# smf_messages

subject: Re: Meganium Man!
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [b][u]Meganium Man! #10: Once in a Lifetime[/u][/b]<br />Simisage headed east immediately after the standoff came to its abrupt end, swinging from tree branch to tree branch behind Ecruteak City and the Burned Tower, before reaching the stone road leading to the Bell Tower, a ten storey building overlooking the antiquated city. Made of pale yellow brick with blue awnings and rafters on each floor, the structure looked magnificent and almost holy. According to legends, if someone pure of heart scales the tower to the rooftop, a legendary PokÃ©mon will appear. The monkey chuckled at the thought of such a PokÃ©mon appearing due to his â€œpure heart,â€ although he didnâ€™t rule out the possibility that Lugia would come here eventually.<br /> Truth be told, he was surprised to emerge from the standoff in one piece. His unborn hostage helped for sure, but even then, what was stopping Lugia or Meganium Man from ripping him limb from limb? All it would take was one sudden move to startle him, possibly resulting in him dropping the egg, allowing the dragon to reclaim it. By all accounts, the monkey shouldâ€™ve died back there.<br /> It was interesting to see that tryhard superhero wannabe working with such a powerful PokÃ©mon. Their fight, although brief, was a once in a lifetime event, a Pay per View kind of thing, and he got to witness it. He knew Lugia wasnâ€™t battling with its full strength; had he done so, Meganium Man would have been dead the instant he was struck by the wyvernâ€™s tail. Regardless of how this played out, he knew that the two would work together to try and stop him, and part of him wanted to see that. Judging by Meganium Manâ€™s attitude, he was certain that the dinosaur would confront him one on one and distract him so Lugia could rescue his baby. That was fine with Simisage; he had no use for the kid once it hatched, and even he wasnâ€™t stupid enough to kill it.<br /> Although Lugiaâ€™s composure looked calm, to Simisage, he may as well have been begging. To a common PokÃ©mon, Lugia ordered Simisage to return the egg. But what Simisage heard and saw was a PokÃ©mon desperate to reclaim the only thing it had left to live for. He was there when Lugiaâ€™s mate died from her illness, despite his tireless efforts to try and cure her, calling upon every crackpot herbalist and hypnotherapist and acupuncturist and who knows else in the region for help. As he watched the wyvernâ€™s last breath leave her, he immediately hung up the stethoscope and cashed in his pension, and was able to live off it comfortably before running into problems after two years. <br /> He was positive the egg wouldâ€™ve hatched by the time he decided to act on his plan, but it hadnâ€™t. His calculations were off by a few days, he realized, upon doing the math in his head again. That didnâ€™t mean the egg wouldnâ€™t hatch any second now, but this complication was one heâ€™d have preferred to avoid. He wasnâ€™t in a heap of trouble so much as a mountain of it, and now, thanks to a careless math error, Simisage was the bad guy.<br /> So be it.<br /> All I need is the eggshell, he reminded himself. The money heâ€™d get for it meant heâ€™d never have to do something so idiotic again. Yeah, he still had to get it to his buyer, but that was easy enough.<br /> He opened the brown sliding door and entered the Bell Tower. Sunlight bathed its polished hardwood floor through the circular windows, and in each corner of the room was a marble statue of a phoenix-like PokÃ©mon with curved wings. In the middle of the tower was a massive support beam to keep the structure steady during storms and possibly the arrival of the phoenix. A stairway was nestled again the north wall, which Simisage climbed. <br /> Unlike the first floor, the second, third and remaining levels didnâ€™t have much in the way of a floor. In each corner was a 10x10 platform with two narrow bridges connecting to several other platforms, each one with its own ladder leading to a different part of the level above, but only one ladder on each level would lead you to the roof. Simisage had no clue which ladder went where, but he could climb the support beam if he needed to.<br /> Simisage picked a ladder at random, climbed to the third floor, and found himself in a secluded nook with a window overlooking the forest behind Ecruteak. No ladder was present, and he couldnâ€™t climb over the wall since it was conjoined to the platform above him. He was trapped but figured this room was his best bet: he had privacy, and if he needed to bail, Simisage could open the window and jump into the forest.<br /> Removing the satchel from his back, he set it down and opened it, took out the egg. It was in pristine condition, thank whatever higher power allowed that. Simisage suddenly felt victorious: Lugia wouldnâ€™t dare attack the tower directly, and if Meganium Man and the cops knew what was good for them, they would listen to his orders to back off if they found him before the egg hatched. But if he used the egg as a hostage again and they called his bluff, he would have to think of something right then and there. Now was as good a time as any, he figured.<br /> Before he could think of a plan, his PokÃ©tchâ€™s phone feature rang. He immediately answered it.<br /> â€œYes?â€<br /> â€œIâ€™ve been watching the news, Simisage. You wouldnâ€™t happen to know why a Lugia is going on a rampage throughout Johto, would you?â€<br /> Kadabra! The buyer! Simisage could picture the yellow creature twirling his whiskers as he asked that. He was positive he heard the psychic-type PokÃ©mon tap his spoon on a table in disdain.<br /> â€œMy math was off,â€ was all Simisage could say.<br /> â€œUh-huh.â€<br /> â€œThe legend goes that it takes approximately three yearsâ€”â€<br /> â€œAp-prox-i-mate-ly,â€ Kadabra interrupted, annunciating each syllable as if to mock his customer. â€œNot precisely. You shouldâ€™ve left the island the instant you saw that it hadnâ€™t hatched yet.â€<br /> The monkey was pacing back and forth in panic.<br /> â€œLook. All I need is a few more daysâ€”â€<br /> â€œNo.â€<br /> â€œâ€”I know that for a factâ€”â€<br /> â€œNo.â€<br /> â€œâ€”that itâ€™s close to hatchingâ€”â€<br /> â€œ[i]No[/i]!â€<br /> As Kadabra barked his reply, Simisage heard the spoon on the other end bend as the metal lightly creaked. Simisageâ€™s free hand clenched into a fist.<br /> â€œThe deal is off, Simisage. I never in a million years thought you would be this careless. Do you really think I want to be associated with you now? Do you really think that risking the lives of millions of people is worth it if it means I can have a new souvenir, or if you can stay retired?â€™<br /> He heard the monkey huff in frustration.<br /> â€œYou know this is a once in a lifetime opportunity, Kadabra,â€ Simisage prodded. â€œI know your IQ is 5000 but even you arenâ€™t smart enough to escape death.â€<br /> â€œFine with me,â€ Kadabra said, not really paying attention. â€œMy point stands. Go find someone else willing to buy the thing. Weâ€™re done.â€<br /> He clicked off before Simisage could get another word in. Simisage was shaking with rage and wanted to throw the PokÃ©tch at the wall, but as long as he still had time, he could try and find another buyer. With any luck, whoever he called wouldnâ€™t have heard about the little incident he caused.<br /> The voice in his head told him to call Ludicolo, but Simisage was positive the police wouldâ€™ve found out about him by now. He knew anyway that the walking lily pad duck just collected them, and didnâ€™t have an outrageous amount of funds to throw around, even if he wanted it. Ludicolo was a purist when it came to collecting, preferring to get it authentically. Buying something like a legendaryâ€™s eggshell was the equivalent of buying a celebrityâ€™s autographed picture in a pawn shop.<br /> Now, the monkey had no choice but to wait there.<br /><br />HEâ€™S AT THE BELL TOWER. Iâ€™M POSITIVE OF IT, Lugia said.<br /> The day had turned to night by now, and although the dragon was probably right, Zangoose didnâ€™t feel like taking the risk of going there and inciting another standoff. Meganium Man decided to call it a day despite wanting to rip Johto apart in pursuit of the leafy simian, and opted to accompany Lugia for the night. They flew out to the Whirl Islands, and as they arrived, Lugia used his psychic powers to separate the whirlpools and make them recede into the waterâ€™s surface, allowing him to enter. He descended through the hole in the roof and roosted on his little shore, setting Meganium Man down on the edge.<br /> â€œI wouldnâ€™t be surprised, but we should wait for Simisage to reveal himself if he is,â€ the dinosaur said in a reasonable tone. He watched Lugiaâ€™s tail as it violently swished back and forth against the towering wall behind them. â€œWeâ€™ll find him. Donâ€™t worry.â€<br /> His spiel was a meaningless one, and he knew it. If Lugia decided to resume his manhunt while he was asleep, Meganium Man was literally powerless to stop him. He couldnâ€™t imagine what the dragon would do with or to Simisage if he found him, and didnâ€™t want to. <br /> DO YOU HAVE CHILDREN, MEGANIUM MAN?<br /> â€œNo, but I have a niece.â€<br /> IF SHE WAS KIDNAPPED OR IN DANGERâ€¦ WHAT WOULD YOU DO TO KEEP HER SAFE?<br /> Without missing a beat, Meganium Man replied, â€œAnything.â€<br /> THATâ€™S WHAT I WANTED TO HEAR.<br /> Lugia obviously had more he wanted to say, but took a moment to collect the proper words. Meganium Man was positive whatever the legendary said next would be unpleasant, but itâ€™s not like the day wasnâ€™t already.<br /> YOU KNOW WHAT I INTEND TO DO ONCE I FIND SIMISAGE, DONâ€™T YOU?<br /> He nodded.<br /> HAVE YOU EVER RESORTED TO KILLING, MEGANIUM MAN?<br /> The vigilante looked away, flinching as he did so. The incidents in Goldenrod City and on the S.S. Anne haunted him and probably would for the rest of his life, and he knew there would be other instances where he would have to do it. His sole comfort regarding the matter was that it would be as a last resort, much like during his brawl with Ledian. What good was such a reassurance if it still mortified him?<br /> He assumed his nonverbal response was all Lugia needed, but the dragon continued to look at him expectantly. The dinosaur saw no choice but to indulge him and sighed.<br /> â€œTwice,â€ he said.<br /> ITâ€™S NOT EASY, IS IT?<br /> Lugiaâ€™s response sounded more like a statement than a question, but perhaps that was due to the bellowing and commanding nature of his voice.<br /> â€œNo. It isnâ€™t.â€<br /> THE ATTACK ON GOLDENROD CITY IS THE ONLY ONE I KNOW OF. WHAT WAS THE OTHER?<br /> â€œSome months ago, these guys hijacked a ship and I was forced to kill one of the pirates.â€<br /> FORCED?<br /> â€œHe held the passengers hostage, and was threatening to use a Blast Seed on them. I donâ€™t doubt he wouldâ€™ve done it if I hadnâ€™t killed him during the fight, but thatâ€™s exactly what he wanted me to do.â€<br /> Meganium Man kicked a stone into the water out of discomfort.<br /> â€œSimisage isnâ€™t worth it, Lugia.â€<br /> I DISAGREE.<br /> â€œYou say that now, but I was in a very similar situation to this one just a few weeks ago. Do you want to know how it ended?â€<br /> Lugia nodded.<br /> â€œHe did the right thing. Sure, he came close to crossing the line, but he didnâ€™t.â€<br /> The dragon looked ahead at the caved-in entrance from when he used Aeroblast, although he wasnâ€™t focusing on it. Lugia was giving Meganium Manâ€™s story time to sink in, while the dinosaur recalled his meeting with Onix, which was playing out eerily similarly to this one.<br /> THERE IS A DIFFERENCE BETWEEN US AND REGULAR POKÃ©MON, MEGANIUM MAN. I DO NOT HAVE TO ANSWER TO THE SAME LAWS YOU DO.<br /> â€œIf thatâ€™s true, then you wouldâ€™ve killed Simisage during the standoff with no questions asked.â€ He suddenly grinned. â€œI donâ€™t know if they make handcuffs in your size, but stranger things exist.â€<br /> Looking at the ground, the dragon tiredly replied, YOU CANâ€™T STOP ME. WHETHER OR NOT SIMISAGE IS WORTH IT IS NOT MY CONCERN. I WILL DO ANYTHING TO RESCUE MY CHILD, TO KEEP IT OUT OF DANGER, AND IF I DECIDE SIMISAGE DESERVES DEATH, SO BE IT.<br /> Meganium Man swallowed hard.<br /> â€œThen I guess Iâ€™m going to have to find him first.â€<br /> FOR YOUR SAKE, I HOPE YOU DO.<br /> The excruciating conversation ended there, and the duo soon fell asleep. Meganium Man dreamt of his fight with Ledian aboard the S.S. Anne, reliving the pivotal moment where he fired a Bullet Seed into the ladybugâ€™s skull, and watched his corpse crash to the floor. He suddenly snapped awake, looking directly through the hole in the islandâ€™s ceiling at the stars.<br /> He rolled over, looking at the destroyed cavern mouth, and saw what remained of Simisageâ€™s tools. Two seeds and an Orb, dumped there when he snagged the egg. Two snaky vines emerged from under their cape and scooped up the items, brought them over to him. He recognized the reddish Blast Seed right away, as well as the Warp Seed; he knew it was such because of the W etched onto it. There was also a blue orb with a light bulb on it, which he presumed to be a Flash Orb. That was it, unless more were under the rubble or at the bottom of the pond.<br /> Well, theseâ€™ll come in handy, Meganium Man thought, tucking them away in hammerspace. He rested his head on Lugiaâ€™s tail, blanketed himself with his cape, and closed his eyes, falling asleep shortly after.<br /> He was awoken by slurping sounds, and through tired eyes, saw Lugia drinking water from the pond in large gulps. It was late in the morning, probably about 10:30am, judging by the sunlight. He sat up, yawned, and rubbed his eyes with his vine whips.<br /> â€œMorning,â€ he said.<br /> MORNING, Lugia replied between sips.<br /> The green apatosaurusâ€™s stomach growled.<br /> â€œGot any food?â€<br /> Lugia shook his head.<br /> I CAN GIVE YOU A LIFT SOMEWHERE IF YOUâ€™D LIKE.<br /> He pulled his head and mouth away from the pond, and Meganium Man walked up his tail and onto his back, sitting down comfortably. Lugia flapped his massive wings, kicking up large waves from the pond, but was ascending through the roof before they could do any harm.<br /> As he began his flight, he said, I WOULD LIKE TO APOLOGIZE FOR LAST NIGHT. I DIDNâ€™T MEAN TO PROD LIKE THAT, AND I DEFINITELY DIDNâ€™T WISH TO CAUSE YOU DISCOMFORT AT ANY POINT.<br /> â€œItâ€™s fine,â€ Meganium Man replied politely.<br /> NO, ITâ€™S NOT. I SHOULD NOT HAVE TALKED TO YOU LIKE THAT LAST NIGHT. WE ARE ALLIES, BUT I SPOKE TO YOU LIKE YOU WERE AN ENEMY. I WILL NOT JUSTIFY WHATâ€”<br /> He suddenly felt a comforting vine on his shoulder.<br /> â€œDonâ€™t worry about it; if the roles were reversed, I probably wouldâ€™ve acted the same way.â€<br /> Lugia almost smiled at Meganium Manâ€™s forgiving nature, but he wouldnâ€™t take back everything he said. If he found Simisage first, he was certain heâ€™d kill the monkey. Just because some unidentified PokÃ©mon didnâ€™t kill some unidentified opponent, that didnâ€™t mean Lugia wouldnâ€™t. Just because Meganium Man didnâ€™t want him to, that didnâ€™t mean he wouldnâ€™t.<br /> They soared over Ecruteak City and could see the rooftop of the Bell Tower, but despite wanting to, Lugia stayed away. Doing so might disturb Simisage and give him cause to flee, if he was there at all. In any event, he didnâ€™t see his baby on the roof, and continued his flight to the Violet City stationhouse, landing outside Zangooseâ€™s office window. Meganium Man trotted inside the building, up to the Chiefâ€™s office, and let himself in. The mongoose hurriedly motioned for him to have a seat.<br /> â€œWhatâ€™s up?â€ Meganium Man asked, grabbing a donut from the box on the desk.<br /> Ludicoloâ€™s voice suddenly came through the speaker on Zangooseâ€™s phone.<br /> â€œAnyway, Kadabra canceled the deal,â€ he said. â€œSimisage is probably scrambling to find another buyer, but from what Kadabra tells me, nobody in Johto buys eggshells and probably wouldnâ€™t buy a Lugia one after what happened yesterday.â€<br /> â€œHas the word â€˜eggshellâ€™ lost all meaning to anyone else?â€ Meganium Man jokingly asked.<br /> â€œKadabraâ€™s calling other collectors and letting them know what happened, so Simisage is out of luck as far as heâ€™s concerned,â€ Ludicolo continued. â€œYou should probably track him down before he does something rash.â€<br /> â€œRight, thanks, Ludicolo,â€ Zangoose said, ending the call. He said to Meganium Man, â€œApparently, this Kadabra fellow was going to buy theâ€¦ well, you know, but isnâ€™t interested considering the current situation.â€<br /> GOOD. SIMISAGE WILL BE FORCED TO RELINQUISH THE EGG SOONER OR LATER.<br /> â€œA thought,â€ Meganium Man piped up. â€œNow, this would require unprecedented amounts of guts and idiocy, but since he now has literally nothing to lose, nothingâ€™s actually stopping him from giving the egg back.â€<br /> HOW DO YOU MEAN?<br /> â€œJust because Kadabra backed out and is calling other collectors, that doesnâ€™t mean Simisage wonâ€™t find one without scruples. Since the egg is likely to hatch before he does so, itâ€™s possible that he could keep the newborn on the interim and continue using it to keep us off his back.â€<br /> â€œOh, for the love ofâ€¦â€ Seviper said, his voice but a harsh whisper.<br /> â€œI see only one way to make sure that doesnâ€™t happen,â€ Meganium Man added.<br /> â€œAnd whatâ€™s that?â€ Zangoose asked, despite already knowing the answer.<br /> â€œWe get to the Bell Tower as soon as possible.â€<br /><br />Simisage was doing some stretches to keep his body nimble, anticipating the battle that could happen literally any second. He set the egg under the windowpane, directly in the sunlight, a crude substitute for the warmth of another living creature. A few punches here, a couple kicks there, and then he looked over his shoulder to see if it was hatching. A couple tail slaps here, some uppercuts there, and then another glance over his shoulder. Crack the knuckles, andâ€”<br /> He heard it. The unmistakable sound of an eggshell crackling graced his ear, the only sound he heard in the tower aside from his heartbeat. He spun around and saw a small crack no thicker than a hair on one of the purple diamonds, and dropped to his knees. More and more cracks appeared on the shell, which started to wobble back and forth; Simisage held out his hands to catch it if it toppled over. A zigzag-shaped crack appeared along the width of the egg, and moments later a small, white, crescent noggin arose, lifting the upper half of the egg. Simisage gently removed the egg half and placed it in his satchel, marveling at the sight before him. A baby Lugia, its eyes not even open, so small it could fit in the palm of his hand.<br /> A once in a lifetime sight, and he got to see it. Overwhelmed by the beauty of the scene, he felt a tear come to his eye and wiped it away. The infant was looking around with its eyes closed, making adorable sounds as it tried to see the world it was finally part of, and for a moment, Simisage forgot Lugia, Meganium Man, and the police even existed.<br /> Using the utmost care, he picked up the newborn and held it close, then retrieved the rest of the eggshell with his free hand. It was a little difficult doing so, but he was able to put the fragments in his satchel and close it tightly, and now he just had to get the baby somewhere where Lugia would see it, but also keep it out of danger. He didnâ€™t feel like getting lost in the tower, so he climbed down the ladder to the second level and jumped to the support beam, digging a wrist blade into it.<br /> The baby, he believed, knew he wasnâ€™t its parent. He already felt somewhat attached to it, witnessing its emergence and all, but Simisage forced himself not to get complacent and began his arduous climb to the rooftop of the Bell Tower. If he hadnâ€™t emptied his bag back in the Whirl Island, he couldâ€™ve used a Warp Seed and reached the rooftop instantly. Oh, well. He held the infant with his tail and used the leaf blades in his sleeves to scale the support beam, but kept the child close to make sure he could hear it. He had to have been climbing for over an hour before he reached the last floor, where the support beam abruptly ended. He only saw one ladder, directly behind him, that ascended. He took the leap and caught it with the dexterity and precision monkeys are known for, and climbed to the rooftop.<br /> Looking up, he saw the blue sky, and scrambled towards it. A refreshing breeze wafted in, and when he finally arrived on the blue roof, he found himself on a narrow gold walkway leading to an altar atop a looming flight of stairs. The bells hanging off the rafters were chiming thanks to the wind, and since the walkway and altar were fenced in by bronze arches, he could set the infant down without having to worry about it falling. Nonetheless, he gave a post a good, hard kick; it didnâ€™t budge. He walked to the altar, set the baby down, and patted it on the head before turning around and making tracks for the ladder.<br /> But then, he heard the sound of massive wings in the distance.<br /> As Lugia encroached upon Ecruteak City and the Bell Tower, his powerful ears caught a sound heâ€™d never heard before, but recognized anyway: high, childlike cries for someone or something, coming from the blue, pitched roof. It wasnâ€™t long before the altar was in his sights, on which he saw a small, white wyvern and a green simian with a satchel on its back.<br /> Simisage ran for the ladder, but Lugia suddenly accelerated, nearly knocking Meganium Man, Zangoose, Seviper, and a small group of police officers off his back. The elder dragon reached the roof before the monkey could reach the ladder and descended onto the walkway, tucking in his wings when his feet touched the ground. His passengers immediately disembarked and Simisage retreated to the altar, a leaf blade sliding out of his two sleeves. Meganium Man ran after him, snarling like a wildebeest all the while. If Simisage thought he could use the baby as a hostage or a shield, he was in for a rude awakening.<br /> Even he was surprised he beat the vigilante there. Meganium Man had two vine whips at the ready, but when the leafy simian turned around to face him, he was holding the infant Lugia, which was crying loudly. Meganium Man had already thrown a vine forward as if to punch Simisage and yanked the appendage back when he realized what he was actually about to strike. As the vines retreated underneath his neckâ€™s flower petals, Simisage grinned.<br /> A fierce snarl escaped Lugia.<br /> Simisage pressed a leaf blade to the infantâ€™s throat.<br /> â€œBack off. Now,â€ he ordered.<br /> YOU WONâ€™T DO IT.<br /> â€œOh, yeah? How would you know?â€<br /> Lugia opened his mouth slightly and began charging his Aeroblast attack. A sparkling orange sphere formed in his jaws, growing bigger and bigger until it was the size of a watermelon.<br /> â€œThatâ€™s how,â€ Meganium Man replied.<br /> While continuing to cry out in distress, the baby Lugia started fidgeting in Simisageâ€™s grip, and he struggled to keep a firm hold on it. Simisage instantly focused all his attention on it, which was Meganium Manâ€™s cue to reach into hammerspace and pull out the Flash Orb. When Simisage laid his eyes on it, the dinosaur threw it at him and it exploded into a massive wall of light that blinded him and made him scream from terror. The next thing he felt was the baby being taken away by two snakelike vines, and a second later, his vision returned.<br /> Meganium Manâ€™s back was turned to him, and his ever-extending vines were passing the newborn to Lugia, whose face no longer showed maniacal fury, but paternal love. He lowered his head and gently licked the infant, who giggled at the sensation. After a short nuzzle, Lugia turned aside and kneeled, allowing Meganium Man to place his child on his back. The purple plates immediately shot up, forming a kind of barrier to protect it.<br /> LOOK OUT!<br /> Turning around, Meganium Man saw Simisage storming towards him, and was promptly struck by one of his leaf blades. Although the dinosaur anticipated this, the sharp edge of the dagger grazed his neck and he forced himself to fall back, getting nothing worse than a flesh wound. He tumbled halfway down the flight of stairs and rolled onto his stomach, stopping himself. A thin trickle of blood inched its way down his saurian neck, but the wound wasnâ€™t deep enough or severe enough to do any real harm.<br /> If another slash landed, howeverâ€¦<br /> Simisage now had two options: turn tail and leap into the forest below from one of the arches, or try and fight his way out. The vigilante had already used one of his Flash Orbs; he might have others, maybe even other tools Simisage had used. Fighting would waste time. Time he would need to escape. <br /> As the monkey bolted towards the arches, Meganium Man reached into hammerspace and retrieved the Blast Seed. He wasnâ€™t interested in killing Simisage, but the explosion would be enough to subdue him if he met his mark. Throwing it in his opponentâ€™s general direction should do the trick, and thatâ€™s exactly what he did. Simisage had taken hold of the arcâ€™s peak when the reddish seed stuck the bottom of the post, and a loud explosion blew the column and a few neighboring ones to smithereens, sending black smoke wafting every which way.<br /> Shortly after the thunderous boom, Meganium Man heard what sounded like a body crashing onto the metal awnings and rushed through the smoke. The awnings were like sheer embankments, but that wasnâ€™t stopping Simisage from easing his way down. Meganium Man pursued him, taking uneven steps along the neutral blue half-pipes, catching Simisageâ€™s attention as his white claws scraped against the metal. <br /> For crying out loud! the simian thought. The vigilante was a persistent fellow, all right. Meganium Man was well on his way towards him, either itching for a brawl or a swift death, but despite not waiting to waste any unnecessary energy through combat, he would provide both if need be.<br /> Meganium Man was a couple feet away when he struck Simisage with the bulbous tip of a vine whip, which the kidnapper didnâ€™t expect to actually work. In spite of that, Meganium Man was too focused on keeping his balance on the awning, and even though the strike hurt, it wasnâ€™t enough to do much else. Simisage was still standing, and now that Meganium Man was coming closer and closer, he figured he may as well tie up this loose end.<br /> Another vine whip blitzed towards him, but Simisage knew this would happen. Just before the tip could strike his face, he took a half step sideways and brought his right leaf blade down on it like a guillotine, watching a flicker of pain appear on Meganium Manâ€™s face as the whip dropped to the ground. The rest of it retreated underneath his neckâ€™s petals, but he was still approaching.<br /> â€œYou just donâ€™t know when to quit, do you?â€ Simisage asked.<br /> â€œItâ€™s my middle name.â€<br /> Ignoring the non-sequiter, Simisage retaliated with a punch of his own, hitting Meganium Man with surprising grace and speed. As the herbal brontosaurâ€™s head whipped to the side, Simisage dished out a ferocious uppercut that made it and his neck snap backwards, nearly costing him his balance. Simisage put the finishing touch on his trifecta of rapid strikes with a roundhouse kick that, under all circumstances, should not have landed.&nbsp; He took a moment to watch Meganium Man crash to the floor, his striking foot returning to the awning while doing so.<br /> And then he ran.<br /> Meganium Man got to his knees and watched Simisage attempt his great escape, running to the north end of the awning. The leaf petals around his neck started waving in the breeze, and as the first petal was launched, it shredded itself up into razor-sized blades, all of which were on a crash course for Simisageâ€™s back. Heâ€™d acted a half second too late: he expected the razor leaves to strike the simian and topple him, but the monkey had reached the edge of the awning when they dug into his back.<br /> A pained gasp was the next thing he heard, and Meganium Man charged after him, pulling the Warp Seed out of hammerspace. Simisage began his fall, but the dinosaur fell with him and wrapped a vine around his torso before swallowing the Warp Seed. He imagined the walkway leading to the altar, saw the treetops rushing towards them, and blinked.<br /> He was still falling when he opened his eyes, but now, the duo were a few feet above the Bell Towerâ€™s rooftop. Lugia and the police were watching with baffled glances, when suddenly, Meganium Man and Simisage fell at the white wyvernâ€™s feet. As Simisage groaned in defeat, the leaves in his back reattached themselves to the base of Meganium Manâ€™s neck, resuming their petal shape.<br /> WELL, YOU DONâ€™T SEE THAT EVERY DAY.<br /><br />As the battle wound down, Zangoose and Seviper accosted Simisage, removed the satchel, and hauled him to the stationhouse with their fleet two steps behind. Meganium Man and Lugia, meanwhile, remained on the Bell Towerâ€™s roof, overlooking Ecruteak City as the noon hour drew near.<br /> â€œNow thatâ€™s what I call an adventure,â€ Meganium Man finally uttered in a bemused tone.<br /> HARD TO BELIEVE YOU DO THIS KIND OF THING FOR A LIVING.<br /> â€œYeah, sometimes. But it ainâ€™t like I got anything else to do.â€<br /> Lugia kneeled, and Meganium Man climbed onto his back, sitting directly behind the newborn.<br /> WHERE TO?<br /> â€œJust drop me off at the entrance.â€<br /> He was still surprised it only took one flap of the wings for Lugia to ascend; most bird PokÃ©mon had to flap theirs four or five times before gaining any decent altitude. While departing from the rooftop, Meganium Man realized that this could very well be the first and only time he would ever get to work with a legendary PokÃ©mon, and made it a point to cherish the memory for the rest of his life.<br /> Not that doing so would be difficult, mind you.<br /> Before he knew it, Lugia had touched down on the stone road and relaxed his tail, allowing Meganium Man to slide down to the barren street. Once his passenger was safely off his back, the looming dragon turned and faced him.<br /> I WOULD LIKE TO THANK YOU FOR YOUR HELP THESE PAST COUPLE OF DAYS. IT IS NOT OFTEN A POKÃ‰MON LIKE ME HAS THE OPPORTUNITY TO WORK WITH SOMEONE WITHâ€¦ SUCH IMPRESSIVE SKILLS.<br /> It took everything Meganium Man had not to laugh at the absurdity of those last three words.<br /> He failed.<br /> OH, SURE, YOUâ€™RE LAUGHING NOW. BUT ITâ€™S TRUE. YOU ARE QUITE LIKELY THE ONLY PERSON WHO WOULD EVER TRY TO FIGHT SOMEBODY ON THE AWNINGS OF THE BELL TOWER. THEREâ€™S SOME KIND OF SKILL IN THAT.<br /> â€œWell, I mean, Simisage started it. I donâ€™t know if recklessness counts as a skill, but thanks!â€™<br /> IN YOUR CASE, IT DOES.<br /> Lugia turned around and faced the east, spread his wings, and flapped them.<br /> â€œGoodbye, Lugia. May we meet again!â€<br /> YES. I WOULD LIKE THE CHANCE TO SETTLE OUR SCORE IN A FAIR FIGHT. FAREWELL, MEGANIUM MAN. MAY PLENTY MORE VILLAINS KEEP YOU BUSY FOR YEARS TO COME.<br /> He wasnâ€™t sure if Lugiaâ€™s sentiment was a backhanded one, but he found it amusing anyway. He waved as Lugia began his flight back to the Whirl Islands, although he was sure they would never meet again. It only seemed logical that Lugia would remain in the isles and at the bottom of the deepest ocean trenches, out of the publicâ€™s eye and consciousness for better or worse.<br /> But, then again, life doesnâ€™t necessarily operate logically.<br /> It didnâ€™t take long for Lugia to return to the archipelago and his domain, slowly lowering himself into the dark recesses as the infant started making sounds of curiosity. Where was it now? What was going on? What mysteries was he about to encounter? All these things would reveal themselves to both of them in time. Lugia landed on his shore and his child immediately hopped off his back, diving into the shallow pond and splashing water around with his tail.<br /> And for the first time in nearly three years, Lugia smiled.<br /><br />[center]<br />The End of Episode 10![/center]<br />


subject: Re: Verifying console/emulator behavior with 8F
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I think I may have found a Game Boy Player inaccuracy, which is really surprising.<br /><br />In English PokÃ©mon Red there is a special glitch map 0xE7. After a couple of hours of testing I finally found a way to access it.<br /><br />1) First get 202 PokÃ©mon in the party (this is to place a C9 in memory at EC2B (CC2B) for map 0xE7&#039;s level-script pointer at EAF1). Without arbitrary code execution, this should be possible by activating Super Glitch while on the deposit option of a PokÃ©mon Center&#039;s PC, depositing the PokÃ©mon to get 255 PokÃ©mon and then withdrawing a PC4SH to get 202 PokÃ©mon (the ID of PC4SH).<br />2) Stand in the spot below, save and reset then put the party cursor to PokÃ©mon 202 and close the menu.<br />3) Change D36E/D36F to 4112 and D35E to E7. You can do this with a TM31 x1 and X Attack x18 in the expanded items pack if you replace them with the Master Ball x199 and TM41 x79 respectively.<br /><br />[img]https://i.imgur.com/gfAWjLa.png[/img]<br /><br />4) You will warp to map 0xE7 and the game shouldn&#039;t freeze.<br /><br />Note: The 202 PokÃ©mon requirement may not be necessary on Game Boy/Virtual Console but it is on Game Boy Player.<br /><br />This is where the emulation error comes in:<br /><br />On a Game Boy Advance SP and Virtual Console, the map redirects you to another map (possibly Pallet Town) where Professor Oak may tell you not to go out and loop around the screen until you&#039;re forced to walk out of bounds.<br /><br />[img]https://i.imgur.com/ZewDKkJ.png[/img][img]https://i.imgur.com/klzjmrH.png[/img]<br /><br />But on the Game Boy Player the map doesn&#039;t redirect you and you get to explore it!<br /><br />[img]https://i.imgur.com/xXGPRbe.png[/img]<br /><br />Though it&#039;s easy to go out of bounds and freeze the game.<br /><br />At first I wondered whether there were requirements for it not to work I was overlooking, but I tested the same save file doing the same steps on a Game Boy Player and then a Game Boy Advance SP in alternation. Every time on the Game Boy Advance SP it warped to Pallet Town. Every time on the Game Boy Player it let me explore the map.


subject: Re: Nothing seem to match
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Hi PanCave :). This is a good place to ask but belongs better in the arbitrary code execution board so I&#039;ll move it there.<br /><br />[quote author=PanCave link=topic=7883.msg204672#msg204672 date=1488983616]<br />A few examples explaining my problem:<br />1)<br />This thread&#039;s first answer: http://forums.glitchcity.info/index.php?topic=7871.msg204526#msg204526<br />When i compare his(/her?) [quote]Back into raw code using the Big List:<br /><br /><br />- Repel x index number of wanted Pokemon<br />- X Speed x14<br />- Ultra Ball x 64<br />- TM05 (Mega Kick) x72<br />- Lemonade x201<br /><br />Becomes<br />1e xx 43 0e 02 40 cd 48 3e c9[/quote]<br />I get the exact same Byte-String, using the Big List. So far so good. But when he shows how the Bytes should look like @3E59:<br />[quote]Now, CF91 is one of the addresses that is reduced by 1 in Yellow; so if we search for 78 ea 90 cf [ld a,b ld (cf90),a ld a,c] in a hex editor (I like to use HxD which is freeware) we can luckily find the beginning gift PokÃ©mon routine in Yellow at 3E59.<br /><br />[b]78 EA 90 CF 79[/b]<br /><br />So we need to change cd 48 3e to cd 59 3e (59 3e because the call routine expects big endian, which may mean highest value comes first; sadly not sure but remember it&#039;s the often the opposite byte order you would find in a memory viewer)[/quote]<br />My Bytes (read with VBA&#039;s Memory viewer) are: [b]CD 18 38 37 C9 78 EA 95 CF 79 EA 2B D1 AF EA 49[/b]<br />Why? :/<br />[/quote]<br /><br />This byte sequence can be found in English Yellow using a hex editor and VBA&#039;s memory viewer (or BGB&#039;s memory viewer), so it&#039;s odd that you got different bytes. It may be possible that your ROM is not English Yellow or you&#039;re using a buggy version of VBA. The one I used for this was called v23.6 svn480, although BGB is great for accuracy so I recommend using that even though it doesn&#039;t have a recording feature that is as user friendly.<br /><br />[quote author=PanCave link=topic=7883.msg204672#msg204672 date=1488983616]<br />2)<br />In another thread there is linked the RAM map of red/blue: http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Items<br />When i search for yellow map, everyone tells me, it&#039;s just red/blue - 1. So according to that list my total item counter should be @(D31D - 1 = D31C), but it&#039;s actually @D321.<br />Reading from there on gives me the correct information about my items, but it&#039;s acutally +4 instead of -1. Why? :/<br />[/quote]<br /><br />The French, German, Italian and Spanish versions of PokÃ©mon Red and Blue use addresses -5 of the original English version address. So D31E in English Red/Blue is D31D in English Yellow and is D321 in non-English European Yellow.<br /><br />[quote author=PanCave link=topic=7883.msg204672#msg204672 date=1488983616]<br />3)<br />Again in another thread is this link: http://aurellem.org/vba-clojure/html/rom.html#sec-9-1<br />[quote]0DE2F.	Duration of Repel.	A single byte, representing the number of steps you can take before the effect wears off.	100[/quote]<br />But when I take a look @0DE2F and the nearby bytes, there is nowhere a 64, which should indicate the 100 steps of repel. Why? :/<br />[/quote]<br /><br />This appears to be an offset for English Yellow, which is 0x64 there as you thought. For looking up 0xDE2F keep in mind that viewing it in the memory editor would just bring up the value for WRAM memory address DE2F instead of ROM offset DE2F.<br /><br />[quote author=PanCave link=topic=7883.msg204672#msg204672 date=1488983616]<br />I get the feeling, that i missed something important on how to find the location of any information in the memory...<br />[/quote]<br /><br />It seems like the only confusion was due to analyzing a non-English version (plus make sure you use a hex editor rather than a memory editor). Otherwise it looks like you&#039;re on the right track. :)<br /><br />[quote author=PanCave link=topic=7883.msg204672#msg204672 date=1488983616]<br />My final goal to achieve is to write code in yellow to change the OT and ID of a specific pokemon (yes mew pokebank). I know, that there are guides out there either doing that in Red/Blue or changing OT/ID of the player in Yellow. But I want to change one specific pokemon in yellow and i can&#039;t find any guides/codes/hints on that. If someone knows one, please tell me, I&#039;m very interested, but I really want also to learn how to read and write the code by myself, so the original question would still be a thing.<br /><br />I hope i worked out, what my problem is and what i want to be able to learn/code.<br /><br />Thank you,<br />PanCave<br />[/quote]<br /><br />For English Yellow you would need to change the X Accuracy x119 (ld l, 77) into an X Accuracy x118 (ld l, 76). But for a non-English European Yellow (which would require a different bootstrap code of stored PokÃ©mon for non-English European versions that [url=http://forums.glitchcity.info/index.php?topic=6638.msg192543#msg192543]can be found here in the 8F thread[/url]) I think you&#039;d need X Accuracy x123.<br /><br />I hope this helps!


subject: MOVED: Nothing seem to match
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=//forums.glitchcity.info/index.php?board=115.0]Arbitrary Code Execution Discussion[/url].<br /><br />[iurl]//forums.glitchcity.info/index.php?topic=7883.0[/iurl]


subject: Re: Nothing seem to match
poster_name: PanCave
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow thank you very much for your answer!<br />Yes you are totally right, I&#039;m using the german version of Pokemon Yellow, which seems to cause the problems/offsets.<br /><br />I am going to keep that in mind, when writing/editing the code :)<br /><br />But there are some questions left:<br />1)<br />Only double checking:<br />[quote]The French, German, Italian and Spanish versions of PokÃ©mon Red and Blue use addresses -5 of the original English version address. So D31E in English Red/Blue is D31D in English Yellow and is D321 in non-English European Yellow.[/quote]<br />Do you mean +5?<br />I&#039;m not trying to bug you, I just want to make sure, that i fully unterstand, what you are saying :)<br /><br />2)<br />[quote]This appears to be an offset for English Yellow, which is 0x64 there as you thought. For looking up 0xDE2F keep in mind that viewing it in the memory editor would just bring up the value for WRAM memory address DE2F instead of ROM offset DE2F.[/quote]<br />I thought, the address space is fixed, such that:<br />0x0000 - 0x7FFF ROM<br />0x8000 - 0x9FFF VRAM<br />0xA000 - 0xBFFF SRAM<br />0xC000 - 0xCFFF RAM<br />0xD000 - 0xFEFF WRAM<br />0xFF00 - 0xFF7F I/O<br />0xFF80 - 0xFFFF RAM<br />So that would mean, that 0x0DE2F always refer to the ROM.<br />Is that wrong? Are there multiple memory chips, which use the same address space?<br /><br />3)<br />[quote]plus make sure you use a hex editor rather than a memory editor[/quote]<br />What benefit does the hex editor have in comparison to the memory viewer? I installed HxD (which I believe you mentioned in a thread), but then i first have to dump the memory. And messing with the memory viewer i can see the changes (both in memory and ingame) in real-time.<br /><br />Thank you again for your time and help! And also for moving the thread in the right forum, I actually thought about posting the question in here, but somehow I thought maybe that&#039;s not a good idea. Anyways, this topic is really interesting!<br /><br />Btw.: It seems to me, that 8F and ws m are turing complete... Maybe building a turing machine simulating pokemon INSIDE pokemon and... well, maybe not!<br /><br />Thanks again,<br />PanCave


subject: Re: State the obvious!
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In this thread even if you don&#039;t state the obvious no one would say anything since whether something is obvious is an opinion.


subject: Re: Which would you rather?
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The NavaShield ominous laugh.<br />Would you rather commit suicide, or kill the first person you see?


subject: Re: State the obvious!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This counts as a reply. In fact all posts in this thread other than the original post count as replies too!


