Pokémon Red, Green, Blue, Yellow - Unused trade script ACE

How to access the unused trades with arbitrary code execution:

English Pokémon Yellow:
-----
Steps:

1) Obtain a "ws m" (hex:63) with the x-coordinate looping map trick (https://www.youtube.com/watch?v=98_azamLeh4), which requires a glitch that expands the items pack such as dry underflow (https://www.youtube.com/watch?v=ZyppANEvnh8). "ws m" initially runs from DA7F+ (number of stored PC Pokémon). ws m executing arbitrary code was documented by TheZZAZZGlitch.

2) Use a payload that redirects the code flow to inventory item 3.

Example:
(Made by pigdevil2010)

Have exactly 10 Pokémon in the current box as follows:

Tangela with 233 HP
Nidoking
Metapod
Haunter
Flareon
Parasect
Growlithe
Tentacool
Grimer
Any Pokemon

(Note: In this video I used TheZZAZZGlitch's older longer payload with a Slowpoke that has 233 HP http://forums.glitchcity.info/index.php/topic,6638.msg189586.html#msg189586)

3) Have the following items in item 3, and then use ws m to run the code.

Lemonade x(trade ID you want)
TM34 x61
TM05 x 4
Repel x 84
Poké Ball x123
TM05 x180
Lemonade x195
TM10 x35
TM01 x01

This represents the following code:
ld a, xx
ld (CD3D),a
inc b
ld e,54
inc b
ld a,e
call 3EB4
jp 23D2
ret

As opcodes and operands, this reads:
3E XX EA 3D CD 04 1E 54 04 7B CD B4 3E C3 D2 23 C9 (01)

English Pokémon Red:
-----
Since 8F relies on your current party Pokémon, it may not be a good idea to use 8F for this (as you may not be able to have Pokémon to trade or trading could mess up the payload) unless you have a compact set up that could be set up first with a more advanced set up (e.g. three-five Pokémon, Pokémon 1 as h Poké (hex:C3), Pokémon 2 as Onix (hex:22), Pokémon 3 as the hex:D3 or hex:F3 glitch Pokémon D322, Pokémon 4 and 5 do not matter).

This is a compact set up by luckytyphlosion that requires 6 Pokémon and redirects the code flow to Item 4, which could be used to set up the compact three Pokémon set up. http://forums.glitchcity.info/index.php/topic,6638.msg198585.html#msg198585

Alternatively, we can use the glitch item "-g m" (hex:6A) which runs through stored Pokémon like Yellow's "ws m".
-g m executing arbitrary code was documented by a Glitch City Laboratories user named "memdump" (http://forums.glitchcity.info/index.php/topic,6638.msg196498.html#msg196498). (Another video showing "-g m": https://www.youtube.com/watch?v=B1E4msXNaYY)

Steps:

1) Obtain a "-g m" (hex:6A) with the x-coordinate looping map trick (https://www.youtube.com/watch?v=98_azamLeh4), which requires a glitch that expands the items pack such as dry underflow (https://www.youtube.com/watch?v=ZyppANEvnh8). "-g m" executes code from DA47, which is 0x39 bytes before the beginning of the PC list, DA80.

2) Values including W_NUMSAFARIBALLS, W_DAYCARE_IN_USE, W_DAYCAREMONNAME, W_DAYCAREMONOT, wDayCareMon between DA47-DA80 should be 00 or harmless code for the game to run through to DA80.

3) Use a payload that redirects the code flow to inventory item 3:

Example (modified from Pigdevil2010's ws m payload, Growlithe>Onix):

Tangela with 233 HP
Nidoking
Metapod
Haunter
Flareon
Parasect
Onix
Tentacool
Grimer
Any Pokemon

4) Have the following items in item 3, and then use -g m to run the code.

Lemonade x(trade ID you want)
TM34 x61
TM05 x 4
Repel x 84
Poké Ball x123
TM05 x109
Lemonade x195
TM15 x36
TM01 x01

This represents the following code:
ld a, xx
ld (CD3D),a
inc b
ld e,54
inc b
ld a,e
call 3E6D
jp 24D7
ret

As opcodes and operands, this reads:
3E XX EA 3D CD 04 1E 54 04 7B CD 6D 3E C3 D7 24 C9 (01)

Japanese Pokémon Green v1.0:
-----
In Pokémon Green v1.0 and v1.1, てへ (hex:7B) executes code from D806 which is wild encounter data.

