Crossover battle ACE

Better writeup can be found here: https://pastebin.com/1NDcK9z2

Example credits warp using crossover battle ACE
Requires wireless adapter to access the crossover battle option on the main menu (on emulator just patch 0x08030867 to the value 0xE0)
Credits warp is possible in RTA: https://www.youtube.com/watch?v=Q48WKeKkk14
EXE5 Team Colonel only, uses Knightman, KnightmanSP and KnightmanDS chips to execute script commands

You'll probably need a basic understanding of this to follow: https://pastebin.com/WUrekERW

tl;dr is we're using a JP exclusive glitch to access an area past a cutscene trigger
there we can talk to a dummy NPC with an invalid script pointer and start running manipulable parts of memory as script commands
eventually we are able to call our darksoul ai, current hp, max hp, and karma as script commands
the "call____" (FC 03 __) script command doesn't do any bounds checks on the function index you pass, and the table it uses to jump includes other values past what is expected, mostly addresses to various buffers and timers
one of the addresses you can jump to is just before the player's entered crossover battle name & description
this gives you 5 bytes + 11 bytes to work with which is just barely enough for up to 3 ARM instructions
we can use other script commands to write payloads elsewhere in RAM, mainly in flags
flags are the only area I've found that allow you to write arbitrary values that persist between battles, save/loads, resets, ect.

set up script command "flagSetBuffered" with buffer 0xB5 ("EA 06 B5") to write an ARM payload in flags using the 2byte frames-since-power-on value as the flag_id
	for this script command you'll need 1770 current hp, 1973 max hp, and 486 karma
	this is just barely possible with 2 HP+500s if you give yourself max hpmems & 2 expand memories using other script command setups

	buffer addr: 0x0200AE90 2 bytes
	flagSetBuffered uses: 0x020029F8 + (flag_id >> 3)
talk to shadowman repeatedly to set 1 bit at a time

you can write anywhere between 0x020029F8 and 0x020049F7
can only set bits, can't clear them so write in a free space
be careful what menus you open
if you write to your pack (which is after flags) and open your folder menu it'll mess with the flags you wrote

the downside of writing a payload to flags is you're setting 1 bit at a time using a frame counter
there's also a slight delay between when you can talk to shadowman, so setting consecutive bits will require hard resetting and setting up the script command again or just waiting a little over 18min for the 2byte value to cycle through
for full control ACE you would probably want to write the smallest payload possible in flags that would allow faster writes by reading the joypad or something

example flag payload:
	00 00 9F E5
	10 FF 2F E1
	15 57 00 08

	ldr r0,[r15,0x0]
	bx r0
	.dw 0x08005715
for this example I will be writing this payload starting at 0x02003C00
0x08005714 is the credits function and it must be called in THUMB

in the crossover battle menu use the 2nd option to set your name to: "ざぉはむ" (0C 80 9F E5)
set your description to: "ぎわひヘxxxx" where x is where you want to jump (08 F0 A0 E1 XX XX XX XX)
	so for this example I would use "ドピブバ" (01 3C 04 02)
	note: 0x00 is used as the string terminator
	      some values are impossible to write here due to the nature of the character map or something
	      for example the "bx/blx" instruction is impossible because 0x2F is not tied to a valid character
later this will be used as a payload starting at 0x0200B05C
example crossover battle payload:
	0C 80 9F E5
	...
	08 F0 A0 E1
	01 3C 04 02

	ldr r8,[r15,0x0C]
	...
	mov r15,r8
	.dw 0x02043C01

update: this shorter payload should work too
	08 F0 9F E5
	...
	01 3C 04 02

	ldr r15,[r15,0x08]
	...
	.dw 0x02043C01

	Name: "ぎわはむ"
	Description: "ドピブバ"

using that text entry menu writes a ton of junk in RAM that will mess up running the payload so hard reset to clear key parts of RAM

enter the crossover battle menu again and choose the 1st option
entering this menu writes your name at 0x0200B05C and description at 0x0200B06C, both converted to a different character map
	probably boktai's if I had to guess
	1 byte per character
back out and continue your game
set up the script command "FC 03 12" and talk to shadowman to run it
	for this script command you'll need 1020 max or current hp, we don't need to terminate the script with karma
talk to shadowman, the game will jump to 0x0200B03C in ARM and eventually execute our crossover battle payload at 0x0200B05C, which will jump to our flag payload, calling the credits
ez credits warp