subject: simple WRITE command
poster_name: PanCave
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: PanCave
icon: xx
body:
  Hey,<br /><br />after figuring out, how to read the german Yellow version, I&#039;m starting to think about coding.<br /><br />Please note: All addresses are for the german Yellow version. Basically its 0x(address of english Yellow version) + 5 or 0x(adress of english Red/Blue version) + 4<br />All Items -&gt; Codes are taken from: http://glitchcity.info/wiki/The_Big_HEX_List<br /><br />I know, that 0xD17B and 0xD17C store the two Bytes of the TID of the first PokÃ©mon in the party.<br />Let&#039;s assume, the Box is correctly setup, such that using ws m will cause the the sp to point at the third item in the bag.<br />Wouldn&#039;t writing a single Byte in RAM possible with:<br />[code]<br />Lemonade x89&nbsp; &nbsp; &nbsp; &nbsp; // ld a, 89<br />TM34 x209<br />.(player)â‚½ ã… A Aã‡â‚½&nbsp;  // combined with line 2: ld D17B, a<br />TM01 xany&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // ret<br />[/code]<br />Shouldn&#039;t this code write &#039;89&#039; @D17B?<br /><br />And I know that &quot;.(player)â‚½ ã… A Aã‡â‚½&quot; can&#039;t be bought in the market, but with this code:<br />[quote][code]<br />ws# #m#<br />Item you want to change x any<br />Burn heal x 43<br />Ice heal x 43<br />Revive x 201<br />[/code][/quote]<br />from this thread https://www.reddit.com/r/pokemon/comments/5q8zlg/getting_gen_1_mew_in_yellow_guide_does_not_work/<br />we should be able to have a Max Elixer and keep increasing it&#039;s ID until it&#039;s &quot;.(player)â‚½ ã… A Aã‡â‚½&quot;.<br /><br />Also:<br />I&#039;m not sure, what the code exactly does:<br />Burn heal x43<br />Ice heal x43<br />Revive x201<br />should mean<br />inc c 43<br />dec c 43<br />dec (hl) 201<br />What is the purpose of the 43 and 201? And why is there no TM01 for return the sp?<br />[b]EDIT: The 201 (which is C9 in hex) is obviously the ret statement![/b]<br /><br />Thank you,<br />PanCave


subject: Re: simple WRITE command
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Hello,<br />I did not check your opcodes, but everything is to be considered an instruction: both the item and its quantity are two different values.<br /><br />You have three items, that means 6 hex values. In the case of 1-byte instructions, that would give 6 instructions. Here, 43 refers to the opcode with a hex value of 2B (dec:43) and 201 is of course, as you figured out, hex:C9, a ret instruction :)


subject: Re: State the obvious!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Giant Cone of Lava also stands for:<br /><br />Gargantuan igniting animal nitrogen test Celebi of Neo-Egypt of France lions are very awesome and laugh so optimistically so try and now dance soundly for our Regulus.


subject: Re: Non-valid source glitch maps documentation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Thanks for your research on Japanese Green map FE Charmy! :)<br /><br />I found map 0x0B in French and Spanish Yellow are &#039;descent&#039; (move down) glitch maps.<br /><br />My favourite non-freezing map 0x0B however is in Italian Yellow, which is explorable and has a non-freezing map script!<br /><br />[img]https://i.imgur.com/biRnKHF.png[/img]<br /><br />I LOVE this because this means you can say you visited the lost city (even though its actual data is invalid), and the Town Map will say you&#039;re in a Pallet Town on the top-left corner of the map.<br /><br />[img]https://i.imgur.com/V4avTZI.png[/img]<br /><br />Sadly you can&#039;t Fly back to it even though it registers as a Fly location.


subject: Re: Spiky Shield Sky Drop glitch
poster_name: SgvSth
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=blahpy link=topic=7872.msg204639#msg204639 date=1488672997]<br />Okay, so it might be possible to get your whole party fainted for the first time since gen 4 with this.<br />[/quote]<br /><br />What about Generation V?


subject: Re: State the obvious!
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &quot;Gargantuan igniting animal nitrogen test Celebi of Neo-Egypt of France lions are very awesome and laugh so optimistically so try and now dance soundly for our Regulus.&quot; is 167 characters long, including spaces and the ending period.


subject: Re: Nothing seem to match
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;d recommend you first make setups on US versions, because they are more documented, and then port them to German versions.<br />It makes it easier for us to help you, since there is a [url=http://github.com/pret/pokered/]complete disassembly[/url] [url=http://github.com/pret/pokeyellow]of the US versions[/url].<br /><br />Also, DON&#039;T F*ING USE VBA. I&#039;m sorry it pisses me so hard, but this thing is absolute garbage, has crappy emulation and poor debugging capabilities.<br />Once you understood how to use it because it&#039;s only 90% user-friendly, BGB is your best friend. Ask anyone doing PokÃ©mon code research here, they use BGB and not VBA.<br /><br />Anyways, answers.<br /><br />1) He did mean +5.<br /><br />2) Let&#039;s talk about offsets. The map you gave is right, except for a some things corrected below.<br />$0000 - $3FFF ROM bank 0<br />$4000 - $7FFF ROM bank $01 - $7F (switchable)<br />$8000 - $9FFF VRAM bank 0 or 1 (switchable)<br />$A000 - $BFFF SRAM bank 0 to 3 (switchable)<br />$C000 - $CFFF WRAM bank 0<br />$D000 - $DFFF WRAM bank 1 to 7 (switchable)<br />$E000 - $FDFF Echo RAM (mirrors $C000 - $DDFF)<br />$FE00 - $FE9F OAM<br />$FEA0 - $FEFF ???<br />$FF00 - $FF7F I/O registers<br />$FF80 - $FFFE HRAM<br />$FFFF Interrupt Enable (IE)<br /><br />However, $0DE2F is NOT such an offset. It&#039;s a ROM offset, like $1DE2F. To use it, open the ROM in HxD, press Ctrl+G, and type &quot;0DEDF&quot;.<br />The thing is very simple to understand : on your memory map, ROM is only present from $0000 to $7FFF. That&#039;s 32kB of ROM. However, PokÃ©mon Red and Blue cartridges contain 1 MB of ROM ! But how is that trickery possible ? Using the same principle as a book. You select the page you want to open, then read a specific char.<br />Here it&#039;s the same : select a ROM bank, and read a specific address.<br />As such, there are two ways of referring to a byte in ROM : either &quot;3:5EDF&quot;, which means &quot;byte at offset $5EDF in GB / emulator when bank 5 is loaded&quot;, or &quot;0DEDF&quot; which means &quot;byte at offset $DEDF in ROM file (using HxD for example)&quot;. Usually ROM offsets are 5-digit wide.<br />Don&#039;t ask me how to load a specific bank in VBA : you can&#039;t. Use BGB if you want to do that.<br /><br />3) That&#039;s what she meant : use HxD and not a memory viewer / editor.


subject: Re: Nothing seem to match
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I like VBA. I feel uncomfortable with BGB&#039;s Memory viewing stuff. I should test mGBA someday since it&#039;s now considered the best GBA emulator 


subject: Re: Nothing seem to match
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: camper
icon: xx
body:
  I use VBA-RR simply because of easy AVI recordings that supports the Turbo button. (That means even if you use Turbo or speed up the game in any way the recordings will still be at the original speed)<br /><br />The BAD thing about the recordings is that the dimensions also stay at the original size even if you make the window size 4x, which results in REALLY LOW QUALITY videos.


subject: Re: State the obvious!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Dogs go &quot;woof&quot;, cats go &quot;meow&quot;, bird goes &quot;tweet&quot; (but what does the fox say?).


subject: Re: State the obvious!
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Obvious is a word.<br />A word may not be obvious.<br />Word is a word.<br />Obvious is obvious.<br />Idempotence is a thing.


subject: Re: simple WRITE command
poster_name: Anna Says Hi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Anna Says Hi
icon: xx
body:
  [quote author=PanCave link=topic=7885.msg204683#msg204683 date=1489073033]<br />And I know that &quot;.(player)â‚½ ã… A Aã‡â‚½&quot; can&#039;t be bought in the market, but with this code:<br />[quote][code]<br />ws# #m#<br />Item you want to change x any<br />Burn heal x 43<br />Ice heal x 43<br />Revive x 201<br />[/code][/quote]<br />from this thread https://www.reddit.com/r/pokemon/comments/5q8zlg/getting_gen_1_mew_in_yellow_guide_does_not_work/<br />we should be able to have a Max Elixer and keep increasing it&#039;s ID until it&#039;s &quot;.(player)â‚½ ã… A Aã‡â‚½&quot;.<br /><br />Also:<br />I&#039;m not sure, what the code exactly does:<br />Burn heal x43<br />Ice heal x43<br />Revive x201<br />should mean<br />inc c 43<br />dec c 43<br />dec (hl) 201<br />What is the purpose of the 43 and 201? And why is there no TM01 for return the sp?<br />[b]EDIT: The 201 (which is C9 in hex) is obviously the ret statement![/b]<br /><br />Thank you,<br />PanCave<br />[/quote]<br /><br />That item code is designed to work with 8F, but coincidentally works with ws m. The reason is that after the ws m bootstrap is run, HL contains D321, which is the address containing the index of the third item in the pack. Then the bootstrap jumps to the address contained in HL. Since we want to get HL to contain D31F (second pack item&#039;s index number), we decrement L twice with opcode 0x2B (43 in decimal). However, item 2B is a key item, and thus we cannot obtain more than one of it which prevents a 2-line setup. So the code actually works like this:<br />[code]<br />(HL contains D321 in Yellow, D322 in Red/Blue)<br />inc C<br />dec L<br />dec C<br />dec L<br />inc (HL)<br />ret[/code]<br /><br />On Red/Blue where item 3 is D322, there are several different ways to get HL to contain item 2&#039;s address. One of them is to reset bit 1 of L, which can be done with TM03 x141. (RES 1, L) Another way is to use X Accuracy x31 (x32 in Red/Blue), which is ld L, 1Fh(20h in Red/Blue). However, since a different amount of X Accuracy is used for the item duplication code, it&#039;s more efficient to use the TM03 setup in Red/Blue.


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7845.msg204607#msg204607 date=1488547594]<br />Believe it or not, MKDasher is finding a way IIRC, and Aera and them are looking for a &quot;speedrun&quot; way of doing so :)<br />YOU&#039;RE WRONG KRYS<br />[/quote]<br /><br />We *were* doing that, turns out the flags seem to be very delicate so no progress has been made past a route to Stark Mountain and the Survival Area. I&#039;ll probably revisit Tran when everything else has been done.


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Would RETIRE trick work?<br />[/quote]<br /><br />Every legendary using the RETIRE trick has been checked, Arceus is the only one that works unfortunately.


subject: Re: simple WRITE command
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  @PanCave :<br />If you want to do some compiling, I recommend you take a look [url=http://issotm.github.io/gbz80toitems3/]the online compiler I wrote[/url]. All I need to add now is reversing item codes and fix a few lingering bugs.<br />(Shameless self-promotion is shameless)<br /><br />Now I need to correct you on something [b][i][u]vital[/u][/i][/b] : sp is the [b]stack pointer[/b] (a registry that points to the top of the stack). You&#039;re mistaking it for pc, the [b]program counter[/b] (a registry that holds a pointer to the byte being currently interpreted).<br />Also, the GB&#039;s stack is a Full, Ascending stack, ie sp is incremented as you push data, and sp points to the current entry.<br /><br />Now, about your question.<br />Both items and quantities translate to bytes, which are then interpreted as instructions. So that&#039;s why Anna Says Hi&#039;s decompilation is correct.<br /><br />Hope it helped !


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Doing this on console also, I can&#039;t seem to get it to work either. 99% of any tweaking patterns I&#039;ve tried on the fast bike just freeze the game instantly. Even the example shown on the first post doesn&#039;t seem to work, freezing like all the others... The one that slows down Jubilife City does work, strangely enough, but opening any menu froze the game.<br />Does the outcome of the tweaking depend on other factors (like items in the bag, party PokÃ©mon, etc.), or does it just not work on console?


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: Cryo
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Spectramark link=topic=7857.msg204705#msg204705 date=1489338358]<br />Does the outcome of the tweaking depend on other factors (like items in the bag, party PokÃ©mon, etc.), or does it just not work on console?<br />[/quote]<br /><br />It depends on how the hardware deals with certain conditions, especially when the error handler isn&#039;t called and the operating environment gets highly corrupted. The corruption itself is mostly based on the current state of the loaded map tile data, but other factors could definitely affect the glitch.


subject: Re: GSC glitch PokÃ©mon &quot;biological research&quot;
poster_name: OLDEN
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: OLDEN
icon: xx
body:
  Hi, Torchickens! I hadn&#039;t expected a late reply, so this was a pleasant surprise. I put a good chunk of the data I verified up [url=http://bulbapedia.bulbagarden.net/wiki/Five_question_marks]on Bulbapedia[/url], including base stats, gender ratios, extremely weird experience rates, and the like.<br /><br />Some notes:<br />[list]<br />[li]Things I haven&#039;t verified through gameplay yet include catch rates, EXP yield, and egg cycles. I haven&#039;t checked a few of the egg groups as well, but I&#039;m pretty confident in those, especially since I got my C:254 to breed with a Totodile.[/li]<br />[li]Encounters with ????? in Gold/Silver always result in a link battle.[/li]<br />[li]I haven&#039;t found any held items on wild ?????. Maybe it&#039;s just probability, but I doubt they have any.[/li]<br />[li]Bulbapedia asserted that &#039;l) m) ZM, one of the types of GS:255, was functionally the same as the Steel-type (on your suggestion, actually), but my GS:255 ?????s don&#039;t seem to resist Normal-type moves.[/li]<br />[li]Other the evolutions I&#039;ve verified, I&#039;ve gotten a few weird evolutions such as GS:000 to Nidoranâ™‚, C:000 to Nidoranâ™‚, and C:252 to Butterfree. Force-feeding them tons of Rare Candies might be the trigger; at the very least, my notes claim that GS:000 evolves into Nidoran when 49 Rare Candies are used on it in a row, no matter the level it starts at.[/li]<br />[li]Don&#039;t forget to add Crystal move tutor moves.[/li]<br />[/list]<br /><br />The last thing I need to do is egg moves, as I have no idea where those are in the ROM.


subject: Re: Offgao's memory viewer and Tetris ACE exploits
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I presume there&#039;s not enough space in unused event flags for this right? If not then MrCheese&#039;s virus shows that it is at least possible to fit in unused event flags a script that opens SRAM, copies some data from it, and jumps to it; would that be worth doing? Since even if you reset the save file then the memory editor should still still there, you just need to re-do the loading code.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What would be the fastest/easiest way to get a working 8F setup starting from a brand new save file?<br /><br />I&#039;m guessing it would start out like the standard speedrun route (Brock thru walls to Saffron, encounter missingno via Trainer Fly with Abra, then item underflow) but then use the undereflow to obtain 8F instead... Then what would be the optimal way to get all the pokÃ©mon required for the bootstrap? Regular encounters, or trainer fly?


subject: Re: Nothing seem to match
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7883.msg204696#msg204696 date=1489156457]<br />I use VBA-RR simply because of easy AVI recordings that supports the Turbo button. (That means even if you use Turbo or speed up the game in any way the recordings will still be at the original speed)<br /><br />The BAD thing about the recordings is that the dimensions also stay at the original size even if you make the window size 4x, which results in REALLY LOW QUALITY videos.<br />[/quote]<br /><br />I record using standard VBA (not M or RR) for PRAMA&#039;s videos, it also records at normal speed even with the turbo


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  In PokÃ©mon Yellow I used [url=https://www.youtube.com/watch?v=DDkema91-vo&amp;t=8s]stable unstable MissingNo.[/url], dry underflow, [url=http://glitchcity.info/wiki/Celadon_looping_map_trick]Celadon looping map trick[/url] and [url=http://glitchcity.info/wiki/Rival_LOL_glitch]Rival LOL glitch[/url] for the bootstrap PokÃ©mon.<br /><br />The Brock Through Walls/Trainer-Fly&nbsp; with Abra sounds good for Red/Blue.<br /><br />Rival LOL glitch is probably a good method for PokÃ©mon Red and Blue as well if you have a six letter long Rival name, although you could also get your PokÃ©mon by warping to places that have them (Route 1 for Pidgey, Safari Zone or Cerulean Cave [use Rival&#039;s item or enter Hall of Fame] for Parasect, Rock Tunnel or Victory Road for Onix, water for Tentacool [use ?????], Safari Zone for Kangaskhan.<br /><br />I&#039;m unsure if Trainer-Fly would be better as you&#039;d need specific Special stats from specific Trainers or party PokÃ©mon, so regular encounters/LOL glitch seems to be better.


subject: Re: RotomDex text Freeze/Crash on Saving
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: exclamation
body:
  Alrighty, I finally got this recorded&nbsp; :D<br /><br />https://www.youtube.com/watch?v=_o8hlz-M3s0


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=jfb1337 link=topic=6638.msg204709#msg204709 date=1489403186]<br />What would be the fastest/easiest way to get a working 8F setup starting from a brand new save file?<br /><br />I&#039;m guessing it would start out like the standard speedrun route (Brock thru walls to Saffron, encounter missingno via Trainer Fly with Abra, then item underflow) but then use the underflow to obtain 8F instead... Then what would be the optimal way to get all the pokÃ©mon required for the bootstrap? Regular encounters, or trainer fly?<br />[/quote]<br />For the level 100 Pidgey I recommend TFlying, fighting against FISHERMAN&#039;s level 27 GOLDEEN in Route 12, Growl x6, catch Pidgey, DON&#039;T SAVE, level to 100, cancel evolution, use HP Ups and remove HP using poison then Antidote (1 HP each 4 steps) or Lv 2 PokÃ©mon (2 HP per hit usually, ie when not Crit :P).<br />Note that some Pidgeys cannot reach 233 Max HP due to low stats, that&#039;s why you shouldn&#039;t save until after you made sure you caught a correct one.<br /><br />I also prefer to catch Arbok from Trainer-Fly (if using the 6-PokÃ©mon setup, the best IMO) ; for the Kangaskhan I recommend you go into a Safari part of the zone where Kangaskhans appear and get kicked out of the Safari challenge in this zone. Then do the usual Surf thingy without loading other grass PokÃ©mon data, and you&#039;re good ([size=6pt]Note : doesn&#039;t work in PokÃ©mon Yellow. Not suited for children under 3 IQ.[/size])


subject: Re: Offgao's memory viewer and Tetris ACE exploits
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7773.msg204397#msg204397 date=1487346707]<br />[quote author=Flandre Scarlet link=topic=7773.msg203776#msg203776 date=1484751330]<br />Would it be possible to have the code in SRAM Bank 0 Hall of Fame data? According the Datacrystal&#039;s RAM MAP it is about 4.8KB of space (http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Bank_0) and would also allow you to use your boxes without corrupting them.<br />[/quote]<br /><br />Mm, that may work but you might have to add code to open the SRAM as SRAM may be closed; filled with FF/or apparently values that are hard to predict.<br />[/quote]<br />Closed SRAM is read as $FF bytes (unless ur playin VBA lel)<br /><br />[quote author=jfb1337 link=topic=7773.msg204708#msg204708 date=1489400837]<br />I presume there&#039;s not enough space in unused event flags for this right? If not then MrCheese&#039;s virus shows that it is at least possible to fit in unused event flags a script that opens SRAM, copies some data from it, and jumps to it; would that be worth doing? Since even if you reset the save file then the memory editor should still still there, you just need to re-do the loading code.<br />[/quote]<br />[code]<br />ld hl, $0060<br />inc [hl]<br />jp $XXXX<br />[/code]<br />Enables SRAM and jumps to wherever you want in a mere 7 bytes !<br />The trick is inc [hl], which reads a $D9 @ $0060, and writes back a $DA to $0060.<br />Enabling SRAM usually works by writing $0A in memory range $0000 - $1FFF ; during testing, I found - by accident - that writing anything that has its lower nibble as $A also works, at least on BGB. I&#039;d like to try on hardware.<br />Disabling SRAM is as simple as writing anything that doesn&#039;t have its lower nibble as $A in the above memory range. It can also be done by saving the game, though :P<br />I don&#039;t know what happens when powering the console off while SRAM is open, but documents imply that this might decay its contents.


subject: Re: RotomDex text Freeze/Crash on Saving
poster_name: Deku-Kitty
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Huh, that&#039;s really odd! The game must not expect you to save while Rotomdex is talking on the bottom screen. I don&#039;t know why that would cause a freeze though. Maybe a conflict between the scripts? 


subject: Re: simple WRITE command
poster_name: PanCave
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you both! You helped me a lot!<br /><br />I think i missed something on my journey for writing arbitrary code... What is hl,c,l,...? Or are there references for these registers?<br /><br />How would a simple write command look like in pokemon yellow german?<br />Such that I could jump to any address (using items or quantities) and write a value (again via item or quantity) to that specific byte?


subject: Re: simple WRITE command
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=PanCave link=topic=7885.msg204716#msg204716 date=1489502670]<br />I think i missed something on my journey for writing arbitrary code... What is hl,c,l,...? Or are there references for these registers?<br />[/quote]<br />[url=http://glitchcity.info/wiki/GB Programming]http://glitchcity.info/wiki/GB Programming[/url] is your friend.<br /><br />[quote author=PanCave link=topic=7885.msg204716#msg204716 date=1489502670]<br />How would a simple write command look like in pokemon yellow german?<br />Such that I could jump to any address (using items or quantities) and write a value (again via item or quantity) to that specific byte?<br />[/quote]<br />Use [url=http://forums.glitchcity.info/index.php?topic=6638.msg189609.html#msg189609]this setup[/url]. Just adapt the memory destination :)


subject: Re: simple WRITE command
poster_name: PanCave
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  okay one final question:<br />To set everything up for the &quot;write-a-single-byte&quot;-command (which I sucessfully tested), I need 5 items with a quantity &gt; 99:<br />[code]<br />- Any Item xAny<br />- ws m<br />- lemonade x170&nbsp; &nbsp; &nbsp; 	59	XX = value<br />- X-Accuracy x139	&nbsp; &nbsp; &nbsp; &nbsp; 7B	YY = low-Byte of address<br />- Carbos x209		&nbsp; &nbsp; &nbsp; &nbsp; D1	ZZ = high-Byte of address<br />- Pokeball x119<br />- Fresh Water x201[/code]<br />Obviously I could encounter Missigno. multiple times, but i know that there is a code for decreasing the quantity of the second item by 1.<br /><br />According to this link: https://youtu.be/jR5rov2e6PU?t=299 for english yellow the setup should lool like this:<br />[code]<br />-ws m<br />-item to decrease x1<br />-burn heal x43<br />-ice heal x53<br />-revive x201[/code]<br />This decompiles to:<br />[code]<br />inc c<br />dec hl<br />dec c<br />dec (hl)<br />dec (hl)<br />ret[/code]<br />Of course, this does not work in yellow version german. But I thought I simply had to increment hl four time instead of decrementing it once, in order to get to the correct address:<br />[code]<br />inc a<br />inc hl<br />dec a<br />inc hl<br />inc c<br />inc hl<br />dec c<br />inc hl<br />dec (hl)<br />dec (hl)<br />ret<br />[/code]<br />[code]<br />Fresh Water&nbsp; x35 (hex:23)<br />Soda Pop&nbsp; x35 (hex:23)<br />Burn Heal&nbsp; x35 (hex:23)<br />Ice Heal&nbsp; x35 (hex:23)<br />Revive&nbsp; x53 (hex:35)<br />TM01&nbsp; x[Any qty]<br />[/code]<br />I tested this code and i does not work :/<br />What am I doing wrong?


subject: Re: simple WRITE command
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  The English setup will work for German versions because of the way 8F bootstrapping works.<br />The most common way of doing so is to set hl to point to the entry point (ie, the third item in the bag) and then &quot;jp [hl]&quot;.<br />That&#039;s why, on all versions, hl points to the third item in the bag, period.<br />Doing a &quot;dec hl&quot; will ALWAYS make hl point to the quantity of the second item in the bag.<br />Also remove the &quot;Ice Heal x53&quot;. It&#039;s unnecessary, because quantities x00 aren&#039;t cleared from the bag (you&#039;re never supposed to have any) and when tossing, you can toss as if it were x256 (eg, tossing 1 at this point yields &quot;Item x255&quot; due to underflow.)


subject: Re: simple WRITE command
poster_name: PanCave
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hm, that&#039;s strange...<br />I made a screenshot:<br />[img]https://puu.sh/uJSC5/0cd837fc80.png[/img]<br />[code]<br />ws m<br />Rare Candy x1<br />Burn Heal x43<br />Revive x201[/code]<br />But when I use ws m, nothing happens.<br /><br />My box setup is according to this page&#039;s first post(&quot;Yet another update&quot;): <br />[url=http://forums.glitchcity.info/index.php?topic=6638.45]http://forums.glitchcity.info/index.php?topic=6638.45[/url]<br />The Box setup works 100%, as I&#039;m able to perform the memory writing you showed me.<br /><br />What am i doing wrong?


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Deku-Kitty
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Question, how does leveling up Arceus to 100 make it transferable? Unless I&#039;m not in the loop, current methods cause Arceus to be shown as caught in the Mystery Zone and not the Hall of Origin. Wouldn&#039;t that discrepancy make it impossible to transfer at all?


subject: Re: simple WRITE command
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Okay, you did wrong on two things :<br />1. Your ws m setup [b]is[/b] incorrect. It jumps to $D31A, but it should jump to $D326.<br />Solution : Replace Sichlor with Kadabra<br />2. Your item setup is incorrect. The setup you had on the screenshot is good, but the one on your save file is bad.<br />Solution : put that Sonderbonbon (or Carbon, on the svae you uploaded) back.<br /><br />I tested it, and it works.<br />~ Panda


subject: Re: simple WRITE command
poster_name: PanCave
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you very much! Know i got everything i need to know!<br /><br />I&#039;m planning to write a detailed guide on how to prepare a glitch Mew for PokÃ©bank in english and non-english version yellow.


subject: Re: simple WRITE command
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I suggest you post it here before you publish it, we could correct stuff and add precisions, warnings etc.<br />You don&#039;t have to, though !


subject: Obtain Mew with arbitrary glitch PokÃ©mon evolution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  As Crystal_ documented ([url=http://forums.glitchcity.info/index.php?topic=6648.0]thread[/url], [url=https://www.youtube.com/watch?v=ggLpyCRUWH8]video[/url]), not every PokÃ©mon&#039;s level-up and evolution data is taken from the ROM, and there are exactly four glitch PokÃ©mon each in both Red and Yellow who actually take their evolution data from VRAM (graphics data).<br /><br />This is the list of applicable glitch PokÃ©mon, copy and pasted from the wiki article I have just written:<br /><br />http://glitchcity.info/wiki/Arbitrary_learnset_glitch_Pok%C3%A9mon<br /><br />[b]Red/Blue[/b]<br /><br />Beginning of pointer table=$3B05C<br /><br />A (0xEA) (VRAM $8124) â€” It learns certain moves when levelled up with Rare Candies but no moves when levelled up in battle.<br />Glitch (0xEB) (VRAM $992B)<br />G&#039;Mp (0xF6) (VRAM $852C)<br />94 h (0xF9) (VRAM $9A20)<br /><br />[b]Yellow[/b]<br /><br />Beginning of pointer table= $3B1E5<br /><br />&#039;r ã‚¥ (0xEA) (VRAM $8124)<br />4 h 4 (0xEB) (VRAM $992B)<br />ã‚¥ â‚½ A (0xF6) (VRAM $852C)<br />â‚½ (0xF9) (VRAM $9A20)<br /><br />According to Okk and echinodermata, level up evolutions are read when there is data in the form &quot;01 [level] PokÃ©mon ID]&quot;.<br /><br />http://forums.glitchcity.info/index.php?topic=5217.0<br /><br />In Yellow, after entering a map or saving and resetting, the location of $9A20 may be taken from one of the screen tiles.<br /><br />Very fortunately, 01 01 15 can be represented by block 09 in Cinnabar Mansion, and when it is at the bottom-left corner of the screen in this spot on 2F you have a chance of evolving â‚½ (0xF9) into Mew at Level 1 due to the VRAM data representing evolution code to evolve it into Mew. (You must save and reset the game at this spot with your â‚½ (0xF9))<br /><br />[img]https://i.imgur.com/fnlBOu4.png[/img]<br /><br />Sadly for unknown reasons it&#039;s only a chance and a rather low chance at that it seems; your â‚½ (0xF9) may evolve into Q or Nidoranâ™‚ many times but never Mew, until you reset and try again hopefully to get a successful attempt. I don&#039;t know why and wonder whether it&#039;s to do with VRAM banks.<br /><br />What&#039;s left to do now is test the other locations and whether this works on Red/Blue.<br /><br />Edit: OK, you should be able to do this with 0xEB too except the data has to be in this green block and I&#039;m not sure how easy that is to do as I couldn&#039;t align the 01 tiles and then that tree in the aforementioned map here.<br /><br />[img]https://i.imgur.com/WJMw3sT.png[/img]<br /><br />Edit 2: 0xF9 confirmed on Red in addition to Yellow.


subject: Re: The exact reason why unstable missingno crashes.
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7112.msg198555#msg198555 date=1432107021]<br />Unstable Missingno. has a dimension of 11x13.[/quote]<br /><br />Wrong, 10x13. (Wow, bumping an entire thread just to add that little note.)


subject: Re: Obtain Mew with arbitrary glitch PokÃ©mon evolution
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The low chance is due to VRAM being read while the LCD is accessing it ; the 01 01 15 bytes are (at least partially) read as $FF due to the LCD having priority.<br />Eventually the read lands on a HBlank period and the evolutions succeeds.


subject: Re: Obtain Mew with arbitrary glitch PokÃ©mon evolution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7886.msg204731#msg204731 date=1489800826]<br />The low chance is due to VRAM being read while the LCD is accessing it ; the 01 01 15 bytes are (at least partially) read as $FF due to the LCD having priority.<br />Eventually the read lands on a HBlank period and the evolutions succeeds.<br />[/quote]<br /><br />I see, interesting.&nbsp; :) Thanks for this.


subject: Re: Obtain Mew with arbitrary glitch PokÃ©mon evolution
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheZZAZZGlitch
icon: xx
body:
  The problem here is something called VRAM inaccessibility.<br /><br />When the LCD is on, VRAM can only be read (and written to) during short, specific periods of time.<br />The underlying reason for this is that most of the time during a frame, the graphics hardware is busy drawing graphics to the screen, and it doesn&#039;t allow anything to modify or access its data when it&#039;s working on it. There are only small periods each frame that the graphics controller takes a break and allows graphics data to be modified.<br /><br />Being more exact, the time periods are called vBlank (short for &#039;vertical blanking interval&#039;) and hBlank (&#039;horizontal blanking interval&#039;). The first one occurs when the hardware finishes drawing the current frame, but hasn&#039;t yet started drawing the next frame. The second one happens if the hardware finishes drawing a single line of pixels on screen and goes to the next line. If graphics are actively displayed on the screen, these are the only periods when VRAM can ever be touched. Otherwise, the VRAM data sits there locked out from access.<br /><br />Any write on &quot;locked&quot; VRAM won&#039;t do anything.<br />Any read on &quot;locked&quot; VRAM will return 0xFF, regardless of what the address really contains.<br /><br />We really don&#039;t know when the code responsible for checking evolution data is going to run. It might, or might not run during vBlank. Or it might even run partially during an hBlank, and partially after hBlank has ended. It&#039;s impossible to predict - it comes down to microsecond-precise timing, which for a human player is essentially random.<br /><br />So this bit of data:<br /><br />[tt]10 10 10 10 10 10 08 00 00 00 10 10 10 15 12 1F 12 00 00 00[/tt]<br /><br />Will usually end up looking something like this when read by the game:<br /><br />[tt]10 FF FF FF FF FF FF FF 00 00 10 FF FF FF FF FF FF FF 00 00[/tt]<br /><br />The 0xFF bytes are there because the subroutine tries to read VRAM data outside of vBlank/hBlank, and it ends up just reading 0xFF bytes.<br /><br />The result of course comes down to timing, so it could be possible for this pattern to be shifted to a different position:<br /><br />[tt]FF FF FF FF FF 10 08 00 FF FF FF FF FF FF FF 1F 12 00 FF FF[/tt]<br /><br />I haven&#039;t tested this in more detail, but it should be possible to have this pattern shifted in such a way that the Mew evolution data could still be read. It might just take a lot of time.<br /><br />I think it would be more practical to not bother trying to put the appropriate data into VRAM, and focus on making the VRAM data slide through to SRAM and try to get the appropriate data into SRAM instead (maybe there&#039;s a Pokemon that has a &quot;01 01 15&quot; sequence in its decompressed sprite, and if not, we can just corrupt that with &#039;M/Missingno. until we get it).<br /><br />Edit: Was too late :(


subject: Re: Forum Bug List and Reports
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &quot;Latest post&quot; in board doesn&#039;t account for posts in Child Boards.<br />Currently only applies to Gen I Glitch board &amp; ACE discussion board.<br />Might be intentional, I believe it&#039;s a bug.


subject: Re: Obtain Mew with arbitrary glitch PokÃ©mon evolution
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t have a proof of what I&#039;m saying, but [url=http://glitchcity.info/wiki/Psychic/Psywave/Night_Shade_animation_glitch]this glitch[/url] (caused by the game still running the VBlank interrupt during the first three transferred screen rows) suggests that the only code that runs during VBlank is the VBlank interrupt handler. Your explanation is still right, though - only the VBlank case would never happen.


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Wow! This is really nice.&nbsp; :) Great job PokÃ©glitch86!<br /><br />Where do you store your script to make it Ho-Oh even after you reset the game? I used [url=https://forums.glitchcity.info/index.php?topic=7332.msg198934#msg198934]meta-map scripts[/url] back when I did Pallet Town into Twinleaf Town.


subject: Re: Gen III Remote Code Execution
poster_name: suloku
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  A little of topic here, but since you reversed the transfered rom and know how game detection works, modifiying the colosseum USA/JAP bonus disc to accept other region carts would be feasible? I&#039;d really like to test that. I checked a little the code, do they only use gamecodes for that?<br /><br />[quote author=HÃ¡Äky link=topic=7861.msg204420#msg204420 date=1487509131]<br />Another technique that might be useful is to take advantage of the Mystery Events feature that overrides an NPC script (used to install Normanâ€™s Eon Ticket script). By storing a script that uses the callasm command, you could execute code on demand by talking to a particular NPC.<br /><br />By writing such a script into the save file using multiboot, it might be possible to do this even in games where Mystery Events is unavailable (FireRed/LeafGreen and non-Japanese Emerald).<br />[/quote]<br /><br />It is, in fact I found that Emerald/FRLG seem to use the same slot for mistery gift script for the WonderCard script (not really checked with jap versions, since the only mistery gift script was for RS, as eon ticket in emerald is hardcoded and mistery gift only enabled an in-game flag).<br /><br />I&#039;m not sure if this reachead Glitch City, but I coded a program to create custom wondercards, and what you suggest can easily be done with a wondercard too, meaning you could even send the script+asm to other people via the wifi adapter. There&#039;s 992 bytes for the script available if I remember correctly, and it can easily be assigned to another npc.


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Deku-Kitty link=topic=7845.msg204723#msg204723 date=1489588615]<br />Question, how does leveling up Arceus to 100 make it transferable? Unless I&#039;m not in the loop, current methods cause Arceus to be shown as caught in the Mystery Zone and not the Hall of Origin. Wouldn&#039;t that discrepancy make it impossible to transfer at all?<br />[/quote]<br /><br />I also thought that there would be problems because of the &quot;Mystery Zone&quot; caught location but it turns out if you level it up to 100 in the game you caught it in Pokebank seems to think it&#039;s a non Azure Flute event Arceus and lets it through. The Mystery Zone caught location isn&#039;t shown in Sun and Moon (or gen 6) which suggests it&#039;s removed from the PokÃ©mon&#039;s data which would also explain why it isn&#039;t rejected for being problematic.


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  [quote author=Deku-Kitty link=topic=7845.msg204723#msg204723 date=1489588615]<br />Question, how does leveling up Arceus to 100 make it transferable? Unless I&#039;m not in the loop, current methods cause Arceus to be shown as caught in the Mystery Zone and not the Hall of Origin. Wouldn&#039;t that discrepancy make it impossible to transfer at all?<br />[/quote]<br /><br />In fact we do have methods allowing the HoO capture. It&#039;s just not documented here yet but works fine, although it&#039;s longer.<br /><br />1 S<br />17 O<br />14 N<br />895 O<br />510 S<br />XABB S/R<br />128 O<br />32 N<br />992 O<br />73000 N<br />Reset counter<br />502 N<br />1 N / 1 S repeatedly until you hear spear pillar music.<br />XABB S/R<br />251 S<br />252 N (last step not counted)<br />2816 S<br />288 O<br />RETIRE, Catch Arceus<br />2 S<br />288 E<br />2565 N<br />252 N<br />RETIRE<br />


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Pokeglitch86
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I believe it is a meta-map script. It is a modified version of Mr. Cheeze&#039;s mew truck save virus with much of his code still remaining, though currently unusable. The map script modifies the OAM DMA routine and the OAM DMA routine then modifies the map script keeping everything running even after changing maps or saving and resetting. Running custom scripts during the OAM DMA is what is doing the bulk of the work rather than using map scripts.


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Pokeglitch86
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The first two bytes of the OAM DMA routine are replaced with a jump command which eventually leads to the custom code. The two bytes that are over written are suppose to load C3 into register A, so we do this in our custom code before returning back to the OAM DMA routine. The custom code just ensures graphical changes are made under the right circumstances, such as copying Ho-oh&#039;s sprite (that we have stored in empty save ram) to VRAM where it will be displayed.


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The method I prefer to use is to replace<br />[code]<br />ld a, $C3<br />ldh [$FF46], a<br /><br />3E C3<br />E0 46<br />[/code]<br />with<br />[code]<br />call wCustomCode<br />ldh [$FF00+c], a<br /><br />CD wCustomCode<br />E2<br />[/code]<br /><br />and append this to wCustomCode :<br />[code]<br />ld c, $46<br />ld a, $C3<br />ret<br />[/code]<br /><br />What&#039;s the assembly for yours ? I don&#039;t fully understand how you do it.


subject: Re: Gen III Remote Code Execution
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=suloku link=topic=7861.msg204739#msg204739 date=1489844684]<br />A little of topic here, but since you reversed the transfered rom and know how game detection works, modifiying the colosseum USA/JAP bonus disc to accept other region carts would be feasible? I&#039;d really like to test that. I checked a little the code, do they only use gamecodes for that?<br />[/quote]<br /><br />I reversed the transfer process itself, not any transfered multiboot images.


subject: GlitchCity-themed Valentine's Day Cards
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  (a month late, I know.)<br />Basically, stuff like this. I&#039;ll post more in the future:<br /><br />[img]http://i.imgur.com/MDw0CPr.png[/img]<br /><br />(if you were one of 2 people who also saw it on the discord congratulations)


subject: Re: The Member's Guide to Topiclessness
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  There are some interesting fake PokÃ©mon cartridges on eBay. It could be that I just didn&#039;t look in the past, but my recent search patterns may have brought them up as I haven&#039;t seen them while casually browsing before (not sure if eBay has a [url=https://en.wikipedia.org/wiki/Filter_bubble]filter bubble[/url] or similar).<br /><br />[img]https://i.imgur.com/8KKhDgw.png[/img]<br /><br />[img]https://i.imgur.com/tNRHCKj.png[/img]<br /><br />The infamous PokÃ©mon Chaos Black.<br /><br />[img]https://i.imgur.com/dL355bi.png[/img]<br /><br />The infamous Diamond and Jade.<br /><br />[img]https://i.imgur.com/KjE2m9w.png[/img]<br />[img]https://i.imgur.com/DFBc7EA.png[/img]


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aera
icon: xx
body:
  [quote]<br />In fact we do have methods allowing the HoO capture. It&#039;s just not documented here yet but works fine, although it&#039;s longer.<br /><br />1 S<br />17 O<br />14 N<br />895 O<br />510 S<br />XABB S/R<br />128 O<br />32 N<br />992 O<br />73000 N<br />Reset counter<br />502 N<br />1 N / 1 S repeatedly until you hear spear pillar music.<br />XABB S/R<br />251 S<br />252 N (last step not counted)<br />2816 S<br />288 O<br />RETIRE, Catch Arceus<br />2 S<br />288 E<br />2565 N<br />252 N<br />RETIRE<br />[/quote]<br /><br />There&#039;s an 11k route mk finalised, a lot better than this one


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I need to check that again, I seem to remember we had trouble with other routes in french games. Thanks!


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=http://pastebin.com/8PAxHSVv]MrCheeze&#039;s virus[/url] patches the first two bytes with jp 78, and at the location it jumps to it then calls the custom code and jumps back to the rest of the OAM script. The custom code sets the a register correctly.<br /><br />Anyway, this is really cool! I want to add Marill and call it Pikablu to troll my friends


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  Thanks! I obtained an 8F on VC blue and got the setup working yesterday, just using normal encounters, in about 3.5 hours.<br /><br />I made a simple script to easily obtain any item, which s very useful for building other scripts: <br /><br />[code]<br />ldd a, (hl)<br />ldd a, (hl)<br />ldi (hl), a<br />inc b ; filler<br />ld (hl), 1<br />dec (hl)<br />inc b ; filler<br />ret[/code]<br />which compiles to <br />[code]<br />Dire Hit x58 <br />Water Stone x4 <br />Max revive x1<br />Revive x4 <br />TM01 x[Any qty]<br />[/code]<br />This sets the index of the 2nd item to its quantity (make sure 8F is the first irem obviously), and it&#039;s quantity to 0 for easy tossing to any desired quantity. <br /><br />This requires only items that can be bought from Celedon dept store, with no missingno duping. <br /><br />Then, you can use it once to get a Max revive x0 stack, so you can get rid of the revive to compact the script slightly.


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Pokeglitch86
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pokeglitch86
icon: xx
body:
  Yes, I&#039;m just using the code Mr. Cheeze wrote, but I have it calling another script before returning back to OAM.<br /><br />I actually was originally disguising a Seadra as a Marill (named Pikablu of course)! But then I decided to switch to adding Ho-oh instead. I think for version 2 I may make it a Pikablu rather than a Ho-oh, as well as getting Mr. Cheeze&#039;s virus working with my code so you could trade that Pikablu to a completely unmodified cartridge. 


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  This was originally a secret but I may as well share it now. Me and ISSOtm are working on something cool that started (coincidentally) shortly before your thread, and part of it (not all of it) involves obtaining Pikablu (a PokÃ©mon modified to have Marill&#039;s sprite).<br /><br />Would you like to team up on Discord? Thinking if we share our code it may help the project finish a lot faster and you can have the BGB save state of what&#039;s been done so far.


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pokeglitch86 link=topic=7888.msg204758#msg204758 date=1489960707]<br />Oh absolutely! My documentation is incredibly poor, so be warned. What exactly do you have in mind?<br />[/quote]<br /><br />Cool, thanks! :) I will send you a PM about it.


subject: Re: What Are The Reasons Behind The Merge Glitch?
poster_name: rinlingyo2016
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you for your thorough answers :)<br /><br />I think I understand:<br />A shifting needs to occur when taking Pokemon out of the box. Everything is shifted above the Cancel button since Cancel should be at the end of the list. However, when we have a Pokemon in the box like Charizard &#039;M, he&#039;s read as the Cancel button, so glitchy things happen to the Pokemon below him. It&#039;s as if the game is trying to shift the Pokemon found below Cancel, but it doesn&#039;t know how to do it properly, so they become partially shifted and merged together.<br /><br />We plan to cover the merge glitch at our Pokemon Glitches panel, so I think this is how I&#039;ll explain the gist of why the glitch works, and I&#039;ll refer them here if anyone wants more detailed explantions.


