# smf_messages

subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Ephraim225 link=topic=7490.msg200340#msg200340 date=1463040328]<br />Have you shown Brock Through Walls yet? If that&#039;s not an option you could show Item Underflow and hope the RAM gives you one of the drinks, it&#039;s how I got the Surfboard :D<br />[/quote]<br /><br />I couldn&#039;t ):<br />It is fixed in the Italian version (and also in the spanish I believe), you can&#039;t open the start menu after the youngster stops you. <br />I thought the same, but I want to use glitches that doesn&#039;t involve random result since I hope that the viewers able to reproduce the same glitches. That&#039;s also the reason why I don&#039;t want to corrupt the game too much, and also I have to pay attention to the emulation itself, since I read that some VBA version doesn&#039;t emulate VRAM reading correctly.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TwilightHakuryuu link=topic=7490.msg200334#msg200334 date=1463005346]<br />I wonder if the cuttable trees are also missable objects? But you wouldn&#039;t be able to trainer-fly from route 9 without being able to get on route 9 in the first place.<br />[/quote]<br /><br />Cuttable trees are tiles changing, as shown by [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]the previous investigation on GC-based RAM maps[/url]. I am not sure if there is also a missable object for them, although the collision must be dealt somehow.<br /><br />And yes indeed, the Pewter glitches (skipping brock, museum guy WTW, hooked dragonite etc.) are fixed in every european release, it&#039;s the same with the french game. 


subject: Re: How would I change my username?
poster_name: Yuzihax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=7492.msg200337#msg200337 date=1463014909]<br />[size=1pt]Did I just say &#039;Edit&#039; in my post oh god I&#039;m becoming Yuzihax.[/size]<br />[/quote]<br />[size=1pt]fite me[/size]<br />[size=1pt]edit: m8[/size]<br /><br />Also went ahead and changed it, since I&#039;m in the neighborhood anyway.


subject: Re: Hey guys!
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Aww shit the oldbie of oldbies. I think that&#039;d make me #3 oldbie now. Or something.<br /><br />Most of the people you would remember are.... well, it&#039;s basically Abwayax and myself. But good to see you return, would be down to catch up with you on IRC or similar.


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Popplio is the new Oshawott. Ugly abomination that needs to be euthanized.<br /><br />But fire cat looks pretty lit[size=1pt]ten[/size] AF. Also owl thing is cute and would probably make a pretty swoot HM slave, but it&#039;s grass type and therefore sucks.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  I&#039;m back with a few more questions that came during work on other Gen 3 versions.<br /><br /><br />1) Pomeg Glitch data corruption can&#039;t be performed on RS (and even if it could it wouldn&#039;t be useful).<br />Thus, PC Item quantities can&#039;t be manipulated.<br />1.a) Is it possible to make the console read code from only one word every double-word ?<br /> Would there be a method (mainly having a certain quantity for every Code Item) to create code from PC Items in RS ?<br /><br />Due to the absence of encryption of many values, Bag Items (stored right after PC Items) can also be used to execute code.<br />This would give up to 50+42 = 92 Items that could be used for ACE in RS.<br /><br /><br />1.b)&nbsp; Else, the only way to store code in RS that I see is with PokÃ©mon data (8 bytes per 8 bytes).<br />What would the 8 bytes of code look like ? (If it doesn&#039;t bother too much to work on that)<br /><br />From what I understood, the last 2 bytes would be used to make a jump of 0x50 bytes (towards the data of the next PC PokÃ©mon).<br />The method I have to obtain the bootstrap PokÃ©mon with Horsea ended up working quite well, and I would like to use it as much as possible. (thanks to HP,Atk,SpAtk,SpDef EVs + Held Item, many combinations for the 6 first bytes can be obtained)<br />The main downside of it is that the last 2 bytes must be obtained with Exp(2 higher bytes)/Contest stats (Coolness, Beauty), and Contest Stats really can&#039;t take that many values with PokÃ©blocks.<br />This is why I would like to know the values of these last 2 bytes in order to know if Horsea can be used or not for that task.<br /><br /><br />2) I tried your setup to execute overworld scripts, but things didn&#039;t work well.<br />Instead of having credits executed / an item obtained / nothing, I got a message box full of OE (RAM was overwritten by 0x101C).<br /><br />For that, I used Glitch Move 0x1608 (pointer at 0x02030400), with a jump towards 0x02025E98 (03 99 5E 02 02 FF FF 08), then copied your code to use overworld scripts at 0x02025E98.<br />I tried it with 25 01 13 02 (special 0x113, end)), a paste of the script to get an item, 02 (end), and it always ended up with a message box and RAM being overwritten. <br /><br />Here is a save ready to perform ACE : http://www.petit-fichier.fr/2016/05/12/emer-test-ace-issue/<br />(Use an Anti-DMA code to have everything at the right adresses)<br /><br /><br />[quote author=drc link=topic=6868.msg200329#msg200329 date=1462996597]<br />[quote author=Spectramark link=topic=6868.msg200316#msg200316 date=1462921791]<br />Just letting you guys know, but do NOT give glitch pokemon 0x0A0D (the one that makes the music glitch) the heart marking. For some reason, it produces an EXTREMELY loud, continuous noise, louder than anything I&#039;ve heard come out of a GBA. The noise stops when you either remove the marking or hover over a pokemon which doesn&#039;t have a heart marking.<br />[/quote]<br /><br />Did it sound like this?<br />If not, try to record it.<br />[/quote]<br /><br />Here is a recording of the effect : https://www.youtube.com/watch?v=M7ckrA2vxEA<br />It really differs from the other sound oddities I heard with 0x0A0D or by toying with the part of 0x0A0D&#039;s name that alters the music.


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7441.msg200346#msg200346 date=1463085135]but it&#039;s grass type and therefore sucks.<br />[/quote]<br /><br />you fucking what mate


subject: MissigNo in EU version
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello everybody. <br />A moment ago I was recording my glitched adventure in PokÃ©mon Red.<br />I decided to remove the Snorlax while getting 128 X Special by doing the &quot;Mew Glitch&quot; after beating the fisher with the tentacool and goldeen, in order to encounter MissingNo, but the game crashed when the battle started. I used the gambler in Route 8 to trigger the glitch. After that I just thought it was because that missingno was just the kind that crashes the game, so I tried to exchange Nidoran(M) with Nidoran(F) in the tunnel entrance at Cerulean City, but that gave me the same result.<br /><br />Can anyone point me a MissingNo that doesn&#039;t crash the game?


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: shaggs
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7441.msg200346#msg200346 date=1463085135]<br />Popplio is the new Oshawott. Ugly abomination that needs to be euthanized.<br /><br />But fire cat looks pretty lit[size=1pt]ten[/size] AF. Also owl thing is cute and would probably make a pretty swoot HM slave, but it&#039;s grass type and therefore sucks.<br />[/quote]<br />I&#039;ll destroy you


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheZZAZZGlitch
icon: xx
body:
  [quote]1.a) Is it possible to make the console read code from only one word every double-word ?<br /> Would there be a method (mainly having a certain quantity for every Code Item) to create code from PC Items in RS ?[/quote]<br /><br />Kind of. It&#039;s possible to write code with only x1 item quantities, because the opcode &#039;0001&#039; corresponds to a completely valid instruction &#039;lsl r0, r0, #0x4&#039;, which would have no effect if r0 is never used.<br />The problem would be storing data. The easy way of storing pointers/addresses in PC items would be gone. Loading any 32-bit constant would take 8 items (8 instructions - 4 8-bit loads and 4 shifts). The item count (and the amount of work to prepare the necessary items) would increase dramatically.<br /><br />We should probably get consistent ACE on Emerald before trying R/S.<br /><br />[quote]1.b)&nbsp; Else, the only way to store code in RS that I see is with PokÃ©mon data (8 bytes per 8 bytes).<br />What would the 8 bytes of code look like ? (If it doesn&#039;t bother too much to work on that)[/quote]<br /><br />The bytes would obviously vary depending on what we want to do. But the last two bytes would always be:<br /><br />[tt]E0 26[/tt].<br /><br />The instruction is &quot;b $+0x50&quot;. It just jumps 0x50 bytes forward.<br />If this sequence of bytes happened to be hard to obtain, some other instructions would work as well: D3 26 (bcc $+0x50 - jumps on unset carry flag), D9 26 (bls $+0x50 - jumps on unset carry flag or set zero flag), D7 26 (bvc $+0x50 - jump on no overflow).<br /><br />[quote]2) I tried your setup to execute overworld scripts, but things didn&#039;t work well.<br />Instead of having credits executed / an item obtained / nothing, I got a message box full of OE (RAM was overwritten by 0x101C).<br /><br />For that, I used Glitch Move 0x1608 (pointer at 0x02030400), with a jump towards 0x02025E98 (03 99 5E 02 02 FF FF 08), then copied your code to use overworld scripts at 0x02025E98.<br />I tried it with 25 01 13 02 (special 0x113, end)), a paste of the script to get an item, 02 (end), and it always ended up with a message box and RAM being overwritten. [/quote]<br /><br />The code probably attempted to execute a garbage script. The script pointer in my example was hardcoded to 0x0E0F14E8 - did you remember to change that?<br />The underlined part should be changed to where the script is stored (it could be in ROM, in RAM, or in the save data):<br /><br />[tt]78 46 09 30 86 46 03 49 01 48 08 47 F0 BD XX XX [u]E8 14 0F 0E[/u] F9 8E 09 08 25 13 01 02[/tt]<br /><br />Also, in order to work, the code has to be 4-byte aligned (it must start at an address ending with either 0, 4, 8 or C).


subject: Re: MissigNo in EU version
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7493.msg200351#msg200351 date=1463091880]<br />Hexes B5, B6, and B7 don&#039;t crash the games. These correspond to 181, 182, and 183<br />[/quote]<br /><br />If you&#039;re talking about the Ghost/Skeleton forms that&#039;s actually hexes B6, B7, and B8 (182~184) unless B5 also does not crash which in theory it should.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, if someone ever finds a way to get past the sixth slot in battle in R/S, the memory corruption does occur there too, but for me it froze after only 26 pushes of the Up button (from Cancel). Probably something to do with having 0 PokÃ©mon.


subject: Re: Hey guys!
poster_name: Surfingpichu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Surfingpichu
icon: xx
body:
  [quote author=Zowayix link=topic=7491.msg200345#msg200345 date=1463081393]<br />Aww s**t the oldbie of oldbies. I think that&#039;d make me #3 oldbie now. Or something.<br /><br />Most of the people you would remember are.... well, it&#039;s basically Abwayax and myself. But good to see you return, would be down to catch up with you on IRC or similar.<br />[/quote]<br /><br /> Heck yeah! You don&#039;t get a whole lot more classic GCL than well.. the old proboards GCL. I&#039;d love to catch up with you guys!<br /><br />Yea, I poked around the site a bit, but the only members I really remember are you and Abwayax. <br /><br />Edit: Also, Zowayix, you have an A+ Waifu.<br /><br />Also<br /><br />[quote author=Abwayax link=topic=7491.msg200327#msg200327 date=1462987964]<br />Hello! Welcome back! Long time no see!<br />[/quote]<br /><br />Hey Abwayax!! It really has been forever. It&#039;s funny, I really didn&#039;t know if this site was still around/active or not until I started watching pokemon speedruns, which... always leads to a slippery slope cascading into just random Pokemon game exploits, and a few of the videos linked back to this site! What a callback!<br /><br />Anyway, I&#039;ll be poking around here from time to time. Missed you guys. I&#039;m glad to see you&#039;re still around, breaking pokemon games. =]


subject: Re: MissigNo in EU version
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Every MissingNo. outside ghost/skeleton MissingNo. (so yes it&#039;s B6 to B8) crashes the game in European R/B, but not in Yellow, [b]if they are encountered using Ditto Trick or Old Man Trick[/b].<br /><br />This means you can get any MissingNo., including pixel forms, using some of the many other PokÃ©mon-getting glitches, the easier solution being the Cooltrainer Trick (that doesn&#039;t crash the game because you change the PokÃ©mon you encounter for a MissingNo., but that doesn&#039;t load its sprite which causes the crash) and more tricky solutions are Fossil Conversion Glitch and Doko-Kashira Door Glitch (because you never encounter the PokÃ©mon), LOL Glitch (for the same reasons as the cooltrainer), and of course arbitrary code execution (either using 8F or POS).<br /><br />Note three things:<br />- There is an actual way to fix the sound bank issue causing the crash. Torchickens worked on it, but I can&#039;t find back the picture he made about this.<br />- If you want a MissingNo. to perform code execution, you actually don&#039;t need it. There is another way to get a x255 item involving GC-RAM Manipulation which is described [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]here[/url] and doesn&#039;t require anything special.<br />- TheZZAZZGlitch developed [url=https://www.youtube.com/watch?v=eLuUWUeUTg4]a procedure[/url], using the aforementioned GC-RAM thing, to stabilize English yellow&#039;s MissingNo. There is certainly a way to do the same for european R/B, and PRAMA&#039;s team planned to work on it on French games. Any result would work on Italian games too.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  [quote author=Krys3000 link=topic=7490.msg200342#msg200342 date=1463050809]<br />[quote author=TwilightHakuryuu link=topic=7490.msg200334#msg200334 date=1463005346]<br />I wonder if the cuttable trees are also missable objects? But you wouldn&#039;t be able to trainer-fly from route 9 without being able to get on route 9 in the first place.<br />[/quote]<br /><br />Cuttable trees are tiles changing, as shown by [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]the previous investigation on GC-based RAM maps[/url]. I am not sure if there is also a missable object for them, although the collision must be dealt somehow.<br />[/quote]<br />I don&#039;t exactly know how the game does this, but anyways.<br /><br />When you try tou cut a tree, it checks whether you are facing a tree / grass tile, and if yes, it looks up in a table to replace the tree / grass tile with a normal earth tile while preserving three of its neighboring tiles (the game, for compression purposes, stores tiles in squares of 2x2 tiles). That&#039;s what we use for Glitch City RAM Manipulation.<br /><br />Every time you enter a new map, the game actually copies the whole map from ROM to RAM, and applies modifications such as cutting trees, discovering the Casino&#039;s stairs, etc (nb : the reloading of these maps don&#039;t involve reloading the graphics, causing the [url=http://glitchcity.info/wiki/index.php/Invisible_tree_glitch]Invisible Tree Glitch[/url]. [b]These modifications don&#039;t involve any sprites at all.[/b]<br /><br />tl;dr : nope, trees aren&#039;t missable objects. They are part of the map.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7490.msg200358#msg200358 date=1463130384]<br />[quote author=Krys3000 link=topic=7490.msg200342#msg200342 date=1463050809]<br />[quote author=TwilightHakuryuu link=topic=7490.msg200334#msg200334 date=1463005346]<br />I wonder if the cuttable trees are also missable objects? But you wouldn&#039;t be able to trainer-fly from route 9 without being able to get on route 9 in the first place.<br />[/quote]<br /><br />Cuttable trees are tiles changing, as shown by [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]the previous investigation on GC-based RAM maps[/url]. I am not sure if there is also a missable object for them, although the collision must be dealt somehow.<br />[/quote]<br />I don&#039;t exactly know how the game does this, but anyways.<br /><br />When you try tou cut a tree, it checks whether you are facing a tree / grass tile, and if yes, it looks up in a table to replace the tree / grass tile with a normal earth tile while preserving three of its neighboring tiles (the game, for compression purposes, stores tiles in squares of 2x2 tiles). That&#039;s what we use for Glitch City RAM Manipulation.<br /><br />Every time you enter a new map, the game actually copies the whole map from ROM to RAM, and applies modifications such as cutting trees, discovering the Casino&#039;s stairs, etc (nb : the reloading of these maps don&#039;t involve reloading the graphics, causing the [url=http://glitchcity.info/wiki/index.php/Invisible_tree_glitch]Invisible Tree Glitch[/url). [b]These modifications don&#039;t involve any sprites at all.[/b]<br /><br />tl;dr : nope, trees aren&#039;t missable objects. They are part of the map.<br />[/quote]<br />I thought that the trees were actually sprites like in gen3 O_O


subject: Re: MissigNo in EU version
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dante
icon: xx
body:
  [quote author=Krys3000 link=topic=7493.msg200357#msg200357 date=1463128246]<br />Every MissingNo. outside ghost/skeleton MissingNo. (so yes it&#039;s B6 to B8) crashes the game in European R/B, but not in Yellow, [b]if they are encountered using Ditto Trick or Old Man Trick[/b].<br /><br />This means you can get any MissingNo., including pixel forms, using some of the many other PokÃ©mon-getting glitches, the easier solution being the Cooltrainer Trick (that doesn&#039;t crash the game because you change the PokÃ©mon you encounter for a MissingNo., but that doesn&#039;t load its sprite which causes the crash) and more tricky solutions are Fossil Conversion Glitch and Doko-Kashira Door Glitch (because you never encounter the PokÃ©mon), LOL Glitch (for the same reasons as the cooltrainer), and of course arbitrary code execution (either using 8F or POS).<br /><br />Note three things:<br />- There is an actual way to fix the sound bank issue causing the crash. Torchickens worked on it, but I can&#039;t find back the picture he made about this.<br />- If you want a MissingNo. to perform code execution, you actually don&#039;t need it. There is another way to get a x255 item involving GC-RAM Manipulation which is described [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]here[/url] and doesn&#039;t require anything special.<br />- TheZZAZZGlitch developed [url=https://www.youtube.com/watch?v=eLuUWUeUTg4]a procedure[/url], using the aforementioned GC-RAM thing, to stabilize English yellow&#039;s MissingNo. There is certainly a way to do the same for european R/B, and PRAMA&#039;s team planned to work on it on French games. Any result would work on Italian games too.<br />[/quote]<br /><br />Thank you very much for the information. I will look into PARMA team&#039;s work :3 <br />I saw ZAAZZGlitch&#039;s video about stabilized MissingNo, and he said that after some tries I can get it anyway, is that the case also for European R/B?


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  [quote author=Wack0 link=topic=6868.msg200355#msg200355 date=1463098411]<br />Well, if someone ever finds a way to get past the sixth slot in battle in R/S, the memory corruption does occur there too, but for me it froze after only 26 pushes of the Up button (from Cancel). Probably something to do with having 0 PokÃ©mon.<br />[/quote]<br /><br />You can perform ACE in RS by altering the values that manage the hostess script at Trainer Tower.<br />- Enter Trainer Tower with Party PokÃ©mon 4,5,6.<br />- Empty party slots 4,5,6.<br />- Alter the hostess script with ACE (put 0x02 at&nbsp; 0x020253FB)<br />- Enter Trainer Tower again.<br />The hostess will take you right back to matches with PokÃ©mon from the party slots chosen on the previous attempt (4,5,6, who are empty).<br />You end up with a fully empty party, the Party PokÃ©mon counter counts 0 PokÃ©mon, this makes the Party PokÃ©mon Selection pointer underflow, and you can scroll past 6th party slot.<br /><br />But as Wack0 said, the game freezes after a few dozen of Up pushes, so you can&#039;t go far at all.<br />Furthermore, Party PokÃ©mon are stored near 0x03004372 in RS, and I don&#039;t know any other interesting value that would be stored in 0x0300xxxx, so you can&#039;t even corrupt something interesting.<br />Even if there were interesting values to poentially corrupt, there would be a pretty high chance that they couldn&#039;t be corrupted because of the lack of DMA in RS.<br /><br /><br />[quote author=TheZZAZZGlitch link=topic=6868.msg200353#msg200353 date=1463093886]<br />[quote]2) I tried your setup to execute overworld scripts, but things didn&#039;t work well.<br />Instead of having credits executed / an item obtained / nothing, I got a message box full of OE (RAM was overwritten by 0x101C).<br /><br />For that, I used Glitch Move 0x1608 (pointer at 0x02030400), with a jump towards 0x02025E98 (03 99 5E 02 02 FF FF 08), then copied your code to use overworld scripts at 0x02025E98.<br />I tried it with 25 01 13 02 (special 0x113, end)), a paste of the script to get an item, 02 (end), and it always ended up with a message box and RAM being overwritten. [/quote]<br /><br />The code probably attempted to execute a garbage script. The script pointer in my example was hardcoded to 0x0E0F14E8 - did you remember to change that?<br />The underlined part should be changed to where the script is stored (it could be in ROM, in RAM, or in the save data):<br /><br />[tt]78 46 09 30 86 46 03 49 01 48 08 47 F0 BD XX XX [u]E8 14 0F 0E[/u] F9 8E 09 08 25 13 01 02[/tt]<br /><br />Also, in order to work, the code has to be 4-byte aligned (it must start at an address ending with either 0, 4, 8 or C).<br />[/quote]<br /><br />Oh, ok, I didn&#039;t understand that part of your instructions this way.<br />After spending long minutes trying to understand what the &quot;script pointer&quot; was referring to, things worked !<br /><br />With this, every small code should fit in Battle Pyramid Items, and it is possible to store the main part of the code there in order to manage the rest of the code with PC Items.<br />Using 00 as a null script, PC Items can be easily used to execute small script commands like special or setflags, which will be useful to make a multi-task code.<br /><br /><br />I found suitable Glitch Moves for every Emerald and FrLg version. (to execute code in PC Items or Pyramid Bag Items, except Jap Emerald Pyramid Bag)<br />I&#039;ll focus on RS today, as the lack of DMA could be annoying.<br /><br /> Regarding the method I had in mind to tell the DMA translation using Pomeg Glitch, it doesn&#039;t work as nicely as planned.<br />(for now, I only have like 10 different patterns for the 32 DMA translations)<br />I found an alternative strategy for Emerald (it uses the same idea I used to unlock Faraway and Birth Islands, but this time with Party Slot 0x47 and the 32+6 first Tms), but that strategy can&#039;t be applied to FrLg.<br /><br />On FrLg (except Jap), I have 13 different patterns.<br />The DMA translation I want to use is the 12 double-words one, and it unfortunately shares its pattern with 3 other DMA translations (so 1/4 chance to get it right).<br />But since these patterns also have patterns in themselves, with different placements of the PC PokÃ©mon in Box 2, I could obtain what I want.<br /><br />I will also try to do the same thing on Emerald because I prefer doing that than the other strategy who requires the 38 first TMs (even if that strategy is still nice).<br /><br />EDIT : Nope, there are no Glitch Moves that could make my initial DMA detection fully work.<br />This method will give a 1/4 chance to have the right DMA translation for an ACE.<br /><br />EDIT 2 : I found a way thanks to in-game traded Meowth.<br />I added the method to that paste :&nbsp; http://pastebin.com/sVHSwgSn<br /><br />I&#039;ll check for the same methods in Emer Jap, FrLG Jap, FrLg (except Jap).<br /><br />[quote author=TheZZAZZGlitch link=topic=6868.msg200353#msg200353 date=1463093886]<br />The bytes would obviously vary depending on what we want to do. But the last two bytes would always be:<br /><br />E0 26.<br />[/quote]<br /><br />0xE0 was easy but 0x26 was tougher to obtain.<br /><br />A double-corrupted Horsea will have a Lonely nature (+ Atk, - Def). This gives a bonus in Coolness and a malus in Toughness.<br /><br />Here is the PokÃ©block recipe :<br />Oran + 2 NPC + Normal RPM : 10 Dry, 10 Bitter, 20 Feel&nbsp; x3 <br />Oran + 2 NPC + 7-23.3 RPM : 8 Dry, 8 Bitter, 20 Feel<br />Spelon + 3 NPC + 100-109.9 RPM : 51 Spicy, 12 Bitter, 32 Feel x4<br />Total : 4*(51+5) = 224 = 0xE0 Spicy (Coolness), 38=0x26 Dry (Beauty) 52*4 = 208 Sheen.<br /><br />That jump can be coded in RS with Horsea, which is great for a large manipulation of the 6 other bytes (2 of them can have any value, and 4 others must have a sum lower than 510).


subject: Re: MissigNo in EU version
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Krys3000 link=topic=7493.msg200357#msg200357 date=1463128246]<br />- There is an actual way to fix the sound bank issue causing the crash. Torchickens worked on it, but I can&#039;t find back the picture he made about this.<br />[/quote]<br />Yes! I think that these may have been the &#039;sound bank fix&#039; GameShark codes, 01xxEFC0, 01xxF0C0.<br /><br />If you modify the values to 08, you ensure that the game is always on the battle sound bank. Invalid sound banks can freeze the game.<br /><br />However, in French Red, Italian Red, these codes don&#039;t always work and you may be still unable to progress even if the battle loads/Missingno. is sent out.<br /><br />I&#039;m wondering if that picture is the one that showed what Missingno. appears like in different languages of Red/Yellow. I uploaded it on to Minus image hosting, and [url=https://twitter.com/torchickens/status/616978438579204096]on Twitter[/url]. I don&#039;t have the big version of it locally anymore sadly, and the Minus link (with many other links) unfortunately broke.<br /><br />[img]http://i.imgur.com/tQ7pNNV.png?1[/img]<br /><br />The following Missingno. (other than B6 (182), B7 (183), B8 (184)) may be problematic:<br /><br />Red/Green JP<br />Yellow JP<br />Yellow EN<br />Red FR<br />Red IT<br />Yellow ES<br />


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7436.msg199809#msg199809 date=1456504762]<br />Oddly, I donâ€™t see any patches related to printing PC boxes or party PokÃ©mon.<br />[/quote]<br /><br />Torchickens has confirmed that printing PC boxes in English Yellow VC works slightly differently from the GB release. For some reason, the error message is no longer displayed.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  That&#039;s right. The printer music still plays but the error box and message doesn&#039;t appear.<br /><br />Additionally:<br /><br />1) When you select PRNT from the PokÃ©dex, the &#039;selected&#039; sound effect plays but nothing else happens, [url=http://forums.glitchcity.info/index.php/topic,7436.msg199809.html#msg199809]like what HÃ¡Äky described on February 26th[/url]. Interestingly, the &#039;printer&#039; music will not play.<br />2, 3, 4) When you try to print out the Summer Beach House Printer, or Game Freak diploma, or a PokÃ©mon in the party from the PokÃ©mon Fan Club chairman after receiving the Bike Voucher, the certificate is shown and the printer music will play, but the error box and message doesn&#039;t appear.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7436.msg200366#msg200366 date=1463161310]<br />1) When you select PRNT from the PokÃ©dex, the &#039;selected&#039; sound effect plays but nothing else happens, [url=http://forums.glitchcity.info/index.php/topic,7436.msg199809.html#msg199809]like what HÃ¡Äky described on February 26th[/url]. Interestingly, the &#039;printer&#039; music will not play.[/quote]<br /><br />Yup. [url=http://forums.glitchcity.info/index.php/topic,6459.msg200043.html#msg200043]The PokÃ©dex&#039;s option even varies between languages in the original Game Boy releases.[/url]<br /><br />[quote author=Torchickens link=topic=7436.msg200366#msg200366 date=1463161310]<br />2) When you try to print out the Summer Beach House Printer, the certificate is shown and the printer music will play, but the error box and message doesn&#039;t appear.<br />3) When you try to print out the Game Freak diploma for completing the PokÃ©dex in Celadon Mansion, the certificate is shown and the printer music will play, but the error box and message doesn&#039;t appear like in 2).<br />[/quote]<br /><br />Huh. So they changed more than we thought. The data on the patch files only uses [tt]print[/tt] for labeling the change to the print function of the PokÃ©dex. Other printer functions are not identified in a meaningful way.


subject: Re: PokÃ©mon Yellow: SGB/GBC differences
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=SatoMew link=topic=6459.msg200043#msg200043 date=1458585043]<br />I&#039;ve spotted another difference between Japanese Yellow and Western Yellow on the Game Boy. The equivalent Virtual Console versions don&#039;t apply here as they were all patched to do the same thing regardless of language.<br /><br />https://www.youtube.com/watch?v=oezMoxAn4ng<br /><br />Issuing a print job of a PokÃ©dex entry in Western Yellow (GB) is preceded by the PokÃ©mon&#039;s cry, unlike in Japanese Yellow (GB) where it goes straight to the error / the Game Boy Printer connection messages. [url=http://forums.glitchcity.info/index.php/topic,7436.msg199809.html#msg199809]In Yellow (VC), the button-press sound effect is played instead and nothing happens.[/url]<br />[/quote]<br /><br />That&#039;s really interesting. Nice find! :)<br /><br />I was curious as to whether this differs between Japanese Yellow v1.0, &quot;Rev A&quot;, &quot;Rev B&quot; and &quot;Rev 3&quot;. I tried it out on all four of those versions and all of them didn&#039;t play the cry.


subject: Re: PokÃ©mon Yellow: SGB/GBC differences
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6459.msg200368#msg200368 date=1463162326]<br />That&#039;s really interesting. Nice find! :) <br /><br />I was curious as to whether this differs between Japanese Yellow v1.0, &quot;Rev A&quot;, &quot;Rev B&quot; and &quot;Rev 3&quot;. I tried it out on all four of those versions and all of them didn&#039;t play the cry.<br />[/quote]<br /><br />Thanks! :) I suppose each subsequent revision fixed bugs or tweaked minor things but I haven&#039;t looked it up yet.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7490.msg200362#msg200362 date=1463138872]<br />ISSOtm, I edited your post to fix a BBCode issue ([tt][url][/tt] wasn&#039;t closed properly)<br />[/quote]<br />Thanks ! Dante&#039;s quote also features the typo.<br /><br />[quote author=Dante link=topic=7490.msg200359#msg200359 date=1463132171]<br />[quote author=ISSOtm link=topic=7490.msg200358#msg200358 date=1463130384]<br />(...)[/quote]<br />I don&#039;t exactly know how the game does this, but anyways.<br /><br />When you try tou cut a tree, it checks whether you are facing a tree / grass tile, and if yes, it looks up in a table to replace the tree / grass tile with a normal earth tile while preserving three of its neighboring tiles (the game, for compression purposes, stores tiles in squares of 2x2 tiles). That&#039;s what we use for Glitch City RAM Manipulation.<br /><br />Every time you enter a new map, the game actually copies the whole map from ROM to RAM, and applies modifications such as cutting trees, discovering the Casino&#039;s stairs, etc (nb : the reloading of these maps don&#039;t involve reloading the graphics, causing the [url=http://glitchcity.info/wiki/index.php/Invisible_tree_glitch]Invisible Tree Glitch[/url). [b]These modifications don&#039;t involve any sprites at all.[/b]<br /><br />tl;dr : nope, trees aren&#039;t missable objects. They are part of the map.<br />[/quote]<br />I thought that the trees were actually sprites like in gen3 O_O<br />[/quote]<br />Nope, they are real terrain tiles. I believe it to be the same in gen II.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7490.msg200370#msg200370 date=1463165108]<br />[quote author=Wack0 link=topic=7490.msg200362#msg200362 date=1463138872]<br />ISSOtm, I edited your post to fix a BBCode issue ([tt][url][/tt] wasn&#039;t closed properly)<br />[/quote]<br />Thanks ! Dante&#039;s quote also features the typo.<br /><br />[quote author=Dante link=topic=7490.msg200359#msg200359 date=1463132171]<br />[quote author=ISSOtm link=topic=7490.msg200358#msg200358 date=1463130384]<br />(...)[/quote]<br />I don&#039;t exactly know how the game does this, but anyways.<br /><br />When you try tou cut a tree, it checks whether you are facing a tree / grass tile, and if yes, it looks up in a table to replace the tree / grass tile with a normal earth tile while preserving three of its neighboring tiles (the game, for compression purposes, stores tiles in squares of 2x2 tiles). That&#039;s what we use for Glitch City RAM Manipulation.<br /><br />Every time you enter a new map, the game actually copies the whole map from ROM to RAM, and applies modifications such as cutting trees, discovering the Casino&#039;s stairs, etc (nb : the reloading of these maps don&#039;t involve reloading the graphics, causing the [url=http://glitchcity.info/wiki/index.php/Invisible_tree_glitch]Invisible Tree Glitch[/url). [b]These modifications don&#039;t involve any sprites at all.[/b]<br /><br />tl;dr : nope, trees aren&#039;t missable objects. They are part of the map.<br />[/quote]<br />I thought that the trees were actually sprites like in gen3 O_O<br />[/quote]<br />Nope, they are real terrain tiles. I believe it to be the same in gen II.<br />[/quote]<br /><br />And what about the rocks? Are they tiles too?


subject: Re: PokÃ©mon Yellow: SGB/GBC differences
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=SatoMew link=topic=6459.msg200369#msg200369 date=1463163239]<br />[quote author=Torchickens link=topic=6459.msg200368#msg200368 date=1463162326]<br />That&#039;s really interesting. Nice find! :) <br /><br />I was curious as to whether this differs between Japanese Yellow v1.0, &quot;Rev A&quot;, &quot;Rev B&quot; and &quot;Rev 3&quot;. I tried it out on all four of those versions and all of them didn&#039;t play the cry.<br />[/quote]<br /><br />Thanks! :) I suppose each subsequent revision fixed bugs or tweaked minor things but I haven&#039;t looked it up yet.<br />[/quote]<br /><br />Yes, that&#039;s possible, and &quot;Rev 3&quot; may actually be a legitimate fourth version that follows &quot;Rev B&quot; because of code in the ROM that marks it as version $02.<br /><br />http://forums.glitchcity.info/index.php/topic,6883.msg200373.html#msg200373


subject: Re: Revision differences in PokÃ©mon games
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=6459.msg200369#msg200369 date=1463163239]<br />[quote author=Torchickens link=topic=6459.msg200368#msg200368 date=1463162326]<br />That&#039;s really interesting. Nice find! :) <br /><br />I was curious as to whether this differs between Japanese Yellow v1.0, &quot;Rev A&quot;, &quot;Rev B&quot; and &quot;Rev 3&quot;. I tried it out on all four of those versions and all of them didn&#039;t play the cry.<br />[/quote]<br /><br />Thanks! :) I suppose each subsequent revision fixed bugs or tweaked minor things but I haven&#039;t looked it up yet.<br />[/quote]<br /><br />I decided to dump the comparisons! Although I haven&#039;t analyzed them, and there are many more changes (possibly indirect changes, locations of routines) compared to Crystal v1.0 and v1.1 https://sites.google.com/site/torchickens2/pokemon-file-comparions<br /><br />It appears that rev 3 may indeed be a real fourth revision, which comes after Rev B.<br /><br />Version number:<br />[code]0000014C: 02 03<br />; version $02&gt;version $03[/code]<br />(Difference between Rev B and Rev 3)


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No, boulders are sprites. Actually, they are dealt in a funny way by the game, which allows us to perform a [url=https://www.youtube.com/watch?v=OWycmqosI2Y]different version of the &#039;warp to any map&#039;[/url] effect of the Doko-Kashira Door Glitch in american and european games.<br /><br />This is a table of 4x4 tile blocks in european games where you can see what is part of the overworld tileset:<br />http://www.prama-initiative.com/RBJ/CTRAM1.png<br /><br />BTW, I feel like I should mention that I am italian, so if you want to ask specifically something to me about anything I said, feel free to do it in our mother tongue&nbsp; ;)<br /><br />


subject: Re: MissigNo in EU version
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Yes, that&#039;s the image I was thinking of. I remember it because you mentioned our Twitter account&nbsp; ;D<br />Thanks!


subject: Re: Debug menus in Japanese Crystal
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  These are incredible finds! Well done HÃ¡Äky! There are a number of sound effects in the sound test I don&#039;t recognize, such as 45, 146, 175, 176-178, 205, 206. Are any of those used?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Shina69
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Shina69
icon: xx
body:
  Hi, guys! Thanks for helping me on changing the moves on yellow a few months ago, really helped!<br /><br />I was wondering if it&#039;s possible to get HM Fly before getting to Celadon City by arbitrary code execution on pallet town, since only a few glitch pokemons level up learning Fly and that&#039;s probably not an option. After i receive the pikachu, maybe he could get it? I saw this video of a guy saving at 0:00 and instantly spawn at the end, maybe i could spawn near the HM Fly little house, although i probably wouldn&#039;t be able to leave from there that easily. Although if i was able to walk through walls, it would be easy. But then, how to disable it? I read about the youngster method but my lvl 100 nidoking doesn&#039;t really apply, that 4th move pp is difficult to get.<br /><br />Thanks for the attention, guys! Maybe there&#039;s already a way to do it and i don&#039;t know.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Shina69 link=topic=6638.msg200380#msg200380 date=1463172174]<br />Hi, guys! Thanks for helping me on changing the moves on yellow a few months ago, really helped!<br /><br />I was wondering if it&#039;s possible to get HM Fly before getting to Celadon City by arbitrary code execution on pallet town, since only a few glitch pokemons level up learning Fly and that&#039;s probably not an option. After i receive the pikachu, maybe he could get it? I saw this video of a guy saving at 0:00 and instantly spawn at the end, maybe i could spawn near the HM Fly little house, although i probably wouldn&#039;t be able to leave from there that easily. Although if i was able to walk through walls, it would be easy. But then, how to disable it?<br /><br />Thanks for the attention, guys! Maybe there&#039;s already a way to do it and i don&#039;t know.<br />[/quote]<br /><br />Yes. Getting to anywhere without arbitrary code execution and/or obtaining HM02 Fly can be done with the expanded items pack warping.<br /><br />You can obtain the expanded items pack at the beginning of the game with the [url=http://forums.glitchcity.info/index.php?topic=6472.0]SRAM glitch[/url] after doing a swap such as PokÃ©mon 1&gt;PokÃ©mon 10 if you have [url=http://forums.glitchcity.info/index.php?topic=6914.0]knowledge of the internal memory layout[/url] (which is the glitch you saw).<br /><br />It may be possible to capture a PokÃ©mon to obtain 49-51 total PokÃ©mon instead of 255 (this happens because you normally capture a Golem (Red/Blue) or Magmar (Yellow) with the decimal index number of 49 or 51 respectively, due to the &quot;[url=https://www.youtube.com/watch?v=ELDCr6fxZMY]wild appeared[/url]&quot; glitch); from then on depositing them all is easy, unless for some reason the PokÃ©mon you deposit or withdraw do not have terminated names (PRAMA encountered this on non-English versions, and in English Yellow a workaround might be to view a PokÃ©mon with a specific move 4 such as Counter (like in the glitch &quot;[url=https://www.youtube.com/watch?v=_BtVoea5ONM]oobLG[/url]&quot;) but I don&#039;t know if this applies to every version). In Red and Blue, the Golem must be caught in a certain place to avoid a freeze. Diglett&#039;s Cave works; then you should open the menu to avoid a freeze if you exit by the stairs.<br /><br />If you keep the expanded items pack, you can warp around as you please; although I&#039;m afraid I don&#039;t know of a way how you could obtain items to keep in this way although it&#039;s likely very possible, because with the looping map trick (described below and on the first post) you may become trapped without a PokÃ©mon to Teleport away.<br /><br />If you&#039;ve obtained an expanded items pack (such as the 255 items pack from [url=http://forums.glitchcity.info/index.php?topic=7175.0]dry underflow glitch[/url]); then you can warp to Celadon City by entering a PokÃ©mon Center, swapping the Ultra Ball x0 at item 32 into Master Ball (left of the exit mat) or &quot;!j&quot; (Red/Blue) or &quot;x&quot; (Yellow) (right of the exit mat)&nbsp; x([url=http://bulbapedia.bulbagarden.net/wiki/List_of_locations_by_index_number_(Generation_I)]exit place ID[/url]) at item 36, and tossing how many you want. x0 actually represents x256. If you toss 250, then you can warp to Celadon City.<br /><br />Regular Missingno. for obtaining a x255 stack (by obtaining x129 Potions, using two, capturing the Missingno. to obtain x255) can appear from doing the Trainer escape glitch/Mew glitch with Misty&#039;s Starmie (This will work in English Red/Blue but likely not French or Italian Red/Blue. Additionally in English Yellow (unsure about Spanish Yellow), if you have cleared your save file with Up+Select+B there is a way to encounter a &quot;[url=http://forums.glitchcity.info/index.php/topic,7436.msg200294.html#msg200294]stable unstable Missingno.[/url]&quot; which is believed to never freeze the game).<br /><br />Special Missingno. 182-184 are alternatives to regular Missingno. if your version&#039;s Missingno. freezes the game (and for people using the French and Italian versions of Red/Blue you could possibly use the PokÃ©mon menu&gt;Cooltrainer glitch described in the link above). They can be encountered by having Ditto transform into a PokÃ©mon with one of those Special stats.<br /><br />Alternatively, you can have a 1/8 chance of obtaining one from a double Trainer-Fly involving talking to the Cubone trade girl on Underground Path to encounter a level 80 Starmie first. This was first used in [url=http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Yellow/Glitched_No_Save_Corruption/Starmie_Trade_Route]a PokÃ©mon speedrunning route[/url].<br /><br />(Click to view video)<br />[youtube]https://www.youtube.com/watch?v=73fAlzIbi9k[/youtube]<br /><br />TheZZAZZGlitch&#039;s looping map trick to obtain 8F or ws m allows you to bring up every item into the regular items to keep, except for possibly the non-functionable PP Up copy (32h) and TM55 (FFh, but you can keep the key item HM05 which works the same). You can dig up items of your choice and keep them if you bring them up with Select and then Teleport away.<br /><br />Steps:<br /><br />1) Walk to this place.<br />[img]http://i.imgur.com/mwJ0mb7.png[/img]<br />2) Swap an item with an ID of hex:33 or greater into the Nugget x1 found at item position 35, such as PokÃ© Doll or X Special.<br />3) Keep walking right (to increase the item ID by 1 each step) or left (to decrease it by 1 each step) to change the item, until you find a HM02: Fly.<br />4) Press Select to bring it up to the top of the items pack and then Teleport away.<br /><br />Hope that helps and let me know if you have any other questions!&nbsp; :)


subject: Re: Bert's Album Reviews
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [b][u]Dragonheart: The Battle Sanctuary[/u][/b]<br />When Dragonheart announced this album in late 2013 and then said nothing about it afterwards, I became suspicious it didn&#039;t exist or was going to meet the same fate as Duke Nukem Forever. Then, in September 2015, it was announced TBS will be released the following October on an American record label.<br /><br />It. <br /><br />Is. <br /><br />[size=36pt]GLORIOUS![/size]<br /><br />It&#039;s really unfortunate Dragonheart have been unable to get any remarkable exposure outside Brazil, because they do what Manowar likes to claim they do, when in actuality Manowar has suddenly become Hollywood and is just rehashing the same shit: Dragonheart write kickass power metal about epic battles and although they don&#039;t take themselves seriously, they still have a fuckload more dignity than most &#039;mainstream&#039; metal bands.<br /><br />But anyway.<br /><br />The album marked a small lineup change, as Marcelo Caporasso left the band and was replaced with Thiago Mussi, Cromathia&#039;s drummer. The band&#039;s sound didn&#039;t change, though.<br /><br />Like Vengeance in Black, The Battle Sanctuary has an extremely dark sound fitting its story: Earth has been reduced to complete shit because of King... Theodoric? The guy who played a minor role in Throne of the Alliance and then wasn&#039;t mentioned ever again, is suddenly the story&#039;s antagonist. Lynkhor isn&#039;t mentioned at all, probably because Marco Caporasso realized his existence didn&#039;t make any sense: why is Lynkhor the King of the Alliance in VIB, instead of Theodoric? There&#039;s no stated reason for Theodoric&#039;s absence, leading me to think Marco dun goofed and went with it because Lynkhor sounds cool. Anyway, the giant demonic entity on TBS&#039; cover is obviously the same guy, and is given the same titles Lynkhor had. Namely, the Devil King. <br /><br />Now, the plot!<br /><br />In &#039;Far From Heaven... Close to Hell,&#039; it&#039;s revealed that Theodoric, instead of masturbating to the idea of destroying the world like he did in VIB, up and did it. Dragonheart and his merry band of LARPers are the only force able to stand against him. To keep them at bay, Theodoric creates a monster of pure evil, the titular &#039;Black Shadow,&#039; and although Dragonheart&#039;s army slays the abomination after a vicious battle, they are banished into a place called &#039;The Arcane&#039;s Palace,&#039; which is basically Hell itself. Lynkhor then is able to discover the heroes&#039; greatest fears in &#039;Inside the Enemy&#039;s Mind;&#039; Dragonheart&#039;s biggest fear is that after all the bullshit they&#039;ve gone through, they will be unable to stop Theodoric.<br /><br />After escaping the palace, Dragonheart and his army make preparations for an upcoming battle against Theodoric&#039;s squadron, and &#039;Forged in Metal&#039; is essentially one boastful &#039;fuck you&#039; to their nemesis. Things go to shit in the following track, &#039;Battle Lines,&#039; when some important wizard who was never mentioned before sacrifices himself to destroy the opposing force. &#039;Marching Under the Stars&#039; is the obligatory ballad and fittingly sombre, where Dragonheart begins to have doubts that the Alliance can win. Meanwhile, Theodoric continues to collect souls and, in &#039;Circle of One,&#039; becomes so horrifyingly strong he becomes the General of Hell.<br /><br />Dragonheart meets with another wizard, Arlin, in &#039;Kill the Leader.&#039; Arlin says Theodoric can indeed be killed, but only by decapitation. Once the group gathers their strength, they face Theodoric&#039;s army in the final showdown/title track. Dragonheart and Theodiric fight each other, during which Dragonheart decapitates the fucker, but he himself dies when Theodoric hurls his spear through the warrior&#039;s chest. The fighting stops, and everyone mourns their fallen hero. In the aftermath, everyone begins rebuilding the world while Dragonheart&#039;s legacy begins (&#039;Time Will Tell).<br /><br />Just like the band&#039;s previous albums, The Battle Sanctuary kicks ass and takes names, and it&#039;s got enough names. It whips you to the pavement right away and refuses to let you up, throwing a constant assault of world-shattering riffs, choruses and melodies at you with reckless abandon. The 3:50-headbanger &#039;Battle Lines&#039; does this best, with a bouncy and catchy rhythm. The plot is generic, sure, but fuck you.<br /><br />Although the mix is still better than Underdark, it&#039;s not as polished as VIB. The album sounds unusually hollow, and the meat in the guitars is expired. Sure, there&#039;s plenty of crunch, but it could very well be freezer burn. The dueling vocals are still around and there&#039;s plenty to killer solos to go around, and every chorus is damningly catchy, if not just as rousing. Very little experimentation happens, other than the obligatory keyboard fluff that pops up on every power metal album, although &#039;Marching Under the Stars&#039; brings back the flutes and lutes. Admittedly I was hoping for the ballad to sound like &#039;Heart of a Hero,&#039; but whatever. Their influences would be proud; the opening riff on &#039;The Arcane&#039;s Palace&#039; is full-blown &#039;90s Blind Guardian. Y&#039;know, before they felt the need to make every fucking song 7+ minutes. You can&#039;t make it work, Hansi. Stop trying to.<br /><br />To bring this review to a close, TBS was worth the wait, and although itâ€™s the ending of their silly fantasy story, I canâ€™t wait to hear what Dragonheart do next.<br /><br />Bert&#039;s Rating: 80/100<br /><br />Recommended songs: All of &#039;em.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Something highly unexpected happened when I was trading PokÃ©mon between Blue on a Nintendo 3DS XL and Red on an original Nintendo 3DS (the aim to get a Cooltrainer Ditto early). I entered the Trade Center and bumped the back of my Nintendo 3DS XL.<br /><br />The Nintendo 3DS XL showed a blue screen on both the top and bottom screen, both said &quot;BOOTROM 8046 ERRCODE: 00F800FF F8F8FFFF FFFFFFFF 00000000 00000000. The system apparently froze and I had to hold down the power button longer than usual to turn it off. This was an official copy.<br />[img]http://i.imgur.com/0en88bp.png[/img]<br /><br />A cursory Google search says this kind of thing has happened before in other situations (not just with PokÃ©mon), and appears to be related to the Nintendo 3DS firmware or BIOS itself. Luckily my Nintendo 3DS XL booted up properly the next time I turned it on, and it appears like (I hope) all the data is OK.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=http://www.3dbrew.org/wiki/Bootloader#Error_Codes]3dbrew[/url] says that this bootrom error is caused by both firm0 and firm1 failing the signature checks.<br /><br />No idea why it would be caused temporarily though.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Wack0 link=topic=7436.msg200384#msg200384 date=1463187602]<br />[url=http://www.3dbrew.org/wiki/Bootloader#Error_Codes]3dbrew[/url] says that this bootrom error is caused by both firm0 and firm1 failing the signature checks.<br /><br />No idea why it would be caused temporarily though.<br />[/quote]<br /><br />That&#039;s interesting. It was only a small bump from the other Nintendo 3DS and I&#039;m like, &quot;gosh, if my Nintendo 3DS XL (with a lot of data downloaded on it too) got bricked I don&#039;t know if I&#039;d be able to sleep&quot; and I&#039;m also a little concerned if it&#039;s going to happen again. I was under the impression it was possibly a Game Boy emulator thing and I guess for the moment, it&#039;s a good thing in a way I didn&#039;t know about this being related to firmware before or I may have panicked (ignorance is bliss in that respect).<br /><br />However, without further knowledge I wonder if whether the fact I entered the Trade Center and opened up communications was significant. I don&#039;t want to bump the Nintendo 3DS again now though, as if it happened again I could probably risk bricking my console and now I&#039;m going to be extra cautious.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: TwilightHakuryuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s really too bad that the trees aren&#039;t missable objects. <br /><br />I do recall reading all the content in the glitch city RAM-manipulation thread, but it has been a while. 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Shina69
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Shina69
icon: xx
body:
  Thanks a lot for the wise and meticulous explanation, Torchickens!<br />Sure it&#039;s a wonder the possibilities that Item Underflow brings as well as glitch items, i followed all the steps on SRAM glitch topic and it&#039;s a all new world. But, recently, i got more interested on these new recent challenges like the no save corruption speedruns and others that avoid the usage of expanded items pack. I looked through the forum archives and also found players trying to beat the game without battling team rocket members and that made me wonder: is it actually possible to complete pokemon yellow on such conditions plus without time cable exploits of any kind? I followed their topic (http://forums.glitchcity.info/index.php/topic,7448.0.html), but answers stopped a few months ago :(


subject: Re: Hey guys!
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Welcome back!<br /><br />Also 10/10 points for watching Pokemon speedruns (cause they&#039;re awesome) and then coming back here from the videos.&nbsp; 8)


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Gonna grab Moon digital copy, Sun physical copy.<br />Sun legendary &gt; Moon legendary. (wtf is the bat thing)<br />Probably going to pick Rowlet and the fire cat thing.<br />Popplio is okay, I think he&#039;s cute but too similar to Oshawott (who I liked).<br /><br />It all depends on the final evos though.... lets hope we don&#039;t get Delphox/Chesnaught 2.0


subject: Re: Playthrough: Completing Generation I without fighting a Team Rocket member
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Photon-Phoenix link=topic=7448.msg199990#msg199990 date=1458019873]<br />EDIT: Actually, if you have a PokÃ©mon with a special stat of 20, you can proc a level 1 Arcanine to appear via trainer escape glitch + cable club escape glitch then using growl 6 times on it.&nbsp; Catching the level 1 Arcanine then defeating a level 2 pidgey or similar will cause the Arcanine to jump to level 100.&nbsp; At level 100, the Arcanine has an effective special stat of 184 if used in the trainer escape + cable club escape glitch -- the special stat needed for a Ghost MissingNo. to appear.<br /><br />(Effective meaning if used on the rival battle near Viridian or the trainer on Route 3 with a Jigglypuff whose PokÃ©mon both have spd/spc DVs of 88 and no Stat EXP)<br />[/quote]<br /><br />Wait is Arcanine effected by experience underflow? I thought it was just certain 3-stage evolution lines.<br /><br />Also, with this: https://www.youtube.com/watch?v=TYNqXzTKzcw and a little research it should be really simple to run Gen 1 without fighting a Rocket if the Rocket in front of Saffron Gym is made to vanish with the Mew Glitch. Would need to research what precise steps to take, however.