Note that in Green v1.1 (where the below items code may have to be adjusted if any addresses, or if the PreDef value is different), it must be used when there is a 50h tile early on the screen (e.g. here the bottom-left corner of a bush tile in overworld places due to its name being slightly different. This is a suitable place to use the item http://i.imgur.com/vXbRIKc.png (the picture applies to all other Generation I games and "long-name glitch items" as well) to avoid a freeze.

When the player talks to the old man; their name is stored in this region before D806 (containing the first letter) is replaced with 00 after the battle. Hence, with a specific player name the player can create a short payload to item 3.

てへ was documented by memdump in this post. http://forums.glitchcity.info/index.php/topic,6638.msg196500.html#msg196500
(Another video showing "てへ": https://www.youtube.com/watch?v=B1E4msXNaYY)

Steps:
1) Have the player name as "(any character)てルめ" (jp D2A6). This acts as a payload to item 3.
2) Obtain a "てへ" (hex:7B) by digging it up from Cycling Road with a y-coordinate of 123.
3) Talk to the old man in Viridian City and say いいえ ("no") to watch his catching demonstration.

4) Have the following items in item 3, then use てへ to run the code.

Lemonade x(trade ID you want)
TM34 x61
TM05 x 4
Repel x 84
Poké Ball x123
TM05 x157
Lemonade x195
Gold Badge (Hex:6A; "ゴールドバッヂ", not ゴールドバッジ) x15
TM01 x 1

This represents the following code:
ld a, xx
ld (CD3D),a
inc b
ld e,54
inc b
ld a,e
call 3E9D
jp 0F6A
ret

As opcodes and operands, this reads:
3E xx EA 3D CD 04 1E 54 04 7B CD 9D 3E C3 6A 0F C9 (01)

Japanese Pokémon Blue:
-----
In Japanese Blue, the long name item (hex:7B) executes code from D806 just like in Japanese Green. However, it must be used when there is a 50h tile early on the screen (e.g. here the bottom-left corner of a bush tile in overworld places. This is a suitable place to use the item http://i.imgur.com/vXbRIKc.png) to avoid a freeze.

Steps:
1) Have the player name as "(any character)てルめ" (jp D2A6). This acts as a payload to item 3.
2) Obtain a hex:7B item by digging it up from Cycling Road with a y-coordinate of 123.
3) Talk to the old man in Viridian City and say いいえ ("no") to watch his catching demonstration.

4) Have the following items in item 3, then use hex:7B to run the code.

Lemonade x(trade ID you want)
TM34 x61
TM05 x 4
Repel x 84
Poké Ball x123
TM05 x 177
Lemonade x195
イﾞピま (hex:B7) x36 (available with make your own items glitch with the second character as "き" https://www.youtube.com/watch?v=L16bVsyZI10; and character ID greater than $24, http://hax.iimarck.us/topic/274/ then the item can be tossed to obtain the correct quantity. Possibly accessible with a y-position looping map trick as well [swap an item with an ID greater than the y boundary into the y-coordinate item and move down].
TM01 x1

This represents the following code:
ld a, xx
ld (CD3D),a
inc b
ld e,54
inc b
ld a,e
call 3EB1
jp 24B7
ret

As opcodes and operands, this reads:
3E XX EA 3D CD 04 1E 54 04 7B CD B1 3E C3 B7 24 C9 (01)

Japanese Pokémon Yellow v1.0:
-----
In Japanese Yellow v1.0, Japanese Yellow Rev A, Rev B and Rev 3, the item "かいがらバッヂ" (hex:63) activates code at D9B2 (number of stored Pokémon in the box), just like in English Pokémon Yellow.

In 2013, Wack0 was looking into arbitrary code execution items for Japanese Yellow and found the execution pointer. TheZZAZZGlitch explained that hex:63 executed D9B2 and that D9B2 was the number of stored Pokémon in the box. http://forums.glitchcity.info/index.php/topic,6638.msg192561.html#msg192561

Steps:
1) Obtain a hex:63 item by digging it up from Cycling Road with a y-coordinate of 99.
2) Use a payload that redirects the code flow to inventory item 3.

