1.1 --- a/.hgignore	Thu Nov 22 11:36:07 2012 -0600
     1.2 +++ b/.hgignore	Thu Nov 22 13:12:21 2012 -0600
     1.3 @@ -18,4 +18,5 @@
     1.4  html/*
     1.5  java/lib/*
     1.6  render/*
     1.7 -zophar/*
     1.8 \ No newline at end of file
     1.9 +zophar/*
    1.10 +video/*

     2.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.2 +++ b/org/tas-submission.txt	Thu Nov 22 13:12:21 2012 -0600
     2.3 @@ -0,0 +1,287 @@
     2.4 +Pokemon Yellow Total Control Hack. Reprogramming the game from the inside!
     2.5 + 
     2.6 +!! Game objectives
     2.7 +
     2.8 +* Emulator used: vba-rerecording 23.5
     2.9 +* Reprogram the Game from the inside
    2.10 +
    2.11 +!! Comments
    2.12 +
    2.13 +I've included a detailed writeup here:
    2.14 +http://aurellem.org/vba-clojure/html/total-control.html
    2.15 +
    2.16 +There is a video at:
    2.17 +http://www.youtube.com/watch?v=p5T81yHkHtI with keypress visualizations
    2.18 +
    2.19 +The following are the highlights:
    2.20 +
    2.21 +! Introduction
    2.22 +
    2.23 +Think of pokemon yellow as creating a little universe with certain
    2.24 +rules. Inside that universe, you can buy items, defeat rival trainers,
    2.25 +and raise your pokemon. But within that universe, you are bound by the
    2.26 +rules of pokemon. You can't build new buildings, or change the music,
    2.27 +or change your clothes.. There are some games (like chess), where it
    2.28 +is not possible to alter the rules of the game from within the
    2.29 +game. No matter what moves you make in chess, you can never change the
    2.30 +rules of the game so that it becomes checkers or basketball. The point
    2.31 +of this run is to show that you CAN change the rules in pokemon
    2.32 +yellow. There is a certain sequence of valid actions (like walking
    2.33 +from one place to another or buying items) that will allow you to
    2.34 +transform pokemon yellow into Pacman, or Tetris, or Pong, or a MIDI
    2.35 +player, or anything else you can imagine.
    2.36 +
    2.37 +
    2.38 +! Background
    2.39 +
    2.40 +The speedrun (http://tasvideos.org/2913S.html) by Felipe Lopes de
    2.41 +Freitas (p4wn3r), beats pokemon yellow in only 1 minute and 36
    2.42 +seconds. It does it by corrupting the in-game item list so that he can
    2.43 +advance the list past its normal limit of 20 items. The memory
    2.44 +immediately after the item list includes the warp points for the
    2.45 +current map, and by treating that data as items and switching and
    2.46 +dropping them, he can make the door from his house take him directly
    2.47 +to the end of the game.
    2.48 +
    2.49 +When I first saw that speedrun, I was amazed at how fast pokemon
    2.50 +yellow could be beaten, and that it was possible to manipulate the
    2.51 +game from the inside, using only the item list. I wondered how far I
    2.52 +could extend the techniques found in p4wn3r's run.
    2.53 +
    2.54 +The gameboy is an 8 bit computer. That means that ultimately, anything
    2.55 +that happens in pokemon is a result of the gameboy's CPU reading a
    2.56 +stream of 8 bit numbers and doing whatever those numbers mean. For
    2.57 +example, in the gameboy, the numbers: 
    2.58 +
    2.59 +62 16 37 224 47 240 37 230 15 55
    2.60 +
    2.61 +mean to check which buttons are currently pressed and copy that result
    2.62 +into the "A" register. With enough numbers, you can spell out an
    2.63 +interactive program that reads input from the buttons and allows you
    2.64 +to write any program you want to the gameboy. Once you have assembled
    2.65 +such a program and forced the game to run it, you have won, since you
    2.66 +can use that program to write any other program (like Tetris or
    2.67 +Pacman) over pokemon yellow's code. I call a program that allows you
    2.68 +to write any other program a "bootstrapping program". So, the goal is
    2.69 +to somehow get a bootstrapping program into pokemon yellow and then
    2.70 +force yellow to run that program instead of its own.
    2.71 +
    2.72 +How can we spell out such a program? Everything in the game is
    2.73 +ultimately numbers, including all items, pokemon, levels, etc. In
    2.74 +particular, the item list looks like:
    2.75 +
    2.76 +
    2.77 + item-one-id         (0-255)
    2.78 + item-one-quantity   (0-255)
    2.79 + item-two-id         (0-255)
    2.80 + item-two-quantity   (0-255)
    2.81 + .