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7441.msg200346#msg200346 date=1463085135]<br />Popplio is the new Oshawott. Ugly abomination that needs to be euthanized.<br /><br />But fire cat looks pretty lit[size=1pt]ten[/size] AF. Also owl thing is cute and would probably make a pretty swoot HM slave, but it&#039;s grass type and therefore sucks.<br />[/quote]<br />couldn&#039;t agree more.<br /><br />also the final evolutions have been &quot;leaked&quot; but im not sure how reliable that source is.<br />the types mentioned were water/fighting grass/flying and fire/ground.


subject: Re: Playthrough: Completing Generation I without fighting a Team Rocket member
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Ephraim225 link=topic=7448.msg200390#msg200390 date=1463376038]<br />Wait is Arcanine effected by experience underflow? I thought it was just certain 3-stage evolution lines.<br />[/quote]<br /><br />Arcanine is not a PokÃ©mon from the medium-slow experience group. Therefore, the Experience Underflow Glitch will only work on him if you catch any eligible PokÃ©mon at level 1, then change its ID by either using Super Glitch corruption or arbitrary code execution to make him an Arcanine [b]before [/b]doing the glitch&nbsp; :D


subject: Re: Playthrough: Completing Generation I without fighting a Team Rocket member
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7448.msg200392#msg200392 date=1463388910]<br />[quote author=Ephraim225 link=topic=7448.msg200390#msg200390 date=1463376038]<br />Wait is Arcanine effected by experience underflow? I thought it was just certain 3-stage evolution lines.<br />[/quote]<br /><br />Arcanine is not a PokÃ©mon from the medium-slow experience group. Therefore, the Experience Underflow Glitch will only work on him if you catch any eligible PokÃ©mon at level 1, then change its ID by either using Super Glitch corruption or arbitrary code execution to make him an Arcanine [b]before [/b]doing the glitch&nbsp; :D<br />[/quote]<br /><br />Now THAT is VERY interesting. Can...can the Q Trick do this?


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7441.msg200346#msg200346 date=1463085135]<br />Popplio is the new Oshawott. Ugly abomination that needs to be euthanized.<br />[/quote]<br /><br />I guarantee you&#039;ll do a 180 when the evolutions and hidden abilities get revealed just like everyone did with every other starter.


subject: Re: Playthrough: Completing Generation I without fighting a Team Rocket member
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I never tried to use the Q Trick for this, but I guess it works yeah&nbsp; ;) I&#039;ll try asap.<br />If you want to know more on the expanded experience underflow, see [url=http://forums.glitchcity.info/index.php/topic,7366.0.html]this thread[/url].


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Ephraim225 link=topic=7441.msg200394#msg200394 date=1463440305]<br />[quote author=Zowayix link=topic=7441.msg200346#msg200346 date=1463085135]<br />Popplio is the new Oshawott. Ugly abomination that needs to be euthanized.<br />[/quote]<br /><br />I guarantee you&#039;ll do a 180 when the evolutions and hidden abilities get revealed just like everyone did with every other starter.<br />[/quote]<br /><br />What penalties may be incurred if you are found to be liable for breach of guarantee?


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7441.msg200397#msg200397 date=1463472861]<br />[quote author=Ephraim225 link=topic=7441.msg200394#msg200394 date=1463440305]<br />[quote author=Zowayix link=topic=7441.msg200346#msg200346 date=1463085135]<br />Popplio is the new Oshawott. Ugly abomination that needs to be euthanized.<br />[/quote]<br /><br />I guarantee you&#039;ll do a 180 when the evolutions and hidden abilities get revealed just like everyone did with every other starter.<br />[/quote]<br /><br />What penalties may be incurred if you are found to be liable for breach of guarantee?<br />[/quote]<br /><br />I will be forced to actually choose the grass starter, which no self-respecting trainer ever does :P


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Ephraim225
icon: xx
body:
  Hey ZZAZZ, I noticed in your video you got the guard in front of Saffron Gym to disappear, could you tell how you did that? I don&#039;t know where in RAM the disappearing NPC list is ^^;<br /><br />EDIT: I think I can figure this out if I knew what all the maps with only 2 vanishing objects were.<br /><br />EDIT2: ...THE HOOKED DRAGONITE.


subject: Re: Hey guys!
poster_name: VaeporSage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Neato. Fun coincidence to be brought back after all that time. :)<br /><br />When was the first GCL forum?


subject: Re: Playthrough: Completing Generation I without fighting a Team Rocket member
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I just realized there is a chance it wouldn&#039;t work as you would have a pokemon with negative experience in the box and the game would freeze upon withdrawing it.


subject: Re: Playthrough: Completing Generation I without fighting a Team Rocket member
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Isn&#039;t there something about doing the Q Trick with the daycare or something? I don&#039;t know if he can deal with negative experience, although probably not.


subject: Re: Playthrough: Completing Generation I without fighting a Team Rocket member
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Couldn&#039;t you do the Q Trick by depositing from your party rather than withdrawing from a box?<br /><br />As for the daycare I think it functions in the same way a box would so you probably couldn&#039;t withdraw level 1 PokÃ©mon from him.


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Ephraim225 link=topic=7441.msg200398#msg200398 date=1463473060]<br />I will be forced to actually choose the grass starter, which no self-respecting trainer ever does :P<br />[/quote]<br /><br />&gt;It&#039;s an &quot;all grass type starters are shit&quot; episode.<br /><br />[quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=7441.msg200391#msg200391 date=1463378410]<br />also the final evolutions have been &quot;leaked&quot; but im not sure how reliable that source is.<br />the types mentioned were water/fighting grass/flying and fire/ground.<br />[/quote]<br /><br />There&#039;s, like, five different &quot;leaks&quot; of the starter&#039;s final evos. All of them look horrible. Especially [size=1pt]evil clown Poppolio[/size].


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: shaggs
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As you can see from this avatar that I made<br />Popplio is the best and you best watch your<br />mouth if you&#039;re thinking about disrespecting <br />the king&nbsp; ;)


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Here they are in the PokÃ©red disassembly :<br />https://github.com/pret/pokered/blob/6057f285ad1a930315d1a45fa3d1aa08efe6801d/wram.asm#L2619<br />and the entry I just added to Datacrystal :<br />http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Event_Flags<br /><br />I&#039;m currently researching what does each flag control.<br />[url=https://github.com/pret/pokered/blob/6057f285ad1a930315d1a45fa3d1aa08efe6801d/main.asm#L3330]This routine[/url] seems to be a good one to target.


subject: Mysterious Black Screen in Emerald?
poster_name: avemflamma
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The other day, I got distracted from messing around on my Emerald cart and looked away.. when I looked back, my screen had turned black. No music played; it was frozen. When I turned it off, the screen didn&#039;t shift in coloration or change at all. Later, this actually reoccured in front of my eyes. I had just exited a battle when suddenly the screen just turned blank. I have no idea what is going on, so I&#039;d like to consult you guys! I&#039;ve never encountered anything like this before, so I&#039;m super curious.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: avemflamma
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not sure if anyone has said this yet, but I can confirm that the Save Corruption glitch is still in the game. I pulled it off on my official copy of Red and have been having a great time messing around with it. I even got a wild encounter to start up in Oak&#039;s lab just by switching around pokes! 


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Ephraim225
icon: xx
body:
  [quote author=ISSOtm link=topic=7490.msg200407#msg200407 date=1463572421]<br />Here they are in the PokÃ©red disassembly :<br />https://github.com/pret/pokered/blob/6057f285ad1a930315d1a45fa3d1aa08efe6801d/wram.asm#L2619<br />and the entry I just added to Datacrystal :<br />http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Event_Flags<br /><br />I&#039;m currently researching what does each flag control.<br />[url=https://github.com/pret/pokered/blob/6057f285ad1a930315d1a45fa3d1aa08efe6801d/main.asm#L3330]This routine[/url] seems to be a good one to target.<br />[/quote]<br /><br />Thanks, but what I&#039;m looking for is a way to trigger a Mew Glitch encounter on a map with only two disappearing NPCs. I figured the only way to accomplish that is a Hooked Dragonite in Pewter City but that just freezes the game, it seems.<br /><br />EDIT: I know you could just write bytes into RAM with 8F but I prefer to avoid that :P


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]Thanks, but what I&#039;m looking for is a way to trigger a Mew Glitch encounter on a map with only two disappearing NPCs.[/quote]<br /><br />This is the list of all maps with only two missable objects:<br /><br />Viridian City<br />Pewter City<br />Route 2<br />Route 22<br />Route 24<br />Viridian Gym<br />Pokemon Tower 6F<br />Cinnabar Mansion 1F<br />Fighting Dojo<br />Rocket Hideout B1F<br />Rocket Hideout B3F<br />Cinnabar Mansion 3F<br />Safari Zone North<br />Victory Road 1F<br /><br />Unfortunately, all of these maps either don&#039;t have a long range trainer to start the Mew Glitch, or aren&#039;t accessible without going through a map with more than two missable objects.<br />You can use the RIVAL&#039;s effect to start a Mew Glitch on Victory Road 1F, and then return there by going through Viridian City, Route 22 and Route 23. But, if you have access to glitch items, you can just use RIVAL&#039;s to get past the object you want to get rid of...


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s funny because people on PRAMA&#039;s forum is trying to do the same thing at Saffron, and we were wondering which map we could use. Guess we have the answer now... so bad&nbsp; :(


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  When I messed around with the RAM address for Pallet&#039;s scripts, I once started a fight with a wild Koffing in the Rival&#039;s house. That was unexpected. 


subject: Re: Mysterious Black Screen in Emerald?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Remember to properly blow the cart before usage ^^<br />(Nintendo always failed to put that in their manuals... Maybe it is a strategy of theirs to force us to buy newer consoles O_o)


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nope. I wrote about this on PRAMA&#039;s skype group, but maybe you weren&#039;t there at this time. I was actually investigating the $D5F3 address, refered as &quot;Have Town map?&quot; on Datacrystal but which doesn&#039;t appear to be so, since it goes to 01 as you enter the Rival&#039;s house, even when you don&#039;t get the map, and doesn&#039;t change when you get it. If you turn on some other bits on this address, weird things happens like sudden text box popping, mostly game crashes, and sometimes (but not everytime?) preceded with a wild Koffing.&nbsp; <br /><br />However, the program error causing all this mess might also have written a 37 somewhere for some reason, which triggered the fight.


subject: Re: Mysterious Black Screen in Emerald?
poster_name: avemflamma
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7494.msg200413#msg200413 date=1463655522]<br />I think your cart is just dying&nbsp; ;D<br />[/quote]<br /><br />Guess so. That&#039;s what I initially thought, but I really haven&#039;t had/used this cart for very long at all. It is used though, so maybe the person who used it before me went to town on it :P <br /><br />[quote author=ISSOtm link=topic=7494.msg200415#msg200415 date=1463670443]<br />Remember to properly blow the cart before usage ^^<br />(Nintendo always failed to put that in their manuals... Maybe it is a strategy of theirs to force us to buy newer consoles O_o)<br />[/quote]<br /><br />Ooh, yeah, I&#039;ll try that next time I start up the game. Thanks ^^


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: hashtag
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey, first post!<br />Using the Wack0&#039;s simple Gameshark script to do a couple things, and i&#039;m curious as to what you are supposed to do when the code requires you to enter a 00<br /><br />for example I have a code that modifies the typing of the current box slot one pokemon. it should look like this<br /><br />any item<br />8f<br />Lemonade * number corresponding to type<br />X-accuracy * 155 for primary type and 156 for secondary type<br />Carbos * 218<br />Pokeball * 119<br />Fresh Water * 201<br /><br />This code works perfectly, and i have used it to replace Aerodactyl&#039;s flying typing with ghost as a proof of concept. the only problem is that when i want to make something a normal type i would have to have 0 lemonades because 00 is the hex that corresponds with normal. I have tried it just without any lemonades and it freezes the game, as expected. Is it possible to make the game read as having 0 lemonades by somehow rolling it over to 256, or anything like that? Thanks!<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  First this code was sort of already made but that&#039;s not a big deal since you are new here. To get 0 Lemonades try using this 8F code by lowena<br /><br />8F<br />Item you want X2 to get 0 or 1 to get 255<br />Burn Heal X43<br />Ice Heal X53<br />Revive X201


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Flandre Scarlet link=topic=6638.msg200420#msg200420 date=1463700961]<br />First this code was sort of already made but that&#039;s not a big deal since you are new here. To get 0 Lemonades try using this 8F code by lowena<br /><br />8F<br />Item you want X2 to get 0 or 1 to get 255<br />Burn Heal X43<br />Ice Heal X53<br />Revive X201<br />[/quote]<br /><br />Alternatively have lemonade x1 followed by Soda Pop x4.<br /><br />this is:<br /><br />[code]<br />ld a,01<br />dec a<br />inc b<br />[/code]


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That stinks. I really wanted to make a speedrun of the game that only gets 6 badges and never fights any Rockets, and that&#039;s very much possible with lots of Brock Through Walls abuse, but I wanted to use some of the tricks that don&#039;t often get used. It wouldn&#039;t be that serious a speedrun, but I&#039;m a casual player in that field anyhow :( Thanks anyways though, ZZAZZ.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oops. Actually, it&#039;s possible! I forgot that the Mew Glitch can be triggered by blacking out.<br /><br />Simply encounter a wild Pokemon on Victory Road 1F while in a trainer&#039;s line of sight and lose the battle. Fight a different trainer, return to Victory Road through Viridian City, Route 22 and Route 23, and there you have it - a Mew Glitch encounter with only two missable objects on the list.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s nice! However, keeping in mind the speedrun purpose, Victory Road won&#039;t be available at this time, right?


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7490.msg200425#msg200425 date=1463745069]<br />That&#039;s nice! However, keeping in mind the speedrun purpose, Victory Road won&#039;t be available at this time, right?<br />[/quote]<br /><br />Yep. It&#039;s pretty useless for this purpose, since you need the Saffron Gym badge anyway to access the Victory Road. But it&#039;s good to know that there is a way to trigger a Mew Glitch encounter with 2 missable objects - this might be used for some fun stuff later.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can also get a x0 stack by tossing a whole stack above a x255 stack (which becomes a copy of the x255 stack), tossing 254 of the copy, and swapping the resulting x1 stack with the x255 stack. As a side effect, your item counter will decrease by 2 so you&#039;ll lose the stack you tossed and the last stack in your bag.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  In case you were wondering, thelinekioubeur posted on PRAMA that you cannot use this subglitch to avoid RIVAL fights. The RIVAL will indeed disappear, but its text box displays, the battle starts anyway, and then the game freezes.<br /><br />[img]http://forum.prama-initiative.com/download/file.php?id=60[/img]<br /><br />thelinekioubeur also notes that just as Snorlax, the RIVAL is always the first missable object flag on the list.


subject: Re: NPCs that can be removed by the Mew Glitch?
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The rival fights are generated by map scripts rather than the rival object itself. This also applies to the tile left of the sailor blocking S.S.Anne, the Saffron guards and the guards blocking Cycling Road.


subject: Teleport's animation looping after encountering yellow MissingNo?
poster_name: Narashae
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was trying some things out with the yellow missingno, because there&#039;s not a lot known about this version. After running away from the encounter, I got the multiple walking characters to trigger, as per usual. However, I then walked a bit, before realizing that I had to use teleport to fix the multiple walking characters effect. Strangely enough, the teleport kept wrapping around the screen, never coming to an end, meaning I was forced to restart the game.<br /><br />I&#039;ve got a bad recording of this: https://a.pomf.cat/htluuj.mp4 . You can see that the background sprites have stopped walking, which normally also happens when you teleport away. The game didn&#039;t actually teleport me to the pokecenter, though. Anyone got a clue why this has happened?


subject: Re: Teleport's animation looping after encountering yellow MissingNo?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Narashae link=topic=7495.msg200431#msg200431 date=1463949855]<br />I was trying some things out with the yellow missingno, because there&#039;s not a lot known about this version. After running away from the encounter, I got the multiple walking characters to trigger, as per usual. However, I then walked a bit, before realizing that I had to use teleport to fix the multiple walking characters effect. Strangely enough, the teleport kept wrapping around the screen, never coming to an end, meaning I was forced to restart the game.<br /><br />I&#039;ve got a bad recording of this: https://a.pomf.cat/htluuj.mp4 . You can see that the background sprites have stopped walking, which normally also happens when you teleport away. The game didn&#039;t actually teleport me to the pokecenter, though. Anyone got a clue why this has happened?<br />[/quote]<br />This effect may happen if you view the statuses of the Yellow glitch PokÃ©mon &quot;?/&quot; (EC) and &quot;â™‚ p ã‚¥ (F4)&quot; too. This corrupts your overworld sprite, and the effect occurs when you try to Teleport away; hence it&#039;s possible the problem is related to your corrupted sprite.


subject: Re: Hey guys!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=VaeporSage link=topic=7491.msg200400#msg200400 date=1463478854]<br />Neato. Fun coincidence to be brought back after all that time. :)<br /><br />When was the first GCL forum?<br />[/quote]<br /><br />The first &quot;Glitch City&quot; forum was started in 2005, but Abwayax has had a variety of websites focusing on PokÃ©mon anomalies since Nemesis Temple in 2003.<br /><br />You can read all about them here. http://forums.glitchcity.info/index.php/topic,1089.10.html


subject: Re: Teleport's animation looping after encountering yellow MissingNo?
poster_name: Narashae
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7495.msg200433#msg200433 date=1464016715]<br />This effect may happen if you view the statuses of the Yellow glitch PokÃ©mon &quot;?/&quot; (EC) and &quot;â™‚ p ã‚¥ (F4)&quot; too. This corrupts your overworld sprite, and the effect occurs when you try to Teleport away; hence it&#039;s possible the problem is related to your corrupted sprite.<br />[/quote]<br /><br />Hmm, would that mean that the duration of the teleport animation is somehow affected by the player&#039;s sprite? I&#039;m not currently able to get on an emulator, but wouldn&#039;t that mean that the teleport itself is delayed until the end of the animation? 


subject: Re: Teleport's animation looping after encountering yellow MissingNo?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The game executes the teleport animation by moving the player up by 0x10 pixels, checking if player&#039;s sprite Y position is [i]exactly[/i] 0xEC, and repeating the process if it isn&#039;t.<br /><br />Normally the player&#039;s sprite is at position 0x3C. So the animation goes on for 6 cycles:<br />[tt]3C -&gt; 2C -&gt; 1C -&gt; 0C -&gt; FC -&gt; EC[/tt]<br /><br />But if the player&#039;s sprite is put in a different Y position (let&#039;s say 0x69), the value of 0xEC is never reached, and thus, the animation goes on forever in an infinite loop.<br /><br />[tt]69 -&gt; 59 -&gt; 49 -&gt; 39 -&gt; 29 -&gt; 19 -&gt; 09 -&gt; F9 -&gt; E9 -&gt; D9 -&gt; C9 -&gt; B9 -&gt; A9 -&gt; 99 -&gt; 89 -&gt; 79 -&gt; 69 -&gt; ...[/tt]<br /><br />Obligatory piece of code from disassembly:<br /><br />[tt]PlayerSpinWhileMovingUpOrDown: ; 70755 (1c:4755)<br />&nbsp; &nbsp; call SpinPlayerSprite<br />&nbsp; &nbsp; ; in our case, a is set here to -0x10 (essentially 0xF0)<br />&nbsp; &nbsp; ld a, [wPlayerSpinWhileMovingUpOrDownAnimDeltaY]<br />&nbsp; &nbsp; ld c, a<br />&nbsp; &nbsp; ld a, [wSpriteStateData1 + 4] ; player&#039;s sprite Y screen position<br />&nbsp; &nbsp; add c<br />&nbsp; &nbsp; ld [wSpriteStateData1 + 4], a<br />&nbsp; &nbsp; ld c, a<br />&nbsp; &nbsp; [b]; in our case, a is set here to 0xEC<br />&nbsp; &nbsp; ld a, [wPlayerSpinWhileMovingUpOrDownAnimMaxY]<br />&nbsp; &nbsp; ; check if we hit the maximum Y position EXACTLY[/b]<br />&nbsp; &nbsp; [b]cp c[/b]<br />&nbsp; &nbsp; [b]; exit if we did[/b]<br />&nbsp; &nbsp; [b]ret z[/b]<br />&nbsp; &nbsp; ld a, [wPlayerSpinWhileMovingUpOrDownAnimFrameDelay]<br />&nbsp; &nbsp; ld c, a<br />&nbsp; &nbsp; call DelayFrames<br />&nbsp; &nbsp; [b]; otherwise repeat until we get there[/b]<br />&nbsp; &nbsp; [b]jr PlayerSpinWhileMovingUpOrDown[/b][/tt]


subject: Re: Anybody have the memcpy hack?
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: drc
icon: xx
body:
  Ok, found it on one of my old PC&#039;s<br /><br />Replace 0x00B5 with: CD 5C 3E FE XX 38 07 CD 5C 3E 23 12 18 02 2A 12 13 0B 79 B0 20 EA C9<br /><br />XX is how many out of 256 bytes you want to let through, with 00 being 256 (which would be useless)


subject: Re: Aren't carts great?
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  I actually do not know how to dump a cart and cannot afford equipment of any kind. Sorry guys &gt;:C


subject: Genesis and bullshit
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Why is there no RAM editor built into any MD/Genesis emulator? Seriously, that is raging horse shit. Anyone seen any that have this?


subject: Re: Aren't carts great?
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If ever you have $45, there&#039;s a device called the [url=https://bennvenn.myshopify.com/products/reader-writer-gen2]joey-joebags[/url] that can dump your GB/GBC/GBA carts, savefiles and all.


subject: Re: Aren't carts great?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Carl Miller link=topic=7482.msg200442#msg200442 date=1464151997]<br />If ever you have $45, there&#039;s a device called the [url=https://bennvenn.myshopify.com/products/reader-writer-gen2]joey-joebags[/url] that can dump your GB/GBC/GBA carts, savefiles and all.<br />[/quote]<br /><br />I didn&#039;t know about the existence of this dumper! Thanks, I might just have to order one at some point, if only to dump my dead Red cart.


subject: Re: Genesis and bullshit
poster_name: GARYM9
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7497.msg200441#msg200441 date=1464131180]<br />Why is there no RAM editor built into any MD/Genesis emulator? Seriously, that is raging horse shit. Anyone seen any that have this?<br />[/quote]<br /><br />You want Debug features?&nbsp; Here&#039;s one with too many.<br /><br />http://www.exodusemulator.com/downloads/current-release<br /><br />You may thank me after your processor explodes from how slow this runs.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In preparation for a video on all the possibilities of Double Corruption, and on ACE on Gen III, I made videos on little techniques that are either required or really useful to fasten the procedures.<br /><br />Obtain Smeargles with various Corruption Types : <br />https://www.youtube.com/watch?v=-LgQJEHBHdA<br /><br />Perfrming Instant Pomeg Glitch : <br />https://www.youtube.com/watch?v=PwYP6D1iTio<br /><br />Obtaining the Caterpie Corruption Initiators : <br />https://www.youtube.com/watch?v=hBWkshUJv_8<br /><br /><br />[u]Regarding ACE :[/u]<br />- I found a way to check for a DMA translation of 12 double-words on FrLg.<br />This allows ACE on FrLg (except Jap) to be conveniently performed, using Glitch Move 0x0713 (animation pointer at 0x023F0084), a Bootstrap PokÃ©mon, and PC Items.<br /><br />- For RS, Glitch Moves 0x804C and 0x8053 have an animation pointer of 0x02039360 who points to the beginning of the second substructure of a certain PC PokÃ©mon. <br />As the substructure of the easiest Bootstrap PokÃ©mon to make is the second one, these glitch moves will perfectly work with it.<br /><br />One way to make a code in RS could be :<br />- Make a code using PC PokÃ©mon to duplicate the first/last PC Item. (setting one of the highest bit to 1, or setting the quantity to 0).<br />Use this code to duplicate Glitch Items.<br />- Make the code you want with PC Items, and trigger it with another Bootstrap PokÃ©mon.<br /><br />This way, the limited size of manipulable PokÃ©mon data wouldn&#039;t be that much of a bother for storing codes.<br /><br /><br />- The overworld script subroutine has different ROM adresses depending on the version.<br />I was able to find it for all Emer/R/S versions, but I can&#039;t find it for FrLg. (I searched for similar values in the ROM but I either had no or many results).<br />Does someone know the ROM adress of the overworld script subroutine in FrLg ?<br /><br /><br />[quote author=TheZZAZZGlitch link=topic=6868.msg200293#msg200293 date=1462631216]<br />&nbsp; Item $203A x512<br />&nbsp; Item $3026 x18689<br />&nbsp; ; (the 3A and 26 in the item IDs above can be replaced to warp to a different map!)<br />&nbsp; Item $6008 x48624<br />&nbsp; Item $3C5A x518<br /> <br />The code overwrites the RAM address responsible for holding the map ID the player will be transported to after using an Escape Rope. <br /><br />&nbsp; Item $[byte to write]20 x18689<br />&nbsp; Item $7008 x48624<br />&nbsp; Item $[address, 3rd byte][address, 4th byte] x$[address, 1st byte][address, 2nd byte]<br /><br />This piece of code only requires 3 items (besides the bootstrap animation bytecode), and will write any byte value to any RAM address.<br />[/quote]<br /><br />Your first code requires 4 PC Items to change 2 consecutive bytes (xx yy), but it also changes the 2 consecutive bytes to 00 and requires the 00 00 xx yy double-word to be 4-byte aligned , whereas your second one requires 3 PC Items to change 1 byte.<br /><br />- Would there be a shorter code to only change 2 consecutive bytes (a word) than using the &quot;change 1 byte&quot; code twice ? (something that would take less than 6 PC Items) (That word being 2-byte aligned.)<br /><br />- And in the same line, would there be a code to change 4 consecutive bytes (a double-word) shorter than 4 times the &quot;change 1 byte&quot; code ? (something that would take less than 12 PC Items).<br />(That double-word being 4-byte aligned.)<br /><br />I&#039;m asking this because certain interesting values can&#039;t be changed with the same command you used for the Escape Rope warp location, and the 00 00 is also a hindrance for certain values that are stored contiguously.<br />


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: GARYM9
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Photon-Phoenix
icon: xx
body:
  [quote author=Bert link=topic=7441.msg200405#msg200405 date=1463534542]<br />[quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=7441.msg200391#msg200391 date=1463378410]<br />also the final evolutions have been &quot;leaked&quot; but im not sure how reliable that source is.<br />the types mentioned were water/fighting grass/flying and fire/ground.<br />[/quote]<br /><br />There&#039;s, like, five different &quot;leaks&quot; of the starter&#039;s final evos. All of them look horrible. Especially [size=1pt]evil clown Poppolio[/size].<br />[/quote]<br /><br />Of course those leaks are fake.&nbsp; This one contains the REAL evolutionary chains.<br /><br />[img]http://i.imgur.com/V142sBU.png[/img]<br /><br />As you can see, Bert, that clown is NOT evil as it&#039;s the legit one.


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Photon-Phoenix link=topic=7441.msg200446#msg200446 date=1464261732]<br />[quote author=Bert link=topic=7441.msg200405#msg200405 date=1463534542]<br />There&#039;s, like, five different &quot;leaks&quot; of the starter&#039;s final evos. All of them look horrible. Especially [size=1pt]evil clown Poppolio[/size].<br />[/quote]<br /><br />Of course those leaks are fake.&nbsp; This one contains the REAL evolutionary chains.<br /><br />[img]http://i.imgur.com/V142sBU.png[/img]<br /><br />As you can see, Bert, that clown is NOT evil as it&#039;s the legit one.<br />[/quote]<br />Glad you cleared that up!<br /><br />So how much pokemon does that make now? Over 1000? 


subject: Walk trough wall (ledge method)
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So I was wondering about why this glitch happens and in general how the safari zone glitch act. <br />Why I can&#039;t just fade out by poisoned pokemon while jumping of a ledge?<br />Does somebody knows?&nbsp;  8)


subject: Re: Walk trough wall (ledge method)
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I haven&#039;t tested it but I believe the game waits until you&#039;re off the ledge before doing a poison check.<br /><br />The timing for that would be hell to pull off anyhow, so I recommend doing it the Museum Guy way if that&#039;s possible. You only have to really set that up one time, then you can use it again and again.


subject: Daniel's Glitch Adventure
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: drc
icon: xx
body:
  This will be something along the lines of Bert&#039;s Glitchy story. So, enjoy.<br /><br />-Episode 1: I can&#039;t name for shit-<br /><br /> I was ready to start my PokÃ©mon journey. It was my 14th birthday and my mom woke me up at 5 AM. It&#039;s fine, though. I wanted her to, as I was very excited for my new journey. So much so that I ran out the door. Once out of the door, I walked 5 squares right and 6 squares up. It&#039;s going to be hard to get used to walking on a grid. Once I walked into the grass, Oak proceeded to violate my privacy and personal space by dragging me to the lab. Then he told me to choose a PokÃ©mon. Despite already knowing inevitably that I would pick Bulbasaur, I decided to look at the others. There was Charmander, owned by every kid who pressed left. Then there was Squirtle, which I don&#039;t think I&#039;ve ever picked.<br /><br /> But then, when I opened the Bulbasaur ball, I felt queasy. As it was released, it looked... off. I remember it looking somewhat like this: [img]http://i.imgur.com/tME8DKC.png[/img]. Then Gary came in, as Oak had amnesia. &quot;Eh, what was his name?&quot; &quot;Peepee&quot; I said, channelling my inner 8 year old, and Prof. Oak actually believed it. When Gary saw the strange &#039;mon, his jaw dropped as he jumped at it, but phased through it. Then, he tried to body slam it. I got tired of these stupid charades and punched him in the face, knocking him out. &quot;I&#039;ll take him&quot; I said to Oak, as he just nodded his head, not even caring. Whatever. I was happy I had a PokÃ©mon, although it might have not been exactly how I expected. I also swiped a PokÃ©dex, and a town map.<br /><br /> I decided to check this PokÃ©mon&#039;s PokÃ©dex entry. It showed its number, 175. Yep. It&#039;s a PokÃ©god. Its name was &quot;â–ˆâ–ˆâ–ˆ3â–ˆâ–ˆâ–ˆâ‚½ â–ˆ&quot; What a mouthful. I was blown away by its stats. At level 5, it had 36 HP, 28 Defense, and 26 Speed, although it also had lackluster 7 Attack and Special. Its types were Ground and Dragon, which was a nice combination, although being weak to Ice (that defense tho). Dragon types tend to be good on offense, balancing its Attack out, and I&#039;ve never paid attention to Special, so I don&#039;t know what it does. I decided to give â–ˆâ–ˆâ–ˆ3â–ˆâ–ˆâ–ˆâ‚½ â–ˆ a name. Hmm... I decided to name it Trizard, seeing as it contained the number 3, and is a Dragon-type. This is where I&#039;ll stop, as I&#039;m working on a project at the moment.


subject: Is it possible to activate the GS ball event through Japanese PCC glitch?
poster_name: Rabby250
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello guys, I&#039;ve just run into this YouTube video demonstrating the unexpected script execution in PCC when playing on a fresh Japanese Crystal:<br />[youtube]http://www.youtube.com/watch?v=nqEaRpDEeTw[/youtube]<br /><br />This reminds me of a rumor back in early 2001, shortly after the release of Japanese Crystal but before the official introduction of GS Ball (the actual distribution took place in May, as I remembered): the rumor, which was never verified, stated that some lucky players received GS Ball from Nurse Joy on their first visit to PCC.<br /><br />So now I&#039;m wondering: is it possible to trigger the event of Nurse Joy handing out the GS Ball with some specific value on $A800, thereby forming a possible explanation to the rumor? Thanks!


subject: Mobile Trade received PokÃ©mon data structure
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  In Japanese PokÃ©mon Crystal, when the value of SRAM 05:A800 is set to 04; you will receive a traded PokÃ©mon the next time you step into the PokÃ©mon Communication Center in Goldenrod City. It will appear in the PokÃ©dex.<br /><br />After you receive the PokÃ©mon, you will get the text &quot;ãŠã¾ãŸã›ã€€ã—ã¾ã—ãŸï¼ã€€ã“ã†ã‹ã‚“ã®ã€€ã‚ã„ã¦ãŒã€€ã¿ã£ã‹ã£ã¦ã„ãŸã€€ã‚ˆã†ã§ã™ ã‚ãªãŸã®ã€€ã‚ãŸã‚‰ã—ã„ã€€ãªã‹ã¾ã§ã™ã€€ã‹ã‚ã„ãŒã£ã¦ã€€ã‚ã’ã¦ã€€ãã ã•ã„ã­ ãã‚Œã§ã¯ã€€ã¾ãŸã®ã€€ã”ã‚Šã‚‡ã†ã‚’ã€€ãŠã¾ã¡ã€€ã—ã¦ãŠã‚Šã¾ã™ï¼&quot; (translated: Thank you for your<br />patience. A trade partner has been found. It&#039;s your new partner. Please take care of it with love. We hope to see you again.)<br /><br />Creating your own Mobile Trade PokÃ©mon should be possible with Japanese PokÃ©mon Crystal arbitrary code execution (thanks to luckytyphlosion, HÃ¡Äky, Paco81&#039;s finds), such as through [url=http://forums.glitchcity.info/index.php/topic,7315.msg198786.html#msg198786]TM15 ACE[/url] (TM15 when used outside of the TM/HM pocket executes FA10).<br /><br />You can obtain a hex:00 ????? through the bad clone glitch and withdraw PokÃ©mon without mail to convert it into ????? FF, use hex:FF Missingning&#039;s items corruption; and follow the steps in the thread, and then manipulate FB84 (in the expanded balls pocket) to a value such as (item x195), Star Piece x 251 (jp FB84; box 4 name character 2).<br /><br />This code will enable the trade (thanks Crystal_ for the skeleton). We just need to find a way to adapt it for a structure such as box names or stored items.<br /><br />[code]ld a,05<br />ld (4e01),a<br />ld a,0a<br />ld (0d01),a<br />ld a,04<br />ld (a800),a<br />ret[/code]<br />[hr]<br />Data structure (work in progress):<br />A800: If it is 04, obtain a PokÃ©mon in the PCC.<br />A826: Species of received PokÃ©mon modifier (e.g. FB=Celebi).<br />B029: Held item of received PokÃ©mon.<br />B02A: Move 1 of received PokÃ©mon.<br />B02B: Move 2 of received PokÃ©mon.<br />B02C: Move 3 of received PokÃ©mon.<br />B02D: Move 4 of received PokÃ©mon.<br />B02E, B02F: ID number of received PokÃ©mon.<br />B030, B031, B032: Experience of received PokÃ©mon.<br />B033, B034: HP stat experience of received PokÃ©mon.<br />B035, B036: Attack stat experience of received PokÃ©mon.<br />B037, B038: Defense stat experience of received PokÃ©mon.<br />B039, B03A: Speed stat experience of received PokÃ©mon.<br />B03B, B03C: Special stat experience of received PokÃ©mon.<br />B03D: Attack/Defense IV of received PokÃ©mon.<br />B03E: Speed/Special IV of received PokÃ©mon.<br />B03F: Received PokÃ©mon&#039;s PP of move 1.<br />B040: Received PokÃ©mon&#039;s PP of move 2.<br />B041: Received PokÃ©mon&#039;s PP of move 3.<br />B042: Received PokÃ©mon&#039;s PP of move 4.<br />B058: Received PokÃ©mon&#039;s OT name character 1.<br />B059: Received PokÃ©mon&#039;s OT name character 2.<br />B05A: Received PokÃ©mon&#039;s OT name character 3.<br />B05B: Received PokÃ©mon&#039;s OT name character 4.<br />B05C: Received PokÃ©mon&#039;s OT name character 5.<br />B05D: Nickname of received PokÃ©mon, character 1.<br />B05E: Nickname of received PokÃ©mon, character 2.<br />B05F: Nickname of received PokÃ©mon, character 3.<br />B060: Nickname of received PokÃ©mon, character 4.<br />B061: Nickname of received PokÃ©mon, character 5.


subject: Re: Is it possible to activate the GS ball event through Japanese PCC glitch?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Interesting that you should post this. Earlier today and yesterday I was looking into how to get a Celebi via the 04 &#039;received PokÃ©mon from a trade&#039; script ([url=http://forums.glitchcity.info/index.php/topic,7502.msg200452.html#msg200452]thread[/url]).<br /><br />[quote author=Rabby250 link=topic=7501.msg200451#msg200451 date=1464692778]<br />Hello guys, I&#039;ve just run into this YouTube video demonstrating the unexpected script execution in PCC when playing on a fresh Japanese Crystal:<br />[youtube]http://www.youtube.com/watch?v=nqEaRpDEeTw[/youtube]<br /><br />This reminds me of a rumor back in early 2001, shortly after the release of Japanese Crystal but before the official introduction of GS Ball (the actual distribution took place in May, as I remembered): the rumor, which was never verified, stated that some lucky players received GS Ball from Nurse Joy on their first visit to PCC.<br /><br />So now I&#039;m wondering: is it possible to trigger the event of Nurse Joy handing out the GS Ball with some specific value on $A800, thereby forming a possible explanation to the rumor? Thanks!<br />[/quote]<br />That&#039;s an interesting rumour and it may be true. It&#039;s possible that they started a new game, reached the PCC and the save data happened to have the right value for some reason. If you clear your save file with Up+Select+B in Generation I, it replaces the entire save file with FF. The same might be true with the Japanese version of PokÃ©mon Crystal.<br /><br />If you start a new game on the emulator BGB without a save file, do not save, and don&#039;t use Up+Select+B, save data appears to be &#039;randomized&#039;; so obtaining the GS Ball this way might be possible. I don&#039;t know if this may apply for a real console though, for fresh cartridges.<br /><br />To force the GS Ball event without cheating, it should be possible with TM14 outside of the TM/HM pocket arbitrary code execution if you open SRAM and write to the relevant address, however, I don&#039;t know if you can activate the GS Ball event by changing $A800, and a different address may be responsible.<br /><br />In English Crystal, you can apparently activate the event by setting 0xBE3C in the save file to 0x0B. So it should be possible by English means as well (if we know the SRAM bank for the 0xBE3C offset address), via a method like [url=http://forums.glitchcity.info/index.php?topic=6979.0]TM33 arbitrary code execution[/url].


subject: Re: Mobile Trade received PokÃ©mon data structure
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  I note that B029 to B042 is very similar (if not exactly the same as) [url=http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_structure_in_Generation_II]the Gen2 PokÃ©mon data structure[/url] (0x01 on).