Example (presented by Wack0, modified from TheZZAZZGlitch's English "ws m" payload):

1.  20 Pokémon in your PC box                                         [0xD9B2 = 0x14]
2.  Slowpoke as the 1st Pokémon in the current PC box                 [0xD9B3 = 0x25]
3.  Slowpoke as the 2nd Pokémon in the current PC box                 [0xD9B4 = 0x25]
4.  Slowpoke as the 3rd Pokémon in the current PC box                 [0xD9B5 = 0x25]
5.  Slowpoke as the 4th Pokémon in the current PC box                 [0xD9B6 = 0x25]
6.  Slowpoke as the 5th Pokémon in the current PC box                 [0xD9B7 = 0x25]
7.  Slowpoke as the 6th Pokémon in the current PC box                 [0xD9B8 = 0x25]
8.  Voltorb as the 7th Pokémon in the current PC box                  [0xD9B9 = 0x06]
9.  Raticate as the 8th Pokémon in the current PC box                 [0xD9BA = 0xA6]
10. Jolteon as the 9th Pokémon in the current PC box                  [0xD9BB = 0x68]
11. Geodude as the 10th Pokémon in the current PC box                 [0xD9BC = 0xA9]
12. Geodude as the 11th Pokémon in the current PC box                 [0xD9BD = 0xA9]
13. Geodude as the 12th Pokémon in the current PC box                 [0xD9BE = 0xA9]
14. Geodude as the 13th Pokémon in the current PC box                 [0xD9BF = 0xA9]
15. Geodude as the 14th Pokémon in the current PC box                 [0xD9C0 = 0xA9]
16. Geodude as the 16th Pokémon in the current PC box                 [0xD9C1 = 0xA9]
17. Geodude as the 15th Pokémon in the current PC box                 [0xD9C2 = 0xA9]
18. Geodude as the 17th Pokémon in the current PC box                 [0xD9C3 = 0xA9]
19. Geodude as the 18th Pokémon in the current PC box                 [0xD9C4 = 0xA9]
20. Geodude as the 19th Pokémon in the current PC box                 [0xD9C5 = 0xA9]
21. Voltorb as the 20th Pokémon in the current PC box                 [0xD9C6 = 0x06]
 :: END OF LIST MARKER [0xFF]                                         [0xD9C7 = 0xFF]
22. Slowpoke as the 1st Pokémon in the current PC box                 [0xD9C8 = 0x25]
23. First PC box Pokémon needs to have 233 HP                         [0xD9C9 = 0x00]
                                                                      [0xD9CA = 0xE9]

3) Have the following items in item 3, and then use かいがらバッヂ to run the code.

Lemonade x(trade ID you want)
TM34 x61
TM05 x 4
Repel x 84
Poké Ball x123
TM05 x 173
Lemonade x 4
TM10 x255
HP Up x201

This represents the following code:
ld a, xx
ld (CD3D),a
inc b
ld e,54
inc b
ld a,e
call 3EAD
jp nc,23FF
ret

As opcodes and operands, this reads:
3E XX EA 3D CD 04 1E 54 04 7B CD AD 3E 04 D2 FF 23 C9


Basis
-----

This is an original in-game trade script from Pokémon Red:

Route2HouseText2: ; 0x1def9
	db $08 ; asm
	ld a, $1
	ld [W_WHICHTRADE], a
	ld a, $54
	call Predef
	jp TextScriptEnd

The register "a" is written as $01 to be written to $CD3D; which then controls the NPC's text if execution of the predefined command $54 follows.

For these arbitrary code executions we run the same code with the exception that $08 is omitted ($08 is a text command that indicates a normal text box to execute code, and we don't need it because the game is not in normal text mode and we are already executing code), some minor adjustments to make the code representable as items that are OK, and we write our own value for 'a' manipulable by altering item 3 quantity to access any trade.

The code is not the same between versions because the locations of the Predef and TextScriptEnd routines are different, whereas the W_WHICHTRADE address remains as CD3D and the Predef command ID remains at $54 between all five versions I have tested.

Predef pointers:
Yellow - 3EB4
Red - 3E6D
Green v1.0 - 3E9D
Japanese Blue - 3EB1
Japanese Yellow v1.0 - 3EAD

TextScriptEnd pointers:
Yellow - 23D2
Red - 24D7
Green v1.0 - 0F6A
Japanese Blue - 24B7
Japanese Yellow v1.0 - 23FF