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  MAJOR UPDATE!<br /><br />#meme created. Once again, blame Charmy. Use it to upload cancer in image form (read: memes) You also will not see if new posts are made, you&#039;ll have to check back manually (if you want to, that is.)<br /><br />New rule: If someone of Member+ or higher requests it, I will create a room for them to post things (SoCs, research notes, etc.) and it will be read-only except for them and Admin or higher. This only applies if it&#039;s used for research purposes.<br /><br />Rule amendment: You may have a nick on the server that differs from the one on GCLF as long as it is in this format:<br />&lt;GCLF nick&gt; (&lt;extra stuff&gt;)<br />The parenthesis set may be swapped out for these sets:<br />[ ], &lt; &gt;, { }<br /><br />New Rank: Those that make great discoveries and documents them [i]live[/i] in chat will get the rank of &quot;Chat Scientist&quot;. This will be a clone of Member+, but you will retain your previous rank if it was higher than Member+.<br /><br />That is all.


subject: Re: The Member's Guide to Topiclessness
poster_name: Missing? NO!
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=3088.msg204748#msg204748 date=1489879367]<br />The infamous PokÃ©mon Chaos Black.<br />[img]https://i.imgur.com/dL355bi.png[/img]<br />[/quote]<br /><br />I remember really wanting a copy of Chaos Black back in the day, just so I could play a quality ROMhack on my GBA. I might take a look at eBay to see if that&#039;s still there. Might be cool to see what all the hype was about ten years ago.


subject: Re: What Are The Reasons Behind The Merge Glitch?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I believe indeed it is very important to explain the glitches for those who would like to understand them. This is why on PRAMA we always try to write an optionnal &quot;technical explanation&quot; section for every single page we write. When I personally don&#039;t know something about a 1G glitch, I usually ask ISSOtm since he&#039;s the team expert for these. Otherwise I ask here or I annoy Torchickens :D<br /><br />Well those pages are in French obviously but if you need something that we wrote you could probably Google translate or just ask! We might wanna add a similar feature here for the glitches in the wiki that still requires explanation.


subject: Re: The Member's Guide to Topiclessness
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Zowayix
icon: xx
body:
  I think I purchased Pokemon SeaBlue or something like that on eBay once, just for funsies. It&#039;s interesting how they just pass it off as though it was any other Pokemon game.<br /><br />I still haven&#039;t played it because I&#039;m lazy<br /><br />Edit: Yeah, it was Bluesea, and also &quot;Pokemon Frigo Returns&quot;, whatever that is. All I know is that they&#039;re both GBA games.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You could remove the<br />[code]<br />ld a, [hli]<br />ld [hld], a<br />[/code]<br />since it effectively does nothing.<br />Item pack :<br />[code]<br />8F<br />[item] x(Any)<br />Dire Hit x4 <br />Max revive x1<br />Revive x4 <br />TM01 x[Any qty]<br />[/code]<br /><br />A more efficient setup (IMO) is<br />[code]<br />8F<br />Item x[any qty]<br />PokÃ© Ball (or Great Ball) x43<br />Revive x3<br />TM01 x[any qty]<br />[/code]<br />Toss all of &quot;Item&quot; but one, then use. You now have 0 of that item :)


subject: Re: GlitchCity-themed Valentine's Day Cards
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7889.msg204747#msg204747 date=1489876562]<br />(if you were one of 2 people who also saw it on the discord congratulations)<br />[/quote]<br />Thanks.<br />I saw it before :).


subject: Re: The Member's Guide to Topiclessness
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Charmy
icon: xx
body:
  Here&#039;s a challenge.<br />https://allegro.pl/gry-na-konsole-game-boy-advance-82328?string=Pokemon&amp;bmatch=base-relevance-floki-5-nga-cul-1-3-0222<br />Try to count all the fakes\bootlegs here.<br />Edit:Hello fellow people from that Prism server.<br />If you&#039;re reading this, this means you&#039;re too slow.<br />Anyway, have a &quot;good&quot; time here.


subject: Re: Programming the Snake game in Pokemon Crystal in real hardware!
poster_name: andr2535
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  Hi, I thought this was very interesting, but it doesn&#039;t work for the english version, so I thought I would make some sort of port. <br /><br />I started on the assumption that the user already has an item pointing to the first box name.<br /><br />So since some of the opcodes required for Crystal_&#039;s implementation is missing from the english version I thought that since there is already a ram editor for the silver/gold coin case glitch<br />I could just edit that and make the box names point to the PC&#039;s first item.<br />[url=http://pastebin.com/AEALLsqR]http://pastebin.com/AEALLsqR[/url]<br /><br />The assembled code:<br />p0&#039;d0IÃ©J5<br />p0&#039;m0(mn)Ã©I5<br />&#039;m55<br /><br />Now that we can point to the PC&#039;s first item we need to get an item setup that can edit an arbitrary ram location, I have modified Crystal_&#039;s<br />implementation of the RAM editor, such that it operates the same way as the coin case glitch one, except that you don&#039;t need specific move patterns<br />and it uses the BOX 4 name instead of BOX 9 name.(I hope it&#039;s alright me more or less copying the code...)<br />[url=http://pastebin.com/YjZ4xEi5]http://pastebin.com/YjZ4xEi5[/url]<br /><br />it&#039;s probably easier to read the item requirement in the pastebin, so I won&#039;t copy them here :P<br />You can test that the code works with this code:<br />&#039;t9&amp;/AC<br />should make your character green.<br /><br />I made some item modifying codes to make it possible/easier to get some of the requirements:<br />[url=http://pastebin.com/GWXC1u2Q]http://pastebin.com/GWXC1u2Q[/url]<br /><br />the only code of those that are really necessary are the code for the amount of items in the first spot in the item bag, this is the assembled version of the x144 code:<br />p0QÃ©U2&#039;d<br /><br />I haven&#039;t tried yet, but I think that it would be trivial to do the rest of what is done in Crystal_&#039;s implementation from here on.<br /><br />I used a list of all the letters available in box names that I compiled myself because I couldn&#039;t find a similar list, I have thrown that on pastebin here:<br />[url=http://pastebin.com/jxLY31kq]http://pastebin.com/jxLY31kq[/url]<br />I also edited a list of opcodes for the game boy to only include those accessible using box names an image of it is attached,<br />hopefully they will be of use to someone :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The ld a, [hld] / ld [hli], a part is what copies the quantity of the item to its index, allowing access to any item index; your script just sets the quantity to 0. But since both are useful behaviours, then I swap the water stones (ld a [hli]) with HP ups (inc hl) if I want to reset the item quantity without setting the index too.<br /><br />Another question: Is there an easy way to find the memory locations and ROM banks that corresponds to a particular label in the disassembly? I had an idea for a script to make tossing items a bit less tedious by copying the graphics for digits or letters over the place where the game reads tiles for glitch quantities from, so it would be easier to see at a glance how many items you have / are tossing, but I&#039;d need the locations for CopyVideoData and FontGraphics


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Charmy
icon: clip
body:
  Guys, today is the sad day, that Discord died.<br />Yeniaul, sorry for the spam in #shitpost.<br />Naltronix and Torchickens, sorry for the group spam, Discord was shitting on itself.<br />I also got a friend request from this guy at the same time it started getting bad.<br />I blame him.<br />Help, I&#039;m scared.<br />Edit: it&#039;s fine now, and the guy that sent me a request just so happened to be a normal guy. Don&#039;t blame him.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  When you build the ROM, it generates two files which contain all the addresses.<br />I attached the file for Red.<br /><br />I recommend you know how to use Ctrl+F :P


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  Ah, thanks, I was wondering what the .sym files were for, for some reason it didn&#039;t occur to me to look inside them!<br /><br />Edit: And here is said script:<br />[code]<br />Carbos x90 <br />Master Ball x14 <br />PokÃ© Ball x84 <br />Repel x128 <br />Carbos x24 <br />X Accuracy x134 <br />TM29 x0 <br />Carbos x144 <br />X Accuracy x0 <br />TM01x[Any qty]<br />[/code]<br /><br />[code]ld h, $5A<br />ld bc, $040E ; b = BANK(FontGraphics), c = 14 = how many tiles to copy<br />ld d, h<br />ld e, $80 ; de = FontGraphics<br />ld h, $18<br />ld l, $86<br />push hl ; hl = CopyVideoDataDouble<br />nop<br />ld h, $90<br />ld l, $0 ; hl = the tiles in VRAM that come after the digits<br />ret ; jumps to CopyVideoDataDouble (done this way to avoid glitch items and key items that would result from directly using call or jp)<br />[/code]<br /><br />This turns the tiles beyond the numbers that glitch quantities read from into the letters A through P, so it&#039;s easier to see how many items you have / are tossing. (There will also be a bunch of letters all over the background).<br /><br />The effect goes away when entering/leaving a building, entering/leaving a battle, resetting the game, or closing the PC item menu, and maybe a few other things.<br /><br />Tested with English blue on BGB.


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, i have no idea what happened either, but it wasn&#039;t just you.<br />[img]https://feen.us/to170h4goh3a1e8byau6.png[/img]


subject: Manipulate specific flags?
poster_name: suloku
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello,<br /><br />I&#039;ve been reading about gen 3 ACE and glitches trying to find a way to manipulate specific flags (specifically, Emerald&#039;s event islands for legendary pokÃ©mon) and after reading about the inner works of ACE and glitzzer popping I have some doubts:<br /><br />- I&#039;ve seen that via Glitzzer popping the flags to birth, faraway and southern island can be enabled, but for what I&#039;ve read about the how the glitch works, those are only enabled because of the game recognizing the data as a corrupt pokÃ©mon and setting it as a bad egg, which results in the flags being enabled. The flags for the 4 islands are consecutive, but to my understanding there&#039;s no way to manipulate the address, in fact that there&#039;s a glitch pokÃ©mon that makes those two flags for the islands get enabled is quite lucky already. Am I wrong and can glitzzer popping be altered to manipulate any flag given we know where it is?<br /><br />- Since I though I couldn&#039;t achieve what I wanted via glitzzer popping, I though ACE was the way to go as showcased here: https://www.youtube.com/watch?v=m9pvNYdhldo&amp;t=31s<br /> The method seems promising as even with the 60 instruction limit, I think enabling 4 flags should fit, but as I don&#039;t know ASM I don&#039;t have a clue about how to write the payload for setup. I do know how to find the ASM in the rom for the setflag instruction scripting uses though, but without knowing how to use it, doesn&#039;t really make a difference.<br />Also, I don&#039;t know if the savegame being &quot;aligned&quot; (blocks 0-14 being in ascending order as seen here https://www.youtube.com/watch?v=1pb-6hMDQBs) is a requirement for this ACE method.<br /><br />The ultimate goal is just a simple ACE that enables the 4 island flags, the items can be obtained via glitzzer popping so they aren&#039;t a problem. Being able to enable/disable flags could have other uses, like re-battling the legendaries, which might also be interesting.<br /><br />I personally prefer the ACE way, since glitzzer popping corruption flag enabling also changes undesired flags in the process, so ACE should be a lot cleaner for the savefile imho.


subject: Re: Manipulate specific flags?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  You should look up Z80ASM guides for the TI-83+. It&#039;ll carry over nicely to the gbz80.<br />Anyway, 60 instructions may not be enough, because the game may check for such changes and null them or if you just save the flags and RET the hell out, you may not exit cleanly. You may even have to call the normal functions that handle special events. Ask ISSOtm, Wack0 or TheZZAZZGlitch.


subject: Re: Manipulate specific flags?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7890.msg204780#msg204780 date=1490100043]<br />You should look up Z80ASM guides for the TI-83+. It&#039;ll carry over nicely to the gbz80.<br />Anyway, 60 instructions may not be enough, because the game may check for such changes and null them or if you just save the flags and RET the hell out, you may not exit cleanly. You may even have to call the normal functions that handle special events. Ask ISSOtm, Wack0 or TheZZAZZGlitch.<br />[/quote]<br /><br />GBA uses ARMv4...<br /><br />Anyway, if you want code exec, and you have a Wii and a GC-&gt;GBA link cable, you can use the RCE I found and detailed here http://forums.glitchcity.info/index.php?topic=7861.0<br /><br />You&#039;ll be able to write your payloads in C there, hopefully it&#039;s what you need (you&#039;d be able to get the items with it as well, FYI, you&#039;ll have lots of space for your payload, about 124 KB...)


subject: Arceus Plate Glitch Discoveries
poster_name: Deku-Kitty
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Deku-Kitty
icon: xx
body:
  I know that there&#039;s a thread already on this glitch, but considering it&#039;s 7 years old I wasn&#039;t sure if I should have bumped it or not. You can merge this with that thread if that would be better.<br /><br />For a refresher, the Arceus Plate Glitch is a glitch where having an Arceus holding a plate in the first slot of your party will freeze the game upon encountering a Pokemon in the Safari Zone/Great Marsh and Pal Park.<br /><br />This glitch was quite hard to test before due to how difficult Arceus was to obtain without hacking, but thanks to the Pal Park Retire glitch it is much easier to get an Arceus. So I slapped a plate on my Arceus obtained via the glitch and headed off to the Great Marsh in my US version of Pearl. Sure enough, the game froze with that wonderful nightmare inducing screech. <br />One trade later, I then tested the glitch in my US Platinum. The glitch didn&#039;t work, I was able to catch Pokemon in the Marsh with 100% less crashing. And yes, my Arceus did have a plate and was in the first slot of my party. This surprised me, as the lack of this glitch working is in contrast to its entry on Bulbapedia, which lists it under glitches that work in Diamond, Pearl, and Platinum. <br /><br />TL;DR<br />- The glitch does work with the Arceus obtained via Pal Park Retire.<br />- Because of this, it&#039;s likely that any Arceus will cause this glitch, how it&#039;s obtained is irrelevant. <br />- Contrary to some sources, I was unable to get the glitch to work on an American copy of Platinum.<br />- It can be assumed that this glitch does not work on any version of HGSS, backed up by research from the old thread.<br /><br />Questions<br />- Does the glitch work in Japanese versions of Platinum?<br />- Does it work in other languages versions of Diamond and Pearl?<br />- Why does this glitch happen at all? What part of Arceus holding a plate cause the game to crash in these areas where you don&#039;t even send out a Pokemon?


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Charmy link=topic=7855.msg204775#msg204775 date=1490042748]<br />Naltronix and Torchickens, sorry for the group spam, Discord was shitting on itself.<br />[/quote]<br /><br />It&#039;s OK! :)


subject: Re: Manipulate specific flags?
poster_name: suloku
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The point would be to do it with only a GBA cartridge, as I pointed in the thread, If I only wanted to execute in-game script commands I could do it via wondercards (but your RCE method is way more powerful and has more possibilities). Would be interesting to see this implemented as a GBA to GBA hombrew, instead of GC/Wii to GBA, but that&#039;s another topic.<br /><br />I went asked TheZZAZZGlitch on his video. I don&#039;t know if the flags are in the DMA regions, but if they aren&#039;t, would that 60 instruction limit allow to set a bit at a certain memory location given we know that exact memory address beforehand?<br /><br />ps: sorry for any stupid question, but I don&#039;t really know anything about assembly


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: naltronix
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: naltronix
icon: xx
body:
  It&#039;s fine, don&#039;t worry. I just did @Torchickens so he could clear up the spam from when discord died.<br />EDIT: To clear up about my second point, it was in #shitpost not in the group dms.


subject: Re: Manipulate specific flags?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7890.msg204781#msg204781 date=1490102812]<br />GBA uses ARMv4...[/quote]<br />I am aware, but he should start with Z80ASM anyway, as skills he learns in Z80 can be transferred to ARM, [i]and[/i] he can write Gen 1/2 ACE scripts.<br />Derp. :P


subject: Re: Manipulate specific flags?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=suloku link=topic=7890.msg204784#msg204784 date=1490109288]<br />Would be interesting to see this implemented as a GBA to GBA hombrew<br />[/quote]<br /><br />Unfortunately, not possible. The GBA&#039;s JoyBus link support only allows for a GBA to be the slave.


subject: Re: Arceus Plate Glitch Discoveries
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The crash part might be because the game attempts to edit the type of a non-loaded PokÃ©mon (since you didn&#039;t even send one out).<br />100% not verified hypothesis right thar.


subject: Can't add items to glitched bag in Blue VC
poster_name: glitchycharizardlord
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: question
body:
  So I was trying to get the expanded bag in Blue VC and mistakenly activated the item stack duplication glitch and messed up my bag. I tried tossing every item but now my bag is glitched and i cant add anything to my bag. Buying two items doesnt fix it and they dont appear at all in list. I tried receiving the old rod and it didnt show up either. I have<br />[list]<br />[li]Antidote x1[/li]<br />[li]repel x99[/li]<br />[li]poke ball x97[/li]<br />[li]cancel (when selected, treated as tm 55 -flash)[/li]<br />[li]blank spot behaves same as above[/li]<br />[li]same as above[/li]<br />[li]blank spot i cant select or get to[/li]<br />[/list]<br /><br />Mashing down gets me to random items and glitch entries but I don&#039;t see the items I bought. I could move those items to my bag by mashing select and up once I get to regular bag. I wanna setup arbitrary code execution so I could get legit mews to transfer to SM. How do I reset the bag to normal?


subject: Re: Can't add items to glitched bag in Blue VC
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Don&#039;t worry. How far down can you go before being stopped ? Try purchasing more items, it should eventually fix everything.


subject: Re: Can't add items to glitched bag in Blue VC
poster_name: glitchycharizardlord
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: glitchycharizardlord
icon: xx
body:
  Well i kept mashing down and I was able to get to the &quot;bottom&quot; of the bag and there were the items I picked up. Mashing down again looped me to the top of the bag with the antidote, etc. Do I need to buy multiple different items or a lot of one item?<br /><br />Edit: Well you were right, buying items eventually fixed the bag. I was messing around with the items and was able to teach cut before I went on the ss anne. I basically want to get to celadon city asap. Will progressing without going on the ss anne mess up my save?


subject: Glitch City Research Outpost (spin-off discord server)
poster_name: naltronix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey! I created an RP discord server just for some fun.<br />The instructions are in #rules, just DM me if any issues arise.<br />Enjoy!<br />https://discord.gg/Fx748uH


subject: Re: Can't add items to glitched bag in Blue VC
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Multiple different is always better.<br /><br />You can skip SS Anne legit by trading a PokÃ©mon that knows Cut, or blacking out of the ship. For example.<br />So it&#039;s 100% fine, and you&#039;re able to go back later without the glitch ^^


subject: Re: Looking for copies of PokÃ©mon Geum and Eun (Korean)
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you search around Naver (the Korean Google basically) with the Korean names (í¬ì¼“ëª¬ìŠ¤í„° ê¸ˆ &amp; ì€) you might be able to find something. 


subject: Re: Arceus Plate Glitch Discoveries
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Deku-Kitty link=topic=7891.msg204782#msg204782 date=1490103832]<br />One trade later, I then tested the glitch in my US Platinum. The glitch didn&#039;t work, I was able to catch Pokemon in the Marsh with 100% less crashing. And yes, my Arceus did have a plate and was in the first slot of my party. This surprised me, as the lack of this glitch working is in contrast to its entry on Bulbapedia, which lists it under glitches that work in Diamond, Pearl, and Platinum. <br />[/quote]<br />Worth noting that the entry on Bulbapedia points out that it&#039;s unknown whether it works in Platinum or HGSS. I had only tested it in Diamond, so it&#039;s good to get it confirmed that it doesn&#039;t occur in Platinum.


subject: Re: &quot;ZZAZZ glitch&quot;?
poster_name: shatteredClockworks
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Basically, best way to destroy data.<br />It&#039;s kinda...scary, in some ways.<br /><br />ALL THE Z&#039;s!<br />ALL OF THEM!


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: gold55803
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: gold55803
icon: xx
body:
  Really stupid question, but could someone explain how data substructures work? The guides on bulbapedia make no sense to me... :&#039;(<br />also, how do you get a bag egg to battle? :???:


subject: PokÃ©mon Crystal unused character?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  In PokÃ©mon Crystal there is a character which I don&#039;t remember being used on any NPC, which I found listed on a list of character indices on the PokÃ©mon Crystal disassembly (https://github.com/pret/pokecrystal/blob/master/constants/sprite_constants.asm).<br /><br />This character can be viewed on BGB (v1.5.2) with the code 013F54D1 but the code working may be due to a presumable emulation error (as I tried the code on an Xploder GB with PokÃ©mon Crystal on a real Game Boy Advance SP and it didn&#039;t work).<br /><br />These are his sprites with the male character&#039;s palette.<br /><br />[img]https://i.imgur.com/S0oItqj.png[/img] [img]https://i.imgur.com/EN5c0oM.png[/img] [img]https://i.imgur.com/GwvcWzM.png[/img] [img]https://i.imgur.com/cgodVqY.png[/img]<br /><br />Video of the code in action:<br />https://www.youtube.com/watch?v=9_oacF2y9pc


subject: Pursuit glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It looks like there is an obscure glitch involving the move Pursuit in Generation II that was documented by someone or a source named Uwasa Ishi (Japanese: å™‚çŸ³). I&#039;m unsure if it only works on the Japanese versions but from what I gather it seems like if you switch out a PokÃ©mon with a status condition and it faints from Pursuit, the status condition will return upon reviving the PokÃ©mon with a Revive.<br /><br />http://hakuda2.web.fc2.com/wario/poke3/n8.html<br /><br />I haven&#039;t tested this glitch yet though. Thoughts?


subject: Re: Arceus Plate Glitch Discoveries
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I tested with [url=https://projectpokemon.org/forums/files/file/272-movie-2009-arceus/]the 12th movie Arceus[/url] and there was no crash after a Great Marsh wild encounter in both Japanese Diamond and Japanese Platinum while holding a Plate and being the first entry on the PokÃ©mon List.


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aera link=topic=7845.msg204740#msg204740 date=1489851455]<br />The Mystery Zone caught location isn&#039;t shown in Sun and Moon (or gen 6) which suggests it&#039;s removed from the PokÃ©mon&#039;s data which would also explain why it isn&#039;t rejected for being problematic.<br />[/quote]<br /><br />In Diamond, Pearl, Platinum, HeartGold, and SoulSilver, there are two &quot;Mystery Zone&quot; headers: [tt]0000[/tt] is for maps while [tt]07DC[/tt] is a caught location. All games afterwards have a single &quot;Mystery Zone&quot; header that goes unused.


subject: Re: PokÃ©mon Crystal unused character?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This sprite also exists in Gold and Silver. [url=https://www.pokecommunity.com/showthread.php?t=232830]JohtoMap[/url] has a feature where it shows the sprites of characters and [tt]3F[/tt] is apparently supposed to look red.<br /><br />Could you update [url=https://tcrf.net/PokÃ©mon_Gold_and_Silver#Unused_NPC_Sprite]the TCRF article&#039;s section[/url] with that spriteset? You could merge the 4 sprites into a single image, too.


subject: Re: PokÃ©mon Crystal unused character?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7894.msg204807#msg204807 date=1490291279]<br />This sprite also exists in Gold and Silver. [url=https://www.pokecommunity.com/showthread.php?t=232830]JohtoMap[/url] has a feature where it shows the sprites of characters and [tt]3F[/tt] is apparently supposed to look red.<br /><br />Could you update [url=https://tcrf.net/PokÃ©mon_Gold_and_Silver#Unused_NPC_Sprite]the TCRF article&#039;s section[/url] with that spriteset? You could merge the 4 sprites into a single image, too.<br />[/quote]<br /><br />Thanks for this! So by using the Game Genie code 3F4-52A-08A in English Gold you can replace the left-most PokÃ©mon Center nurse with this NPC sprite. :)<br /><br />I&#039;m just a little confused, do you want me to add the red sprites to the article (as you wrote the sprite is supposed to look red) or a version of the sprites with no palette assigned? The confusion was from the TCRF article stating there is no palette for the NPC.


subject: Re: PokÃ©mon Crystal unused character?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7894.msg204808#msg204808 date=1490302429]<br />Thanks for this! So by using the Game Genie code 3F4-52A-08A in English Gold you can replace the left-most PokÃ©mon Center nurse with this NPC sprite. :) <br />[/quote]<br /><br />And thank you for looking that up!&nbsp; :D <br /><br />[quote author=Torchickens link=topic=7894.msg204808#msg204808 date=1490302429]<br />I&#039;m just a little confused, do you want me to add the red sprites to the article (as you wrote the sprite is supposed to look red) or a version of the sprites with no palette assigned? The confusion was from the TCRF article stating there is no palette for the NPC.<br />[/quote]<br /><br />Oh. My apologies, I added that before looking at the ROM on JohtoMap. I&#039;m talking about the red sprites, yes. That supposition about the palette can be safely removed now.


subject: Re: PokÃ©mon Crystal unused character?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=http://forums.bulbagarden.net/index.php?threads/unused-location-in-gen-ii.174506/]Seems like the Japanese versions have an unused header for a removed location,[/url] which was called ã€Œã‚ªãƒã‚±ã‚„ã—ãã€&nbsp; [i]Haunted House[/i]. The English versions erased this reference by replacing the header&#039;s string with &quot;N/A&quot;.


subject: Re: PokÃ©mon Crystal unused character?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7894.msg204811#msg204811 date=1490313888]<br />[url=http://forums.bulbagarden.net/index.php?threads/unused-location-in-gen-ii.174506/]Seems like the Japanese versions have an unused header for a removed location,[/url] which was called ã€Œã‚ªãƒã‚±ã‚„ã—ãã€&nbsp; [i]Haunted House[/i]. The English versions erased this reference by replacing the header&#039;s string with &quot;N/A&quot;.<br />[/quote]<br /><br />Yeah, I noticed your comment and it made me really curious whether it inspired the Old Chateau in Generation IV. I&#039;ve updated the TCRF page with that theory.<br /><br />It would be really cool if Gold/Silver had a haunted house to explore.&nbsp; :)


subject: Re: PokÃ©mon Crystal unused character?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  [quote author=Torchickens link=topic=7894.msg204812#msg204812 date=1490315031]<br />It would be really cool if Gold/Silver had a haunted house to explore.&nbsp; :) <br />[/quote]<br /><br />Indeed. Silktree suggests that the Haunted House would&#039;ve been found in Olivine City and that its inspiration was possibly the [url=https://en.wikipedia.org/wiki/Himeji_Castle#Lore_and_legend]Himeji Castle[/url].


subject: Re: PokÃ©mon Crystal unused character?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=SatoMew link=topic=7894.msg204813#msg204813 date=1490315385]<br />[quote author=Torchickens link=topic=7894.msg204812#msg204812 date=1490315031]<br />It would be really cool if Gold/Silver had a haunted house to explore.&nbsp; :) <br />[/quote]<br /><br />Indeed. Silktree suggests that the Haunted House would&#039;ve been found in Olivine City and that its inspiration was possibly the [url=https://en.wikipedia.org/wiki/Himeji_Castle#Lore_and_legend]Himeji Castle[/url].<br />[/quote]<br /><br />Cool! Was that discussion publicly online? May you link to Silktree&#039;s theory please?


subject: Re: PokÃ©mon Crystal unused character?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7894.msg204814#msg204814 date=1490315790]<br />Cool! Was that discussion publicly online? May you link to Silktree&#039;s theory please?<br />[/quote]<br /><br />Yes, he said that in the Bulbagarden Forums thread I linked to above. [url=http://forums.bulbagarden.net/index.php?threads/unused-location-in-gen-ii.174506/#post-5510586]Here&#039;s the direct link to his post[/url]&nbsp; :) 


subject: Re: PokÃ©mon Crystal unused character?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7894.msg204815#msg204815 date=1490316195]<br />[quote author=Torchickens link=topic=7894.msg204814#msg204814 date=1490315790]<br />Cool! Was that discussion publicly online? May you link to Silktree&#039;s theory please?<br />[/quote]<br /><br />Yes, he said that in the Bulbagarden Forums thread I linked to above. [url=http://forums.bulbagarden.net/index.php?threads/unused-location-in-gen-ii.174506/#post-5510586]Here&#039;s the direct link to his post[/url]&nbsp; :)<br />[/quote]<br /><br />Thanks Sato! ^_^


subject: Re: PokÃ©mon Crystal unused character?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7894.msg204816#msg204816 date=1490316483]<br />Thanks Sato! ^_^<br />[/quote]<br /><br />You&#039;re welcome! ^.^


subject: Glitch Pikachu cries in Yellow
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I&#039;m considering recording all of the glitch Pikachu cries by ID.<br /><br />If anyone else would like to help, you can enter the following code for ws m.<br /><br />Valid values only range from 0x00 to 0x29, which leaves the rest of the values as glitch sound clips!<br /><br />[code]<br />ld e,xx<br />ld b,3c<br />ld hl,4000<br />call 3e84<br />ret<br />[/code]<br /><br />If we want to represent this with reasonable items, prepare:<br /><br />Repel x (cry ID)<br />PokÃ© Ball x 6<br />Fresh Water x 33<br />Master Ball x 64<br />Soda Pop x 45<br />TM05 x 132<br />Lemonade x 201<br /><br />(1e 02 04 06 3C 21 01 40 3d 2d CD 84 3E C9)<br /><br />Hope this comes useful for anyone else who would like to experiment!&nbsp; :)<br /><br />Edit: (Some) may differ depending on the location you play them.


subject: Re: Dissapearing Mimikyu Minor Glitch
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SnorlaxMonster
icon: xx
body:
  Due to [url=https://www.gamefaqs.com/boards/187276-pokemon-sun/74977651]this GameFAQs thread[/url], I tried out some other things and found that this glitch applies to far more than just the Red Card.<br /><br />If the user of Sky Drop faints or switches out upon inflicting damage while Battle Effects are off, the target remains invisible. I managed to reproduce this with Iron Barbs, the Life Orb, and the Rocky Helmet.<br /><br />Also, it&#039;s worth noting that if there are 2 wild Pokemon (due to an SOS call), the Red Card switches your Pokemon rather than forcing you to flee.<br /><br />EDIT: Also, I should point out that this also occurs in Generation VI. This is not new to Generation VII.


subject: Re: Manipulate specific flags?
poster_name: suloku
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7890.msg204787#msg204787 date=1490117417]<br />Unfortunately, not possible. The GBA&#039;s JoyBus link support only allows for a GBA to be the slave.<br />[/quote]<br /><br />I&#039;m getting of topic, but the GBA 10ANNIV rom (and probably others) worked by sending a client application the GBA from another GBA. The leaked official SDK has an example about this too (by the way one of the 10ANNIV roms was made public recently).


subject: Re: Manipulate specific flags?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=suloku link=topic=7890.msg204820#msg204820 date=1490347917]<br />[quote author=Wack0 link=topic=7890.msg204787#msg204787 date=1490117417]<br />Unfortunately, not possible. The GBA&#039;s JoyBus link support only allows for a GBA to be the slave.<br />[/quote]<br /><br />I&#039;m getting of topic, but the GBA 10ANNIV rom (and probably others) worked by sending a client application the GBA from another GBA. The leaked official SDK has an example about this too (by the way one of the 10ANNIV roms was made public recently).<br />[/quote]<br /><br />That uses the GBA BIOS multiboot, which is different from the multiboot implemented inside of R/S/E/FR/LG (which uses the JoyBus protocol over the link cable for communicaion with the GameCube games).


subject: Re: Dissapearing Mimikyu Minor Glitch
poster_name: Deku-Kitty
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SnorlaxMonster link=topic=7818.msg204819#msg204819 date=1490342715]<br />Due to [url=https://www.gamefaqs.com/boards/187276-pokemon-sun/74977651]this GameFAQs thread[/url], I tried out some other things and found that this glitch applies to far more than just the Red Card.<br /><br />If the user of Sky Drop faints or switches out upon inflicting damage while Battle Effects are off, the target remains invisible. I managed to reproduce this with Iron Barbs, the Life Orb, and the Rocky Helmet.<br /><br />Also, it&#039;s worth noting that if there are 2 wild Pokemon (due to an SOS call), the Red Card switches your Pokemon rather than forcing you to flee.<br /><br />EDIT: Also, I should point out that this also occurs in Generation VI. This is not new to Generation VII.<br />[/quote]<br /><br />Dang, Sky Drop is the glitchiest move since TMTRAINER.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: suljko
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is the Arceus that you get from the glitch transferable, i would also ask that if I changed its location obtained to Hall of Origin and lv&#039;ed it to 100 would it transfer to further pokemon games? :???:


subject: Changing Starter Pokemon with 8f??
poster_name: georgewashingmonton
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: georgewashingmonton
icon: xx
body:
  Hello,<br /><br />I was wondering if anyone made an 8f script that changes the 3 starter pokemon that Oak gives you in Pokemon Red/Blue.<br />----<br />A script that I was looking for would involve:<br />-Randomizing the 3 starters (they would all be different/no repeats, &amp; not be any glitch pokemon), so you can choose which ever one you want.<br /><br /><br />^^^if the above is too complicated...maybe we can go with a more simple script like...:<br />-(after you choose a starter, you deposit it in the pc) <br />-the pokemon in pc box 1, slot 1...will have its species changed to a random legit pokemon (no glitched pokemon) after using 8f<br />-----<br />[b]*Note: [/b]I am aware of pokemon randomizer roms that allow you to customize much more than just starters...but they don&#039;t work on actual consoles.


subject: Re: Changing Starter Pokemon with 8f??
poster_name: naltronix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It would need to be running in the background, as using 8F for a romhack would be boring having to trigger the 8F scripts.<br />See: MrCheeze&#039;s Virus.


subject: How did a glitch item delete my save file?
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was trying to build an 8F script on VC Blue, and accidentally created a glitch item (think it was 0x86). Without really thinking, I clicked on it, and my game crashed into a stripey screen. But when I restarted, the save file was gone - it didn&#039;t give any error message or anything, the continue option was just removed from the menu. As far as I&#039;m aware, this can only happen when the player name gets corrupted in SRAM with no terminator. What happened here? Is there any point where the game opens SRAM without closing it? Or did the glitch item open SRAM by itself? This has happened to me before when I used 8F without the correct setup and must have hit an rst 38, but I&#039;ve also done that before without my save file deleting.


subject: Re: Changing Starter Pokemon with 8f??
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not even needed. Just write something to $DF00 onwards, then partially reset the game (reset but don&#039;t clear WRAM after $DEFF). Doable if you have a save file with 8F on the cartridge you want to run the thing on.<br /><br />What do you mean by &quot;no repeats&quot; ?<br />Wouldn&#039;t be simpler to just give you the PokÃ©mon you want ?<br /><br /><br />Also, you CAN play randomized ROMs on console, you just need to fix their headers so the console will think they are legit.<br />Ask if you want a setup to &quot;legitimate-ify&quot; such a ROM (are you on Windows or Linux ?)


subject: Re: How did a glitch item delete my save file?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  SRAM is open when a value $XA (X being any hex digit) is &quot;written&quot; to address range $0000 - $1FFF). This may happen either by writing such a value directly, or incrementing / decrementing a value in ROM. Example : incrementing the byte at $0060 (which is a $D9) will unlock SRAM.<br /><br />If SRAM is overwritten with junk afterwards, the game may either think the save file is corrupted or simply doesn&#039;t exist.<br />You can get your PokÃ©mon back if you perform the SRAM glitch (without the &quot;Clear saved data ?&quot; part, of course :P), they just will be considered traded PokÃ©mon.<br />Just make sure never to power off too late : if you get a &quot;the save is destroyed !&quot; message you CAN try again, don&#039;t delete saved data.<br />If you can load your file but cannot access the PokÃ©mon menu afterwards it&#039;s over :/


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Since x0 quantities are a bit of a pain to get, I&#039;d recommend this :<br />[code]<br />Carbos x90 <br />Master Ball x13<br />PokÃ© Ball x84 <br />Repel x128 <br />Carbos x24 <br />X Accuracy x134 <br />TM29 x3<br />Carbos x144 <br />X Accuracy x0 <br />TM01x[Any qty]<br />[/code]<br /><br />[code]<br />ld h, $5A<br />ld bc, $040D ; b = BANK(FontGraphics), c = 14 - 1 = how many tiles to copy - 1<br />ld d, h<br />ld e, $80 ; de = FontGraphics<br />ld h, $18<br />ld l, $86<br />push hl ; hl = CopyVideoDataDouble<br />inc bc<br />ld h, $90<br />ld l, $0 ; hl = the tiles in VRAM that come after the digits<br />ret ; jumps to CopyVideoDataDouble (done this way to avoid glitch items and key items that would result from directly using call or jp)<br />[/code]<br /><br />(Didn&#039;t test it though)


subject: Re: is it possible to &quot;create&quot; your own pokemon (out of the 255 pokemons)
poster_name: naltronix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes, but you have to make your own front and back sprites and fix up the broken pointers.<br />I also reccomend reading the rules.


subject: Re: is it possible to &quot;create&quot; your own pokemon (out of the 255 pokemons)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can&#039;t fully build a custom PokÃ©mon without ROM hacking.<br />Actually, you may be able to, but you&#039;d need to use some very heavy game logic manipulation (using, I guess, DMA hijacking) to make a custom cry, custom sprite, custom learnset, etc.<br />Also, it would be very difficult to do especially because some attacks, such as Substitute, fully reload the sprite.<br /><br />So :<br />- In theory it&#039;s possible<br />- No one will ever have the dedication to complete such a tremendous work<br />- I might be wrong but I bet I&#039;m not<br /><br />(TAS-level ACE would be able to also do such a thing, but I guess that&#039;s out of TheUnReturned&#039;s scope)


subject: Stuck in a wall
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=https://www.youtube.com/watch?v=ZBAFrtkLvuY]This player[/url] got stuck in a wall after they saved where the deliveryman would stand, then received a Mystery Gift. As a result, they ended up stuck inside the wall. In previous games, the deliveryman would just stand in a different position.<br /><br />I&#039;m a little skeptical of this, but it would be interesting to see someone try to replicate this.


subject: Re: Stuck in a wall
poster_name: Deku-Kitty
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This has been going around for a while, it only happens if you use PkHex apparently. I&#039;m not sure how it relates though.


subject: Re: Expanded Experience Underflow
poster_name: Sock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello! New to Glitch City but have been playing Red and have my beautiful 8F and learning all of it&#039;s possibilites. I am interested in this expanded experience underflow execution but am a little confused and hoping to get some help. First, what bootstrap is proper for this? Right now I have access to the bootstrap with Kangaskhan as the last member of the party as well as the one with Arbok as the last member.<br /><br /><br />Any Item<br />8F / ws*lâ€™||lm||<br />ThunderStone x100<br />TM09 x82<br />Lemonade x(dec ID of the wanted PokÃ©mon) &lt;--------- Does this have to be the corresponding dec ID of the Pokemon who is in the first slot? This is where I am mostly confused. <br />Ether x119<br />X Accuracy x107<br />X Attack x119<br />TM01 x(any quantity)<br /><br />I am tired of using rare candies to level up and need a solid way to gain experience. I hope to hear from someone. This page ROCKS!<br /><br /><br /><br /><br />


subject: Re: Expanded Experience Underflow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No, it&#039;s the ID of the PokÃ©mon you want. The PokÃ©mon you want to get.<br />As for both setups, they are equal under almost all aspects. COnsider them the same - save for the 6-PokÃ©mon setup which allows you to freely choose the first PokÃ©mon.


subject: Re: Stuck in a wall
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, I thought it sounded similar to the PkHeX issue, but PkHeX was fixed so that that would no longer occur, and the player claimed to have never cheated. However, they also couldn&#039;t have only just downloaded the Munchlax Wonder Card, so maybe they saved months ago, and only just now opened their game again.


subject: Re: Expanded Experience Underflow
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes, as ISSO said. The idea of this method is to transform a medium-slow lvl 1 PokÃ©mon into a wanted PokÃ©mon, that will retain the medium-slow profile. So, you put your medium-slow PokÃ©mon in the first slot and you use the code with the dec ID of the WANTED PokÃ©mon : it will change your first PokÃ©mon to that PokÃ©mon and gaining the exp will trigger the glitch.<br /><br />This was not however designed to trigger the glitch on a lvl 1 non-medium-slow PokÃ©mon that you already have :)


subject: Re: PokÃ©mon Stadium - N64 ACE HYPE !
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The github says the maximum payload would be just under 128kb via 4 GB saves. But wouldn&#039;t it be possible to write a program that allows the user to keep removing GB carts to plug in new ones, and loading all the data off those? That way you could have an arbitrary large payload - limited only by the N64&#039;s RAM size.


subject: Re: PokÃ©mon Stadium - N64 ACE HYPE !
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Removing GB carts doesn&#039;t see possible to me (IIRC the game periodically checks whether a cart is inserted, but I may be wrong) ; however, we could do either of :<br />- Plug two Gen I carts and 1 or 2 carts with more SRAM than PokÃ©mon (which have only 4 SRAM banks). Cartswap may be used to write data to these other carts.<br />- Use the 128 kB to make a RAM writer and simply write your payload with your N64 controller(s)


subject: Re: PokÃ©mon Stadium - N64 ACE HYPE !
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  Yes but once you have ACE then what the game does shouldn&#039;t be a limiting factor, should it? You could just enter your own loop of checking whether GB carts are inserted and reading from them if there are new ones, without returning to the game&#039;s code. Unless it runs in a separate thread that the OS won&#039;t let us kill, which is unlikely.<br /><br />And yes, for TAS then reading from the controllers is the easiest way to go, but if as non TAS-ing human you want to use a large payload more than once for some reason then it would be easier to store it, especially if you have access to one of those things that allows you to read/write the save file of a GB cart from a PC, then you wouldn&#039;t have to manually enter the payload at all.


subject: Re: PokÃ©mon Stadium - N64 ACE HYPE !
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Not necessarily, if the GB game is emulated then we&#039;d have to&nbsp; find a way to break out of the emulator and [i]even then[/i] we&#039;d have to start using N64-format ASM which is vastly different and much larger.