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  Metarkrai, if you still want to know where the FR/LG script_run() (US Emerald 0x8098EF8) is, it&#039;s at 0x8069AE4 in US FireRed; in the FireRed .idb it&#039;s named script_env_12_start_and_stuff().


subject: Re: Mobile Trade received PokÃ©mon data structure
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Wack0 link=topic=7502.msg200454#msg200454 date=1464711004]<br />I note that B029 to B042 is very similar (if not exactly the same as) [url=http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_structure_in_Generation_II]the Gen2 PokÃ©mon data structure[/url] (0x01 on).<br />[/quote]<br /><br />Yes. I&#039;m still looking to see if you can change the level, I think I may have guessed where it was based on the data structure pattern above but not found it.<br /><br />I successfully got a Celebi at level 2 named &quot;?????&quot; with 16449536 experience using the following box names:<br /><br />Box 4: ãƒ§ã¼ã‚¬ãŒãƒ‘ãœãƒ‘ã¥<br />Box 5: ã¼ã‚¶ãŒã‚¼ã¥ã¼ã‚¬ãƒ™<br />Box 6: ãŒãƒ­ãœã‚¬ãšãšãšãš<br />Box 7: ãšã¥ãƒ§ã¹ã¹ã¹ã¹ã¹<br />Box 8: ãŒãƒ­ãœãŒã¥ãŒã‚£<br />Box 9: ãœã ã¥ã®<br /><br />After making it jump to level 100, it learned five moves. I replaced Baton Pass with Perish Song and it now looks like this!<br /><br />[img]http://i.imgur.com/nAaMmYu.png[/img][img]http://i.imgur.com/WU8X1qi.png[/img][img]http://i.imgur.com/RibJWXO.png[/img]<br /><br />ASM:<br /><br />[code]<br />ld a,05<br />ld h,40<br />ld l,40<br />ldd (hl),a<br />ld d,b<br />ld a,0A<br />ld h,0D<br />ldd (hl),a<br />ld a,05<br />dec a<br />ld d,b<br />ld h,A8<br />ld l,05<br />dec l<br />dec l<br />dec l<br />dec l<br />ld d,b<br />dec l<br />xor a<br />dec a<br />dec a<br />dec a<br />dec a<br />dec a<br />ld d,b<br />ld h,A8<br />ld l,26<br />ldd (hl),a<br />ld h,B0<br />ld d,b<br />ld d,b<br />ld l,30<br />ldd (hl),a<br />ret<br />ld d,b<br />ld d,b<br />[/code]<br /><br />Code:<br /><br />[code]3E 05 26 40 2E 40 32 50 3E 0A 26 0D 32 3E 05 3D 50 26 A8 2E 05 2D 2D 2D 2D 50 2D 32 AF 3D 3D 3D 3D 3D 50 26 A8 2E 26 32 26 B0 50 50 2E 30 32 C9 50 50[/code]


subject: Re: Daniel's Glitch Adventure
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m diggin&#039; it. I especially like the part where Peepee tries to attack Trizard himself, and the self-awareness of the narrator. Checking out Trizard&#039;s stats was also pretty cool.<br /><br />However... the events seem rushed. This isn&#039;t necessarily a bad thing, since the beginning of the game happens pretty much in the same amount of time as your narrative, but it all seems like a blur.<br /><br />Other than that, I&#039;m really looking forward to see where this goes!


subject: Re: Is it possible to activate the GS ball event through Japanese PCC glitch?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The PCC&#039;s Trade Corner attendant delivers you the GS Ball in Japanese Crystal [url=http://forums.glitchcity.info/index.php/topic,7407.msg199607.html#msg199607]when address 0xA000 is set to 0x0B[/url] [b]even if the PokÃ©mon Mobile System GB is disabled[/b] (its state is controlled by addresses 0xE800 and 0x9000 of the save file).<br /><br />[quote author=Rabby250 link=topic=7501.msg200451#msg200451 date=1464692778]<br />This reminds me of a rumor back in early 2001, shortly after the release of Japanese Crystal but before the official introduction of GS Ball (the actual distribution took place in May, as I remembered): the rumor, which was never verified, stated that some lucky players received GS Ball from Nurse Joy on their first visit to PCC.<br />[/quote]<br /><br />This rumor [i]may[/i] be true because I recall being given the GS Ball after a visit to the PCC when I played the game about half a decade ago. Unfortunately, I do not have the files from that period. It&#039;s something that I most likely dismissed as an emulation quirk back then.


subject: Re: Hey guys!
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Surfingpichu link=topic=7491.msg200356#msg200356 date=1463106513]<br />Edit: Also, Zowayix, you have an A+ Waifu.<br />[/quote]<br /><br />&gt;Rena is only A+<br />&gt;not S tier


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Shina69
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Shina69
icon: xx
body:
  Is it possible to change your Ash character sprite for a Prof Oak one? Would love to trick my friend on a cable fight xD<br />There are these videos making it by the endless spinning glitch, but sprite changes again if you stop moving.<br />https://www.youtube.com/watch?v=3-mzSaAxH38<br />https://www.youtube.com/watch?v=P_gWeUM4d5I<br /><br />Wonder if it&#039;s possible to create an wsm code to change the sprite.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=6868.msg200455#msg200455 date=1464717299]<br />Metarkrai, if you still want to know where the FR/LG script_run() (US Emerald 0x8098EF8) is, it&#039;s at 0x8069AE4 in US FireRed; in the FireRed .idb it&#039;s named script_env_12_start_and_stuff().<br />[/quote]<br /><br />Yup, I&#039;m still working on procedures for console ACE on Gen 3, and overworld script execution can&#039;t be passed over. Many thanks for the adress !<br /><br />With this, I completed the list of subroutine adresses I have.<br />[quote]-- Script engine subroutine adresses :<br />Emer US : 0x08098EF9 / Emer Fr : 0x08098F09 / Emer Ita : 0x08098F0D / Emer Spa : 0x08098F0D / Emer Jap : 0x08098881<br />FrLg US : 0x08069AE5 / FrLg Fr : 0x08069B95 / FrLg Ita : 0x08069AC1 / FrLg Spa : 0x08069BA9 / FrLg Jap : 0x080693A5<br />Ruby US : 0x080655B9 / Ruby Fr : 0x080659E5 / Ruby Ita : 0x0806590B / Ruby Jap : 0x080628F9<br />Sapp US : 0x080655BD / Sapp Fr : 0x080659E9 / Sapp Ita : 0x08065911 / Sapp Jap : 0x080628FD[/quote]<br /><br /><br />- I could execute code and overworld script on all Emerald and all FrLg (Jap or non Jap), but it didn&#039;t successfully work in RS.<br />The game executes the code, but softlocks right after that. <br /><br />There may be an additional command that is required to end an animation for RS. Do you have any information about that ?<br /><br /><br />As of now, ACE on Emerald is ok, all the setup procedures are made. <br />For FrLg, I need to adapt the PC Item procedure from Emerald.<br />For RS, I would like to use PC PokÃ©mon data to perform an ACE that sets the quantity of PC Item nÂ°1 to 0x0000. This way, PC Items could be duplicated like in Emerald and FrLg.<br /><br />I&#039;m still trying to find some improvements in order to make the storage of multiple codes, and I haven&#039;t made the list of all potentially interesting codes yet, but the overall thing looks good to me.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  Your script_run() list is still incomplete, as in Ruby US v1.2, 0x80655B8 is in the middle of a function... (from what I see, it&#039;s at 0x80655D8 in v1.2)<br /><br />Maybe setting a breakpoint on 0x8075CD0 will help with finding the softlock issue (again, Ruby US v1.2 offset). This is the handler for animation VM opcode 0x08.


subject: Re: Walk trough wall (ledge method)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  Yep, it is actually quite easy to understand. But there are two types of WTW :<br />1. Ledge method, murseum guy method<br />2. Brock Through Walls<br /><br />The first one is quite simple : the game has a guiding system, used notably in Pewter City. It works by, instead of reading the memory address corresponding to joypad input, reading predetermined values. The game has two things for that :<br />1. CD38, which is an index the game uses to read the predefined inputs. If it is nonzero, the game skips collision checks.<br />2. D730 bit 7, which when on, activates the guiding mechanism.<br />Note that when you jump off a ledge, the game actually uses the guiding mechanism to simulate two Down presses.<br /><br />So the glitch is essentially resetting D730 bit 7 while having a non-zero CD38 [b]for the ledge method[/b].<br />The Museum Guy and Brock Through Walls methods are a big mess, and far more complicated (internally) than the ledge method.<br />However, it seems that the developers took poisoning into account, and thus the glitch cannot be done simply with a poisoned PokÃ©mon, because poison isn&#039;t applied at all while being guided.<br /><br /><br />For more detailed (and less clear, meh) explanations on the mechanics of the WTW glitch, see [url=http://forums.glitchcity.info/index.php/topic,6675.msg198359.html#msg198359]this post of mine[/url] and [url=http://forums.glitchcity.info/index.php/topic,7221.msg198668.html#msg198668]this other one[/url].<br /><br />[hr]<br />[quote author=Ephraim225 link=topic=7499.msg200449#msg200449 date=1464664114]<br />I haven&#039;t tested it but I believe the game waits until you&#039;re off the ledge before doing a poison check.<br /><br />The timing for that would be hell to pull off anyhow, so I recommend doing it the Museum Guy way if that&#039;s possible. You only have to really set that up one time, then you can use it again and again.<br />[/quote]<br />The timing is nothing in Red/Blue, because you can do another simpler method involving KO PokÃ©mon and 5~6 save/resets. I posted the method some time ago on the wiki page, but the modification has to be approved by an admin for everyone to be able to view it.<br />And even in Yellow, you can count around 10 steps then Fly to Viridian City, as there is a ledge right in front of the PokÃ©mon Center. Then do a few save/reset trials and errors, and you&#039;re good to go !<br /><br />[hr]<br />[quote author=Dante link=topic=7499.msg200448#msg200448 date=1464626106]<br />So I was wondering about why this glitch happens and in general how the safari zone glitch act. <br />Why I can&#039;t just fade out by poisoned pokemon while jumping of a ledge?<br />Does somebody knows?&nbsp;  8)<br />[/quote]<br />The WTW glitch and Safari Zone Glitch are completely different things. If you also want explanations on the Safari Zone Glitch, I can give you some. But right now I&#039;m too lazy to do that.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This won&#039;t work on Link Battles. Your Gameboy will show a Oak sprite, but the opponent Gameboy won&#039;t, because you&#039;re never supposed to be Oak :P


subject: Re: Walk trough wall (ledge method)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The jumping step is not taken into consideration by the poison counter. You would need to do an extra step, that&#039;s why you can&#039;t do that.<br /><br />But think about it: what would we want to do this? If you blackout, you appear in a PokÃ©mon Center from which you couldn&#039;t get out without using the door... which would remove the walk through walls effect. That&#039;s why we use the poison in the first place, to exit the Safari Hall without using the exit :)<br /><br />Ephraim225: for the record, the Museum Guy glitch doesn&#039;t work in European games (Dante plays in italian!)


subject: Re: Walk trough wall (ledge method)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In Gen I, blacking out puts you right in front of the PokÃ©mon Center&#039;s door, not inside.<br /><br />[quote author=Krys3000 link=topic=7499.msg200465#msg200465 date=1464813246]<br />Ephraim225: for the record, the Museum Guy glitch doesn&#039;t work in European games (Dante plays in italian!)<br />[/quote]<br />The Museum Guy and Youngster methods only work on versions prior (and including) US R/B.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  <br />Oh damn, I didn&#039;t think that there would be changes of adresses for different versions of the same game.<br />I found a ROM that may be a 1.2 US Ruby (at least, the overworld script subroutine starts at 0x080655D8).<br />There doesn&#039;t seem to be too many important changes in glitch move animation pointers, but there seem to be some changes in glitch move names/effects.<br /><br />On that ROM, I tried again two code executions (changing a word, using special 0x0113), but the game froze for one code and soft-resetted for the other code.<br /><br />Here is a save file of that : http://www.petit-fichier.fr/2016/06/01/ruby-us-code-execution/ruby-us-code-execution.sav<br />The first party PokÃ©mon knows Glitch Move 0x1626 , who has an animation pointer at 0x02030400.<br />At 0x02030400, you have : 025BCD03 0800FF02 (use the 03 for move animations, then jump to 0x02025BCC)<br />At 0x02025BCC you have : 30094678 49034686 47084801 0001BDF0 02025BE4 080655D9 (use the subroutine at 0x080655D9, and make it execute the code at 0x02025BE4)<br />At 0x02025BE4, you have : 02011325 (special 0x0113, end)<br /><br />At 0x02025C0C, you also have : 0200023A 49013026 BDF06008 02025BE8 (writes 0x00003A26 at 0x02025BE8)<br />You can change the values at 0x02030400 to 025C0D03 0800FF03 to execute that code.<br /><br />These codes are fully functional in Emerald and FrLg (modulus the change in the jump adresses).<br /><br />I searched the overworld script subroutine in RS by using the values it started with on Emerald, so the subroutine may not be the good one (since the game freezes/resets before executing the scripts, I can&#039;t tell).<br />Even without that, the game freezes with the code that changes a double-word in RAM.<br />


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=The G-Meister link=topic=36.msg199448#msg199448 date=1448483317]<br />Ah, remembered the quirk. On Cinnabar Island, if you push the lady over to the right so she&#039;s standing underneath the doorway of the Gym, if you stand in the doorway without the secret key, it will tell you the door is locked, then try to push you down. Because she&#039;s in the way, you can&#039;t move down, so it just brings up the message again. If you close the message enough times, she&#039;ll slowly start to move out of the way again.<br />[/quote]<br />I was bored, so this got its own [url=http://glitchcity.info/wiki/index.php?title=Infinite_Blaine_Door]wiki page[/url]. [size=2pt]Can someone give me a life ? Please[/size]


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I got bit by different versions having different offsets myself, so..<br /><br />Thanks for the save file, I&#039;ll work on figuring out the issue when I get time.<br /><br />(I got confused a bit because you posted the byte streams as arrays of 32bit little-endian integers.)


subject: Re: Aren't carts great?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Carl Miller link=topic=7482.msg200442#msg200442 date=1464151997]<br />If ever you have $45, there&#039;s a device called the [url=https://bennvenn.myshopify.com/products/reader-writer-gen2]joey-joebags[/url] that can dump your GB/GBC/GBA carts, savefiles and all.<br />[/quote]<br />Thanks, but $45 is something I will probably never have spare...&nbsp; :P


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Finally got time to look.<br /><br />In no$gba, when the move is used, before the animation even happens (still on the move selection screen after pressing A), a jump to 0xA02004E2 happens. (tried 3 or 4 times with same result.) Obviously this move is too unstable, and can&#039;t even reach the animation part.


subject: Re: The dream thread
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The other night, I dreamt we had domesticated robot dinosaurs.<br /><br />DOMESTICATED.<br /><br />ROBOT.<br /><br />DINOSAURS.<br /><br />DO YOU KNOW HOW AWESOME THAT IS.<br /><br />YES I THOUGHT SO.<br /><br />However, they were much smaller, no bigger than an average dog. My family had an orange robo-triceratops, who just downright refused to come in.<br /><br />I was then woken up by my neighbor screaming he&#039;s gonna cut a tree down.<br />


subject: Re: The dream thread
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Have you ever had a dream where you- you -he and .. .you made - you did - he&nbsp; you... he did you so much you could do anything?<br /><br />Seriously, though, I can never remember my dreams.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Damn it, the save that was extracted from vba has glitch move 0x162C who indeed freezes the game before executing code on Ruby 1.2 US (on the other US Ruby it executes the code, but it has a long name who messes up a lot with the graphics and the move menu). Sorry, I messed up.<br /><br />For Glitch Move 0x1626 (or 0x1620), you can edit the moves of the currently fighting PokÃ©mon at 0x02024A8C.<br />Could you try your test again with one of these moves, please ? (I can do another save if you want)<br /><br /><br /><br /><br /><br /><br />


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  I tried with 0x1626, couldn&#039;t get the move to hit (it can hit the user or the opponent, but every time i tried attacking, the PokÃ©mon evaded the move...)<br /><br />So I tried with 0x1620, and it takes a few tries (one attempt it took 5 or so tries) but eventually the move hits and the payload executes.<br /><br />After the payload finishes execution, it does some other stuff and then jumps.. back into the payload?! Anyway, this causes a return to 0x3002A460. Still figuring things out.<br /><br />EDIT: ok, so if I patch the payload to contain a &quot;bx lr&quot; to allow it to return gracefully, it doesn&#039;t screw up.<br /><br />The payload should really start with [tt]push {r0, lr}[/tt] and end with [tt]pop {r0, pc}[/tt] (instead of [tt]pop {r4-r7, pc}[/tt] which i think actually returns to the caller&#039;s caller!).


subject: Re: Daniel's Glitch Adventure
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  ~CHAPTER TWO - [font=comic sans ms]uh~[size=4pt]i like how we have comic sans on here. 10/10 would bang[/size][/font]<br /><br />I&#039;m actually very concerned about formatting. It&#039;s really bothering me. Also, links are easter eggs that sort of relate to the story, you should click them. I mean, you don&#039;t have to, but it&#039;s nice. Also, it&#039;s 2 AM here.<br /><br />[hr]<br /><br /> So I went to the shop. Everything looked weird. There were stranged items. I saw such great items like &quot;a||POKEMON||ITEM||DANIEL||SAVE||OPTIONS||EXIT&quot; and &quot;8(japanese symbol)&quot; I disregarded those and bought a couple of potions and had this uncomfortable exchange:<br /><br /> &quot;Hey, I&#039;d like that Elixir!&quot; I said, cheerfully.<br /> &quot;You mean Elixer?&quot; the clerk said.<br /> &quot;Uhh, that&#039;s no-&quot;<br /> &quot;DANIEL! YOU ARE GOING TO BUY THIS ELIXER, AND YOU ARE GOING TO LIKE IT! That&#039;ll be $3999.99&quot; followed by a cash-register noise.<br /><br /> It cost me $4000, but it was worth it. I mean, he had a gun to my head. Once I went out, I fastwalked like an idiot up to the Viridian Forest entrance, but I went through. &quot;What was that?&quot; I whispered to myself, as I saw the exit through a couple of trees. &quot;For some reason I expected there to be more, but whatever. That part of the game was tedious anyway.&quot;<br /><br /> &quot;Daniel! Wait up!&quot; Gary came out of the exit. &quot;Let&#039;s try our new PokÃ©mon&quot;. I tried telling him I didn&#039;t have any new PokÃ©mon, but he strolled up to me and battled. My tank of a PokÃ©mon ripped through his Charmander. Although he asked to come with me. I guess I could use a partner, as long as he didn&#039;t try that shit like back at the lab. Up at Pewter, I ran into a sign, and continued walking. Although I swear Peepee wrote &quot;Daniel is a poopy faic xD&quot; on the sign.<br /><br /> After I made it to Pewter, I went into the store and somebody came up to me. &quot;Hey, you want a Magikarp? Only $499.99!&quot; Why these people kept giving me pennies, I don&#039;t know. I paid cold hard cash for it and recieved a Magikarp, which I named Undyne *[url=https://www.youtube.com/watch?v=YTy9v9a7Tmo]doo doo doo intensifies[/url]*<br /><br /> When I went outside, I saw some people battling, standard stuff. Level 100 Nidokings as far as the eye can see. Some kid came up with a group of friends and said &quot;WOAH, IT&#039;S A MISSINGNO.!&quot;, and his sister escorted them out. We locked eyes, and she whispered &quot;Hi, I&#039;m Misty.&quot;<br /><br /> &quot;Uh-- h...hi! Bye&quot; I&#039;m a real charming guy, let me tell you. I&#039;m antisocial enough. Having a girl actually say hi to me, was an experience. She left before looking back at me. Peepee witnessed the whole thing and said &quot;What a stinker. Here, let me show you&quot; <br /><br /> &quot;[url=https://www.youtube.com/watch?v=p_S-mCstfSI]ayy gurl wassup, you wanna fuck?[/url]&quot; I cringed so much, until I heard a punching noise and Peepee fell. Misty decided to join in too. I felt happy having a group of sort-of friends with me. It felt nice. I got dÃ©ja vu` for some reason, and we continued walking. Once we were about to move on from Pewter, some kid stopped us. He tried to be an Oak, but Trizard used a strange move. According to the PokÃ©dex, it was named &quot;TM36&quot;. No type, 35 PP. Its other attacks Wrao, Razor Wind, Poison Sting. Intersting set of moves. TM36&#039;s description was &quot;P â‚½ â–ˆ98 2B Continuedâ–ˆ4 â–ˆâ–ˆq3 error.&quot;


subject: Re: PokÃ©mon Moon and Sun Discussion
poster_name: Missing? NO!
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s strange to me that the new legendaries are weak to the type you&#039;d think would correspond to their game. Solgaleo is weak to Fire, Lunala is quad weak to Dark. That had to be intentional.<br /><br />From what I&#039;ve seen of the region, it looks to be a lot more detailed/expansive than how Kalos looked. Rather than simple routes it actually looked like, from the few clips I saw, a world that I&#039;d want to explore every nook and cranny of.<br /><br />#teamLitten


subject: Re: The dream thread
poster_name: Missing? NO!
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I had a dream that I broke ZeRo&#039;s (undisputed best Smash 4 player in the world) shield, then stood up, bowed to the crowd, and spiked him for the set and tournament win. Then I woke up and was sad.


subject: Re: Daniel's Glitch Adventure
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;description<br />&gt;gen 1<br /><br />I guess this is meant to be part-Stadium then, which *does* have move descriptions? (and I had to look that up, because I never actually played it, aside from reversing it a little bit, then cursing as I remembered how much I hate MIPS)


subject: Re: Daniel's Glitch Adventure
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7500.msg200480#msg200480 date=1465126978]<br />&gt;description<br />&gt;gen 1<br /><br />I guess this is meant to be part-Stadium then, which *does* have move descriptions? (and I had to look that up, because I never actually played it, aside from reversing it a little bit, then cursing as I remembered how much I hate MIPS)<br />[/quote]<br />I&#039;m sort of mixing gens.


subject: Yellow Hex ID C9-FF, New glitch pokemon?
poster_name: edwardsjs21
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So I was messing around on my yellow rom, trying to catch pokemon with hex IDs C9-FF, not realizing that those were the IDs for trainers. While I was doing this I made the discovery that you can hard reset whenever you get a trainer until it gives you a glitch pokemon with that hex. So far, using this method I have caught glitch pokemon with hex IDs ranging from CB to E1 and all inbetween. I have still yet to test E2-FF with this method but so far it is yielding some interesting glitch pokemon which have still yet to be indexed at this point. <br />Also I am using the gameshark code 01xxd7cf to obtain my pokemon rather than the mew glitch to save time, I don&#039;t know if that is why this is working but hopefully it&#039;s applicable to the mew glitch as well. <br />I just wanted to mention this in case anyone else wants to try it.


subject: Re: Yellow Hex ID C9-FF, New glitch pokemon?
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s not new, sadly. Also the PokÃ©mon shown in your avatar is my favourite glitch PokÃ©mon of all time.<br /><br />You can read about those glitch PokÃ©mon [url=http://bulbapedia.bulbagarden.net/wiki/List_of_glitch_Pok%C3%A9mon]here[/url].


subject: Arbitrary code execution in Red/Blue with cooltrainer glitch move.
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystal_
icon: xx
body:
  Basically, out of unrelated data, hex 00&#039;s move effect turns out to be 0x74, which essentially makes its move effect pointer point to F928. The cooltrainer move will execute its move effect function at the end of the ExecuteMove routine, and only if the target isn&#039;t fainted. Since cooltrainer has a glitch move effect, it&#039;s not present in any of the special move effect arrays and thus falls into the last call to the move effect handling function, where all the move effects that have not been handled yet are supposed to be taken care of.<br /><br />F928 is exactly the start of the enemy party Pokemon data. It&#039;s not the best place to end up at, but it&#039;s still RAM nonetheless.<br /><br />[img]http://i.imgur.com/DWUmEA7.png[/img]<br /><br />After spending some time considering all the options, this is the best I could come up with:<br /><br />[code]add hl, hl<br />nop<br />jp [hl][/code]<br /><br />Which corresponds to Machoke with 233 current HP in the fourth position of the last fought opponent. This already makes access to the cable club with another player/game a necessity.<br /><br />This makes us jump to F250, which is the move 2 of the sixth party Pokemon. It&#039;s more manageable but we still need to find a way to reach bag items, ideally. I came up with the following setup to reach F31E (item 1):<br /><br />Party Pokemon #6: (Golbat)<br />- Hyper Beam as 2nd move<br />- Supersonic as 3rd move<br />- Leech Life as 4th move<br /><br />which is:<br /><br />[code]ccf<br />jr nc, $8d[/code]<br /><br />hl overflowed in the last ld hl, hl instruction so we will be jumping to F1E0 here, which is the move 1 PP of party Pokemon #3.<br /><br />And then:<br /><br />Party Pokemon #3:<br />- PP of move 1: C3 (3 PP, 3 PP ups)<br />- PP of move 2: 1E (30 PP, 0 PP ups)<br />- PP of move 3: D3 (19 PP, 3 PP ups)<br /><br />Or jp D31E, which means that we finally made it to the item 1 of our bag.<br /><br />Given how easy is to get a Ditto learn cooltrainer I was hoping that this could make a decent alternative to ACE with 8F as this item is not particularly easy to obtain. However this also has many inconveniences.<br /><br />- Need to have someone else with a very high level Machoke (around 80) to battle with<br />- Need 6 PP Ups<br />- Need a lot coins to buy Hyper Beam<br /><br />What&#039;s more, in order to keep the opponent&#039;s party Pokemon in RAM we must perform the cable club escape glitch or else the data will be gone when we reset. Sure, the first thing we could do with ACE is clear the flag that makes the game think we are in the cable club (is it wLinkState?, I&#039;m too lazy to properly check right now) so we can actually save and end all the other side effects. But this inconvenience basically turned if off for me compared to 8F.<br /><br />Also to note is the well know corrupting side effects of the cooltrainer move as well as the fact that cooltrainer ACE won&#039;t be as versatile as 8F since we can only use it during battle. I thought at first that cooltrainer ACE might make a decent alternative to hack yourself 8F but all the flaws considered it definitely doesn&#039;t appear to be the case<br /><br />The ACE exploit is there though, in case someone can come up with a better bootstrap code.<br /><br />EDIT: Made a typo, it&#039;s not D929, but D928. Fixed the screenshot too.


subject: Re: Arbitrary code execution in Red/Blue with cooltrainer glitch move.
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Surprised nobody found this yet. I&#039;ll look into other glitch moves. How do you find the pointers?


subject: Re: Arbitrary code execution in Red/Blue with cooltrainer glitch move.
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystal_
icon: xx
body:
  From data past this table: https://github.com/pret/pokered/blob/master/engine/battle/core.asm#L7142<br /><br />Note that move effects with id 80-FF point to same as 00-7F though (or rather 81-00 = 01-80), other than that the moment when they are called may be different.<br /><br />The pointers will be made up from the unused sleep effect function below the table.<br /><br />I tracked down other glitch moves in the past, but it&#039;s still pretty suboptimal. For example, glitch move TM42&#039;s effect handler points to CD11, which is the least significant byte of the player&#039;s active Pokemon&#039;s unmodified HP stat: https://www.youtube.com/watch?v=FoV9HUtVICE


subject: Re: Arbitrary code execution in Red/Blue with cooltrainer glitch move.
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Very nice job Crystal_, that makes another way to execute code in 1G. Joining 8F, Pikachu off-screen, B1F, TM42... maybe others too, at a time I was working on a way to execute code from tiles using \-g* (hex:6F) but never had the time to finish it.<br /><br />I&#039;ll tweet about this with prama&#039;s account&nbsp; ;D


subject: Re: Arbitrary code execution in Red/Blue with cooltrainer glitch move.
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This is already known and was used in the (now obsolete) [url=http://tasvideos.org/4064S.html]PokÃ©mon Blue TAS in 28:07.28 by MrWint[/url]. Except there, instead of trying to make use of the opponent Pokemon data, this area was just filled with harmless instructions to let the execution slide all the way to boxed Pokemon data at $DA80.<br />


subject: Re: Yellow Hex ID C9-FF, New glitch pokemon?
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]While I was doing this I made the discovery that you can hard reset whenever you get a trainer until it gives you a glitch pokemon with that hex.[/quote]<br /><br />That part is new to me, what did you do to make that happen exactly?


subject: Re: Yellow Hex ID C9-FF, New glitch pokemon?
poster_name: edwardsjs21
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I used the gameshark code 01(Hex)d7cf and saved the game. Then I walked into grass until I encountered a pokemon, if it was a trainer I just hard reset(pushed the power button) and tried again until a glitch pokemon appeared rather than a trainer. I&#039;ve found that the pokemon often take the sprite of pokemon you would normally encounter in that grass but keep the color of the glitch pokemon, that may be part of why it worked. 


subject: Re: Arbitrary code execution in Red/Blue with cooltrainer glitch move.
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You&#039;ll also need an X Accuracy to reliably hit with the move, or the move effect won&#039;t happen.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=6868.msg200476#msg200476 date=1465073099]<br />EDIT: ok, so if I patch the payload to contain a &quot;bx lr&quot; to allow it to return gracefully, it doesn&#039;t screw up.<br /><br />The payload should really start with [tt]push {r0, lr}[/tt] and end with [tt]pop {r0, pc}[/tt] (instead of [tt]pop {r4-r7, pc}[/tt] which i think actually returns to the caller&#039;s caller!).<br />[/quote]<br /><br />That&#039;s good news !<br /><br />So, how would Thezzazz&#039;s code executions change ?<br /><br /><br /><br />[quote author=TheZZAZZGlitch link=topic=6868.msg200293#msg200293 date=1462631216]<br />Code (at $0E0F14D0):<br />&nbsp; ; Load whatever we want to R0<br />&nbsp; mov r0, #0x[byte to write]<br />&nbsp; ; Load the address we want to write to<br />&nbsp; ldr r1, [r15+0x4]<br />&nbsp; ; Store the value of R0 to byte at R1<br />&nbsp; strb r0, [r1]<br />&nbsp; ; Pops registers R4 through R7 from the stack and returns.<br />&nbsp; ; (R15 is instruction pointer)<br />&nbsp; pop {r4-r7, r15}<br />&nbsp; ; This is where the destination RAM address is loaded from<br />&nbsp; dcd 0x[address, 1st byte][address, 2nd byte][address, 3rd byte][address, 4th byte]<br /><br />As code :<br />20 [byte to write] 01 49 08 70 F0 BD [address, 4th byte] [address, 3rd byte] [address, 2nd byte] [address, 1st byte] <br />[/quote]<br /><br />[quote author=TheZZAZZGlitch link=topic=6868.msg200297#msg200297 date=1462656539]<br />[b]Code (at $E0F14D0):[/b]<br />&nbsp; [i]; Previous setup to execute a subroutine[/i]<br />&nbsp; mov r0, r15<br />&nbsp; add r0, #0x9<br />&nbsp; mov r14, r0<br />&nbsp; [i]; Pointer to the script engine subroutine[/i]<br />&nbsp; ldr r1, =RunScriptOffset<br />&nbsp; [i]; The script engine subroutine takes the pointer to a script in R0[/i]<br />&nbsp; ldr r0, =ScriptDataOffset<br />&nbsp; [i]; Do some magic[/i]<br />&nbsp; bx r1<br />&nbsp; pop {r4-r7, r15}<br />&nbsp; [i]; This nop is necessary because 4 byte alignment for ldr[/i]<br />&nbsp; nop<br />RunScriptOffset:<br />&nbsp; [i]; Pointer to the script engine subroutine[/i]<br />&nbsp; dcd 0x08098EF9<br />ScriptDataOffset:<br />&nbsp; [i]; Pointer to the script data[/i]<br />&nbsp; dcd 0x0E0F14E8<br />[b]The overworld script to execute (at $E0F14E8):[/b]<br />&nbsp; [i]; lol credits[/i]<br />&nbsp; special 0x0113<br />&nbsp; end<br />[b]As hexadecimal data :[/b]<br />78 46 09 30 86 46 03 49 01 48 08 47 F0 BD XX XX E8 14 0F 0E F9 8E 09 08[/tt]<br />[/quote]<br /><br /><br />Also, what would be the structure of a code that changes multiple RAM values before returning ?<br />(I&#039;m still a non-initiated to ARM and I can&#039;t find what hexadecimal values correspond to pop {r4-r7, r15} in the code.)<br /><br />Since setting up PC Items takes time (it becomes more tedious if you have to remove PC Items to write another code), codes that perform multiple useful commands at once would gain time in the writing procedure (like unlocking all islands, repop most of the legendaries, set multiple event flags, get mirage island and .., setting a swarm,...).<br /><br />I&#039;ll look back into RS Glitch Moves to find ones that have a convenient Animation Pointer for RS 1.2 (and that doesn&#039;t mess up the fight), because the pointer should point towards the second substructure of a PC PokÃ©mon for the Bootstrap code.<br />Else, we would need an ACE on Emerald to write the Bootstrap code on anoter area of a in-game traded PokÃ©mon data.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheZZAZZGlitch
icon: xx
body:
  In US Emerald, &#039;bx lr&#039; does not return gracefully at all:<br /><br />[img]http://i.imgur.com/LLUoUIe.png[/img]<br /><br />Either the calling conventions change between versions, or I&#039;m doing something wrong. It looks like it tried to return to a RAM address, so something&#039;s probably pushed on the stack after all.<br /><br />The code to change a full 4-byte aligned dword would be this:<br />[tt]At $0E0F14C0 (box item 11):<br />&nbsp; ; (same stuff as before)<br />At $0E0F14D0 (box item 15):<br />&nbsp; ; This is the data to write<br />&nbsp; ldr r0, [r15+0x8]<br />&nbsp; ; The address where we want to store the value<br />&nbsp; ldr r1, [r15+0x4]<br />&nbsp; ; Store the value of R0 to dword at R1<br />&nbsp; str r0, [r1]<br />&nbsp; ; Return<br />&nbsp; pop {r4-r7, r15}<br />&nbsp; ; This is where the destination RAM address is loaded from<br />&nbsp; dcd 0xXXXXXXXX<br />&nbsp; ; This is where the value to write is loaded from<br />&nbsp; dcd 0xYYYYYYYY[/tt]<br /><br />Hex:<br />[tt]02 48 01 49 08 60 F0 BD XX XX XX XX YY YY YY YY[/tt]<br />The code has to be 4-byte aligned.<br /><br />Also, [tt]bx lr[/tt] is [tt]70 47[/tt]


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I made such a payload with those changes (and same code size):<br /><br />[tt]; fasmarm syntax<br />processor cpu32_v4t ; ARMv4t (GBA cpu)<br />thumb ; we don&#039;t want an ARM-mode payload<br />; code starts below<br />push {r0, lr} ; save r0, lr to stack<br />ldr r1, [script_run] ; r1 = ptr to script_run()<br />ldr r0, [script_vmip] ; r0 = ptr to script bytecode<br />bl _call_via_r1 ; let the CPU set up lr itself<br />pop {r0, pc} ; restore r0, and return<br /><br />_call_via_r1:<br />bx r1<br /><br />nop ; for alignment<br /><br />script_run:<br />dw 0x080655D9<br />script_vmip:<br />dw 0x02025be4[/tt]<br /><br />hex representation:<br />[tt]01 B5 03 49 03 48 00 F0 01 F8 01 BD 08 47 C0 46 D9 55 06 08 E4 5B 02 02[/tt]<br />(where [tt]D9 55 06 08[/tt] is the offset of script_run() as little endian and [tt]E4 5B 02 02[/tt] is where your script is)<br /><br />and it seemed to work, at least it didn&#039;t call into the payload again then return back to some part of RAM; but it still essentially froze.<br /><br />Some investigation later, it seems that it&#039;s getting into an infinite loop.. calling the payload...<br /><br />Not sure what else to try.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I figured it out.<br /><br />Remember that animation opcode 0x03 creates a new task: it happens to call the address you give it as well.<br /><br />It also increases a counter, named [tt]move_anim_active_task_count[/tt] in the FireRed IDB.<br /><br />Animation opcode 0x08 is essentially a no-op if [tt]move_anim_active_task_count[/tt] &gt;= 0.<br /><br />So, you need to remove the task (otherwise, the game will keep calling the payload over and over, and will freeze as the animation will never end).<br /><br />(How the game continued in FR/LG/Emerald remains a mystery to me.)<br /><br />You do this by calling a function named [tt]move_anim_task_del()[/tt] in the FireRed IDB. Its location is 0x8072760 in FireRed US, 0x8075928 in Ruby US v1.2.<br /><br />As for how to find it in other games, search for [tt]08 78 01 38 08 70 01 BC 00 47[/tt]; the function entry point should be the [tt]00 B5[/tt] 12 bytes before. There are two matches very close to each other: the first match is what you&#039;re looking for (the functions are identical apart from the RAM address whose value gets decremented)<br /><br />Anyway, [tt]move_anim_task_del()[/tt] takes one argument: the task index to delete. Thing is, we don&#039;t know the task index, at least initially. However, the second time the payload gets called, the task index is in r0.<br /><br />So, how to detect that?<br /><br />It&#039;s really quite easy: the first time the payload gets called, r1 points to ROM; otherwise, it points to RAM. So, a payload like this could be used:<br /><br />[tt]; fasmarm syntax<br />processor cpu32_v4t ; ARMv4t (GBA cpu)<br />thumb ; we don&#039;t want an ARM-mode payload<br />; code starts below<br />push {r0-r1, lr} ; save r0, r1, lr to stack<br />; is this our first time? if so, run the payload<br />lsrs r1,24<br />cmp r1,8<br />beq run_payload<br />; we&#039;re being called a second time, just remove the task<br />ldr r1, [move_anim_task_del]<br />bl _call_via_r1<br />pop {r0-r1, pc}<br />run_payload:<br />; actual payload here<br />ldr r1, [script_run]<br />ldr r0, [script_vmip]<br />bl _call_via_r1<br />pop {r0-r1, pc}<br /><br />_call_via_r1:<br />bx r1<br /><br />; hey, perfectly aligned now!<br /><br />move_anim_task_del:<br />dw 0x08075929<br />script_run:<br />dw 0x080655D9<br />script_vmip:<br />dw 0x02025be4[/tt]<br /><br />Hex representation:<br />[tt]03 B5 09 0E 08 29 03 D0 04 49 00 F0 06 F8 03 BD 03 49 04 48 00 F0 01 F8 03 BD 08 47 29 59 07 08 D9 55 06 08 E4 5B 02 02[/tt]<br /><br />Remember to change the last three 32-bit integers for your game/version/language.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Beastachu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=avemflamma link=topic=7436.msg200409#msg200409 date=1463614782]<br />Not sure if anyone has said this yet, but I can confirm that the Save Corruption glitch is still in the game. I pulled it off on my official copy of Red and have been having a great time messing around with it. I even got a wild encounter to start up in Oak&#039;s lab just by switching around pokes!<br />[/quote]<br /><br />What method did you use for the save corruption? I&#039;m not sure if it&#039;s just timing, or if it&#039;s a safety mechanism on the N3DS, but I&#039;ve tried shutting the system, killing the game from the home menu &amp; even pulling the battery out n I got nuthin


subject: Re: Aren't carts great?
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Carl Miller link=topic=7482.msg200497#msg200497 date=1465347021]<br />Mow lawns. Wash cars. Beg a friend who has $45. :P<br />[/quote]<br />this. <br /><br />Hell, git gud at games and make a money match with somebody you know you can&#039;t lose to. I&#039;ve made decent sums of money from just knocking people&#039;s ego down to level in sm4sh. <br /><br />[s]steal<br />[/s]<br />Or even better, do what i primarily do and get job. 


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Beastachu link=topic=7436.msg200499#msg200499 date=1465363515]<br />[quote author=avemflamma link=topic=7436.msg200409#msg200409 date=1463614782]<br />Not sure if anyone has said this yet, but I can confirm that the Save Corruption glitch is still in the game. I pulled it off on my official copy of Red and have been having a great time messing around with it. I even got a wild encounter to start up in Oak&#039;s lab just by switching around pokes!<br />[/quote]<br /><br />What method did you use for the save corruption? I&#039;m not sure if it&#039;s just timing, or if it&#039;s a safety mechanism on the N3DS, but I&#039;ve tried shutting the system, killing the game from the home menu &amp; even pulling the battery out n I got nuthin<br />[/quote]<br /><br />The VC release have a Resume/Reset option.<br /><br />I&#039;m unsure if it&#039;s possible to disable it and if you might not have it, but you can pull of the glitch if you try touching &quot;Reset&quot; on the Touch Screen&#039;s Virtual Console menu after you press save, shortly after the Yes/No box disappears but before the text becomes blank. The timing must be precise, if you do it too early or late you might get no save, a corrupted unusable save, or a normal save file.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Beastachu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  O thanx! I kinda skipped the reset function as I assumed it would have some kind of safety feature to it, it being virtual console n all.


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Beastachu link=topic=7436.msg200502#msg200502 date=1465444338]<br />O thanx! I kinda skipped the reset function as I assumed it would have some kind of safety feature to it, it being virtual console n all.<br />[/quote]<br />You&#039;re welcome!


subject: ACE: Manipulate encounter
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So, I need to manipulate my next encounter. How can I do that with ACE? More importantly, I need to know Assembly in order to write by myself the code or there&#039;s some kind of converter from C or C# or anything else (like XSE for GBA games)?<br />I want to fight the professor OAK in EU Version of pokemon Red with his real team, not glitched.<br />Any suggestion?<br /><br />PS: I&#039;m specifically interested in this method, I know I can achieve that with ditto&#039;s glitch


subject: Re: The Member's Guide to Topiclessness
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m fucking terrified to use elevators in Duke Nukem 64 now.<br /><br />There I was, dicking around Area 51 and coming upon the room with the big blue spaceship in it. Once I got the access card to activate the elevator at the far end of the room, I hear the familiar roar of the Mini Battlelord.<br /><br />My plan was to place a bunch of pipe bombs in the elevator and then have it drop to the lower level, where that asshole was walking around, and detonate them. It worked the first time, and I heard his damage roar.<br /><br />But I forgot the shithead knew how elevators worked.<br /><br />Once the elevator comes back up, I am greeted by that big stupid minotaur and all his grenades and turrets, dying as ingloriously as possible.<br /><br />F**k you, Mini Battlelord. I don&#039;t like you as a boss, and I sure as fuck don&#039;t like you for being a cheap cop-out of an enemy.


subject: Re: ACE: Manipulate encounter
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Dante link=topic=7506.msg200506#msg200506 date=1465581342]<br />So, I need to manipulate my next encounter. How can I do that with ACE? More importantly, I need to know Assembly in order to write by myself the code or there&#039;s some kind of converter from C or C# or anything else (like XSE for GBA games)?<br />I want to fight the professor OAK in EU Version of pokemon Red with his real team, not glitched.<br />Any suggestion?<br /><br />PS: I&#039;m specifically interested in this method, I know I can achieve that with ditto&#039;s glitch<br />[/quote]<br /><br />Hi Dante. Modifying D059 (PokÃ©mon/Trainer) and D05D (Roster) (or D058 and D05C in Yellow) will allow you to access every PokÃ©mon with index numbers 1-199, and every real (and many glitch) Trainers in the game. The values for Professor Oak are 226 in D059 and 1 (Blastoise), 2 (Venusaur) or 3 (Charizard) in D05D.<br /><br />The following code will enable you to access the Professor Oak roster of your choice.<br /><br />[code]3E E2 EA 59 D0 04 3E xx EA 5D D0 C9[/code]<br /><br />Lemonade x226<br />TM34 x89 (x88 in Yellow)<br />TM08 x04<br />Lemonade x (roster)<br />TM34 x93 (x92 in Yellow)<br />TM08 x201<br /><br />To look up the ASM interpretation of the code, refer to [url=http://iimarck.us/etc/asmopcodes.txt]this page[/url].<br /><br />We can walk through the code I just wrote, below.<br /><br />ld a, E2&nbsp; - Register &#039;a&#039; becomes E2; the value for Prof. Oak in the [url=http://glitchcity.info/wiki/index.php/The_Big_HEX_List]Big List[/url]<br />ld (D059),a - Load &#039;a&#039; into D059 (instant encounter address)<br />inc b - Useless code, added for good item representation<br />ld a, xx - Register &#039;a&#039; becomes the roster value (we want 1, 2 or 3)<br />ld (D05D),a - Load &#039;a&#039; into D05D (Trainer roster)<br />ret - End code (actually return to the address in sp, which we have not changed)<br /><br />Memory addresses can be found at [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map]Datacrystal and on the PokÃ©mon Red disassembly[/url].<br /><br />There is a C-language to Game Boy game converter [url=http://www.loirak.com/gameboy/gbprog.php]on this website[/url] that may be useful (although I&#039;ve never tried this) if you want to make a game to execute such as Pong (first use 8F or ws m to store the code in free space such as boxed PokÃ©mon, and then jump to it).<br /><br />However, if you simply want to edit a memory address or call an existing ROM function, you&#039;re best off writing the raw code.<br /><br />Hope that helps!


