1. I believe 0x1928 IWRAM is the RNG. A trace log of how it updates:
0802C58D: 00008820 LDRH r0, [r4] r0:00000000 r1:02036F9C r2:0201B4A0 r3:02003B10 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C58C r16:6000003F
0802C58F: 00008008 STRH r0, [r1] r0:00004B51 r1:02036F9C r2:0201B4A0 r3:02003B10 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C58E r16:6000003F
0802C591: 00004B0A LDR r3, [PC, #40] r0:00004B51 r1:02036F9C r2:0201B4A0 r3:02003B10 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C590 r16:6000003F
0802C593: 00002000 MOV r0, #0 r0:00004B51 r1:02036F9C r2:0201B4A0 r3:02036FA0 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C592 r16:6000003F
0802C595: 00005E0A LDRSH r2, [r1, r0] r0:00000000 r1:02036F9C r2:0201B4A0 r3:02036FA0 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C594 r16:6000003F
0802C597: 00000050 LSL r0, r2, #1 r0:00000000 r1:02036F9C r2:00004B51 r3:02036FA0 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C596 r16:6000003F
0802C599: 00001880 ADD r0, r0, r2 r0:000096A2 r1:02036F9C r2:00004B51 r3:02036FA0 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C598 r16:6000003F
0802C59B: 00008018 STRH r0, [r3] r0:0000E1F3 r1:02036F9C r2:00004B51 r3:02036FA0 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C59A r16:6000003F
0802C59D: 0000785A LDRB r2, [r3, #1] r0:0000E1F3 r1:02036F9C r2:00004B51 r3:02036FA0 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C59C r16:6000003F
0802C59F: 0000780B LDRB r3, [r1] r0:0000E1F3 r1:02036F9C r2:000000E1 r3:02036FA0 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C59E r16:6000003F
0802C5A1: 000018D0 ADD r0, r2, r3 r0:0000E1F3 r1:02036F9C r2:000000E1 r3:00000051 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C5A0 r16:6000003F
0802C5A3: 00007008 STRB r0, [r1] r0:00000132 r1:02036F9C r2:000000E1 r3:00000051 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C5A2 r16:6000003F
0802C5A5: 0000704A STRB r2, [r1, #1] r0:00000132 r1:02036F9C r2:000000E1 r3:00000051 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C5A4 r16:6000003F
0802C5A7: 00008808 LDRH r0, [r1] r0:00000132 r1:02036F9C r2:000000E1 r3:00000051 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C5A6 r16:6000003F
0802C5A9: 00008020 STRH r0, [r4] r0:0000E132 r1:02036F9C r2:000000E1 r3:00000051 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C5A8 r16:6000003F
0802C5AB: 00007808 LDRB r0, [r1] r0:0000E132 r1:02036F9C r2:000000E1 r3:00000051 r4:03001928 r5:02007CA0 r6:030043D0 r7:0000000A r8:00000000 r9:00000000 r10:00000000 r11:00000000 r12:02000800 r13:03007C80 r14:080103A3 r15:0802C5AA r16:6000003F
Which after messing around, I believe the corresponding lua code would be:
Download rng.luaLanguage: lua
function next_rng(value)
local temp1 = bit.rshift(3 * value,8) --value + lshift value by 1 is value + 2*value = 3 * value!
local temp2 = bit.band(value, 0xFF)
local result = bit.band(temp1 + temp2, 0xFF) + (temp1 * 256)
return bit.band(result, 0xFFFF)
end
Or a simplified version:
Download rng.luaLanguage: lua
function next_rng(value)
local x = bit.rshift(3 * value,8) --This is floor(3*value/256)
local r = bit.band(x + value, 0xFF) + (x * 256) --bit.band same as mod 256
return bit.band(r, 0xFFFF) --Same as mod 65536
end
On reset, this seems to start at 0xD37 (3383 in decimal), loaded from 0x0015FD4 in ROM. This gives different values for 43,534 calls, before looping back to 0xD37. Pretty sure it's RNG since freezing it gives consistent results for things like hits. So now it's possible to make a giant table of 43,534 entries to determine where in the loop is the RNG right now so far, and potentially how much needed to wait to get a better RNG.
2. I believe each entity in battle has their own address determining criticals. For NPCs at least, it seems to be the address base + 0xA0, where base is 0x01CD20, 0x01CE8C, 0x01CFF8 in EWRAM. Need to check if it's the same offset for team members. Setting it to 4 makes hits critical for the corresponding NPC's attack.
3. I think I found addresses relating to battle state. While I used Combined WRAM, it's probably all EWRAM:
0x01CCC4 - something?
0 - Nothing; turn occurs then you do nothing, and get to select stuff again
1 - The state right before you attack
2 - Same as 1?
3 - Dealing damage
4 - Defeat; makes enemy Xp yield add to total
5 - Attack yourself
6 - Enemy flees
7 - ?
0x0196AF
0 - No idea, but freezing to 0 makes you remain in fight, even if 0 opponents
1 - You lose
2 - You win
3 - You lose
4 - transit to XP screen?
5 - You lose (probably different than above; need to check with bosses)
6 - You win
17 - Last several bosses defeats you (you dont respawn; battle just ends)
Also I think battle interfaces are nearby
0x019690
0 - Battle start! (Set it to 0 to reload battle with new NPC)
1 - Battle (select items, attack, etc)
2 - State before attack
3 - Attacking
4 - State before going back to 1
5 - Enemy defeated or you ran away
6 - No idea, disables menus
7 - XP screen
8 - Recruit (Set this to auto recruit; fantastic! Works on bosses too)
9 - Transits to overworld; counts as defeat bosses; (only works if not in menu)
10 -Disables menu use
11 - This changes friendliness; probably from using items on them
12, 13, 14 - ?
15 - Displays something about enemy?