    2.82 + .
    2.83 + .
    2.84 + 
    2.85 +
    2.86 +Let's consider the button measuring program  [37 62 16 37 224 37 240
    2.87 +37 230 15 55] from before. Interpreted as items and item quantities, it is 
    2.88 +
    2.89 + lemonade     x16
    2.90 + guard spec.  x224
    2.91 + leaf stone   x240
    2.92 + guard spec.  x230
    2.93 + parlyz heal  x55
    2.94 +
    2.95 +So, if we can get the right items in the right quantities, we can
    2.96 +spell out a bootstrapping program. Likewise, when writing the
    2.97 +bootstrapping program, we must be careful to only use numbers that are
    2.98 +also valid items and quantities. This is hard because there aren't
    2.99 +many different items to work with, and many machine instructions
   2.100 +actually take 2 or even 3 numbers in a row, which severely restricts
   2.101 +the types of items you can use. I ended up needing about 92 numbers to
   2.102 +implement a bootstrap program. Half of those numbers were elaborate
   2.103 +ways of doing nothing and were just there so that the entire program
   2.104 +was also a valid item list.
   2.105 +
   2.106 +The final part of the hack is getting pokemon yellow to execute the
   2.107 +new program after it has been assembled with items. Fortunately,
   2.108 +pokemon keeps a number called a function pointer within easy reach of
   2.109 +the corrupted item list. This function pointer is the starting point
   2.110 +(address) of a program which the game runs every so often to check for
   2.111 +poison and do general maintenance. By shifting an item over this
   2.112 +function pointer, I can rewrite that address to point to the
   2.113 +bootstrapping program, and make the game execute it. Without this
   2.114 +function pointer, it would not be possible to take over the game.
   2.115 +
   2.116 +!! The Run
   2.117 +
   2.118 +! Pallet
   2.119 +
   2.120 +I start off and name my rival Lp/k. These characters will eventually be
   2.121 +treated as items and shifted over the function pointer, causing it to
   2.122 +execute the bootstrapping program that will soon be constructed. I
   2.123 +start the run the same as p4wn3r's and restart the game while saving,
   2.124 +so that the pokemon list is corrupted. By switching the 8th and 10th
   2.125 +pokemon, I corrupt the item list and can now scroll down past the 20th
   2.126 +item. I shift items around to increase the text speed to maximum and
   2.127 +rewrite the warp point of my house to Celadon Dept. Store. (p4wn3r
   2.128 +used this to go directly to the hall of fame and win the game in his
   2.129 +run.) I deposit many 0x00 glitch items into the PC from my corrupted
   2.130 +inventory for later use. Then, I withdraw the potion from the
   2.131 +PC. This repairs my item list by overflowing the item counter from
   2.132 +0xFF back to 0x00, though the potion is obliterated in the process. I
   2.133 +then take 255 glitch items with ID 0x00 from the computer into my
   2.134 +personal items.
   2.135 +
   2.136 +! Celadon Dept. Store
   2.137 +
   2.138 +Leaving my house takes me directly to Celadon Dept. store, where I
   2.139 +sell two 0x00 items for 414925 each, giving myself essentially max
   2.140 +money. I hit every floor of the department store, gathering the
   2.141 +following items:
   2.142 +
   2.143 + +-------------------+----------+
   2.144 + |##| Item           | Quantity |
   2.145 + +--+----------------+----------+
   2.146 + |1 | TM02           |  98      |
   2.147 + |2 | TM37           |  71      |
   2.148 + |3 | TM05           |   1      |
   2.149 + |4 | TM09           |   1      |
   2.150 + |5 | burn-heal      |  12      |
   2.151 + |6 | ice-heal       |  55      |
   2.152 + |7 | parlyz-heal    |  99      |
   2.153 + |8 | parlyz-heal    |  55      |
   2.154 + |9 | TM18           |   1      |
   2.155 + |10| fire-stone     |  23      |
   2.156 + |11| water-stone    |  29      |
   2.157 + |12| x-accuracy     |  58      |
   2.158 + |13| guard-spec     |  99      |
   2.159 + |14| guard-spec     |  24      |
   2.160 + |15| lemonade       |  16      |
   2.161 + |16| TM13           |   1      |
   2.162 + +--+----------------+----------+
   2.163 + 
   2.164 +
   2.165 +After gathering these items, I deposit them in the appropriate order
   2.166 +into the item PC to spell out my bootstrapping program. Writing a full
   2.167 +bootstrap program in one go using only items turned out to be too
   2.168 +hard, so I split the process up into three parts. The program that I
   2.169 +actually construct using items is very limited. It reads only from the
   2.170 +A, B, start, and select buttons, and writes 4 bits each frame starting
   2.171 +at a fixed point in memory. After it writes 200 or so bytes, it jumps
   2.172 +directly to what it just wrote. In my run, I use this program to write
   2.173 +another bootstrapping program that can write any number of bytes to
   2.174 +any location in memory, and then jump to any location in memory. This
   2.175 +new program also can write 8 bits per frame by using all the
   2.176 +buttons. Using this new bootstrap program, I write a final
   2.177 +bootstrapping program that does everything the previous bootstrapping
   2.178 +program does except it also displays the bytes it is writing to memory
   2.179 +on the screen.