subject: Re: Changing DV Pokemon Yellow (German Version) with ACE
poster_name: TeamKoala
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello everyone.<br /><br />My first post here.&nbsp; :P<br />Anything new on this topic?<br /><br />I was able to optain the &quot;ws m&quot; item in the german version of yellow, but have no idea what kind of items and pokemon i need to do the ACE<br /><br />1. Change all DVs to 10<br />2. Change the trainer id<br />3. Change the name<br /><br />Maybe someone here can help me.<br />Many thanks in advance.


subject: Re: Changing DV Pokemon Yellow (German Version) with ACE
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You should be able to use a standard setup while adapting the codes to modify the first PokÃ©mon in your team. Since German and French have the same RAM addresses, I should be able to design something for you later this day (later for us)


subject: Windows Whistler vs Windows XP - what changed?
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, with little help of @yeniaul I managed to get Windows Whistler to work on a VM, here&#039;s what changed, obviously not everything is here as I just started yesterday but I hope it&#039;s enough for now.<br />I&#039;ll be comparing a Beta 2 bulid to XP final SP3 (Both Professional)<br />[center][b]Chapter 1 : Installation.[/b][/center]<br />Difference 1:Different logo and loading bars.<br />Difference 2:Different boot screen.<br />Difference 3:Can&#039;t quick-format.<br />Difference 4:Critical error after the post-formatting reboot, the only way around it is to upgrade from Win2000 with it&#039;s system clock set to a specific date range. (1st January 2001 is confirmed to work)<br />Difference 5:Completely different Installation screens (Beta 1 only)<br />[center][b]Chapter 2 : Introduction.[/b][/center]<br />Difference 1:Different (logoless) AVI.<br />Difference 2:No introduction mp3.<br />Difference 3:A wizard instead of the help circle as your helper.<br />Difference 4:Different buttons.<br />Difference 5:A &quot;mouse usage tutorial&quot; if you wait long enough on the first screen.<br />Difference 6:System does not ask you to create user accounts, it does make one automatically with the name you registered the copy with.<br />Difference 7:System doesn&#039;t ask you if you want to enable updates.<br />[center][b]Chapter 3 : Post-Introduction.[/b][/center]<br />Difference 1:The system opens My Computer instead of the Start Menu.<br />Difference 2:A &quot;Comment?&quot; Button to the left of the buttons on all windows.<br />Difference 3: Different Desktop background.<br />Difference 4: Different Recycle Bin icon.<br />Difference 5: &quot;My Documents&quot;, &quot;My Computer&quot;, and &quot;My Network Places&quot; icons on the desktop active by default.<br />Difference 6:New shortcuts.<br />Difference 7:Text has borders around it enabled by default.<br />Difference 8:The taskbar has different design.<br />Difference 9:The taskbar is not locked by default.<br />Difference 10: Only one Luna theme color.<br />But there&#039;sâ€‹ more...<br />


subject: Re: Manipulate specific flags?
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=suloku link=topic=7890.msg204779#msg204779 date=1490094358]<br />Hello,<br /><br />I&#039;ve been reading about gen 3 ACE and glitches trying to find a way to manipulate specific flags (specifically, Emerald&#039;s event islands for legendary pokÃ©mon) and after reading about the inner works of ACE and glitzzer popping I have some doubts:<br /><br />- I&#039;ve seen that via Glitzzer popping the flags to birth, faraway and southern island can be enabled, but for what I&#039;ve read about the how the glitch works, those are only enabled because of the game recognizing the data as a corrupt pokÃ©mon and setting it as a bad egg, which results in the flags being enabled. The flags for the 4 islands are consecutive, but to my understanding there&#039;s no way to manipulate the address, in fact that there&#039;s a glitch pokÃ©mon that makes those two flags for the islands get enabled is quite lucky already. Am I wrong and can glitzzer popping be altered to manipulate any flag given we know where it is?<br />[/quote]<br /><br />Southern Island can be directly obtained by corrupting a word that manages the delivery man script, (its default script being Southern Island&#039;s one, while the others needed to be added through mystery cards), so that one is the easiest of them to obtain in Emerald (and this works on any emerald file).<br />Since the unlock flags for&nbsp; the event islands aren&#039;t far from each other, there wasn&#039;t too much &quot;luck&quot; required to get at least one in a certain word (what was important was the location of that word inside its double-word because that word needs to be read as &quot;Remaining HP&quot; for a party PokÃ©mon).<br />The criteria for having a Glitch PokÃ©mon that gives the right party slot were also a bit large (the character that influences the party slot is around 8.000 and the maximal name lenght to make things possible is around 10.700 characters).<br />The fact that there is no Glitch PokÃ©mon that has a name fitting these two requirements on US and JP Emerald seems for me to be the &quot;unlucky&quot; part as a certain amount of Glitch PokÃ©mon could potentially work (but the required value never ended up in the right character).<br /><br />The flags for Navel Rock, Faraway Island, and Birth Island also can&#039;t be corrupted via Pomeg Glitch Data Corruption (aka Glitzer Popping) because they aren&#039;t in the right location in their respective double-words.<br /><br />Out of the few other ways to corrupt data induced by Pomeg Glitch or Glitch Stuff, none of them can set the bits for the islands flags and leave the game stable/playable. (With a longer glitch PokÃ©mon name, you could set these bits to 1 but too much graphical-related data would have been corrupted and the game would crash once you would move).<br /><br />This also holds true for RS and FrLg. <br />An effect from viewing certain Glitch PokÃ©mon summaries in FrLg seemed promising (it messes up with the value that tells you how many summaries you can still see by pushing down) but you either end up freezing the game quite early or only having less than a dozen of additional summaries that you can see.<br /><br /><br />So as of now, ACE stands as the sole way to unlock the remaining event islands and some other stuff.<br /><br />Things regarding ACE have progressed for a good amount towards procedures doable on console since the discovery of another entry point via Glitch Moves Animation Scripts by Wack0.<br /><br />Writing a code that triggers a flag can be done, but the tough part is about the amount of stuff you would be required to do on console, especially with Glitch Items (they can&#039;t be distinguished from each other so once you start placing them you can only know if your &quot;Glitch Items and placement&quot; was good once you attempt your ACE.<br /><br />The procedure with the least setup that I thought of to run an overworld script in Emerald is :<br />- Get the Bootstrap PokÃ©mon (some EV training for the PokÃ© + 1 Glitch Item)<br />- Write commands to set the event islands flags in the PC (4 Glitch Items, 1 per flag)<br />- Store some Glitch Items in Pyramid Bags to make a code (16 Glitch Items if I remember well)<br />- Make an ACE to execute the code made with Pyramid Bags Items : Copies the PC Items data to an area unaffected by DMA + changes the script adress of a NPC on the map to the adress of the area unaffected by DMA.<br />- Talk to the NPC to execute the commands stored there and unlock the islands.<br /><br />Thus, that&#039;s ~20 Glitch Items you need to obtain without a single EV failure.<br /><br /><br /><br />


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=gold55803 link=topic=6868.msg204800#msg204800 date=1490192405]<br />Really stupid question, but could someone explain how data substructures work? The guides on bulbapedia make no sense to me... :&#039;(<br />also, how do you get a bag egg to battle? :???:<br />[/quote]<br /><br /><br />Outside of the PokÃ©mon IDentifiant (PID), Trainer IDentifiant (TID), PokÃ©mon&#039;s nickname, and Trainer&#039;s name, most of the PokÃ©mon&#039;s data is separated into 4 groups called substructures.<br />Each one of these substructures contains certain parts of the PokÃ©mon&#039;s data in a certain order.<br />They are called : Growth - Attacks - EVs &amp; Contest stats - Miscellanous<br /><br />For example, the Attacks substructure contains in that order : Move 1 identifiant - Move 2 identifiant -&nbsp; Move 3 identifiant&nbsp; - Move 4 identifiant - Move 1 PPs - Move 2 PPs - Move 3 PPs - Move 4 PPs<br />Each one of these substructures is 96 bits long (or 12 bytes, or 6 words, or 3 double-words).<br /><br />But all of this data isn&#039;t stored as is, it is crypted when stored into the RAM and decrypted when the game wants to use it to check/use some values (like calculating a PokÃ©mon&#039;s stats).<br /><br />In Gen 3, the encryption is made of two mechanics :<br />- The order of the 4 substructures is given by the PID modulo 24 (there are 24 ways to sort 4 different elements)<br />- The game takes all the hexadecimal words that make the substructures and computes their sum.<br />The first 4 hexadecimal characters of this sum (called checksum) is stored on another part of the PokÃ©mon&#039;s data.<br />Then, the game goes through every hexadecimal double-word that is contained in the substructures and modifies them with the formula : encrypted double-word = word xor TID xor PID&nbsp; (XoR being a logical operation)<br /><br />Thus, if you corrupt the data in the substructures directly, the checksum will be invalid and the corruption will fail (the PokÃ©mon will turn into a Bad Egg as soon as the game computes the checksum again and finds the difference with the stored checksum).<br /><br />However, if you corrupt the PokÃ©mon&#039;s PID, you will change the order of the substructures.<br />So when the game will look at the PokÃ©mon&#039;s data after the corruption, he will incorrectly read the substructures and this is where we can get very cool stuff.<br />(example : Growth substructure being read over the Attacks substructure, so the species of the corrupted PokÃ©mon is read over the identifiant of the first move of the PokÃ©mon before it corruption )<br />Since the PID is also used in the encryption of the substructures data, that PID corruption needs to meet a certain criteria in order to not affect that encryption.<br />But thankfully, one of the two possible ways to corrupt data with Pomeg Glitch meets this criteria.<br /><br /><br />Getting a Bad Egg (or an Egg/empty slot) to the battle is the matter of forcing the game to send a PokÃ©mon from a certain party slot to the battle, even though that PokÃ©mon is not supposed to be sent to the battle.<br />To do that, we exploit an oversight in the code that doesn&#039;t refresh the value &quot;Party slot of the currently fighting PokÃ©mon&quot; from one battle to another if the party is fully KO.<br /><br />Thus, the procedure looks like this :<br />- Make a wild battle and send a valid PokÃ©mon to the fight (let&#039;s say from the 3rd party slot)<br />- Perform Pomeg Glitch to have a fully KO party<br />- Place a Bad Egg/Egg to the 3rd party slot (or leave it empty by depositing a PokÃ©mon to the PC before killing the whole party)<br />- Make another battle (since the party is fully KO, the PokÃ©mon in the 3rd party slot will be forced to the fight)


subject: Re: Stuck in a wall
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I might try to replicate it without any cheats if a new event appears. And just give me the instructions.


subject: Re: Windows Whistler vs Windows XP - what changed?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Windows 2000 used as a base, even on a fresh install. Don&#039;t forget that. <br />Oh, and a different BSOD format.


subject: Re: Stuck in a wall
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Charmy link=topic=7901.msg204851#msg204851 date=1490976430]<br />I might try to replicate it without any cheats if a new event appears. And just give me the instructions.<br />[/quote]There are several Event carts floating about, try using one to replicate it. You&#039;ll need 2 systems, though.


subject: Re: PokÃ©mon Stadium - N64 ACE HYPE !
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=jfb1337 link=topic=7789.msg204844#msg204844 date=1490816779]<br />Yes but once you have ACE then what the game does shouldn&#039;t be a limiting factor, should it? You could just enter your own loop of checking whether GB carts are inserted and reading from them if there are new ones, without returning to the game&#039;s code. Unless it runs in a separate thread that the OS won&#039;t let us kill, which is unlikely.<br />[/quote]<br />I don&#039;t know the details about how it is performed, so I won&#039;t get hyped on it until it is confirmed.<br /><br />[quote author=jfb1337 link=topic=7789.msg204844#msg204844 date=1490816779]<br />And yes, for TAS then reading from the controllers is the easiest way to go, but if as non TAS-ing human you want to use a large payload more than once for some reason then it would be easier to store it, especially if you have access to one of those things that allows you to read/write the save file of a GB cart from a PC, then you wouldn&#039;t have to manually enter the payload at all.<br />[/quote]<br />Imagine if the payload you stored in your GB carts was a memory editor that also allows you to jump to anypart of memory.<br />Bam, you can write any code and have it ran. No TAS skillz required (see offgao&#039;s memory editor, it&#039;s the state-of-the-art ACE tool for Gen I)<br /><br />[quote author=Yeniaul link=topic=7789.msg204845#msg204845 date=1490821298]<br />Not necessarily, if the GB game is emulated then we&#039;d have to&nbsp; find a way to break out of the emulator and [i]even then[/i] we&#039;d have to start using N64-format ASM which is vastly different and much larger.<br />[/quote]<br />You got it slightly wrong. We can&#039;t escape the emulator without N64 ACE - the emulator is (according to MrCheeze) too solid to be escapable.<br />What we do is copy N64 ASM as raw hex from GB carts ; to avoid being limited with the 4 N64 controllers (and thus GB carts) the idea was to copy one&#039;s contents, swap it, and repeat until the whole payload has been written.


subject: Re: Changing DV Pokemon Yellow (German Version) with ACE
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Hello,<br /><br />I haven&#039;t tested and I did that a bit quickly so it contains annoying items/quantities for which underflow trick/other 8F codes will be required probably. <br />But unless I missed something it should do the following things if you have a Mew in your party&#039;s first slot [u]in european yellow games only[/u]:<br />- Change Mew&#039;s IV to dec:10 (Was it the point? I don&#039;t know how that shiny determination works)<br />- Change Mew&#039;s ID to dec:22796 (not sure about this, because I don&#039;t know if ID is BCD. Can someone tell?)<br />- Change Mew&#039;s OT to &quot;GF&quot;<br /><br />First, have the following PokÃ©mon in your active PokÃ©mon storage box in the PC:<br /><br />Tangela with 233 HPs currently)<br />Nidoking<br />Metapod<br />Haunter<br />Flareon<br />Parasect<br />Kadabra<br />Tentacool<br />Grimer<br />Another random PokÃ©mon, but just one<br /><br />Then prepare the following inventory, and use ws*lâ€™||lm|:<br /><br />[Anything]<br />ws*lâ€™||lm|<br />ThunderStone x134<br />TM09 x62<br />Moon Stone x119<br />Hp Up x119<br />TM01 x[any quantity]<br /><br />Then prepare the following inventory, and use ws*lâ€™||lm|:<br /><br />[Anything]<br />ws*lâ€™||lm|<br />ThunderStone x124<br />TM09 x62<br />Burn Heal x119<br />HM03 x77<br />Secret Key x79<br />PokÃ© Ball x113<br />TM01 x[any quantity]<br /><br />Then prepare the following inventory, and use ws*lâ€™||lm|:<br /><br />[Anything]<br />ws*lâ€™||lm|<br />ThunderStone x121<br />TM10 x4<br />Lemonade x128<br />Burn Heal x119<br />Ice Heal x198<br />PokÃ© Ball x60<br />Secret Key x119<br />Fresh water x43<br />Potion x119<br />TM01 x[any quantity]


subject: Does Index Number 503 in HeartGold and SoulSilver store Rotom data?
poster_name: Pokemonprime
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pokemonprime
icon: xx
body:
  So while messing around with summoning index numbers past 493 in wild encounters through the use of a &quot;Max Pokeballs&quot; and a &quot;Number of Masterballs = index number of Pokemon encountered&quot; cheat, I ran into index number 501, which takes the appearance of a dark gray box, like all of the &quot;functional&quot; past index number 493 Pokemon. It also has the typing of Electric/Ghost, a typing exclusive to Rotom. In addition, it shares Rotom&#039;s ability of Levitate and has Rotom&#039;s move set, that being Astonish, Thunder Wave, ThunderShock, and Confuse Ray at level 3. With this information, my only conclusion is that 501 is used to store some set of data for Rotom. The question is why stored it at 501, 24 slots away from Rotom itself at 479.<br /><br />[img]http://i.imgur.com/bfyfBII.png[/img] Trainer Memo Screen (DeSmuMe screenshot)<br /><br />[img]http://i.imgur.com/MIIkNJz.png[/img] Skills Screen (DeSmuMe screenshot)<br /><br />[img]http://i.imgur.com/ls4zArf.png?2[/img] Moveset compared to Gen IV learnset, courtestry of Bulbapedia (cropped to prevent a massive image)<br /><br />Also, hello there! First post, sorry if I messed anything up. (If I did, please point it out!)<br /><br />EDIT: 503 not 501 sorry! Been doing this a lot and got them confused....


subject: Hacked Pokemon to generation it shouldn't exist in. (EXPERIMENT)
poster_name: shatteredClockworks
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So for a while I&#039;ve been wondering: &quot;What would happen if I hacked a Buzzwole (sorry if I misspelled that by the way) into my copy of Moon, and then used PKSM&#039;s bank feature (which basically serves as Pokemon bank with a few extra features) and loaded it with a different save from the previous generation, and then tried putting it in that box?&quot; In short, I wonder what would happen if I put a gen 7 Pokemon into the box (PKSM&#039;s box, NOT Pokemon bank) and then transferred it to the gen 6&#039;s save box? And what I really want to know is: Can I use that Pokemon in battle if it worked?


subject: Re: Stuck in a wall
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7901.msg204853#msg204853 date=1490979626]<br />[quote author=Charmy link=topic=7901.msg204851#msg204851 date=1490976430]<br />I might try to replicate it without any cheats if a new event appears. And just give me the instructions.<br />[/quote]There are several Event carts floating about, try using one to replicate it. You&#039;ll need 2 systems, though.<br />[/quote]<br /><br />Not for Gen VII though. Only Gen V and earlier.<br /><br /><br />I do have spare PAL region codes for Bottle Caps I&#039;d be happy to donate (since I can&#039;t use more than one), if anyone wants to try.


subject: Re: Does Index Number 503 in HeartGold and SoulSilver store Rotom data?
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SnorlaxMonster
icon: xx
body:
  Yes. You can see the full list of which index numbers store the forms here: [url=http://bulbapedia.bulbagarden.net/wiki/List_of_PokÃ©mon_by_index_number_(Generation_IV)]List of PokÃ©mon by index number (Generation IV)[/url]


subject: Re: Does Index Number 503 in HeartGold and SoulSilver store Rotom data?
poster_name: Pokemonprime
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh, well I feel like a right idiot now. Interesting note though, while according to that chart #502 is a Manaphy Egg, force encountering it gives you a Bad Egg, which hardlocks the game after the Pokedex screen if you attempt to catch it. This is odd as #501, Pokemon Egg, appears seemingly appropriately as &quot;Egg&quot;, albeit with the ability to use Splash which I doubt was an intended feature. Egg also softlocks the game after the Pokedex screen if you try and catch it.


subject: Get and transfer shiny Mew in PokÃ©mon Green
poster_name: cornflakegirl
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey I&#039;m sorry if this has been asked before, couldn&#039;t find anything during a quick search.<br /><br />I have VC PokÃ©mon Green on my Japanese 3DS and I would love to get shiny Mew there and transfer it over to PokÃ©mon Sun &amp; Moon. For that I have a few questions:<br /><br />1. Is there an easy/less dangerous way to get 5ã‹ã„? I&#039;ve found [url=http://forums.glitchcity.info/index.php?topic=6573.0]this guide[/url] that only seems to work with an emulator but pictures are all gone by now. Since it&#039;s already five years old, maybe another way has been found in the meantime?<br /><br />Supposing there&#039;s a solution to the first question:<br />2. What&#039;s the item setup to get the shiny IVs on a Mew once caught? Is it the same as for western Red/Blue or is it different?<br />3. What&#039;s the item setup to change the OT to ã‚²ãƒ¼ãƒ•ãƒª and ID to 22796?<br /><br />Thanks in advance :)


subject: Re: Get and transfer shiny Mew in PokÃ©mon Green
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=cornflakegirl link=topic=7905.msg204861#msg204861 date=1491071501]<br />Hey I&#039;m sorry if this has been asked before, couldn&#039;t find anything during a quick search.<br /><br />I have VC PokÃ©mon Green on my Japanese 3DS and I would love to get shiny Mew there and transfer it over to PokÃ©mon Sun &amp; Moon. For that I have a few questions:<br /><br />1. Is there an easy/less dangerous way to get 5ã‹ã„? I&#039;ve found [url=http://forums.glitchcity.info/index.php?topic=6573.0]this guide[/url] that only seems to work with an emulator but pictures are all gone by now. Since it&#039;s already five years old, maybe another way has been found in the meantime?<br /><br />Supposing there&#039;s a solution to the first question:<br />2. What&#039;s the item setup to get the shiny IVs on a Mew once caught? Is it the same as for western Red/Blue or is it different?<br />3. What&#039;s the item setup to change the OT to ã‚²ãƒ¼ãƒ•ãƒª and ID to 22796?<br /><br />Thanks in advance :)<br />[/quote]<br /><br />Hi, welcome to the forums cornflakegirl. :) I don&#039;t think anyone has raised this question before, no.<br /><br />Instead of using 5ã‹ã„ now the best option is probably using ã¦ã¸ (hex:7B) with the player name ã‚ã¦ãƒ«ã‚, which will make the code jump to the third item.<br /><br />I don&#039;t know which release of Green the VC version is, but you may have to use ã¦ã¸ in a spot with a [url=http://glitchcity.info/wiki/0x50_sub-tile]0x50 sub-tile[/url] visible on the screen before you use the item, in order to prevent a freeze.<br /><br />Getting ã¦ã¸ is possible with the following steps:<br /><br />1) First use dry underflow glitch or a Select glitch to explode the inventory. If you are using dry underflow glitch follow the steps in [url=https://www.youtube.com/watch?v=ZyppANEvnh8&amp;t=222s]this video[/url]. You can encounter a Fossil or Ghost MissingNo. (normal MissingNo. seemingly always freezes) to duplicate the item or perform the [url=http://glitchcity.info/wiki/Swapping_Transform_moves_glitch]swapping Transform moves glitch[/url] to get move 0x00, then open a PokÃ©mon summary in battle in Diglett&#039;s Cave (important) and scroll the menu with &quot;-&quot; on the screen to mutate the enemy PokÃ©mon to MissingNo. that way without a freeze, which will duplicate your sixth item like in the international versions upon capture.<br /><br />2) Go to (or warp to Route 18 by changing item 34 to an Escape Rope; ã‚ãªã¬ã‘ã®ãƒ’ãƒ¢) Cycling Road and find item 32 at this y-position (y=123 where y increases as you move down).<br /><br />[img]http://i.imgur.com/hHuQY3k.png[/img]<br /><br />I don&#039;t have a code for a Japanese Shiny GF Mew sadly, but hopefully will be able to work on this tomorrow.<br /><br />When you use ã¦ã¸, you should first watch the old man&#039;s demonstration and use it in the location below to be safe as a 0x50 sub-tile is on the top-left corner of the screen.<br /><br />[img]http://i.imgur.com/T2pxfmQ.png[/img]<br /><br />Hope this helps so far!<br /><br />Due to a data structure difference you can&#039;t use the [url=http://glitchcity.info/wiki/Celadon_looping_map_trick]Celadon looping map trick[/url] to get items, but you can use the y-position from Cycling Road instead, and possibly swap the y-position to be above the y-boundary if you need a high ID item (the same exploit as Celadon looping map trick but with the y position).<br /><br />Unfortunately the quantity of the item would be the x coordinate, meaning you can&#039;t get x0 items this way (which serve as x256 and allow you to access allow quantities from non-key items).<br /><br />Despite that fortunately you can duplicate your items with the same exploits for dry underflow as above, or possibly this glitch instead.<br />https://www.youtube.com/watch?v=tcTB_IaNtqU<br /><br /><br />Edit: I found this video on NicoNico which uses the FriendBadge to get a Game Freak Mew instead, will look into this as well.<br />http://www.mmcafe.com/nico.html#http://www.nicovideo.jp/watch/sm30557065


subject: Re: Get and transfer shiny Mew in PokÃ©mon Green
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7905.msg204862#msg204862 date=1491078892]<br />I don&#039;t know which release of Green the VC version is<br />[/quote]<br /><br />Based on [url=https://forums.glitchcity.info/index.php?topic=7436.msg199800#msg199800]the patch files provided by Wack0[/url] and [url=https://forums.glitchcity.info/index.php?topic=7384.30]previous discussion about the subject here[/url], the VC release seems to be of Green v1.1.


subject: Re: Get and transfer shiny Mew in PokÃ©mon Green
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=SatoMew link=topic=7905.msg204863#msg204863 date=1491088587]<br />[quote author=Torchickens link=topic=7905.msg204862#msg204862 date=1491078892]<br />I don&#039;t know which release of Green the VC version is<br />[/quote]<br /><br />Based on [url=https://forums.glitchcity.info/index.php?topic=7436.msg199800#msg199800]the patch files provided by Wack0[/url] and [url=https://forums.glitchcity.info/index.php?topic=7384.30]previous discussion about the subject here[/url], the VC release seems to be of Green v1.1.<br />[/quote]<br /><br />Ah thanks for that :), so if so ã¦ã¸ would have an unterminated name and freeze the game if selected in a place where there is no 0x50 sub-tile in that version (assuming it works the same as a cartridge v1.1 in the VC release however).


subject: Re: Name Changes
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is there any chance I can get my name changed?<br /><br />Old Name: Spectramark<br /><br />New Name: â–’h POKÃ©â–“â–‘


subject: Re: Get and transfer shiny Mew in PokÃ©mon Green
poster_name: cornflakegirl
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow thank you very much Torchickens for your very detailed reply! I&#039;ll start a new game naming myself ã‚ã¦ãƒ«ã‚ and play normally until the point where I can catch a Ditto.<br />That video on NicoNico looks promising, I only know a handful of kanji though so thanks for your help :)


subject: Re: Hacked Pokemon to generation it shouldn't exist in. (EXPERIMENT)
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  100% they would become glitch Pokemon, because Buzzwolde does not exsist in Gen 6.<br />Converting a glitch pokemon form Gen 6 to 7 with index numbers 722-801 will result in its equivalent Pokemon.


subject: Re: Does Index Number 503 in HeartGold and SoulSilver store Rotom data?
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yep you&#039;re right, most glitch PokÃ©mon before the crashes and weird clones are used to store data of other PokÃ©mon.


subject: Re: Name Changes
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=â–’h POKÃ©â–“â–‘ link=topic=3109.msg204865#msg204865 date=1491095126]<br />Is there any chance I can get my name changed?<br /><br />Old Name: Spectramark<br /><br />New Name: â–’h POKÃ©â–“â–‘<br />[/quote]<br /><br />Done! Enjoy. :)


subject: Numbers in a nickname
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m not sure if this is the right thread, but I&#039;m posting it here since I can only assume that ACE is the only way to do this.<br /><br />I was watching ChickasaurusGL&#039;s &quot;Elite Six Glitch Masters&quot; video and noticed that her glitch Pokemon all had numbers in their names. What kind of 8F setup would I need to stick numbers in a Pokemon&#039;s name?<br /><br />I appreciate the help :)


subject: Re: Numbers in a nickname
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  We receive a lot of questions about how to use 8F to do stuff. Sometimes these are very complex questions that requires some knowledge regarding opcodes, but sometimes, as it is the case with your request, you don&#039;t need to know much. This knowledge is already available here and elsewhere in the form of ready-to-use, well-explained setups in which you only have to change a few things using tables and lists that we also give and explain.<br /><br />Although we are here to help people discover this glitch and how to use it, I would like to mention to you and all the others that will come after, that if you just read what is already available, you can already answer your question. In fact, I strongly advise you to document yourself about 8F before trying to do it, even if you just use a code that someone gave you. It is always better to understand what you do to use it the proper way.<br /><br />Thus said, here&#039;s one answer to your question.<br /><br />To get the 8F item, you can use the celadon loop as described here: http://forums.glitchcity.info/index.php?topic=6638.0<br />As a proper PokÃ©mon setup, you can use this: http://glitchcity.info/wiki/Arbitrary_code_execution#Using_8F_.28English_Red.2FBlue.29<br /><br />Now, select the RAM address you would like to change using, for example, this list: http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map<br />Here, let&#039;s say you want to change the letter 1 of your first PokÃ©mon&#039;s nickname. This is address $[color=red]D2[/color][color=blue]B5[/color].<br /><br />Now, select the value you want to put in it using, for example, this list: http://glitchcity.info/biglist.htm<br />Here, let&#039;s say that you want to change that letter for the number &quot;4&quot;. As you can see, it matches hexadecimal $[color=green]FA[/color].<br /><br />(On a side note, understand that what you are about to do is asking for $[color=red]D2[/color][color=blue]B5[/color] to take the value $[color=green]FA[/color]. As a result, this corresponds to using the gameshark code 01[color=green]FA[/color][color=blue]B5[/color][color=red]D2[/color]).<br /><br />To trigger the 8F code, use this item setup. It&#039;s a generic setup for one-value changing codes:<br />- Any item at any quantity<br />- 8F<br />- Lemonade x[color=green]AA[/color]<br />- X Accuracy x[color=blue]BB[/color]<br />- Carbos x[color=red]CC[/color]<br />- PokÃ© Ball, x119<br />- Fresh Water x201<br /><br />AA, BB and CC are decimal translation of the three red, blue and green values (your RAM address and the value to give to it). You can translate hexadecimal to decimal with the windows calculator, or just the abovementioned list (http://glitchcity.info/biglist.htm). Here, it says [color=green]250[/color], [color=blue]181[/color] and [color=red]210[/color].<br /><br />Once you&#039;re ready, just use the 8F item :)


subject: Re: Numbers in a nickname
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the really informative answer! But there&#039;s one small thing that&#039;s confused me. On the Data Crystal page you linked to it says &quot;D2B5-D2BF - nickname for first&quot; Does that mean that those are the values for the first Pokemon&#039;s nickname (such as D2B6 being the second character in the nickname) or do I have that totally wrong?


subject: Re: Numbers in a nickname
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes, that&#039;s exactly what it means&nbsp; ;)<br /><br />Also remember a name is always terminated with an end marker (hex ID 50). If your name is 10 characters long, the 11th and last address is the end marker. If your name is shorter, there is an end marker after the last character. <br /><br />If you shorten your name using 8F, don&#039;t forget to place an end marker after your last character to &quot;delete&quot; every extra character.


subject: Re: Numbers in a nickname
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ok good! 1 last thing I want to clear up- won&#039;t having a different 1st Pokemon in my party screw up the 8F code? Cause it says that the first Pokemon has to be the 233 HP Pidgey


subject: Re: Numbers in a nickname
poster_name: MegaLuxray
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  -Any Pokemon<br />-Pidgey with 233 HP<br />-Parasect<br />-Onix<br />-Tentacool<br />-Arbok<br /><br />Sorry, accidentally posted reply before I was finished typing.


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Pokeglitch86
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  New update with Pikablu and Pokedex entry. https://youtu.be/QvTEVYbKMTw<br /><br />Unfortunately, I got the code together too late for April 1st.


subject: Re: Numbers in a nickname
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can also change the nicknames of PokÃ©mon stored in the PC using the right RAM addresses, still available on the datacrystal link :D


subject: Re: Numbers in a nickname
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  We have a wiki page about 8F bootstrap setups : http://glitchcity.info/wiki/List_of_8F_bootstrap_setups<br />We&#039;d have to improve its visibility (it&#039;s at the end of the ACE page)


subject: Re: Hacked Pokemon to generation it shouldn't exist in. (EXPERIMENT)
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I did the same with Moves, I used PkHeX to give Gen 4,5,6 and 7 moves to a Areodactyl that was put into a Gen 3 game,<br />Glitch moves and &quot;er for more!&quot; everywhere.<br />Confirmed.


subject: Re: Stuck in a wall
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SnorlaxMonster link=topic=7901.msg204858#msg204858 date=1491054578]<br />[quote author=Yeniaul link=topic=7901.msg204853#msg204853 date=1490979626]<br />[quote author=Charmy link=topic=7901.msg204851#msg204851 date=1490976430]<br />I might try to replicate it without any cheats if a new event appears. And just give me the instructions.<br />[/quote]There are several Event carts floating about, try using one to replicate it. You&#039;ll need 2 systems, though.<br />[/quote]<br /><br />Not for Gen VII though. Only Gen V and earlier.<br /><br /><br />I do have spare PAL region codes for Bottle Caps I&#039;d be happy to donate (since I can&#039;t use more than one), if anyone wants to try.<br />[/quote]<br />I am European but US console, damn.


subject: Re: Windows Whistler vs Windows XP - what changed?
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Now for a fun fact. In Whistler you can change your account type to even Limited even if you&#039;re the only Administrator account.<br />And making too many accounts causes a BSOD, great job programmers.


subject: Re: My Generation VII Invalid PokÃ©mon Research
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Also, try giving yourself Gen 6 key items, I can&#039;t because Global Link, (and I want these Festival coins, rank 82 so far) so :rip:.


subject: Re: Can't add items to glitched bag in Blue VC
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=glitchycharizardlord link=topic=7892.msg204793#msg204793 date=1490123524]<br />I was messing around with the items and was able to teach cut before I went on the ss anne. I basically want to get to celadon city asap. Will progressing without going on the ss anne mess up my save?<br />[/quote]<br />Progressing without going on S.S. Anne isn&#039;t dangerous, you can progress as far as you want and then return to see the truck (and no, there&#039;s no Mew under there unless you&#039;re infected with a virus).


subject: Re: Numbers in a nickname
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ok everything went as planned, but something strange happened while I was doing the old man glitch to duplicate my items. I found a level 160 Aerodactyl fossil Missingno and sent my level 7 normal form Missingno against it. In the process of running away it used Leer on me 3 times. On the fourth attempt to run it used Poison Sting and the game softlocked! What the...?


subject: Re: Numbers in a nickname
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The mysteries of MissingNo.... I&#039;m familiar with sprite overflowing into the sound bank causing the game to freeze when regular MissingNo. is encountered using Ditto/Old Man glitches in European R/B, but it&#039;s the first time I hear about the kind of softlocking you describe.


subject: Re: Pursuit glitch
poster_name: zxSuperGlitch
poster_ip: ***.***.***.***
icon: xx
body:
  If possible, it&#039;d be cool for you to test it out. I would do, but I have no access to a PC atm and I don&#039;t have space to install emulators on my phone.


subject: Re: Pursuit glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=zxSuperGlitch link=topic=7895.msg204897#msg204897 date=1491415849]<br />If possible, it&#039;d be cool for you to test it out. I would do, but I have no access to a PC atm and I don&#039;t have space to install emulators on my phone.<br />[/quote]<br /><br />I later tested this glitch and recorded a video.<br /><br />Link is here.&nbsp; :)<br /><br />https://www.youtube.com/watch?v=tiRvw-Nb2ME


subject: Re: Numbers in a nickname
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=MewFlare link=topic=7906.msg204892#msg204892 date=1491355880]<br />Ok everything went as planned, but something strange happened while I was doing the old man glitch to duplicate my items. I found a level 160 Aerodactyl fossil Missingno and sent my level 7 normal form Missingno against it. In the process of running away it used Leer on me 3 times. On the fourth attempt to run it used Poison Sting and the game softlocked! What the...?<br />[/quote]<br /><br />That&#039;s odd. I wonder if Bird-type PokÃ©mon can get poisoned and if the softlock may be related to that.<br /><br />Your sixth PokÃ©mon being Arbok makes sense as the opposing Fossil/Ghost MissingNo. would have base stats, moves based on the last PokÃ©mon in the party.<br /><br />Edit: I just got a normal MissingNo. poisoned with Poison Sting so they can get poisoned.


subject: Gen 1 glitch discord
poster_name: Anna Says Hi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not sure if a Discord channel already exists for stuff like this so I made one.<br /><br />https://discord.gg/uUEupQA<br /><br />Also has a separate channel for ACE discussion.


subject: Re: Numbers in a nickname
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Possible reason : your Missingno&#039;s DEF stat was under 4 (excluding 4), and the opponent&#039;s ATK stat was too large. When that happens, the game divides stats by four to fit the calculations - usually leading to only a small imprecision.<br />But in this case the game divides by zero :D


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In some instructions for pomeg corruption I see that a specific 4th move is required. What does this 4th move do, and why does it differ between regions?


subject: Re: Scrapped PokÃ©mon from Gold and Silver
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  TCRF has [url=https://tcrf.net/Prerelease:PokÃ©mon_Gold_and_Silver]an interesting article[/url] about the prerelease period of Gold and Silver. For example, the Space World &#039;97 guidebook mentions that the protagonist has a 3-year-older brother (Red?).