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Shina69 link=topic=6638.msg200387#msg200387 date=1463266555]<br />Thanks a lot for the wise and meticulous explanation, Torchickens!<br />Sure it&#039;s a wonder the possibilities that Item Underflow brings as well as glitch items, i followed all the steps on SRAM glitch topic and it&#039;s a all new world. But, recently, i got more interested on these new recent challenges like the no save corruption speedruns and others that avoid the usage of expanded items pack. I looked through the forum archives and also found players trying to beat the game without battling team rocket members and that made me wonder: is it actually possible to complete pokemon yellow on such conditions plus without time cable exploits of any kind? I followed their topic (http://forums.glitchcity.info/index.php/topic,7448.0.html), but answers stopped a few months ago :(<br />[/quote]<br /><br />You&#039;re welcome! I don&#039;t know the answer to that I&#039;m afraid. Though it&#039;s possible to avoid at least some of the Rockets, including:<br /><br />1) Regular Mt. Moon Rockets (you don&#039;t need to fight them).<br />2) [url=https://www.youtube.com/watch?v=pA3mumxJYJw]Jessie &amp; James on Mt. Moon[/url] (but note in Paco81&#039;s video he escapes from a long-range Rocket in Mt. Moon using an Escape Rope).<br />3) Rocket HQ rockets: PokÃ© Doll PokÃ©mon Tower skip.<br />4) Silph Co. Rockets: [url=https://www.youtube.com/watch?v=TYNqXzTKzcw]Removing[/url] the gym NPC with the Trainer escape glitch(??)<br /><br />If there is a way to obtain a &quot;Rival&#039;s effect&quot;/&quot;Jack effect&quot; (walk through walls item) early such as &quot;o&quot; (hex:94) before Nugget Bridge, that could possibly be used to bypass the Nugget Rocket and the Rocket blocking the Dig TM NPC&#039;s house. It could also be used to bypass the Rocket blocking Fuchsia City&#039;s gym (though you might need to Teleport or Dig away after), also eliminating the need to battle PokÃ©mon Tower&#039;s Jessie &amp; James.<br /><br />[hr]<br /><br />If you want to use 8F or ws m for many tasks, it&#039;s worth it to turn it into an in-built GameShark so you can use it without re-obtain items for different uses (in the case you tossed a quantity but need a higher quantity than what you have left to do something else).<br /><br />This long code will load the quantity of Lemonade into the address represented by the quantity of Carbos (address first byte) and X Accuracy (address second byte) and reset the quantities back to 0 (actually 256 and tossable to obtain any quantity), so you can truly write whatever you want in RAM, WRAM as many times as you like without having to obtain items again if a quantity is too low.<br /><br />You can get all of the items below with the [url=http://glitchcity.info/wiki/index.php/Celadon_looping_map_trick]Celadon looping map trick[/url].<br /><br />[code]3E xx 26 xx 2E xx 04 77 26 D3 3E 00 2E 23 04 22 23 22 23 22 C9[/code]<br /><br />Lemonade x(xx)<br />Carbos x(yy)<br />X Accuracy x(zz)<br />PokÃ© Ball x119<br />Carbos x211<br />Lemonade x0<br />X Accuracy x35 (x34 in Yellow)<br />PokÃ© Ball x34<br />HP Up x34<br />HP Up x34<br />TM01 x0<br /><br />ld a, 00 - a (value)=xx<br />ld h, 00 - h (address byte 1)=yy<br />ld l, 00 - l (address byte 2)=zz<br />inc b - useless code<br />ld (hl),a - load a into the address (e.g. D059)<br />ld h, D3 - we load the address byte 1 as D3 (item quantities are in the D3XX region)<br />ld a, 00 - we load &#039;a&#039; as 0 (quantity of 0)<br />ld l,&nbsp; 23 - l=23, now our address is D323 (item 3 quantity)<br />inc b - useless code<br />ld (hli),a - means we put &#039;a&#039; in D323, and then increase the hl value to D324<br />inc hl -&nbsp; hl value=D325<br />ld (hli),a - means we will load a (0) into D325 (item 4 quantity), and increase hl to D326<br />inc hl - hl value =D327<br />ld (hli),a - means we put &#039;a&#039; in D327 (item 5 quantity) 


subject: Re: ACE: Manipulate encounter
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dante link=topic=7506.msg200509#msg200509 date=1465597497]<br />Thank you a lot&nbsp; ;D really good stuff<br />[/quote]<br />You&#039;re welcome!


subject: Item duplication in EU Pokemon RED
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve tried to find a way to duplicate my items but I couldn&#039;t so here we are again.<br />The most common way to duplicate items is with missigno, but in the eu version that is a really hard way to get that.<br />I need duplication for 2 things:<br />1- More rare candy in order to get a Pidgey with 233 HP and set up the 7F ACE.<br />2- More TM in order to execute code.<br />How can I do?


subject: Re: Item duplication in EU Pokemon RED
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, your question is tricky because yes, encountering MissingNo. for us europeans is a big problem. Hopefully we have found a way [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]to get a x255 item without MissingNo.[/url] which allows us to do the item underflow and thus, get the 8F item. Moreover, once that is possible, you can duplicate your items using ACE.<br /><br />But your case is probably the last flaw in the system, as you need specific items to be duplicated in order to execute code. I&#039;d like to mention that you can perform a very simple 8F code with easy-to-get items to obtain any item you want:<br /><br />&nbsp; &nbsp; 8F<br />&nbsp; &nbsp; Any item which hex ID goes +1 once the code is active (quantity stays the same, so any x255 item obtained via underflow could be used, and then you could throw as much as necessary)<br />&nbsp; &nbsp; Burn Heal x43<br />&nbsp; &nbsp; Ice Heal x43<br />&nbsp; &nbsp; Full Heal x201<br /><br />Anyway, this still requires you to have a proper 8F setup. I&#039;m guessing the easiest thing is using the underflow. You probably know that you can use &quot;loop subglitches&quot; involving 35th and 36th items to change the quantity and the nature of an item.<br /><br /><br />


subject: Re: Item duplication in EU Pokemon RED
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7507.msg200513#msg200513 date=1465748463]<br />Well, your question is tricky because yes, encountering MissingNo. for us europeans is a big problem. Hopefully we have found a way [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]to get a x255 item without MissingNo.[/url] which allows us to do the item underflow and thus, get the 8F item. Moreover, once that is possible, you can duplicate your items using ACE.<br /><br />But your case is probably the last flaw in the system, as you need specific items to be duplicated in order to execute code. I&#039;d like to mention that you can perform a very simple 8F code with easy-to-get items to obtain any item you want:<br /><br />&nbsp; &nbsp; 8F<br />&nbsp; &nbsp; Any item which hex ID goes +1 once the code is active (quantity stays the same, so any x255 item obtained via underflow could be used, and then you could throw as much as necessary)<br />&nbsp; &nbsp; Burn Heal x43<br />&nbsp; &nbsp; Ice Heal x43<br />&nbsp; &nbsp; Full Heal x201<br /><br />Anyway, this still requires you to have a proper 8F setup. I&#039;m guessing the easiest thing is using the underflow. You probably know that you can use &quot;loop subglitches&quot; involving 35th and 36th items to change the quantity and the nature of an item.<br />[/quote]<br />Today I managed to get 7F for the first time. I did it because I read that 7F works on the eu version like 8F on the english one, tell me if I&#039;m wrong. I used your method, with the partial underflow of the pc (which i didn&#039;t fixed yet).<br />So tell me if I&#039;m wrong:<br />I have to setup the 7F (maybe with trainers glitch and underflow exp?), then get a 255 item from my pc, and use the 7F to get the item I want?


subject: Re: Item duplication in EU Pokemon RED
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  [quote author=Dante link=topic=7507.msg200512#msg200512 date=1465731566]<br />I&#039;ve tried to find a way to duplicate my items but I couldn&#039;t so here we are again.<br />The most common way to duplicate items is with missigno, but in the eu version that is a really hard way to get that.<br />I need duplication for 2 things:<br />1- More rare candy in order to get a Pidgey with 233 HP and set up the 7F ACE.<br />2- More TM in order to execute code.<br />How can I do?<br />[/quote]<br />For the Pidgey, I recommend you to use a Trainer-Fly to get a level 1 Pidgey (remember, it must NOT be sent to your PC !), otherwise you&#039;ll need ~1h of rare candy&#039;ing + evolution cancelling.<br /><br />For the quantities, forget Krys&#039; long shenanigans. You can simply :<br />[list type=decimal]<br />[li]Get a Cooltrainer Ditto (y&#039;know the drill...)[/li]<br />[li]Go to any cave[/li]<br />[li]Have an encounter[/li]<br />[li]Open the PkMn or the Item menu then close it[/li]<br />[li]Open and close the Fight menu until the PokÃ©mon are corrupted[/li]<br />[li]Catch the opponent[/li]<br />[li]Now your items are duplicated ![/li]<br />[li]Open your START menu before exiting the cave, and you&#039;re done ![/li]<br />[/list]<br /><br /><br />Note that this won&#039;t work for Yellow, but our EU Yellow Missingno is stable (yay !), so no worries &#039;bout that.<br />Once you got at least one item cloned, you can have a simpler item setup that will have 7F multiply items :<br />[code]<br />(Starting from the first item)<br />7F<br />Duplicate item x(any qty)<br />Lemonade x1<br />Soda Cool x43<br />PokÃ© Ball x119<br />TM01 x(any qty)<br />[/code]<br />(For the PokÃ© Balls, have 1, clone it, then toss 10 of them)<br /><br />This should give you 0 items in the second slot. The game won&#039;t delete the stack of items like you would expect it to, but you can toss items and it will behave as if you had 256 of it. That is, tossing 1 will give you 255, etc.<br />Remember, for every other action, this is a stack of 0 items. So, tossing 0 items will... delete the stack. Meh.


subject: Re: Item duplication in EU Pokemon RED
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &quot;8F&quot; refers to the same item in every game. But the 8F item is called 7EME ETAGE in french, and probably something like P7 in italian. That&#039;s just because steps are not counted in the same way in english.


subject: Re: Pokemon Yellow - Missing Helix Fossil Glitch!?
poster_name: Power_Noob
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Power_Noob
icon: xx
body:
  I&#039;m playing yellow on the gbasp and this same thing happened to me. I&#039;d transferred an Abra I caught from gold so I could use teleport as early as possible in yellow and start working trainers to see wut cool glitchmon I could generate. Got some cool ones in the process and thought that I could do it with the supernerd and team rocket but it would not allow me to. In any case, it appears that if u use that glitch in Mt.moon the helix fossil will not be available for u to pick up, yet when u beat the supernerd, he still gives u the choice to grab it as if it is still there...I mean, for HIM it&#039;s there because once u grab the dome fossil he walks to the space right before where the helix should be and claims his invisible fossil. ::shrug:: #kabutoiscooleranyway but it&#039;s still a weird thing for the game to do, totally threw me off.<br /><br />I never knew u could make (a) snorlax disappear either... that&#039;ll make things interesting...


subject: Re: Item duplication in EU Pokemon RED
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7507.msg200516#msg200516 date=1465836477]<br />&quot;8F&quot; refers to the same item in every game. But the 8F item is called 7EME ETAGE in french, and probably something like P7 in italian. That&#039;s just because steps are not counted in the same way in english.<br />[/quote]<br /><br />in US english*


subject: Re: Pokemon Yellow - Missing Helix Fossil Glitch!?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  http://forums.glitchcity.info/index.php/topic,7490.0.html<br />This is what happened. Your &quot;illegitimate&quot; encounter confused the game into removing the Helix Fossil.<br />It didn&#039;t fail to load, you tricked the game into despawning it.


subject: Analyzing the chance of Wally fainting the Ralts in Generation III
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Bulbapedia states:<br /><br />[quote]In the Generation III games, it is possible for the capture tutorial to end with Ralts fainting. This can only happen if Zigzagoon is generated with 11 Attack, and the wild Ralts has a Nature that lowers Defense, an IV of 3 or less in HP, and 5 or less in Defense. With all this, Zigzagoon can do a maximum of 10 damage with its first Tackle, and after Growl is used on it, 7 with its second. This makes for a total of 17 damage, just enough to knock out Ralts. However, the game continues on as if it had been caught. The probability of this occurring is (182/800)*(4/25)*(4/32)*(6/32)*(5/16)*(7/16), or about 1 in 8574.[/quote]<br /><br />A video of Wally fainting the Ralts can be found here:<br /><br />[youtube]https://www.youtube.com/watch?v=xERTYBk3Txk[/youtube]<br /><br />Somebody asked me a good question and wondered where the probabilities came from, so I took a guess at working that out.<br /><br />[quote]<br />Hi. I looked into this for you but I don&#039;t know the full answer sadly. That&#039;s OK, your English is good.<br /><br />Bulbapedia says the Zigzagoon must be made with 11 Attack, Ralts must have a nature that lowers Defense, an IV of 3 or less in HP, and 5 or less in Defense and the probabilities are (182/800)*(4/25)*(4/32)*(6/32)*(5/16)*(7/16), or about 1 in 8574.<br /><br />When we work out the probabilities of multiple events occurring, we use multiplication.<br /><br />The first event 182/800, I&#039;m unsure why this might be.<br /><br />The second event is 4/25 because there are four natures that lower Defense, Lonely, Hasty, Mild and Gentle.<br /><br />The third event is 4/32 because every IV including HP takes up four bits (2^4=32). It might be 4/32 and not 3/32 because 0 is a possible Defense IV.<br /><br />The fourth event is 6/32 for the same reason (there are six possible Defense IVs that will work; 0, 1, 2, 3, 4 and 5.<br /><br />I&#039;m unsure why the fifth event is 5/16 and the last event is 7/16. <br /><br />I don&#039;t know if this is a valid approach. However, there are 14/32 (which can be simplified as 7/16) possibilities for exactly 11 Attack for a Zigzagoon at a +Attack nature, plus 6/32 possibilities for 12 Attack at a +Attack nature. There are also 6/32 possibilities for a neutral Attack nature Zigzagoon to have 11 Attack (it cannot have 12).<br /><br />For Zigzagoon to have an Attack of 11 or 12 at level 7, it must have an Attack IV of at least 12 at a +Attack nature, or at least 26 at a nature which doesn&#039;t boost Attack. The chances of this might be ((4/25) [positive Attack nature amount]+(17/25) [all neutral Attack natures]))*((20/32) [the total of positive nature IV possibilities for 11+ Attack])+ (6/32) [the total of neutral nature IV possibilities for 11+ Attack] = 0.6825 (273/400).<br /><br />(4/25)*(4/32)*(6/32)*(273/400)=0.16*0.125*0.1875*0.6825=0.002559375. This is actually 1 in 390.72 (we can round this up to 391), so there is the possibility that Wally fainting the Ralts is more likely than previously thought, but my math may be incorrect.<br />[/quote]<br /><br />I worked out the number of viable IVs for a level 7 Zigzagoon with 11 and 12 Attack using the save file editor &quot;A-Save&quot;. It&#039;s likely that I made an error because I don&#039;t consider myself to be very good at maths. However, there could also be an error with A-Save, or my logic, or my calculation method.<br /><br />Edit: I didn&#039;t consider that the damage Ralts takes in battle might vary, even when both PokÃ©mon have the same stats.


subject: Re: Item duplication in EU Pokemon RED
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7507.msg200516#msg200516 date=1465836477]<br />&quot;8F&quot; refers to the same item in every game. But the 8F item is called 7EME ETAGE in french, and probably something like P7 in italian. That&#039;s just because steps are not counted in the same way in english.<br />[/quote]<br />Yeah I realized that the F stood for &quot;Floor&quot; when i did it in italian. In ITA, it&#039;s called 7Â° P.


subject: Re: Recent purchases
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I bought a blue Jay Jr. acoustic guitar on Friday for $70. And got a free Steven Seagal movie with it.<br /><br />Pawn shops rule.


subject: Re: Analyzing the chance of Wally fainting the Ralts in Generation III
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The 182/800 figure is the probability of Zigzagoon having 11 or 12 Attack. Itâ€™s based on the same figures you came up with, but the correct calculation for the probability of Zigzagoon having an Attack-enhancing nature [i]and[/i] 12â€“31 IVs, [i]or[/i] an Attack-neutral nature [i]and[/i] 26â€“31 IVs, is (4/25 Ã— 20/32) + (17/25 Ã— 6/32) = 182/800.<br /><br />The next three figures are the probabilities of Ralts having a Defense-reducing nature, 0â€“3 HP IVs, and 0â€“5 Defense IVs. But by my calculations, Ralts can actually have up to 9 Defense IVs and still end up with a Defense stat of 6, so the probability of Ralts being vulnerable to a two-hit KO should be 4/25 Ã— 4/32 Ã— 10/32 = 1/160.<br /><br />The last two figures are apparently meant to be the probability that the 85%â€“100% random damage multiplier will be high enough to deal 10 damage on the first attack and 7 on the second. Assuming that [url=https://pokemonshowdown.com/damagecalc/]PokÃ©mon Showdownâ€™s damage calculator[/url] is accurate (is it?), those figures are also wrong: if the damage roll is anything less than 100%, the damage will be rounded down and Zigzagoon will be unable to KO Ralts. The probability of a 100% roll is 1/16, so the probability of two in a row is (1/16)[sup]2[/sup] = 1/256.<br /><br />The probability of all these things happening at once would thus be 182/800 Ã— 1/160 Ã— 1/256 = 182/32768000, or about 1 in 180â€¯044.


subject: Re: Recent purchases
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Pawn shops are pretty dece.<br /><br />Meanwhile, I went to Walmart the other day and got:<br />Â· a Logitech MK520 wireless keyboard and mouse<br />Â· a 64GB flash drive<br />Â· new earbuds<br />Â· a new phone charger cable


subject: Emulating the Mobile Adapter GB
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Itâ€™s been over fifteen years and no one has done this yet?<br /><br />(This post is necessarily going to be filled with technical minutiae, so if thatâ€™s not your thing, you may want to skip the entire first half of it and skim through the rest. If that [i]is[/i] your thing, then you donâ€™t need me to tell you what to do.)<br /><br />Iâ€™ve documented most of the protocol that Game Boy Color games use to communicate with the Mobile Adapter GB, and written a proof-of-concept implementation that links with BGB and enables Mobile Trainerâ€™s initial setup and PokÃ©mon Crystalâ€™s Trade Corner to work. Because Iâ€™ve been working with BGB, Iâ€™ve not yet tested anything with Game Boy Advance games, but I would expect that the protocol is the same and it should be possible to create an implementation compatible with VBA-M in the future.<br /><br />As all of this information has been determined solely from analysis of Mobile Trainer and PokÃ©mon Crystal, I canâ€™t say whether this documentation represents how the Mobile Adapter GB hardware actually behaves, but it at least represents how these games seem to expect it to behave.<br /><br /><br />[size=12pt][b]Protocol description[/b][/size]<br />The Game Boy Color communicates with the Mobile Adapter GB at a clock speed of 512 KiHz (bits 0 and 1 of the SC register are set and the GBC is in double-speed mode). The protocol closely resembles the one used by the Game Boy Printer, but it has been modified for two-way communication.<br /><br />A communication session consists of a series of commands sent by the Game Boy Color, each followed by a response from the Mobile Adapter GB, generally using the same command ID as the command it is responding to. A session begins with the Game Boy Color sending command $10 with the body [tt]&quot;NINTENDO&quot;[/tt], and the Mobile Adapter GB replying with the same. The session ends when the Game Boy Color sends command $11, and the Mobile Adapter GB responds in kind.<br /><br />When either device sends a packet, it begins by sending the preamble bytes $99 $66, followed by the packet data. After the packet is finished, both the sender and receiver transmit a byte containing their device ID xor $80. (The Game Boy Colorâ€™s device ID is $00. Any device ID from $08 to $0F is recognized as a Mobile Adapter GB: $08 is the PDC model, $09 is the CDMA model, $0A is the unreleased DoCoMo PHS model, and $0B is the DDI PHS model. $0Câ€“0F were presumably reserved for future use.)<br /><br />After the device ID, the sender sends $00 while the receiver confirms successful receipt of the packet by sending the packetâ€™s command ID xor $80. If the packet checksum fails, the recipient sends $F1 instead, which instructs the other device to resend the packet. ($EE, $F0, and $F2 also appear to be error codes, but I donâ€™t know how theyâ€™re used.)<br /><br />The packet itself consists of a four-byte header, followed by the body, followed by a two-byte big-endian checksum, which is the sum of each preceding byte (not including the $99 $66 preamble). The first byte of the header is the command ID, and the fourth is the length of the packet body. The second and third bytes are unused, as far as I know, and are set to $00. While a packet is being received, the recipient continuously transmits the byte $4B.<br /><br /><br />[size=12pt][b]Command listing[/b][/size]<br />This list covers all of the commands supported by the standard library found in PokÃ©mon Crystal. There is also at least one command, $1A (write configuration data), that is exclusively used by Mobile Trainer. Itâ€™s possible that some of the missing numbers are commands that exist in the hardware but were never used by any software; for instance, I would expect that there are commands for opening and closing UDP connections.<br /><br />The command numbers appear to be organized such that commands numbered $1x relate to the basic operation of the Mobile Adapter GB and its attached telephone, while commands numbered $2x are network operations.<br /><br />[b]$10: Begin session[/b]<br />Sent to the adapter at the start of a session. The packet body is the ASCII string [tt]&quot;NINTENDO&quot;[/tt]. The adapter replies with an identical packet.<br /><br />[b]$11: End session[/b]<br />Sent to the adapter at the end of a session. The packet body is empty. The adapter replies with an identical empty packet.<br /><br />[b]$12: Dial telephone[/b]<br />Instructs the adapter to dial a telephone number. The packet body contains one byte of unknown significance, followed by the telephone number written in ASCII. The adapterâ€™s response has an empty body.<br /><br />[b]$13: Hang up telephone[/b]<br />Instructs the adapter to hang up a telephone connection. The packet body is empty. The adapter replies with an identical empty packet.<br /><br />[b]$14: Wait for telephone call[/b]<br />Instructs the adapter to wait for a telephone call to be received. The packet body is empty. The adapter replies with an identical empty packet (only when the call is received?).<br /><br />[b]$15: Transfer data[/b]<br />This command is used either to send data over a TCP connection opened with command $23, or directly to another Mobile Adapter GB. While a connection is open, the Game Boy sends this packet containing one byte of unknown significance followed by zero or more bytes of data to be transmitted. The adapter replies with one byte of unknown significance followed by zero or more bytes that it has received from the other end. This is repeated until the connection is closed. The adapter sets bit 7 of the command ID while it is connected to a server, so the replyâ€™s command ID appears as $95. When the remote server has closed the connection ([i]e.g.[/i], at the end of an HTTP response), the reply sets the command ID byte to $9F instead.<br /><br />[b]$17: Telephone status[/b]<br />Sent to the adapter before attempting to dial. The packet body is empty. The adapterâ€™s reply has one byte: $00 means that the telephone is ready to make a call, $04 or $05 means that the line is busy (Iâ€™m not sure what the difference between these values is?), and any other value seems to be an error. Some features of Mobile Trainer actually check this after dialing to make sure the line is active, but PokÃ©mon Crystal doesnâ€™t bother.<br /><br />[b]$19: Read configuration data[/b]<br />Requests a portion of the adapterâ€™s 192-byte configuration memory. The packet body consists of two bytes; the first is an offset and the second is the number of bytes to be read. The adapter replies with a body containing one byte of unknown significance (possibly the offset, although that would be redundant?) followed by the requested data. In practice, the configuration data is read in two chunks of 96 bytes; it should be technically possible to read the full 192 bytes at once, but reading in smaller chunks is probably more reliable.<br /><br />[b]$1A: Write configuration data[/b]<br />Writes to a portion of the adapterâ€™s 192-byte configuration memory. The packet body consists of one byte, which is an offset, followed by the bytes to be written. The adapterâ€™s reply has an empty body (or, at least, Mobile Trainer doesnâ€™t seem to care what the response is). As with the read command, Mobile Trainer chooses to write the data in two separate chunks (of 128 and 64 bytes).<br /><br />[b]$21: ISP login[/b]<br />Logs in to the DION service (which will then be used to connect to an Internet server). The packet body begins with the login ID and password, each prefixed by a byte denoting its length. The last eight bytes are the IPv4 addresses of two DNS servers. The adapterâ€™s reply has a four-byte body, which might be an IPv4 address assigned to the adapter, although that doesnâ€™t seem to be needed for anything in-game.<br /><br />[b]$22: ISP logout[/b]<br />Logs out of the DION service. The packet body is empty. The adapter replies with an identical packet.<br /><br />[b]$23: Open TCP connection[/b]<br />Opens a TCP connection to an Internet server. The packet body consists of an IPv4 address (four bytes) and a port number (two bytes, big-endian). The adapter replies with one byte of unknown significance. The adapter sets bit 7 of the command ID while it is connected to a server, so the replyâ€™s command ID appears as $A3.<br /><br />[b]$24: Close TCP connection[/b]<br />Closes a TCP connection to an Internet server. The packet body contains one byte of unknown significance. The adapter replies with one byte of unknown significance.<br /><br />[b]$28: DNS query[/b]<br />Looks up the IP address for a domain name, presumably using the DNS server addresses sent in command $21. The packet body is the domain name. The adapterâ€™s reply has a four-byte body containing the corresponding IPv4 address.<br /><br /><br />[size=12pt][b]Configuration memory[/b][/size]<br />The Mobile Adapter GB has 192 bytes of memory in which to store configuration data. This memory can be read with command $19 and written with command $1A. It is structured as follows:<br /><br />[code]$00&nbsp; &quot;MA&quot;<br />$02&nbsp; Set to $01 during Mobile Trainer registration<br />&nbsp; &nbsp;  Set to $81 when registration is successfully completed<br />$04&nbsp; Primary DNS server (210.196.3.183)<br />$08&nbsp; Secondary DNS server (210.141.112.163)<br />$0C&nbsp; Login ID (&quot;g_________&quot;)<br />$2C&nbsp; E-mail address (&quot;________@____.dion.ne.jp&quot;)<br />$4A&nbsp; SMTP server (&quot;mail.____.dion.ne.jp&quot;)<br />$5E&nbsp; POP server (&quot;pop.____.dion.ne.jp&quot;)<br />$76&nbsp; Configuration slot 1<br />$8E&nbsp; Configuration slot 2<br />$A6&nbsp; Configuration slot 3<br />$BE&nbsp; Checksum (big-endian)[/code]<br /><br />Strings are null-terminated if shorter than the fields which contain them.<br /><br />Each configuration slot may contain a telephone number to be used to connect to the ISP (eight bytes) and an identifying string (sixteen bytes). The telephone number is stored in a variant of binary-coded decimal, where $A represents the [tt]#[/tt] key, $B represents the [tt]*[/tt] key, and $F marks the end of the telephone number.<br /><br />If the device ID is $08 (PDC) or $09 (CDMA), Mobile Trainer will configure it to use the telephone number [tt]#9677[/tt] and identifying string [tt]&quot;DION PDC/CDMAONE&quot;[/tt]. If the device ID is $0A (DoCoMo PHS) or $0B (DDI PHS), it will be configured with the telephone number [tt]0077487751[/tt] and identifying string [tt]&quot;DION DDI-POCKET&quot;[/tt].<br /><br />These are always written to the first configuration slot; the other two slots are always empty (filled with $FF and $00), and itâ€™s unclear how they would have been used. (Iâ€™m guessing theyâ€™re there in case Nintendo wanted to support an ISP other than DION in the future?) PokÃ©mon Crystal has an option within the Mobile menu, titled ã€Œãƒ¢ãƒã‚¤ãƒ«ã‚»ãƒ³ã‚¿ãƒ¼ã‚’ã€€ãˆã‚‰ã¶ã€ [i]Choose a Mobile Center[/i], for selecting which of these three configuration slots it will use.<br /><br />If the device ID is one of the unused values $0Câ€“0F, Mobile Trainer will fill the entire configuration memory with garbage data, because bounds checking is for sissies.<br /><br />The checksum, like the packet checksum, is simply the sum of the preceding 190 bytes.<br /><br /><br />[size=12pt][b]Mobile Trainer[/b][/size]<br />[b]Initial setup[/b]<br />When the Mobile Trainer cartridge is first loaded with the Mobile Adapter GB connected, a setup wizard prompts the user to enter their DION login ID, e-mail address, and password. (According to [url=http://www.nintendo.co.jp/nom/0101/provider/]instructions published by the Nintendo Online Magazine[/url], these credentials were provided on the ã€Œï¼¤ï¼©ï¼¯ï¼®ãƒ¢ãƒã‚¤ãƒ«ï¼§ï¼¢ã‚³ãƒ¼ã‚¹ç™»éŒ²æ›¸ã€ [i]DION Mobile GB Plan Registration Form[/i] included in the Mobile Adapter GB box. The account would expire after 15 days unless the Registration Form was filled out and mailed to KDDI.)<br /><br />(Straying further from the topic, [url=http://www.geocities.jp/rikkyjp/ope/msgbphoto.html]this site has some photographs of the printed matter supplied with the Mobile Adapter GB[/url], which bizarrely includes a promotion offering baseballs signed by Kazuhiro Sasaki, then a pitcher for the Nintendo of Americaâ€“owned Seattle Mariners.)<br /><br />The login ID and e-mail address are stored in the adapterâ€™s configuration memory, and the user is asked to choose whether or not the password will be saved on the Mobile Trainer cartridge. After that, Mobile Trainer attempts to log in to the DION POP e-mail server ([tt]pop.____.dion.ne.jp[/tt], where the subdomain is filled in from the entered e-mail address). If the login is successful, then a welcome message is displayed, followed by the Mobile Trainer title screen.<br /><br />After setup has been completed, Mobile Trainer will boot to the title screen even when the Mobile Adapter GB is not connected. (If an adapter is connected, Mobile Trainer will still check whether it has been configured, and launch the setup wizard if needed.)<br /><br />[youtube]https://youtu.be/oE7J1UFYO4M[/youtube]<br /><br /><br />[b]Other features[/b]<br />I havenâ€™t put much effort into getting any other features of Mobile Trainer working, but they all appear to be fairly straightforward: the e-mail uses DIONâ€™s POP and SMTP servers, the account management options use a simple HTTP interface, and Nintendoâ€™s mobile homepage would have used some subset of HTML (though there probably arenâ€™t any complete surviving copies of the pages, there are a few screenshots in [url=http://www.nintendo.co.jp/nom/0107/05/index.html]this Nintendo Online Magazine article[/url]).<br /><br />However, there may be significant unused content in the Mobile Trainer ROM. The most obvious instance is some text for a debug menu thatâ€™s helpfully titled ã€Œï¼ï¼ã€€ï¼¤ï¼¥ï¼¢ï¼µï¼§ã€€ï¼­ï¼¯ï¼¤ï¼¥ã€€ï¼ï¼ã€. I also found this peculiar run of text:<br /><br />[quote]ã“ã‚“ã©ã€ã¾ãŸã‚ãã¼ã†<br />ãƒžãƒªã‚ª<br />ã¾ãŸã‚ãã¼ã†ã­<br />mario@mario.ne.jp<br /><br />ï¼—ãŒã¤ã®ã•ã„ã—ã‚‡ã®ã«ã¡ã‚ˆã†ã³ã«ã€ã‚„ãã‚…ã†ã‚’ã™ã‚‹ã‹ã‚‰ã“ã„ã‚ˆ<br />ã‚¯ãƒƒãƒ‘ã ã„ãŠã†<br />ã‚„ãã‚…ã†ã‚„ã‚‹ãž<br />kuppa@mario.ne.jp<br /><br />ã¤ã„ã«ãƒã‚±ãƒ¢ãƒ³ã®ã•ã„ã—ã‚“ã•ããŒã¨ã†ã˜ã‚‡ã†ã™ã‚‹ãžï¼ã€Œãƒã‚±ãƒƒãƒˆãƒ¢ãƒ³ã‚¹ã‚¿ãƒ¼è‹”ã€ãã‚ã—ãã¯ã«ã‚“ã¦ã‚“ã©ã†ã®ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã¸ï¼§ï¼¯ï¼<br />ãƒ¡ãƒ¼ãƒ«ãƒžã‚¬ã‚¸ãƒ³GB<br />GAMER&#039;s Life<br />grave01@natird.ad.jp<br /><br />ãƒ¡ãƒ¼ãƒ«ã‚»ãƒ³ã‚¿ãƒ¼ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã®ãŸã‚ã€7/14ï½ž7/20ã¾ã§ã®ãã‹ã‚“ã€ãƒ¡ãƒ¼ãƒ«ã‚’ãƒã‚§ãƒƒã‚¯ã§ããªããªã‚Šã¾ã™<br />ã‚ã‚‰ã‹ã˜ã‚ã”ã‚Šã‚‡ã†ã—ã‚‡ã†ãã ã•ã„<br />ï¼§ï¼¢ã‚»ãƒ³ã‚¿ãƒ¼<br />ã ã„ã˜ãªãŠã—ã‚‰ã›<br />ieve@makopi.ne.jp<br /><br />ããããƒ»ãƒ»ãƒ»<br />ã‚€ã ã„<br />p@p.ne.jp[/quote]<br /><br />To my knowledge, Bowser didnâ€™t play baseball until 2005 on the GameCube, and I [i]still[/i] havenâ€™t heard any news about this [i]Pocket Monsters Moss[/i]â€¦<br /><br />One more thing I noticed is that after completing the initial setup, there are four options in the ã€Œãƒ¢ãƒã‚¤ãƒ«ã›ã£ã¦ã„ã€ [i]Mobile Settings[/i] menu, but when [url=https://www.youtube.com/watch?v=tY8CdSJCez8]Torchickens used a GameShark code to skip the initial setup[/url], a fifth option, ã€Œé›»è©±ç•ªå·ã®å¤‰æ›´ã€ [i]Change telephone number[/i], appeared. By erasing my Mobile Trainer save file and using that GameShark code, I was able to replicate this and attempted to use this option. It read the configuration data from the adapter, then started executing from WRAM and choked on opcode $FD. Iâ€™m guessing thatâ€™s not the intended behavior.<br /><br /><br />[size=12pt][b]PokÃ©mon Crystal[/b][/size]<br />[b]Initial connection[/b]<br />On startup, before the copyright screen, PokÃ©mon Crystal tries to connect to the Mobile Adapter GB and check the telephone status with command $17. If this connection is successful (which does not require that the adapter even be configured), all of the gameâ€™s mobile features are unlocked except for Mobile Stadium.<br /><br />(The telephone status check has no purpose: the game will recognize the adapter as connected regardless of what value it sends in response to command $17. It appears that the result of this check is used to set or clear the â€œunlimited battle mobile adapterâ€ flag, but the flag is always cleared regardless of what value is sent by the adapter. Iâ€™m guessing the debug build behaved differently.)<br /><br />After the successful connection, the ã€Œãƒ¢ãƒã‚¤ãƒ«ã€€ãƒ—ãƒ­ãƒ•ã‚£ãƒ¼ãƒ«ã€ â€œMobile Profileâ€ screen will be presented the first time Continue is selected from the main menu, or whenever a new game is started.<br /><br /><br />[b]Egg Ticket[/b]<br />When the Egg Ticket is redeemed at the PokÃ©Com Center Trade Corner, the game makes an HTTP GET request for [tt]http://gameboy.datacenter.ne.jp/cgb/download?name=/01/CGB-BXTJ/tamago/index.txt[/tt]. ([tt]&quot;CGB-BXTJ&quot;[/tt] is the product code for the Japanese version of PokÃ©mon Crystal; [tt]&quot;01&quot;[/tt] denotes the gameâ€™s publisher, Nintendo.) This text file should have two lines, with CRLF line endings.<br /><br />The first line is the HTTP URI that will be used to download the Odd Egg data. This URI contains a sequence of up to four capital [tt]&quot;X&quot;[/tt]s, which the game will replace with a hexadecimal value.<br /><br />(If the filenameâ€”[i]i.e.[/i], the part of the URI after the last [tt]&quot;/&quot;[/tt], even if itâ€™s part of the query stringâ€”starts with a decimal digit, the game reads up to three digits from the start of the filename, interprets this as the service fee [in yen] charged for downloading this file, and prompts the user to confirm before downloading it. Since it is known that there was no service fee for the Egg Ticket event, the filename should not start with a digit, or an [tt]&quot;X&quot;[/tt] that will be replaced by a digit.)<br /><br />The second line is a series of 16-bit values written in hexadecimal (with lowercase [tt]&quot;a&quot;[/tt]â€“[tt]&quot;f&quot;[/tt]). These represent the cumulative probabilities of each Odd Egg being obtained. The game generates a random 16-bit number, compares it to each of these values, and downloads the Odd Egg corresponding to the first value that is greater than or equal to the random number, by filling in the [tt]&quot;X&quot;[/tt]s in the URI with [tt]&quot;0000&quot;[/tt] for the first Odd Egg, [tt]&quot;0001&quot;[/tt] for the second, and so on in hexadecimal. Leading digits will be omitted if there are fewer than four [tt]&quot;X&quot;[/tt]s to replace.<br /><br />If the second line of the file is blank, the Trade Corner attendant will say ã€Œã‚‚ã†ã—ã‚ã‘ã€€ã”ã–ã„ã¾ã›ã‚“ï¼ã€€ãŸã ã„ã¾ã€€ã‚¿ãƒžã‚´ã‘ã‚“ã®ã€€ã‚µãƒ¼ãƒ“ã‚¹ã¯ã€€ã¡ã‚…ã†ã—ã€€ã—ã¦ã„ã¾ã™ã€ â€œIâ€™m awfully sorry. The EGG TICKET exchange service isnâ€™t running now.â€ Reportedly the Egg Ticket exchange service ran for the entire time that the Mobile System GB was in operation, so this text would never have been used. If the Egg Ticket service was shut down, it would have made it impossible for someone who had the Egg Ticket in their Bag to use the Trade Corner until they deposited it in their PC, which could have been confusing.<br /><br />The downloaded Odd Egg file is 54 bytes, containing the 48-byte PokÃ©mon data structure followed by the nickname, which should be ã€Œã‚¿ãƒžã‚´ã€ â€œEGGâ€. The OT name ã€Œãªãžã€ â€œODDâ€ is added by the game, though it goes unseen since an Eggâ€™s OT is always shown as â€œ?????â€ until it hatches.<br /><br />For my implementation, Iâ€™ve copied the Odd Egg data from the English version. But according to legend, the Odd Egg received from the mobile event had a 50% chance to be Shiny, higher than the 14% chance for the in-game event in the Western versions. Does anyone know where this information came from? The only way to verify it would have been to download [tt]index.txt[/tt] and read the probability values, and Iâ€™ve seen no evidence that anyone would have known how to do that at the time.<br /><br />[youtube]https://youtu.be/Er0gbOvHY5k[/youtube]<br /><br /><br />[b]PokÃ©Com Center Trade Corner[/b]<br />When a PokÃ©mon is deposited at the Trade Corner, the game sends an HTTP GET request for [tt]http://gameboy.datacenter.ne.jp/cgb/download?name=/01/CGB-BXTJ/exchange/index.txt[/tt]. The first line of this file is a URI that will be used to log in before uploading the PokÃ©mon data. Since the service fee for the Trade Corner was Â¥10, the filename in that URI should start with [tt]&quot;10&quot;[/tt].<br /><br />As far as I can tell, the server is supposed to send an HTTP 401 Unauthorized response with a [tt]WWW-Authenticate[/tt] header, to which the game will respond by retrying with an [tt]Authorization[/tt] header. Then the server will respond with a [tt]Gb-Auth-ID[/tt] header. I canâ€™t seem to get this process to work, so instead Iâ€™ve bypassed it by having the server send the [tt]Gb-Auth-ID[/tt] on the first try.<br /><br />The game POSTs a 143-byte file with the following contents:<br /><br />[code]$00&nbsp; DION e-mail address (null-terminated ASCII)<br />$1E&nbsp; Trainer ID<br />$20&nbsp; Secret ID<br />$22&nbsp; Offered PokÃ©monâ€™s gender<br />$23&nbsp; Offered PokÃ©monâ€™s species<br />$24&nbsp; Requested PokÃ©monâ€™s gender<br />$25&nbsp; Requested PokÃ©monâ€™s species<br />$26&nbsp; Trainer name<br />$2B&nbsp; Offered PokÃ©monâ€™s 48-byte data structure<br />$5B&nbsp; Offered PokÃ©monâ€™s OT name<br />$60&nbsp; Offered PokÃ©monâ€™s nickname<br />$65&nbsp; Mail data (filled with 00 if not holding Mail):<br />$65&nbsp; &nbsp; Message<br />$86&nbsp; &nbsp; Senderâ€™s name<br />$8B&nbsp; &nbsp; Senderâ€™s Trainer ID<br />$8D&nbsp; &nbsp; PokÃ©mon species<br />$8E&nbsp; &nbsp; Item index[/code]<br /><br />The genders of the offered and requested PokÃ©mon are encoded as: $00 = gender unknown, $01 = male, $02 = female, and (for the requested PokÃ©mon) $03 = either male or female.<br /><br />After a PokÃ©mon is deposited in the Trade Corner, the game enforces a two-hour waiting period before the status of the trade may be checked. To check if a trade has been made, the game logs in to the DION POP e-mail server and searches for an e-mail with the header [tt]X-Game-code: CGB-BXTJ-00[/tt]. If it finds one, it will read the [tt]X-Game-result[/tt] header, which is in the format [tt]1 [i]ttttssss oooo rrrr x[/i][/tt], where [tt][i]tttt[/i][/tt] and [tt][i]ssss[/i][/tt] are the Trainer ID and Secret ID, [tt][i]oooo[/i][/tt] is the gender and species of the offered PokÃ©mon, and [tt][i]rrrr[/i][/tt] is the gender and species of the requested PokÃ©mon, all written in lowercase hexadecimal. The last character [tt][i]x[/i][/tt] is either [tt]&quot;1&quot;[/tt] or [tt]&quot;2&quot;[/tt], with [tt]&quot;1&quot;[/tt] indicating that a trade partner has been found and [tt]&quot;2&quot;[/tt] indicating that the server has given up on finding one. If a trade partner has been found, the body of the e-mail will contain the last 105 bytes of the above data structure (starting from the Trainer name) for the received PokÃ©mon, encoded in Base64.<br /><br />If no e-mail with a matching [tt]X-Game-code[/tt] and [tt]X-Game-result[/tt] is found, the Trade Corner attendant will give you the option to retrieve your PokÃ©mon. If you choose to retrieve it, the game reads a URI from the [i]second[/i] line of [tt]exchange/index.txt[/tt] and POSTs a 38-byte file to it, which contains the first 38 bytes of the above data structure (up to the requested PokÃ©monâ€™s species). This cancels the trade.<br /><br />[youtube]https://youtu.be/0ZerrH7rYZU[/youtube]<br /><br /><br />[b]Cable Trade Center[/b]<br />I wasnâ€™t planning to work on the multiplayer features at this point; I just wanted to see what commands they use so I could add them to the command listing.<br /><br />I wrote my program so that when it received a command it didnâ€™t recognize, it would echo that command verbatim in response. This turned out to be entirely sufficient to make the Mobile Trade screen open and let me trade with myself!<br /><br />[youtube]https://youtu.be/4Uh4sgtmDMQ[/youtube]<br /><br />One notable feature of the mobile trade animations is that the Mobile Adapter GB is depicted using a palette chosen according to the device IDâ€”the PDC adapter is shown as blue, the CDMA adapter is shown as yellow, the unreleased DoCoMo PHS adapter is shown as green, and the DDI PHS adapter is shown as red. There are also assigned palettes for the unused device IDs $0Câ€“0F: purple for $0C, black for $0D, pink for $0E, and gray/violet for $0F.<br /><br />[img]http://i.imgur.com/emwzq58.png[/img][img]http://i.imgur.com/2jt6fmU.png[/img][img]http://i.imgur.com/qB3DTCH.png[/img][img]http://i.imgur.com/cwr6A5W.png[/img]<br /><br /><br />[b]Cable Club Colosseum[/b]<br />I was also able to get into a battle with myself in the Colosseum, though it inevitably unraveled when the opposing PokÃ©mon fainted and it tried to send out the fainted PokÃ©mon as a replacement for itself (since it wasnâ€™t â€œmyâ€ PokÃ©mon that fainted, I hadnâ€™t made a selection).<br /><br />I did, however, find out what an â€œunlimited battle mobile adapterâ€ does: it removes the 10 minute per day limit on Colosseum battles. When entering the Colosseum without the â€œunlimited battleâ€ flag, the attendant will ask: ã€Œãã‚‡ã†ã®ã€€ã®ã“ã‚Šã€€ã˜ã‹ã‚“ã¯ã€€ã‚ã¨ã€€ï¼‘ï¼ã€€ãµã‚“ã§ã™[ã€‚]ã€€ãŸã„ã›ã‚“ã€€ã—ã¾ã™ã‹ï¼Ÿã€ â€œTodayâ€™s remaining time is 10 min. Would you like to battle?â€ (or one of a few other messages if less time is left). With the â€œunlimited battleâ€ flag, she asks instead: ã€Œãƒ¢ãƒã‚¤ãƒ«ã€€ãŸã„ã›ã‚“ã€€ã§ã¯ã€€ãƒã‚±ãƒ¢ãƒ³ã‚’ã€€ï¼“ãŸã„ã€€ãˆã‚‰ã‚“ã§ã€€ãŸã„ã›ã‚“ã€€ã—ã¾ã™[ã€‚]ã€€ã‚ˆã‚ã—ã„ã§ã™ã‹ï¼Ÿã€ â€œTo enter a mobile battle, you must pick a team of three POKÃ©MON. Is that OK?â€<br /><br /><br />[size=12pt][b]Implementation[/b][/size]<br /><br />http://pastebin.com/igq4SuVd<br /><br />I pilfered the BGB linking code from [url=https://www.youtube.com/watch?v=h_j0w7r6xSk]TheZZAZZGlitchâ€™s implementation of the Game Boy Printer protocol[/url] and wrote a script that does just enough to make these features work. Rather than connecting to a proper server, it fabricates the responses that the server should give for a limited set of commands. It completely ignores the DION login ID and password, so you can enter whatever you want in Mobile Trainerâ€™s setup. The e-mail server is hard-coded to contain an e-mail matching the Pidgey-for-Pidgey trade that I made in the video; if you want to use the Trade Corner, youâ€™ll have to edit that e-mail to match your Trainer ID, Secret ID, and the trade youâ€™ve made.<br /><br />I think the next step will be to set up a server that can run a fully functioning Trade Corner, and write a client that can connect to that server or make direct â€œcallsâ€ to other clients. Thereâ€™s still the matter of getting PokÃ©mon Crystalâ€™s PokÃ©mon News, Battle Tower, and Mobile Stadium features running, and after that, it might be interesting to get a couple of the other Mobile Adapter GB compatible games working. Eventually, it would be fun to build a ROM hack of the English version of PokÃ©mon Crystal that restores all of its mobile functionality.


subject: Re: Emulating the Mobile Adapter GB
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I can help work on the server-side aspect.<br /><br />I wonder if that download script on the webserver was vulnerable to local file disclosure at the time.<br /><br />This is something I meant to do myself, by the way: I just tried to go about it a different way, via static analysis, and I&#039;m not sure how the GB serial hardware works.<br /><br />I did notice the pop3/smtp text in the Mobile Adaptor library though: and I did wonder if any game used it.


subject: Re: Analyzing the chance of Wally fainting the Ralts in Generation III
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7508.msg200523#msg200523 date=1465868464]<br />about 1 in 180044.<br />[/quote]<br /><br />and it happened to me once on a real cart...<br /><br />I think anyway, it&#039;s been years.


subject: Re: Item duplication in EU Pokemon RED
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  7Â° P certo, visto che Ã¨ il settimo piano. Questa gente americana Ã¨ un po&#039; strana&nbsp; :D<br /><br />[quote author=Wack0 link=topic=7507.msg200518#msg200518 date=1465841026]<br />[quote author=Krys3000 link=topic=7507.msg200516#msg200516 date=1465836477]<br />&quot;8F&quot; refers to the same item in every game. But the 8F item is called 7EME ETAGE in french, and probably something like P7 in italian. That&#039;s just because steps are not counted in the same way in english.<br />[/quote]<br /><br />in US english*<br />[/quote]<br /><br />I didn&#039;t know that, sorry&nbsp; ;D


subject: Re: Item duplication in EU Pokemon RED
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7507.msg200528#msg200528 date=1465907942]<br />7Â° P certo, visto che Ã¨ il settimo piano. Questa gente americana Ã¨ un po&#039; strana&nbsp; :D<br /><br />[quote author=Wack0 link=topic=7507.msg200518#msg200518 date=1465841026]<br />[quote author=Krys3000 link=topic=7507.msg200516#msg200516 date=1465836477]<br />&quot;8F&quot; refers to the same item in every game. But the 8F item is called 7EME ETAGE in french, and probably something like P7 in italian. That&#039;s just because steps are not counted in the same way in english.<br />[/quote]<br /><br />in US english*<br />[/quote]<br /><br />I didn&#039;t know that, sorry&nbsp; ;D<br />[/quote]<br /><br />Aaaaah oddio ho realizzato adesso. PerchÃ© in America non esiste il piano terra, partono dal primo piano!


subject: Re: Emulating the Mobile Adapter GB
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  OK. I modified the emulator to dump to file the data of any unknown packet.<br /><br />I then went into the Cable Trade Center, and canceled, and now I have several files to look through.<br /><br />Haven&#039;t discovered much yet, naturally, however, it seems to use specifically 0x15 packets.<br /><br />Seems the &quot;byte of unknown significance&quot; is the length of the sent/received data.<br /><br />The first sent packet is 0x15 bytes in length, and starts with [url=https://github.com/pret/pokecrystal/blob/master/misc/mobile_40.asm#L3832]&quot;\x19\x73\x09\x13trade_crystal&quot;[/url]. There follows two big-endian int16s 0x1 and 0x1a06, which are unknown to me at this time.<br /><br />Most of the packets sent are empty.<br /><br />Here&#039;s a dump of the packets if anyone else wants to look: http://lucasm.cf/?yzrlz<br /><br />edit: And here&#039;s a dump of the Mobile Colosseum packets: http://lucasm.cf/?yzjim<br />This one starts with [url=https://github.com/pret/pokecrystal/blob/master/misc/mobile_40.asm#L3842]&quot;\x19\x67\x10\x01limit_crystal&quot;[/url].<br /><br />There&#039;s a similar string near both of them, [url=https://github.com/pret/pokecrystal/blob/master/misc/mobile_40.asm#L3837]&quot;\x19\x67\x10\x01free__crystal&quot;[/url]. Guessing this one is used with the Unlimited Battle Adapter, given [url=https://github.com/pret/pokecrystal/blob/master/misc/mobile_40.asm#L3800]this code[/url]?


subject: Re: Emulating the Mobile Adapter GB
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7509.msg200526#msg200526 date=1465898084]This is something I meant to do myself, by the way: I just tried to go about it a different way, via static analysis, and I&#039;m not sure how the GB serial hardware works.[/quote]<br /><br />That sounds painful ;D I started by setting a read breakpoint on $FF01 (serial data) and trying to find what bytes I could put there to make something different happen.<br /><br />[quote author=Wack0 link=topic=7509.msg200531#msg200531 date=1465923069]<br />OK. I modified the emulator to dump to file the data of any unknown packet.<br /><br />I then went into the Cable Trade Center, and canceled, and now I have several files to look through.<br /><br />Haven&#039;t discovered much yet, naturally, however, it seems to use specifically 0x15 packets.<br /><br />Seems the &quot;byte of unknown significance&quot; is the length of the sent/received data.[/quote]<br /><br />The first byte of a $15 packet is, as far as Iâ€™ve seen, always $FF (though my implementation sends $00 and it doesnâ€™t seem to matter). Your dumps are starting from the second byte, which is the first byte of the actual data sent by the Trade Center/Colosseum. These features apparently have their own redundant packet structure, which starts with the length and ends with a little-endian checksum.<br /><br />[quote author=Wack0 link=topic=7509.msg200531#msg200531 date=1465923069]There&#039;s a similar string near both of them, [url=https://github.com/pret/pokecrystal/blob/master/misc/mobile_40.asm#L3837]&quot;\x19\x67\x10\x01free__crystal&quot;[/url]. Guessing this one is used with the Unlimited Battle Adapter, given [url=https://github.com/pret/pokecrystal/blob/master/misc/mobile_40.asm#L3800]this code[/url]?<br />[/quote]<br /><br />Yes, [tt]&quot;free__crystal&quot;[/tt] is sent in â€œunlimited battleâ€ mode.


