Any Item on C Theory

Address names will be in reference to https://docs.google.com/spreadsheets/d/1QhucUVkOGwpO2d_OX8hsn61jHtYVQALj2iUag7HDiTQ/edit#gid=1277031729

When `Pause Menu Status` is set to 0x0003 or 0x000F while `Menu Type open` is the pause menu (0x0006), an item will be equipped.  Usually when equipping from the item or mask screen, the item value is loaded into `Item ID being Equipped` and the item slot is loaded into `Item/Mask Slot being Equipped`.  Just setting `Pause Menu Status` shortcuts some parts of the equip routine, which causes it to still equip but malfunction slightly.  Whatever value is in `Item ID being Equipped` is added to 0xFF91 (past 0xFFFF wraps back to zero), and the least significant byte of the result is the value of the equipped item.  `Item/Mask Slot being Equipped` is, in this scenario, always set to 0x0001.

The fact that generic overflows that reach that far nuke the graphics pointers is a problem, because then the menu would just crash.  The debug menu and bomber's notebook, however, function even while the graphics pointers are corrupted.  And, luckily, the method of equipping I laid out above will take effect while the debug menu is open over the pause menu.  So for equipping arbitrary item values onto a C button we would need to manipulate the following:

`Menu Type open` to 0x0006
`Debug Menu open` to 0x0001 or 0x0002
`Bomber's Notebook open` to nonzero
`Pause Menu Status` to 0x0003 or 0x000F
`Item ID being Equipped` to any desired result

The equip should happen while the debug menu is up.  Since the OoT save screen isn't up and the graphics pointers are presumably kaput, the game should crash on closing the debug menu.  That's where this trick by Exodus comes in (https://www.youtube.com/watch?v=0iNRvpeKmjQ), which as far as I can tell should work using gossip stone timestop to play SoS as you're walking into a loading zone (just to skip a big hover).  You should then load into the next area with your shiny new fishing rod (or whatever) equipped.

It's unfortunate that item slot gets written over with a static value and doesn't appear manipulable.  If we could do a normal equip and then one of these "fake" equips without leaving the menu, the slot would be something we could manipulate.  If anyone's interested in looking into this further, the slot value gets written over by code at 80751934 (J 1.0).  There's a branch above it, 807518F8, which for a normal equip always branches but fails to do so for a "fake" equip.  The condition for that branch comes from a value at 80760C10 which is initialized to 0 when the pause menu is brought up.  Usually when beginning an equip it is set to 3, but the "fake" equip skips this.  I don't particularly see a way around this.