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=jfb1337 link=topic=6868.msg204905#msg204905 date=1491501211]<br />In some instructions for pomeg corruption I see that a specific 4th move is required. What does this 4th move do, and why does it differ between regions?<br />[/quote]<br /><br />The PokÃ©mon&#039;s IDentifiant (PID) is used to determine the order of the PokÃ©mon&#039;s substructures (with PID modulo 24)<br />The Trainer IDenfiiant (TID) and the PID are used to encrypt the values inside the substructures (encrypted double-word = double-word xor TID xor PID)<br />There is a checksum over the cecrypted values inside the substructures (the game sums all the uncrypted words inside the substructures and stores : checksum := sum % 0x10000 on another place inside the PokÃ©mon&#039;s data )<br /><br />When the game checks a PC/Party PokÃ©mon, if the new checksum he calculates is different from the checksum stored in the PokÃ©mon&#039;s data, then the PokÃ©mon is turned into a Bad Egg.<br /><br />The goal of the PC PokÃ©mon Corruption is to corrupt a PokÃ©mon&#039;s PID to change the odrer of the substructures of that PokÃ©mon.<br /><br />However, corrupting a PokÃ©mon&#039;s PID or TID alters ths decryption of the values inside the substructures (there are 3*4=12 double-words that are affected), so you need specific PID/TID corruptions in order to preserve the checksum.<br /><br />The two PID/TID corruptions that can be done with Pomeg Glitch are : a corruption of 0x05000000 (will always change the checksum) 0x40000000 (can preserve the checksum)<br /><br />To explain why the 0x40000000 corruption can preserve the checksum, you need to see how that corruption affects the decrypted values inside the substrustures.<br />Due to the &quot;decrypted double-word = crypted double-word xor PID xor TID&quot; formula, a TID/PID corruption of 0x40000000 induces a change of 0x40000000 on every of the 12 double-words inside the substructures (either a gain of 0x40000000 or a loss of 0x40000000).<br /><br />The checksum being the sum of all decrypted words, there are 12&nbsp; decrypted words that will be different during the checksum calculation (these words either gained 0x4000 or lost 0x4000).<br />Since &quot;stored checksum = sum of all words % 0x10000&quot;, the sum of all words needs to change by a multiple of 0x10000 in order to preserve the checksum.<br />And, if n is the amount of decrypted words that gain 0x4000, (this means 12-n decrypted words lose 0x4000), the checksum will change by : n. 0x4000 - (12-n) 0x4000 = (2n-12). 0x4000 = n. 0x8000 - 0x30000<br /><br />Thus, a PID/TID corruption of 0x40000000 will preserve the checksum (and will be successful) if an only if n (the amount of decrypted double-words that gain 0x40000000) is even. (because 2. 0x8000 = 0x10000)<br /><br /><br />Also, when a PID/TID corruption happens, the change in the decrypted double-words that it brings affects the &quot;Egg state&quot; flag, as well as the identifiant of its Moves nÂ°2 and nÂ°4<br />So if the PokÃ©mon was not inside an Egg before a corruption, it becomes an Egg after it. (and vice-versa). And the identifiant of its Moves nÂ°2 and nÂ°4 changes.<br /><br /><br />Thus, if you only want to permute a PokÃ©mon&#039;s substructures, you need to corrupt both PID and TID with a 0x40000000 corruption. (Corrupting the PID alone would change the substructures order but turn the PokÃ©mon into an Egg as well as changing a few other values)<br /><br />And, as said before, you need to be sure that for both corruptions, there will be an even amount of decrypted double-words that will gain 0x40000000.<br /><br /><br />This gain/loss of 0x40000000 on a decrypted double-word is determined by a certain bit on that decrypted double-word.<br />So you can list the 12 bits that affect this gain/loss of 0x40000000 and their importance in a PokÃ©mon&#039;s data.<br />You need an even amount of these &quot;important&quot; bits to 1 in order to have a working PID/TID corruption.<br /><br />One of these bits happens to be a bit determining the current PPs of Move nÂ°4.<br /><br /><br />And, as when you corrupt the TID of that PokÃ©mon then its Move nÂ°4 idenifiant changes (the TID corruption doesn&#039;t permute the substructures, so it preserves the Move nÂ°4 value, aside for the 0x4000 gain/loss), the PPs of the new 4th Move may change the value of the bit determining the 0x40000000 gain/loss, which would give an odd amount of &quot;important&quot; bits at 1. (Since the first corruption was successful, it means that you had an even amount of these &quot;important&quot; bits at 1)<br />Thus, if the PPs of the new 4th Move are not controlled, the amount of &quot;important&quot; bits can turn odd which will prevent the success of the second corruption on that PokÃ©mon.<br /><br />And if you want to perform the fast procedure for the PC PokÃ©mon Corruption, you need to clone the corrupted PokÃ©mon, which means that you have to move it, which means that its PPs are refreshed.<br /><br />Thus, a specific 4th move is chosen for fast double corruption procedures (especially with in-game traded PokÃ©mon).<br />And the PPs of the corrupted form of regular moves depends on the version you&#039;re on, so each game has different possible 4th Moves that will allow for a fast double-corruption.<br /><br /><br />If you don&#039;t chose a specific 4th move for a fast double-corruption, then you will have to not touch the Egg obtained after the first corruption if you want the second corruption to succeed.<br /><br /><br />I made a video about this matter as if you want to corrupt a PokÃ©mon (Smeargles in general), you need to know who are these &quot;important&quot; bits and how to check if you have an odd/even amount of them at 1 : https://www.youtube.com/watch?v=65e-SKeE5Ec<br />


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I got arceus, but instead of leaving pal park area I made a mistake which led into me fighting ( and losing miserably) against cynthia, which made me teleport to a pokemon center in palpark mode. as you said the RETIRE activates the fourth script right, well in Oreburgh City this activates a rather interesting cutscene by your rival, which makes him push you one to the left, you can also push yourself behind doors to activate the void glitch in a considerable easier fashion. Issues here being: I do not know how to use the void myself other than watching the video, you can only save at areas like contests, pokecentra&#039;s etc. as you&#039;re still in palpark mode, you can enter trainerbattles, but you can&#039;t use fly or fight wild pokemons. Also using the RETIRE button inside of the Pal Park exit you get pushed down into the void extremely easely, and in Hearthome city you can desync pokemons following you or have multiple following at once.. even though I don&#039;t think thats one particularly usefull. anyway, this would make a &#039;1time tweaking&#039; method, assuming that you&#039;d find a way to whatever location/legendary you wanna get too.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Gravedigger link=topic=7770.msg204909#msg204909 date=1491602481]<br />I got arceus, but instead of leaving pal park area I made a mistake which led into me fighting ( and losing miserably) against cynthia, which made me teleport to a pokemon center in palpark mode. as you said the RETIRE activates the fourth script right, well in Oreburgh City this activates a rather interesting cutscene by your rival, which makes him push you one to the left, you can also push yourself behind doors to activate the void glitch in a considerable easier fashion. Issues here being: I do not know how to use the void myself other than watching the video, you can only save at areas like contests, pokecentra&#039;s etc. as you&#039;re still in palpark mode, you can enter trainerbattles, but you can&#039;t use fly or fight wild pokemons. Also using the RETIRE button inside of the Pal Park exit you get pushed down into the void extremely easely, and in Hearthome city you can desync pokemons following you or have multiple following at once.. even though I don&#039;t think thats one particularly usefull. anyway, this would make a &#039;1time tweaking&#039; method, assuming that you&#039;d find a way to whatever location/legendary you wanna get too.<br />[/quote]<br /><br />I already figured everything here out a while ago. Pal park mode based void entries are completely useless but I didn&#039;t know losing to Cynthia didn&#039;t cause the crash like what happens when you win


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aera link=topic=7770.msg204911#msg204911 date=1491667358]<br />[quote author=Gravedigger link=topic=7770.msg204909#msg204909 date=1491602481]<br />I got arceus, but instead of leaving pal park area I made a mistake which led into me fighting ( and losing miserably) against cynthia, which made me teleport to a pokemon center in palpark mode. as you said the RETIRE activates the fourth script right, well in Oreburgh City this activates a rather interesting cutscene by your rival, which makes him push you one to the left, you can also push yourself behind doors to activate the void glitch in a considerable easier fashion. Issues here being: I do not know how to use the void myself other than watching the video, you can only save at areas like contests, pokecentra&#039;s etc. as you&#039;re still in palpark mode, you can enter trainerbattles, but you can&#039;t use fly or fight wild pokemons. Also using the RETIRE button inside of the Pal Park exit you get pushed down into the void extremely easely, and in Hearthome city you can desync pokemons following you or have multiple following at once.. even though I don&#039;t think thats one particularly usefull. anyway, this would make a &#039;1time tweaking&#039; method, assuming that you&#039;d find a way to whatever location/legendary you wanna get too.<br />[/quote]<br /><br />I already figured everything here out a while ago. Pal park mode based void entries are completely useless but I didn&#039;t know losing to Cynthia didn&#039;t cause the crash like what happens when you win<br />[/quote] Hey, it causes a white\black out after all.


subject: Re: Offgao's memory viewer and Tetris ACE exploits
poster_name: Terry
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Terry
icon: xx
body:
  So, I&#039;ve been browsing here for years but never really needed to sign up until now, and I&#039;m pretty lost.&nbsp; I&#039;ve inserted the code into my game from the quoted post below, and have a working 8f bootstrap, but how do I make it redirect to the PC box 1? I have the wrong item list/bootsrap, right? I&#039;ve scoured this thread high and low several times and I feel like I&#039;m missing something simple. <br /><br />pls halp!<br /><br />edit: also, my box looks a bit different, and I&#039;m pretty sure I put everything in right, but for some reason my mons don&#039;t have any names like yours do.<br />Can I not use spoilers or collapse on this forum? oh well.<br />[url=https://cdn.discordapp.com/attachments/239495793487118336/300434755227222017/20170408_175856.jpg]https://cdn.discordapp.com/attachments/239495793487118336/300434755227222017/20170408_175856.jpg[/url]<br />I am using a physical gameshark to do this though, 25 addresses at a time, so there is defiantly a chance I messed up somewhere.<br /><br />[quote author=Torchickens link=topic=7773.msg203699#msg203699 date=1484254011]<br />Amazing. Thank you Cryo! :) <br /><br />I worked out another way to do it but [s]your version looks a lot shorter[/s].<br /><br />Edit: Mine is shorter but it needs the code at DBF0.<br /><br />@DA80:<br />[code]<br />01 00 DA C5 0B 0B 16 12 21 AA<br />C3 CD 25 DB 03 C5 01 0A 00 09<br />C1 15 20 F3 C1 3E ED EA D3 C3<br />3E FF E0 B7 76 C5 CD 31 38 C1<br />F0 B5 FE 02 C8 FE 03 20 02 C5 <br />C9 FE 40 20 01 0B FE 80 20 01 <br />03 FE 20 20 06 21 F0 FF 09 44 <br />4D FE 10 20 06 21 10 00 09 44 <br />4D FE 24 20 06 21 00 FF 09 44 <br />4D FE 14 20 06 21 00 01 09 44 <br />4D 16 00 FE 88 20 02 16 FF FE<br />48 20 02 16 01 FE 28 20 02 16<br />F0 FE 18 20 02 16 10 60 69 FE<br />44 20 08 F5 3A F5 2A 32 F1 77<br />F1 FE 84 20 08 F5 2A F5 3A 22<br />F1 77 F1 44 4D 7A A7 28 03 0A<br />82 02 C3 83 DA 3E 7C 22 3E 7F<br />22 78 CD 3E DB 79 CD 3E DB 3E<br />E3 22 0A CD 3E DB 3E 7C 22 C9<br />F5 CB 37 CD 45 DB F1 E5 26 DB<br />F6 F0 6F 7E E1 22 C9<br />[/code]<br />@DBF0:<br />[code]<br />F6 F7 F8 F9 FA FB FC FD FE FF<br />60 61 62 63 64 65<br />[/code]<br />[/quote]


subject: Need help with finding registers
poster_name: TheHooked8F
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I found this tidbit of information while scrolling through the 8F thread by ZZAZZ glitch.<br /><br />[quote]Impressive. Great work on finding all those extra tricks and an alternative to k(y&#039;s code too! <br /><br />I&#039;m gonna re-post the CPU registers for D322 that you added as a caption in your video.<br /><br />[quote]af = 6300 [a=63, f=00]<br />bc = 22B8 [b=22, c=B8]<br />de= 0001 [d=00, e=01]<br />hl= D322 [h=D3, l=22]<br />All flags reset[/quote][/quote]<br /><br />It got me wondering; how do you find the cpu registers for a certain value? If anyone knows, please tell me.


subject: Re: Need help with finding registers
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What do you mean ? How do you check the register&#039;s values at a certain point in execution ?<br />This can be done with the bgb emulator by placing a breakpoint where you want to examine the registers&#039; contents.<br />Once the breakpoint is hit, the registers&#039; values will be displayed in the upper-right corner of the debugger window.


subject: [Passion Project]Glitchspeak Program
poster_name: zeifyl
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: zeifyl
icon: xx
body:
  [center][img]http://image.prntscr.com/image/02615d10dbd74b219e0bf84fb6f4a223.png[/img][/center]<br /><br />UPDATE: Program is finished, and can now be downloaded from [url=http://s000.tinyupload.com/index.php?file_id=00145181754628339100]here[/url]<br /><br />Since I currently got nothing to do at work (since all the current tasks are above my paygrade), the boss told me to just do whatever, and I decided to start working on a Glitchspeak program, because Pokemon #360. It&#039;s supposed to be able to convert letters in text to a &quot;glitched&quot; string, using some rules I&#039;ve set up (such as randomising if the letter is uppercase or lowercase, and most of the time just turning it into a random symbol I found), and back to English.<br /><br />[center][img]http://image.prntscr.com/image/bb49888229024f95b6c0ee1c972a8797.png[/img][/center]<br /><br />The program is written in C#, using Visual Studio 2015.<br /><br />Any feedback or suggestions would be greatly appreciated.


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  So... I just bricked Discord Mobile by trying to send ~13MB of text in one message. :XD:<br />Until I can get it up and running again, I&#039;ll need the Admins and Mods on the server to handle things.<br />That is all.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Deku-Kitty
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=zxSuperGlitch link=topic=7770.msg204913#msg204913 date=1491669220]<br />Was gonna try this; Platinum save got completely wiped by me trying to tweak lolwut<br />[/quote]<br />As far as I know, there currently isn&#039;t a method to get Arceus in Platinum, so you kinda lost your save file for nothing. RIP.


subject: Re: Offgao's memory viewer and Tetris ACE exploits
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  The required 8F bootstrap would be jp $DA80, which is H# (glitch item $C3) x128 / TM18 x any.<br />Or if you don&#039;t like the glitch item, it could be replaced with either TM18 or TM10, for jp c, xxxx or jp nc, xxxx respectively, one of those should work but I&#039;m not sure which. It might be a good idea to make the any quantity x201 or put a TM01 afterwards, so if the wrong one is used then nothing happens (instead of a crash).<br /><br />As for the nicknames, was there ever previous data on the cart in that box? If so then it might be left over from that, but I&#039;m not sure.<br /><br />Do the nicknames even matter? It looks like the code isn&#039;t long enough to reach them, so would it be safe for me to overwrite them with properly terminated nicknames? And would this make it safe to view the stat pages, to allow for easy comparison between console and emulator?<br /><br />For Cryo&#039;s version, do the 7 pokemon in the box matter? It seems like only the ones that encode the jp instruction should do. <br /><br />Also, it seems possible to avoid having to write out the tiles elsewhere in memory by replacing the GetChar function with <br />[code]<br />GetChar:<br />and a, $0F<br />add a, $F6 ; &#039;0&#039;<br />jr nc , .digit<br />add a, $60 ; &#039;A&#039;<br />.digit<br />ld (hl+), a<br />ret<br />[/code]<br />which 2 bytes shorter than it is in Cryo&#039;s version (don&#039;t know about Torchicken&#039;s version), and saves 16 bytes of tile IDs.<br /><br />Edit: I tried this with Torchicken&#039;s version on BGB and it worked. (I also had my nicknames be blank spaces instead of 9s both when using box 1 on BGB and box 12 on VC. Don&#039;t know why)<br /><br />Edit2: I think I figured out the nickname thing: From a fresh cart, SRAM will be initialised with (mostly?) 00. However, the ClearSAV function fills SRAM with FF, which corresponds to the 9 character. So if you&#039;ve ever cleared the save file with the button combo that clears it, your uninitialised nicknames are all 9, otherwise they&#039;re blank spaces.


subject: GlitchDex errors/omissions
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  This is a thread for noting errors/omissions in the GlitchDex that need to be resolved:<br /><br />*The base 123 Defense for [url=http://glitchcity.info/wiki/GlitchDex/Y:237]4( h 4 ?[/url] should be base 128 according to [url=https://hax.iimarck.us/files/missingno_explained.html]the data[/url].<br />*The base Attack for the [url=http://glitchcity.info/wiki/Category:Family_209_glitch_Pok%C3%A9mon]Family 209[/url] glitch PokÃ©mon in Red/Blue (Base 255 Attack) is incorrect?<br />*Since some glitch PokÃ©mon have ( in their names, this breaks the name system which thinks the bracket is part of the glitch PokÃ©mon&#039;s family data (PokÃ©dex number).<br />*Cries need to be added for glitch PokÃ©mon due to the old links no longer working.<br />*Methods of obtaining glitch PokÃ©mon need to be updated for a few remaining glitch PokÃ©mon.<br />*TM/HM moves and Time Capsule exploit moves need to be added for a few remaining glitch PokÃ©mon.<br />*Super Glitch moves should have their index numbers indicated in the data. Also a question worth raising is &quot;are there any &#039;non-Super Glitch&#039; moves which never cause Super Glitch corruption?&quot;.<br />*Add the index numbers for types for glitch PokÃ©mon with glitch types and &#039;pseudo real&#039; (is said to be a real type but is really a glitch type) types.


subject: Pikawalk Glitch Information?
poster_name: baconpants
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I am extremely curious about the glitch where Pikachu walks offscreen and the game becomes extremely confused. Is there any reason as to why a crash from this glitch may brick your save file? I would really like to know as my save file was corrupted while entering Glitch City and I lost my Pokemon to it. (That I was dearly attached to, but I&#039;m attached to every one of them!)<br /><br />Is the game just so confused by Pikachu it messes itself up, or does keeping track of Pikachu need a lot of work?


subject: Rate my Diamond team? Or just read about it, that's fine too.
poster_name: baconpants
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [list]Even though I am definitely not one to play competitively or raise Pokemon with perfect IVs and EVs, I still would like to get my team rated, if that&#039;s okay! I&#039;d rather it be judged on just if they are good Pokemon to raise for the main story, and perhaps their names as well. Also, I know they&#039;re all pretty underleveled.<br /><br />Nickname: Allen<br />Species: Torterra<br />Gender: Male<br />Level: 40<br />Nature: Naughty<br />Trait: Very finicky.<br />Moves:<br />Earthquake<br />Bite<br />Synthesis<br />Razor Leaf<br /><br />Nickname: Nyes<br />Species: Luxray<br />Gender: Female<br />Level: 45<br />Nature: Gentle<br />Trait: Likes to run.<br />Moves:<br />Thunder Fang<br />Spark<br />Charge<br />Crunch<br /><br />Nickname: Egglord<br />Species: Staravia (Yes, I know..)<br />Gender: Female<br />Level: 20<br />Nature: Lovely<br />Trait: Alert to sounds.<br />Moves:<br />Fly<br />Quick Attack<br />Wing Attack<br />Endeavor<br /><br />Nickname: Satan (I can explain!)<br />Species: Feraligatr<br />Gender: Female<br />Level: 43<br />Nature: Naive<br />Trait: Mischievous.<br />Moves:<br />Slash<br />Crunch<br />Surf<br />Ice Fang<br /><br />Nickname: Jasper<br />Species: Toxicroak<br />Gender: Female<br />Level: 40<br />Nature: Relaxed<br />Trait: Somewhat vain.<br />Moves:<br />Sucker Punch<br />Strength<br />Revenge<br />Rock Climb<br /><br />Nickname: Gaspar<br />Species: Gengar<br />Gender: Male<br />Level: 42<br />Nature: Hasty<br />Trait: Proud of its power.<br />Moves:<br />Sucker Punch<br />Shadow Punch<br />Dream Eater<br />Shadow Ball<br /><br />Please remember I don&#039;t play competitively and this is my main story team! Constructive criticism would be nice for how to improve my team moveset-wise, etc.[/list]


subject: Re: Pikawalk Glitch Information?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t exactly know why, but what happens is the game keeps track of your movement to move Pikachu. To do so, your movement is copied into a buffer, but when Pikachu is offscreen, the game writes past the buffer&#039;s bounds and ends up corrupting memory following the buffer. Now, as to why that bricked your save file, there may be a thousand different reasons. Mostly if you saved after attempting the glitch.


subject: Re: [Passion Project]Glitchspeak Program
poster_name: zeifyl
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: zeifyl
icon: xx
body:
  Update: Program is finished, and can now be downloaded from [url=http://s000.tinyupload.com/index.php?file_id=00145181754628339100]Here[/url]<br /><br />Also sorry for double posting.


subject: Re: Pikawalk Glitch Information?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  That&#039;s right, the corruption affects addresses D438 onwards for the first step while Pikachu is off-screen with the following values:<br /><br />South=01<br />North=02<br />West=03<br />East=04<br /><br />So if you place Pikachu off-screen then move south, then west and east in that order, the data looks like 01 03 04.<br /><br />It is possible to corrupt over 250 bytes using this glitch, I unfortunately can&#039;t remember the specifics but it might not be 255 bytes.<br /><br />This is a list of addresses you may be able to corrupt using the glitch, from the [url=https://github.com/pret/pokeyellow]PokÃ©mon Yellow disassembly[/url].<br /><br />[code]<br />wExpressionNumber:: ; d447<br />	ds 1<br />wPikaPicAnimNumber:: ; d448<br />	ds 1<br />	<br />wPikachuMovementScriptBank:: ds 1&nbsp; ; d449<br />wPikachuMovementScriptAddress:: dw ; d44a<br />wPikachuMovementFlags:: ; d44c<br />; bit 6 - spawn shadow<br />; bit 7 - signal end of command<br />	ds 1<br /><br />wCurPikaMovementData:: ; d44d<br />wCurPikaMovementParam1:: ds 1 ; d44d<br />wCurPikaMovementFunc1:: ds 1 ; d44e<br />wCurPikaMovementParam2:: ds 1 ; d44f<br />wCurPikaMovementFunc2:: ds 1 ; d450<br />wd451:: ds 1 ; d451<br />wCurPikaMovementSpriteImageIdx:: ds 1 ; d452<br />wPikaSpriteX:: ds 1 ; d453<br />wPikaSpriteY:: ds 1 ; d454<br />wPikachuMovementXOffset:: ds 1 ; d455<br />wPikachuMovementYOffset:: ds 1 ; d456<br />wPikachuStepTimer:: ds 1 ; d457<br />wPikachuStepSubtimer:: ds 1 ; d458<br />	ds 5<br />wCurPikaMovementDataEnd:: ; d45e<br />	ds wCurPikaMovementData - @<br /><br /><br />wPikaPicAnimPointer:: dw ; d44d<br />wPikaPicAnimPointerSetupFinished:: ds 1 ; d44f<br />wPikaPicAnimCurGraphicID:: ds 1 ; d450<br />wPikaPicAnimTimer:: ds 2 ; d451<br />wPikaPicAnimDelay:: ds 1 ; d453<br />wPikaPicPikaDrawStartX:: ds 1 ; d454<br />wPikaPicPikaDrawStartY:: ds 1 ; d455<br /><br />wCurPikaPicAnimObject:: ; d456<br />wCurPikaPicAnimObjectVTileOffset:: db ; d456<br />wCurPikaPicAnimObjectXOffset:: db ; d457<br />wCurPikaPicAnimObjectYOffset:: db ; d458<br />wCurPikaPicAnimObjectScriptIdx:: db ; d459<br />wCurPikaPicAnimObjectFrameIdx:: db ; d45a<br />wCurPikaPicAnimObjectFrameTimer:: db ; d45b<br />	ds 1<br />wCurPikaPicAnimObjectEnd:: ; d45d<br /><br />	ds 18<br /><br />wPikachuHappiness:: ds 1 ; d46f<br />wPikachuMood:: ds 1 ; d470<br />wd472:: ds 1 ; d471<br />wd473:: ds 1 ; d472<br /><br />	ds 1<br /><br />wd475:: ds 1 ; d474<br /><br />	ds 4<br /><br />wd47a:: ds 1 ; d479<br /><br />	ds 24<br />	<br />wd492:: ds 1 ; d492<br />	<br />	ds 1<br />	<br />wSurfingMinigameHiScore:: ds 2 ; 4-digit BCD little-endian<br />	ds 1<br /><br />wPrinterSettings:: ds 1<br />wUnknownSerialFlag_d499:: ds 1 ; d498<br />wPrinterConnectionOpen:: ds 1 ; d499<br />wPrinterOpcode:: ds 1 ; d49a<br />wd49c:: ds 1 ; d49b<br /><br />	ds 19<br /><br />wNumSigns:: ; d4af<br />; number of signs in the current map (up to 16)<br />	ds 1<br /><br />wSignCoords:: ; d4b0<br />; 2 bytes each<br />; Y, X<br />	ds 32<br /><br />wSignTextIDs:: ; d4d0<br />	ds 16<br /><br />wNumSprites:: ; d4e0<br />; number of sprites on the current map<br />	ds 1<br /><br />; these two variables track the X and Y offset in blocks from the last special warp used<br />; they don&#039;t seem to be used for anything<br />wYOffsetSinceLastSpecialWarp:: ; d4e1<br />	ds 1<br />wXOffsetSinceLastSpecialWarp:: ; d4e2<br />	ds 1<br /><br />wMapSpriteData:: ; d4e3<br />; two bytes per sprite (movement byte 2, text ID)<br />	ds 32<br /><br />wMapSpriteExtraData:: ; d503<br />; two bytes per sprite (trainer class/item ID, trainer set ID)<br />	ds 32<br /><br />wCurrentMapHeight2:: ; d523<br />; map height in 2x2 meta-tiles<br />	ds 1<br /><br />wCurrentMapWidth2:: ; d524<br />; map width in 2x2 meta-tiles<br />	ds 1<br /><br />wMapViewVRAMPointer:: ; d525<br />; the address of the upper left corner of the visible portion of the BG tile map in VRAM<br />	ds 2<br /><br />; In the comments for the player direction variables below, &quot;moving&quot; refers to<br />; both walking and changing facing direction without taking a step.<br /><br />wPlayerMovingDirection:: ; d527<br />; if the player is moving, the current direction<br />; if the player is not moving, zero<br />; map scripts write to this in order to change the player&#039;s facing direction<br />	ds 1<br /><br />wPlayerLastStopDirection:: ; d528<br />; the direction in which the player was moving before the player last stopped<br />	ds 1<br /><br />wPlayerDirection:: ; d529<br />; if the player is moving, the current direction<br />; if the player is not moving, the last the direction in which the player moved<br />	ds 1<br /><br />wTilesetBank:: ; d52a<br />	ds 1<br /><br />wTilesetBlocksPtr:: ; d52b<br />; maps blocks (4x4 tiles) to tiles<br />	ds 2<br /><br />wTilesetGfxPtr:: ; d52d<br />	ds 2<br /><br />wTilesetCollisionPtr:: ; d52f<br />; list of all walkable tiles<br />	ds 2<br /><br />wTilesetTalkingOverTiles:: ; d531<br />	ds 3<br /><br />wGrassTile:: ; d534<br />	ds 1<br /><br />	ds 4<br />[/code]<br /><br />I unfortunately don&#039;t know why the freezes from Pikawalk occur, but the reason why it can wipe the save may be related to the game filling the memory with 00 39 and affecting the SRAM.<br /><br />As is documented, you can also use the Pikawalk for:<br /><br />*Arbitrary code execution using glitch signs.<br />*To corrupt Pikachu&#039;s happiness/emotions.<br />*To enable 255 hours play-time.<br />*To create a &#039;Super Glitch City&#039; (a Glitch City with an invalid tileset).<br />*To get the S.S. Ticket while Bill is still a PokÃ©mon.<br />*To [url=https://www.youtube.com/watch?v=GA89M3MvnFI]corrupt Trainer data[/url].


subject: Re: [Passion Project]Glitchspeak Program
poster_name: zeifyl
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7909.msg204931#msg204931 date=1491986535]<br />This is a really nice looking program.&nbsp; :) Love it.<br />[/quote]<br />Woah! Torchickens saw it, and likes it! Thanks!<br />Also I did fix a tiny bug, concerning the letter &quot;v&quot;. The download link has been updated with the latest version.


subject: Re: [Passion Project]Glitchspeak Program
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=zeifyl link=topic=7909.msg204932#msg204932 date=1491987147]<br />[quote author=Torchickens link=topic=7909.msg204931#msg204931 date=1491986535]<br />This is a really nice looking program.&nbsp; :) Love it.<br />[/quote]<br />Woah! Torchickens saw it, and likes it! Thanks!<br />Also I did fix a tiny bug, concerning the letter &quot;v&quot;. The download link has been updated with the latest version.<br />[/quote]<br /><br />You&#039;re welcome, hehe. :)<br /><br />I see, cool.


subject: Any text dumps of Japanese Gen I games?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I really need to find a full text dump of any Japanese Gen I Pokemon game (don&#039;t ask why ;))<br /><br />Any attempts of Googling it failed miserably, even when I entered the keywords in Japanese.<br />I also recall seeing such a text dump at least once in my life, so I&#039;m sure it exists.<br /><br />Normally I&#039;d just attempt to make my own dump, but my knowledge of Japanese is really limited and I wouldn&#039;t really be able to separate the real ingame text from false-positives. If someone already made it, this would save me a lot of work.<br /><br />The question is: are there any text dumps of Japanese Gen I Pokemon games? And where can I find them?


subject: PKMN R/B - ACE: How to Exec code from ram?
poster_name: Klohver
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi, I am new to the pokemon glitching scene, I have been playing pkm r/b since it first came out, and started glitching for the past few years. I am familiar with the item underflow, trainer fly, and other glitches. What really interests me is arbitrary code execution. My plan is to, using 8F to bootstrap my game on console, and be able to write a code similar to the one where TheZZAZZGlitch used pokemon r/b/y to load super mario, pokemon crystal, etc, but have it execute things back into the same cartridge, for example: code it to reset the game, then I can start a new game in pokemon r/b with that code running so when I start the new game, I will have a certain setup right off the bat. For instance: having item 8F right from pallet town, having items, badges, 151 pokemon, being able to item underflow, or even possibly creating some sort of GUI or entry into the start menu that can be accessed to edit memory addresses that are out of reach of the item underflow glitch, all from the get go. I haven&#039;t seen anyone do this yet so I&#039;m hoping there is someone out there who could direct me on how to accomplish this. I get the gyst of how to bootstrap, but I am not familiar with the ASM code so I have no idea how to start this project? Any and all help will be super appreciated&nbsp; ;D


subject: Re: Any text dumps of Japanese Gen I games?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7913.msg204934#msg204934 date=1492003065]<br />I really need to find a full text dump of any Japanese Gen I Pokemon game (don&#039;t ask why ;))<br /><br />Any attempts of Googling it failed miserably, even when I entered the keywords in Japanese.<br />I also recall seeing such a text dump at least once in my life, so I&#039;m sure it exists.<br /><br />Normally I&#039;d just attempt to make my own dump, but my knowledge of Japanese is really limited and I wouldn&#039;t really be able to separate the real ingame text from false-positives. If someone already made it, this would save me a lot of work.<br /><br />The question is: are there any text dumps of Japanese Gen I Pokemon games? And where can I find them?<br />[/quote]<br /><br />I&#039;m afraid I don&#039;t know, sorry.<br /><br />I remember creating a Japanese Red/Green text dump which I [url=https://hax.iimarckus.org/topic/1362/]posted on Skeetendo[/url], but as I remember it wasn&#039;t organized and likely had a lot of garbage text in it. The file unfortunately may no longer exist as the link to it became unavailable and I&#039;m not sure if I have a backup, though it&#039;s possible somebody else may have downloaded it.<br /><br />Some of the text can be found on [url=https://github.com/YamaArashi/pokered-jp]the Japanese PokÃ©mon Red disassembly[/url], and [url=https://hax.iimarckus.org/topic/6767/]this useful thread[/url] but the text added on to the Japanese PokÃ©mon Red disassembly project likely isn&#039;t exhaustive, nor is the text on the thread.<br /><br />There may be a chance a Japanese fan has created a Red/Green text dump, but I&#039;m unsure what term is used in the Japanese community to describe a text dump. Hopefully with a bit of research one like this could be found.<br /><br />Alternatively I suggest contacting [url=https://forums.glitchcity.info/index.php?action=profile;u=1744]MeseInsanity[/url]. He knows Japanese, may be a native speaker and may be able to help you out with a joint text dump project.


subject: Re: PKMN R/B - ACE: How to Exec code from ram?
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  If this is your first time using ACE, I&#039;d recommend first try out some of the small scripts in the [url=http://forums.glitchcity.info/index.php?topic=6638.0]main thread[/url], such as getting any item or any pokÃ©mon, and try to understand how they work. The [url=https://github.com/pret/pokered]dissasembly[/url] might help with understanding too. <br /><br />Then you could start trying to make your own scripts, whenever you think of something that might be useful, using the [url=http://glitchcity.info/wiki/The%20Big%20HEX%20List]Big Hex List[/url] and [url=https://issotm.github.io/gbz80toitems3/]ISSOtm&#039;s compiler[/url] to help. <br /><br />If you&#039;re unsure of anything, try it in an emulator first - especially for things that might have a chance to crash and corrupt the save file and/or things that take a long time to set up.<br /><br />If your main goal is cartswapping, you can try a basic cartswap script at this point, that would soft reset into the swapped cart without any additional custom code.<br /><br />Once you feel you have enough experience with ACE, you can start something more ambitious, like [url=http://forums.glitchcity.info/index.php?topic=7773.0]Offgao&#039;s memory editor[/url], which I&nbsp; programmed into my game using a slightly modified version of [url=http://glitchcity.info/wiki/Executing_large_programs_with_arbitrary_code_execution]ZZAZZ&#039;s route 1 bike method[/url] - It&#039;s a GUI memory editor. <br /><br />Then, it should be possible to write a program that allows a cartswap into another game, then copy the memory editor + any other set up you want (like putting an 8F in the bag, bootstrap in your party, etc) into the save file before jumping into the initialisation routine.&nbsp; <br /><br />In theory it should be possible to patch up the initialisation script, like ZZAZZ for super mario, and skip over the part that clears HRAM, allowing custom code to be injected into the title screen, which would also give you control over starting a new save file as well as just continuing - which would allow you to do the stuff you want such as having access to 8F and the GUI memeditor from the start.


subject: Re: Pikawalk Glitch Information?
poster_name: baconpants
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh man, that&#039;s pretty neat!<br /><br />I don&#039;t remember doing anything insane with my Pikachu, I was just typically walking along the exit of the Safari Zone, heading into Glitch City and of course, Pikachu starts going in different directions and not following me. As soon as it stepped out of the map, the game crashed with a screen similar to this:<br /><br />[img]http://cdn.bulbagarden.net/upload/5/50/Redcrash.png[/img] <br /><br />Similar to the one that appears when you encounter Yellow Missingno.


subject: I'm new to this forum and PokÃ©mon glitching
poster_name: ï¼£ï¼¨ï¼©ï¼®ï¼¥ï¼³ï¼¥
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello, I am new to a lot of the PokÃ©mon glitching and I just want to ask for something like a &quot;Beginners Guide to PokÃ©mon Glitching For Generation One&quot; or something like that. As you could tell with my sort of suggestion title, I only want to start glitching with the first generation of PokÃ©mon, as I think it might be the simpler place to start, especially since I&#039;m still pretty new to programming, and&nbsp; I know nothing about Assembly language or reverse engineering code. Sorry if I&#039;m being dumb and there&#039;s a thread already talking about the basics of this stuff.


subject: Re: Any text dumps of Japanese Gen I games?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s likely that no one has made a full Japanese text dump yet. You can find a list of known dumps in various languages [url=http://bulbapedia.bulbagarden.net/wiki/User:Abcboy#Text_dumps]here[/url].


subject: Re: I'm new to this forum and PokÃ©mon glitching
poster_name: baconpants
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t happen to have a guide on hand, but I can help you if you would like! Honestly, I stick with and am familiar with the easier stuff. It all depends on where you would like to start, Generation 1 is a mess and has loads of glitches to work with. My personal favorite is the merging glitch, but it requires the Mew glitch and that. <br /><br />The best place to start would be with well known and easy to perform glitches with little or no side-effects, and that would be something along the lines of the trainer escape glitch, which you can use to get Pokemon such as Nidoking or Gengar at the beginning of Yellow, and get Mew. Another one would be the old man trick to get Missingno. There are many links on the wiki for stuff relating to these, and they&#039;re really fun to do.<br /><br />Once you get into that, you can do cooler stuff such as get glitch Pokemon with the trainer trick and if you want to get into the really advanced stuff, arbitrary code execution can do almost anything within the limits of your emulator/Gameboy.<br /><br />Welcome to the glitching community! 


subject: Re: I'm new to this forum and PokÃ©mon glitching
poster_name: ï¼£ï¼¨ï¼©ï¼®ï¼¥ï¼³ï¼¥
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=baconpants link=topic=7916.msg204942#msg204942 date=1492043536]<br />I don&#039;t happen to have a guide on hand, but I can help you if you would like! Honestly, I stick with and am familiar with the easier stuff. It all depends on where you would like to start, Generation 1 is a mess and has loads of glitches to work with. My personal favorite is the merging glitch, but it requires the Mew glitch and that. <br /><br />The best place to start would be with well known and easy to perform glitches with little or no side-effects, and that would be something along the lines of the trainer escape glitch, which you can use to get Pokemon such as Nidoking or Gengar at the beginning of Yellow, and get Mew. Another one would be the old man trick to get Missingno. There are many links on the wiki for stuff relating to these, and they&#039;re really fun to do.<br /><br />Once you get into that, you can do cooler stuff such as get glitch Pokemon with the trainer trick and if you want to get into the really advanced stuff, arbitrary code execution can do almost anything within the limits of your emulator/Gameboy.<br /><br />Welcome to the glitching community!<br />[/quote]<br />Thanks! Although this didn&#039;t really help that much as I already know about the Old Man and Trainer Escape Glitch, and I want to get into some of the slightly more advanced stuff, but I have really no idea where to start. Anyways, I appreciate your reply!


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=zxSuperGlitch link=topic=7770.msg204913#msg204913 date=1491669220]<br />Was gonna try this; Platinum save got completely wiped by me trying to tweak lolwut<br />[/quote]<br />And that&#039;s why I always use R4&#039;s save backuping features while glitching on gen 4 games.<br />Bad to hear that though.


subject: Re: Any text dumps of Japanese Gen I games?
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Let me guess, you&#039;re gonna translate it.<br />Anyway, I didn&#039;t find one on my way.<br />Also, about Bing Emerald, I don&#039;t really have time to do it, so it&#039;s just sitting here.


subject: Re: PKMN R/B - ACE: How to Exec code from ram?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  What you need first, and it is essential, is solid knowledge of assembly.<br />The Game Boy&#039;s processor is similar to the z80, so I recommend reading [url=http://tutorials.eeems.ca/ASMin28Days/welcome.html]ASM in 28 Days[/url] (a Day in this tutorial is simply a lesson, not a full day :P) to learn the z80 assembly. The tutorial is for TI 8X+ calculators, so there are some things there that don&#039;t matter for Game Boy stuff, but read it all, it&#039;ll make you practice.<br /><br />Once you have good knowledge of z80 assembly, read [url=http://gbdev.gg8.se/wiki/articles/Pan_Docs]the Pan Docs[/url] to get the basics of the GB&#039;s internals.<br /><br />And then get familiar with Gen I&#039;s engine, and you can start coding !


subject: Potential method to obtain ????? I'm not sure has been discussed before
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  As is known, the Japanese and English versions of PokÃ©mon games cause communication errors when linked together.<br /><br />However, something that got me wondering is it possible that we could abuse this to obtain a ?????, hence making the bad clone glitch easier for people who don&#039;t have Stadium 2 or don&#039;t want to use Coin Case/glitch TM/glitch PokÃ©dex mode arbitrary code execution?<br /><br />While I was linking up a Japanese Gold with an English Gold one of the versions interpreted some of the PokÃ©mon as ?????. Sadly I couldn&#039;t trade it as it was deemed to be abnormal.<br /><br />Thanks to the [url=https://forums.glitchcity.info/index.php?topic=6985.msg195941#msg195941]work of HÃ¡Äky[/url] however, we know that if a PokÃ©mon is not a hybrid, is not over level 100 and has matching types it can be traded without being interpreted as abnormal. I don&#039;t know for sure if this applies to ?????, but I seem to remember it does apply so we could potentially trade over the ?????.


subject: Re: Project &quot;Gotta Document 'Em All!&quot;
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  The GlitchDex now has all TM/HM and Time Capsule exploit data! :)<br /><br />(but work still needs to be done on the G/S/C glitch PokÃ©mon)<br /><br />Work on categorizing may start tomorrow, then it&#039;s on to ItemDex.


subject: Re: Potential method to obtain ????? I'm not sure has been discussed before
poster_name: baconpants
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This is really interesting! If you can get it to trade back and forth, I believe it would be a lot easier to get it than cloning repeatedly and the like, and save lots of time! I hope you make progress with this discovery!!


subject: Re: Potential method to obtain ????? I'm not sure has been discussed before
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=baconpants link=topic=7917.msg204949#msg204949 date=1492110298]<br />This is really interesting! If you can get it to trade back and forth, I believe it would be a lot easier to get it than cloning repeatedly and the like, and save lots of time! I hope you make progress with this discovery!!<br />[/quote]<br /><br />Thanks bacon! I agree :), it would be a great alternative even though you&#039;d need a Link Cable and a Japanese Generation II game.


subject: Re: Studies on the possibility of getting ????? in G/S/C
poster_name: baconpants
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I have only gotten ????? through cloning. I haven&#039;t seen a lot of information about them and had to mostly experiment on my physical copy of Silver, which was risky, but I obtained one.<br /><br />Essentially what I did is take one of my Pokemon, I randomly decided to use Gyarados but it doesn&#039;t really matter, just remember that the output if done correctly will have the front sprite of that Pokemon you utilized for cloning. After taking my Gyarados into the party, I tend to switch to a clear box. <br /><br />The game will remember if a box has been filled, and I haven&#039;t gotten it to work with a full box. The probability seems highest from around 16 Pokemon to 18 Pokemon in the box at the time of your cloning. I am sure it will work at other times, but this is just when it seems to appear for me. After this, you perform the cloning glitch as usual.<br /><br />The timing must be early, sometime between when the text box is cleared and SAVI. <br /><br />[img]http://i.imgur.com/SqRf3g3.png[/img]<br /><br />Somewhere right around here. <br /><br />Most of the clones will be perfect copies, but the one you are looking for should be part Steel along with glitchy letters and symbols. It should be the opposite gender of your original copy, and be level 0. Some of the other data such as the name may or may not remain, but the level is the main thing that will tell you if it is a bad clone. It is a hybrid of the original copy and a ?????. Depositing and removing it from the daycare will stabilize it to a full ?????.<br /><br />Depositing multiple Pokemon will not increase your chances of obtaining one, but just give you more if you do get one.<br /><br />This is all of my knowledge of the subject, sorry I am not very good with the technical stuff.<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: atav32
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: question
body:
  Hey everyone! Just discovered the wonders of 8F! Still got a lot to learn.<br /><br />I&#039;ve been using the &quot;Alternative Catch&#039;Em All&quot; code in the original post to receive any Pokemon and it&#039;s amazing how well it works!<br /><br />[quote]<br />ITEM LIST (starting from the first slot):<br />* Any item<br />* 8F<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x[SpeciesIndex]<br />X Speed&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x14<br />Ultra Ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x64<br />TM05&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x72<br />Lemonade&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x201<br /><br />[code]<br />ASM:<br />Code: [Select]<br />WRA1:D322 1E 20&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  e,[SpeciesIndex]<br />WRA1:D324 43&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  b,e<br />WRA1:D325 0E 02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  c,02<br />WRA1:D327 40&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  b,b<br />WRA1:D328 CD 48 3E&nbsp; &nbsp; &nbsp; &nbsp;  call 3E48<br />WRA1:D32B C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret <br />[/code]<br />[/quote]<br /><br />But when I started transferring them to Pokemon Bank, I&#039;ve hit a couple snatches.<br /><br />The main problem is that the Pokemon you receive are all Lvl 2. But PokeTransporter has level checks for <br />[list]<br />[li]starters &amp; evolutions[/li]<br />[li]Ditto[/li]<br />[li]Dratini &amp; evolutions[/li]<br />[li]legendary birds[/li]<br />[li]Mewtwo[/li]<br />[/list]<br /><br />Just wondering if there&#039;s an easy way to modify the setup to generate a variable Pokemon level. Or maybe hard-coded at Lvl 70 or something.<br /><br />- - - - -<br /><br />Unrelated, but just curious: I&#039;ve read that TM 01 x(any) and [any item] x201 represent the C9 byte which stops code execution. How do they differ? I tried using TM 01 x129 instead of Lemonade x201 in the above setup and it froze the game.<br /><br />Thanks everyone!


subject: What ISN'T Possible With ACE?
poster_name: Superâ˜…Nova
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: question
body:
  So far, we&#039;ve found the ability to complete the early Pokemon games incredibly quickly- even going so far as to beat other GB and GBC games with the correct usage of ACE. We can turn Pokemon into snake, and link battles into multiplayer games of pong. However, as someone with very limited knowledge of the exact behind the scenes (simply because I&#039;m a bit of an airhead when it comes to anything related to code), I&#039;ve always wondered what [i]isn&#039;t[/i] possible using ACE. <br /><br />Is there anything? Are there things we simply can&#039;t do with the in game bugs that allow us to write our own memory? I&#039;d also be interested in any snags that came up when ACE was first really exploited if anyone has any resources for me to take a look at. Thanks!


subject: Re: Potential method to obtain ????? I'm not sure has been discussed before
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t think it has been studied before and should be possible, indeed. Do you know if it works between English and non-English European games?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The Lemonade represents 3E in &quot;call 3E48&quot;. Without the Lemonade it translates to &quot;call C948&quot;. Even if C948 returns properly (it probably doesn&#039;t), it&#039;ll still treat the rest of your items as code until it finds a ret.


subject: Re: What ISN'T Possible With ACE?
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s impossible to do something outside of the hardware&#039;s capability. You can&#039;t make the game play the FRLG version of Pallet Town, for example.


subject: Re: What ISN'T Possible With ACE?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  camper pointed out the first problem. Although the example might be incorrect (having seen the latest Yellow TAS playing &quot;still alive&quot;... :P)<br />But, for example, you can&#039;t make a higher-resolution display. The hardware simply doesn&#039;t allow it.<br /><br />The second thing you can&#039;t do with ACE is modify ROM. You can emulate modifications (see SMB3 &quot;total control&quot; TAS) but they aren&#039;t permanent.<br />The next problem is the possible lack of RAM : the space where you can store your custom code can be very restricted, which means payloads too large aren&#039;t possible.


subject: Re: Potential method to obtain ????? I'm not sure has been discussed before
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The trade should work, IIRC the problem with JP and non-JP is the differing data structures (for example, non-JP versions&#039; longer Trainer name means the OT field is larger than in JP).<br />Plus, data structures are the same between US and EU : no problems.


subject: Re: What ISN'T Possible With ACE?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Has no one seen what date the &quot;Still Alive&quot; TAS was uploaded?<br />I put the video on the Discord server... then saw the date and knew I was bamboozled.<br />


subject: Re: What ISN'T Possible With ACE?
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: camper
icon: xx
body:
  [quote author=Yeniaul link=topic=7918.msg204959#msg204959 date=1492189734]<br />Has no one seen what date the &quot;Still Alive&quot; TAS was uploaded?<br />I put the video on the Discord server... then saw the date and knew I was bamboozled.<br />[/quote]<br />[url=https://www.youtube.com/watch?v=Vjm8P8utT5g]February 5th.[/url]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Here is a script that should work for an arbitrary encounter level:<br /><br />Repel x[Species index]&nbsp; ; ld e, [species index]<br />Awakening x[Level]&nbsp; &nbsp; &nbsp; ; ld c, [level]<br />X speed x64&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ; ld b, e / ld b, b<br />TM05 x72&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Lemonade x201&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ; call 3E38 / ret<br /><br />Replacing the lemonade x201 with a lemonade x4 [i]followed[/i] by a TM01 x[any] would also work. (x4 corresponds to inc b which basically does nothing at this point). But the lemonade is important.<br />


subject: Editing A000 to BFFF
poster_name: []J.
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: []J.
icon: xx
body:
  Hi, I&#039;m having some issues making my own ROM in GBZ80, and if anyone was to know the solution, it&#039;d be someone here.<br /><br />My cart type is 0x13, &quot;MBC3+RAM+BATTERY&quot;<br /><br />I cannot write to any value between A000 and BFFF, and any read attempts return FF. I&#039;ve tried toying with a few of the values at FF00+, but that&#039;s been proved fruitless. The area is titled SRA0 in BGB and I can&#039;t find anything about it online.<br /><br />Any help would be much appreciated.<br /> <br /><br /><br />


subject: Re: Editing A000 to BFFF
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  Attempt writing any byte ending in A to... i think it&#039;s ROM (but I may be very, very wrong). It&#039;ll unlock SRAM and allow read/write.<br />EDIT: Write any byte with A as the lower nybble to ROM:0000. I was riiiiiight...