subject: Re: Recent purchases
poster_name: shaggs
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=6636.msg189545#msg189545 date=1367033417]<br />Iron maiden - number of the beast, and Iron Maiden - Maiden Japan on LP records.<br />[/quote]<br />MY BOY YOU HAVE EXCELLENT TASTE&nbsp; (-:3


subject: Re: Debug menus in Japanese Crystal
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: HÃ¡Äky
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7407.msg199854#msg199854 date=1456704173][table][tr][td]Unused<br />(3F:656E)[/td]<br />[td]Displays the Mobile Adapter connection prompt with an incorrect palette. Maybe it would do more than that if a connection could be made.[/td][/tr]<br />[/table][/quote]<br /><br />This script initiates a Colosseum mobile battle using the first three PokÃ©mon in the party. It can be either a time-limited battle or an unlimited one depending on the â€œunlimited battle mobile adapterâ€ flag.<br /><br />The palette of the Mobile Adapter prompt depends on the location where itâ€™s accessed. In an area such as the first floor of the PokÃ©Com Center, the prompt will be the usual dark blue.<br /><br />Also, I realize I never mentioned how to access those unreferenced scripts. The Game Genie codes ??4-819-D58 Â· ??4-829-7FB will replace the pointer to ãƒ†ã‚¹ãƒˆï¼‘ [i]Test 1[/i].<br /><br />[quote author=HÃ¡Äky link=topic=7407.msg199854#msg199854 date=1456704173][size=12pt][b]Quick-start[/b] (3F:5983)[/size]<br />Function 3F:5983 seems to be intended as some sort of accelerated start for debugging purposes. It does a bewildering variety of peculiar things:<br />â€¦<br />[list][*]Sets bit 7 of $D83F ([tt]StatusFlags[/tt]). (Pokecrystal identifies this as ENGINE_BUG_CONTEST_ON, but I donâ€™t think itâ€™s related to the Bug-Catching Contest at all. The only place I see that itâ€™s used is in [url=https://github.com/pret/pokecrystal/blob/0add51451cda9d4221af137f83e2429d3577310c/engine/main_menu.asm#L150][tt]MainMenu_GetWhichMenu[/tt][/url], which checks this flag but then does the same thing whether itâ€™s set or not. The flag is set in-game when the Mystery Egg is given to Prof. Elm.)[/list][/quote]<br /><br />Thereâ€™s dummied-out code for the main menu in the English version of PokÃ©mon Crystal? When I say it like that, the reason for it becomes a lot more obvious :P<br /><br />That flag is used in the Japanese version to hide the Mobile and Mobile Stadium options from the main menu until the Mystery Egg is delivered to Prof. Elm.<br /><br />[quote author=Torchickens link=topic=7407.msg200379#msg200379 date=1463171562]<br />These are incredible finds! Well done HÃ¡Äky! There are a number of sound effects in the sound test I don&#039;t recognize, such as 45, 146, 175, 176-178, 205, 206. Are any of those used?<br />[/quote]<br /><br />175â€“178 are used for the moves Moonlight, Encore, Beat Up, and Baton Pass.<br /><br />206 is used when unlocking the Card Folder. 205 is probably also used for some mobile feature, but I donâ€™t know which one.<br /><br />045 and 146 donâ€™t seem to be used. Notably, 045 (called [tt]SFX_FANFARE[/tt] in pokecrystal) [url=https://github.com/pret/pokecrystal/blob/7aef59841489ea449b9a34d424c681a4b48b88ab/home/text.asm#L1051]can be played by a text script[/url], but there donâ€™t appear to be any text scripts that use that command.


subject: Re: Debug menus in Japanese Crystal
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I see. Thanks for that. :)<br /><br />Regarding the sound test, may I ask how would we go about activating it with arbitrary code execution (with a trick such as TM15 ACE)? Would it be as simple as bringing up the menu, or are there pointers within the menu code that were changed in the final game?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6638.msg200510#msg200510 date=1465597897]If there is a way to obtain a &quot;Rival&#039;s effect&quot;/&quot;Jack effect&quot; (walk through walls item) early such as &quot;o&quot; (hex:94) before Nugget Bridge, that could possibly be used to bypass the Nugget Rocket and the Rocket blocking the Dig TM NPC&#039;s house. It could also be used to bypass the Rocket blocking Fuchsia City&#039;s gym (though you might need to Teleport or Dig away after), also eliminating the need to battle PokÃ©mon Tower&#039;s Jessie &amp; James.[/quote]<br /><br />Yellow version speedruns get item underflow by setting up Trainer-Fly in Viridian Forest, having Misty be the most recent trainer battle and then blacking out back to Pewter to get the encounter. If Missingno. doesn&#039;t crash, what you can do is duplicate a Potion, use two of them, then capture Missingno. to duplicate them again. 255 Potions. Now you just need the right RAM values for Jack&#039;s item.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Ephraim225 link=topic=6638.msg200537#msg200537 date=1466028280]<br />[quote author=Torchickens link=topic=6638.msg200510#msg200510 date=1465597897]If there is a way to obtain a &quot;Rival&#039;s effect&quot;/&quot;Jack effect&quot; (walk through walls item) early such as &quot;o&quot; (hex:94) before Nugget Bridge, that could possibly be used to bypass the Nugget Rocket and the Rocket blocking the Dig TM NPC&#039;s house. It could also be used to bypass the Rocket blocking Fuchsia City&#039;s gym (though you might need to Teleport or Dig away after), also eliminating the need to battle PokÃ©mon Tower&#039;s Jessie &amp; James.[/quote]<br /><br />Yellow version speedruns get item underflow by setting up Trainer-Fly in Viridian Forest, having Misty be the most recent trainer battle and then blacking out back to Pewter to get the encounter. If Missingno. doesn&#039;t crash, what you can do is duplicate a Potion, use two of them, then capture Missingno. to duplicate them again. 255 Potions. Now you just need the right RAM values for Jack&#039;s item.<br />[/quote]<br />That&#039;s true. However Shina69 was asking how we could do this without the expanded items pack.


subject: Re: Debug menus in Japanese Crystal
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7407.msg200536#msg200536 date=1466024399]<br />I see. Thanks for that. :)<br /><br />Regarding the sound test, may I ask how would we go about activating it with arbitrary code execution (with a trick such as TM15 ACE)? Would it be as simple as bringing up the menu, or are there pointers within the menu code that were changed in the final game?<br />[/quote]<br /><br />The sound test makes several calls to functions in the upper part of bank 0 that are offset by $3D bytes, including important ones like [tt]PlayMusic[/tt] and [tt]PlaySFX[/tt] ;)<br /><br />In order to run it with ACE, youâ€™d have to copy the code (from 3F:72C3â€“73B1) into RAM and patch those calls. And once the code is moved into RAM, youâ€™d also need to patch calls to the sound testâ€™s own subroutines so they point to the new addresses in RAM. Probably the simplest patching method would be to loop through the code looking for the bytes $CD ([tt]call[/tt]) and $C3 ([tt]jp[/tt]) and checking the high byte of the address that follows. If itâ€™s â‰¥ $40, then itâ€™s pointing to its own code in bank $3F and needs to be offset to wherever youâ€™ve put the patched code in RAM. If itâ€™s â‰¥ $2B, then itâ€™s pointing to the upper part of bank 0 and you need to subtract $003D. If itâ€™s &lt; $2B, then the address is fine. (This might not work properly if the bytes $CD or $C3 appeared as an operand rather than an instruction, but luckily they donâ€™t in the sound test code.)


subject: Re: Item duplication in EU Pokemon RED
poster_name: Xiphiidae
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Xiphiidae
icon: xx
body:
  [quote author=Dante link=topic=7507.msg200530#msg200530 date=1465914055]<br />[quote author=Krys3000 link=topic=7507.msg200528#msg200528 date=1465907942]<br />7Â° P certo, visto che Ã¨ il settimo piano. Questa gente americana Ã¨ un po&#039; strana&nbsp; :D<br /><br />[quote author=Wack0 link=topic=7507.msg200518#msg200518 date=1465841026]<br />[quote author=Krys3000 link=topic=7507.msg200516#msg200516 date=1465836477]<br />&quot;8F&quot; refers to the same item in every game. But the 8F item is called 7EME ETAGE in french, and probably something like P7 in italian. That&#039;s just because steps are not counted in the same way in english.<br />[/quote]<br /><br />in US english*<br />[/quote]<br /><br />I didn&#039;t know that, sorry&nbsp; ;D<br />[/quote]<br /><br />Aaaaah oddio ho realizzato adesso. PerchÃ© in America non esiste il piano terra, partono dal primo piano!<br />[/quote]<br /><br />The worst thing is that in Australia half of the buildings start at Ground Floor and half start at First Floor...


subject: Re: Debug menus in Japanese Crystal
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7407.msg200540#msg200540 date=1466045402]<br />[quote author=Torchickens link=topic=7407.msg200536#msg200536 date=1466024399]<br />I see. Thanks for that. :)<br /><br />Regarding the sound test, may I ask how would we go about activating it with arbitrary code execution (with a trick such as TM15 ACE)? Would it be as simple as bringing up the menu, or are there pointers within the menu code that were changed in the final game?<br />[/quote]<br /><br />The sound test makes several calls to functions in the upper part of bank 0 that are offset by $3D bytes, including important ones like [tt]PlayMusic[/tt] and [tt]PlaySFX[/tt] ;)<br /><br />In order to run it with ACE, youâ€™d have to copy the code (from 3F:72C3â€“73B1) into RAM and patch those calls. And once the code is moved into RAM, youâ€™d also need to patch calls to the sound testâ€™s own subroutines so they point to the new addresses in RAM. Probably the simplest patching method would be to loop through the code looking for the bytes $CD ([tt]call[/tt]) and $C3 ([tt]jp[/tt]) and checking the high byte of the address that follows. If itâ€™s â‰¥ $40, then itâ€™s pointing to its own code in bank $3F and needs to be offset to wherever youâ€™ve put the patched code in RAM. If itâ€™s â‰¥ $2B, then itâ€™s pointing to the upper part of bank 0 and you need to subtract $003D. If itâ€™s &lt; $2B, then the address is fine. (This might not work properly if the bytes $CD or $C3 appeared as an operand rather than an instruction, but luckily they donâ€™t in the sound test code.)<br />[/quote]<br /><br />Neat! Thanks for information, going to look into writing code that does that.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Ephraim225
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh whoops. I didn&#039;t look at the previous page ^^;<br /><br />In that case there&#039;s only one other way I can think of: Have the Rocket NPC on Nugget Bridge disappear through the Mew Glitch. For that you&#039;d have to figure out what that NPC&#039;s &quot;disappearing object number&quot; is, start the Mew Glitch on a map with that many objects -1, start the Mew Glitch there, head to Nugget Bridge, lose to one of the trainers, then make sure not to cross through any maps with more disappearing objects than the number you want.<br /><br />So...I suppose it comes down to the number of disappearing objects on Route 24 and which one the Rocket is.


subject: Re: The dream thread
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Last night I dreamt that a horde of velociraptors were attacking my neighborhood, and a brontosaurus and a tyrannosaurus were trying to fight them off. For some reason, [url=https://en.wikipedia.org/wiki/Flashpoint_(TV_series)]Team One[/url] showed up and tried to keep everything under control. By then, the dinosaurs had reached my backyard, which was a lot bigger than it is in reality.<br /><br />I&#039;m not sure how it happened, but at some point I got an AK-47, mounted the brontosaurus, and massacred a good number of velociraptors, but I was forced to take shelter in my clubhouse. The leader of the raptors was waiting for me there, and we had a fierce struggle for the gun, but I gained the upper hand, harnessed my inner King Kong, and snapped his jaw in half. The raptors were soon slain.<br /><br />F**k yeah.


subject: PPSE-DS generated team (Platinum)
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  All pokemon are Level 100, 255 EV, 31 IV on all stats, 255 all competition stats<br /><br />Pidgeot, ability &quot;Wonder Guard&quot;, Leftovers equipped<br />1. Fly<br />2. Surf<br />3. Cut<br />4. Teleport<br /><br />Salamence, ability &quot;Color Change&quot;, Sitrus Berry equipped<br />1. Hyper Beam<br />2. Aurora Beam<br />3. Softboiled<br />4. Magical Leaf<br /><br />Raichu, ability &quot;Wonder Guard&quot;, Leftovers equipped<br />1. Guillotine<br />2. Zap Cannon<br />3. Wrap<br />4. Rock Polish<br /><br />Phione, ability &quot;Wonder Guard&quot;, Quick Claw equipped<br />1. Water Gun<br />2. Softboiled<br />3. Transform<br />4. Take Down<br /><br />Any comments?<br /><br />If you want to say &quot;You cheat and suck&quot; or something of the sort, don&#039;t.


subject: Petition thread
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  This is where petitions for things go.<br />I&#039;ll begin.<br /><br /><br />Petition to move the Yellow functions list into the *Dex list.<br />


subject: Re: The Story of Glitchy, the 4. . [Completed 10/27/2014]
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Carl Miller link=topic=6794.msg200547#msg200547 date=1466179853]<br />Way to bump.<br />[/quote]<br />-.- i don&#039;t appreciate your sarcasm


subject: Adding items to the &quot;New file&quot; menu
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: wink
body:
  This is a .REG file. This file, when run, will add several new items to the &quot;New File&quot; right-click context menu.<br /><br />I believe this would be helpful for programmers, ROM hackers, and users in general.<br /><br />This adds the following:<br />.py file<br />.bat file<br />.asm file<br />.html file<br />.css file<br />.ini file<br />.js file<br />.vbs file<br />.c file<br />.h file<br />.dat file


subject: Re: Petition thread
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7511.msg200546#msg200546 date=1466113046]<br />This is where petitions for things go.<br />I&#039;ll begin.<br /><br /><br />Petition to move the Yellow functions list into the *Dex list.<br />[/quote]<br />I support this, but I feel it&#039;s first a good idea to make sure the GlitchDex, AttackDex and ItemDex are completed.<br /><br />I live alone in my own flat now so fortunately have a lot of free time to work on this. :)


subject: Re: Adding items to the &quot;New file&quot; menu
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7512.msg200549#msg200549 date=1466191121]<br />This is a .REG file. This file, when run, will add several new items to the &quot;New File&quot; right-click context menu.<br /><br />I believe this would be helpful for programmers, ROM hackers, and users in general.<br /><br />This adds the following:<br />.py file<br />.bat file<br />.asm file<br />.html file<br />.css file<br />.ini file<br />.js file<br />.vbs file<br />.c file<br />.h file<br />.dat file<br />[/quote]<br /><br />This looks useful indeed! Thanks!


subject: Re: The Story of Glitchy, the 4. . [Completed 10/27/2014]
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=6794.msg200548#msg200548 date=1466190985]<br />[quote author=Carl Miller link=topic=6794.msg200547#msg200547 date=1466179853]<br />Way to bump.<br />[/quote]<br />-.- i don&#039;t appreciate your sarcasm<br />[/quote]<br /><br />I&#039;m all right with the bump personally because the post contributed a request (not just something like &quot;this is cool&quot;), and the forums aren&#039;t that active anymore.


subject: Re: Petition thread
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7511.msg200550#msg200550 date=1466191545]<br />[quote author=Yeniaul link=topic=7511.msg200546#msg200546 date=1466113046]<br />This is where petitions for things go.<br />I&#039;ll begin.<br /><br /><br />Petition to move the Yellow functions list into the *Dex list.<br />[/quote]<br />I support this, but I feel it&#039;s first a good idea to make sure the GlitchDex, AttackDex and ItemDex are completed.<br /><br />I live alone in my own flat now so fortunately have a lot of free time to work on this. :)<br />[/quote]<br />Yeah, priorities, after all. <br />Do you really feel like my list is good enough for that?


subject: Re: Item duplication in EU Pokemon RED
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7507.msg200515#msg200515 date=1465830209]<br />[quote author=Dante link=topic=7507.msg200512#msg200512 date=1465731566]<br />I&#039;ve tried to find a way to duplicate my items but I couldn&#039;t so here we are again.<br />The most common way to duplicate items is with missigno, but in the eu version that is a really hard way to get that.<br />I need duplication for 2 things:<br />1- More rare candy in order to get a Pidgey with 233 HP and set up the 7F ACE.<br />2- More TM in order to execute code.<br />How can I do?<br />[/quote]<br />For the Pidgey, I recommend you to use a Trainer-Fly to get a level 1 Pidgey (remember, it must NOT be sent to your PC !), otherwise you&#039;ll need ~1h of rare candy&#039;ing + evolution cancelling.<br /><br />For the quantities, forget Krys&#039; long shenanigans. You can simply :<br />[list type=decimal]<br />[li]Get a Cooltrainer Ditto (y&#039;know the drill...)[/li]<br />[li]Go to any cave[/li]<br />[li]Have an encounter[/li]<br />[li]Open the PkMn or the Item menu then close it[/li]<br />[li]Open and close the Fight menu until the PokÃ©mon are corrupted[/li]<br />[li]Catch the opponent[/li]<br />[li]Now your items are duplicated ![/li]<br />[li]Open your START menu before exiting the cave, and you&#039;re done ![/li]<br />[/list]<br /><br /><br />Note that this won&#039;t work for Yellow, but our EU Yellow Missingno is stable (yay !), so no worries &#039;bout that.<br />Once you got at least one item cloned, you can have a simpler item setup that will have 7F multiply items :<br />[code]<br />(Starting from the first item)<br />7F<br />Duplicate item x(any qty)<br />Lemonade x1<br />Soda Cool x43<br />PokÃ© Ball x119<br />TM01 x(any qty)<br />[/code]<br />(For the PokÃ© Balls, have 1, clone it, then toss 10 of them)<br /><br />This should give you 0 items in the second slot. The game won&#039;t delete the stack of items like you would expect it to, but you can toss items and it will behave as if you had 256 of it. That is, tossing 1 will give you 255, etc.<br />Remember, for every other action, this is a stack of 0 items. So, tossing 0 items will... delete the stack. Meh.<br />[/quote]<br />I tried but it didn&#039;t worked :*(<br />First: maybe I did something wrong with Ditto or maybe it&#039;s because is the ITA version, but the cooltrainer move doesn&#039;t have cooltrainer as a type.<br />I tried in rock tunnel and with every pokemon I met I got the same result:<br />after some tries, finally the battle menu is stabilized. When I open it, the music starts slowly vanishing, then when i close the menu i get a burned foe. If I catch him, the game freeze, doesn&#039;t matter if will full party or not. If I try to escape, they don&#039;t let me, they die because of the burn, then the game crashes. Maybe I should try with a pokedoll?


subject: Re: Petition thread
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Yeah. I&#039;m thinking that after the GlitchDex, AttackDex, ItemDex are done we could work on a listing like this:<br /><br />GlitchDex<br />AttackDex<br />ItemDex<br />TypeDex<br />AreaDex<br />(UnownDex?)<br />(CommandDex?)<br />More<br /><br />I have mixed thoughts whether the Predef list (CommandDex) should be on the Sidebar. It is definitely a database and I&#039;m leaning towards yes, although it doesn&#039;t come in to play very often (outside of arbitrary code execution), so could be found under &quot;More&quot;.<br /><br />I have a question. Are predefined commands dependent on the ROM bank in which they were called or do the predefined commands set the bank automatically? If so, it would be good to document the effects for different banks.


subject: Re: Petition thread
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7511.msg200555#msg200555 date=1466193381]<br />I&#039;m thinking that after the GlitchDex, AttackDex, ItemDex are done we work on a listing like this:<br /><br />GlitchDex<br />AttackDex<br />ItemDex<br />TypeDex<br />AreaDex<br />UnownDex<br />More<br /><br />The predefined commands list is a database and could be found under &quot;More&quot;.<br /><br />I have a question. Are predefined commands dependent on the ROM bank in which they were called or do the predefined commands set the bank automatically? If so, it would be good to document the effects for different banks.<br />[/quote]<br />As far as I can tell, they depend on the bank, what&#039;s running, screen data, sound data, and the function called. For example, 07 is always the same, but 2E has changed...


subject: Re: Item duplication in EU Pokemon RED
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  It looks like you activated the main glitch successfully (the music faded out and the foe became burned) in Rock Tunnel, however the statement that the glitch works in any cave sadly actually isn&#039;t true.<br /><br />In the English version, the freeze can be avoided in the main Diglett&#039;s Cave map (map C5), Mt. Moon B1F (map 3C), all Seafoam Islands maps except for B4F (map C0), Unknown Dungeon 1F (map E2) and Unknown Dungeon 2F (map E4).<br /><br />Other maps including Rock Tunnel do not work.<br /><br />The easiest working map is Diglett&#039;s Cave because you can quickly walk to it from Vermilion City. I have confirmed that Diglett&#039;s Cave also works in the Italian version of Red.


subject: Re: Item duplication in EU Pokemon RED
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7507.msg200557#msg200557 date=1466196989]<br />It looks like you activated the main glitch successfully (the music faded out and the foe became burned) in Rock Tunnel, however the statement that the glitch works in any cave sadly actually isn&#039;t true.<br /><br />In the English version, the freeze can be avoided in the main Diglett&#039;s Cave map (map C5), Mt. Moon B1F (map 3C), all Seafoam Islands maps except for B4F (map C0), Unknown Dungeon 1F (map E2) and Unknown Dungeon 2F (map E4).<br /><br />Other maps including Rock Tunnel do not work.<br /><br />The easiest working map is Diglett&#039;s Cave because you can quickly walk to it from Vermilion City. I have confirmed that Diglett&#039;s Cave also works in the Italian version of Red.<br />[/quote]<br />It worked, thank you :)<br />One last question: this kind of missigno can corrupt somehow other things beside himself?


subject: Re: Adding items to the &quot;New file&quot; menu
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7512.msg200558#msg200558 date=1466251033]<br />I generally just use new text document and change the extension...<br />[/quote]<br />Now you don&#039;t. Saves time!


subject: Re: Item duplication in EU Pokemon RED
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You&#039;re welcome! Like other Missingno., if you view the stats of this Missingno. (hex:32), it will cause the [url=http://bulbapedia.bulbagarden.net/wiki/Inverted_sprites]inverted sprites[/url]. If you send it into battle, its backsprite likely won&#039;t freeze the game, but it will mess up the Hall of Fame. The Missingno. also cannot learn any moves other than Water Gun and Razor Wind unless you give it a TM/HM, so you&#039;re safe from Super Glitch.


subject: Re: Item duplication in EU Pokemon RED
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7507.msg200557#msg200557 date=1466196989]<br />It looks like you activated the main glitch successfully (the music faded out and the foe became burned) in Rock Tunnel, however the statement that the glitch works in any cave sadly actually isn&#039;t true.<br /><br />In the English version, the freeze can be avoided in the main Diglett&#039;s Cave map (map C5), Mt. Moon B1F (map 3C), all Seafoam Islands maps except for B4F (map C0), Unknown Dungeon 1F (map E2) and Unknown Dungeon 2F (map E4).<br /><br />Other maps including Rock Tunnel do not work.<br /><br />The easiest working map is Diglett&#039;s Cave because you can quickly walk to it from Vermilion City. I have confirmed that Diglett&#039;s Cave also works in the Italian version of Red.<br />[/quote]<br />Why is that ? Is it because of the tilesets ?


subject: Re: IT'S SO DAMN HOT.
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Milk is never a bad choice. You need your calcium.<br /><br />[img]https://scontent.cdninstagram.com/t51.2885-15/e15/10576119_611053035659264_1827940716_n.jpg?ig_cache_key=NzczMjQwMTYyNTYxMjE2NDUy.2[/img]


subject: Re: The Story of Glitchy, the 4. . [Completed 10/27/2014]
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=6794.msg200548#msg200548 date=1466190985]<br />[quote author=Carl Miller link=topic=6794.msg200547#msg200547 date=1466179853]<br />Way to bump.<br />[/quote]<br />-.- i don&#039;t appreciate your sarcasm<br />[/quote]<br />There is no sarcasm to be had. You posted in a thread more than 120 days after the last post in that thread was made; that is GCLf&#039;s definition of a bump.


subject: Re: IT'S SO DAMN HOT.
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No it&#039;s not.<br /><br />~~ Southern Hemisphere<br /><br /><br />Fuckin freezing my tits off down here.


subject: Re: IT'S SO DAMN HOT.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  My, if this is the last topic ever active on these forums, I&#039;m gonna feel ashamed for the rest of my life.<br /><br />Gotta bump&#039;em all !


subject: Re: IT'S SO DAMN HOT.
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7513.msg200573#msg200573 date=1466589041]<br />My, if this is the last topic ever active on these forums, I&#039;m gonna feel ashamed for the rest of my life.<br /><br />Gotta bump&#039;em all !<br />[/quote]<br /><br />Are we really in such a bad state? :( 


subject: Re: IT'S SO DAMN HOT.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Uh, I remember a post from torchickens that I understood as approximately that... gee, I wish I could spend more time on GCLf as well as on my RPG project, but unfortunately that&#039;s gonna be IMPOSSIBRU.<br /><br />Though, I&#039;m currently working more on the wiki than on the forums...


subject: Re: IT'S SO DAMN HOT.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Do you mean this [url=http://forums.glitchcity.info/index.php/topic,6794.msg200552.html#msg200552]post[/url]?<br /><br />We aren&#039;t as active as we were, and it&#039;s sad, but I don&#039;t think we&#039;re in a bad state. Posts have slowed down but there are still active users here, such as you two, and the forum still attracts people interested in glitches who ask questions.&nbsp; :)<br /><br />[quote author=ISSOtm link=topic=7513.msg200575#msg200575 date=1466593356]<br />gee, I wish I could spend more time on GCLf as well as on my RPG project, but unfortunately that&#039;s gonna be IMPOSSIBRU.<br /><br />Though, I&#039;m currently working more on the wiki than on the forums...<br />[/quote]<br />Yeah, I know the feeling ;_; I used to have a lot of projects too. One way of looking at it is they&#039;re hobbies, there is no obligation to commit; so I assess how I feel and if I&#039;m in the mood to contribute to them so be it. I used to stay up late, and with my Youtube account it has become difficult not to go back to my old lifestyle because comments can quickly build up, but the other element is I feel being early to rest, early to rise is underused.


subject: Re: IT'S SO DAMN HOT.
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7513.msg200576#msg200576 date=1466596228]<br />We aren&#039;t as active as we were, and it&#039;s sad, but I don&#039;t think we&#039;re in a bad state. Posts have slowed down but there are still active users here, such as you two, and the forum still attracts people interested in glitches who ask questions.&nbsp; :)<br />[/quote]<br />There are still contributors, like me with the Yellow functions list. Without contributors, this place would become a standstill.


subject: Re: IT'S SO DAMN HOT.
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;My thread which initially started with a quote from Anchorman turns into a frank discussion about the forum&#039;s status.<br /><br />I never asked for this feel.


subject: Getting into glitching
poster_name: ShySkream
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I find it funny how I just joined and this is the most recent discussion :P<br /><br />I was surprised at how active this place was, considering how old most glitches are.&nbsp; I&#039;m fairly interested in hex codes and computer architecture and I&#039;ve done a few glitches on my Yellow cartridge, so I decided to check out some sources.&nbsp; My goal is to learn enough to be able to start finding my own glitches or maximizing some already discovered.&nbsp; It also helps that I don&#039;t mind editing wikis :)<br /><br />Anyone here have a similar interest in memory manipulation and such?&nbsp; any suggestions on things I should check out?


subject: Hi everyone!
poster_name: ShySkream
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was doing a bit of studying up on assembly code in my free time (totally not a nerd, I swear!) and I remembered how some glitches in Pokemon used hex codes to get certain results.&nbsp; I decided to do a bit of searching and found this place, which to my surprise was very much alive!&nbsp; I&#039;ve done a few glitches in the past on my Pokemon Yellow cartridge, and since then I&#039;ve learned how to understand processor instructions and like to think about how it all works.&nbsp; I also like to go on occasional wiki editing sprees, but I usually get tired out and don&#039;t edit for a while other than minor things.&nbsp; I will probably be active on the forum, though I haven&#039;t been part of one in quite a while.&nbsp; I spend a lot of time playing Team Fortress 2 and occasionally doing redstone in Minecraft.<br /><br />Any suggestions on relevant pages I should check out?&nbsp; I&#039;m more interested in understanding the functions in memory and abusing those, but manipulation and hacks are fine too.


subject: Re: Getting into glitching
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  If you&#039;re into long, drawn-out processes of testing things with different variables (location, screen data, etc.), you might try the *Dex area or maybe my Yellow Predefined Functions List and see what can be contributed there.


subject: Re: Getting into glitching
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Welcome to the forums ShySkream!<br /><br />A good resource for playing around with glitches is the [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map]PokÃ©mon Red RAM map[/url] or the [url=http://glitchcity.info/wiki/index.php/Pok%C3%A9mon_GameShark_codes]PokÃ©mon GameShark codes archive[/url]. Here you can find the locations of memory addresses for memory viewer (if you&#039;re using the GameShark codes archive; the address is the last four digits of the code in reverse endianness e.g. 01xx59D0 becomes D059), and look up the behaviour of undefined things, such as PokÃ©mon beyond 190 (Victreebel; if you modify D164 [PokÃ©mon 1 species byte 1] in Red/Blue), items beyond Max Elixer (83; if you modify D31E [item 1] and moves beyond Struggle (if you modify D173 [PokÃ©mon 1 move 1]). In PokÃ©mon Yellow, many of the RAM addresses are the same as the PokÃ©mon Red RAM address minus 1.<br /><br />If you need to look up which value corresponds with which PokÃ©mon, item or move; then we have a table for this called [url=http://glitchcity.info/wiki/index.php/The_Big_HEX_List]The Big HEX List[/url].<br /><br />Using the RAM map makes setting up for existing glitches relatively easy even if you do not have a save file. [url=https://sites.google.com/site/torchickens2/pokemon-save-files]On my Google Sites website[/url], I&#039;ve also prepared completed save files ideal for glitching purposes.<br /><br />If you want to edit a save from Generation III, it is sometimes harder but conveniently you can use a save file editor to do this known as [url=http://glitchcity.info/wiki/index.php/A-Save]A-Save[/url].<br /><br />I have videos explaining many glitches on my channel ChickasaurusGL you can use for studying, and [url=https://www.youtube.com/user/thezzazzglitch]TheZZAZZGlitch[/url], [url=https://www.youtube.com/user/CrystaL12RG]Crystal_[/url], [url=https://www.youtube.com/user/MissingnoXpert]MissingnoXpert[/url], and [url=https://www.youtube.com/user/zreety]Metarkrai M[/url] are examples of some of the other large channels specializing in glitching.<br /><br />Hope this helps! ^_^<br /><br />[quote author=Yeniaul link=topic=7513.msg200581#msg200581 date=1466633190]<br />If you&#039;re into long, drawn-out processes of testing things with different variables (location, screen data, etc.), you might try the *Dex area or maybe my Yellow Predefined Functions List and see what can be contributed there.<br />[/quote]<br />Yeah, when you work out how to change a &quot;thing&quot;, you are often able to find many &quot;glitch things&quot; (since a byte can hold up to 256 values; if the thing occupies two bytes there may be a maximum of 65536 values), the main thing being PokÃ©mon, items, etc. Often the effects are due to extrapolation; such as the pointer for the B2F item being taken from the end of the item pointer list and glitch things which execute code like [url=http://forums.glitchcity.info/index.php/topic,3733.0.html]glitch contacts[/url] can have very interesting effects.


subject: Re: Getting into glitching
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ShySkream link=topic=7515.msg200583#msg200583 date=1466636318]<br />Oh golly, I sure derailed this thread.<br /><br />Thanks for the info!<br />[/quote]<br />You&#039;re welcome! I&#039;ve split this segment of the thread into its own thread, &quot;getting into glitching&quot;.


subject: Re: IT'S SO DAMN HOT.
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [img]http://i.imgur.com/U7hO3DA.png[/img]<br /><br />I&#039;m a bit of a lurker<br /><br />Nah, but I&#039;m gonna start working again on that glitch base stats chart.


subject: Re: Creepiest 1st Generation Glitches
poster_name: MrGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: MrGlitch
icon: xx
body:
  Old thread is old.<br /><br />I&#039;ll nominate one that I just came across a few minutes ago.&nbsp; I&#039;ve seen it elsewhere but am not sure if it has an official name.&nbsp; Performed in R/B by changing the first byte at line 3906 to 9F, then activating the Fun Glitch Effects of this change by pressing &quot;A&quot; to stop dialogue boxes from loading all the way.&nbsp; <br /><br />Once in a while, something will sneak up on you after you&#039;ve played with an NPC&#039;s dialogue for a bit.&nbsp; As soon as you exit the conversation: oh s**t a battle.&nbsp; Sometimes it is a horizontally flipped Aerodactyl Missingno. sprite with one channel of the battle victory music.&nbsp; Other time (such as tonight), it is a scary glitch trainer with an indiscernible name who wants to fight you in YOUR HOUSE just because you dared to talk to your mother.&nbsp; Naturally the game crashes as soon as the &quot;(Fuckity Trainer Name) wants to fight!&quot; dialogue finishes loading.<br /><br />I&#039;d prefer strange trainers to stay out of my house, especially before I receive any Pokemon.<br /><br />(edit: same glitch trainer as in this video, but it crashed before any Pokemon were sent out: https://www.youtube.com/watch?v=Da-n1yldJLg )


subject: Re: IT'S SO DAMN HOT.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I guess Torchickens types faster than me, heh :P. I&#039;ll post what I wanted to post anyways, even if this post is late now.<br /><br />There is so much for you to know, depending on how deep you want to go. Here I&#039;ll talk about GB stuff, since I don&#039;t know much about newer gens.<br /><br />Level zero : good tools.<br />There are two emulators which are most accurate : BizHawk and BGB.<br />BizHawk is mostly used for TASing (as far as I know), and BGB may not be intuitive, but it has the best debugger you&#039;ll ever find.<br /><br />Level 1 : messing with memory.<br />To begin doing cool stuff, you should check Datacrystal.<br />They have a superb RAM map, go check it out !<br /><br />Level 1.5 : learning the machine<br />To dive even further, you must learn to know the machine. Fortunately for you (and us), the Game Boy is the best-documented Nintendo console.<br />First, know that the Game Boy&#039;s processor is derived from the z80 processor (its name is... the gbz80 !!).<br />So first, if you don&#039;t already know, learn z80. I can give you a tutorial designed for TI 8x calculators, because that&#039;s the way I learnt z80. See z80 ASM in 28 days.<br />Then you&#039;ll need to learn the differences between z80 and gbz80 (removed and added opcodes...)<br />That, I have no tutorial. Maybe we should do a wiki page on how to program in gbz80... dunno.<br />Now, you know how the processor works. Then, you must learn about the rest : check out gbdevwiki.<br /><br />Level 2 : Break It Down To The Code<br />Well, if you know how the machine works, time to dive into PokÃ©red or PokÃ©crystal.<br />These are complete disassemblies of the PokÃ©mon Red/Blue/Yellow and Crystal games, respectively. If you know how the machine works, you should be able to pick huge info out there.<br /><br /><br />Well, that&#039;s all I can tell for Gen I and II ; but you can also peek at Gen III, which also is quite known and understood ; but if you are an Uber Adventurer, you should check out Gen IV.<br /><br /><br />Side note for everyone : the list of generations we have ACE on :<br />* Gen 1 (8 methods as of now ? Maybe 9 soon)<br />* Gen 2 (2 methods, actually one per game :P)<br />* Gen 3 (although we need to stabilize this a bit)<br />And Gen 4 might be peeking at the corner... we should check more the invalid jumps caused by unstable tweaking.<br /><br /><br />Links :<br />BGB : http://gbdev.gg8.se/<br />BizHawk : http://tasvideos.org/BizHawk<br />Datacrystal : http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red_and_Blue:RAM_map<br />Also : http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold:RAM_map<br />z80 ASM in 28 days : http://tutorials.eeems.ca/ASMin28Days/<br />GBdevwiki : http://gbdev.gg8.se/wiki/<br /><br />Youtube : five well-known channels about PokÃ©mon glitches<br />TheZZAZZGlitch : http://youtube.com/user/TheZZAZZGlitch<br />Torchickens / ChickasaurusGL : http://youtube.com/ChickasaurusGL<br />Crystal_ : http://youtube.com/user/CrystaL12RG<br />MissingnoXpert : http://youtube.com/user/MissingnoXpert<br />Metarkrai : http://youtube.com/user/zeety/


subject: Re: Hi everyone!
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  As mentioned in the &quot;It&#039;s too damn hot&quot; topic, you should learn the inner workings of the GB and check out PokÃ©red / PokÃ©crystal.<br /><br />If you want to check out glitches, see<br />http://glitchcity.info/wiki/Category:Major_glitches<br />http://glitchcity.info/wiki/Category:Generational_Glitches<br /><br />You may like ACE a bit ^^


subject: Re: Getting into glitching
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well then, my recent post in the previous topic should also be moved. I guess I submitted after you moved, sorry &gt;&lt;


subject: What I have done?
poster_name: Cristi-Chan
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  So, basically, I don&#039;t know what I have done. I only started to hack a PokÃ©mon Gold ROM and this just hapenned.<br />You can download here to see what I meaning.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: MrGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes this is a result of ROM hacking, but as I&#039;ve managed to reproduce it several times, I think it&#039;s worth mentioning.&nbsp; As with most of my memory hacking exploits, it involves changing the first byte in line 3906 to 9F.<br /><br />In R/B, playing around a bit with the SNES at the very beginning of the game will somehow trigger an action related to the Fighting Dojo.&nbsp; The action of selecting (Yes/No) Hitmonchan is offered to the player, and if the player accepts, a perfectly normal Hitmonchan is added to the party.<br /><br />Although pretty much anything can happen in memory hacking, this seems to be one consistent feature that I&#039;ve found.&nbsp; It doesn&#039;t always happen when interacting with the SNES.


subject: Re: G/S/C glitch discussion
poster_name: MrGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: MrGlitch
icon: xx
body:
  [quote author=Torchickens link=topic=6594.msg195762#msg195762 date=1403117054]<br />Actually it does, but it&#039;s probably unused. Have one mail in the Mail Box, set A835 to hex:39, and the first &#039;letter&#039; (actually a control character) in the mail will be &#039;GREEN&#039;.<br />[/quote]<br /><br />Yep. I posted a while back about a glitchy mailbox in Gold that contained dozens of messages with &quot;GREEN&quot; as the body text.<br /><br />I would like to stress again just how much fun it is to change the first byte of line 0049 to &quot;11&quot;.<br />[img]http://i.imgur.com/wvfIej0.png[/img]


subject: Re: What I have done?
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: clip
body:
  [quote author=drc link=topic=7516.msg200592#msg200592 date=1466700501]<br />I don&#039;t see any problems. What emulator are you using?<br />[/quote]<br />THIS is what the OP was saying.<br />It changes with the last full-screen or building onscreen.


subject: Re: What I have done?
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  [quote author=Cristi-Chan link=topic=7516.msg200596#msg200596 date=1466715510]<br />Anyone know why this happens? My emulator is VisualBoyAdvance-M.<br />[/quote]<br />Occurs in TGB Dual too. 


subject: Re: What I have done?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Several entities that have you follow (The Old Man in ...whatever the second town is, for example) are broken... I think you fucked up a map bank or 8.


subject: Re: What I have done?
poster_name: Cristi-Chan
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7516.msg200598#msg200598 date=1466717401]<br />Several entities that have you follow (The Old Man in ...whatever the second town is, for example) are broken... I think you fucked up a map bank or 8.<br />[/quote]<br />I see... I think the best thing I can do is start over and hack a clean ROM. Oh, and the second town is called &quot;Cherrygrove City&quot;<br />^^


subject: Re: Creepiest 1st Generation Glitches
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I nominate Y165, which can be found using 01A51DD1.<br /><br />https://www.youtube.com/watch?v=Kin90o3WY0A


subject: Re: General Pokemon Glitchiness
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not sure if I&#039;ve posted this, but you can use 01EC1DD1 for Bird type-having PokÃ©mon in Yellow.


subject: How did you get into glitching?
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Title.<br /><br />I first got into glitching when I was 9 and got a (illegal, however I now own a copy) PokÃ©mon Yellow ROM and started figuratively shitting all over the memory viewer, until I encountered a game freeze accompanied by &quot;2 error.&quot; I then took a handheld mirror out of my bathroom, then recorded from my mom&#039;s laptop webcam. It was probably very cringy, (although the video isn&#039;t available since the computer is dead, and I&#039;m not paying a sum of money to dig up a shitty recording) I then started messing around and eventually bought some cartridges for my brother&#039;s old GBASP, which he gave to me since he had 2 for some reason. To this day, the gameboy is my favourite console.


subject: Re: How did you get into glitching?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hearing about the Mew Glitch, back in 2004, and getting some informations on PokÃ©Gods. Yep, it was that time.


subject: Re: What I have done?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, that one! Oh, make sure your map banks are all defined properly, as even one byte too many in size can cause this type of thing.&nbsp; ;D


subject: Re: How did you get into glitching?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  Reading some stuff about gen3 glitches in ~2005.<br /><br />My first ever play through of a PokÃ©mon game was around this time; and I&#039;d somehow managed to screw up my PokÃ©mon Ruby save file (most likely by cheating, I&#039;ve had my Xploder for GBA since 2003 or 2004) in such a way that I could not progress.


subject: Re: How did you get into glitching?
poster_name: Firebolt
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Firebolt
icon: xx
body:
  What a fitting topic for my first post. I had gotten into glitching back in 2008 or 2009 when I found out about Missingno., then proceeded to scour the internet for more information about any pokemon glitch. I spent a quite a lot of time watching youtube videos of various glitches and memory editing. Only recently have I wanted to become a part of the community, but I&#039;m not really sure what sort of things I could contribute to this community where many things have already been discovered, other than off-topic posts about computer keyboards...<br /><br />Time to lurk forever again :P


subject: Re: How did you get into glitching?
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I got into it when Missingnoxpert&#039;s LGPY series was recommended to me on Youtube. It doesn&#039;t have anywhere near the amount of details found here but it was hugely entertaining and a great watch. After that I found this place and lurked for about a year and a half before joining.


subject: Re: Hi everyone!
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You need to replace those spaces with underscores in order for the whole URL to be turned into a link.


subject: Re: How did you get into glitching?
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was in fifth grade and saw someone trigger an encounter with MissingNo. along the Cinnabar coast. I bought a copy of Red Version just so I could do it myself. <br /><br />


subject: Re: How did you get into glitching?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I played a nice Flash game full of pop culture references, and at some point the player &quot;sent out MISSINGNO&quot;. Then, I found bulbapedia&#039;s articles about PokÃ©mon glitches, and a reference link directed me to GCL wiki, which I got interested in quite quick.<br />Back in 2k14, I guess.


subject: Re: General Pokemon Glitchiness
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TwilightHakuryuu link=topic=715.msg199541#msg199541 date=1451525971]<br />[quote author=Krys3000 link=topic=715.msg199538#msg199538 date=1451461839]<br />This is a text box ID mismatching. It happens because the glitch loads the text box with the same ID than the last text box you opened which in your case is not 0 (start menu) anymore. You&#039;ll find more on GCL&#039;s article about the glitch :)<br />[/quote]<br /><br />Makes perfect sense for the dialogue box itself, but what of the lack of any encounter when I closed it and the reappearance of Gary? Does text box ID mismatching&#039;s effects extend to preventing the Mew Glitch from initiating an encounter and resetting flags for certain NPCs? Like causing the disappearing Snorlax as part of the Mew Glitch?<br />[/quote]<br />Uh, I guess in that case the game tries to find Gary&#039;s sprite in the internal sprite table in some way, however he disappeared and the game loops infinitely while infinitely looking for him. Damn brat, where&#039;d he go ??


subject: Re: How did you get into glitching?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Firebolt link=topic=7517.msg200607#msg200607 date=1466792670]<br />What a fitting topic for my first post. I had gotten into glitching back in 2008 or 2009 when I found out about Missingno., then proceeded to scour the internet for more information about any pokemon glitch. I spent a quite a lot of time watching youtube videos of various glitches and memory editing. Only recently have I wanted to become a part of the community, but I&#039;m not really sure what sort of things I could contribute to this community where many things have already been discovered, other than off-topic posts about computer keyboards...<br /><br />Time to lurk forever again :P<br />[/quote]<br />There&#039;s still a shit-ton left to find. I just recently compiled a list of Yellow predefined functions that will most likely end up in a Dex of its own. (Every tile, map, combination in stack, byte on screen, item/PkMn in inventory/PC, etc. affects the outcome of invalid ones, making 8x or so more outcomes than there are Go board combinations (Around 18x the number of atoms in the universe) so it&#039;d be a SHIT-TON of info!) Even after games are 20 or so years old, glitches are still just being found. SMB, SMB3 for NES both had new glitches found within the last few years. Point is, glitches will probably still be found in the Arcade version of Donkey Kong in 2100. Glitches are forever. Every byte has the potential to completely break shit. No game is an exception. Get good at a game, and new glitches will appear in front of you. It&#039;s a constant. (Like Rule 34 of the Internet, or the Speed of Light.)


subject: Re: How did you get into glitching?
poster_name: Firebolt
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Firebolt
icon: xx
body:
  Sorry for derailing this thread, but what sort of resources should I take a look at to better understand how this game works, including the fundamentals of the &#039;architecture&#039; of similar games?<br /><br />Like I have no idea where to begin, other than my basic surface level understanding of these glitches.


