G-Mode Save Station
During G-Mode, the game behaves in some ways as though X-ray scope were still active. The most noticeable are that the game does not process PLMs or projectiles. Stepping on a save station in G-Mode, and subsequently activating X-Ray to leave G-Mode, can execute a wide amount of code, most often crashing the game if done blindly, but can grant Samus any item in the game. This is used in the Glitched RBO world record route to obtain Gravity Suit.
Functioning
The game stores lists for each PLM, located in bank $84, of pointers to functions, and arguments for those functions. These are called instruction lists. There is a section of RAM from $1D27 through $1D76 where the game loads these pointers for running functions related to processing PLMs. For the save station, the pointer is loaded into $1D75 (the game starts at the top of this range and works downwards. Since save rooms have two PLMs that are processed when entering the room: first the door, and then the save station). In G-Mode PLMs aren't processed, and when Samus steps on the save station, $1D75 starts increasing by $02 every other frame, starting with whatever PLM instruction the game was last trying to execute. When entering a save room, $1D75 will contain $AFEC, which is a pointer to a sleep instruction (save station does nothing until Samus attempts to interact with it).
After stepping on a save station in G-Mode, and X-Ray is activated, and G-Mode left, the game will look at whatever value is in $1D75, and interpret those two bytes as a location of a pointer in bank $84. For collecting items, you'll need to stop on a correct byte in order to be granted the item (see list below). Every item in the game has three variants: normal, hidden, and in a chozo orb; and either of these will work for obtaining the item. However, the instruction lists for these variants are so far apart in the ROM that it is irrelevant. Therefore, using the one that appears first in the ROM (the normal, not hidden or orb variant) makes the most sense. The game will either crash or do something else unexpected if X-Ray is not pressed in the two-frame window. It can also matter how long the dash button is held down to activate X-Ray.
It is also possible to spawn energy refill and map stations (though unusable as they will spawn too close to the floor, on the left tile of the bottom of the save station), Samus Eaters (Vileplumes), shot blocks, door caps, and basically any other PLM. It is also possible to execute a lot of other code, with mostly unknown or undocumented results (or most likely, a crash).
Relevant Locations
$1D27 through $1D75 in RAM, though $1D75 seems to be the relevant address.
Pointer locations for collecting items. When watching $1D75 in RAMwatch, it should contain the following location in order to obtain the item:
Energy Tank $E0B6 Missile $E0D6 Super Missile $E100 Bomb $E152 Charge Beam $E180 Ice Beam $E1AE Hi-Jump Boots $E1DC Speed Booster $E20A Wave Beam $E238 Spazer $E266 Spring Ball $E294 Varia Suit $E2C8 Gravity Suit $E2F6 Plasma Beam $E358 Grapple Beam $E386 Space Jump $E3B8 Screw Attack $E3E6 Morphing Ball $E414 Reserve Tank $E442
TODO: add other pointer locations that are known to at least do something other than crash, or potentially could do something useful.
