EXE5 credits warp using crossover battle ACE

Requires wireless adapter to access the crossover battle option on the main menu (on emulator just patch 0x08030867 to the value 0xE0)
EXE5 Team Colonel only, uses Knightman, KnightmanSP and KnightmanDS chips to execute script commands
Video: https://www.youtube.com/watch?v=Q48WKeKkk14

You'll probably need a basic understanding of the related ASE (arbitrary script execution) method we're using to trigger this: https://pastebin.com/WUrekERW

tl;dr is we're using a JP exclusive glitch to access an area past a cutscene trigger
there we can talk to a dummy NPC with an invalid script pointer and start running manipulable parts of memory as script commands
eventually we are able to call our darksoul ai, current hp, max hp, and karma as script commands
the "call____" (FC 03 __) script command doesn't do any bounds checks on the function index you pass, and the table it uses to jump includes other values past what is expected, mostly addresses to various buffers and timers
one of the addresses you can jump to is just before the player's entered crossover battle name & description
this gives you 5 bytes + 11 bytes to work with which is just barely enough for up to 3 ARM instructions
some bytes are not possible to write using the crossover battle text entry
possible characters: https://pastebin.com/ZF6xHkdz

on the main menu choose the 3rd option to enter the crossover battle menu
if this is your first time in this menu you'll immediately be prompted to enter your name and description, otherwise choose the 2nd option to open this menu
Name: "ぞぞはむ"
Description: "へバうふケゆポよゃほげ"
	10 10 9F E5
	...
	E1 02 88 E0
	B9 E9 3F EA
	81 E2 0A 00

	ldr r1, [pc, 0x10]
	...
	add r0, r8, r1, ror 5
	b 0300575C
	.dw 0x000AE281

the credits function is located at 0x08005714 and is written in THUMB
when we jump to our crossover battle payload we'll be running in ARM, not THUMB
the "bx" instruction is the only way to change to THUMB from ARM
we can't directly write "bx" to the crossover buffers since the character 0x2F is not possible
luckily 0x0300575C has the instruction "bx r0", which we can easily jump to using only 1 instruction
we can't just do "ldr r0, [pc + ...]" to load the credits address because loading into r0 requires the byte 0x00, which is the string terminator
we can get around this with clever use of Op2 in the add instruction
	0xAE281 ROR 5 = 0x08005714
	(the credits function is located at 0x08005714)
r8 has the value 1 in it when we start running our payload, so we can use it to set the THUMB bit
so the add instruction basically does this
	r0 = r8 + (r1 ROR 5)
	r0 = 1 + (0xAE281 ROR 5)
	r0 = 1 + 0x08005714
	r0 = 0x08005715

using that text entry menu writes a ton of junk in RAM that will mess up running the payload so hard reset to clear key parts of RAM

enter the crossover battle menu again and choose the 1st option
entering this menu writes your name at 0x0200B05C and description at 0x0200B06C
back out and continue your game
set up the script command "FC 03 12" and talk to shadowman to run it
	for this script command you'll need 1020 current hp, 1042 max hp, and valid karma (ex: 486)
ez credits warp

Thanks to Prof9 and luckytyphlosion for all their help and descoveries
Shoutouts to Kojima for making this all possible

===============================================================================================

so for RTA here's a rough outline of a route
if you use a dark chip at any point, start counting karma
	https://forums.therockmanexezone.com/mmbn5-how-karma-works-t4332.html
	***keep in mind exe5 has a unique glitch where the karma & hp loss functions are called twice if you run away from a battle***
	if at any point you lose track of karma run from battles until mega man becomes light again, then your next dark chip will set you to exactly 480

during lotto codes get HP+50, HP+200, HP+300, HP+400
play the game normally up until the drill comp revisits during the shadowman scenario
before heading to oran isle get knightman, knightmanSP, and knightmanDS chips, and enough zenny to buy guardian (10500z from Oran shop)
	***knightmanSP needs to be either 220 damage or 240 damage***
	***if your knightmanSP is 220 damage grab Cannon * from MainComp 1 GMD***

do the drill comp revists and when leaving oran isle jack into oran net
jack out past the cutscene trigger near where the shadowman npc is
head to scilab and trigger the clouds

jack in and head to oran and trigger the initial cutscene
grab the vacuum thing and go to the shop and buy guardian if you haven't already
backtrack to ACDC 3 and libwarp with 320 + (400+50) hp or 314 + (200) hp

use dark chips to drop to 308 maxHP (6 or 3 chip+run)
setup guardian darksoul ai combo
drop current hp to 244
raise karma to valid (486) by running away from fights and put in HP+300
setup knightman hand buffer with 244 currentHP, 608 maxHP, 486 karma
	F4 00 60 02 E6 01
	give_item(hpmem, 2)
	end()
talk to shadowman a ton until you have max hpmems

put in HP+50
use dark chips to drop to 1042 maxHP (4 chip+run), while doing so get your currentHP to 1020
raise karma to valid (486) by running away from fights

save and soft reset
setup the crossover battle payload and hard reset after
enter the first option in the crossover battle menu and back out to load the payload in the buffer

continue and setup knightman hand buffer with 1020 currentHP, 1042 maxHP, 486 karma
	FC 03 12 04 E6 01
	call_func_0x12() *our crossover battle payload*
	end()
talk to shadowman and credits warp