subject: Re: How did you get into glitching?
poster_name: joonas2345
poster_ip: ***.***.***.***
modified_name: joonas2345
icon: xx
body:
  [quote author=Firebolt link=topic=7517.msg200615#msg200615 date=1466870686]<br />Sorry for derailing this thread, but what sort of resources should I take a look at to better understand how this game works, including the fundamentals of the &#039;architecture&#039; of similar games?<br /><br />Like I have no idea where to begin, other than my basic surface level understanding of these glitches.<br />[/quote]<br /><br />Link to Pokemon Red &amp; Blue RAM and ROM maps: [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red_and_Blue]http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red_and_Blue[/url]<br />This video series helped me understand pokemon Gold/Silver/Crystal: [url=https://www.youtube.com/watch?v=P55prFTaZoE&amp;list=PL_91s-bjHU__doGoOWcSWv4fYoMAtnM8u&amp;index=1]https://www.youtube.com/watch?v=P55prFTaZoE&amp;list=PL_91s-bjHU__doGoOWcSWv4fYoMAtnM8u&amp;index=1[/url]<br /><br />Here is Skeetendo thread about GEN 1 and GEN 2 Music hacking: [url=https://hax.iimarck.us/topic/11/]https://hax.iimarck.us/topic/11/[/url]<br /><br />ASM School is a great resource, as well: [url=http://gameboy.mongenel.com/asmschool.html]http://gameboy.mongenel.com/asmschool.html[/url]<br />GbDev wiki contains various resources about Game Boy: [url=http://gbdev.gg8.se/wiki/articles/Main_Page]http://gbdev.gg8.se/wiki/articles/Main_Page[/url]<br />You should take look at the Pan Docs: [url=http://gbdev.gg8.se/wiki/articles/Pan_Docs]http://gbdev.gg8.se/wiki/articles/Pan_Docs[/url]<br />Pokered disassembly will be very useful once you learn ASM: [url=https://github.com/pret/pokered]https://github.com/pret/pokered[/url]<br /><br /><br />EDIT1: I forgot the Big list: [url=http://glitchcity.info/wiki/index.php/The_Big_HEX_List]http://glitchcity.info/wiki/index.php/The_Big_HEX_List[/url]<br />Also, TASVideos page contains some info that might prove useful: [url=http://tasvideos.org/GameResources/GBx/Pokemon.html]http://tasvideos.org/GameResources/GBx/Pokemon.html[/url]<br />GB pointer tutorial: [url=http://www.pokecommunity.com/showthread.php?t=235574]http://www.pokecommunity.com/showthread.php?t=235574[/url]<br /><br />EDIT2: You also need some tools...<br />an accurate emulator[1] (gambatte, [bizhawk] or BGB).<br />VBA is fine for quick testing but it isn&#039;t 100% accurate.<br />Link to BGB: [url=http://bgb.bircd.org/]http://bgb.bircd.org/[/url]<br />BGB has a great debugger.<br /><br />You need a hex editor (E.G. wxHexEditor (cross-platform), HxD or GoldFinger ([b]has support for table files[/b]):<br />GoldFinger: [url=http://www.romhacking.net/utilities/204/]http://www.romhacking.net/utilities/204/[/url]<br />wxHexEditor: [url=http://www.wxhexeditor.org/]http://www.wxhexeditor.org/[/url]<br />HxD: [url=https://mh-nexus.de/en/hxd/]https://mh-nexus.de/en/hxd/[/url]<br /><br />[1] See [url=http://gbdev.gg8.se/wiki/articles/Test_ROMs]http://gbdev.gg8.se/wiki/articles/Test_ROMs[/url] for details.<br /><br />EDIT3: [url=http://glitchcity.info/wiki/index.php/GB_Programming]http://glitchcity.info/wiki/index.php/GB_Programming[/url]


subject: Re: How did you get into glitching?
poster_name: Firebolt
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you very much for these resources, will begin to read them shortly, and then hopefully I will be able to make contributions!


subject: Re: How did you get into glitching?
poster_name: TMTRAINER
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TMTRAINER
icon: xx
body:
  While not really a researcher, I had a friend who showcased some of the more classic glitches, like the MissingNo. from Old Man glitch, and I instantly became enthralled with the fact that these games, which in my young 9 year old mind, were no longer perfect and I was the kind of person who loved to see how far games could go with the interesting quarks I could find in them.<br /><br />Soon, I came across GCL and have been lurking around here for years (bar the time GCL was down). It&#039;s absolutely insane what has developed here over time, and it&#039;s been a pleasure reading through all this stuff.<br /><br />A then a few years later, I came across Werster who was running some of the older games, and absolutely decimated one of the gen 2 games. That&#039;s when I really wanted to try some of the stuff myself. <br /><br />Not a really groundbreaking way to get into glitching, but I&#039;m a fan of the subject.<br /><br />EDIT: Currently 20, I&#039;ve been literally interested in glitches since I was 9. Time flies, yo.


subject: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What I want to know is why and how this occurs, as well as where the name comes from. I know the stack pointer decreases significantly for every textbox. Here is the video:<br />[youtube]https://www.youtube.com/watch?v=njs98Ulf7gc[/youtube]


subject: Glitch-Inspired Music
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: exclamation
body:
  Since there is no section for music, this is where this post will go.<br /><br />[s]I am currently composing music based on Pokemon glitches, based on their instability, usefulness, and potential for harm to a save. <br />[color=yellow]Composed music is based on a program I wrote for type, tempo and mood generation. I then wrote the music based on this.[/color]<br /><br />So far, I have 10 written, but since the program I&#039;m using is on my DSi, they have to be transferred to a PC via Auxiliary cord. <br /><br />6-25-16: I have 2 recorded, edited, and finalized, and 1 recorded, but not edited. <br /><br />6-26-16: Fixed #7. I dropped a clip in the wrong place. EDIT 2: Got #3 edited and finalized.<br /><br />7-1-16: Finally got off my ass and bought a new AUX cable. Recording all of them now for future edits. EDIT: Only got one done. Procrastination!<br /><br />7-12-16: AUDIO OUT has crapped out on my DSi. Since I cannot continue, I&#039;ll post what I have below and leave it at that. dammit... EDIT: Recording continues! ~$150 dropped into new AUDIO OUT port.<br /><br />8-9-16: To celebrate the server migration being over [s]FUCKING FINALLY[/s] I got off my ass and recorded 2 or 3 more.<br /><br />This post will be [color=white]edited[/color] when news is available.<br /><br /><br />I hope you guys realize how dedicated I am to this site![/s]<br /><br /><br />[size=36pt]RELEASE: https://goo.gl/C7U7Tt[/size]<br />HOLY s**t this took a while! Sorry about that, but jobs and all.


subject: Re: Glitch-Inspired Music
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Can I make a request? If not, just let me know. I think a rock version of a variation on Female symbol&#039;s cry would be cool. I tried it once, but didn&#039;t get anywhere.


subject: Re: How did you get into glitching?
poster_name: MrGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  WillisTheUnbreakable and Krauser912 on YouTube.<br /><br />It&#039;s been nine years since WTU made his last Pokemon glitch video.&nbsp; Wow.


subject: Re: How did you get into glitching?
poster_name: joonas2345
poster_ip: ***.***.***.***
modified_name: joonas2345
icon: xx
body:
  [quote author=Firebolt link=topic=7517.msg200619#msg200619 date=1466888893]<br />Thank you very much for these resources, will begin to read them shortly, and then hopefully I will be able to make contributions!<br />[/quote]<br />No problem. I added some additional links to some tools and resources that I forgot to include.<br /><br /><br />But back to the original topic.<br />I got into glitching when I found some forum topic about missingNO. It was back in 2006 (IIRC) when TRsRockin was alive. However, back then I couldn&#039;t understand English, so I had to guess what everything meant or ask my mum to translate it for me. <br /><br />But in 2010 or 2009 I found GCL. I had become better at English and I started learning about less well known glitches. I tried some of them myself and I started to become interested about technical details behind the glitches so I started lurking here.


subject: Re: How did you get into glitching?
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m here just because I need some information for a youtube&#039;s series of videos.<br />I actually learned how to hack third gen pokemon games in 2008 with fanmade tools and I was introduced to ASM without really getting into it.<br />Now I don&#039;t do anything since I work on mac and there was no good emulator I could find with all the VBA&#039;s tools.


subject: How to fix dry PC underflow
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dante
icon: xx
body:
  I got the underflow and I exploited it but now it really bothers me.<br />First: when I deposit an item I have to scroll all the way down to get it back.<br />Second: since the items are stored beyond the limit i suppose that I&#039;m actually changing random bytes and this thing bothers me. What kind of datas are stored after the PC items?<br /><br />So... How do I fix it?<br />PS: On EU Pokemon Red.


subject: Re: How did you get into glitching?
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MrGlitch link=topic=7517.msg200626#msg200626 date=1466921333]<br />WillisTheUnbreakable and Krauser912 on YouTube.<br /><br />It&#039;s been nine years since WTU made his last Pokemon glitch video.&nbsp; Wow.<br />[/quote]<br /><br />I used to watch them a lot, along with other names like agusganog, AndrewFMs&#039; &quot;PokÃ©mon with no PokÃ©mon&quot;, some weird newgrounds&nbsp; animation of glitch city (my favourite line is &quot;i am borken&quot;), some narration of let&#039;s horribly break pokÃ©mon blue which has since been deleted, and some guy that starts with a p


subject: Re: How to fix dry PC underflow
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you triggered the traditional underflow which makes your stored items number to be 255, I guess normally it should be fixed by storing several new items (which would make the counter to go to 1). Otherwise you could still withdraw/toss every extra item.


subject: Re: How to fix dry PC underflow
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dante
icon: xx
body:
  I&#039;ll try.<br />By the way, could I use ACE in order to set the counter back to 50?<br /><br />Edit: oh, i followed your method, by cutting the tree in the glitch city. So I guess I set that to be 109-ish


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In Pokemon Yellow using ws m is it possible to change the trainer ID? <br /><br />I read somewhere that you could, but not sure and never seen a video showing it.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Ketchup901
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is there a catch &#039;em all script for Yellow? Or at least RAM/ROM maps so I can try to convert it myself?


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve heard if you encounter missingno, then beat the hall of fame and don&#039;t encounter missingno after that - the hall of fame won&#039;t be glitched. <br /><br />Is this true? Kinda wanna test this but if someone knows for sure, would save a few hours of playing.<br /><br />Also heard the stable versions of missingno: Kabutops fossil, Aereodactyl fossil and pokemon tower ghost - will not glitch the hall of the fame if you encounter them because they&#039;re not glitched sprites?


subject: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystal_
icon: xx
body:
  So I&#039;ve been looking into this glitch...<br />https://www.youtube.com/watch?v=I_JjAIvG9zA<br /><br />The thing is, there are a total of 11 sprites in the oak&#039;s lab before getting your first Pokemon: 2 Pokedex, Oak, Blue, 3 Pokeballs, a lady, 2 scientists, and yourself. That&#039;s one more than the number allowed to be displayed at once, as the OAM buffer can only hold data for 40 objects (fe00-fe9f) and each sprite is made of 4.<br /><br />There is a 10-half-block vertical separation between the two dexes and the two scientists though, meaning they should never be all displayed at once, EXCEPT when you are four half-blocks above the scientists and walk up, or when you are four half-blocks below the dexes and walk down. In these cases, parts of all four sprites are on screen as the background map scrolls during your movement.<br /><br />The issue comes from the clear unused OAM routine: https://github.com/pret/pokered/blob/2b2c6fe/engine/overworld/oam.asm#L147<br />If there are 11 sprites, hOAMBufferOffset is going to end up becoming $b0 given that PrepareOAMData is taking care of what would be a total of 44 objects ($00 to $af). Normally, it should be multiples of $10 from $00 through $a0. The game would then attempt to clear unused OAM data starting from what should be the last sprite in use, indicated by hOAMBufferOffset. If there are, say, 6 sprites on screen, every four bytes from $c360 to $c3a0 are set to $a0 in order to make all those sprites invisible in the wram sprite buffer (y coordinate of $a0 is just below the screen). If there are 11 sprites, however, every four bytes from $c3b0 through $c4a0 are going to become corrupted with $a0 because the game won&#039;t stop until the lower byte of the address equals $a0 (supposed to be the address of the last sprite when preceded by $c3). With the tilemap starting at $c3a0, this leads to the screen getting corrupted with character &quot;a&quot; every four tiles.<br /><br />Most of the times, however, the scientists are alrealdy invisible by the time the pokedexes show up, so there are never more than 9 sprites overlapping. But it&#039;s not always, given that the glitch pops up every once in a while, which leaves me wondering, what is the timing factor that leads to the pokedex sprites appearing when the scientists are still considered to be visible?<br /><br />Anyway, after that, some sprites seemingly at random became invisible, leaving only a total of five on screen, but I haven&#039;t really looked beyond that. So yeah, has anyone been able to figure out more than me about this mysterious glitch?<br /><br />EDIT: Figured out why the sprites disappear. If they are above one of the corrupted tiles, the tile will have a value higher than $60 (because they were corrupted with $a0), so the game thinks they are hidden by a text box: https://github.com/pret/pokered/blob/master/engine/overworld/movement.asm#L508<br />


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Nostalgia link=topic=36.msg200637#msg200637 date=1467033203]<br />I&#039;ve heard if you encounter missingno, then beat the hall of fame and don&#039;t encounter missingno after that - the hall of fame won&#039;t be glitched. <br /><br />Is this true? Kinda wanna test this but if someone knows for sure, would save a few hours of playing.<br />[/quote]<br /><br />Yes, when we obtain our first Hall of Fame induction, you may register the glitch PokÃ©mon and receive an &#039;ordinary&#039; Hall of Fame. :)<br /><br />A glitch PokÃ©mon in a Hall of Fame induction sequence (for registering the PokÃ©mon) may appear as the previous valid sprite or block consisting of a combination of tiles, which is reminiscent of ????? from Generation II.<br /><br />[img]http://i.imgur.com/b0dWKTf.png[/img][img]http://i.imgur.com/9B9NlWj.png[/img]<br /><br />If further Hall of Fame corruptions are registered with Missingno., it is possible that you will corrupt the listing; even if you never send out the Missingno.<br /><br />Viewing the opponent&#039;s side sprite of Missingno. or sending one into battle will corrupt the Hall of Fame if a listing exists, but it is safe to view the summary of Missingno. and keep the Hall of Fame data.<br /><br />You can use the CoolTrainerâ™€ move in RB to capture a level 127 hex:32 Missingno. and keep the Hall of Fame data even if you have a listing:<br /><br />1) Obtain a &#039;CoolTrainer&#039; Ditto by having it transform and swapping the second move with the first.<br />2) Enter Diglett&#039;s Cave and enter a battle.<br />3) Open the PokÃ©mon menu from within battle (important), then close the menu with B and enter the fight menu. Move the cursor until the music fades out, and then capture the Missingno. Your sixth item will be duplicated by 128 if less than 128.<br />4) After the battle, open the start menu and close it to avoid a freeze before leaving.<br /><br />[quote author=Nostalgia link=topic=36.msg200637#msg200637 date=1467033203]<br />Also heard the stable versions of missingno: Kabutops fossil, Aereodactyl fossil and pokemon tower ghost - will not glitch the hall of the fame if you encounter them because they&#039;re not glitched sprites?<br />[/quote]<br />That&#039;s true. Encountering stable Missingno. (Kabutops Fossil, Aerodactyl Fossil and PokÃ©mon Tower Ghost) on the opponent&#039;s side won&#039;t glitch the Hall of Fame. However, it appears that specific backsprites for these PokÃ©mon may glitch the Hall of Fame. I was successfully able to corrupt it with B6 Missingno. when the foe was Caterpie, but not Pikachu â€” both gave glitchy sprites (The back-sprite of the PokÃ©mon is sourced from the two byte pointer of the enemy PokÃ©mon with a bank B for Kabutops Fossil Missingno. and bank D for Aerodactyl and Ghost Missingno.).


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Ketchup901 link=topic=6638.msg200636#msg200636 date=1467008627]<br />Is there a catch &#039;em all script for Yellow? Or at least RAM/ROM maps so I can try to convert it myself?<br />[/quote]<br /><br />Yes. The &#039;instant battle&#039; catch &#039;em all script is the same as the Red/Blue catch &#039;em all script other than we change address D059 to D058 (this is the case with many addresses in Yellow; there is a subtraction of 1 and usually when you see an address in the DXXX you may be able to subtract 1 to get the Yellow address); hence we can use a TM34 x88 instead of TM34 x89.<br /><br />Like this:<br />[code]<br />Item 3: Lemonade x(xx)<br />Item 4: TM34 x88<br />Item 5: TM08 x201<br />[/code]<br /><br />[code]3E xx EA 58 D0 C9[/code]<br /><br />[code]ld a,xx<br />ld (D058),a<br />ret[/code]<br /><br />(As always, this will only work with bootstrap code to item 3 such as [url=http://forums.glitchcity.info/index.php/topic,6638.msg194861.html#msg194861]this setup by Pigdevil2010[/url])<br /><br />In case you don&#039;t know more addresses can be found on [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map#Pokemon_1_Settings]the PokÃ©mon Red RAM map[/url] and [url=https://github.com/pret/pokered/blob/master/wram.asm]PokÃ©mon Red disassembly/WRAM[/url] :) â€” we can subtract 1 from them to get many of the Yellow addresses except for some such as CD38 (which when 1 allows us to walk through walls).<br /><br />Additionally, if you want to receive the PokÃ©mon as a gift; the code needs to be adjusted to account for [url=http://forums.glitchcity.info/index.php/topic,6638.msg196352.html#msg196352]the change of a location of a routine in the ROM[/url]:<br /><br />[code]<br />Item 3: Repel x[SpeciesIndex]<br />Item 4: X Speed&nbsp; x14<br />Item 5: Ultra Ball x64<br />Item 6: TM05&nbsp; x89<br />Lemonade x201[/code]<br /><br />Code:<br />[code]1E 20 43 0E 02 40 CD 48 3E C9[/code]<br /><br />ASM:<br />[code]<br />ld&nbsp;  e,[SpeciesIndex]<br />ld&nbsp;  b,e<br />ld&nbsp;  c,02<br />ld&nbsp;  b,b<br />call 3E48<br />ret<br />[/code]<br /><br />Hope this helps! ^_^


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6638.msg200635#msg200635 date=1466980362]<br />In Pokemon Yellow using ws m is it possible to change the trainer ID? <br /><br />I read somewhere that you could, but not sure and never seen a video showing it.<br />[/quote]<br /><br />Yes. Here is some code for that sole purpose. :)<br /><br />[code]<br />ld a,xx<br />ld e,yy<br />ld h,d3<br />ld l,58<br />ldi (hl),a<br />ld (hl),e<br />ret<br />[/code]<br /><br />[code]3E xx 1E xx 26 D3 2E 58 22 73 C9[/code]<br /><br />[code]<br />Lemonade x (xx)<br />Repel x (yy)<br />Carbos x 211<br />X Accuracy x88<br />Water Stone x115<br />TM01 x(any)<br />[/code]<br /><br />(The X Accuracy is x89 in Red/Blue)<br /><br />Where the quantity of the Lemonade is the first byte of your new Trainer ID (in hexadecimal) and the quantity of the Repel is the second byte of your Trainer ID (in hexadecimal). For example, if we want the Trainer ID 42965, we can go on Windows Calculator or use [url=http://www.binaryhexconverter.com/hex-to-decimal-converter]a converter[/url] and convert it to get hex:A7D5 (A7 for byte 1 or D5 for byte 2. A7 converts into 167 in decimal, while D5 converts into 213 in decimal). We cannot have Trainer IDs greater than 65535, sadly.<br /><br />The changes are invisible until you capture a new PokÃ©mon, because the Trainer Card doesn&#039;t display the Trainer ID in Generation I.<br /><br />With the &#039;in-built GameShark code&#039; in [url=http://forums.glitchcity.info/index.php/topic,6638.msg200510.html#msg200510]my earlier post[/url] designed for multiple tasks (note that for Yellow version we use X Accuracy x34), you can use use the Lemonade as your byte value (e.g. A7) and Carbos x 211, X Accuracy x 88 as the other parameters (h [address byte 1], and l [address byte 2]).<br /><br />Additionally, if we activate the [url=http://glitchcity.info/wiki/index.php/Expanded_item_pack]expanded items pack[/url], your Trainer ID addresses can be found as item 30&#039;s quantity (byte 1) and item 31 (byte 2), which means that if you want to have a particular ID you can get most by tossing from item 30, and changing item 31. The ID 01234 (04D2 in hexadecimal) could be obtained with a quantity of 4 in item 30 and a &#039;D2 item&#039; ([url=http://glitchcity.info/wiki/index.php/The_Big_HEX_List]TM10 according to The Big HEX List[/url]) in item 31. Glitch items can be obtained with the [url=http://glitchcity.info/wiki/index.php/Celadon_looping_map_trick]Celadon looping map trick[/url], but if you want to do this make sure you carefully navigate the menu slowly with B; as a &#039;long name glitch item&#039; can easily freeze your game (and there is a chance of Continue being removed from the options) if the A button is pressed on it.<br /><br />Hope this helps. ^_^


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Torchickens, while I appreciate the detailed response I think you misunderstood my first question, all I want to know is can one encounter missingno just for item duping - before beating the elite 4 - then beat the elite four with a team regular pokemon and will the hall of fame be glitch free? <br /><br />As I have read that the corrupting of hall of fame data - comes from encountering missingno after beating the elite four and that scrambles your saved hall of fame data and corrupts it with a bunch of glitch pokemon. So my thinking is, prior to beating the elite four there would be no saved hall of fame data so there would be nothing to corrupt? I could be wrong with this statement, that&#039;s why I want to know.<br /><br />You see, I never mess around with catching glitch pokemon and just use missingno for item duping. :) And I recently lost a perfect Red file, so I want play through the game again but this time I want to try to not corrupt the hall of fame if possible.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=36.msg200642#msg200642 date=1467062697]<br />Torchickens, while I appreciate the detailed response I think you misunderstood my first question, all I want to know is can one encounter missingno just for item duping - before beating the elite 4 - then beat the elite four with a team regular pokemon and will the hall of fame be glitch free? <br /><br />As I have read that the corrupting of hall of fame data - comes from encountering missingno after beating the elite four and that scrambles your saved hall of fame data and corrupts it with a bunch of glitch pokemon. So my thinking is, prior to beating the elite four there would be no saved hall of fame data so there would be nothing to corrupt? I could be wrong with this statement, that&#039;s why I want to know.<br /><br />You see, I never mess around with catching glitch pokemon and just use missingno for item duping. :) And I recently lost a perfect Red file, so I want play through the game again but this time I want to try to not corrupt the hall of fame if possible.<br />[/quote]<br /><br />Oh, it looks like I was under the impression you meant entering the Hall of Fame with a Missingno. in the party. Sorry about that.<br /><br />Yes. If you encounter a Missingno. and then receive your first Hall of Fame listing, the Hall of Fame will be glitch free until you encounter Missingno. (or certain other garbage sprite glitch PokÃ©mon) again. :)


subject: Swift (Speed Star) in Japanese 1st Gen
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In English RBY, Swift ignores accuracy/evade modifiers. However, I noticed it missing in Japanese Green and Yellow when modified accuracy/evade were in effect. I searched for information about this for a long time, found nothing on the usual English sites, and remarkably little when searching in Japanese (results below). Is this difference true in general? Does anyone here have a real Japanese cartridge to test with? And if it&#039;s true, how did it happen that hardly anyone noticed?<br /><br /><br />Basic info websites just say it always hits, the same as the English sites:<br /><br /><br />http://pokemon.g-takumi.com/skill63.html<br /><br />[quote]èµ¤ç·‘é’ãƒ”ã‚«ãƒãƒ¥ã‚¦æ”»ç•¥<br />ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼<br />ã‚³ãƒ¡ãƒ³ãƒˆ: æ•µã«æ”»æ’ƒãŒå¿…ãšå½“ãŸã‚‹<br /><br />Red-Green-Blue-Pikachu guide<br />Speed Star<br />Comment: attack always hits the enemy[/quote]<br /><br /><br />[url=http://games.gaym.jp/GB/pokemon_rgbp/wiki/?%E3%82%B9%E3%83%94%E3%83%BC%E3%83%89%E3%82%B9%E3%82%BF%E3%83%BC]http://games.gaym.jp/GB/pokemon_rgbp/wiki/?ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼[/url]<br /><br />[quote]ãƒã‚±ãƒƒãƒˆãƒ¢ãƒ³ã‚¹ã‚¿ãƒ¼ èµ¤ãƒ»ç·‘ãƒ»é’ãƒ»ãƒ”ã‚«ãƒãƒ¥ã‚¦ æ”»ç•¥wiki <br />ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼<br />èª¬æ˜Ž: å¿…ãšæ”»æ’ƒãŒå½“ãŸã‚‹<br /><br />Pokemon Red-Green-Blue-Pikachu guide wiki<br />Speed Star<br />Explanation: attack always hits[/quote]<br /><br /><br />[url=http://wiki.ãƒã‚±ãƒ¢ãƒ³.com/wiki/%E3%82%B9%E3%83%94%E3%83%BC%E3%83%89%E3%82%B9%E3%82%BF%E3%83%BC]http://wiki.ãƒã‚±ãƒ¢ãƒ³.com/wiki/ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼[/url]<br /><br />[quote]èª¬æ˜Žæ–‡<br />ãŸãŸã‹ã†ã‚ã–<br />ç¬¬äºŒä¸–ä»£:ãœã£ãŸã„ã« ã‚ˆã‘ã‚‰ã‚Œãªã„ ã»ã—ãŒãŸã® ã“ã†ã›ã‚“ã‚’ ã‚€ã™ã†ã« ã¯ã£ã—ã‚ƒã™ã‚‹<br />...<br /><br />Explanatory Note<br />Battle Skill<br />Second Generation: Shoots a completely unavoidable beam of stars<br />...[/quote]<br /><br />This page just quotes the descriptive text from the games, and there wasn&#039;t any in 1st Gen. So it doesn&#039;t specifically say that the effect applies to 1st Gen, but doesn&#039;t say otherwise either, and it would make sense to mention something like that.<br /><br /><br />[url=https://ja.wikipedia.org/wiki/%E3%83%9D%E3%82%B1%E3%83%83%E3%83%88%E3%83%A2%E3%83%B3%E3%82%B9%E3%82%BF%E3%83%BC%E3%81%AE%E6%8A%80%E4%B8%80%E8%A6%A7_%28%E3%81%95-%E3%81%AE%29]https://ja.wikipedia.org/wiki/ãƒã‚±ãƒƒãƒˆãƒ¢ãƒ³ã‚¹ã‚¿ãƒ¼ã®æŠ€ä¸€è¦§_(ã•-ã®)[/url]<br /><br />I can&#039;t entirely read this, but maybe it does explain the situation.<br /><br />[quote]ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼<br />ãƒŽãƒ¼ãƒžãƒ«ã‚¿ã‚¤ãƒ—ã®ç‰¹æ®ŠæŠ€ã€‚è‡ªåˆ†ã®å‘½ä¸­çŽ‡ã‚„ç›¸æ‰‹ã®å›žé¿çŽ‡ã«é–¢ä¿‚ãªãå¿…ãšå‘½ä¸­ã™ã‚‹ã€‚ç›¸æ‰‹å…¨ä½“ã«æœ‰åŠ¹ã€‚<br />ã€Žç¬¬ä¸€ä¸–ä»£ã€ã§ã¯ã‚²ãƒ¼ãƒ ä¸­ã§ã¯å¿…ä¸­ã¨èª¬æ˜Žã•ã‚Œã‚‹ã‚‚ã®ã®ã€å®Ÿéš›ã¯å‘½ä¸­çŽ‡ãŒ100ã®æŠ€ã§ç›¸æ‰‹ã®çŠ¶æ…‹ã«ã‚ˆã£ã¦ã¯å›žé¿ã•ã‚Œã‚‹ã“ã¨ã‚‚ã‚ã‚‹ã€‚ãªãŠã“ã®æ€§èƒ½ã¯æ—¥æœ¬ç‰ˆã®ã¿ã§ã€æµ·å¤–ç‰ˆã§ã¯å¿…ä¸­ã«åŠ ãˆã€ã€Œã‚ãªã‚’ã»ã‚‹ã€ã§åœ°ä¸­ã«æ½œã£ã¦ã„ã‚‹ç›¸æ‰‹ã‚„ã€Œãã‚‰ã‚’ã¨ã¶ã€ã§ç©ºä¸­ã«é£›ã³ä¸ŠãŒã£ã¦ã„ã‚‹ç›¸æ‰‹ã«ã‚‚å½“ãŸã‚‹ã€‚<br />ã‚¢ãƒ‹ãƒ¡ã§ã¯å›žé¿ã•ã‚Œã‚‹ã“ã¨ãŒã‚ã‚‹ã€‚<br /><br />Speed Star<br />Normal type unique skill. Always hits regardless of own accuracy and opponent&#039;s evade. It always affects the opponent (???).<br />In the 1st Gen games it was explained as &quot;hitting the target&quot;, in practice it was a 100% accuracy skill that could be evaded depending on the opponent&#039;s status. This was possible only in the Japanese version (???), in overseas versions in addition to hitting the target, it would hit opponents while underground for Dig or in the air for Fly.<br />In America, it could hit the target without evasion (???).[/quote]<br /><br /><br />Then we get to obscure posts on Q&amp;A sites:<br /><br /><br />http://pokemon.g-takumi.com/bbs_detail.php?bbs_id=3762<br /><br />[quote]ãƒžã‚¶ãƒ¼:<br />ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ãŒå¤–ã‚ŒãŸã‚“ã§ã™ãŒæœ‰ã‚Šå¾—ã‚‹ã§ã—ã‚‡ã†ã‹ï¼Ÿ<br />Speed Star missed but is this possible?<br /><br />ã‚:<br />æœ‰ã‚Šå¾—ã¾ã™ã‚ˆ<br />Yes it&#039;s possible.<br /><br />ãƒžã‚¶ãƒ¼:<br />çµ¶å¯¾å½“ãŸã‚‹ã®ã§ã¯ãªã„ã®ã§ã™ã‹ï¼ï¼Ÿ<br />It doesn&#039;t always hit!?<br /><br />ã®ã‚Š:<br />åˆä»£ã§ã¯ã€Œå¿…ä¸­æŠ€ã€ã¨å‘¼ã¹ã‚‹æŠ€ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚<br />ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ã‚‚ã€ãŸã ã®å‘½ä¸­çŽ‡100%ã®æŠ€ã«éŽãŽãªã„ã®ã§ã™ã­ã€‚<br />ãã—ã¦ã€ãªãœã‹å‘½ä¸­çŽ‡100%ã¨ã•ã‚Œã¦ã„ã‚‹æŠ€ã§ã‚‚0.4%ã®ç¢ºçŽ‡ã§å¤–ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã€‚<br />In 1st gen it wasn&#039;t called the &quot;hitting the target&quot; skill.<br />It just had a 100% accuracy rate. <br />And somehow, even 100% accuracy skills had a 0.4% chance of missing.<br /><br />ãƒžã‚¶ãƒ¼:<br />ãã†ãªã‚“ã§ã™ã‹â€¦<br />ã§ã¯ã‚„ã¯ã‚Šã‹ã’ã¶ã‚“ã—ã‚“ã§ã®å½±éŸ¿ã‚‚å‡ºã‚‹ã‚“ã§ã—ã‚‡ã†ã‹ï¼Ÿ<br />Is that so...<br />So Double Team will have an effect after all?<br /><br />0:<br />ã€Žã‹ã’ã¶ã‚“ã—ã‚“ã€ã€Žã™ãªã‹ã‘ã€ã€Žãƒ•ãƒ©ãƒƒã‚·ãƒ¥ã€etc å…¨ã¦å½±éŸ¿å—ã‘ã‚‹ã¯ãšã§ã™ã‚ˆã€‚<br />Double Team, Sand Attack, Flash etc should all have an effect.<br /><br />ãƒžã‚¶ãƒ¼:<br />ãã†ã§ã™ã‹â€¦æ®‹å¿µã§ã™<br />Is that so... too bad.[/quote]<br /><br /><br />http://detail.chiebukuro.yahoo.co.jp/qa/question_detail/q10145018325<br /><br />And finally a complete explanation, if it&#039;s correct...<br /><br />[quote]sensui2231ã•ã‚“:<br />ãƒã‚±ãƒ¢ãƒ³ã®èµ¤ç‰ˆã‚’ã‚„ã£ã¦ã„ãŸã‚‰ã€ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ãŒå¤–ã‚Œã¾ã—ãŸã€‚<br />ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ã£ã¦çµ¶å¯¾ã‚ãŸã‚Šã¾ã™ã‚ˆã­ï¼Ÿ<br />ä¸€ä½“ã©ã†ã„ã†ã“ã¨ã§ã—ã‚‡ã†ã‹ï¼Ÿ<br />ã¡ãªã¿ã«ã“ã¡ã‚‰ã¯ã‚¹ã‚¿ãƒ¼ãƒŸãƒ¼ã§ãƒ¬ãƒ™ãƒ«33ã€ç›¸æ‰‹ã¯ãƒ”ãƒƒãƒ”ã§ãƒ¬ãƒ™ãƒ«33ã€å°ã•ããªã‚‹ã‚’ä¸€å›žä½¿ã£ã¦ã„ãŸ <br />I was playing Pokemon Red and Speed Star missed.<br />Doesn&#039;t Speed Star always hit?<br />What&#039;s going on?<br />By the way, this was a L33 Starmie, and the opponent was a L33 Clefairy which had used Minimize once.<br /><br />gigafa_1007ã•ã‚“:<br />å¿…ä¸­ã«ãªã‚‹ã®ã¯é‡‘éŠ€ã‹ã‚‰ã§ã™ã€‚<br />æµ·å¤–ç‰ˆã¨ãƒã‚±ãƒ¢ãƒ³ã‚¹ã‚¿ã‚¸ã‚¢ãƒ 2ä»¥å¤–ã®åˆä»£ã‚½ãƒ•ãƒˆã§ã¯æ™®é€šã®æŠ€ã§ã™<br />Hitting the target was from Gold and Silver onwards.<br />Except the overseas editions and Pokemon Stadium 2, in 1st Gen it was an ordinary skill.<br />[/quote]


subject: Re: How to fix dry PC underflow
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I wasn&#039;t able to do that ):<br />The problem is that I would need way to much items to fill the PC and I can&#039;t find enough of them ):


subject: Re: How to fix dry PC underflow
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Dante, I worked on a code for this in French, Spanish, German and Italian Red.<br /><br />Lemonsucco x50<br />Carburante x213<br />Precisione X x63<br />Pietraidrica x4<br />Precisione X x164<br />Repellente x255<br />PokÃ© Ball x115<br />MT04 x1<br /><br />[code]<br />ld a,32<br />ld h,D5<br />ld l,3F<br />ldi (hl),a<br />inc b<br />ld l,A4<br />ld e,FF<br />inc b<br />ld (hl),e<br />ret<br />[/code]<br /><br />[code]3E 32 26 D5 2E 3F 22 04 2E A4 1E FF 04 73 C9[/code]<br /><br />The code sets the number of PC items to 50 and adds an FF byte in item 51&#039;s slot. Hope this works out for you! :)


subject: Re: How to fix dry PC underflow
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dante link=topic=7520.msg200634#msg200634 date=1466974352]<br />Edit: oh, i followed your method, by cutting the tree in the glitch city. So I guess I set that to be 109-ish<br />[/quote]<br /><br />Yes, that&#039;s what I wanted to know, that&#039;s why you can&#039;t use the traditional fix. Of course you can ACE your way out of this, as Torchickens demonstrated! :)


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m not sure whether writing data in the HOF Buffer [u]after[/u] it was affected by MissingNo.&#039;s sprite overflow erraze the corruption, but I wouldn&#039;t be surprised. But for sure, MissingNo. with regular sprites won&#039;t cause the glitch.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  All moves have at least a 0.4% chance of missing, because the formula is x/[b]256[/b], while the highest possible value is 255, which gives 99.6%.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: IceFlame
icon: clip
body:
  [quote author=drc link=topic=7522.msg200649#msg200649 date=1467128472]<br />All moves have at least a 0.4% chance of missing, because the formula is x/[b]256[/b], while the highest possible value is 255, which gives 99.6%.<br />[/quote]<br />I know that, though from what I was reading recently, there is still some doubt about it for Swift.<br />http://forums.glitchcity.info/index.php/topic,6649.0.html<br /><br />What I&#039;m talking about here is Swift being affected by accuracy/evade modifiers in the Japanese games.<br /><br />(Attached video) In Yellow Rev B, my Electrode is battling a Grimer that had already used Minimize 3 times. No way is this 1/256.<br />It misses 6 times out of 10. If the chance of missing is 1/256, the chance of missing 6 times out of 10 is less than 1 in a million.<br /><br />I know that VBA is not the most accurate. Tested in BGB as well. But testing on the real thing would be a good idea.


subject: Re: How to fix dry PC underflow
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7520.msg200646#msg200646 date=1467121350]<br />Dante, I worked on a code for this in French, Spanish, German and Italian Red.<br /><br />Lemonsucco x50<br />Carburante x213<br />Precisione X x63<br />Pietraidrica x4<br />Precisione X x164<br />Repellente x255<br />PokÃ© Ball x115<br />MT04 x1<br /><br />[code]<br />ld a,32<br />ld h,D5<br />ld l,3F<br />ldi (hl),a<br />inc b<br />ld l,A4<br />ld e,FF<br />inc b<br />ld (hl),e<br />ret<br />[/code]<br /><br />[code]3E 32 26 D5 2E 3F 22 04 2E A4 1E FF 04 73 C9[/code]<br /><br />The code sets the number of PC items to 50 and adds an FF byte in item 51&#039;s slot. Hope this works out for you! :)<br />[/quote]<br />Thank you very much! I&#039;ll test this as soon as the university allows me C:


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6638.msg200650#msg200650 date=1467130568]<br />What&#039;s the TM01 for in that code? Because I don&#039;t have that TM anymore..<br />[/quote]<br /><br />TM01 ends the code (Hex C9). Its availible in Celadon dept. store.


subject: 3rd gen to 2nd gen connected and strange result
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So I wanted to share a story of my childhood with all of you. Around 2004/2005, I had a link cable and a brand new Pokemon Sapphire.<br />I tried to connect it with a copy of Pokemon Gold with a friend. We didn&#039;t knew it wasn&#039;t possible and it wasn&#039;t clear how to do it. I was smart enough to know that at least there were some limitation, like there were limitation between first and second gen.<br />So on sapphire I went in the &quot;data exchange thing&quot; (can&#039;t remember how it was called), and in Gold in the Time Machine.<br />It didn&#039;t worked obviusly.<br />So the day after that Pokemon Gold started to act strangly. At first, the player was freeze. I remember that my friend saved in the route above Vermillion City. He could rotate but not move. <br />Other minor glitches may had happened but I can&#039;t remember or I didn&#039;t noticed them, since the game wasn&#039;t mine and I was just a spectator.<br />After that the &quot;CONTINUE&quot; button disappeard and the cartdrige apparently lost his ability to save the game. <br /><br />So... What do you think it triggered that?<br />It is possible that a deletion of every data could have fixed the issue?<br /><br />Pokemon Sapphire never had any problem since then. The link cable didn&#039;t worked properly after that, but maybe that wasn&#039;t caused by this experiment.<br />I tried to look online but I couldn&#039;t find anyone experienced this...


subject: Re: 3rd gen to 2nd gen connected and strange result
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Very interesting o.O<br /><br />I might try this out. Which languages were the Gold and PokÃ©mon Sapphire?


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Neat. ^_^ Seems like another obscure Japanese version glitch. Other than Select button glitches we have [url=https://tcrf.net/Pok%C3%A9mon_Red_and_Blue/Version_Differences#Glitches]other obscure glitches[/url] such as the Saffron Gym glitch and Broken Hidden Items glitch (unlisted on that page). This makes me wonder if there are any more.<br /><br />I have physical Japanese PokÃ©mon cartridges, albeit with dead save batteries. I should be able to conveniently test Swift/ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ with reduced accuracy out on a physical cartridge for you once I get a new Xploder GB cheat cartridge (I can order one with expected delivery between July 5th, July 6th), as the current one I have may be broken.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7522.msg200659#msg200659 date=1467235016]<br />I should be able to conveniently test Swift/ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ with reduced accuracy out on a physical cartridge for you once I get a new Xploder GB cheat cartridge (I can order one with expected delivery between July 5th, July 6th), as the current one I have may be broken.<br />[/quote]<br /><br />Interesting. What makes you think your Xploder GB is broken? I think the same with mine, but only because it takes several hours of resetting just to get to the enter cheat screen. (the majority of the time it freezes on a white screen or glitched screen that turns to a white screen). It could be because it can&#039;t fit properly in a GBA SP though.


subject: Re: 3rd gen to 2nd gen connected and strange result
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7523.msg200658#msg200658 date=1467233682]<br />Very interesting o.O<br /><br />I might try this out. Which languages were the Gold and PokÃ©mon Sapphire?<br />[/quote]<br />Both italian!


