### To get wrong pocket TM17

BOX NAMES (boxes 1 to 5) - https://i.imgur.com/Ts8QRXT.png

Use Coin Case with Quagsire @ TM02 - Return

; d8bf - BOX 1
add b
; Entry point
xor a
or $d0
ld [$f5b8], a ; write TM17 to items pocket item #1
pop hl
ld d, b

; d8c8 - BOX 2
sub $d5
sub $ea ; a = 0x11
ld [$f8d1], a ; write 'ld de' of ld de, $f8d0
and a
ld d, b

; d8d1 - BOX 3
db $d0, $d0, $f8 ; <-- this becomes ld de, $f8d0
sub $ff ; a = 0x12
add sp, $ff
push de

; d8da - BOX 4
ld [$f8e6], a ; write '12' of jp nc, $12f5
and a
and a
and a
and a
and a
ld d, b

; d8e3 - BOX 5
and a
db $d2, $f5, $f5 ; <-- this becomes jp nc, $12f5
db $50, $50, $50, $50, $50

-----

### To get TM09

BOX NAMES (box 1) - https://i.imgur.com/PLlSVww.png

Use TM17 with quagsire @ TM02 - Return

; d8bf - BOX 1
add b
; Entry point
xor a
or $ff
ld [$f586], a
ret nc
ld d, b

-----

### To use TM17 as a memory editor

BOX NAMES (boxes 2 to 10) - https://i.imgur.com/PLlSVww.png

Rename Box 1 as address+value code.
Give Quagsire TM09, then use TM17.

; d8bf - BOX 1
; address + value code

; d8c8 - BOX 2
xor a
sub $a0
sub $a1 ; a = 0xbf
ld [$f8e7], a ; write 'l' of ld hl, d16
ld d, b

; d8d1 - BOX 3
sub $9e ; a = 0x21
ld [$f8e6], a ; write 'ld hl' of ld hl, d16
sub $fe ; a = 0x23
ei
ld d, b

; d8da - BOX 4
ld [$f8f8], a ; write inc hl
sub $f9 ; a = 0x2a
ld [$f8f6], a ; write ld a, [hli]
ld d, b

; d8e3 - BOX 5
and a
and a
and a
db $f8, $f8, $f8 ; <-- this becomes ld hl, $f8bf
and a
and a
ld d, b

; d8ec - BOX 6
call nc, $f8fe
and a
and a
and a
db $ea, $ea, $50 ; <-- this becomes ld [<address>], a

; d8f5 - BOX 7
ret nc
hl_reads_d8f6:
db $f8 ; <-- this becomes ld a, [hli]
add [hl]
db $f8 ; <-- this becomes inc hl
and a
ret nc
db $50, $50, $50

; d8fe - BOX 8
shifted_code_d8fe:
call nc, $f8f6
and a
ld [$f8f4], a ; write high byte of address
and a
ld d, b

; d907 - BOX 9
call nc, $f8f6
and a
ld [$f8f3], a ; write low byte of address
and a
ld d, b

; d910 - BOX 10
call nc, $f8f6
ret nc ; return value in a
db $50, $50, $50, $50, $50

-----