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: jaybug_jimmies
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jaybug_jimmies
icon: xx
body:
  Hi folks<br />I have always been curious what this site [url=http://hakuda2.web.fc2.com/wario/poke3/f3.html]http://hakuda2.web.fc2.com/wario/poke3/f3.html[/url]<br />actually [i]said[/i]. All I knew is that it was pointing out the locations of some 0x50 map tiles. A really nice friend offered to translate it. However, they don&#039;t know anything about pokemon glitching, so they lack some context. I&#039;ve been trying to answer their questions, but honestly I&#039;m confused by some things.<br /><br />Here is a photo of their current attempts at translation:<br /><br />[url=http://imgur.com/a/8R0JK]http://imgur.com/a/8R0JK[/url]<br /><br />The reference to a &quot;summoning call&quot; is mysterious to me. What glitch exploit involving 0x50 map tiles would involve using a &quot;summoning call&quot;? Doesn&#039;t sound like traditional Cooltrainer exploit, sounds like something that forces a pokemon encounter? Wait . . . is it LOL glitch maybe? I am not very familiar with that one.<br /><br />My friend was also confuzzled about something that translated to &#039;map chips.&#039; and &#039;mass.&#039; I thought chips was referring to map tiles but it may not be, looking at how the word is being used in the paragraph. I dunno.<br /><br />Any ideas or insights would be awesome!<br /><br />EDIT: Aahaaaa Ok I found the section in this site on LOLglitch. This is definitely referring to that glitch. So that particular piece is cleared up at least.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=atav32 link=topic=6638.msg204952#msg204952 date=1492119538]<br />Hey everyone! Just discovered the wonders of 8F! Still got a lot to learn.<br /><br />I&#039;ve been using the &quot;Alternative Catch&#039;Em All&quot; code in the original post to receive any Pokemon and it&#039;s amazing how well it works!<br /><br />[quote]<br />ITEM LIST (starting from the first slot):<br />* Any item<br />* 8F<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x[SpeciesIndex]<br />X Speed&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x14<br />Ultra Ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x64<br />TM05&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x72<br />Lemonade&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x201<br /><br />[code]<br />ASM:<br />Code: [Select]<br />WRA1:D322 1E 20&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  e,[SpeciesIndex]<br />WRA1:D324 43&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  b,e<br />WRA1:D325 0E 02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  c,02<br />WRA1:D327 40&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  b,b<br />WRA1:D328 CD 48 3E&nbsp; &nbsp; &nbsp; &nbsp;  call 3E48<br />WRA1:D32B C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret <br />[/code]<br />[/quote]<br /><br />But when I started transferring them to Pokemon Bank, I&#039;ve hit a couple snatches.<br /><br />The main problem is that the Pokemon you receive are all Lvl 2. But PokeTransporter has level checks for <br />[list]<br />[li]starters &amp; evolutions[/li]<br />[li]Ditto[/li]<br />[li]Dratini &amp; evolutions[/li]<br />[li]legendary birds[/li]<br />[li]Mewtwo[/li]<br />[/list]<br /><br />Just wondering if there&#039;s an easy way to modify the setup to generate a variable Pokemon level. Or maybe hard-coded at Lvl 70 or something.<br /><br />- - - - -<br /><br />Unrelated, but just curious: I&#039;ve read that TM 01 x(any) and [any item] x201 represent the C9 byte which stops code execution. How do they differ? I tried using TM 01 x129 instead of Lemonade x201 in the above setup and it froze the game.<br /><br />Thanks everyone!<br />[/quote]<br /><br /><br />The Ultra Ball (index 2) actually represents the lvl. For instance using X Accuracy x64 instead of Ultra Ball x64 gives a lvl 46 PokÃ©mon.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Thanks for sharing this translation jaybug_jimmies!<br /><br />Yeah, &#039;map chip&#039; is probably referring to a sub-tile.<br /><br />In the Japanese versions, there is [url=http://glitchcity.info/wiki/Japanese_unterminated_name_glitch_item_instant_encounter_glitch]a simpler glitch[/url] than LOL glitch where 0x50 sub-tiles are relevant which allows you to summon a PokÃ©mon battle without having to partially escape from battle.<br /><br />In the English versions the glitch isn&#039;t that useful because the tile controlling D059 in the English versions is a menu tile; which would always result in a battle with Metapod.


subject: Re: Hacked Pokemon to generation it shouldn't exist in. (EXPERIMENT)
poster_name: shatteredClockworks
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MarcinTVP8 link=topic=7904.msg204867#msg204867 date=1491139237]<br />100% they would become glitch Pokemon, because Buzzwolde does not exsist in Gen 6.<br />Converting a glitch pokemon form Gen 6 to 7 with index numbers 722-801 will result in its equivalent Pokemon.<br />[/quote]I guess that would make sense, I actually forgot about this idea until now when I logged on again. 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Writing is done usually on Notepad or a sheet of paper. I&#039;m not even joking :P<br />Then we compile it either by hand or using some nifty tools created by the community (for example [url=http://glitchcity.info/wiki/8F%20Helper]these[/url] [url=http://glitchcity.info/wiki/GBz80%20to%20Items]two[/url])<br /><br />To test them, most of us prefer the BGB emulator and its amazing debugger, but some other emulators such as BizHawk are good options.<br />Some even take the time to build the setup on console to verify. But it&#039;s more rare.


subject: Re: Potential method to obtain ????? I'm not sure has been discussed before
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Now confirmed :)<br /><br />You just need two(?) newly started English Gold/Japanese Crystal or Gold games, with the English Gold having just the starter PokÃ©mon and the Japanese version having six PokÃ©mon.<br /><br />https://www.youtube.com/watch?v=-fvurV8KPEo


subject: Re: Potential method to obtain ????? I'm not sure has been discussed before
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Also, I suggested that the opponents party data on the JP version is shifted back by four bytes.<br />That&#039;s the reason the JP game shows that they have five PokÃ©mon in their party.


subject: GS Ball event by editing address byte via Arduino?
poster_name: Geration111
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi guys, i hope this is the right section of the forum to ask this. <br />So yesterday i was able to trade pokemons between my Arduino and PokÃ©mon Crystal only by using the SPI communication (so via game link cable, i only have an input, an output and the clock). I was wondering if there is a way, during the communication process, to set the byte 0x0B in the address 0xBE3C to the RAM (that address is in the RAM, right?) of the game cartridge. Do you guys know&nbsp; the SRAM bank for the 0xBE3C offset address?<br /><br />I also would like to ask, because i have an European cartridge, you if in European versions of the game the address changes or not, because i know for japanese games is another address, i think is address $A800 (0xA000) of the SRAM.<br /><br />And in your opinion, should i be able to send the byte by only using the serial communication during the communication process bewtween the Arduino and my gameboy? Anyone knows the function to do so (sending THAT byte to THAT precise address)?<br /><br />Does anyone have any ideas?<br /><br />In these topics there are the only infos i know:<br />https://forums.glitchcity.info/index.php?topic=7501.msg200458#msg200458<br />https://forums.glitchcity.info/index.php?topic=7626.msg202262#msg202262<br />http://forums.glitchcity.info/index.php?topic=1342.0;nowap&nbsp; &nbsp; &lt;-------------- here i don&#039;t see any 0xBE3C address, why is that so?


subject: Re: Studies on the possibility of getting ????? in G/S/C
poster_name: Geration111
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Geration111
icon: xx
body:
  I think i should be able to trade to myself ????? by coding it into Arduino since Hex numbers FC, FE and FF are not used for pokemons.<br /><br />But what does this ????? pokemon do?


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: jaybug_jimmies
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you Torchickens for pointing me to the right glitch! This helps enormously. Things make so much more sense now, and my friend is having a much easier time translating. I&#039;ll share the results when complete. :)


subject: Re: The CartSwap ACE - Using PokÃ©mon to ACE / credits warp other games
poster_name: Netroshin
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: question
body:
  Hi guys,<br /><br />I am wondering every time about the ace&#039;s you all do.<br /><br />The cardswap is one thing that I am interested in, too.<br />Can you ACE one starter or the starters in Pokemon Gold/Silver using ACE cardswap?<br /><br />From Blue using 8F to Gold with other starters.<br /><br />I hope that I can learn more about ACE here :)<br /><br />


subject: Re: The CartSwap ACE - Using PokÃ©mon to ACE / credits warp other games
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, I think it would be possible using cartswap ACE. We could use the DMA-hijacking-based GameShark emulator, I think there&#039;s a GameShark code to manipulate starters.


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: epicnessness
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I transferred my level 50 Darkrai (from Pearl) to my Pokemon Black 2, but Pokemon Transporter doesn&#039;t let it through. I made sure that it didn&#039;t know Pursuit, but it still doesn&#039;t work.<br />What&#039;s the problem?


subject: welcome to the jungle, we have fun and games
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  This was a long time coming, to be honest...<br /><br />If you watch Evie or ZZAZZ&#039;s videos on YouTube, you&#039;ve probably seen a guy named &quot;tate the great&quot; or &quot;LOST FOSSIL&quot; hanging around... yeah, that&#039;s mwah.<br /><br />Speaking of Evie, I also drew her icon, so that&#039;s cool I guess.<br /><br />ANYWAY, my name is Simon, I&#039;m autistic, I make a lot of typos, and I&#039;m currently planning for a project about documenting Japanese glitch Pokemon, so get ready for that?


subject: Hello
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi, I&#039;m Parzival. I&#039;ve been a lurker here for... what, 6 years? Anyway, I just wanted to become a member because... well... I&#039;ve been procrastinating about making one for 6 years, might as well just do it.


subject: Re: Hello
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Welcome to you too, I guess!<br /><br />I&#039;ve been stalking this place for a few weeks, although I&#039;ve always had a bizarre fascination with Pokemon glitches and I&#039;ve always checked on it sporadically...<br /><br />Six years is a lot of time to spend lurking... Glad to have more friends, though! :D


subject: Re: welcome to the jungle, we have fun and games
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nous avons aussi des mÃ¨mes de partout et un Discord !<br /><br />No worries about your autism, we already have autist people here and they didn&#039;t blow a nuke yet, so all is merry and fine !<br />Welcome to GCL ! (And nice icon, btw :D)


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Here is a new one, someone needs to edit the first post to add it.<br />[url=https://discord.gg/bxdMuWy]https://discord.gg/bxdMuWy[/url]


subject: Re: Offgao's memory viewer and Tetris ACE exploits
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  After a related question I decided to look up the equivalent of 3831 (JoyPadLowSensitivity) in non-English European versions.<br /><br />This is the code you have to place at DA80 for each version with the equivalent address in brackets to get the memory editor to work in those versions.<br /><br />English Red:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 31 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br /><br />(Joypad function address: 3138)<br /><br />French Red:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 4E 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 4E38)<br /><br />German Red:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 4B 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 4B38)<br /><br />Spanish Red:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 50 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br /><br />(Joypad function address: 5038)<br /><br />Italian Red:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 49 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 4938)<br /><br />English Yellow:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 1E 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 1E38)<br /><br />French Yellow:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 21 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 2138)<br /><br />German Yellow:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 23 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 2338)<br /><br />Spanish Yellow:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 23 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 2338)<br /><br />Italian Yellow:<br /><br />07 F6 01 00 FE 01 18 1F FF 00 00 00 00 00 00 00 00 00 00 00 00 00<br />F6 F7 F8 F9 FA FB FC FD FE FF 60 61 62 63 64 65 66 01 00 DA C5 0B 0B 16 12 21 AA C3 CD 4F DB 03 C5<br />01 0A 00 09 C1 15 20 F3 C1 3E ED EA D3 C3 3E FF E0 B7 76 C5 CD 1C 38 C1 F0 B5 FE 02 C8 FE 03 20 03<br />00 C5 C9 FE 40 20 01 0B FE 80 20 01 03 FE 20 20 06 21 F0 FF 09 44 4D FE 10 20 06 21 10 00 09 44 4D<br />FE 24 20 06 21 00 FF 09 44 4D FE 14 20 06 21 00 01 09 44 4D 16 00 FE 88 20 02 16 FF FE 48 20 02 16<br />01 FE 28 20 02 16 F0 FE 18 20 02 16 10 60 69 FE 44 20 08 F5 3A F5 2A 32 F1 77 F1 FE 84 20 0A F5 2A<br />18 00 F5 3A 22 F1 77 F1 44 4D 7A A7 28 03 0A 82 02 C3 AA DA 3E 7C 22 3E 7F 22 78 CD 6A DB 79 1E 1F<br />CD 6A DB 3E E3 22 0A CD 6A DB 3E 7C 22 C9 F5 CB 37 CD 71 DB F1 E5 26 DA E6 0F C6 96 6F 7E E1 22 C9<br /><br />(Joypad function address: 1C38)


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: gold55803
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Metarkrai link=topic=6868.msg204850#msg204850 date=1490976365]<br />[quote author=gold55803 link=topic=6868.msg204800#msg204800 date=1490192405]<br />Really stupid question, but could someone explain how data substructures work? The guides on bulbapedia make no sense to me... :&#039;(<br />also, how do you get a bag egg to battle? :???:<br />[/quote]<br /><br /><br />Outside of the PokÃ©mon IDentifiant (PID), Trainer IDentifiant (TID), PokÃ©mon&#039;s nickname, and Trainer&#039;s name, most of the PokÃ©mon&#039;s data is separated into 4 groups called substructures.<br />Each one of these substructures contains certain parts of the PokÃ©mon&#039;s data in a certain order.<br />They are called : Growth - Attacks - EVs &amp; Contest stats - Miscellanous<br /><br />For example, the Attacks substructure contains in that order : Move 1 identifiant - Move 2 identifiant -&nbsp; Move 3 identifiant&nbsp; - Move 4 identifiant - Move 1 PPs - Move 2 PPs - Move 3 PPs - Move 4 PPs<br />Each one of these substructures is 96 bits long (or 12 bytes, or 6 words, or 3 double-words).<br /><br />But all of this data isn&#039;t stored as is, it is crypted when stored into the RAM and decrypted when the game wants to use it to check/use some values (like calculating a PokÃ©mon&#039;s stats).<br /><br />In Gen 3, the encryption is made of two mechanics :<br />- The order of the 4 substructures is given by the PID modulo 24 (there are 24 ways to sort 4 different elements)<br />- The game takes all the hexadecimal words that make the substructures and computes their sum.<br />The first 4 hexadecimal characters of this sum (called checksum) is stored on another part of the PokÃ©mon&#039;s data.<br />Then, the game goes through every hexadecimal double-word that is contained in the substructures and modifies them with the formula : encrypted double-word = word xor TID xor PID&nbsp; (XoR being a logical operation)<br /><br />Thus, if you corrupt the data in the substructures directly, the checksum will be invalid and the corruption will fail (the PokÃ©mon will turn into a Bad Egg as soon as the game computes the checksum again and finds the difference with the stored checksum).<br /><br />However, if you corrupt the PokÃ©mon&#039;s PID, you will change the order of the substructures.<br />So when the game will look at the PokÃ©mon&#039;s data after the corruption, he will incorrectly read the substructures and this is where we can get very cool stuff.<br />(example : Growth substructure being read over the Attacks substructure, so the species of the corrupted PokÃ©mon is read over the identifiant of the first move of the PokÃ©mon before it corruption )<br />Since the PID is also used in the encryption of the substructures data, that PID corruption needs to meet a certain criteria in order to not affect that encryption.<br />But thankfully, one of the two possible ways to corrupt data with Pomeg Glitch meets this criteria.<br /><br /><br />Getting a Bad Egg (or an Egg/empty slot) to the battle is the matter of forcing the game to send a PokÃ©mon from a certain party slot to the battle, even though that PokÃ©mon is not supposed to be sent to the battle.<br />To do that, we exploit an oversight in the code that doesn&#039;t refresh the value &quot;Party slot of the currently fighting PokÃ©mon&quot; from one battle to another if the party is fully KO.<br /><br />Thus, the procedure looks like this :<br />- Make a wild battle and send a valid PokÃ©mon to the fight (let&#039;s say from the 3rd party slot)<br />- Perform Pomeg Glitch to have a fully KO party<br />- Place a Bad Egg/Egg to the 3rd party slot (or leave it empty by depositing a PokÃ©mon to the PC before killing the whole party)<br />- Make another battle (since the party is fully KO, the PokÃ©mon in the 3rd party slot will be forced to the fight)<br />[/quote]<br /><br />Alright, Thanks!


subject: Disabling the START menu through ACE
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Because why not :)<br />This is useful, for example, when making custom save files (poke @TheZZAZZGlitch :P). Or if you want to be an ugly troll to your friends ^^<br /><br />This is based off DMA hijacking, a technique that allows &quot;automatic&quot; ACE on each frame.<br />First off, you will want to write this piece of code somewhere :<br />[code]<br />NoStart::<br />ld a, [$C3AA]<br />cp $79<br />jr nz, .ok<br />ld hl, $0014<br />add hl, sp<br />ld [hl], $E8<br />inc hl<br />ld [hl], $29<br />.ok<br />ld a, $C3<br />ld c, $46<br />ret<br />[/code]<br />And for those who want hex :<br />[code]FAAAC3 FE79 2009 211400 39 36E8 23 3629 3EC3 0E46 C9[/code]<br /><br />Then, you will want to write<br />[code]CDYYXX E2[/code]<br />at $FF80, where the address of the above function is $XXYY (be careful of the order, it&#039;s in reverse !)<br />For example, if [u]NoStart[/u] is at [u]$CAFE[/u] you will write<br />[code]CDFECA E2[/code]<br /><br />But be careful, those four bytes have to be written in one frame ! Otherwise you will almost certainly crash :D<br /><br />Now, if everything is in place, the START menu will pop up when you press START, but will close immediately, without even printing any text inside<br />Until you reset the console, actually. This doesn&#039;t persist through resets :3 (although it is possible to make it permanent)<br />But this can make challenge runs where you aren&#039;t allowed to save (unless you change boxes), use items out of battle, re-order your PokÃ©mon (outside of the PC). Or just have fun screwing around :P<br /><br /><br />[hr]<br />[b]How does it work ?[/b]<br /><br />$C3AA is a part of the game&#039;s WRAM tilemap, and this is where tiles are written to before being copied to VRAM (because of access restrictions)<br />Specifically, the game writes a $79 there (top-left menu tile) when opening the START menu. As far as I know, no other text box in the game does this.<br />If such a tile is detected, the script knows the game is attempting to open the START menu. Specifically, due to how text boxes work, the game is processing the DisplayTextIDInit function, which consistently waits for a few frames.<br />What we do is manipulate this function&#039;s return address so instead of displaying the menu, it will directly go to the function that closes it.<br />[code]<br />ld hl, $0014<br />add hl, sp<br />[/code]<br />makes hl point to the aforementioned return address, which we overwrite with [u]$29E8[/u] (CloseTextDisplay) which undoes everything. Pop :P<br />All that remains of the menu is the blank text box, which is displayed by DisplayTextIDInit. It would be possible to avoid it, but that would be heavier. Besides, if you want to troll a friend, he will probably freak out a bit more :D<br /><br />Note that this doesn&#039;t affect any other text box ;)<br /><br />I&#039;d like to make a demonstration video but I don&#039;t have any working screen recorder.<br />Bummer.


subject: Japanese Glitch Pokemon Research
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: lamp
body:
  [b]NOTE:[/b] I know that there is a sticky about Gen 1 glitch Pokemon in various languages, but it has not been updated in a few years and is very incomplete. I aim for a more comprehensive version of all the glitch Pokemon in only the Japanese versions of the games.<br /><br />A few days ago, I realized that there is very little information on glitch Pokemon im the Japanese versions of the games. Naturally, there was almost nothing I could find that was written in English, but even Japanese websites dedicated towards Pokemon glitch research provided little information, usually just recording the base stats and MAYBE levelup moves of the Pokemon.<br /><br />Thusly, I have set out to create a comprehensive guide (field notes, if you will) to glitch Pokemon available in the Japanese versions of Red/Green, Blue, and Yellow.<br /><br />Assistance in my research is most welcome. Here is a form that lists all the various traits of a Pokemon:<br />[code]SPRITES GO HERE (front, back, menu)<br />[b]Name:[/b] NAME GOES HERE (TRANSLATION)<br />[b]Version:[/b]<br />[b]Hex ID:[/b]<br />[b]Type:[/b]<br />[b]Growth Rate/Lv. 100 EXP:[/b] (if you can&#039;t find its EXP group, just skip it and put the level 100 EXP)<br />[b]Catch Rate:[/b] (use the document provided later in this thread!)<br />[b]EXP Yield:[/b]<br />[b]Evolutions:[/b] (only levelup evolutions, unless you really want to record others)<br />[b]Cry:[/b] (provide description of it, or record it if you can!)<br />[b]Pokedex Entry:[/b] (provide image)<br /><br />[b][u]BASE STATS[/u][/b]<br />[b]HP:[/b] (there is a list of glitch Pokemon stats in this thread, use it)<br />[b]Attack:[/b]<br />[b]Defense:[/b]<br />[b]Speed:[/b]<br />[b]Special:[/b]<br /><br />[b][u]LEVELUP MOVES[/u][/b]<br />0 - MOVE GOES HERE (figure these out however you can! Preferably, go up to lv. 255)<br /><br />[b][u]TM MOVES[/u][/b]<br />TM00 - MOVE GOES HERE<br /><br />[b]Notes:[/b][/code]<br /><br />It would help if there was a way to calculate base stats for non-hybrids. A list of glitched EXP groups in the Japanese games would also be welcome. If you have resources on these topics, or just anything that would be useful in my quest, post it here.


subject: Data remanence: How many possible timea can you start a new save file in R/B/Y?
poster_name: ctfmon
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Going to preface this by saying that although I&#039;ve been interested in Pokemon glitches for several years now, I&#039;ve never really done much of it myself. So I know a fair amount butâ€‹I don&#039;t have a lot of first hand experience. <br /><br />There are some glitches that recall information from previous deleted saves. With this is mind, is there a limit to how many save files can ever be created on a game cart? If so, what is that limit?


subject: Re: Data remanence: How many possible timea can you start a new save file in R/B/Y?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Based on my (admittedly low) knowledge of Game Boy programming, I don&#039;t think that there is a limit. The remnants from past save files would not &quot;stack&quot; until there is no more space for writing saves, they would just be replaced. In addition, said remnants would be eventually overwritten as you progressed with that save file.<br /><br />If you were doing it on console, there MAY be a possibility that you exhaust the save battery, but I know diddly-squat about Game Boy hardware, so don&#039;t quote me on that.


subject: Re: Data remanence: How many possible timea can you start a new save file in R/B/Y?
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  SRAM chips tend to wear out over time, which IIRC can be influenced by how much data is read/written, just like HDDs.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: TheSixthItem
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In yellow, morph second item gives adds 1 to the quantity of item 2. If you have 255 and you use it, you get 0. Is there a way to convert that from ws[glitch]m to 8F?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=TheSixthItem link=topic=6638.msg205008#msg205008 date=1492872711]<br />In yellow, morph second item gives adds 1 to the quantity of item 2. If you have 255 and you use it, you get 0. Is there a way to convert that from ws[glitch]m to 8F? [/quote]<br /><br />Yes. The following code which is a modified version of TheZZAZZGlitch&#039;s change second item code (see this thread&#039;s first post) should work for changing the item quantity. It should on both Yellow (when using ws m redirected to item 3) and Red/Blue (when using 8F redirected to item 3) because no absolute memory addresses are specified. <br /><br />* 8F<br />* Item with quantity you want to morph<br />Burn Heal&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x43<br />Full Heal&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x201<br /><br />[u][b]ASM:[/b][/u]<br />[code]WRA1:D322 0C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; c<br />WRA1:D323 2B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  dec&nbsp; hl<br />WRA1:D32A 34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; (hl)<br />WRA1:D32B C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret [/code]


subject: Re: Project &quot;Gotta Document 'Em All!&quot;
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I am going to invest some more time into the GlitchDex to add PokÃ©dex entries, experience groups and catch rates in addition to the remaining &quot;move&quot; categories.<br /><br />Does anybody know if there is a way to view GlitchDex/Y:208&#039;s PokÃ©dex entry? Whenever I try it via capture at the beginning of the game or the code 01D01DD1 the screen turns white and the music fades out.<br /><br />However, apparently rsrdaman was able to get the PokÃ©dex data.<br /><br />[img]http://cdn.bulbagarden.net/upload/f/f0/YGlitchDexD0.png[/img]<br /><br />http://bulbapedia.bulbagarden.net/wiki/File:YGlitchDexD0.png<br /><br />I won&#039;t be adding this one though unless there is a way to get it to work and the screen happens to be the same. I have noticed some entries differ to the ones on Bulbapedia likely due to there being data from writable memory.


subject: Re: Project &quot;Gotta Document 'Em All!&quot;
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7705.msg205010#msg205010 date=1492895094]<br />I am going to invest some more time into the GlitchDex to add PokÃ©dex entries, experience groups and catch rates in addition to the remaining &quot;move&quot; categories.<br /><br />Does anybody know if there is a way to view GlitchDex/Y:208&#039;s PokÃ©dex entry? Whenever I try it via capture at the beginning of the game or the code 01D01DD1 the screen turns white and the music fades out.<br /><br />However, apparently rsrdaman was able to get the PokÃ©dex data.<br /><br />[img]http://cdn.bulbagarden.net/upload/f/f0/YGlitchDexD0.png[/img]<br /><br />http://bulbapedia.bulbagarden.net/wiki/File:YGlitchDexD0.png<br /><br />I won&#039;t be adding this one though unless there is a way to get it to work and the screen happens to be the same. I have noticed some entries differ to the ones on Bulbapedia likely due to there being data from writable memory.<br />[/quote]<br /><br />Next time I get on the computer, I&#039;ll see if I can get it to work in Debug Yellow, or try wrestling with normal Yellow if that doesn&#039;t count.<br />By the way, the list of TMs the Pokemon can learn is VERY hard to read without line breaks. If that&#039;s not on your list of improvements, I&#039;d appreciate if it was. :)


subject: Re: Data remanence: How many possible timea can you start a new save file in R/B/Y?
poster_name: ctfmon
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=7928.msg205007#msg205007 date=1492820376]<br />SRAM chips tend to wear out over time, which IIRC can be influenced by how much data is read/written, just like HDDs.<br />[/quote]<br /><br />Are there any interesting glitches that could arise from a worn down SRAM chip? Or would it simply result in save corruption/deletion?


subject: Re: Data remanence: How many possible timea can you start a new save file in R/B/Y?
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  With save checksumming, you&#039;d have to be lucky to be able to load a save. Then again, I&#039;ve saved and successfully reloaded a game while under Super Glitch effects multiple times on hardware, so who knows?


subject: R/G Glitch Pokemon Cries
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  This is related to my Japanese Glitchdex project, but I have put it in its own thread since it&#039;s only somewhat related...<br /><br />My good friend recorded every single glitch cry in Red and Green and uploaded it on YouTube!<br /><br />While this will be a nice help for my research, I will post it here in case anybody else wants to hear them.<br /><br />[url=https://youtu.be/P_E1ZUpI-58]All Glitch Pokemon Cries in Red and Green[/url]<br /><br />(if this is too similar to my research thread, feel free to merge them)<br /><br />Edit: Edited post for clarification... My apologies!


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheSixthItem link=topic=6638.msg205008#msg205008 date=1492872711]<br />In yellow, morph second item gives adds 1 to the quantity of item 2. If you have 255 and you use it, you get 0. Is there a way to convert that from ws[glitch]m to 8F?<br />[/quote]<br /><br />This is wat I use to get 0 of a certain item.<br /><br />- 8F<br />- Item you want 0 of x1<br />- PokÃ©ball x43<br />- Revive x201<br /><br />More convinient to turn 1 item into 0 then turning 255 into 0. Its also worth noting that 0 is actually 256, so you can toss them to get any quantity you need.


subject: Re: Project &quot;Gotta Document 'Em All!&quot;
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7705.msg205011#msg205011 date=1492906143]<br />[quote author=Torchickens link=topic=7705.msg205010#msg205010 date=1492895094]<br />I am going to invest some more time into the GlitchDex to add PokÃ©dex entries, experience groups and catch rates in addition to the remaining &quot;move&quot; categories.<br /><br />Does anybody know if there is a way to view GlitchDex/Y:208&#039;s PokÃ©dex entry? Whenever I try it via capture at the beginning of the game or the code 01D01DD1 the screen turns white and the music fades out.<br /><br />However, apparently rsrdaman was able to get the PokÃ©dex data.<br /><br />[img]http://cdn.bulbagarden.net/upload/f/f0/YGlitchDexD0.png[/img]<br /><br />http://bulbapedia.bulbagarden.net/wiki/File:YGlitchDexD0.png<br /><br />I won&#039;t be adding this one though unless there is a way to get it to work and the screen happens to be the same. I have noticed some entries differ to the ones on Bulbapedia likely due to there being data from writable memory.<br />[/quote]<br /><br />Next time I get on the computer, I&#039;ll see if I can get it to work in Debug Yellow, or try wrestling with normal Yellow if that doesn&#039;t count.<br />By the way, the list of TMs the Pokemon can learn is VERY hard to read without line breaks. If that&#039;s not on your list of improvements, I&#039;d appreciate if it was. :)<br />[/quote]<br /><br />Thanks! I think (but may be wrong) that line breaks should be there but the custom formatting apparently ignores it. This could possibly be worked around by using bullet points, so will add that to the list of tasks to do.


subject: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  The data for glitch PokÃ©mon PokÃ©dex is retrieved from a specific location in the Game Boy address BUS. In PokÃ©mon Red, this address should be the value of register de when a breakpoint is set to 10:436D and the PokÃ©mon&#039;s PokÃ©dex entry is loaded.<br /><br />A good number of glitch PokÃ©mon take their data from writable memory, including:<br /><br />BF: 9183<br />C0: 8B88<br />C6: 8F50<br />C7: 9180<br />C8: 8D84<br />CE: 8F50<br />CF: 888E<br />D0: 8E92<br />D2: 888F<br />D6: B417*<br />D8: 8550<br />D9: 8880<br />DA: 9891<br />DC: AA00*<br />E0: 8893<br />E1: 988D<br />E2: 817F<br />E3: 9188<br />E9: 8150<br />EA: 8B80<br />EE: CB17*<br />EF: 8350<br />F1: 8891<br />F2: 8B8B<br />F8: 8487<br />F9: 8C91<br />FA: 9388<br />FB: 9182<br />FC: 8180<br />FE: C203*<br /><br />(You must have not set [url=http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9dex_flags]the glitch PokÃ©mon&#039;s capture flag[/url] to see its PokÃ©dex entry)<br /><br />Thanks to the PokÃ©mon Red disassembly, we know the data is formatted like this.<br /><br />*(Species string terminated by 50).<br />*Four bytes apparently affecting height and weight.<br />*Text code.<br />*0x50<br /><br />While the text code (usually?) begins with 17, which is apparently the &quot;text far&quot; command we could replace it with 08, which allows us to execute arbitrary code following the 08.<br /><br />The addresses marked with an asterisk probably have the most potential to be abused. In particular D6 (B417) and DC (AA00), which is somewhere in the Hall of Fame data for SRAM bank 0.<br /><br />When I caught a glitch PokÃ©mon it appears that the SRAM was left open, so hopefully we may be able to add a bootstrap code here to items or a different location to execute arbitrary code, provided that we catch a 0xD6 or 0xDC with the LOL glitch.<br /><br />Chances are if you are able to catch these glitch PokÃ©mon using the LOL glitch you already have access to the expanded items pack, which sadly makes this glitch unnecessary as you could modify the map script in the expanded items pack or bring up an 8F for arbitrary code execution but it&#039;s still a nice glitch.<br /><br />Edit: I checked Blue and nothing changed sadly, though just noticed I may have missed 0xF0 (8350).


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I know there are glitch Pokemon with movesets and evolutions read from writable memory, but what do all the other ones do?<br /><br />Is there a Pokemon that takes its stats or TM moves from writable memory? That could be fun to tinker with...


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Caveat link=topic=7930.msg205019#msg205019 date=1492985212]<br />I know there are glitch Pokemon with movesets and evolutions read from writable memory, but what do all the other ones do?<br /><br />Is there a Pokemon that takes its stats or TM moves from writable memory? That could be fun to tinker with...<br />[/quote]<br /><br />Technically, Fossil and Ghost MissingNo. can be manipulated to have different base stats and/or a different TM/HM learnset but it has to be taken from an existing PokÃ©mon or glitch PokÃ©mon.<br /><br />https://www.youtube.com/watch?v=JnwN-uIVliA<br /><br />Otherwise I don&#039;t think so as all data (except for pointers within the data) for PokÃ©dex numbers (where the TM/HM data is stored) end up in ROM, and the TM/HM data is just a series of eight bytes wherever in the ROM the game ends up (TM/HM flags).<br /><br />However, there is the possibility of a glitch PokÃ©mon with a sprite from RAM. If so there is a slim chance we might even be able to assign a custom sprite without OAM hacking, but it would also have to have the dimensions data (not manipulable and from the ROM) assigned to that glitch PokÃ©mon. In other words it seems there could be a size limit for that sprite, and for glitch PokÃ©mon with a x0 dimension their sprites could still freeze the game.


subject: Re: Japanese Glitch Pokemon Research
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Good luck and have fun with your research! :)<br /><br />I don&#039;t know much about these glitch PokÃ©mon either, though I remember [url=http://www.geocities.jp/kattempla/pokebug/pokename.html]this website had a list of glitch PokÃ©mon names[/url] and I have a vague memory of someone documenting ã‚¢ãƒã‚›ãƒ‡ãƒ‘ãƒŸ (hex:FF)&#039;s moves.


subject: Re: Japanese Glitch Pokemon Research
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  Welp, Evie, thanks for posting, because now I have an excuse to post this!<br /><br />Here is my first Pokemon... I wanted to do HEX:FD due to that fact it has the Ghost sprite, but trying to fight it gives you a trainer battle, so I will obtain it some other way.<br /><br />[img]https://i.imgur.com/AuMcsUG.png[/img] [img]https://i.imgur.com/Uma2wJC.png[/img] [img]https://i.imgur.com/G1c3xxj.png[/img]<br />[b]Name:[/b] ãƒ… (Zu)<br />[b]Version:[/b] Green<br />[b]Hex ID:[/b] BF<br />[b]Type:[/b] Normal/ãƒœãƒ¼ã‚¤ (Boy type...? Maybe Youngster?)<br />[b]Growth Rate/Lv. 100 EXP:[/b] 0x20/2068037<br />[b]Catch Rate:[/b] 161<br />[b]EXP Yield:[/b] 91<br />[b]Evolutions:[/b] N/A<br />[b]Cry:[/b] Similar to Nidoran F. Possibly lower pitch? [url=https://twitter.com/NihyakuKitsune/status/855576918673903617]Video clip is here! (recorded by a friend!)[/url]<br />[b]Pokedex Entry:[/b] [img]https://i.imgur.com/NIIazmG.png[/img]<br /><br />[b][u]BASE STATS[/u][/b]<br />[b]HP:[/b] 20<br />[b]Attack:[/b] 35<br />[b]Defense:[/b] 26<br />[b]Speed:[/b] 167<br />[b]Special:[/b] 200<br /><br />[b][u]LEVELUP MOVES[/u][/b]<br />0 - Screech<br />0 - Pay Day<br />0 - Cut<br />0 - TM05<br />1 - TM34<br />3 - Super Glitch<br />5 - Super Glitch<br />6 - Wing Attack<br />7 - Aurora Beam<br />8 - Double Kick<br />9 - Aurora Beam<br />14 - Aurora Beam<br />15 - TM50<br />22 - TM03<br />24 - Wrap<br />25 - Aurora Beam<br />27 - TM29<br />28 - Horn Attack<br />29 - TM50<br />30 - Tackle<br />31 - TM54<br />32 - Fire Spin<br />33 - Horn Drill<br />35 - TM25<br />37 - Supersonic<br />39 - TM50<br />40 - Thunder Punch<br />41 - TM18<br />44 - Tackle<br />53 - Horn Drill<br />54 - TM08<br />55 - Super Glitch<br />62 - Comet Punch<br />67 - Horn Drill<br />71 - TM50<br />75 - TM04<br />81 - TM50<br />86 - TM25<br />87 - TM50<br />98 - TM50<br />111 - Poison Sting<br />119 - Horn Drill<br />132 - Horn Drill<br />153 - TM14<br />154 - Horn Drill<br />157 - Aurora Beam<br />167 - Super Glitch<br />168 - TM12<br />169 - TM12<br />172 - TM07<br />175 - TM34<br />180 - TM03<br />181 - TM14<br />183 - Horn Drill<br />193 - Aurora Beam<br />195 - Super Glitch<br />202 - Sand Attack<br />203 - TM54<br />204 - Tackle<br />205 - Agility<br />207 - Double Kick<br />209 - Tackle<br />210 - TM34<br />212 - Super Glitch<br />214 - TM03<br />218 - Stun Spore<br />221 - TM10<br />230 - TM10<br />234 - Absorb<br />245 - TM50<br />250 - TM21<br />254 - Mega Drain<br />255 - TM34<br /><br />[b][u]TM MOVES[/u][/b]<br />TM02 - Razor Wind<br />TM03 - Swords Dance<br />TM05 - Mega Kick<br />TM06 - Toxic<br />TM09 - Take Down<br />TM13 - Ice Beam<br />TM15 - Hyper Beam<br />TM16 - Pay Day<br />TM17 - Submission<br />TM23 - Dragon Rage<br />TM24 - Thunderbolt<br />TM25 - Thunder<br />TM30 - Teleport<br />TM31 - Mimic<br />TM32 - Double Team<br />TM34 - Bide<br />TM36 - Selfdestruct<br />TM37 - Egg Bomb<br />TM38 - Fire Blast<br />TM39 - Swift<br />TM40 - Skull Bash<br />TM41 - Softboiled<br />TM42 - Dream Eater<br />TM46 - Psywave<br />TM47 - Explosion<br />TM48 - Rock Slide<br />HM03 - Surf<br />HM05 - Flash<br /><br />[b]Notes:[/b] TM05, when I used it, had Scratch&#039;s animation and actually restored my health like Recover!<br />This Pokemon&#039;s front sprite also corrupts the soundbanks with varying effects, from doing nothing to slightly corrupting the music (and causing NPCs to walk down the screen) to causing the game to crash.


subject: Re: Japanese Glitch Pokemon Research
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What on Earth are those &quot;Base Stats&quot;? Are they what the stats were at level 100 because otherwise I have no idea what the heck those numbers could be. A base stat can only be up to 255 because the data is interpreted in that way and without ROM hacking you cannot have a base stat above 255.


subject: Re: The exact reason why unstable missingno crashes.
poster_name: TheSixthItem
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yellow missingno takes it&#039;s behavior from an unused chunk of data in SRAM bank 0 which can be quite random. thezzazzglitch made a video on stable yellow missingno using a method of arbitrary code execution <br />https://youtube.com/watch?v=eLuUWUeUTg4


subject: Re: Japanese Glitch Pokemon Research
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nice research Caveat !<br /><br />You mention it learns Super Glitch (four times, at levels 3, 5, 195 and 212), but could you indicate which IDs of Super Glitch are learned ? Thanks !<br /><br />Keep going, this is some good work :)


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  PokÃ©mon sprites aren&#039;t managed by the OAM. They are written on the tilemap (otherwise they&#039;d take all sprite slots and there would be nothing remaining for attack animations)<br /><br />Also, C203 ACE (PokÃ©mon FE) has a slim chance of being possible (I personally doubt it, but... let&#039;s cross fingers !) and CB17 ACE may be possible, it runs code based on map data and lastly drawn tiles, and eventually on menu data (&lt;- this one almost always crashes due to bad luck).<br /><br />VRAM should be locked when data is pulled from it, so I doubt about all non-* entries.<br /><br />The two SRAM candidates (B417 for hex:D6 and AA00 for hex:DC) may yield ACE, but we need to study what locks and what unlocks SRAM more. And then they may require ridiculous setups to yield ACE, but that&#039;d be the 13th (maybe 14th ? I lost count) ACE exploit in these games.<br /><br /><br />Yes, we have more than 10 different ACE exploits.<br />[b]QUALITY PROGRAMMING, GAME FREAK[/b]


subject: Re: Japanese Glitch Pokemon Research
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  [quote author=ISSOtm link=topic=7926.msg205025#msg205025 date=1493025956]<br />Nice research Caveat !<br /><br />You mention it learns Super Glitch (four times, at levels 3, 5, 195 and 212), but could you indicate which IDs of Super Glitch are learned ? Thanks !<br /><br />Keep going, this is some good work :)<br />[/quote]<br />I don&#039;t know how to use BGB&#039;s debugger to get the ID of the moves...<br /><br />Thanks, anyway&nbsp; :D<br /><br />EDIT:<br />[quote author=Flandre Scarlet link=topic=7926.msg205023#msg205023 date=1492999484]<br />What on Earth are those &quot;Base Stats&quot;? Are they what the stats were at level 100 because otherwise I have no idea what the heck those numbers could be. A base stat can only be up to 255 because the data is interpreted in that way and without ROM hacking you cannot have a base stat above 255.<br />[/quote]<br /><br />I do admit that my wording was a bit off (hence the question mark), but it is the level 100 stats of the Pokemon, not the base stats.<br /><br />I changed the post to reflect this... Sorry for the confusion.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Updated with Yellow pointers:<br /><br />(Set a breakpoint to 10:4405 and check de)<br /><br />00: 9288<br />BF: 8492<br />C0: 8384<br />C2: 9604<br />C6: 8492<br />C7: 8384<br />CD: 8492<br />CE: 8384<br />D0: A207/FREEZE<br />D4: 888B<br />D5: 8099<br />D6: 8391<br />D8: BE00<br />DC: 8B85<br />DD: 8C80<br />E1: 8417<br />E3: 8550<br />E4: 808B<br />E5: 848C<br />E7: D007<br />EB: 8893<br />EC: 988D<br />ED: 9493<br />EE: 9391<br />EF: 848B<br />F1: C808<br />F5: 9493<br />F6: 9391<br />F7: 848B<br />F9: F403 (!!)<br />FD: 8792<br />FE: 8B84<br />FF: 858B<br /><br />F403 is Echo RAM for D403, which can be manipulated by changing item 116+ in the expanded items pack, although you don&#039;t have that much space because items 129-256 represent items 1-128 again.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Now THAT is [b]really[/b] interesting !<br /><br />E7 runs code from D007, which is wEnemyMonBaseExp.<br />Right then is the player PokÃ©mon&#039;s name, so no problem ! Having a nick with a perfect number of characters means the first executed byte will be the player PokÃ©mon&#039;s HP (low byte). Making this $08 is easy.<br />[b]ACE HYPEEEEEEEEEEEE[/b]<br />Setup that would work, though it&#039;s not the only one :<br />- &quot;Box level&quot; (?) 1-byte instruction that doesn&#039;t crash<br />- No status problem<br />- The PokÃ©mon&#039;s type #1 should be $01 (FIGHT-type ?)<br />And then the PokÃ©mon&#039;s moves onwards will be ran as code.<br /><br />F1&#039;s C808 is in the middle of a &quot;LY override buffer&quot;. No idea what this is, but if the first read byte is $08, then this may NOP-slide into some printer-related data. Might lead to ACE ?<br /><br />F403 : is in the middle of some warp data. As Torchickens pointed it out, this could be manipulated..!<br />We can re-route execution to the item pack (either direct jump, or set hl then jp hl)


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: pikachubros2012
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=shatteredClockworks link=topic=36.msg203870#msg203870 date=1485360751]<br />In blue, I tried doing the &#039;M glitch, I eventually got it, but I got some weird encounters before actually getting Missingno.<br />Like a level 160 Rattatta<br />PROFESSOR OAK(!)<br />And Mewtwo.<br />By the way.<br />&#039;M sounds like Zapdos on crack.<br /> :P<br />[/quote]<br /><br />What was your Trainer name?