subject: 2nd Gen Roaming Mechanics
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: IceFlame
icon: xx
body:
  I took a rather obsessive interest in this recently, and thought I would write up my findings, to help others and put it up for checking.<br /><br />All testing was on English Crystal V1.0, but I&#039;m assuming it works the same on the other games unless some evidence comes up for otherwise.<br /><br /><br /><br />[size=18pt]Johto Map showing connections[/size]<br /><br />[img]http://i.imgur.com/D2UmKJs.png[/img]<br /><br /><br /><br />[size=18pt]TLDR catching guide[/size]<br /><br />[b]Preparation[/b]<br />Buy about 50 Super Repels.<br />Catch a Hoppip and give it 10 Carbos.<br />Level it until it evolves to Jumpluff and gets at least 98 speed, not exceeding level 40.<br />Make sure it learns Sleep Powder. Teach it Headbutt so it can do a reasonable amount of damage.<br />Put it at the top of the party.<br /><br />[b]To find the Beasts for the first time[/b]<br />Go to the eastern patch of grass on Route 36 and get on the bike.<br />Use a Super Repel. Cycle around in the grass until it expires.<br />Go into the Ruins of Alph courtyard.<br />Go into the gatehouse and back out into the Ruins of Alph courtyard.<br />Head back to the patch of grass and repeat.<br />Make sure to never double back on yourself onto Route 36 (e.g. Route 36 -&gt; Gatehouse -&gt; Route 36, or Route 36 -&gt; Violet -&gt; Route 36). That makes the Beasts avoid you.<br />If you want to reject bad DVs, then once you see one for the first time, go hunt it and forget about the others for now. Don&#039;t save between the first time you see it and when you catch it and check its stats!<br />Otherwise, it&#039;s quicker to find all of them at this stage, and then track them in parallel. Save the game if you see one for the first time and it runs away, so you can reset if it gets killed later, without losing the &quot;seen&quot; status.<br /><br />[b]To find the Beasts (not for the first time)[/b]<br />Jump to the last section of this post and follow the instructions there.<br />Leave Jumpluff at the top of the party and keep using the Repels when searching the grass.<br /><br />[b]In battle[/b]<br />Use Sleep Powder on the first turn and if the Beast wakes up.<br />Reduce its health while it&#039;s asleep.<br />Reset the game if you kill it by accident.<br />Once it&#039;s at low health and asleep, throw Ultra Balls.<br />If it runs away, don&#039;t worry, just find it again using the &quot;not for the first time&quot; way.<br /><br /><br /><br />[size=18pt]Memory Map[/size]<br /><br />Probably for English Crystal only.<br /><br />[code]<br />dfcf species (f3=Raikou)<br />dfd0 level (0x28=40)<br />dfd1 map group<br />dfd2 map number<br />dfd3 current HP<br />dfd4 DV<br />dfd5 DV<br /><br />New game, not yet released from Burned Tower: 0000 ffff 00 0000<br />Roaming but not met in battle yet: f328 xxxx 00 0000<br />Roaming after it was met: as above (DVs generated when first met)<br />If caught or killed: 0028 ffff 00 xxxx (level and DVs stay)<br /><br />dfd6 species (f4=Entei)<br />dfd7 level (0x28=40)<br />dfd8 map group<br />dfd9 map number<br />dfda current HP<br />dfdb DV<br />dfdc DV<br /><br />Next 7 bytes unused Suicune:<br />0000 ffff 00 0000 (at all stages of game)<br /><br />dfe4 map number player was last in<br />dfe5 map group player was last in<br />dfe6 map number player was in the time before last<br />dfe7 map group player was in the time before last<br />The above 4 are one step later most of the time,<br />but the description is for what they are during the instant when it matters.<br />Fly/teleport to the same place does rotate them (so they become the same).<br /><br />dcb5 map group player is currently in<br />dcb6 map number player is currently in<br /><br />Possible roaming location values (written map group, map number, route number):<br />1803 r29<br />1a01 r30<br />1a02 r31<br />0a01 r32<br />0806 r33<br />0b01 r34<br />0a02 r35<br />0a03 r36<br />0a04 r37 <br />010c r38<br />010d r39<br />0205 r42<br />0905 r43<br />0206 r44<br />0508 r45<br />0509 r46<br />ffff n/a<br />[/code]<br /><br /><br /><br />[size=18pt]When do they move?[/size]<br /><br />[b]The Beasts stay where they are:[/b]<br />Move around within one area<br />Battle wild PokÃ©mon<br />Cut<br />Surf<br />One of them is caught or killed<br /><br />[b]The Beasts move, most times to an adjacent route:[/b]<br />Move to next area<br />Move into or out of a building or cave<br />Go up or down a ladder<br />Dig<br />Use an escape rope<br />One of them flees (they all move)<br /><br />[b]The Beasts jump randomly:[/b]<br />Load game<br />Fly<br />Teleport<br /><br /><br /><br />[size=18pt]What happens in battle?[/size]<br /><br />The Beast&#039;s current HP is kept between encounters.<br />As above, the DVs are generated when first met in battle, and kept between encounters.<br />Sleep prevents fleeing.<br />The Beast doesn&#039;t flee the turn it wakes up.<br />It uses an attack the turn it wakes up (can be Roar).<br />Paralysis doesn&#039;t prevent fleeing.<br />Paralysis is not kept between encounters (would be a problem if it did!)<br />Mean Look prevents fleeing, but doesn&#039;t affect Roar. It might be worth using in addition to a sleep move.<br />Fast Balls are well-documented not to work on these guys.<br /><br />[b]Fleeing priority:[/b]<br />This depends on the in-battle speed of the two PokÃ©mon (after the Badge Bonus is applied).<br />The Beasts usually flee before a slower PokÃ©mon can use a regular attack, but not always. If Entei or Raikou&#039;s Roar is replaced with another attack, the slower PokÃ©mon no longer has a chance to attack first.<br />Against Entei: a faster PokÃ©mon, or a PokÃ©mon using Quick Attack, always hits first.<br />Against Raikou: a faster PokÃ©mon using a regular attack, or a slower PokÃ©mon using Quick Attack, usually hits first, but not always. If Raikou&#039;s Quick Attack is replaced with something else, Raikou no longer has a chance to flee first in these cases.<br />A faster PokÃ©mon using Quick Attack always hits first.<br />From this, I conclude that the Beast still chooses an attack even though it&#039;s trying to flee, and fleeing has the same priority as the attack chosen.<br /><br />We need a faster PokÃ©mon with a sleep move. But since Raikou knows Quick Attack, it will sometimes flee before the faster PokÃ©mon can do anything. Too bad.<br />If the sleep move misses, or if the Beast wakes up and uses Roar, that&#039;s also too bad.<br /><br /><br /><br />[size=18pt]Which PokÃ©mon can hunt Raikou?[/size]<br /><br />Raikou has base speed 115. With a 15 speed DV, it has 109 speed at level 40. The hunter needs a sleep move and at least 110 speed, which is 98 speed with the 9/8 Badge Bonus.<br /><br />It would be reasonable to use Repels to find a Beast for the first time (with any PokÃ©mon level 35-40 at the top). Then use the PokÃ©dex to track it. Once on the same route, put a high-level PokÃ©mon with a sleep move at the top, and just go through all the wild encounters until the Beast turns up. It doesn&#039;t seem to change route just from battling. My False Swiping Parasect would get 98 speed about level 80. At level 82, Level Balls become useful.<br /><br />If we want to use Repels for the catch encounter, the hunter needs a maximum level of 40 (40 itself is OK).<br />Gengar/Jumpluff have base speed 110. They are comfortably fast enough. With 10 Carbos and the Badge Bonus, they outspeed Raikou at level 40 with any speed DV. In many cases the player won&#039;t be able to get Gengar because it&#039;s a trade evolution.<br />Haunter/Jynx have base speed 95. This seemed rather tight before I noticed about the Badge Bonus. With 10 Carbos and the Badge Bonus, they only need a Speed DV of 2.<br />Sleep Powder and Lovely Kiss are much more accurate than Hypnosis, and the most important thing here is to put the Beast to sleep on the first turn, so Jumpluff or Jynx are probably more suitable than the Ghosts.<br />Once the Beast is asleep, if the HP is not yet low enough, it might make sense to switch to a high level False Swiper, since the current HP is kept between encounters.<br /><br /><br /><br />[size=18pt]How long to search?[/size]<br /><br />Time for some asm reading.<br />In PokeCrystal, the function RandomEncounter is called every step if there are encounters in the current area.<br />Nonzero wWildEncounterCooldown (d452) prevents encounters and is decremented every step. I didn&#039;t follow the code that sets it, but watching it in-game, it is set to 4 when entering a map (which doesn&#039;t matter for grass routes). It is also set to 5 after a wild encounter, but it stays at 0 when using Repel.<br />Next is TryWildEncounter. It loads the encounter rate from wMornEncounterRate etc (d25a-d25c). Watching those in-game, they are always 25 on the relevant routes, except on Route 39 they are 5 for some reason. Better not search on Route 39 then.<br />Music can double this number (but the radio stops when we change route so that would be a pain).<br />We get a battle if a random number 0-255 is less than the modified encounter rate.<br />So generally, there is 25/256 chance of a battle per step.<br />Next is ChooseWildEncounter. Believing the comments there, if we are in the right map, there is 25/256 chance of this battle being a particular roaming Beast. If it&#039;s not a Beast, then a regular wild encounter is chosen (which could be nothing under some condition that I don&#039;t understand).<br />Repel is checked after all this.<br />As far as I can see, the bike doesn&#039;t affect anything here, so might as well ride it to cover more steps in the same amount of time.<br /><br />If using Repel, it makes sense to think of it per step.<br />Each step there is 25/256 chance of a battle and of that, 25/256 chance of the wanted Beast. This gives 625/65536 per step overall (just under 1%).<br />This is a binomial probability calculation, giving 62% chance of finding the wanted Beast within 100 steps, 80% within 200 steps, or 91% within 250 steps.<br />So if we don&#039;t know whether the Beast is here, a possible strategy is to go to the patch of grass we want to search, use a Super Repel (200 steps) or Max Repel (250 steps) depending on preference, and move around in the grass until it expires.<br />This is much longer than most advice around the internet seems to be suggesting.<br /><br />It not using Repel, it makes sense to think of it per battle.<br />There is 25/256 chance of meeting the wanted Beast per battle. That makes a 90% chance of finding it within 23 battles.<br />But in any case, it would be pointless to do this unless we already know the Beast is here, so keep going until finding it.<br /><br /><br /><br />[size=18pt]How do they move?[/size]<br /><br />The function UpdateRoamMons in PokeCrystal appears to be the thing for normal movement, and JumpRoamMons for a random reset e.g. when loading the game.<br /><br />RoamMaps is a graph containing the available connections from each route. Studying UpdateRoamMons, for each Beast it loads the available connections from the current route, then tries to pick one. It picks a random number from 0-31. If this number is 0, it moves to a random route (JumpRoamMon). Otherwise, it takes this number mod 4 as an index into the list of available connections (so the 0th connection is slightly less likely than the others). If the number is too high for the length of the list, it starts again and picks a new random number from 0-31 (so it&#039;s more likely to jump to a random route if there were fewer connections available). As far as I can see, it also starts again if the selected connection matches the route the player was in before the last-but-one map change (but this doesn&#039;t apply to a random jump). This last point turns out to be very important.<br /><br />For a random jump (JumpRoamMon), whether called from JumpRoamMons or from drawing a 0 in UpdateRoamMons, it picks with equal probability from the 16 available routes, excluding the route the player is currently in.<br /><br /><br /><br />[size=18pt]How to find a Beast for the first time?[/size]<br /><br />It&#039;s possible to simulate the above algorithm for a very large number of repetitions. If I understood the asm correctly, and implemented my Python correctly according to that understanding, this will tell us the chance of success of various strategies.<br /><br />http://pastebin.com/U3jfMrMm<br /><br />If the player is not around, e.g. going in and out of buildings in a city, the chance of a Beast being on a particular route will depend mostly on the connection graph. It works out with the highest chance of about 10% for Route 36 or 42, and a 7.5% chance for the next highest few. Route 39 has the lowest chance, so that&#039;s another reason not to search there. I thought that using Teleport/Fly (triggering a random reset) would negate the advantage of the unbalanced graph, but it seems that a random reset followed by one move gives close to the same distribution as roaming for a long time, and after 3 moves it&#039;s almost indistinguishable.<br /><br />Sample results from 100000 trials:<br />[code]<br />route&nbsp;  reset&nbsp;  1 move&nbsp; 2 moves 3 moves many<br />29&nbsp; &nbsp; &nbsp; 6.2%&nbsp; &nbsp; 6.1%&nbsp; &nbsp; 5.8%&nbsp; &nbsp; 5.5%&nbsp; &nbsp; 5.0%<br />30&nbsp; &nbsp; &nbsp; 6.3%&nbsp; &nbsp; 4.9%&nbsp; &nbsp; 5.1%&nbsp; &nbsp; 5.1%&nbsp; &nbsp; 4.7%<br />31&nbsp; &nbsp; &nbsp; 6.2%&nbsp; &nbsp; 7.2%&nbsp; &nbsp; 7.4%&nbsp; &nbsp; 7.6%&nbsp; &nbsp; 7.5%<br />32&nbsp; &nbsp; &nbsp; 6.4%&nbsp; &nbsp; 6.8%&nbsp; &nbsp; 7.3%&nbsp; &nbsp; 7.2%&nbsp; &nbsp; 7.3%<br />33&nbsp; &nbsp; &nbsp; 6.2%&nbsp; &nbsp; 5.2%&nbsp; &nbsp; 5.3%&nbsp; &nbsp; 5.0%&nbsp; &nbsp; 4.9%<br />34&nbsp; &nbsp; &nbsp; 6.3%&nbsp; &nbsp; 6.2%&nbsp; &nbsp; 5.1%&nbsp; &nbsp; 5.5%&nbsp; &nbsp; 5.0%<br />35&nbsp; &nbsp; &nbsp; 6.3%&nbsp; &nbsp; 4.9%&nbsp; &nbsp; 5.4%&nbsp; &nbsp; 4.8%&nbsp; &nbsp; 5.1%<br />36&nbsp; &nbsp; &nbsp; 6.3%&nbsp; &nbsp; 9.3%&nbsp; &nbsp; 8.8%&nbsp; &nbsp; 9.8%&nbsp; &nbsp; 9.7%<br />37&nbsp; &nbsp; &nbsp; 6.2%&nbsp; &nbsp; 5.3%&nbsp; &nbsp; 7.6%&nbsp; &nbsp; 6.6%&nbsp; &nbsp; 7.3%<br />38&nbsp; &nbsp; &nbsp; 6.1%&nbsp; &nbsp; 9.4%&nbsp; &nbsp; 6.5%&nbsp; &nbsp; 8.1%&nbsp; &nbsp; 7.6%<br />39&nbsp; &nbsp; &nbsp; 6.1%&nbsp; &nbsp; 2.5%&nbsp; &nbsp; 3.4%&nbsp; &nbsp; 2.5%&nbsp; &nbsp; 2.8%<br />42&nbsp; &nbsp; &nbsp; 6.3%&nbsp; &nbsp; 8.9%&nbsp; &nbsp; 9.1%&nbsp; &nbsp; 9.2%&nbsp; &nbsp; 9.7%<br />43&nbsp; &nbsp; &nbsp; 6.2%&nbsp; &nbsp; 3.8%&nbsp; &nbsp; 4.9%&nbsp; &nbsp; 4.5%&nbsp; &nbsp; 5.0%<br />44&nbsp; &nbsp; &nbsp; 6.3%&nbsp; &nbsp; 7.7%&nbsp; &nbsp; 6.6%&nbsp; &nbsp; 7.5%&nbsp; &nbsp; 7.5%<br />45&nbsp; &nbsp; &nbsp; 6.3%&nbsp; &nbsp; 5.2%&nbsp; &nbsp; 5.8%&nbsp; &nbsp; 5.1%&nbsp; &nbsp; 5.3%<br />46&nbsp; &nbsp; &nbsp; 6.2%&nbsp; &nbsp; 6.6%&nbsp; &nbsp; 5.9%&nbsp; &nbsp; 6.1%&nbsp; &nbsp; 5.4%<br />[/code]<br /><br />So we know where the Beast is most likely to be. The problem is, there is a tendency for it not to be where the player is looking for it.<br /><br />I have seen in a few places the advice to move back and forth between two maps where one map has grass close to the exit, e.g. search Route 37 going in and out of Ecruteak every so often, or search Route 42 going in and out of Mount Mortar. This sounds sensible. But if I&#039;m not mistaken here, it will literally never work.<br /><br />With Route 36 or 42 being the best, it seems plausible to search Route 36 and go in and out of the Ruins of Alph. (The National Park is further from the grass and dismounts the bike.) Just going into the gatehouse and back, the Beast never appears. It&#039;s important to go all the way through into the ruins courtyard. But the Beast is still avoiding the player here: I get 7% chance of it being on Route 36 during the search. Going out and in twice (on the ruins side, not the Route 36 side!) raises it to 8.5% which almost eliminates the &quot;avoiding the player&quot; effect. A third time makes little difference.<br /><br />It also seems plausible to Teleport to Violet or Mahogany, and move onto Route 36 or 42 respectively. Again, if that&#039;s the only thing done, the Beast will never appear. Violet works out slightly better here. Using Teleport twice gives a 9% chance. Using Teleport once and walking in and out of the PokÃ©mon centre gives a 8% chance. (This must be because the Beast can&#039;t walk onto the target route when the player enters the PokÃ©mon centre, and the missing 1% is from the cases where it walks away from the target route and then straight back again.) Using Teleport twice and walking in and out of the PokÃ©mon centre is up to 9.5%, pretty much as if the player wasn&#039;t there. &quot;Fly to Violet, go in and out of PokÃ©mon centre, move to route 36, Fly to Mahogany, go in and out of PokÃ©mon centre, move to route 42&quot; gives about 9%, and might be slightly quicker since Mahogany is closer to the grass.<br /><br />Even if Teleport/Fly strategies can give a slightly higher chance of the Beast being on the target route, they require more concentration and the player spends less time in the grass than for the Ruins of Alph strategy, so that&#039;s a matter of preference.<br /><br /><br /><br />[size=18pt]How to find a Beast (not for the first time)?[/size]<br /><br />A possible strategy based on the above (not simulated):<br /><br />Fly to Mahogany.<br />Check PokÃ©dex.<br />If there is a Beast on Route 37, 38, 43 or 44 then move to Route 42.<br />Otherwise, if there&#039;s one on Route 42 or 45 then move to Route 44.<br />(Moving to Route 43 is no use because of the gatehouse: if the Beast could be met on Route 43 in two turns, it will be on Route 42 or 44 next turn.)<br />Otherwise, if it&#039;s anywhere else, Fly to Mahogany again.<br />Once on Route 42 or 44, check PokÃ©dex again.<br />If the Beast is here, get ready to battle it.<br />If it went the wrong way, resist the temptation to chase it, and switch to Violet.<br /><br />Fly to Violet.<br />Check PokÃ©dex.<br />If there is a Beast on Route 32, 35 or 37 then move to Route 36.<br />Otherwise, if there&#039;s one on Route 31, 33 or 36 then move to Route 32.<br />(Moving to route 31 is almost no use for the same reason as above. In this case, the Beast could come from Route 29, but it&#039;s a long shot.)<br />Otherwise, if it&#039;s anywhere else, Fly to Violet again.<br />Once on Route 32 or 36, check PokÃ©dex again.<br />If the Beast is here, get ready to battle it.<br />If it went the wrong way, resist the temptation to chase it, and switch to Mahogany.<br /><br />It&#039;s reasonable to hunt more that one Beast at a time. Make sure the PokÃ©dex is in Old or New PokÃ©dex mode (not alphabetical), as then the Beasts will be adjacent. The Up and Down controls can switch between them when on the description screen, though not when on the map itself.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I look forward to hearing the results.<br /><br />I wonder if it&#039;s not a glitch, and they thought up the &quot;always hit&quot; effect later once they noticed Double Team was broken.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Wack0 link=topic=7522.msg200660#msg200660 date=1467241187]<br />[quote author=Torchickens link=topic=7522.msg200659#msg200659 date=1467235016]<br />I should be able to conveniently test Swift/ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ with reduced accuracy out on a physical cartridge for you once I get a new Xploder GB cheat cartridge (I can order one with expected delivery between July 5th, July 6th), as the current one I have may be broken.<br />[/quote]<br /><br />Interesting. What makes you think your Xploder GB is broken? I think the same with mine, but only because it takes several hours of resetting just to get to the enter cheat screen. (the majority of the time it freezes on a white screen or glitched screen that turns to a white screen). It could be because it can&#039;t fit properly in a GBA SP though.<br />[/quote]<br /><br />On my Game Boy Advance SP, the Xploder GB freezes on a black screen, or a white screen/glitched screen, so it sounds like we&#039;ve been experiencing a similar issue. There have been different results depending on the game I insert into the cartridge. The device worked in the past so it makes me wonder whether something inside of the cartridge was damaged. I think possibly at one time; twice(?) a long time ago and relatively recently the cheat list became corrupted, but the first time I managed to fix the problem (although I don&#039;t know if this is a false memory). I haven&#039;t tried repeatedly trying to load it yet, so I&#039;ll give it a go for a good two hours :).<br /><br />On my Game Boy Color (which had a low remaining battery life), the screen won&#039;t get past the Game Boy Color bootup (it appeared blank without the Game Boy Color logo).<br /><br />[quote author=IceFlame link=topic=7522.msg200663#msg200663 date=1467286285]<br />I look forward to hearing the results.<br /><br />I wonder if it&#039;s not a glitch, and they thought up the &quot;always hit&quot; effect later once they noticed Double Team was broken.<br />[/quote]<br /><br />Interesting. Hmm.<br /><br />In Red/Blue/Yellow and Stadium we have the text:<br /><br />[quote author=Route 12 gate girl]<br />TM39 is a move<br />called SWIFT.<br /><br />It&#039;s very accurate,<br />so use it during<br />battles you can&#039;t<br />afford to lose.<br />[/quote]<br /><br />;and the Stadium description is â€”<br /><br />[quote author=PokÃ©mon Stadium]&quot;A Normal-type attack. It is highly accurate, so it can be counted on to inflict damage.&quot;)[/quote]<br /><br />These state that Swift is very accurate but don&#039;t state that it always hits. I will look up the Japanese texts too, one moment.<br /><br />Edit 1:<br /><br />[quote author=Route 12 gate girl]<br />ã‚ã–ãƒžã‚·ãƒ³ï¼“ï¼™ã¯ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ã€€ã¨ã„ã†ã€€ã‚ã–ã‚ˆã€€ã“ã®ã€€ã‚ã–ã¯ã€€ã‚ã„ã¡ã‚…ã†ã‚Šã¤ãŒã€€ã™ã”ãã€€ãŸã‹ã„ã®ã€€ã¾ã‘ã‚‰ã‚Œãªã„ã€€ã—ã‚‡ã†ã¶ã®ã€€ã¨ãã€€ã‚„ãã«ã€€ãŸã¤ã€€ã¯ãšã‚ˆ<br />[/quote]<br /><br />Translation attempt:<br /><br />TM39 is called the Speed Star move. This move&#039;s accuracy rate is very high and nothing else beats it. It should help you. (??)<br /><br />è² ã‘ã‚‹	ã€ã¾ã‘ã‚‹ã€‘	 - To be defeated.<br />ã¾ã‘ã‚‰ã‚Œãªã„ - Means it is undefeated.<br /><br />Note that I&#039;m not very experienced with Japanese so my translations may be wrong.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: IceFlame
icon: xx
body:
  Hmm, your quote is missing the line breaks - I think that&#039;s the sentence-ending explanatory ã® in the 4th line, so the meaning is the same as the English.<br />[quote]ã‚ã–ãƒžã‚·ãƒ³ï¼“ï¼™ã¯<br />ã‚¹ãƒ”ãƒ¼ãƒ‰ã‚¹ã‚¿ãƒ¼ã€€ã¨ã„ã†ã€€ã‚ã–ã‚ˆ<br />ã“ã®ã€€ã‚ã–ã¯ã€€ã‚ã„ã¡ã‚…ã†ã‚Šã¤ãŒ<br />ã™ã”ãã€€ãŸã‹ã„ã®<br />ã¾ã‘ã‚‰ã‚Œãªã„ã€€ã—ã‚‡ã†ã¶ã®ã€€ã¨ã<br />ã‚„ãã«ã€€ãŸã¤ã€€ã¯ãšã‚ˆ[/quote]<br />TM39 is<br />a move called Speed Star.<br />This move&#039;s accuracy rate<br />is very high.<br />During a battle you can&#039;t lose<br />it should be useful.<br /><br />I&#039;ll have a look at the English disassembly later. But we don&#039;t have an annotated Japanese disassembly, right? So finding out anything from the Japanese code would depend on similarity to the English, and might take a very long time.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Oh, OK. :) Thanks.<br /><br />[quote author=IceFlame link=topic=7522.msg200665#msg200665 date=1467291454]<br />I&#039;ll have a look at the English disassembly later. But we don&#039;t have an annotated Japanese disassembly, right? So finding out anything from the Japanese code would depend on similarity to the English, and might take a very long time.<br />[/quote]<br /><br />OK, good luck analyzing the code. Not that I&#039;m aware of, no(?). Yes, we could use a hex editor to find similar byte code. If the Speed Star code is significantly different, I guess a different approach is to look for a higher move routine and set a breakpoint. We have some great reversers here like Wack0, TheZZAZZGlitch, Sanqui so they may be able to help.


subject: Re: 2nd Gen Roaming Mechanics
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you! I was tempted to look into this the last time I was trying to track down the beasts, but never did.<br /><br />Roar has âˆ’1 priority. If fleeing has the same priority as the selected move, that would explain why slower PokÃ©mon can sometimes attack before the beast flees.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7522.msg200664#msg200664 date=1467287695]<br />On my Game Boy Advance SP, the Xploder GB freezes on a black screen, or a white screen/glitched screen, so it sounds like we&#039;ve been experiencing a similar issue. There have been different results depending on the game I insert into the cartridge. The device worked in the past so it makes me wonder whether something inside of the cartridge was damaged. I think possibly at one time; twice(?) a long time ago and relatively recently the cheat list became corrupted, but the first time I managed to fix the problem (although I don&#039;t know if this is a false memory). I haven&#039;t tried repeatedly trying to load it yet, so I&#039;ll give it a go for a good two hours :).<br />[/quote]<br /><br />I seem to remember the last time my Xploder GB properly worked was around ~2006-2007. It froze when saving the cheats list, and the cheats list was corrupted with a reset. But at a later time, when I got it to work, the cheats list showed perfectly normally, including the cheat I added when it froze (it was an encounter modifier to get Gengar, for the capture flag to prevent a bad freezing PokÃ©dex entry, as I intended to then use it to encounter h PokÃ© (RB:C3). This was on my friend&#039;s Blue cart, as I didn&#039;t have any Gen 1 carts of my own at that time.<br /><br />These days, I have no patience to keep trying, resetting, trying again, reseating the carts, etc, for hours. Another friend of mine has a GB GameShark, so...<br /><br />I guess this Xploder GB issue is another reason why I want to get a GB ROM dumper; however I have no clean ROM to compare against, and have no idea if the Xploder GB ROM is even dumped. (A quick Google search only shows me ROMs for the GBA Xploder, which I got at the same time as my Xploder GB (around 2003-2004 or so; the two were bundled together) and still works to this day. Not that I use it often.)


subject: Pokemon Save Abuse Glitch Variation
poster_name: PokeGlitchFanatic
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: PokeGlitchFanatic
icon: clip
body:
  I have been gone for a while, and during my hiatus I began to experiment with the Pokemon Yellow Save Abuse, &quot;Beat the Game in 0:00&quot; glitch.<br />In order to experiment with both the Pokemon you receive and the glitch inventory, I do the &quot;turn off before game saves&quot; thing,corrupt the inventory, but I do not warp anywhere. I have gotten some fascinating results by switching around, tossing, and viewing various items and glitch Pokemon. I even managed to beat the rival with a 3trainerpoke, although the game froze immediately afterwards. I have massive amounts of screen shots and video. I&#039;ll attach a few soon (computer issues now), and if anybody wants to join me on my research, have fun!<br />EDIT: I have accessed the most fantastic screenshots and have attached them.


subject: Re: 3rd gen to 2nd gen connected and strange result
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;d say it looks like the Gold cart&#039;s SRAM battery was running out, or stuff like that. I don&#039;t think it can be related to the exchange, however I could confirm if you told me if the attendant allowed you to enter the Cable Club or if she told you that nothing was connected.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, you could use a code that mutates items for example. Such as (using pigdevil2010&#039;s bootstrap setup !)<br />[code]<br />8F / ws l m<br />Key item<br />PokÃ© Ball x43<br />Great Ball x43<br />Revive x201<br />[/code]<br />[code]<br />inc b<br />dec hl<br />inc bc<br />dec hl<br />dec (hl)<br />ret<br />[/code]<br />You&#039;ll increase item #2&#039;s ID by one each time you use 8F / ws l m. It will be of quantity 1.


subject: Re: 2nd Gen Roaming Mechanics
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7524.msg200667#msg200667 date=1467295205]<br />Roar has âˆ’1 priority. If fleeing has the same priority as the selected move, that would explain why slower PokÃ©mon can sometimes attack before the beast flees.<br />[/quote]<br />You&#039;re right - if Roar is replaced with another attack, the slower PokÃ©mon no longer gets a chance to attack first. I&#039;ll rewrite that section.<br /><br />That&#039;s amusing. The Beast could have escaped, but because it chose to use Roar, it got trapped.


subject: Re: Pokemon Save Abuse Glitch Variation
poster_name: PokeGlitchFanatic
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: PokeGlitchFanatic
icon: xx
body:
  I&#039;ve confirmed a few things about what item represents what. I always have a ton of ethers in my party, and tossing all of them makes the game totslly black and white, with no shading. I&#039;m assuming that it represents the coloring, so by tossing specific amounts, I can make it any color I desire.<br />EDIT: After experimenting, I realized that ether dos change the color. However, it will only do one of three things: a(make the game the light green shown in my screenshot) b(make it a light blue) c(make it black/white.<br />Tossing any number that isn&#039;t all of them has no effect.


subject: Re: Pokemon Save Abuse Glitch Variation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=PokeGlitchFanatic link=topic=7525.msg200675#msg200675 date=1467374825]<br />I&#039;ve confirmed a few things about what item represents what. I always have a ton of ethers in my party, and tossing all of them makes the game totslly black and white, with no shading. I&#039;m assuming that it represents the coloring, so by tossing specific amounts, I can make it any color I desire.<br />EDIT: After experimenting, I realized that ether dos change the color. However, it will only do one of three things: a(make the game the light green shown in my screenshot) b(make it a light blue) c(make it black/white.<br />Tossing any number that isn&#039;t all of them has no effect.<br />[/quote]<br /><br />You may have altered item 32&#039;s quantity (brightness) but it&#039;s interesting it was Ethers changing the quantity. When you toss all of an item, it may shift the items below it two bytes upwards; so tossing all of an item above item 32 (stored sound bank x brightness) can affect it if there are no Cancels in between.<br /><br />Luckytyphlosion documented item underflow items, which you can find here.<br />http://forums.glitchcity.info/index.php/topic,6914.msg194959.html#msg194959<br /><br />The items beyond slot 20 basically represent D346 and beyond in this list â€”<br />http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map#Items<br /><br />One item represents one address, and the next item represents the address that follows (e.g. item 21 is D346; item 21 quantity is D347).


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: IceFlame
icon: xx
body:
  In the English PokeRed disassembly, looks like Swift always hits, and moves always hit when X Accuracy is in effect. There&#039;s a comment on the Swift check saying &quot;Swift never misses (interestingly, Azure Heights lists this is a myth, but it appears to be true)&quot;.<br /><br />There is a case where an attack does zero damage and the game says it missed. I remember a streamer getting caught out by this when trying to fight Brock&#039;s Onix with a Weedle. But it can only happen with 1/4 type effectiveness, so that can&#039;t explain people thinking they&#039;ve seen Swift miss.<br /><br />User 80C doesn&#039;t actually say it was an English cartridge, though on an English forum, I&#039;d think that was the case unless otherwise specified.<br /><br />Comparing the move table is a lot easier than comparing the code. It uses 990 bytes, in 165 groups of 6 (move id, effect, power, type, accuracy, pp). And it starts with Pound (01 00 28 00 FF 23). The only difference is that in the Japanese games, Blizzard&#039;s effect is 0x23 (shared with no other moves), while in the English games, it&#039;s 0x05 (the same as Ice Punch and Ice Beam). Swift&#039;s effect is 0x11 in all the games (shared with no other moves). So it appears that Swift was supposed to do something.<br /><br />----<br /><br />Getting distracted onto Blizzard, the following Effect IDs are used by the listed moves:<br /><br />0x04 Fire Punch, Ember, Flamethrower<br />0x05 Ice Punch, Ice Beam, Blizzard (E)<br />0x06 Thunderpunch, Thundershock, Thunderbolt, Thunder<br />0x22 Fire Blast<br />0x23 Blizzard (J)<br />0x24 Body Slam, Lick<br /><br />In PokeRed, the FreezeBurnParalyzeEffect routine gets called for all 6 of those. It picks the 10% or 30% probability based on the size of the Effect ID, then for the 30% ones it subtracts 0x1E to convert to the 10% version before applying it.<br /><br />In English Yellow, I hacked the move table entry for Scratch to have Effect 0x23, and it does indeed freeze a lot.<br /><br />As a side note, FreezeBurnParalyzeEffect seemed to be comparing the type of the attack with the types of the target to determine effect immunity, so I tested that. My hacked Scratch can freeze Ice Pokemon but seemingly not Normal Pokemon.<br /><br />https://www.math.miami.edu/~jam/azure/compendium/myths.htm<br />[quote]Myth: Blizzard freezes 30% of the time in link battles.<br />Many guides report this, and if you poke into the ROM you will see that Blizzard does indeed freeze 30% of the time, if a certain condition is true. We just don&#039;t know what that condition is, or even if that condition can be met within the realm of normal game play.[/quote]<br />I don&#039;t think so... English Red is not doing anything to distinguish between Blizzard and Ice Beam. It seems rather that Effect 0x23 freezes 30% of the time, but no attack has this effect.<br /><br />[quote]This myth was further propagated by the PokÃ©mon Yellow instruction booklets, which claim that Blizzard freezes less frequently in Colosseum2 link battles. In reality, however, Blizzard freezes 10% of the time in all link battles.[/quote]<br />I&#039;ll guess it&#039;s true in Japanese Yellow, and got changed in the game but not in the manual.<br /><br />It seems so...<br />https://tcrf.net/Pok%C3%A9mon_Red_and_Blue/Version_Differences#Original_Blizzard_Freezing_Chance_Value<br />[quote]In the original Japanese releases, Blizzard has a 30.1% chance of freezing. The localizations, PokÃ©mon Stadium, and the Japanese Yellow, when played in Colosseum 2 mode reduce this to 10.2%. The English Yellow instruction booklet mistakenly claims that Blizzard freezes less frequently in Colosseum 2 mode, which is only true in the Japanese releases since the value was reduced to 10.2% everywhere already in Red and Blue. [/quote]<br /><br />----<br /><br />Also, we were talking about in-game move descriptions earlier. According to Bulbapedia, the Stadium description for Mega Punch says it&#039;s &quot;highly accurate&quot;. This doesn&#039;t really inspire confidence in the descriptions (unless Mega Punch actually does have a different accuracy in Stadium?)<br />http://bulbapedia.bulbagarden.net/wiki/Mega_Punch


subject: Re: 2nd Gen Roaming Mechanics
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  MY GOD this is detailed! I eventually had to dump my save, fire up an emulator, use memory manipulation (Rewrote which pokemon was selected the frame of selection... I&#039;m a dirty cheater :P) then republish to cart. (Pain in the ass, as Nintendo has SRAM set to direct access read-only on the hardware level of their carts, so only software can write to it. Lucky for me, the HW_WRITE contact was still on the board, so I just stuck a new pin in the SRAM unit and jumped it, allowing access... eat a fat one, Nintendo)


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: IceFlame
icon: xx
body:
  I had a good attempt at comparing the code, and I reckon it&#039;s a bug:<br />http://pastebin.com/nJzRK337<br /><br />Predictions:<br />In the Japanese games, the Swift Effect works only against Substitutes.<br />HP draining attacks work against Substitutes in the English games, but miss in the Japanese games.<br /><br />Sadly, I won&#039;t be able to test it today.<br /><br />(Please excuse the double post in this case. If anyone else is working on this at the same time, I wanted to make sure they notice the update.)<br /><br />----<br /><br />I roughly confirmed this for English Yellow and Japanese Yellow (Rev B). Used codes to give my Pokemon Substitute and Double Team, and give a wild Pokemon 4 copies of either Absorb, Pound or Swift.<br /><br />For the first test, the wild Pokemon had Absorb, and my Pokemon damaged it and then made a sub. (I didn&#039;t use Double Team in this test.)<br />In English, Absorb worked on the sub. The drain effect worked, except on the turn the sub broke. In Japanese, Absorb missed the sub all of the 5 times the wild Pokemon tried it.<br /><br />For the second test, the wild Pokemon had Pound, my Pokemon used Double Team 6 times, then let itself get hit for a while, and made a sub and let that get broken twice.<br />In both games, the wild Pokemon missed a good proportion of the time, whether my Pokemon had a sub or not.<br /><br />For the third test, the wild Pokemon had Swift, my Pokemon used Double Team 6 times, then let itself get hit for a while, and made a sub and let that get broken twice.<br />In English, Swift hit every time, whether my Pokemon had a sub or not. In Japanese, the wild Pokemon hit every time when there was a sub, and missed a good proportion of the time when there wasn&#039;t one.<br /><br />I guess this is resolved! Though I still wonder, &quot;how did it happen that hardly anyone noticed?&quot;


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So lately I have been looking into TheZZAZZGlitch&#039;s pong game. However, after trying to break down the code into map coordinates, I am left with a few questions wich I hope someone can help me with. <br /><br />The first thing I am wondering about is the entry point. The code starts at $D901. Wich is the opponents 3rd PokÃ©mon type 1. Does the opponent&#039;s PokÃ©mon data reset to 0 after saving and restarting or does it persist? In other words, will the pong game still be there after saving?<br /><br />A few other things I&#039;m not to sure about is some opcodes. <br />Namely:<br />- ldi&nbsp; (hl),a<br />I cant find this one on the cpu chart. But I&#039;m pretty sure its opcode 22 (ld (hl+),a) wich i think loads a into (hl) and then increments the hl register. Is that correct?<br /><br />- ld&nbsp;  a,($FF00+A2)<br />There are a few of these, I have no idea what to do with them&nbsp; );<br /><br />And finally, commands that take a 2 byte input. These require the lower byte first then the higher byte right? They already seem to be listed in the code with the lower byte first, but I&#039;m not sure.<br /><br />Any help on this is much appreciated.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Of course it will, but only for newer entries. You&#039;re overwriting corrupted data with some valid other, after all.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  [list]Okay, simple questions, simple answers.<br /><br />Unless it is saved then loaded, RAM doesn&#039;t persist. In that case it won&#039;t, but don&#039;t assume it will be zero.<br /><br />There is no official syntax for gb-specific z80 instructions, so here are some aliases :<br />[list]<br />[li]ldi (hl), a[/li]<br />[li]ld (hli), a[/li]<br />[li]ld (hl+), a[/li][li]ld [hli], a[/li]<br />[/list]<br />Same for ldd and ld-, etc.<br />You are correct, ldi (hl), a is totally equivalent to ld (hl), a \ inc hl<br /><br />There is a special instruction in gb z80 : ld ($FF00 + imm8), a (as well as ld a, ($FF00 + imm8)<br />It saves one byte (thus speed) over ld a, (mem16) and ld (mem16), a<br /><br />And the gb z80 is little-endian :<br />call $C0DE is &quot;CD DE C0&quot;<br /><br />Gotcha ? I will be writing a gbz80 dev page on the wiki some day. Right now I&#039;m spending a week with my gf, so I&#039;m pretty much occupied :P[/list]


subject: Re: Pokemon Red Blue and Yellow 3DS Glitch Confirmation
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krisp link=topic=7436.msg199885#msg199885 date=1456951924]<br />Just checking in to confirm everyone else&#039;s frustration with MissingNo. in Yellow, damn that red/green line freeze up! So can anyone confirm a special of 182-184 are the magic numbers? It&#039;s going to take a long time to get a special that high. If anyone has a better solution, please share, because I really need to duplicate these TMs. My Flareon is sad with no fire moves. I don&#039;t care about masterballs or rare candies.<br />[/quote]<br />[quote author=Torchickens]<br />182-184 are indeed the magic numbers.<br /><br />I hope you find or have found a solution. I have a late reply in case you&#039;re still trying to duplicate your items.<br /><br />If you have access to another Nintendo 3DS with a PokÃ©mon Red or PokÃ©mon Blue, then you can possibly duplicate your items with the &quot;Cooltrainer&quot; glitch.<br /><br />(On Miiverse, I found a screenshot of somebody who may have activated the PokÃ©mon&gt;CoolTrainer effect on VC PokÃ©mon Yellow because they corrupted the sprites on Route 1 to turn an NPC into a Chansey)<br />Another method you can use is via &quot;stable unstable Missingno.&quot; This is only if you want to start the game all over again to keep a supply of particularly useful TMs such as Flamethrower, Thunderbolt, Ice Beam, Swords Dance.<br />[/quote]<br /><br />Hello there, long-time lurker and I have found a way to encounter Yellow&#039;s Missingno.s with stats of 182-184 a little easier. Though the process might be a bit [i]tedious[/i]...but it worked for me after a few tries.<br /><br />1)Do the Mew Trick in Cerulean City (or Route 8, your pick)<br />2)You need to battle the trainer on Route 3 (the one between the ledges) and use Growl 6 times on his last pokemon<br />3)You should get a lv. 1 Nidoranâ™€ when you fly back to Cerulean/R8 ([u][b]DO NOT SAVE AFTER CATCHING IT, IT MAY NOT HAVE THE RIGHT STAT[/b][/u])<br />4) Do the Experience underflow glitch; since Nidoranâ™€ uses the same growth algorithm as Mew, it will reach lv. 100 and evolve<br />5)Use a Moon Stone to evolve it again into Nidoqueen<br />6) Its Special stat now should be somewhere close to 180 range; if not, use a Calcium or 2 to get it to the right stat. If it goes over, restart and do the Mew Trick over again<br />7)Once Nidoqueen&#039;s Special stat is either 182, 183, or 184, you can encounter those Missingno. with the Mew Trick with ease (granted you can Fly to Cinnabar and find a Ditto of course)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t know if this was known, but here&#039;s a shinyzer code created by PRAMA board&#039;s member thelinekioubeur. It changes your first stored PokÃ©mon so it will be shiny when traded to 2G games.<br /><br />[code]ld hl, $DAB1<br />ld a, $EA<br />ld (hl), a<br />sub a, $40<br />inc hl<br />ld c, a<br />inc b<br />ld (hl), c<br />ret[/code]<br /><br />[code]ThunderStone x177<br />TM18 x62<br />TM34 x119<br />TM14 x64<br />Hp Up x79<br />PokÃ© Ball x113<br />TM01 x[whatever][/code]<br /><br />ThunderStone quantity goes -1 in US Yellow, +5 in european R/B, +4 in european Yellow.


subject: Re: General Pokemon Glitchiness
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve had an interesting glitch happen to me a few years ago back in Diamond and Pearl.<br /><br />I used an AR code to make all wild encounters shiny, and apparently having that code on while with a partner causes some wild double battles to freeze after the first wild pokemon does the shiny animation.<br /><br />First encounter was a Graveler and Onix on Iron Island with Riley. Graveler&#039;s shiny animation cut off Onix&#039;s cry and the game froze (notably, a small black bar appeared on the left-hand side)<br /><br />Another encounter in the same place was (I think) Onix and and Steelix or both Onix, but the game didn&#039;t freeze and the animations played normally.<br /><br />However, I had an encounter with Marley in that one part in Victory Road and encountered 2 shiny Machokes, which froze the game on the second one&#039;s shiny animation (and an extremely glitchy, small bar appeared in the same left-hand corner)<br /><br />I found it odd since on yours and a trainer&#039;s side, the game doesn&#039;t freeze if 2 shinies (same species or not) are sent out at once. I had a video uploaded once that showed the first 2 encounters mentioned (that got removed due to people not liking anyone who uses cheats and reported the vid) and someone once mentioned to me that this was caused by the second pokemon&#039;s cry being cut off or something about the game handling all those variables at once causes it to overload and stop.<br /><br />It&#039;s always had me curious as to why the game freezes.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: U_Flame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: U_Flame
icon: xx
body:
  [quote author=Krys3000 link=topic=6638.msg200686#msg200686 date=1467550612]<br />I don&#039;t know if this was known, but here&#039;s a shinyzer code created by PRAMA board&#039;s member thelinekioubeur. It changes your first stored PokÃ©mon so it will be shiny when traded to 2G games.<br /><br />[code]ld hl, $DAB1<br />ld a, $EA<br />ld (hl), a<br />sub a, $40<br />inc hl<br />ld c, a<br />inc b<br />ld (hl), c<br />ret[/code]<br /><br />[code]ThunderStone x177<br />TM18 x62<br />TM34 x119<br />TM14 x64<br />Hp Up x79<br />PokÃ© Ball x113<br />TM01 x[whatever][/code]<br /><br />ThunderStone quantity goes -1 in US Yellow, +5 in european R/B, +4 in european Yellow.<br />[/quote]<br /><br />This turned my 62 TM18s into 35 &quot;ws m &quot;s. Is that normal? I&#039;ve double checked to make sure I&#039;m using the right items. If it matters, I&#039;m on US Blue&nbsp; using 1 TM01 and the only Pokemon in box 1 is &quot;&#039;M &#039;N g&quot; I haven&#039;t checked what gen 2 views it as yet. I did try leveling it up to see if the possibly changed DVs made a ddifference stats, but the game crashes when &#039;M &#039;N g levels up. 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The quantity of TM01 REALLY doesn&#039;t matter. I mean it.<br />And, uh, it seems everything is correct. The ws lm shouldn&#039;t be here, and I guess you didn&#039;t setup your bag properly.<br />The listing given by Krys3000 start from item #3 !<br />The full setup should be something like<br />[code]<br />Any item xAny qty<br />Any item xAny qty<br />Thunderstone x177<br />TM18 x62<br />(etc)<br />TM01 xAny qty<br />Any items (or nothing :P)<br />[/code]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: U_Flame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh of course the 3rd item rule! I was so used to following list setups exactly that I forgot that was a thing. Thank you. 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, sorry I did not mention item 1 and 8F/ws l&#039;m, I just copy/pasted thelinekiouber&#039;s post and translated it to english. It seemed pretty obvious though&nbsp; :P


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: U_Flame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah in hindsight it kinda was. Oh well, I got a shiny glitch Pokemon now. Probably won&#039;t actually matter if I can&#039;t find a way to transfer it but its the thought that counts. Yay


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg200682#msg200682 date=1467486833]<br />[list]Okay, simple questions, simple answers.<br /><br />Unless it is saved then loaded, RAM doesn&#039;t persist. In that case it won&#039;t, but don&#039;t assume it will be zero.<br /><br />There is no official syntax for gb-specific z80 instructions, so here are some aliases :<br />[list]<br />[li]ldi (hl), a[/li]<br />[li]ld (hli), a[/li]<br />[li]ld (hl+), a[/li][li]ld [hli], a[/li]<br />[/list]<br />Same for ldd and ld-, etc.<br />You are correct, ldi (hl), a is totally equivalent to ld (hl), a \ inc hl<br /><br />There is a special instruction in gb z80 : ld ($FF00 + imm8), a (as well as ld a, ($FF00 + imm8)<br />It saves one byte (thus speed) over ld a, (mem16) and ld (mem16), a<br /><br />And the gb z80 is little-endian :<br />call $C0DE is &quot;CD DE C0&quot;<br /><br />Gotcha ? I will be writing a gbz80 dev page on the wiki some day. Right now I&#039;m spending a week with my gf, so I&#039;m pretty much occupied :P[/list]<br />[/quote]<br /><br />Thanks&nbsp; :D<br /><br />ld a,($FF00+A2)<br />So this would be &quot;F0 A2&quot;<br /><br />About negative relative jumps... Took me a while to figure that out, but i think i got it. <br />[code]<br />D99B &lt;- 18 || jr<br />D99C &lt;- FC || jump to D999<br />[/code]<br />This would be it right?


subject: Shitbanning
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  Shitbanning is the act of banning a user AFTER instigating, provoking or otherwise guaranteeing a user will perform a bannable action.<br /><br />This is the place to list off places where you have been shitbanned, run off, or just removed from a community for any reason. If you wanna vent about being banned, go ahead.<br /><br />My post:<br /><br />Was banned from danooct1.com/forum through shitbanning for reason: &quot;toxic&quot;.<br />[url=https://danooct1.com/forum/viewtopic.php?f=5&amp;t=688]Post used to shitban[/url]


subject: Re: Shitbanning
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [font=comic sans ms][size=8pt]that one time where i got banned for &quot;overquoting&quot;[/size][size=36pt]FUCK[/size][/font]


subject: YouTube's naming limits
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Missingno. Monarch:<br /><br />&gt;Alliteration<br />&gt;Sounds good<br />&gt;Lets people know I focus on PokÃ©mon<br />&gt;Easy to remember<br />&gt;I can&#039;t change my name BECAUSE THERE&#039;S A 90 DAY LIMIT I&#039;M SO FUCKING MAD AAAARRRRGGHGHGHGGHHHGHGH


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  When I&#039;m doubting about relative jumps, I remember this :<br />18 00 (jr @+0) does nothing.<br />18 FE (jr @-2) loops infinitely.<br /><br />So what you do is :<br />[list type=decimal]<br />[li]Take the address of the jr opcode (the first byte, not its operand !)[/li]<br />[li]Add two, call that &quot;baseAddr&quot;[/li]<br />[li]Take the operandas a signed 8-bit integer, call that &quot;offset&quot;[/li]<br />[li]Add offset to baseAddr[/li]<br />[li]Now you got the destination address.[/li]<br />[/list]<br />In your case, we have<br />* baseAddr = $D99B + 2 = $D99D<br />* offset = $FC = -$4 (negative, since its leftmost bit is 1 :P)<br />So you&#039;d jump to $D99D - $4 because ($FC &amp;&amp; $80) = $80<br />That is D999. You did right !<br /><br />Oh hey, and a tip about negating :<br />hex * -1 = (hex XOR $FF) + 1<br />It&#039;s neat to know this if you didn&#039;t already.


subject: Re: Shitbanning
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;Be me<br />&gt;Be raging asshole on a Smash Bros. fan forum<br />&gt;Treat everybody like shit<br />&gt;Everyone loved me<br />&gt;I never get banned<br />&gt;Got warned once for telling some idiot to go to bed because he was acting like a spaz


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m currently porting it to google docs. I&#039;m using a new-ish format, so it&#039;s gonna take a while. Current status: 40%<br /><br />https://docs.google.com/spreadsheets/d/1v81TksEV2Fi90cz1REr0IrMLlxcC3yCMvRg8KzzV2aQ/edit?usp=sharing


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7316.msg200700#msg200700 date=1467767261]<br />I&#039;m currently porting it to google docs. I&#039;m using a new-ish format, so it&#039;s gonna take a while. Current status: 40%<br /><br />https://docs.google.com/spreadsheets/d/1v81TksEV2Fi90cz1REr0IrMLlxcC3yCMvRg8KzzV2aQ/edit?usp=sharing<br />[/quote]<br />Thank you! :)


subject: 8f typing change doesn't work
poster_name: Alekstreamed
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So I&#039;m new here and to the whole arbitrary execution thing, but I wanted to try a code I found on another topic. It claims to change the typing of the first Pokemon in your current box. I used it and it did nothing. Here&#039;s the code:<br />[img]http://imgur.com/K7jY4iP[/img]<br />I have the 5 Pokemon/233 pidgey setup and have the correct items. Is there a reason this wouldn&#039;t work? Thank you :)


subject: Re: Creepiest 1st Generation Glitches
poster_name: Alekstreamed
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Scariest glitch I&#039;ve seen, fighting professor oak, on a certain roster, when his first Pokemon does it&#039;s cry, the music cuts out and starts playing this eerie music I&#039;ve never heard before


subject: Re: Creepiest 1st Generation Glitches
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Alekstreamed link=topic=7364.msg200704#msg200704 date=1467901182]<br />Scariest glitch I&#039;ve seen, fighting professor oak, on a certain roster, when his first Pokemon does it&#039;s cry, the music cuts out and starts playing this eerie music I&#039;ve never heard before<br />[/quote]<br />Did it look like this? [url=http://bulbapedia.bulbagarden.net/wiki/%E2%97%A3%E3%82%A5_8]http://bulbapedia.bulbagarden.net/wiki/%E2%97%A3%E3%82%A5_8[/url]


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  PokÃ©mon Red is now finished, with added Pallete, catch rate percent, and Stat averages. Later I&#039;ll do Yellow, JPRGY, EURGY, and any other requests.


subject: Re: Shitbanning
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  WOW... the arsehole who banned me (&quot;justquant&quot;) made an account on vxheaven.net just to retaliate. Told him to re-read the post. xD<br /><br />http://vxheaven.org/forum/viewtopic.php?pid=18795#p18795<br /><br />EDIT: Did I mention this was my first ever offense of any kind on this site?