   2.180 +
   2.181 +! Finale
   2.182 +
   2.183 +After completing this bootstrapping program, I go to the Celadon
   2.184 +mansion, because I find the metaness of that building to be
   2.185 +sufficiently high to serve as an exit point for the pokemon
   2.186 +universe. I corrupt my item list again by switching corrupted pokemon,
   2.187 +scroll down to my rival's name and discard until it is equal to the
   2.188 +address of my bootstrapping program, and then swap it with the
   2.189 +function pointer. Once the menu is closed, the bootstrapping program
   2.190 +takes over, and I write the payload....
   2.191 +
   2.192 +!! Other comments
   2.193 +
   2.194 +The entire video was played by the computer using bots. I used
   2.195 +functional programming to write search programs over different
   2.196 +possible game states to find the most efficient way of performing
   2.197 +general actions.  Some interesting things I developed but didn't use
   2.198 +were pretty printing functions to display the game's internal data
   2.199 +structures, and an "improbability drive" that forces improbable events
   2.200 +to happen automatically using search.
   2.201 +
   2.202 +Here are a few example scripts:
   2.203 +
   2.204 +
   2.205 + (defn-memo viridian-store->oaks-lab
   2.206 +   ([] (viridian-store->oaks-lab
   2.207 +        (get-oaks-parcel) ) )
   2.208 +   ([ script \]
   2.209 +      (->> script
   2.210 +           (walk [↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓
   2.211 +                  ← ← ← ← ← ← ← ← ← 
   2.212 +                  ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓
   2.213 +                  ← ←
   2.214 +                  ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓
   2.215 +                  ↓ ↓ ↓ ↓ ↓ ↓ ↓
   2.216 +                  → → → → → → → →
   2.217 +                  ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓
   2.218 +                  ← ← ← ← ←
   2.219 +                  ↓ ↓ ↓ ↓
   2.220 +                  ])
   2.221 +           (walk-thru-grass
   2.222 +            [↓ ↓ ↓ ↓ ↓ ↓ ↓])
   2.223 +           (walk [↓ ↓ ← ↓ ↓ ↓ ←
   2.224 +                  ↓ ↓ ↓ ↓ ↓ ↓
   2.225 +                  → → → ↑])
   2.226 +                 
   2.227 +           (do-nothing 1) ) ) )
   2.228 +
   2.229 + 
   2.230 +This script walks from the Viridian City pokemon store to Oak's
   2.231 +Lab in the most efficient way possible. The walk-thru-grass function
   2.232 +guarantees that no wild battles will happen by manipulating the game's
   2.233 +random number generator.
   2.234 +
   2.235 +
   2.236 + (defn-memo hacking-10
   2.237 +   ([] (hacking-10 (hacking-9) ) )
   2.238 +   ([ script \]
   2.239 +      (->> script
   2.240 +           begin-deposit
   2.241 +           (deposit-held-item 17 230)
   2.242 +           (deposit-held-item-named :parlyz-heal 55)
   2.243 +           (deposit-held-item 14 178)
   2.244 +           (deposit-held-item-named :water-stone 29)
   2.245 +           (deposit-held-item 14 32)
   2.246 +           (deposit-held-item-named :TM18 1)
   2.247 +           (deposit-held-item 13 1)
   2.248 +           (deposit-held-item 13 191)
   2.249 +           (deposit-held-item-named :TM02 98)
   2.250 +           (deposit-held-item-named :TM09 1)
   2.251 +           close-menu) ) ) 
   2.252 + 
   2.253 +
   2.254 +This script calculates the fastest sequence of key presses to deposit
   2.255 +the requested items into a PC, assuming that the character starts out
   2.256 +in front of a computer.