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  - Glitch item ACE<br />- Custom map script ACE<br />- Glitch map&#039;s map script ACE<br />- Normal map glitched map script ACE<br />- Glitch move ACE<br />- Glitch text boxes ACE<br />- Pikachu off-screen ACE<br />- Pikachu glitch emote ACE<br />- CartSwap ACE<br />- ZZAZZ Trainer ACE<br />- Glitch PokÃ©dex entries ACE<br /><br />That&#039;d make it the 11th ACE exploit. Unless I forgot one in this list, which would make it 12th.<br />Â¯\_(ãƒ„)_/Â¯


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I think you forgot remote code execution in the Trade Center (the exploit MrCheeze did for the R/B virus), so that makes at least 12.<br /><br />https://www.youtube.com/watch?v=h5Igc18hc2Q


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7930.msg205036#msg205036 date=1493107659]<br />- Glitch item ACE<br />- Custom map script ACE<br />- Glitch map&#039;s map script ACE<br />- Normal map glitched map script ACE<br />- Glitch move ACE<br />- Glitch text boxes ACE<br />- Pikachu off-screen ACE<br />- Pikachu glitch emote ACE<br />- CartSwap ACE<br />- ZZAZZ Trainer ACE<br />- Glitch PokÃ©dex entries ACE<br /><br />That&#039;d make it the 11th ACE exploit. Unless I forgot one in this list, which would make it 12th.<br />Â¯\_(ãƒ„)_/Â¯<br />[/quote]Game Freak&#039;s FailTrain just doesn&#039;t stop, does it?


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=36.msg204972#msg204972 date=1492339690]<br />Thanks for sharing this translation jaybug_jimmies!<br /><br />Yeah, &#039;map chip&#039; is probably referring to a sub-tile.<br /><br />In the Japanese versions, there is [url=http://glitchcity.info/wiki/Japanese_unterminated_name_glitch_item_instant_encounter_glitch]a simpler glitch[/url] than LOL glitch where 0x50 sub-tiles are relevant which allows you to summon a PokÃ©mon battle without having to partially escape from battle.<br /><br />In the English versions the glitch isn&#039;t that useful because the tile controlling D059 in the English versions is a menu tile; which would always result in a battle with Metapod.<br />[/quote]...so that&#039;s why the Hooked Metapod battles are a thing? Huh. Neat.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Yeah, it&#039;s quite unfortunate for Game Freak.<br /><br />Interestingly, if you call Wack0&#039;s Hall of Fame script using 0xF9 ACE, the Hall of Fame sequence runs without any problems but upon choosing continue you don&#039;t receive the PokÃ©mon (which would have been a Rhydon).<br /><br />[img]http://i.imgur.com/on31H7N.gif[/img]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Blaki
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s my first 8F script ever, it&#039;s not practical by any means, but still a bit fun. It displays a Pokedex entry based on the quantity of the stack of Lemonade !<br /><br />Lemonade x[Pokemon index value]<br />TM05 x155 (hex:9B)<br />Full Heal x201 (hex:C9)<br /><br />[u][b]ASM[/b][/u]<br />[code]ld a, [Pokemon index value]<br />call $349B<br />ret[/code]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Blaki link=topic=6638.msg205042#msg205042 date=1493158966]<br />It&#039;s my first 8F script ever, it&#039;s not practical by any means, but still a bit fun. It displays a Pokedex entry based on the quantity of the stack of Lemonade !<br /><br />Lemonade x[Pokemon index value]<br />TM05 x155 (hex:9B)<br />Full Heal x201 (hex:C9)<br /><br />[u][b]ASM[/b][/u]<br />[code]ld a, [Pokemon index value]<br />call $349B<br />ret[/code]<br />[/quote]<br />This could potentially be useful for the Pokedex ACE that was discovered recently...<br /><br />Even if it only displays complete entries after catching the Pokemon, it could still be used to easily execute the code in that manner.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Much like science in general, glitching seems to not be based on the principle of &quot;why&quot;, but the principle of &quot;why NOT?&quot;<br /><br />Do we need 12 ways to execute arbitrary code? [i]Hell[/i] no, but that won&#039;t stop any of us.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Parzival
icon: xx
body:
  [quote author=Caveat link=topic=6638.msg205043#msg205043 date=1493167355]<br />[quote author=Blaki link=topic=6638.msg205042#msg205042 date=1493158966]<br />It&#039;s my first 8F script ever, it&#039;s not practical by any means, but still a bit fun. It displays a Pokedex entry based on the quantity of the stack of Lemonade !<br /><br />Lemonade x[Pokemon index value]<br />TM05 x155 (hex:9B)<br />Full Heal x201 (hex:C9)<br /><br />[u][b]ASM[/b][/u]<br />[code]ld a, [Pokemon index value]<br />call $349B<br />ret[/code]<br />[/quote]<br />This could potentially be useful for the Pokedex ACE that was discovered recently...<br /><br />Even if it only displays complete entries after catching the Pokemon, it could still be used to easily execute the code in that manner.<br />[/quote]<br />Well, well, a newcomer might&#039;ve made history...


subject: Re: Japanese Glitch Pokemon Research
poster_name: OLDEN
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: OLDEN
icon: xx
body:
  I&#039;ve managed to extract the base stat data of every glitch PokÃ©mon in RGBY and put it on a [url=https://docs.google.com/spreadsheets/d/1Rnqns3UrF_G1bQbIcvwdyXB3m4nDYxa-Bj8PcpEOGpc/pubhtml]spreadsheet[/url]. It&#039;s still a work in progress, but I&#039;ve gotten the base stats, catch rate, and EXP yield down. A disclaimer: due to the general weirdness of glitches, some of this data might not be reflected in actual gameplay.<br /><br />In particular, ãƒ…&#039;s base stats are:<br />HP: 200<br />Attack: 35<br />Defense: 26<br />Speed: 167<br />Special: 200


subject: Re: Japanese Glitch Pokemon Research
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  [quote author=OLDEN link=topic=7926.msg205047#msg205047 date=1493192895]<br />I&#039;ve managed to extract the base stat data of every glitch PokÃ©mon in RGBY and put it on a [url=https://docs.google.com/spreadsheets/d/1Rnqns3UrF_G1bQbIcvwdyXB3m4nDYxa-Bj8PcpEOGpc/pubhtml]spreadsheet[/url]. It&#039;s still a work in progress, but I&#039;ve gotten the base stats, catch rate, and EXP yield down. A disclaimer: due to the general weirdness of glitches, some of this data might not be reflected in actual gameplay.<br /><br />In particular, ãƒ…&#039;s base stats are:<br />HP: 200<br />Attack: 35<br />Defense: 26<br />Speed: 167<br />Special: 200<br />[/quote]<br /><br />Oh, cool! Thanks for this!<br /><br />I haven&#039;t done any research lately because I haven&#039;t been on the computer. I could use my iPad, but that might lead to to inaccuracies. (and I don&#039;t know if this thing could support GameShark codes...)<br /><br />I did, however, assemble [url=https://pastebin.com/wXuucvZJ]a list[/url] of Pokedex numbers, as well as listing if the Pokemon is a hybrid or not.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=ISSOtm link=topic=7930.msg205026#msg205026 date=1493026303]<br />The two SRAM candidates (B417 for hex:D6 and AA00 for hex:DC) may yield ACE, but we need to study what locks and what unlocks SRAM more. And then they may require ridiculous setups to yield ACE, but that&#039;d be the 13th (maybe 14th ? I lost count) ACE exploit in these games.<br />[/quote]<br /><br />Looking into Red/Blue&#039;s now and will hopefully include it with Yellow ACE in a video.<br /><br />I almost did this with 0xDC (AA00) using PokÃ©mon 5 with a 50 terminator in the right place and PokÃ©mon 6 as a Level 8 PokÃ©mon with an invalid nickname but then it seems the SRAM data got corrupted because of 0xDC&#039;s sprite on the PokÃ©dex entry and that might be why it didn&#039;t work.<br /><br />I&#039;m not sure if you can do it with 0xD6 without another ACE or Hall of Fame corruption as it lands on one of the 00s, and even with a 0x50 directly following it you can&#039;t use the 08 text code five bytes later.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Correct me if I&#039;m wrong, but isn&#039;t SRAM unlocked by writing any byte ending in a 0xA nybble to 0000-1FFF?


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Does HRAM manipulation also count as ACE? Or not because the only way to get it is by already having ACE in the first place?<br /><br />Anyway, I decided to do a search for jp [hl] to find other potential ACE entry points (besides the ones that mess with the stack such as trade centre RCE, or exotic stuff like cartswap and HRAm manip, or potentially anything that messes with the ROM bank in an unexpected manor, or anything which pushes something to the stack and then rets to it, though I don&#039;t know if the game ever does this):<br /><br />[code]pokered$ git grep &quot;jp \[hl\]&quot;<br />engine/battle/animations.asm:&nbsp;  jp [hl] ; jump to special effect function<br />engine/battle/animations.asm:&nbsp;  jp [hl]<br />engine/battle/animations.asm:&nbsp;  jp [hl]<br />engine/battle/animations.asm:&nbsp;  jp [hl]<br />engine/battle/battle_transitions.asm:&nbsp;  jp [hl]<br />engine/battle/core.asm: jp [hl]<br />engine/battle/core.asm: jp [hl]<br />engine/battle/core.asm: jp [hl] ; jump to special effect handler<br />engine/battle/trainer_ai.asm:&nbsp;  jp [hl]&nbsp; &nbsp; &nbsp;  ; execute modification function<br />engine/battle/trainer_ai.asm:&nbsp;  jp [hl]<br />engine/cable_club.asm:&nbsp; jp [hl]<br />engine/items/items.asm: jp [hl]<br />engine/menu/start_sub_menus.asm:&nbsp; &nbsp; &nbsp; &nbsp; jp [hl]<br />engine/menu/text_box.asm:&nbsp; &nbsp; &nbsp;  jp [hl] ; jump to the function<br />engine/overworld/player_state.asm:&nbsp; &nbsp; &nbsp; jp [hl]<br />engine/overworld/ssanne.asm:&nbsp; &nbsp; jp [hl]<br />engine/palettes.asm:&nbsp; &nbsp; jp [hl]<br />engine/slot_machine.asm:&nbsp; &nbsp; &nbsp; &nbsp; jp [hl]<br />engine/trade.asm:&nbsp; &nbsp; &nbsp;  jp [hl] ; call trade func, which will return to the top of the loop<br />home.asm:&nbsp; &nbsp; &nbsp;  jp [hl]<br />home.asm:&nbsp; &nbsp; &nbsp;  jp [hl]<br />home.asm:&nbsp; &nbsp; &nbsp;  jp [hl]<br />home/overworld.asm:&nbsp; &nbsp;  jp [hl] ; jump to script<br />home/predef.asm:&nbsp; &nbsp; &nbsp; &nbsp; jp [hl][/code]<br /><br />OK so that&#039;s 24 possibilities (for R/B at least, haven&#039;t checked Y): <br /><br />- The 4 in animations.asm look like they&#039;re either non-manipulable, or fall under Glitch Move ACE (via animation pointers)<br /><br />- The 1 in battle_transitions.asm is non-manipulable (only influenced by bc which is set to 0, then only set by a few functions that never set bc to something invalid)<br /><br />- The 3 in core.asm are either non manipulable or fall under Glitch Move ACE (via move effects)<br /><br />- The 1 in trainer_ai.asm is the ZZAZZ trainer ACE (are there other glitch trainers that trigger ACE too?)<br /><br />- The 1 in cable_club.asm is seemed interesting, but it turns out that the address it reads from to determine the jump, CC38 aka wTradeCenterPointerTableIndex, is set right before every time the function that contains the jump is called, so it&#039;s unmanipulable. <br /><br />- The 1 in items.asm is Glitch Item ACE, the 8F that we all know and love<br /><br />- The 1 in start_submenus.asm is for out of battle moves, which seemed interesting since there is an unused field move $B4, but it would just act like surf since in its place is an extra pointer to the surf function. But maybe $cd3d AKA wFieldMoves could be manipulated somehow? Though this is very unlikely.<br /><br />- The 1 in text_box.asm doesn&#039;t seem manipulable since it searches through a table that is properly terminated by $FF<br /><br />- The 1 in player_state.asm looks interesting: It&#039;s determined by wSpriteStateData1 + 9, aka $C109, the player&#039;s current direction. Could that be potentially manipulated somehow?<br /><br />- The 1 in ssanne.asm is ALSO based on wSpriteStateData1 + 9<br /><br />- The 1 is palletes.asm is about SGB pallete commands. But it seems like every time RunPaletteCommand is called, b is set to a valid palette command already, so there doesn&#039;t seem to be room for manipulation.<br /><br />- The 1 in slot_machine.asm is for a pointer to a reward function that&#039;s based on the symbol on the wheel that matched. Unfortunately that doesn&#039;t seem possible to manipulate.<br /><br />- The 1 in trade.asm is non manipulable, as the pointer it uses is only ever set to a valid trade animation function which just follows a fixed sequence defined entirely in ROM.<br /><br />- The 3 in home.asm are in Bankswitch, CallFunctionInTable, and CheckForHiddenObjectOrBookshelfOrCardKeyDoor. <br />--The latter is non manipulable since it searches for a pointer in a well-terminated array so it only loads valid hidden object pointers. <br />--Bankswitch is also non manipulable since it always sets hl properly before being called. <br />--CallFunctionInTable is only used in scripts (which would fall under the map script ACE methods) and a couple of places in home.asm, one also to do with map scripts, and the other for NPC movement scripts, which after a quick glance over where the addresses involved are used, they seem to all be only set to constant values, unless $CC57 or $CF10 could be manipulated somehow.<br /><br />- The 1 in overworld.asm is the map script, which covers 3 types of map pointer ACEs.<br /><br />- Finally, the one in Predef.asm is for Predef pointers. Probably not manipulable since a predef ID is always set before calling Predef.<br /><br />I was surprised that TextCommandProcessor doesn&#039;t show up, but I discovered that actually uses &quot;jp hl&quot; instead of &quot;jp [hl]&quot; like I was searching for.<br /><br />There are 2 other instances of &quot;jp hl&quot;: One also in text.asm to a non manipulable function table, since it&#039;s only used when a &lt; 0xE [even if this were manipulable, it wouldn&#039;t be very useful since it&#039;s part of the text command processor which you can already use 08 to turn into ACE anyway]. The other is in naming_screen.asm, on a non-manipulable table for button input.<br /><br />Anyway, the next interesting thing to search for is TextCommandProcessor itself:<br /><br />[code]pokered$ git grep TextCommandProcessor<br />engine/cable_club.asm:&nbsp; call TextCommandProcessor<br />engine/menu/pokedex.asm:&nbsp; &nbsp; &nbsp; &nbsp; call TextCommandProcessor ; print pokedex description text<br />home.asm:&nbsp; &nbsp; &nbsp;  call TextCommandProcessor<br />home.asm:&nbsp; &nbsp; &nbsp;  jp TextCommandProcessor<br />home/text.asm:&nbsp; call TextCommandProcessor<br />home/text.asm:TextCommandProcessor::<br />home/text.asm:&nbsp; call TextCommandProcessor<br />[/code]<br />The calls in text.asm are the handlers for TX_FAR, and Char55, which points to a fixed text in ROM.<br />The call in cable_club.asm is also a fixed text string.<br />The call in pokedex.asm is [i]this[/i] ACE method!<br />The calls in home.asm are part of PrintText, which gives us something else to search for, and TrainerEndBattletext. Could we possibly manipulate the win/lose text pointers at d08c from within battle?<br /><br />At this point I searched for PrintText... and there are TONS of results., too many to list here and more than I&#039;m willing to check at the moment. They probably fall into the category of glitch text box ACE though.<br /><br />But if anyone wants to add a 13th method to the list, PrintText is a good place to start.<br /><br />Also, note that ACE doesn&#039;t necessarily need to point to RAM - Maybe there&#039;s something which points somewhere in ROM that&#039;s in the middle of a function that messes with the push/pop balance, causing the game to jump again to somewhere else when it hits a ret? A bit like how Coin Case ACE works.<br /><br />Also, research into what unlocks SRAM would be nice, since sometimes when I hit an rst 38 I lose my save, and sometimes I don&#039;t, with no pattern I can see, so it would be nice to know what unlocks SRAM so I could take precautions.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Several (read: most) of the invalid Predefs in Yellow over... it&#039;s like $80 or so... execute data from WRAM (thanks to whoever wrote the Wiki article for bringing those to my attention!) so we could probably start there in RB as well.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Parzival
icon: xx
body:
  [quote author=Aera link=topic=7770.msg205051#msg205051 date=1493220358]<br />You can&#039;t even enter the void in Platinum, surprised some people don&#039;t know this<br />[/quote]<br />Game won&#039;t let you break it?<br />MAKE IT BREAK ITSELF<br />[code]memcpy:<br />pop hl<br />pop de<br />pop hl<br />ld a,0<br />ld b,0<br />ld hl,0<br />ret[/code]<br />EDIT: I&#039;m an idiot. Revising code...


subject: Re: The Member's Guide to Topiclessness
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is it weird that I&#039;m slowly picking up more and more GBZ80ASM just from all the 8F/ws m scripts posted here? I feel like it is, since I&#039;m also gathering syntax and such as well at the same time. It&#039;s like taking a course on it, just [i]really, really[/i] spread out time-wise.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow, thanks for this jfb1337.<br /><br />I suppose HRAM ACE counts as the Pikachu glitch emote ACE was included on the list as well.<br /><br />I&#039;ll look into your finds to see if any other methods are possible.


subject: Re: Glitch Pikachu cries in Yellow
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheSixthItem link=topic=7897.msg205034#msg205034 date=1493081286]<br />I was just playing around with some of these.<br />https://youtu.be/NwH3Z4cZYEg<br />[/quote]<br /><br />Your video seems to only demonstrate valid cries. Invalid cries start from hex 0x2A (decimal 42).


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  @Parzival : calling invalid predefs without ACE is currently impossible. I might become wrong at some point.<br /><br />@jfb1337 : Nice grep ! :P<br />$C109 isn&#039;t manipulable on its own, BUT Glitch PokÃ©mon sprites (like Yellow&#039;s &quot;pixel&quot; Missingno.) can scramble this. This might be an entry point for ACE !<br />$CD3D should be overwritten by Brock Through Walls or the NoClip &quot;Museum guy&quot; method. This could also be an entry point ^^<br />If I overlooked other entries you marked as &quot;potential&quot;, please tell me and I&#039;ll look at those too !<br /><br />I didn&#039;t see you &quot;git grep &quot;jp hl&quot;, though ? And I can&#039;t do it because lack of Linux etc.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7930.msg205059#msg205059 date=1493239488]<br />@Parzival : calling invalid predefs without ACE is currently impossible. I might become wrong at some point.<br /><br />@jfb1337 : Nice grep ! :P<br />$C109 isn&#039;t manipulable on its own, BUT Glitch PokÃ©mon sprites (like Yellow&#039;s &quot;pixel&quot; Missingno.) can scramble this. This might be an entry point for ACE !<br />$CD3D should be overwritten by Brock Through Walls or the NoClip &quot;Museum guy&quot; method. This could also be an entry point ^^<br />If I overlooked other entries you marked as &quot;potential&quot;, please tell me and I&#039;ll look at those too !<br /><br />I didn&#039;t see you &quot;git grep &quot;jp hl&quot;, though ? And I can&#039;t do it because lack of Linux etc.<br />[/quote]<br /><br />$D08C can theoretically be manipulated with CoolTrainer to any reasonable address represented by map tiles at BGB coordinate x=03 y=0F, or the blue tile here:<br /><br />[img]http://i.imgur.com/iUGvGex.png[/img]<br /><br />..but you&#039;d need to not touch address $D078 or anything else that could lead the battle to freeze/end. If Glitch Cities alone aren&#039;t enough a tile printing glitch item combined with 9F to save the screen data [i]may[/i] help.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This address should be zero to be non-crashing, as far as a quick look into pokered could tell me. Maybe doable by Glitch Cities.


subject: Setting all ailments in-battle
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So, just to get acquainted with 8F, I made a small script to set the CPU Ailment byte to FF, because why not. I don&#039;t think anyone will be interested, but just in case, here you go.<br />[code]ld a,$FF;<br />ld [$CFE9],a;<br />ret;[/code]<br />In items, that&#039;d be<br />[code]Lemonade x255<br />TM34 x233<br />TM07 x201[/code]<br />I screwed everything up with one of my earlier tries, which was<br />[code]push af;<br />ld a,$FF;<br />ld [$CFE9],a;<br />pop af;<br />ret;[/code]<br />I landed at 03:0573, which is an invalid opcode. I don&#039;t know what happened before that, because I can&#039;t find a way to press a button for one frame while in the BGB debugger.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  [quote author=ISSOtm link=topic=7930.msg205059#msg205059 date=1493239488]<br /><br />I didn&#039;t see you &quot;git grep &quot;jp hl&quot;, though ? And I can&#039;t do it because lack of Linux etc.<br />[/quote]<br /><br />Here:<br />[code]pokered$ git grep &quot;jp hl&quot;<br />engine/menu/naming_screen.asm:&nbsp; jp hl<br />home/text.asm:&nbsp; jp hl<br />home/text.asm:&nbsp; jp hl<br /><br />[/code]<br /><br /><br />


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks ! These don&#039;t look like they can serve our purposes.<br />Oh well, at least you checked out :)


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  Also, I don&#039;t think CD3D would actually be possible since it gets written to when you select a pokemon, at which point there&#039;s no way to change it before the point it is read when you select one of the feild moves. I was originally thinking about super glitch corruption from the unused field move, but the game stores names of field moves separately so this one is just a properly terminated empty string.


subject: Re: GlitchDex errors/omissions
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Y:218 is Normal/Flying because it is a Spearow hybrid, not Rock/Ground.<br />RB:245 apparently has a volatile front sprite, as Bulbapedia has a (low quality) picture of it.


subject: Re: GlitchDex errors/omissions
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7910.msg205067#msg205067 date=1493291301]<br />Y:218 is Normal/Flying because it is a Spearow hybrid, not Rock/Ground.<br />RB:245 apparently has a volatile front sprite, as Bulbapedia has a (low quality) picture of it.<br />[/quote]<br /><br />Hmm I already fixed the error on Y:218 so I&#039;m unsure if an error is causing the page not to update.<br /><br />Thanks. Yeah, at an earlier point I included volatile glitch PokÃ©mon front sprites but later I decided not to add the one for RB:245 as I was never able to confirm it showing up, so it might not get added as it could be an error.


subject: Pokemon Red - Stryder7x edition
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you don&#039;t know Stryder7x, he makes videos about Paper Mario glitches. They generated a ton of memes, and this hack is a tribute to him. Now, it&#039;s not a ROM hack !<br /><br />Teaser : https://youtu.be/XfDCMkl5-Ko<br />Download the save : http://issotm.github.io/pokestryder.sav<br />Open with English Pokemon Red or Blue (Should crash otherwise, so... :D)<br /><br />Tech talk : http://gbdev.gg8.se/forums/viewtopic.php?pid=2273#p2273<br />It&#039;s too long. Really too long.


subject: Good DS Emulator
poster_name: Shadow Tyrant
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Does anyone have any good emulators, preferably one that can show the stats screen or move set screen of the Pokemon ----- with out crashing.


subject: Re: Good DS Emulator
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Higan is an incredibly accurate multi-purpose emulator, but I&#039;m not sure if it is accurate enough to survive looking at -----&#039;s stats.


subject: Re: Scrapped PokÃ©mon from Gold and Silver
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  There&#039;s something incredibly depressing about this... All these cool Pokemon that were literally removed from existence, and we will probably never meet them...<br /><br />Aqua and Aquaria could be Marill and Azumarill. (When was that little drawing of purple Marill revealed?)<br /><br />BÅ«ku could have been reworked into Emolga...<br /><br />Is it possible for somebody to contact Katsu Nagao and ask if they remember any of the other Pokemon?


subject: 's moveset
poster_name: Shadow Tyrant
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was unable to find the moveset/learnset for this pokemon so I figured I would post it here, please tell me if this has been done to save me time. Also keep in mind this is incomplete and onlygoes to Lv. 93 as I got stuck there.<br />Lv.23 Heart Swap<br />Lv.23 Metal Claw<br />Lv.24 Foresight<br />Lv.26 Worry Seed<br />Lv.26 Crunch<br />Lv.27 -<br />Lv.27 Spore<br />Lv.29 (Space)<br />Lv.30 SmellingSalt<br />Lv.30 Cross Poison<br />Lv.32 Frenzy Plant<br />Lv.33 Peck<br />Lv.33 Sand Tomb<br />Lv.33 Howl<br />Lv.34 Theif<br />Lv.34 Rock Polish<br />Lv.35 Dragon Rage<br />Lv.35 Mega Punch<br />Lv.35 Dragon Rage<br />Lv.35 Dragon Rage<br />Lv.35 Frenzy Plant<br />Lv.35 Dragon Rage<br />Lv.37 Chatter<br />Lv.38 Encore<br />Lv.38 Zap Cannon<br />Lv.39 Low Kick<br />Lv.39 Bulk Up<br />Lv.40 Toxic<br />Lv.42 Chatter<br />Lv.42 Signal Beam<br />Lv.42 Signal Beam<br />Lv.42 Signal Beam<br />Lv.42 Signal Beam<br />Lv.42 Signal Beam<br />Lv.42 Signal Beam<br />Lv.42 Signal Beam<br />Lv.46 Hi Jump Kick<br />Lv.47 Shadow Punch<br />Lv.47 Hidden Power<br />Lv.49 (Space)<br />Lv.49 Focus Punch<br />Lv.51 Brick Break<br />Lv.51 -<br />Lv.52 Trump Card<br />Lv.52 Heal Order<br />Lv.55 (Space)<br />Lv.58 Hypnosis<br />Lv.59 Struggle<br />Lv.59 Stomp<br />Lv.62 Hydro Pump<br />Lv.63 Avalanche<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.64 -<br />Lv.66 (Space)<br />Lv.68 (Space)<br />Lv.70 Agility<br />Lv.74 Dark Pulse<br />Lv.75 Safegaurd<br />Lv.76 Aqua Ring<br />Lv.81 Future Sight<br />Lv.83 Power Trick<br />Lv.86 Selfdestruct<br />Lv.87 -<br />Lv.88 -<br />Lv.89 -<br />Lv.89 Zap Cannon<br />Lv.90 Crabhammer<br />Lv.91 Peck<br />Lv.92 Force Palm<br />Lv.93 (Space) (All moves past this point it just wants to keep learning for what seems like forever)<br />Lv.93 Captivate <br />Lv.93 Captivate <br />Lv.93 Magnet Bomb


subject: Re: 's moveset
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nice. Is this for [url=http://forums.glitchcity.info/index.php?topic=7784.0]the same glitch you found in Platinum[/url]?


subject: Re: Scrapped PokÃ©mon from Gold and Silver
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7343.msg205072#msg205072 date=1493375481]<br />There&#039;s something incredibly depressing about this... All these cool Pokemon that were literally removed from existence, and we will probably never meet them...<br /><br />Aqua and Aquaria could be Marill and Azumarill. (When was that little drawing of purple Marill revealed?)<br /><br />BÅ«ku could have been reworked into Emolga...<br /><br />Is it possible for somebody to contact Katsu Nagao and ask if they remember any of the other Pokemon?<br />[/quote]<br /><br />Yeah, we never know though. Maybe Game Freak will rework these in the future or have already done so for one or more of them. Would love to see Honooguma in a future generation. :)<br /><br />Not sure when the Marill artwork was created and apparently the artwork is actually fan-made, not official.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: zeldamidori
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  hey guys, it&#039;s working in the german version of pokemon diamond.<br />thank you very much&nbsp; :D finally, after seven years, I got an Arceus


subject: Re: 2nd Glitch Pokemon in Pokemon Platinum
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;d like to see a video of this thing, if you can record it!<br /><br />From your description, it kinda reminds me of the Pomeg Glitch Pokemon in FRLG... (the &quot;oE {e Ai&quot; thing, or something similar)


subject: Wild Red Card oversight
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In a wild Single Battle (including an SOS Battle as long as there is currently only one opponent), if a wild PokÃ©mon holds a Red Card, the Red Card forces the player&#039;s PokÃ©mon to flee rather than switch out when activated.<br /><br />However, if the player only has one conscious PokÃ©mon in their party, the Red Card will not activate. This makes sense for its effect to force a switch, but for forcing a PokÃ©mon to flee I interpret this as a bug.<br /><br />This bug occurs in Gen 5, 6, and 7.


subject: Re: Wild Red Card oversight
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The Red Card is kinda buggy, isn&#039;t it?<br /><br />Does this glitch happen in previous generations?


subject: Re: Wild Red Card oversight
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Caveat link=topic=7936.msg205084#msg205084 date=1493554699]<br />The Red Card is kinda buggy, isn&#039;t it?<br /><br />Does this glitch happen in previous generations?<br />[/quote]<br /><br />Yeah, SnorlaxMonster said it occurs in Generations V and VI as well.


subject: Re: Pokemon Red - Stryder7x edition
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve broken this in multiple ways, all of which were labeled [B]wontfix[/b] by ISSOtm. I guess not even glitch fixes from a high-tier GCL [s]scientist[/s] member can derail Game Freak&#039;s FailTrain.


subject: Re: Pokemon Red - Stryder7x edition
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=7933.msg205086#msg205086 date=1493595918]<br />I&#039;ve broken this in multiple ways, all of which were labeled [B]wontfix[/b] by ISSOtm. I guess not even glitch fixes from a high-tier GCL [s]scientist[/s] member can derail Game Freak&#039;s FailTrain.<br />[/quote]<br />You used cheats, hence no fix.<br /><br /><br />[quote author=Caveat link=topic=7933.msg205087#msg205087 date=1493600321]<br />Thanks for being a meme factory, Stryder...<br />[/quote]<br />To this I can only answer one thing :<br />[size=14pt][b]LUIGI OVERLOAD[/b][/size]<br /><br />[quote author=Caveat link=topic=7933.msg205087#msg205087 date=1493600321]<br />I might tinker with this later...<br />[/quote]<br />I made a huge post that details how the thing works, if you&#039;re interested :<br />http://gbdev.gg8.se/forums/viewtopic.php?id=436


subject: Re: Pokemon Red - Stryder7x edition
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;you used cheats<br />Save states aren&#039;t cheats, and the first time save states weren&#039;t used anyway. :XD:


subject: Re: Pokemon Red - Stryder7x edition
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Your save states were broken, and thus allowed you to save when you shouldn&#039;t have been allowed to.<br />And the first time, I didn&#039;t fix because I prevented the trigger from happening entirely.


subject: Poke Pelago Glitch
poster_name: TheSixthItem
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheSixthItem
icon: xx
body:
  There&#039;s a glitch on poke pelago that lets you finish everything instantly<br />here&#039;s how to do it:<br />1. Start everything that you want to do<br />2. Save then go to System Settings &gt; Date and time<br />3. Set the time to January 31st 2016 at 23:59<br />4. Get into your game before the clock rolls over to the next minute<br />5. Wait for the clock to roll over<br />Poke Pelago Will Skip Ahead 24 hours*<br />HAVE FUN!<br /><br />*EDIT: Actually, everything just FINISHES. I thought it was 24 hours but when I was ev training my gligar, it skipped 48 so yeah... It isn&#039;t 24 hrs


subject: Re: The Member's Guide to Topiclessness
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve been sifting through some very old (late 2000s) posts...<br /><br />The state of 2006-2009 GCL was absolutely bizarre, from what I can tell...<br /><br />There were some pretty cool little games and such, though!


subject: Re: The Member's Guide to Topiclessness
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, my friend came home to a dead cat. I don&#039;t know many specifics, but... looks like I&#039;m gonna be trying to get him through his loss. He&#039;s known her since birth, too...


subject: The other glitch pokemon's stats and moves
poster_name: Shadow Tyrant
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I am going to call this one ?68 due to what the pokedex tries to show when catching this thing.<br /><br />Type Normal/Flying<br /><br />Base stats (Assuming all IVs are zero so I could be very wrong here)<br />HP-11<br />Atk-9<br />Def-10<br />Sp.Atk-10<br />Sp.Def-6<br />Spe-1<br /><br />Learnset<br />Lv. Start-5 Present (Could learn this move anywhere between these 2 levels)<br />Lv. Start-5 (Space) (Could learn this move anywhere between these 2 levels)<br />Lv. Start-5 Covet (Could learn this move anywhere between these 2 levels)<br />Lv. 26 Gastro Acid<br />Lv. 35 Dragon Rage<br />Lv. 40 Quick Attack<br />Lv. 64 -<br /><br />HM/TMs<br />TM 48 Skill swap<br />TM 89 U-Turn<br /><br />Move re-learner tries to teach him many glitch moves that he never tried to learn and moves he never tried to learn from Lv. 5 to 100. I still need to check the move tutors that you pay shards for moves.


subject: Gen 2 to 3 MITM trading?
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve been thinking about how you can&#039;t trade from Gen 2 to 3 for some reason, and I had a thought. Could we use a Python program to intercept and modify the data between the games in such a way that a Gen 2 game will see the other end of the link as a Gen 2 game, and the Gen 3 game will see a Gen 3 game? IMO, this could work, but it really isn&#039;t useful, but I might as well share my thoughts here just in case someone wants to pick it up.


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I briefly looked at the indices for C109 in Yellow and already found some really interesting behaviour:<br /><br />0E, 0F: Execute DA41 - This can fall through to wDayCareInUse and then the manipulable wNumInBox.<br />12, 13: Execute D367 - This can be manipulated via the expanded items pack.<br />20: Enable &quot;Blind Pikachu&quot; effect. Another fun way to do it!<br /><br />Sadly simply changing the value doesn&#039;t seem to be sufficient as it will reset back to a normal value, and the value must remain the same while walking on the exit mat.<br /><br />As ISSOtm said we might be able to get a glitch PokÃ©mon corruption (Yellow MissingNo.&#039;s sprite corruption if it doesn&#039;t freeze the game can do it after you run away, are there any others?) that sets this and hopefully to an exploitable value. If we use a save file that has never encountered a glitch PokÃ©mon and corrupted the SRAM there may be a point in which x number of encounters always results in the exploitable value.<br /><br />Edit: If you use Lg- then you can execute 0E&#039;s arbitrary code (or theoretically another ID&#039;s script) that way, bingo!<br /><br />Here are the other execution points that execute C000-FDFF.<br /><br />2C - DFE6<br />2D - DFE6<br />3A - FA0A<br />3B - FA0A<br />3E - D368<br />3F - D368<br />50 - C9A7<br />51 - C9A7<br />54 - C937<br />55 - C937<br />56 - E5C9<br />57 - E5C9<br />58 - D5E5<br />59 - D5E5<br />5A - C5D5<br />5B - C5D5<br />5C - CDC5<br />5D - CDC5<br />5E - D4CD<br />5F - D4CD<br />62 - FA42<br />63 - FA42<br />66 - D35D<br />67 - D35D<br />70 - FA35<br />71 - FA35<br />74 - C109<br />75 - C109<br />76 - CBC1<br />77 - CBC1<br />82 - C021<br />83 - C021<br />8E - FA6F<br />8F - FA6F<br />90 - C5FA<br />91 - C5FA<br />92 - CFC5<br />93 - CFC5<br />9A - CD00<br />9B - CD00<br />A0 - C13D<br />A1 - C13D<br />A2 - D1C1<br />A3 - D1C1<br />A4 - E1D1<br />A5 - E1D1<br />A6 - C9E1<br />A7 - C9E1<br />A8 - C8C9<br />A9 - C8C9<br />AC - D041<br />AD - D041<br />B0 - D341<br />B1 - D341<br />B4 - D641<br />B5 - D641<br />C7 - D0E4<br />DA - FAFF<br />DB - FAFF<br />DC - C5FA<br />DD - C5FA<br />DE - CFC5<br />DF - CFC5<br />EC - D918<br />ED - D918<br />F2 - D618<br />F3 - D618<br />F4 - E5D6<br />F5 - E5D6<br />F6 - D5E5<br />F7 - D5E5<br />F8 - C5D5<br />F9 - C5D5<br /><br />The only task now is finding out which series of corruptions would bring up a suitable execution point.


subject: Re: The other glitch pokemon's stats and moves
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Does this make you some sort of epic glitch pioneer or something?<br /><br />...Actually, this thing sucks REALLY bad!


subject: Re: Gen 2 to 3 MITM trading?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This could be done without too much problem by connecting two link cables to probably an Arduino, Pi or smth.<br />It&#039;s not useful at all, plus the EV systems aren&#039;t very compatible, data structures would be a pain to convert...<br /><br />But yeah, maybe someone bored will do it :D


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  OK done!<br /><br />From a save file with wiped SRAM data view 0xEC&#039;s summary sprite three times and then encounter Yellow MissingNo three times in Viridian Forest.<br /><br />You may get this wonderful piece of art (C109=0F). :)<br /><br />[img]http://i.imgur.com/UfNsIVI.png[/img]<br /><br />Then use Lg- and the game will execute DA41. Let this fall through to DA7F and use Pigdevil2010&#039;s bootstrap code (see http://forums.glitchcity.info/index.php?topic=6638.msg194861#msg194861) to redirect to item 3 and then add your code there.<br /><br />Do note that DA41 is WPlayTimeMaxed and wPlayTimeMinutes and wPlayTimeSeconds, wPlayTimeFrames follow. This means PlayTimeMinutes must not be a value that writes to h, causes a freeze, causes a jump so that DA7F isn&#039;t accessed, and you must be lucky enough to not get a freeze from the seconds and frames value.


subject: Re: The other glitch pokemon's stats and moves
poster_name: Shadow Tyrant
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  To answer the first question no, most likely not, and number 2 ya when I saw its stats at level 100 it was quite upsetting to see how bad it was (But so far all the glitch pokemon in gen 4 suck).


