Level 4

Method
======

- Bomb bombable wall from slot 7 bomb. Feel free to s+q, mirror etc. $03C4 should remain 0x70 until
  you use all your ancilla slots or use lamp in slot 2, which is easily avoidable.

  This doesn't seem to work on the overworld.

- Populate memory with 0xA, 0x13 or 0x3C

  One setup that lets you spawn arbitrary ancillae, makes you visit certain screens which has sprites that
  set up $0C9A[0x10] with the overworld or screen index you're on.

  $0C9A[0x10] is far enough that when the ancilla is spawned, it writes its Y coordinate into the ancilla slot
  array, making it possible to spawn any ancilla we want, by changing Y

  It's possible to S+Q after visiting.

  OW places to set up memory (only LW):
  - DM cave (where we usually DMA) (ow idx 0xA)
  - Sanctuary (ow idx 0x13)
  - Great Swamp SE (just east of swamp entrance) (ow idx 0x3C)

  UW places:
  - PoD, Stalfos Trap (0x0A)
  - TRock Pokey 1 (key) (0x13)
  - Hookshot cave (0x3C)

  Overworld is probably best in terms of flexibility, since you can theoretically spawn 16 sprites in
  any screen with bushes, bottle contents etc. which should fill up $0C9A[0x10].

- Once $0C9A is filled up, travel to where you want to use the oobmisslots glitch. Note that any screens
  you travel through might put new values into $0C9A[0x10].

- Once set up, use up slot 0-4 (or 0-1 for bombs) and try to spawn an ancilla. The distance between 0C4A and 0C9A works such that if $0C9A is 0x3C, then the y coordinate of the spawned ancilla will be put into ancilla slot 0 ($0C4A), $0C9B will use $0C4B etc.


Receive Item
============
Ancilla index: $22

$0C5E = Y high (based on which screen you are on, see $21), which is the item you will receive
    01 master sword
    0F bombos
    10 ether
    17 heart piece (works if you have 3?)
    20 crystal
    26 heart container (works)
    37 pendant
    38 pendant
    39 pendant

$0C54 = X low which changes some logic?
    0 = text
    1 = ?
    2 = sprite
    3 = object

I only got Heart Container to work. I think rupees should work too.

Bird
====
Ancilla index: $27

$0C22,X = X velocity, needs to be set first. Shoot arrow rightwards before misslotting.

$0385,X = 0 for "Pick up logic" (plaid) and nonzero for "Drop off logic" (you basically just get invuln fora few secs). Use hookshot before misslotting.


Milestone item
==============
Ancilla index: $29

$0C5E,X = item to receive? Set from Y high

$0403 = "Countdown timer for special objects".
        You want highest bit to be set (0x80+), else the item just terminatse on spawn.

        In other words, you will only receive items in boss rooms or rooms where you have
        manipulated the boss flag in.

        This will give you just about anything it seems. https://puu.sh/DLuul/dc4c7d0615.png
        Including arbitrary pendants. Or glitched non-existent items https://puu.sh/DLuCa/f02513c7dd.png.

        Need to misslot to slot 2 for this memory to be affected.
        In that case, use fire rod or something that doesn't set a timer in $03B1,X.

        You can also use this to manipulate $0401 and upwards. In which case, don't use fire rod.

        $0403 which is room data (chest opened, boss killed, crystals gotten), will be stored to SRM.
        So you can delete bosses, pick up items multiple times pretty easy with this.


Weathervane duck
================
Ancilla index: $38

Idk it just worked on first try. It will give you flute at end of animation.

Will softlock if messing with menu/select menu when he leaves.


Lamp flame
==========
Ancilla index: $2F

Doesn't work. Torches are torched not from the ancilla.


Rod shot
========
Ancilla index: $02

$0C5E,X = If 0, it's a traveling rod shot. If not it will be "ConsumingFire". Set from X low.

Will light torches or hit enemies if misslotted. You can give the slot no speed (it will stay on screen, standing still) or diagonal speed or whatever you want.


Arrow
=====
Anilla index: $09

I've seen it spawn and move like a normal arrow. I assume it will hit sprites but haven't tested.


3D crystal cutscene
===================
Ancilla index: $3E

Goes through this array, indexed by $A0:

0600 5a00 2900 9000 de00 a400 ac00 0d00
b888 da88 9788 3bbd 48c0 a8c0 da88 f288
c220 a522 8dc2 0fa5 208d c40f e220 228f
e607 a5b0 0aaa 7c6e 889c 6804 a907 8d90
06a5 1148 228d d301 6885 11a9 1f8f 07c0
7ea9 008f 0bc0 7ee6 b060 c220 a900 008f
09c0 7e8f 07c0 7ea9 1f00 8f0b c07e 9ca6
0ae2 209c 4606 9c42 06e6 b060 af05 c07e
f00f 2244 e900 af07 c07e f004 2244 e900
60e6 b060 2073 8cad 6804 d00d ee68 049c
8e06 9c90 06a9 0585 1160 5189 5d89 948a
8989 ca89 b589 ca89 308a 3bbd bc89 a789
bc89 d189 9ac0 948a b08a c220 a522 8dc2
0fa5 208d c40f e220 a5b0 f00c c907 9004
223f df00 22b4 b801 228f e607 a5b0 0aaa
7c08 89ad 5804 4820 ae8b 688d 5804 6022

Supposed to only do the first row.
The other ones that works (since this is 16 bit CMP) is rooms:
- A9 (EP, big chest)
- 1F (IP, big key)
- E9 (Empty clone) Gives
- DF (Cave) Gives 06

When spawned in OW, you skip the cutscenes (also, it works).