   2.257 +
   2.258 +!! Other Comments
   2.259 +
   2.260 +The final payload program is multiple programs. I created a reduced
   2.261 +form of MIDI and implemented it in gameboy machine language. Then I
   2.262 +translated a midi file from http://www.everyponysings.com/ into this
   2.263 +reduced MIDI language. The payload program contains both the music
   2.264 +data and the MIDI interpreter to play that data. The picture works in
   2.265 +a similar way. There is code to translate a png file into a form that
   2.266 +can be displayed on a gameboy, and other code to actually display that
   2.267 +image. Both the image and the display code are also written by the
   2.268 +final bootstrapping program.  Even though my final payload is rather
   2.269 +simple, you can write any program at all as the payload. The source
   2.270 +for the sound and image displaying code is at
   2.271 +http://hg.bortreb.com/vba-clojure.
   2.272 +
   2.273 +This entire project is open source and I encourage anyone who wants to
   2.274 +take the code and play around!
   2.275 +
   2.276 +
   2.277 +!! Suggested Screenshots
   2.278 +
   2.279 +* http://aurellem.org/pokemon-hack/code.png
   2.280 +* http://aurellem.org/pokemon-hack/code2.png
   2.281 +* http://aurellem.org/pokemon-hack/matrix.png
   2.282 +* http://aurellem.org/pokemon-hack/matrix2.png
   2.283 +* http://aurellem.org/pokemon-hack/pinkie-pie.png
   2.284 +
   2.285 +Or whatever you all think would be best.
   2.286 +
   2.287 +I encoded the video with/without button visualization here:
   2.288 +
   2.289 +* http://aurellem.org/pokemon-hack/rlm-yellow-hack.avi
   2.290 +* http://aurellem.org/pokemon-hack/rlm-yellow-hack-no-buttons.avi

     3.1 --- a/org/total-control.org	Thu Nov 22 11:36:07 2012 -0600
     3.2 +++ b/org/total-control.org	Thu Nov 22 13:12:21 2012 -0600
     3.3 @@ -168,8 +168,8 @@
     3.4  bootstrap program in one go using only items turned out to be too
     3.5  hard, so I split the process up into three parts. The program that I
     3.6  actually construct using items is very limited. It reads only from the
     3.7 -A, B, start, and select buttons, and writes 4 bits each frame to a
     3.8 -fixed point in memory. After it writes 200 or so bytes, it jumps
     3.9 +A, B, start, and select buttons, and writes 4 bits each frame starting
    3.10 +at a fixed point in memory. After it writes 200 or so bytes, it jumps
    3.11  directly to what it just wrote. In my run, I use this program to write
    3.12  another bootstrapping program that can write any number of bytes to
    3.13  any location in memory, and then jump to any location in memory. This
    3.14 @@ -462,17 +462,17 @@
    3.15  in with impunity. At the end, I toss the 0xFF away to reveal the
    3.16  completed bootstrap program.
    3.17  
    3.18 -The final payload program is actually multiple programs. I created a
    3.19 -reduced form of MIDI and implemented it in gameboy machine
    3.20 -language. Then I translated a midi file from
    3.21 -http://www.everyponysings.com/ into this reduced MIDI language. The
    3.22 -payload program contains both the music data and the MIDI interpreter
    3.23 -to play that data. The picture works in a similar way. There is code
    3.24 -to translate a png file into a form that can be displayed on a
    3.25 -gameboy, and other code to actually display that image. Both the image
    3.26 -and the display code are also written by the final bootstrapping
    3.27 -program.  Even though my final payload is rather simple, you can write
    3.28 -any program at all as the payload. The source for the sound and image
    3.29 -displaying code is at http://hg.bortreb.com/vba-clojure.
    3.30 +The final payload program is multiple programs. I created a reduced
    3.31 +form of MIDI and implemented it in gameboy machine language. Then I
    3.32 +translated a midi file from http://www.everyponysings.com/ into this
    3.33 +reduced MIDI language. The payload program contains both the music
    3.34 +data and the MIDI interpreter to play that data. The picture works in
    3.35 +a similar way. There is code to translate a png file into a form that
    3.36 +can be displayed on a gameboy, and other code to actually display that
    3.37 +image. Both the image and the display code are also written by the
    3.38 +final bootstrapping program.  Even though my final payload is rather
    3.39 +simple, you can write any program at all as the payload. The source
    3.40 +for the sound and image displaying code is at
    3.41 +http://hg.bortreb.com/vba-clojure.
    3.42  
    3.43