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  [quote author=Torchickens link=topic=7930.msg205102#msg205102 date=1493759346]<br />OK done!<br /><br />From a save file with wiped SRAM data view 0xEC&#039;s summary sprite three times and then encounter Yellow MissingNo three times in Viridian Forest.<br /><br />You may get this wonderful piece of art (C109=0F). :)<br /><br />[img]http://i.imgur.com/UfNsIVI.png[/img]<br /><br />Then use Lg- and the game will execute DA41. Let this fall through to DA7F and use Pigdevil2010&#039;s bootstrap code (see http://forums.glitchcity.info/index.php?topic=6638.msg194861#msg194861) to redirect to item 3 and then add your code there.<br /><br />Do note that DA41 is WPlayTimeMaxed and wPlayTimeMinutes and wPlayTimeSeconds, wPlayTimeFrames follow. This means PlayTimeMinutes must not be a value that writes to h, causes a freeze, causes a jump so that DA7F isn&#039;t accessed, and you must be lucky enough to not get a freeze from the seconds and frames value.<br />[/quote]<br /><br />Is this the most complex setup for ACE yet?<br /><br />I don&#039;t know how complicated most of the other methods are, but this is still ridiculous.


subject: Re: The other glitch pokemon's stats and moves
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Actually, the thing&#039;s starting moves match up with those of the hybrids, according to Bulbapedia...<br /><br />They both only learn 2 TMS, but the hybrids learn Light Screen and Charge Beam... Strange!


subject: Re: The other glitch pokemon's stats and moves
poster_name: Shadow Tyrant
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That is strange, I happened to have ----- in the party and he could only learn 2 TMs as well (Both being Skill swap and U-Turn)


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Caveat link=topic=7930.msg205104#msg205104 date=1493760933]<br />[quote author=Torchickens link=topic=7930.msg205102#msg205102 date=1493759346]<br />OK done!<br /><br />From a save file with wiped SRAM data view 0xEC&#039;s summary sprite three times and then encounter Yellow MissingNo three times in Viridian Forest.<br /><br />You may get this wonderful piece of art (C109=0F). :)<br /><br />[img]http://i.imgur.com/UfNsIVI.png[/img]<br /><br />Then use Lg- and the game will execute DA41. Let this fall through to DA7F and use Pigdevil2010&#039;s bootstrap code (see http://forums.glitchcity.info/index.php?topic=6638.msg194861#msg194861) to redirect to item 3 and then add your code there.<br /><br />Do note that DA41 is WPlayTimeMaxed and wPlayTimeMinutes and wPlayTimeSeconds, wPlayTimeFrames follow. This means PlayTimeMinutes must not be a value that writes to h, causes a freeze, causes a jump so that DA7F isn&#039;t accessed, and you must be lucky enough to not get a freeze from the seconds and frames value.<br />[/quote]<br /><br />Is this the most complex setup for ACE yet?<br /><br />I don&#039;t know how complicated most of the other methods are, but this is still ridiculous.<br />[/quote]<br /><br />Turns out this may work if you open your menu at Viridian City&#039;s PC before going to Viridian Forest and have never seen MissingNo. before, so it seems this is less hard to set up than previously thought, although there are some unknown complications that would prevent C109 becoming 0F.<br /><br />MissingNo. can be taken from one of the Trainers that do not differ in Yellow from [url=https://puu.sh/257S]this image[/url]. Notably you can Rival&#039;s effect through Lorelei&#039;s door and Selfdestruct to Bruno&#039;s second PokÃ©mon, lose the match and guarantee infinite MissingNo. To enable the Special encounter you can be guided by the Pewter City museum NPC.<br /><br />I successfully got this to work on console, but that was with a MissingNo.&gt;0xEC back-sprite&gt;MissingNo. method so there is a chance the new Viridian City PC method may not work.<br /><br />Even with this, this is a bit harder than map script and 8F/ws m arbitrary code execution due to the luck element (if the play time data is problematic you&#039;d have to delete the save file because you can&#039;t save the C109 value), having to have never seen a glitch PokÃ©mon sprite (I suppose Fossil/Ghost MissingNo. won&#039;t count) and importantly having to obtain the glitch item Lg- (hex:6E). If you&#039;re able to obtain glitch items you probably will have set up dry underflow and could just use custom map script ACE/LOL glitch with items with quantities over 99 from Celadon looping map trick or MissingNo. to set up the storage box bootstrap code.<br /><br />It&#039;s nice that this seems not to be a too unreasonable method of ACE however.<br /><br />Pikachu glitch emote and HRAM ACE could be seen as examples of more difficult methods as they already require arbitrary code execution to begin with.<br /><br />[quote author=Torchickens]<br />I successfully got this to work on console, but that was with a MissingNo.&gt;0xEC back-sprite&gt;MissingNo. method so there is a chance the new Viridian City PC method may not work.<br />[/quote]<br /><br />Does seem to work on real console. :)


subject: Petscop
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  Scaretheater introduced me to an ARG-in-progress of some kind...<br /><br />A guy named Paul finds a strange, unfinished Playstation game called Petscop and uploads footage of it to Youtube. It is a vaguely Pokemon-esque game in which a little bird(?) thing runs around trying to catch various &quot;pets&quot;, or weird monsters.<br /><br />However, things take a sinister turn quickly, with a mystery surrounding two little children named Mike and Care, a strange silhouette monster, and hints that the pets may have a deeper meaning...<br /><br />Very cool and creepy, and I know all of this just from reading about it!<br /><br />Much about the story and the game itself is still unknown, so let&#039;s investigate together!<br /><br />[url=https://www.youtube.com/channel/UCZKQv0ZFHpeIUkOtNjtq4KA]Youtube Channel[/url]<br />[url=https://www.reddit.com/r/Petscop/]Subreddit[/url]<br /><br />(note that there are heavy child abuse allusions, so be wary if you are upset by that sort of thing)


subject: Re: Glitch PokÃ©mon PokÃ©dex ACE in Generation I
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=7930.msg205108#msg205108 date=1493853086]<br />(IIRC) ACE Counter: 14.<br />Holy hell, so much s**t coding.<br />FAILTRAIN COUNTER: OVERFLOW<br />[/quote]<br />I think this game may legitimately be one of the buggiest games ever.<br /><br />Move over, Superman 64...


subject: Re: Petscop
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [i]interest gets piqued[/i]<br />...<br />...<br />...<br />...Let us begin.<br /><br />GET THAT MOTHERFUCKER


subject: Using the RETIRE glitch to enter the void?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  Using the &#039;Retire&#039; glitch in oreburgh city in D/P, you start the cutscene in which your Rival pushes you to the left, if you do this next to any house you can end up behind the door, enter it from the backside and get into the void. Alternatively, you can use Retire in the Great March building, which will make you walk downwards, even through the walls into the void.<br /><br />Edit: Going to Amity Square and activating Retire makes you go up, or down depending or you answer the question with yes or no, I am currently in the process of testing how far up and down I can go before I can freely move in the void, or I get stuck and the script unloads<br /><br />Answer: Going up, you crash once you load &#039;Oreburgh city&#039;, and going down you enter Mystery zone, but are able to walk back up into Amity Square.<br /><br />Issues: <br />1) First of all, you have to lose&nbsp; a battle in the void to maintain the Retire effect and be able to leave the void (as far as I&#039;ve tested).<br />You can&#039;t use fly, teleport, escape ropes or dig because you&#039;re still in the palpad mode and can&#039;t access these.<br />2)&nbsp; you will have to walk all the way to Oreburgh city as you&#039;ll spawn in the last pokecenter you entered before entering the void.<br />3) you can no longer fight any non-player battles in this mode, so gameplay is limited in this mode.<br />4) you can&#039;t use your bike, fly or any of the mentioned actions in 1), even after you left the void, but hey, at least you can walk through the grass without getting attacked... ha.<br />5) You can&#039;t save unless you&#039;re in a pokecenter, or any other area that forces you to save (like jubilife&#039;s WFC)<br /><br />There are a lot of downsides to this, and I don&#039;t know or you can disabled the Palpad mode by going into the void and into the palpark area, but I mainly posted this to just share some findings, don&#039;t think anyone else posted about this way of getting into the void yet either.<br />Don&#039;t recommend using this for real, but do what you want :)<br /><br />I&#039;m gonna add some screens and videos of this later today, to show my findings!<br /><br />Interesting thing, using RETIRE in Great Marsch to run around it, going above the door to the safari zone, using RETIRE to get under it and then entering the door makes you able to fight pokemon in the Safari zone, without paying, you can catch them with normal pokeballs (I used Duskballs) and gain experience, its the only zone I&#039;ve found in which you can fight... and you&#039;re not supposed to be able to fight here :p<br />


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Deku-Kitty link=topic=7845.msg204723#msg204723 date=1489588615]<br />Question, how does leveling up Arceus to 100 make it transferable? Unless I&#039;m not in the loop, current methods cause Arceus to be shown as caught in the Mystery Zone and not the Hall of Origin. Wouldn&#039;t that discrepancy make it impossible to transfer at all?<br />[/quote]<br /><br />There are ways to get Arceus found in the right location, which makes it transferable!


subject: Re: Using the RETIRE glitch to enter the void?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I guess you can get into the Sinnoh void by going left repeatedly ?<br />... or the Rival&#039;s script gets unloaded. Forget this (but posting anyways in case magic happens)


subject: Re: Using the RETIRE glitch to enter the void?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7941.msg205114#msg205114 date=1494015451]<br />I guess you can get into the Sinnoh void by going left repeatedly ?<br />... or the Rival&#039;s script gets unloaded. Forget this (but posting anyways in case magic happens)<br />[/quote]<br /><br />Is there any benefit over using the void by walking into the door from the backside? If so, I could test to see how far you could get before the script unloads.


subject: Re: Using the RETIRE glitch to enter the void?
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7941.msg205116#msg205116 date=1494022868]<br />But Gotta Document &#039;Em All !<br />[/quote]<br />I do believe the term you&#039;re looking for is [i][b]i&#039;m bored, but I&#039;ll try it anyway because I need something to do.[/b][/i]


subject: Re: Using the RETIRE glitch to enter the void?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No. I&#039;m talking about &quot;Try everything, so we can document it&quot;. Because documentation always eventually comes in handy.<br />Also, I&#039;m not bored, I&#039;ve got lots of stuff I&#039;m trying to do :D


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=epicnessness link=topic=7845.msg205096#msg205096 date=1493701686]<br />Yes I did.<br />[/quote]<br /><br />No idea then, there could be info i dont know since i dont use bank to transfer my mons.


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh and Mystery Zone Arceus should be transferable, the caught location is erased when it is sent to gen 5 i think


subject: Re: Using the RETIRE glitch to enter the void?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=ISSOtm link=topic=7941.msg205119#msg205119 date=1494058599]<br />No. I&#039;m talking about &quot;Try everything, so we can document it&quot;. Because documentation always eventually comes in handy.<br />Also, I&#039;m not bored, I&#039;ve got lots of stuff I&#039;m trying to do :D<br />[/quote]<br /><br />Tested, trying it at the wall at the far left makes the script change to a trainer tips sign, and ad the cave down right in Oreburgh you end up stuck in a wall in a mystery zone, I did find a very good void though, the building left of the pokemarkt seems to have a very stable void without any barriers blocking me. Also a sideeffect of the RETIRE glitch seemed like certain NPS&#039; went invisible with only a shadow showing, untill intereacted with of reloading of sprites.


subject: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare? +video
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: smiley
body:
  Alright, I felt like I had to seriously rewrite this whole post in order to get this pokemon.. or pokemons straight.<br /><br />-The pokemon is found using RETIRE in daycare, engaging into a double battle.<br />-The pokemon changes the sprites of pokemon around him into box&#039;s, which reverts itself once pokemon are thrown into the fight.<br /><br />-The pokemon changes its number in pokedex, type, stats, health depending on (we&#039;re assuming) The pokemon in the daycare.<br />-level is always 1 in battle, but sometimes it changes to 0 after looking at pokemons stats and such in box&#039;s, not sure why this happens<br />-always male<br />-changes its color sometimes when you look at pokemon in a box, permanently untill changed to another.<br />-changes its first part of its type to the previous pokemon looked at, second always remains flying. You can also change its type to &#039;cool&#039; or &#039;smart&#039; and so on.<br /><br />-most &#039;s we&#039;ve cought are extremely unstable, crashing when trying to look at their summary or switching them with another pokemon.<br />but, one particular one we refered to as &quot; &#039;s 24&#039; referring to its number given once caught, and it being an &#039;s. Was stable enough to be viewed.<br />-The moveset exists out of dig, and 2 glitchmoves with 0pp, we weren&#039;t able to test them out as any &#039;s seemed to crash the game or softlock if we tried to battle.<br /><br />-in certain occasions, trying to look at the summary of &#039;s 24 in a box crashes, but sometimes you can, usually after you changed the position of pokemons around.<br />-the glitchpokemon can corrupt daycare pokemon, if you&#039;re trying to receive them after battling &#039;s, the game freezes when you try to receive it, if theres a corrupted pokemon in the daycare and you add a second, this one also seems to be corrupted. this led me to believe that the daycare itself was corrupted, but at further investigation this seems to be not true, as trying to get an &#039;s without pokemon in the daycare makes the daycare act normal after battle. <br /><br />-&#039;s 24 is not able to be put in a contest, this will simply crash the game. He actually makes you unable to do contests at all, with any pokemon, even if he&#039;s no longer in your party. this might be because the partner mode later stated in this post<br />- DISCLAIMER: just figured out its not the fact that you have an &#039;s -- in your team that crashes you, he actually corrupts your abilty to fight when caught.<br /><br />-Trying to engage the battle with 1 pokemon in party automaticly gives you a DPbox, I also found&nbsp; a sidebug bcs of this. When DPbox uses strugle on <br />an onix in dig, he misses and no longer tries to engage into fighting. <br /><br />-My theorie is that the fight puts you into a &#039;partner&#039; mode, hence the DPbox, and why we crash trying to engage in any other battle than the doublebattle in daycare. But, you fight with your own pokemon if you don&#039;t have just the single pokemon, now that I have the poketch app I&#039;ll see or DPbox ends up in my party.<br /><br />-He seems to be stable when put in the daycare, the daycare poketch app shows him as a questionmark.<br />-When leveling up in daycare, his level seems inconsistent. Level 9 -by poketch app. level 8- showing up in party. level 10- showing up in box&#039;s.<br /><br />-stats stay level 1 after receiving from daycare, however putting him in a box, closing out, going back in and grabbing him makes his stats change to a higher number.<br /><br />-When bred with a dito, the egg seems to white out chat, and only shows up in box&#039;s and poketch apps, once it hatches it becomes a Dpbox.<br /><br />-When ditto uses transform, the game does not crash. You change bothe dito and &#039;s -- into &#039;nothing&#039; or something invisible, and change the sprites of the remaining pokemons into box&#039;s. dito&#039;s moves are extremely graphically bugged! One of the glitchmoves always says &#039;out of pp&#039; while the other one makes you mash A a ton of times trying to get through a blank message, and doesn&#039;t seem to change stats or do dmg.<br /><br />-The pokemon seems to have have a couple of glitchmoves, and a large variete of moves he can learn.<br /><br />-When taken from daycare, his health is 10+his level (10 is his base hp at 0), and stats are 4 5 5 5 5, after putting him in a box and retreiving him (you can actually change his level depening on which pokemon you switch him with, or actually their Experience group.) his stats and health will be stabilized, except his speed, this always seems to stay at 5<br /><br />https://gyazo.com/c1614eb9da126c4ce99018b2d53910f5<br />https://gyazo.com/5e1968dda3454d4dea02f695b56b859b<br />https://gyazo.com/9588a373956e36ee839637da0ad8145c<br />https://gyazo.com/0183233068287c142dfaad8916407ef4<br />https://gyazo.com/32a3a44113b925984953c610ba1ebd4f<br /><br />Also, I am unable to get them to work in battles, even the only battle I can enter (aka the daycare RETIRE battle) they seem to crash, but ditto is able to copy their moveset, and that looks a bit like.. this?<br /><br />https://gyazo.com/4925d26573b3b2d45dcfb4a452e404df<br />The glitchy sprites change from &#039;s to &#039;s, but they are always located in the same location.<br /> <br />This covers most of what we&#039;ve found, thanks to @caveat http://forums.glitchcity.info/index.php?action=profile;u=1851<br />for watching my stream about this pokemon, and helping figure out how this pokemon behaves!<br /><br />sadly it appears as if my obs didn&#039;t save the stream, so I&#039;ll have another stream tomorrow at 10:00 CEST<br />over at https://www.twitch.tv/trggravedigger<br />Hope you tune in, as I know little to nothing about coding, and I feel like this pokemon is changing its type and such arbitrarily.<br /> <br />Someone who watched this thread watched my second stream on this, he figured out that the level that The glitchpokemon has depends on the experience group of the pokemon, if you swap the &#039;s with a certain pokemon, it will change its level depending on what group it is in, and all the pokemon in that group will make him that level.<br /><br /><br />https://www.youtube.com/watch?v=0pSldSIY1YI&amp;feature=youtu.be <br /><br />Explanations and showing off the glitchpokemon, hopefully this sheds some light on everything!&nbsp; 8)<br />


subject: Re: Using the RETIRE glitch to enter the void?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7941.msg205124#msg205124 date=1494080756]<br />That&#039;s interesting. Was their collision still present ?<br />[/quote]<br /><br />Shadow, collision, untill you interact with them, then they appear. I also found a glitchpokemon, but I made a seperate post about that :)


subject: Re: Using the RETIRE glitch to enter the void?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7941.msg205126#msg205126 date=1494083779]<br />Well, their collision being still loaded is a shame. But it&#039;s a nice Tweaking Fun, I guess ^^<br />[/quote]<br /><br />In most areas you can just use RETIRED to activate a script that stops NPC&#039;s from walking, or turning around, this can be really handy to skip certain NPC&#039;s, as you can just RETIRE to make them stuck looking in a certain area, open your inventory and close it to make them turn the other direction and use RETIRE again to get them stuck, repeat at liking as many times as you want too, but its still not the same as them not having a collision though..


subject: Re: Something weird thing I remember doing in D/P (or maybe it was Platinum)
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=xtreme713ify link=topic=6885.msg194603#msg194603 date=1398032256]<br />I was walking through Eterna City and an NPC was blocking my way...eventually, me and her walked onto a tile at the same time, and I was on the same tile, essentially walking THROUGH HER! However, as soon I tried to move again, she was solid.<br /><br />Anyone care to explain?<br />[/quote]<br /><br />I can actually tell you something more about this, and how this sounds like a paradox to what I&#039;ve figured out. I mess around a lot with RETIRE and figured out quickly that you can get NPC&#039;s stuck in most areas looking in a certain direction, not moving anymore untill you open you inventory (like if you were using cut or something, all NPC&#039;s stop doing anything, only difference being that I can) basicly when NPC&#039;s walk from a tile onto another one their collision box is on bothe at the same time. I do however think that with proper timing I might be able to find the exact frame on which the collisionbox is about to appear and the NPC walks onto it, and if I manage to do this I&#039;ll update you on this


subject: Using RETIRE in the Great Marsch to get safari pokemon
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  Enter Great Marsch, Use retire, go to the right, go up, go left, use RETIRE above the door to the safari zone, enter door.<br />You will now be in the safari zone, but not in the safari mode. Meaning: you will have actual battles now (This is the only area in which you can fight wild pokemon/catch wild pokemon in RETIRE mode I found), pokemons won&#039;t flee (great for shiny hunting) you are not limited to safari balls, but can use anything you want (great for shiny hunting) and you can lower their hp, use status effects and so on like in normal battles. you also no longer have a timer for being in the safari zone.<br /><br />You will however be unable to leave battles you engaged, so keep that in mind!<br />https://www.youtube.com/watch?v=9AGH2W8okWI&amp;feature=youtu.be<br />Its not hard, but thought I&#039;d record it anyway just in case.


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205129#msg205129 date=1494091727]<br />Looks like Shadow Tyrant&#039;s Glitch Pokemon...<br />[/quote]<br /><br />I couldn&#039;t find the post about it, can you link it? :)


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=http://forums.glitchcity.info/index.php?topic=7784.0]This one![/url]<br /><br />Although, he mentions that its sprite disappeared after its entry animation...<br /><br />[url=http://forums.glitchcity.info/index.php?topic=7938.0]Here are its stats.


subject: Re: Using RETIRE in the Great Marsch to get safari pokemon
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Caveat link=topic=7943.msg205132#msg205132 date=1494092906]<br />When you&#039;re done with the Great Marsh, can you escape?<br />[/quote]<br />you can just walk through the door, and it won&#039;t even start the leaving the safari zone script.<br />I added in the video, so that should probaply answer most questions.


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205133#msg205133 date=1494092931]<br />[url=http://forums.glitchcity.info/index.php?topic=7784.0]This one![/url]<br /><br />Although, he mentions that its sprite disappeared after its entry animation...<br /><br />[url=http://forums.glitchcity.info/index.php?topic=7938.0]Here are its stats.<br />[/quote]<br /><br />doesn&#039;t seem like its that pokemon to me, as the &#039;onix&#039; only knows dig, and changes type depending on what pokemon is in the daycare.


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, then this is odd...<br /><br />Try killing the other Pokemon and using an Action Replay code to catch it?


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205136#msg205136 date=1494095931]<br />Well, then this is odd...<br /><br />Try killing the other Pokemon and using an Action Replay code to catch it?<br />[/quote]<br /><br />I would, if I had any idea how to do any of that, everything I do is all legit atm.


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This AR code should work, although I did pull it from the first result on Google...<br /><br />9223b5fa 00002101<br />1223b5fa 00002100<br />D2000000 00000000


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205138#msg205138 date=1494097106]<br />This AR code should work, although I did pull it from the first result on Google...<br /><br />9223b5fa 00002101<br />1223b5fa 00002100<br />D2000000 00000000<br />[/quote]<br /><br />Trying to catch m right now, once I threw a pokeball my sprites started messing up, and textboxes take a billion time to load<br /><br />edit: fk his catchrate seems low, I gave myself 999 masterballs and will try again.


subject: Re: Diamond/Pearl Glitchpokemon when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205138#msg205138 date=1494097106]<br />This AR code should work, although I did pull it from the first result on Google...<br /><br />9223b5fa 00002101<br />1223b5fa 00002100<br />D2000000 00000000<br />[/quote]<br /><br />Seems like depending on what pokemon are in the daycare, his number in the pokedex changed! I have one 32 &#039;s and one 28 &#039;s.


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  I wonder if this thing is like special Missingno variants, but it takes its data from the Daycare...<br /><br />WE&#039;RE DOING SCIENCEY STUFF HERE


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205141#msg205141 date=1494100239]<br />I wonder if this thing is like special Missingno variants, but it takes its data from the Daycare...<br /><br />WE&#039;RE DOING SCIENCEY STUFF HERE<br />[/quote]<br /><br />not only takes, it also corrupts it!<br />If you&#039;d like to follow, heres the stream: https://www.twitch.tv/trggravedigger


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  Currently tuning in right now...<br /><br />This thing is absolutely bizarre...<br /><br />By the way, you&#039;re not crazy, I saw its type change to Water/Ground...<br /><br />Finally, here&#039;s what we learned about this thing:<br />-Whilst fighting the thing, knocking it out will cause the other Trainer to send out their Pokemon in its spot.<br />-Changes typing based on seemingly arbitrary conditions. It seems to depend in part on the last Pokemon viewed. It&#039;s usually &quot;Normal&quot;/Flying. (The palette for the primary type is this really ugly yellow color)<br />-Apparently resists Water in battle? (Maybe it uses the type of Bulbasaur?)<br />-Changes Pokedex number also based on seemingly arbitrary conditions. From what I gather, it&#039;s partially based on what Pokemon are left in the Daycare.<br />-Its Pokedex number is always ?31 outside of the Pokedex entry.<br />-It seems to always have Dig, and two volatile glitch moves. <br />-The types of the glitch moves apparently depend on the moves of the last Pokemon viewed. (It also works with Contest conditions, as I saw it turn to &quot;Cool&quot; type once)<br />-The max PP of the glitch moves is always 0, but the current PP is volatile.<br />-Exactly one time it randomly changed its level to 0.<br />-In battle, it only uses Dig.<br />-In battle and on the summary screen, it&#039;s orange-brown, but in the PC it turns a dull red.<br />-Its sprite turns black if a Pokeball sprite is on the screen.<br />-In battle it&#039;s a square, in the PC it&#039;s a rectangle, and in the summary it changes from a square TO a rectangle.<br />-All the &quot;subspecies&quot; (based on combinations of Daycare Pokemon) we&#039;ve observed so far have caused a freeze if you try to enter a Trainer battle with them. Entering it in a Contest doesn&#039;t work either.<br /><br />We&#039;ve clearly got SOMETHING on our hands, so I think we should give it a name... Any ideas?<br />(I wonder what would happen if we tried to battle a legendary with this thing...)


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205143#msg205143 date=1494101863]<br />Currently tuning in right now...<br /><br />This thing is absolutely bizarre...<br /><br />By the way, you&#039;re not crazy, I saw its type change to Water/Ground...<br /><br />Finally, here&#039;s what we learned about this thing:<br />-Whilst fighting the thing, knocking it out will cause the other Trainer to send out their Pokemon in its spot.<br />-Changes typing based on seemingly arbitrary conditions. It seems to depend in part on the last Pokemon viewed. It&#039;s usually &quot;Normal&quot;/Flying. (The palette for the primary type is this really ugly yellow color)<br />-Apparently resists Water in battle? (Maybe it uses the type of Bulbasaur?)<br />-Changes Pokedex number also based on seemingly arbitrary conditions. From what I gather, it&#039;s partially based on what Pokemon are left in the Daycare.<br />-It seems to always have Dig, and two volatile glitch moves. <br />-The types of the glitch moves apparently also depend on the moves of the last Pokemon viewed. (It also works with Contest conditions, as I saw it turn to &quot;Cool&quot; type once)<br />-The max PP of the glitch moves is always 0, but the current PP is volatile.<br />-Exactly one time it randomly changed its level to 0.<br />-In battle, it only uses Dig.<br />-In battle and on the summary screen, it&#039;s orange-brown, but in the PC it turns a dull red.<br />-Its sprite turns black if a Pokeball sprite is on the screen.<br />-In battle it&#039;s a square, in the PC it&#039;s a rectangle, and in the summary it changes from a rectangle TO a square.<br />-All the &quot;subspecies&quot; (based on combinations of Daycare Pokemon) we&#039;ve observed so far have caused a freeze if you try to enter a Trainer battle with them. Entering it in a Contest doesn&#039;t work either.<br /><br />We&#039;ve clearly got SOMETHING on our hands, so I think we should give it a name... Any ideas?<br />(I wonder what would happen if we tried to battle a legendary with this thing...)<br />[/quote]<br /><br />first of all, I think calling them&nbsp; &nbsp;  &#039;s&nbsp; &nbsp; followed by their original showed up catchnumber is the best I can think off, I&#039;ve been refering to our &#039;stable&#039; glitchpokemon as &#039;s 24, whilst &#039;s 20, s&#039; 28, &#039;s 32 were all too gamebreaking. thing is, do we consider it changing its type or level or stats a change, or it being a completely different pokemon? or do we call it a &#039;hybrid between geodude and &#039;s 24&#039; for example? also, I&#039;d love to test it out on a legendary :) <br /><br />-ps the number showing up in a box is always 31, but I&#039;m referring to when you catch them and they get put into the pokedex, then they always get a random number


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Caveat
icon: xx
body:
  If a special Missingno changes its attributes, it&#039;s still the same Pokemon...<br />So I guess it depends on if the hex number stays the same.<br /><br />(I was thinking of naming it something based on DPBox, actually...)


subject: Re: Obtaining Shaymin and Darkrai with the Void Glitch in 10 minutes!
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Flandre Scarlet
icon: xx
body:
  Caught location doesn&#039;t matter since there is no normal way to catch Arceus only get it via event. The problem is it isn&#039;t a faithful encounter (I think) and more importantly it isn&#039;t in a Cherish Ball.


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205145#msg205145 date=1494108448]<br />If a special Missingno changes its attributes, it&#039;s still the same Pokemon...<br />So I guess it depends on if the hex number stays the same.<br /><br />(I was thinking of naming it something based on DPBox, actually...)<br />[/quote]<br /><br />yeah I guess its also a box.. but they don&#039;t share anything else?<br />Actually, DPbox is what hatches out of &#039;s their eggs, interestingly enough.


subject: Strugle bug?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So in my latest post I had a rant about the glitchpokemon we got in the daycare, it corrupted my party into me having a DPbox, which used strugle in a fight, but the enemie onix was in &#039;dig&#039; and the strugle missed, for the entire battle DPbox stayed alive, didn&#039;t do a single attack after his strugle.


subject: Re: Strugle bug?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Interesting...<br />Maybe we should research if it only works with DPBox or if it occurs with any Pokemon...<br /><br />Struggle has only 1 PP if you hack it onto a Pokemon, but I don&#039;t know if it only knows that move or if it straightup has no moves.


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Wow, amazing find Gravedigger!<br /><br />So could the glitch moves from these glitch PokÃ©mon be an access point for arbitrary code execution or any other nice effects? (Like in [url=https://www.youtube.com/watch?v=2szcZxxCROk]TheZZAZZGlitch&#039;s video[/url]) With void glitch already we don&#039;t need it for Hall of Fame, Darkrai/Shaymin/Arceus but I wonder if there&#039;s a small chance we could use it to run special other scripts at our will or say get Generation IV hybrids?<br /><br />


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Sorry that I couldn&#039;t watch the stream! It was uploaded at 4 AM my time...<br /><br />I&#039;m interested in how you managed to execute arbitrary code...<br /><br />I wonder if a local multiplayer battle would &quot;fix&quot; the battle system?


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well this is extremely interesting, I&#039;ve never seen a battle triggered from using RETIRE that isn&#039;t Arceus, good job with that, hopefully it&#039;s not flag or RAM based.


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7942.msg205153#msg205153 date=1494159281]<br />Wow, amazing find Gravedigger!<br /><br />So could the glitch moves from these glitch PokÃ©mon be an access point for arbitrary code execution or any other nice effects? (Like in [url=https://www.youtube.com/watch?v=2szcZxxCROk]TheZZAZZGlitch&#039;s video[/url]) With void glitch already we don&#039;t need it for Hall of Fame, Darkrai/Shaymin/Arceus but I wonder if there&#039;s a small chance we could use it to run special other scripts at our will or say get Generation IV hybrids?<br />[/quote]<br /><br />Well, so far I&#039;ve only been able to permanently change its stats and moves, but If I find something I&#039;ll add a post!


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205154#msg205154 date=1494161034]<br />Sorry that I couldn&#039;t watch the stream! It was uploaded at 4 AM my time...<br /><br />I&#039;m interested in how you managed to execute arbitrary code...<br /><br />I wonder if a local multiplayer battle would &quot;fix&quot; the battle system?<br />[/quote]<br /><br />I think it has to do with what order pokemon are in your party, and then going to the pokecenter to heal? at least that seemed to change the moves, I tested it multiple times and it seems like the moves aren&#039;t always in the same order when recreating, making me believe that it is arbitrarily changing.


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s incredible how all of this came from &quot;hey, let&#039;s use the RETIRE option in random buildings and see what happens&quot;.<br /><br />Is there a debugger tool for DS?


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7942.msg205158#msg205158 date=1494167259]<br />It&#039;s incredible how all of this came from &quot;hey, let&#039;s use the RETIRE option in random buildings and see what happens&quot;.<br /><br />Is there a debugger tool for DS?<br />[/quote]<br /><br />actually it was: lets use RETIRE in every single building/area I can find untill shit happens :)


subject: Re: Diamond/Pearl Glitchpokemon &quot; 's &quot;when using RETIRED in Daycare?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Aera link=topic=7942.msg205155#msg205155 date=1494161363]<br />Well this is extremely interesting, I&#039;ve never seen a battle triggered from using RETIRE that isn&#039;t Arceus, good job with that, hopefully it&#039;s not flag or RAM based.<br />[/quote]<br /><br />Actually on stream today we entered a couple of battles in the void, 2 against team galactic members, one of which was Saturn, and then the guy at celestic town, and then a battle in the coffee house :)<br /><br />https://www.youtube.com/watch?v=xkGpPT0d-tg&amp;feature=youtu.be<br /><br />edit: LOL we just fought Volkner (8th gym leader) with only the first two badges, I&#039;ll make a highlight of it later.


subject: Using RETIRE to heal yourself and break all graphics.
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  https://www.youtube.com/watch?v=EBmV_q-nQrA&amp;feature=youtu.be<br /><br />Baiscly using RETIRE around Heatran&#039;s area seemed to heal me, but seriously mess up all graphics.<br />no worries, opening anything will refresh the graphics and fix it :)


subject: Re: Using RETIRE to heal yourself and break all graphics.
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The main post about the RETIRE glitch says that nothing happens if there is no 4th script programmed in the map, but this suggests the contrary...<br /><br />You&#039;ve effectively discovered a major glitch here from just failing to tweak to Arceus properly, and that&#039;s great.


subject: Re: Using RETIRE to heal yourself and break all graphics.
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Caveat link=topic=7947.msg205163#msg205163 date=1494187433]<br />The main post about the RETIRE glitch says that nothing happens if there is no 4th script programmed in the map, but this suggests the contrary...<br /><br />You&#039;ve effectively discovered a major glitch here from just failing to tweak to Arceus properly, and that&#039;s great.<br />[/quote]<br /><br />I actually didn&#039;t even have a National pokedex in this video, skipped it by entering the ribon house in the void which made me get put outside in the resort area, luckely you seem to spawn in resort area with a bike? (no Idea why, first time I got a bike in RETIRE mode), which might make me able to tweak into the void again around there and get to the Heatran area with the bike still on me? :) Also this Is the third way to get RETIRE outside the void, the other being my SunyShore Hall of fame with RETIRE and the literaly just &#039;kys&#039; method.<br /><br />Also, I think this is the script after the vulcano errupts, maybe a beta version of it? or maybe it bugs out bcs I haven&#039;t entered the mountain with the cutscene but I have used the script?


subject: Re: Strugle bug?
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7944.msg205152#msg205152 date=1494158784]<br />Interesting...<br />Maybe we should research if it only works with DPBox or if it occurs with any Pokemon...<br /><br />Struggle has only 1 PP if you hack it onto a Pokemon, but I don&#039;t know if it only knows that move or if it straightup has no moves.<br />[/quote]<br /><br />well the game says &#039;dldldlddldld... glitchsprites... is out of usable moves&#039;, so I think further research might be usefull


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: shatteredClockworks
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ACE91 link=topic=36.msg961#msg961 date=1144248233]<br />Yep, Yellow MissingNo. does exist. It usually freezes the game, though. The picture on GCL&#039;s &quot;Under Construction&quot; page is an example of this. Sometimes, however, the freezing doesn&#039;t occur and you can catch it, but I have yet to actually capture it because I used my Master Ball on Yellow before I found out about Yellow MissingNo., so I can&#039;t multiply my Master Ball... :(<br />Oh, here&#039;s the picture: [img]http://glitchcity.ath.cx/images/mn-appears.png[/img]<br />[/quote] I remember a fair amount of time ago I was playing Pokemon red [VC] (Yes this still is a thing in the port) with a newly caught Missingno (Glitch missingno, not fossil or ghost) and I decided to battle an (old) friend of mine. He sends out a Dratini and I send out my Missingno., and when it appeared on the screen for him, it looked exactly like yellow missingno.. And of course, I crashed the shit out of his game.<br /><br />good times.


subject: catching shayming in less than a minute with RETIRE. (Not been able to recreate)
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  I don&#039;t even know. figure it out from this video.<br /><br />https://www.youtube.com/watch?v=zh71OyPoVzE<br />I changed the link to a more indepth one, bcs the last one was really hard to understand bcs I didn&#039;t explain what direction I went in.<br /><br />Heres my savestate: http://www.mediafire.com/file/3e24quq4ntew3sv/Seabreak.dst<br /><br />Aera tried doing this, but didn&#039;t get route 227 script to do anything, not even the healing script. So for now we&#039;ll take this as some kind a RAM based glitch? <br />


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=shatteredClockworks link=topic=36.msg205166#msg205166 date=1494245994]<br />[quote author=ACE91 link=topic=36.msg961#msg961 date=1144248233]<br />Yep, Yellow MissingNo. does exist. It usually freezes the game, though. The picture on GCL&#039;s &quot;Under Construction&quot; page is an example of this. Sometimes, however, the freezing doesn&#039;t occur and you can catch it, but I have yet to actually capture it because I used my Master Ball on Yellow before I found out about Yellow MissingNo., so I can&#039;t multiply my Master Ball... :(<br />Oh, here&#039;s the picture: [img]http://glitchcity.ath.cx/images/mn-appears.png[/img]<br />[/quote] I remember a fair amount of time ago I was playing Pokemon red [VC] (Yes this still is a thing in the port) with a newly caught Missingno (Glitch missingno, not fossil or ghost) and I decided to battle an (old) friend of mine. He sends out a Dratini and I send out my Missingno., and when it appeared on the screen for him, it looked exactly like yellow missingno.. And of course, I crashed the s**t out of his game.<br /><br />good times.<br />[/quote]<br /><br />When you battle with Red/Blue against Yellow, the glitch PokÃ©mon that appear are the equivalent glitch PokÃ©mon. All regular Red/Blue MissingNo. are regular Yellow MissingNo. in Yellow as both share the same IDs, so this is not surprising.<br /><br />Interesting thing to do though now that you mention it, as Red/Blue MissingNo. is a lot easier to obtain than Yellow MissingNo. and [url=https://youtu.be/DDkema91-vo?t=188]if Yellow MissingNo. doesn&#039;t freeze[/url] (e.g. possibly if it&#039;s the first time Yellow has ever seen a glitch PokÃ©mon and the data was erased with Up+Select+B) I wonder what could happen.<br /><br />Edit: I tried it and unfortunately nothing too unusual happened other than a misaligned player sprite, which is an expected behaviour.


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Gravedigger link=topic=7948.msg205167#msg205167 date=1494250590]<br />I don&#039;t even know. figure it out from this video.<br /><br />https://www.youtube.com/watch?v=KX9VQEBL7h8&amp;feature=youtu.be<br /><br />Heres my savestate: http://www.mediafire.com/file/3e24quq4ntew3sv/Seabreak.dst<br />[/quote]<br /><br />Very nice. It says the video is unavailable though for some reason. :(


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gravedigger
icon: xx
body:
  [quote author=Torchickens link=topic=7948.msg205169#msg205169 date=1494252758]<br />[quote author=Gravedigger link=topic=7948.msg205167#msg205167 date=1494250590]<br />I don&#039;t even know. figure it out from this video.<br /><br />https://www.youtube.com/watch?v=KX9VQEBL7h8&amp;feature=youtu.be<br /><br />Heres my savestate: http://www.mediafire.com/file/3e24quq4ntew3sv/Seabreak.dst<br />[/quote]<br /><br />Very nice. It says the video is unavailable though for some reason. :(<br />[/quote]<br /><br />Seems to be an error with uploading, I can&#039;t put it on &#039;public&#039; I&#039;m gonna reupload it and I&#039;ll edit the link<br />edit: mind trying again? should work now.


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  It works, cool! :) Thanks Gravedigger. Really nice glitch, it&#039;s interesting how you can corrupt the graphics like that.


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7948.msg205171#msg205171 date=1494254847]<br />It works, cool! :) Thanks Gravedigger. Really nice glitch, it&#039;s interesting how you can corrupt the graphics like that.<br />[/quote]<br /><br />I wonder what happened after that, did I go into some kinda voidstate so I could walk over to seabreak path? I wonder what causes that


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well this is a COMPLETE game changer, well done for finding this, it may now be possible to disable RETIRE from the overworld as you could walk to Pal Park


subject: Yellow MissingNo.'s faces
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: clip
body:
  Yellow MissingNo. has two faces (see attachments). I wonder if there are any other glitch PokÃ©mon which by chance, have faces like this.


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aera link=topic=7948.msg205173#msg205173 date=1494255894]<br />Well this is a COMPLETE game changer, well done for finding this, it may now be possible to disable RETIRE from the overworld as you could walk to Pal Park<br />[/quote]<br /><br />I always could, I&#039;ve found countless ways to get into the void with RETIRE


subject: Other ways of getting into the void using RETIRE
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As it seems like the chaymin one is really unreliable, use this one for defenite results if you&#039;re stuck in RETIRE mode instead:<br /><br />https://www.youtube.com/watch?v=6bEyZ57todE&amp;feature=youtu.be<br /><br />These are guaranteed ways of entering the void using RETIRE, which I&#039;ve never had any issues with before


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  RETIRE too OP, please nerf.<br /><br />I&#039;m sure there&#039;s some area that executes arbitrary code... Somewhere...


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Aera
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I always could, I&#039;ve found countless ways to get into the void with RETIRE<br />[/quote]<br /><br />While that is possible, not a single entrypoint in the void can provide access to Pal Park without the use of saving and resetting.


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aera link=topic=7948.msg205179#msg205179 date=1494274010]<br />I always could, I&#039;ve found countless ways to get into the void with RETIRE<br />[/quote]<br /><br />While that is possible, not a single entrypoint in the void can provide access to Pal Park without the use of saving and resetting.<br />[/quote]<br /><br />and you can&#039;t do that in RETIRE mode, alright understood :c&nbsp; and the hall of fame script automaticly puts you into your room after saving, so that aint an option either, the contest script you can&#039;t acces with RETIRE and neither can you do this with the pokemarkt save-option, which you probaply can&#039;t acces either in the void.. 


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So, while dicking around with a WTW code on the overworld, I stumbled upon a visible, working copy of the Flower Paradise after S&amp;Ring in the Ironworks, complete with a broken, misplaced Shaymin actor. I&#039;m trying to re-find it, but I wasn&#039;t tracking what I was doing, so it may take me a while.


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  When RTS is enabled for Platinum on my R4, when the game normally crashes, the RTS wrapper is called and I can save/load my states or return to the R4 firmware just fine.<br />...could we use this to load homebrew?


subject: Re: catching shayming in less than a minute with RETIRE.
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=7948.msg205181#msg205181 date=1494290431]<br />So, while dicking around with a WTW code on the overworld, I stumbled upon a visible, working copy of the Flower Paradise after S&amp;Ring in the Ironworks, complete with a broken, misplaced Shaymin actor. I&#039;m trying to re-find it, but I wasn&#039;t tracking what I was doing, so it may take me a while.<br />[/quote]<br /><br />Well theres a working flower paradise going to the right of route 228, about 190 steps but without walk through walls lr being able to recreate this glitch we can&#039;t acces it, tweaking around battle zone might be possible but Idk tbh


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In your Torterra example, do the Pokemon&#039;s moves actually change or is it just cosmetic?<br /><br />If they do, maybe one of the glitch moves can be utilized for ACE...<br /><br />Even if not, maybe you could utilize the glitch to corrupt the Pokemon&#039;s moves?


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=7857.msg205184#msg205184 date=1494326984]<br />In your Torterra example, do the Pokemon&#039;s moves actually change or is it just cosmetic?<br /><br />If they do, maybe one of the glitch moves can be utilized for ACE...<br /><br />Even if not, maybe you could utilize the glitch to corrupt the Pokemon&#039;s moves?<br />[/quote]<br /><br />This actually also happens with stable eggs of &#039;s, same stats changes and text at the upper part, just something I noticed. I don&#039;t think that the moves actually change though in battle, but I can&#039;t test that bcs I can&#039;t fight anymore now.