It will give you the same crystals every time on OW, since it uses $040C as an index.

https://milde.no/public/alttp/clips/freecrystals.mp4


$040C
=====

By having $CA5/$CA6 (slot 0x5B/0x5C) be a replacable value, you can overwrite $040C[0x2] which is used as
a dungeon ID in some routines, like the one figuring out which big keys to give you, or
which crystals to give you (with the OW crystal glitch above)

Actually a lot of stuff in $0400-$04200 is overwritable now. You can get conveyor effect on link, become tempbunny, secrets in room can be revealed automatically, room flags removed etc.



Routines
========

It does AND #$7F, so the same values repeat. I dont remember what $80 would be but it crashed anyways.

    |  0    1    2    3    4    5    6    7    8    9    A    B    C    D    E    F
----+--------------------------------------------------------------------------------
0 8 |      851b 86d2 8852 8d19 90fc 93e8 955a 9fda a155 a47f a501 dde9 ddee a632 a632
1 9 | a632 a55a a632 8435 a831 a833 a909 a9cd aac4 b0f2 bad4 93ff b68e bbe0 bcb6 bd98
2 A | c037 c0b8 c3ae d3e0 ee13 a907 d67e de0c c716 cab0 d7d6 d921 e377 e9fa eb50 ec25
3 B | db48 dc94 aa59 a632 efac c283 cfce d061 d1fc ea95 f19f c18b c20e ca25 cc16 d53d
4 C | d4be ecc1 c802 ccc4 0702 0106 0701 0107 0700 0108 0904 ff04 0302 0708 0101 0707
5 D | 0001 0807 04ff 0409 8383 8383 80b6 80b6 b6b7 b6b7 b6b7 b6b7 68bd d00c 9e03 0c4a
6 E | 11a5 06d0 8020 2090 908b 2a20 a086 a904 d90b 0c4a 03f0 1088 b9f8 0280 04f0 30a9
7 F | 0485 10a9 b3ac f00f bc11 0c7c 06d0 8c22 0dba 0a80 9022 0dba 0480 8022 0dba 00a0

5F = EOR $000000,x
69 = ADC #$20
AE = ..
EB

90 b8 5f (A0 = 60)
BCC $0C04

5f 00 00 00 90 b4
EOR $000000,x : BCC $0C04

5f 20 20 20   : A2 1B    : 8E 10 : ..
EOR $202020,x : LDX #$1B : STX $10 : ..

WORKING SETUP:
==============

080c4a adc #$20               A:080c X:0000 Y:00d0 S:01e5 D:0000 DB:08 nvMXdizc V: 52 H:208 F:17

1. Get 0x70

$0C9A

$0BF0:
A9 19    : 85 10   : 60
LDA #$19 : STA $10 : RTS

$0C4A:
69 20    : 90 A2
ADC #$20 : BCC $0BFA

69 = JMP $0C4A
20 = BedSpread (stable always)
90 = BlastWall
A2 = ReceiveItem


1. Do:
- Get Lamp
- Get Somaria
- Get Boots
- Bombable wall from slot 7 ($03C4 = 0x70)

2. Go to DM cave (above DMA)

3. Fill sprites by bonking tree ($0C9A[0x4] = [0x0A, 0x0A, 0x0A, 0x0A])

4. Move down, right, bonk the stone, jump down ledge, move left & wait for guard (2-3 times?)

5. Hopefully $0C9A[0x4] is 0xA and the rest is not.

6. Set up stuff & do the thing.


- Need $0BF0 to be A9 19 85 10 60 (LDA #$19 : STA $10 : RTS). This can be done by just using an item on different y coords.
- Need to set up some other variables too, for the payload to $0C4A, else the spawned ancillae might not be stable (there could be better payloads but this one works at least)
- Misslot  in order from right to left: 69 20 90 A2 (ADC #$20 : BCC $0BF0).

Slot 0: $69 is the one that jump to $0C4A
Slot 1: $20 is Link's bed and is very stable
Slot 2: $90 is "wall blast" and is pretty stable, but not always. Need to prep some slot 2 value in some ancilla array to make it last longer.
Slot 3: $A2 is "receive item" and is often not very stable. Again need to prep some stuff to make it last for at least a few seconds.

A2 can be replaced with other things like A3 (bunny poof) or A4 (grave stone in motion) and be more stable. However, then the jump into Y coords would make it so the payload to $0BF0 will need slot 5+. While slot 0-4 is free. I'm not sure how to even do that, I guess you'd need red boom or some other item. Or set it up before you do the slot 7 bombable wall perhaps, with a normal misslot.