well as where to patch to disable the clock error check. I am guessing it is assembly for the ARMIPS ( http://www.romhacking.net/utilities/635/ ) assembler, it is probably the main assembler for GBA and DS hackers but some pokemon hackers do use odd tools and methods. If not that then something in the arm-eabi (GNU arm assembly) is a good bet as well.

I could cover what I think each step is doing (and there do seem to be some redundant steps and odd choices), or indeed how to turn that into something you can use. Short version is 08?????? is the ROM in memory, so where it says (0)80005e6 it means 05e6 in the ROM which is probably very early on in the game's boot sequence. You would assemble it with whatever it assembles with, put that somewhere in the ROM (like the blank space towards the end), note this location and put that in the part where it has xxxxxxxx (again adding 08 so it knows to look in the ROM) and also change the location it says
(02BF06 in the ROM image, I am not sure what C046C046 decodes as right now (possibly two NOPs in thumb) and I also do not know what it is replacing but it is probably just a way to stop the game from going the down the "failed the clock check" path). The 0200F024 stuff is a location in the GBA's RAM which the author used as it was also used in the ruby/sapphire patches, they do not know if it is used later in the game hence them calling it unsafe.
If the other patch works (and I believe it does, possibly works better) there is little need to do any of that.

 

[Jibib]

The linked patch is an IPS file (actually two different ones, one allowing you to set the clocks if you want which should be better than what you have there).

There are any number of IPS patching tools (before the DS it was probably the most common patch type, give or take some made for CD/DVD using systems). GBATA from http://www.no-intro.org/tools.htm being a good one. You can patch it before you save patch the game, after probably works too. Whether it works with other hacks will vary.

As for the code above... I have actually never before seen a patch intended for the end user to come in that form and doubt I ever will again. It is not really all that useful to other hackers looking to see how it works either as it is not commented, though it does have nice variable names/location names so there is that. I guess it is made this way so other pokemon hackers could work around it if they use space it might have wanted to occupy otherwise.
What it is is an assembly fragment/set of routines, and a fairly high level/developer oriented version at that, and instructions on where to patch it into the ROM (though seemingly using runtime memory addressing rather than ROM level addressing like most people normally would), as well as where to patch to disable the clock error check. I am guessing it is assembly for the ARMIPS ( http://www.romhacking.net/utilities/635/ ) assembler, it is probably the main assembler for GBA and DS hackers but some pokemon hackers do use odd tools and methods. If not that then something in the arm-eabi (GNU arm assembly) is a good bet as well.

I could cover what I think each step is doing (and there do seem to be some redundant steps and odd choices), or indeed how to turn that into something you can use. Short version is 08?????? is the ROM in memory, so where it says (0)80005e6 it means 05e6 in the ROM which is probably very early on in the game's boot sequence. You would assemble it with whatever it assembles with, put that somewhere in the ROM (like the blank space towards the end), note this location and put that in the part where it has xxxxxxxx (again adding 08 so it knows to look in the ROM) and also change the location it says
(02BF06 in the ROM image, I am not sure what C046C046 decodes as right now (possibly two NOPs in thumb) and I also do not know what it is replacing but it is probably just a way to stop the game from going the down the "failed the clock check" path). The 0200F024 stuff is a location in the GBA's RAM which the author used as it was also used in the ruby/sapphire patches, they do not know if it is used later in the game hence them calling it unsafe.
If the other patch works (and I believe it does, possibly works better) there is little need to do any of that.

Thanks, I'll give it a shot at assembling using one of those programs and patching the ROM. I think it might take awhile as I'm still trying to make sense of all of this haha.

I'll post my results here .