subject: Re: Shitbanning
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7526.msg200709#msg200709 date=1467929614]<br />WOW... the arsehole who banned me (&quot;justquant&quot;) made an account on vxheaven.net just to retaliate. Told him to re-read the post. xD<br /><br />http://vxheaven.org/forum/viewtopic.php?pid=18795#p18795<br /><br />EDIT: Did I mention this was my first ever offense of any kind on this site?<br />[/quote]<br /><br />Woah you watch danooct1 too?<br /><br />Also there&#039;s a game of life glider on that page.<br /><br />


subject: 8F name's origin: does it relate to sliph co?
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was thinking for a long long time, why is 8F named 8F?<br />Is it the elevator buttons of sliph co?<br />If it really is, I think it could answer 1,2,3,4,5,6,7,8,9,10,11F name.<br />Again, if it really is the same button, why doesn&#039;t it does the same thing...is it because we&#039;re not inside the lift?<br />What happens if we use 8F in the lift?<br />(I&#039;m just a newcomer, so sorry if I said everything wrong)


subject: Highest possible DV values for Gen 1 games
poster_name: hashtag
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi, the TL,dR of this thread is going to be that i am trying to figure out what the best DV spreads each pokemon in gen 1 pokemon games can possibly achieve without glitches. anyways here is a bunch of words.<br /><br />Hello i am from smogon, where it has recently come to our attention that on RBY carts, many pokemon cannot have perfect DV spreads, and although i don&#039;t know if this is ever going to be implemented on our Sim, I think it is important to identify exactly what it is that would be changed. So i am asking here because i know that people in this community are very knowledgeable about the inner workings of these games and i hope someone can help give some insight into this issue.<br /><br />What we are working with right now is this article describing why it happens (http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Red/Blue_Wild_DVs)and this list of possible values for a patch of grass with &quot;25 encounter rate&quot; (http://pastebin.com/iBT64Pkq) This particular table is important for speedrunners who are trying to get a high stat nidoran. However this is only one route and as far as i know there isn&#039;t a database i can find that details what the encounter rates are for different routes. <br /><br />we know for a fact that pokemon like gastly and geodude are only found in caves, and the encounter rates in these places is much lower, so there should be a smaller list of possible DV spreads, but I don&#039;t know where to find or how to generate such a list, and we don&#039;t even know how different routes&#039; encounter rates compare to each other. basically we are in the dark about a lot here. some questions on my mind are:<br /><br />Do mons encountered via fishing have a chance for a perfect spread, is there a different table for them?<br /><br />Do mons acquired through in-game trades take the DV spread of the mon you traded, do they generate their own spreads?<br /><br />Does Yellow version use the same or different tables from Red/Blue?<br /><br />What about different languages?<br /><br />Thanks! i know that this is kind of tall ask but i appreciate anyone who has any insight on even a part of this.


subject: Re: 8F name's origin: does it relate to sliph co?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The programmers didn&#039;t bother creating separate code for item menus and elevator menus.<br />Instead, they just created dummy items with floor names, and programmed the elevator menu as an item selection screen. The same is true about the Gym Badge man in Cerulean City, and this is the reason why the badge items also exist.<br /><br />Elevator menus have special triggers that take the player to the proper floor after selecting an option, rather than trying to use the selected item. So, the floor items were never intended to be used, only displayed. If they are actually obtained and normally used, we get all sorts of wonderful glitchy effects.<br /><br />This quirk in programming has some interesting consequences. For example, in Japanese games, you can actually swap options in elevator menus, just like items can be swapped in item screens. Obviously, this doesn&#039;t end very well: [url=https://www.youtube.com/watch?v=fMf7_85ifc8]https://www.youtube.com/watch?v=fMf7_85ifc8[/url]<br />Also, activating the &#039;buy Master Balls for free&#039; Gameshark code will cause the first option in elevator menus to be replaced with Master Ball. This bugged me out as a kid. The code is constructed to change the first item in any item list to Master Ball, and elevator menus are in fact item lists.<br />


subject: Re: Saffron City 'odd Rocket' glitch
poster_name: rocketglitch2
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: rocketglitch2
icon: xx
body:
  Apologies for bringing this one back from the dead, but I came here to verify this one.<br /><br />I found my old Gameboy color and Pokemon blue cartridge, and on playing it for nostalgia&#039;s sake chanced upon the same thing happening. I left the Silph building, went up and talked to the Rocket guarding the house and descended into the alley, and a Rocket phantom appeared on the screen on the edge of the Silph building. Curiously it wasn&#039;t in the same spot as in the video.<br />EDIT: actually, it depends on where you walk: taking the left side of the alley it happens as in the video; on the right side, the Rocket appears on the edge of the building.<br /><br />For completeness, I hold 6 badges (in some order) and flew to Saffron from Viridian, after which I wandered into and out of the Silph building and found the bug as described. I then found this post after a search for more info on the bug.


subject: Share Screenshots of Funny Glitch Occurrences
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hacks too, i guess, followed by what happened around the event:<br />[img]http://i.imgur.com/musaV1R.png[/img]<br />After this, a bunch of noises played, and this happened (ignore the japanese characters):<br />[img]http://i.imgur.com/eBlranb.png[/img]


subject: Re: Share Screenshots of Funny Glitch Occurrences
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  I lost the picture, but at one point, just by coming out of a PKMN Center, all graphics were screwed, and yet I could continue as normal. This occured on REAL HARDWARE, which, luckily, was a DDS (Debug DS) I got off eBay, which included video-out.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  Since this is a forum game, I think it&#039;d be okay to revive it, right?<br /><br />Binary output of the first several KB of an old XPadder install I have zipped up.<br /><br /><br />PK........â€”}Ã»&lt;&gt;Å .Ã©}...w...3...Controller Profiles/2142_[PS2-Rorin].xpadderprofilezÃ¥..Ã¤...}UÃnÃš0.Â½Â¯Ã„;Ã¸râ€œÂ².;.ZU\tPv..#tÃ«:Ã­Ã‚%.&lt;B.Ã™ÃŽ.Ã¶Ã´36.Ã...Ë†Å“Å¸/Ã§.Ã‡Ãœ.Â¸ÃºÃªÃœÃœÂ£Ã§â€™f.â€œh.Ã…Å¡Ã§.MÃŒâ€¡ÃCâ€ ÃŽÃw&amp;..Ã….tÂ»Æ’...Â¡_)Ã“ÃˆÂ¼5/6ÃªwÃ§Ã†|Ã…Â©Ã¦Â«ÃËœÃ‘Ã¬E.L.Ã»qâ€t!ÃƒÃ©F.4OÃ¹?Ãƒ&amp;Â½(Ã©9v)Ã¹fÃƒdÃ­Ã„.vÃŒxNÂ³â„¢ÃˆÃ˜0Ã•Â´ÃˆÂ¨ÃŒÃ€8.&quot;Hâ€º Ã­hÃ½.2.h$..\.FBÃ‘H(Z.Å’.Â¿.-.Fâ€¹Â¯Gâ€¹CÃ‘Ã¢PÂ´$.-y3Z.Å’â€“\.â€“â€žÂ¢%WÂ£â„¢ÃÃ· .ÃŸ.{VÃ¨Ã³Ã¦Ã»Ti-.Ã¼â€¦Ã®Ã™PÂ²\ÃÃŒÃƒÃ“\h5\@Å’Xm)MB.vÃ’.Ë†Ã…V:â€™Â¢Zm=ÃœiÂ§l.Ã‘H.ZÅ .Ã’â€°ÂµUÅ !..â€¢Â¦JUzÂ¼Â³?FÅ¸!ÃšÂ³Â®?Ã•Â¾t6*Ã©j[i/dÃ9Ã“â€™Â®&lt;Â¼oÂ½+Q.Å¡Ã‰=Â£Âªâ€™Ly.g|â€ Ã˜Ã€Å¡(ÃŸÂ£L..Â¤Â¸Ã¶=Æ’Ã“Ã¢Ã±ÃVÂ£â„¢8Ã¶q.zGÃžCÃ¡..4Ã¡Ã’Ã‹t..Ã‰wcÃŸÂ½Â¬Ã¤Â«XPÃâ€ .Ã¢wvÂª:Ã.â€¢Ã‚â€ž3&#039;â€˜.Ã¯ÃŽÃÅ¸Ã hÃ´s4}DÃ©Ã²Ã«&lt;Å¡.Ã¯*Ã¶Â®.pÃ¥Ã­â€™Â®Â»UIÃ2ËœÃUÃ¹Ã¤Ã©Ã—:..GÃ â€œKÃ²BÃ».hÅ¾nÃ¹ÃšgÃÃ¾[ÃÅ’.Â´.Å Ã¹Â¤Â³~Â«ÃÃÂ§Ã’Ãª.Å’â€“fÃ­â€Â¡Ã‘.Â²ÃŽ. Ã»{Âµ&lt;qCÃ l..â€º=Ãr.Å¸w&amp;..+Â¶LÃ˜Ã§..Ãƒ#Ã¼Ã”i&quot;Ã¤Â¡qÂ¸Å¸Ã»Ã¼â‚¬`ÃHiIÃ—.Ã‰#ÃR8Ã§.Ã¢â€”RÂ¯tÂµkÃžÂ«nâ€BÃ¸Ã’Ã©tÂ³Å“.uâ€œwÂ¶.Ã¸Ã¯sÃª4.bâ€¡ÃŽ.Ã»â„¢qrÃ·.ÃŒÃ„_â€ Å¾&lt;AÃÃÂºâ€ºÃ­.h.f,Å¡Â²KY;Ã¥Ã¸L7Ã™Ã–Å’qCtÃ©nG4Å¡â€œÂº9.1ÂµÂ¢Ã¿PK........Ëœ}Ã»&lt;ÃƒÂ«ÃÂºâ€...Â£...K...Controller Profiles/Area_51_[Logitech_Chillstream-Anaxander].xpadderprofile}â€œÃ‘NÃ‚0.â€ Ã¯Ixâ€¡^Jâ€šâ€ u.$d.ÃªÃ¤J&quot;Â±Â¢DÃ£Eeâ€¡Ã™Ë†Ã­Ã¬Å &amp;&gt;Â½.â€¢Ã´ +$.Ã¥Ã»OÃ¿}dgÃ£Ã“Ã†OÂ»5&amp;â€¹Bd..23z%Ã—@&amp;Ã•OÃ…C.Ãš..0Â¥Ã”*Â¡Â½ÃžÃ°Â¬7.5{Ã¦`IÃµÂµRÃ¥Ã¥KÂ»U]FÃœÃŠÃ¥{.&quot;{Ã’.ÃŠdÃ€Âº.â€ .)r.Ã„Å¡Ã‹Å¸*eÃ½.Ã«Â»Ã´ÃžÃˆ&lt;.Ã£OFÃÃˆ%Ã©LdS.AÃ‚.Pâ„¢0.Âªâ€¹B.=.hP..UÂ£A5ÃšÂ¬FCj4Â¤..Ã•Ã¢Â£jqP-nVâ€¹CjqH..Ã•Ã˜Q5.TcÃj,Â¤Ã†.Ã•ÂªÃ­Â»(Kâ„¢Â«.PvÂ·|â€”.kÂµÅ Ã¸ZÃ›2Â¹.Â¯ËœÃ†Å½ÃžÃ€ÃŠâ€™+.Â¬Ã‘k.3.ÃŸaÃ–wÃ¬.Â³.ÂªÃ¡oreq8tÃ¡-fÃ§Å½]â€”KQâ‚¬ÃŸÃ¨;â„¢Â¿Ã™Â¿{Ã–â€”â€ž.nâ€ž.riÃ„Ã².Â¬.LÃµÂ·rs..Ã«Ã›;8ÃoÃƒÂ¼pÃ°.CtÂ§.s_ÃŒ1Ã¶Ã•.Ã¸}ÃšUOÃµÂ¦.2Ã•_@Ã¦Ã…Ã¾Ã€6Ã¢.@â€“D#.!.t|K.Ã†â€š%^.uÃ”Ã°Ã¿PÂ°ÃÃ¿3Ã”PÃƒÃ¿C...Ã›Ã¬+Â¶.Ã zÃœs&amp;&#039;QgoÃ¶Ã .Ã¯OÃ“NÂ½Ã„Â¿PK........Å¡}Ã»&lt;{Ã»%.â€˜...Â¿...;...Controller Profiles/Audiosurf_[PS2-Shiaoran].xpadderprofile.â€AKÃƒ0.Ã…Ã¯Æ’}â€¡..Â¦4i6&#039;Â£â€¡Ã‰...Ã„:.Ã…CXÂ³.Â¬II2.Ã»Ã´Â¦.Â³YÃ—Ã”.6â€“Ã¿{}Ã¯â€”â€™vvÃ‘Ã¹..fÃ Âµ$YF%xâ€bÃƒ..Ã®ÃŒ.â„¢Ã»...^Â¨TLÃ°.EÃ‘Ã´2BÃ•Ã¨=Â¥.ËœÂ¯f&lt;W.Ãƒ.Ã¹.SÃÃ–_.JÂ²7ÃÂ©J&amp;x4ÃÂ®Ã‚H.8)RÂ¶7*..Ã°Ã˜ÂªÃâ€™Ã¥9â€¢Ãâ€¢p..Â²x$Ã™Rd4Â¹.â€™Ã­.Ã—Â¤p.Â¡_BÂµâ€jÃ‚3&quot;Â³Z@^&lt;Ã”â€¹â€¡Â¼xÃ¨.Â¯Â£.Ãºâ€ž.Â´Ã˜â€¹.Ã·Â¢Ã…^Â´Â¸.-Ã¶Â¡Ã…&gt;4Ã¬EÃƒÂ½hÃ˜â€¹â€ Â»Ã‘Â°..wÂ¢â„¢.8WÅ Ã¥Ã¼â€ºr}8â‚¬7[..â€¡i!Â´J.Ã¨FÆ’Â¥Ã˜*.Ã¬.Å“ÃsÃ—â€¡Â¬Ã¯â€°Ã¥Å¸m#:2Ã†..84p.jÅ“.6_.ÃºÂ¦Â¡Ã…Ã—Ã–xÂ«Ã–Â¤Â¤G77.Â¬â€š0Â´.Â¢Ã“Â²ÃªÅ’Â¬J;Å¸K)v`U6J.Ã©Å Ãµ Ã‘.bÃ‡]Â¹Z7jâ€¦Ã®ÂªÃ•Ãš}Â«tÃ·Z.Â¯Ã™:Ã¼ÃVÃ¿Â§..ÃšÃ­.[Å .zÅ’`.ÂµdÅ¸â€¡RÅ¡Ã·Â¯Â«:â‚¬NBâ€ºÃ’ÃšÃºrÅ¡m81.Â½Ã”Â¦Â¾.fÂ¯NH{ÃƒÃ•Ãº4Ã¤.PK........ }Ã»&lt;&quot;Ã†â€¦â€¹}...9...9...Controller Profiles/Battle for the Pacific.xpadderprofile}â€œAOÃ‚0.â€ Ã¯KÃ¶.vâ€..Ã­.jÃˆ.Ã¨Ã”â€¹$Ãˆ@Å’Ã†Cee4ÃŽvYâ€¹&amp;Ã¾z;.Ã®.Â¬.@â€“Ã§}Ã—&gt;.iâ€¡Ã§..ÃŸ../.MSV.â€œRÂ®xÃŽâ€š{Ã³cÂ¸Ã«.ÃŸ{fÂ¥Ã¢RDÂ¸Ã—Â»Â¼@Â¨Bo.Ã“.Ã¹j.2ÃµÃ®{Ã¦.%Å¡/?cFÃ“W)ËœÅ .Â¤; 0Ã¡4â€œâ€šÃ¦.Ã¿5)Ã©wIÃŸÂ¦Â³â€™g.+Ã«7Q.Ã™$Å¾Ãt,S.%Å¡Å â€â€“)X.Â¹.|.`Â§.&gt;Â©â€ .jÂ¸].Â»Ã”Â°K-tÂªâ€¦&#039;Ã•BÂ§ZÃ˜Â®.ÂºÃ”Bâ€”.qÂªâ€˜â€œjÃ„Â©FÃšÃ•Ë†K.Â´Âªâ„¢Ã“7RÅ gÃ¢â€¹.Â½?|7..Â¥@I.ÂµÅ Â¦.aÃ‹Ã® .-{d+sÅ Ã—|Â¥aHlËœ.tÃ‰ Ã¯[Ã¾.Ã™.,4â€“.Ã….Ã‹Æ’3Ã”.Â½+Ã›{â‚¬Ã¬ÃšÂ².Ã½hÅ’ÃÃ›Ã¹Âª%-.Ã»Â£ÃtÂ·.Â¸.oÃŠÂ³ÃµÂ¡.Ã®Ã”Ã—h^Ã˜Å¾m,Ã–Å’Ã¥ÃÂ¼Â¨Ã³XÃ¾Ë†Ã£FEÃ¡.Ã›Â¯Â²â‚¬pÂ»ÂµÃ¥1Ã¤Ãµâ€™.Ã„Ã•.eÃ±.ÃžÃšÂ¦Ã X~Â³.?[.Ã›â‚¬ÃŽâ€“Ã‚ÃšÃ¡ Ã›Ã–Ã.Â¸v.Â¥.ÃºÃž.PK........Å“}Ã»&lt;0Ã„â€™dÃ·...Å¾...M...Controller Profiles/Battlefield_2142_[Xbox_360-Adrian_Cordero].xpadderprofile}â€œ]oÃš0.â€ Ã¯Ã³+|Â¹JÃ™..@Â©....W 1LÃ‡Ãšj..1!jjGâ€°Ã™Â´Ã½Ãºâ€¦8Ã„.â€šA.Ã¡Ã·=Ã§Ãµâ€œÃ˜gÃ¸Ã¹Ãª&#039;.Â¢Å¸Â¹Ë†cY eÂ¡wi&amp;Ã‘Â¬Ãº.â€ Å¾Ã²Ã â€¡,ÃŠTÂ«.â€°Â¢Ã»/8.â€šW..ÂªÂ¾&amp;UIÃ¹+Â¨Ã¾anÃ’Ã­Ã»DÅ Ã¸E+YÅ½Ãº,Ã¬3`Â¤&quot;Ã‘Jd&lt;Ã½Wâ„¢Â¬.Â²^mÂ®â€¹4IdÃ¡ÃºpË†kcÂ².Ã±BÃ‡r4Mâ€œÂ½Ã™Ë†Â¿..Ã—:7BÃ…Â¢Ë†.N::Ã±Aâ€˜[PÃ„.EZÂ¨Ã®&amp;Ã˜Â£wÂ¡Â¨.Å Ãžâ€šÂ¢&gt;(z.Å z Â¨.Å Ã¹ Ã˜-(Ã¦Æ’bWÂ¡Ëœ.Å ]Æ’.^.Ã‹2MÃ”â€¡TÂ¦Â¹b_.Ã†hâ€¦yÂ¦M9Ã¢Â¹Ã˜J .+/Ã´Â¡â€hÂ³â€”2C.Ã½G..j+VPZ.&gt;Ãž2Ã‰M!UbÃ¶.?y.1.â‚¬.Ã–Ã}ÃŠ.ÃŸÂ³Ã¾\Ã®Âªâ€°Ã˜Â§;.Â¼Â¾ÃµÂ¦@ÂºoÂ¤r+rË†?Â°ÃºÅ’â€žÃ£Ã§Ã±|Å Ã¸ÃºÃ›2Å“Ã¡Â³.=[1Â°.A.â‚¬gÂ¬â€¢)t._^dÃ­â€”vÃˆÅ¾Ã²â€ H.YÂ´ÃªÃª8uÃ–.Â·Ã¢Ã±}Zm-ÃžZÃµÂ¸SS)Ã².ÃÃµÃ¶.ÃŒÃª)~.4.&gt;.Â²â€¹Ã§@uÃ±.`Ã”OÂ±Ã¶X.ÃºÂ·&lt;.ÃŠÃ‰Â¯.Å¾K..z.Ã â‚¬ÃAs.^VÃ¹&quot;.(Hh/â€ºÂ«Ã±ÃµÂ»G.Ã½GÃ±Â¢Â¦Ã›ÃŸÃŒâ€º.Â¨9â€˜.Â±&#039;Å’&gt;â€˜;X.Å¾Â·Â¾.Ã§ÂµÂ¸[Ã›...â€¦.\..Ã¸Ã½Ã¬j8ÂªÂ¥HÃ€.Â±m.nuZÃ¿.PK........Â¢}Ã»&lt;..Â¹lÂ¾...Ã»...9...Controller Profiles/BioShockController_PS2.xpadderprofile}â€MOÃ‚@.â€ Ã¯$Ã¼â€¡.5Â©Â¦ÃnÂ¡Ã„Ã´â‚¬&quot;&#039;Iâ€Ã¢G4..:â€“.eÂ·i.MÃ¼Ãµ.Â¶Â¸SÃ¨J.!ÃÂ¼Ã“yv(Â½ÂºÃ¨|Ãµ{WÃŽKÃÃ’.JÃ§Â¾â€.&lt;.gZ.Ã”ÃœÃ–ÃÃ¯=AYq)bÃ¢yÃƒKoÃ„vÃ¬-.Ã¥Ã”oÃ…EVÂ½Ã·{ÃµW?Q|Ãµ9.â€“Â¾J.U&lt; nÃ¤Ã£.gâ„¢.,OÃ¸O].=7Ã´tuQÃ²,Æ’Ã’tÃºnÃ“7Â¹gÃ©LÂ¦.&#039;Å â€°â€â€¢)ÂºÅ“o+.Ã“.9U.P\iÂ©Ã‘ÃÂ¥Â¡Â®ZÃ•HÂ·.Â±Â©.â€ºZ`U.Ã¾U.Â¬jAÂ·Z`S.ljÃ”ÂªFÃ¿UÂ£V5Ãš.FmjÂ´S.Â¾Ã»Ã†UÃ…3Â±.Â¡.7ÃŸÃµV))Ã¼$â€”ÂªÅ Â§Ëœ.Ã.Ëœ.Å¡=aF5Â»Ã…,Ã”lÅ½Ã™ a&lt;[+g&amp;Â·.8ÂºÃ Å“â€˜s..ÃªÃ .fâ€˜fwÃ°qÃœÃ«Â·zÂ£Ã¹vÂ³ÃŒ!Ã¶;`Â¢J.â„¢ZÃ—{%#Ã—..Å“.Ã©.Â³.[lÃ‹Â¥Å“3.1.[Ã«Ã²Å¡3W+V@Â«Ã’l2)Ã˜ÃªÂ¨Ãev H-ÂªÃ•HÃ”.5Â¿Ã„Â«Ã¹s?..Ã®~.Ãkâ‚¬Ãœy,L}Â¿d.y0t&quot;Â¿Ã…iÃŸÅ½Å¡ÃŒnÃƒ:s...â€¡.Ã.Â¢).ÃŒÃÅ“.csÃ©1~Ã¬Â´Ã2â€œ_Ã°w..@cPfOqÃ¬Ã¸tÃ»â€9Å“....ÃšÃ~Ã¯.PK........Â¤}Ã»&lt;â‚¬Ã¢.Ã­y...â€¦...8...Controller Profiles/BioShock_[PS2-RaZoRX].xpadderprofile}UÃ‘nÃš0.}GÃ¢.Ã¼Â¸I.Ë†.(SÃ….â€¦Â¢j.Ã„.(SÂ§=XÃ¤.,â€™8Å .XÃ·ÃµKÃ¬@Ã¬.....sÃ®Ã±Â¹Ã¶Ã…yÃ¼Ã–Ã¸iÂ·.Ã‘Â¯Ëœx.$h.Â°...ÃÃ³Å¸.7.Â´[o.pÃŠÂ¢1Ã®Ã·.Âº.. ÃŸ.Â¤(Ã¿Â¦4Ã²Ã¹Å¸v+.Â´Ãœâ€Ã®O3 Ãž;â€¹â‚¬.â€¡NgÃ¨Â¨.%&gt;â€¹HÃ Ã’.9Ã«.:ÃŽ@Â²â€ºâ€žÃº&gt;$UÂ¥Ã•Â±$3[.oÃ‰&lt;.Â»)â€°&lt;â€™xÅ .e&quot;Ã°=..Ã‘Ã°Â§Ã‘Â°1.nÅ½â€ MÃ‘Â°)Å¡mÅ’f..Ã6FÂ³â€ºÂ£Ã™Â¦hÂ¶)Å¡cÅ’Ã¦|.Ã1FsÅ¡Â£9Â¦hNcÂ´|Ãº&amp;Å“S?.!JÂ¯ÃƒÃ·â€Â¥)â€¹Â¬..a&lt;Â§.OÃ‘â€žz.Ã¥.,Ã¥Ã£Â¹Å a!.â€¦â‚¬.Â¯Ã·|.Ã´Ã².3M â€¹^UÃŒ.E?Â²0Ã–PÂ©tcÂ²..wâ€žzÃ‹uPÅ Å¸Ul â€ž.Ã¦wÃ‘: Â¼Â·.Â¢-0(Â£PÃ¿ËœÂ¢%Ã‹8 I /Ã¸Â«*.^Ã·.Å¡.â€ Ã’h.â€¡Âº.Â¥Ã¹&lt;.Å¸Â¢ÂºWÃ¸ %Dâ„¢Ã†+&gt;Ã®â€˜.R.ÃŒ.Ã±..[*8.Å½Ã“#â€°|@â€œ0Ã”Â¶z$Ã­â€“Ã”Ã³Ã²;I.fkÃÂ¾.â€º%â€°Ã¹&gt;.Ë†4Âª4Ã‘.Â¾/ÃµÂµÃ¸VÂ¿&lt;.Â¾&#039;Â±v:â€“Å“Â¢iÃ‚Â²Ã½Q&#039;dÃ‰T.â€ºZÂµÃ¤hÂ½3.ÃªpÂ£XÅ½Ã”Ã,.vNÃŽzËœrÂ°Ã¦Â£ÃªJÃœÃ†BÂ¿Ãºâ€ºvQq&gt;]q@]UPÃ®Æ’Ã˜Ã…Ã. @Ã›Â¸Ã¢Ã…....Â²?Ã•pYÃºVÂ¡3vâ€°â€žx.Å“...â€™Ã»%.Â´Ã’.Æ’&quot;m.Ã².Vp.Ã¼OÂº`Â¾Â®...ÃµÂ¢/Ã›.Â³Ã¤R{.\Ã»ÃœÂ©`Ã•Å“xÂºÂ£dÃ‰LÃ…o.&gt;Ã¥Ã›Q_Â¤ÃªÃUÃ¡[;Ã…C..Ãºâ€°ÃºV*Â»X0vÂº.Ã…â€¢QÂ·nÃ‰Ã²{H.Ëœ;Ã‚JGJÃ¹.Ã¬Ã– XÂ¾:â€”Å Â½Ã³Â¨â€¹LÃ½Ã¢Âª_Â¥ZÅ Ã¾.PK........Â¦}Ã»&lt; Ã¡Â®.....â€ž...U...Controller Profiles/Brothers_in_Arms_Road_to_Hill_30_[Xbox_360-Sekken].xpadderprofile}â€AOÃ‚0.â€ Ã¯$Ã¼â€¡.%ACÂ»..Â².:Ã±Ã¢.tâ‚¬.Ã£Â¡Ã’2.gÂ»lE..Â½..Ã©7]!..Ã§}Ã·Ãµ.Â´â€º\Â¶Â¾Âº.IÂ°.(cÂ¼.Ã¦Â¥Ãšâ€°Å“.3Ã³aÂ¸Ã¯â€šngÃ…Ã‹J(.Ã¡Ã`|â€¦P.^SÂ®.Ã³Ã–BfÃ•[Â·cÂ¾Â¢Tâ€¹Ã­GÃŒ)Ã›(Ã‰Â«hDÃº#..A3%iÅ¾Å .â€œâ€™aÅ¸.mÂº(Eâ€“Ã±Ã’]â€°ÃºÃˆ&amp;Ã±Å“Â²D1.Â¥Å¡JFK.Ã†!_â‚¬Ã¿.Ã˜Â«â€ ÃÂªaÂ¯.nWÃƒ&gt;5Ã¬S.Â½jÃ¡YÂµÃÂ«.Â¶Â«â€¦&gt;ÂµÃÂ§FÂ¼jÃ¤Â¬.Ã±Âªâ€˜v5Ã¢S#.jfÃ·MÂ«JdÃ²â€œK}Ãš|Â·..â€¢DiÂ®t.Â¥.ÃrÃˆÂ±Ã¥O.â€¦â€“Ã #â€“-Ã¨;Â¤CK.Ã¹ÃŽÃ¬Ã¹Â½Ã˜i.Å½lÃ¸.Ã™Ã˜Â².dÃ—â€“ÃW[Z4ÃœnÃ€Ã´;%uÂ©Ã²Ã†-.lÅ¾.Ã†ÃŒaMÃ”Â¡Ã¢..â€šâ€¹Â°Ã§.ÃŠÂ²Â°Ã….CÃ&quot;Ã›kKÂ±Â£Â±Ãºâ€“.Â®.Â¬â€”Â·.ÃCv.Ãº.!..CÃ®.Â§.Â»Ã‘SxLOÂ£Ã­.%Ãªâ€¹.Ã‹..Ã€2 sÂ¤Â°Ã¦V...Ã‚â€™s.Â¥.6.AÂ®u\Ã¥Ã..{.2Ã;Ã¾wÃ22Ã¥_PK........Â«}Ã»&lt;â€ºâ„¢Ã˜Ã²Å’...â€°...R...Controller Profiles/Call Of Duty 4 - Modern Warfare [PS2-Old Snake].xpadderprofile}â€œÃ‘NÃ‚0.â€ Ã¯Ixâ€¡]jâ€šâ€ v.hÃˆ.ÃÃ‰â€¢3Ãª..Ã†â€¹â€ â€“Ã‘Ë†Ã­Â².M|z;.Ã©â„¢Â®.@ÃˆwÃ¾Å¾Ã³.e.Å“u~ÃºÂ½IÃ´RQÃ†x.ÃÃ—j%6&lt;Å¡Ã™.Ã‹C.ÃºÂ½.Â¯ÂµP2Ã…ÃƒÃ¡Ã¸...Ã´Vp.Ã™Â¯.Â²Ã”Ã¯Ã½Å¾Ã½â€¹.#â€“..Â§Ã¬UIÂ®Ã“..Å’.Â¬.Z*I7â€¦Ã¸Â±Uâ€™.HÃ¢ÂªOÂµ(K^Ã»â€œhâ‚¬\%Â»Â§,WÅ’Â§â€¦Â¡â€™Ã‘Å¡.v(TÃ€Ã¿.8Â¨â€ .ÂªÃ¡ .Ã®VÃƒ!5.Râ€¹Æ’jÃ±QÂµ8Â¨.wÂ«Ã…!Âµ8Â¤Fâ€šjÃ¤Â¨..Âªâ€˜n5.R#.jÃ¶Ã­â€ºj-JÃ¹Ã‰Â¥9Â¼|W[câ€DÃ…F....]rÃˆÂ±Ã£Ã—.Ã…Å½=BF.[@â€“Ã¬sÂ¢\â€º(W[Ã#WË†NÃ°).Å½\0.Å’Ã™[Ã•NÃ†.Ã¤Ã˜%.d.Å½ÃÃ²Ã•ÃŸ)Â¨uÃ¶Ã’Ã¥f.Âµâ€¡.ÃžÃ¨%.Zâ€¹#.Ãš.kÂ±2.ÃªÃ¾Â¹ÃœÃ¹Ã«6Â¯.J&lt;ÃšmÂ¾.Ã iÂ¦Â¾Â¥Æ’Ã˜ÃƒfÅ’Æ’.Ã°Âª.Å¡..â€šÂ¶SÃˆ}Ã£gË†}Ã«.^Ã¶CkÃ·ÃˆrÃµÃ…Â£Â¦.Å’â‚¬A ÂµÂ£0Ã¦Ã§â€šÃ”Â¼â€š.Ã¯.&quot;.l/Ã«cvÃ¡_PK........Â¨}Ã»&lt;d!EÃ§Ã...Ã´Â¼..H...Controller Profiles/Call_Of_Duty_2_[Xbox_360-machoman_93].xpadderprofile.ÃšQ.\Ã‡uÃ„Ã±w.Ãº.|Å’.&amp;â„¢Â®Âªâ„¢.â€¦Ã.Ã™Å Ã²b.â€ (&#039;.Æ’&lt;Â¬Ã„.EËœÃ¢.Ã¤*Ã¾Ãº!wHÃ®Ãœ9UÃÃ‡â‚¬.Â£Ã¯Å Â¸Â§I.Ã½}Ã±Ã»Ãƒ?Ã›Ã¿|ÃµÂ»?&lt;Ã¹Ã¯Â·7/^ÃœÂ¾{Ã²â€”ww?Â¿z}Ã»Ã¤Ã›.Ã¿ÃµÃ¡&lt;Ã½._Ã½Ã®?oÃŸÂ½.uÃ·Ã¦.vÂ»Â«.Ã™.?.Ã½ÃÃ³Ã›Ã»&#039;.Ã¾Âº.ÃµÃ¦Ã¥Ã»Ã¿Ã½Ãªw.Ã¾Ã§x~Ã¿ÃªÂ§Â¿.s{Ã³Ã¢owonÃŸ?;Ã¨Ã©AÂ§&#039;?Â¼{ÃµÃ²Ã¥Ã­Â»Ã‡gÃ£Ã©8=Ã¹Ã¦/7/Â¾yuÃ³Ã²Ã®ÃÃÃ«Ã¯Ã®^Ãœ&gt;Ã»ÃºÃµÃ«Â».Å“Ã½zcÃº.Ã¡)Ã¢Â» Â¾.&amp;Ã¯â€šÃ©Â»`Ãº.Å’Ã¯Ã‚Ã¸.Å“Â¼.Â§Ã¯Ã‚Ã©Â»(Â¾â€¹Ã¢Â»hÃ².Å¡Â¾â€¹Ã²Â»|Ã¸.Ã´ÃµÃ»Ã·Â¯^Â¾Ã¹ÃµÃ¶ÃÃ½Ã§?@.Ã¼Ã­Ã¾Ã¾Ã®ÃÃ¸.â€º_oÅ¸mNÅ¾Â¿Â¾Â».Ã¿Ã¬Ã¹Ã›â€ºÅ¸n7Ã§?ÃœÂ½|Ã¹ÃºÃ¶Ã™n{Ã¸Ã›Â».Ã¯ÃœÃ™Ã·7Ã·Â·ÃÃ†Ã¶ÃÃ·Â¿Ã½ÃºÃ£â€¡_aËœÃƒÃ§Ã·Ã¯nÃŸÂ¼Â¼Ã¿Ã¥Ã½3.Å¾Ã¢Â°}Â¡Ã›Ã»Ã§Â·Â¯o.Âº.â€ Ã½~Ã³Ã¤Â»Â»ÃŸÃžÃŸ&gt;.{{Ã»Ã¢.QÅ¸&lt;ÃœÃÅ¸Ã¯Ã®Ã¾Ã¾Â¯.Ãº0Ã¥Â»â€ºÃ³Å¸@..Â§ÃÃ¿Â´9sCÃƒ..44&gt;.Ã­..â€¡.8&gt;Ã½Ã°Ã—Ã¶uÃ’Ã˜Ë†cc96Ã‹Ã˜&lt;.Ã½Ã½Ã“o7Â§npÅ¡Ãâ„¢.Â§.Å“.Ã..g.Å“Ã‹ÃU.Ã—iÃ°ÃÅ¸FÂ¹Â±eÃ†V.[nl5Ã†V.[ql-Ã‡Ãžâ€”Â±Ã·Â§Â±Âµ9scÃ¯ÃÃ˜Ã»4Ã¶Ãž.Â½oÅ’Â½.cÃ¯Ã£Ã˜Ã»Ã¥Ã˜â€¡2Ã¶Ã¡4Ã¶Â¿oÃŽÃœÃ˜.3Ã¶!.}p+Ã­p9Ã¶.OÃ·ÃœÂ¾L.Ãº.â€¡&gt;,â€¡Â¾*C_.â€ Ã¾Ã¡Ã¦Ã‡ÃÂ©.Ã»ÃŠÅ’}â€¢Ã†Â¾rÂ¿Ã›W.ÃŸÃ­Â«8Ã¸U.Ã¼j9Ã¸Â±.~&lt;.Ã¾oÃ¯.ÂºyÂ»Ã¹Â·Ã˜Ã‘Ã~4Â³.Ã“Ã¬G7Ã»Â±1Ã»1ÃŽ~Å’Â³.â€”Â³_â€”Ã™Â¯OÂ³Ã¿qsÃ¦Ã†Â¾6c_Â§Â±Â¯ÃÃ˜Ã—.Â±Â¯Ã£Ã˜Ã—qÃ¬Ã«Ã¥Ã˜cWÃƒeÃ·Ã©ÃŸdÂ¯^Ã¾Ã²!â€”.yÃµÃ³Ã½Ã¶Â±.Ëœ.+Ëœ]LËœ.Â»â€ ÃÂ§Ã“{Ã¸Ã°zÂ±cv9dvÃ«Â«0.Ã·)Ã¢Â¶gv~[p9Ã¡â€ ..tÃ¦Å¸tÃœ$Ã¤Ã–%7jÃŠ.ËœÃ¹mÃ‹..s#Ã–ÃœÂ°97:=7rÃ.\tc.tÂ£6Ã â„¢ÃŸ&amp;ÃpM7bÃ”.[uÂ£â€œu#wÃÃˆa7Ã–e7jÃš.â„¢Ã¹mÃ›..w#Ã–ÃÂ°y7:}7rÃ .\xc.xÂ£6ÃžÃ˜â€ºÃ¹mÃ¤.Wy#fÃžÂ°.7:Â¡7rÃ©.Å“zcÃzÂ£Ã†Ãž8ËœÃ¹mÃ­.â€”{#Ã¶Ãž8Ã˜Ã¹..Ã¹sÃ´.\}c.}Â£vÃŸÂ¸2Ã³Ã›Ã¬.Â®Ã»F.Â¿aÃ‹otÃ’oÃ¤Ã¶.9Ã¾Ã†ÂºÃ¾FÃÂ¿q4Ã³Ã›Ã´.Â®Ã½FÅ’Â¿aÃ«otÃ²oÃ¤Ã¾.9.Ã‡Âº.GMÃ€qmÃ¦Â·.8\.Å½X.ÃƒfÃ Ã¨tÃ Ãˆ!8r.Å½u.Â¢Â¦ vu~Ã˜Ã¾Æ’Ã«?Ã„Ã¾Æ’Ã­?tÃº.Â¹Ã¿.Ã».Ã«Ã¾CÃ­?ËœÃ¾Æ’Ã­?Â¸Ã¾CÃ¬?Ã˜Ã¾CÂ§Ã¿.Ã».Â¹Ã¿ÃÃ¸â€™g&gt;Ã¥â„¢Ã¾Æ’Ã¿â€“g?Ã¦Ã¥Â¯yÃ¾s^Ã«{ÃžÃ¤Æ’ÃžÃ¤â€¹ÃžÂºÃ¿PÃ».Â¦Ã¿`Ã».Â®Ã¿.Ã».Â¶Ã¿ÃÃ©?Ã¤Ã¾CÃ®?Â¬Ã».ÂµÃ¿`Ãº.Â¶Ã¿Ã Ãº.Â±Ã¿`Ã»..Ã¾CÃ®?Ã¤Ã¾ÃƒÂºÃ¿PÃ».Â¦Ã¿`Ã».Â®Ã¿.Ã».Â¶Ã¿ÃÃ©?Ã¤Ã¾CÃ®?Â¬Ã».ÂµÃ¿`Ãº.Â¶Ã¿Ã Ãº.Â±Ã¿`Ã»..Ã¾CÃ®?Ã¤Ã¾ÃƒÂºÃ¿PÃ».Â¦Ã¿`Ã».Â®Ã¿.Ã».Â¶Ã¿ÃÃ©?Ã¤Ã¾CÃ®?Â¬Ã».ÂµÃ¿`Ãº.Â¶Ã¿Ã Ãº.Â±Ã¿`Ã»..Ã¾CÃ®?Ã¤Ã¾ÃƒÂºÃ¿


subject: Re: 8F name's origin: does it relate to sliph co?
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheUnReturned
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7529.msg200715#msg200715 date=1468051518]<br />The programmers didn&#039;t bother creating separate code for item menus and elevator menus.<br />Instead, they just created dummy items with floor names, and programmed the elevator menu as an item selection screen. The same is true about the Gym Badge man in Cerulean City, and this is the reason why the badge items also exist.<br /><br />Elevator menus have special triggers that take the player to the proper floor after selecting an option, rather than trying to use the selected item. So, the floor items were never intended to be used, only displayed. If they are actually obtained and normally used, we get all sorts of wonderful glitchy effects.<br /><br />This quirk in programming has some interesting consequences. For example, in Japanese games, you can actually swap options in elevator menus, just like items can be swapped in item screens. Obviously, this doesn&#039;t end very well: [url=https://www.youtube.com/watch?v=fMf7_85ifc8]https://www.youtube.com/watch?v=fMf7_85ifc8[/url]<br />Also, activating the &#039;buy Master Balls for free&#039; Gameshark code will cause the first option in elevator menus to be replaced with Master Ball. This bugged me out as a kid. The code is constructed to change the first item in any item list to Master Ball, and elevator menus are in fact item lists.<br />[/quote]<br />Ehh...<br />Is it possible to program a custom floor by changing what does the floor button leads to?<br />Or change where does the lift button could take you to?<br />That way we might be able to access everywhere with lift haha


subject: Re: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It looks like it just shows the game is broken.<br /><br /><br />Wait.<br />Whenever there&#039;s more than 10 sprites on screen show up, it will keep corrupting until the sprites were hidden by a textbox?


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In first place, where did you get that Pokemon in the very first of the game in the first place<br />Uhh, E6...<br />The back sprite of it is devastating, and have a very high chance of locking your game up.<br />But myself haven&#039;t seen this effect before.<br />My guess is it that, the back Sprite of E6 has corrupt everything (or buttons) with a certain value (which maybe is the Rattata learned &lt;garbage&gt;). Normally after learning a move, (if only that Pokemon learn the move and there&#039;s still move slot remaining) you would have exited to the overworld. But seemingly the game could not find a value to return back to the overworld, it would continue to scan through (which is keep learning the move) until it finds the value to go back to the overworld, but it can&#039;t, and maybe one of these happened:<br />The move learnt keep exceeding the limit and eventually crashed<br />It reached the end.<br />(I&#039;m new to glitching so maybe all of those are wrong)<br />But why it&#039;s the ENEMY Pokemon learning the move?<br />[s]Maybe it&#039;s jealous of you so it glitches itself too[/s]


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It actually takes the back sprite from 0xFAC9, which is in RAM. It reads this, and draws too many bytes, corrupting some stuff, and then... I don&#039;t know.


subject: Thread for requesting patches
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This is a thread where you can request small patches for things you need.<br /><br />For example, I need a script where holding select makes all sfx (not music) stop. Please post it in hex codes. Thanks.


subject: Re: Thread for requesting patches
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Alright. Update: What about a patch that, when you press select, it ends the current textbox. However, I question whether it would affect item swapping.


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I think this may be related to the sound bank addresses C0EF, C0F0 becoming corrupted (corrupted by the decompression of the glitch PokÃ©mon&#039;s sprite). When experimenting with the &quot;stable unstable&quot; Missingno. trick (the first unstable Missingno. you encounter is believed to never freeze the game unless you encounter further), I noticed that a value of 01 would give a &quot;learned&quot;/&quot;trying to learn&quot; effect.


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheUnReturned
icon: xx
body:
  [quote author=Torchickens link=topic=7518.msg200727#msg200727 date=1468249704]<br />I think this may be related to the sound bank addresses C0EF, C0F0 becoming corrupted (corrupted by the decompression of the glitch PokÃ©mon&#039;s sprite). When experimenting with the &quot;stable unstable&quot; Missingno. trick (the first unstable Missingno. you encounter is believed to never freeze the game unless you encounter further), I noticed that a value of 01 would give a &quot;learned&quot;/&quot;trying to learn&quot; effect.<br />[/quote]<br />So you mean it&#039;s corrupted to a infinite 01 loop?<br />It corrupted the enemy Pokemon value?


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7518.msg200621#msg200621 date=1466900232]<br />What I want to know is why and how this occurs, as well as where the name comes from. I know the stack pointer decreases significantly for every textbox. Here is the video:<br />[youtube]https://www.youtube.com/watch?v=njs98Ulf7gc[/youtube]<br />[/quote]<br />You used gameshark code for that?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: bestgoldglitche
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: bestgoldglitche
icon: xx
body:
  [quote author=camper link=topic=6716.msg190560#msg190560 date=1373561320]<br />Item cloning is possible with Pokemon cloning. Now we need to find a way to do item mutation.<br />[/quote]<br /><br />I&#039;ve been playing around with this glitch for a while now and recently found a way to produce any item.&nbsp; The process is almost the same as what TheZZAZZGlitch laid out in his video where he explained how to get Celebi.&nbsp; <br /><br />https://www.youtube.com/watch?v=SpfgOVfGVTo<br /><br />Basically, you place 43 Fresh Water in your PC instead of 42, and you&#039;ll jump to the item of the first Pokemon in your party instead of the ID number.&nbsp; Given the normal set up that would yield HM09 I think which can be sold for about 19000 Pokebucks...<br /><br />This happens because the stack of 4 Great balls increases the index number of the item where TheZZAZZGlitch placed HM07 in the video, so you don&#039;t just get back the same item that you put in the PC.&nbsp; Also, using only 2 Great Balls increases the index number by 1 and using multiple stacks of Great Balls will increase the index number in the same manner.<br /><br />This can be helpful for getting stray items by finding base items that have an index number before theirs as you can swap out HM07 with other base items to mutate.&nbsp; This way you don&#039;t even lose the item you were initially working with.<br /><br />I don&#039;t know much assembly, but I know enough to understand the concepts behind how the glitch works.&nbsp; Given that 42 Fresh Water correspond to changing the ID number of the first Pokemon in your party, subsequently adding Fresh Water with move you one byte further into the Pokemon&#039;s data allowing you to overwrite things like moves by having 44 to 47 Fresh Waters or EXP by having 50 to 52.&nbsp; <br /><br />There&#039;s a simple list of the data structure here:<br />http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_structure_in_Generation_II<br /><br />An interesting way to use this is getting a level 100 by changing the EXP of a Pokemon and simply knocking out one wild Pokemon.&nbsp; I&#039;m pretty sure this takes 50 Fresh Water.<br /><br />So there&#039;s a rudimentary form of item mutation and also access to all the Pokemon&#039;s stats and their Attacks, EXP, Friendship etc.<br /><br />Oh, and a nice list of Pokemon, Moves, and Items by index number courtesy of TheZZAZZGlitch&#039;s video:<br />http://pastebin.com/raw/arPmsvYu


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=bestgoldglitche link=topic=6716.msg200730#msg200730 date=1468315566]<br />[quote author=camper link=topic=6716.msg190560#msg190560 date=1373561320]<br />Item cloning is possible with Pokemon cloning. Now we need to find a way to do item mutation.<br />[/quote]<br /><br />I&#039;ve been playing around with this glitch for a while now and recently found a way to produce basically any item.&nbsp; The process is basically the same as what TheZZAZZGlitch laid out in his video where he explained how to get Celebi.&nbsp; <br /><br />https://www.youtube.com/watch?v=SpfgOVfGVTo<br /><br />Basically, you place 43 Fresh Water in your PC instead of 42, and you&#039;ll jump to the item of the first Pokemon in your party instead of the ID number.&nbsp; Given the normal set up that would yield HM09 I think which can be sold for about 19000 Pokebucks...<br /><br />This happens because the stack of 4 Great balls increases the index number of the item where TheZZAZZGlitch placed HM07 in the video, so you don&#039;t just get back the same item that you put in the PC.&nbsp; Also, using only 2 Great Balls increases the index number by 1 and using multiple stacks of Great Balls will increase the index number in the same manner.<br /><br />This can be helpful for getting stray items by finding base items that have an index number before theirs as you can swap out HM07 with other base items to mutate.&nbsp; This way you don&#039;t even lose the item you were initially working with.<br /><br />I don&#039;t know much assembly, but I know enough to understand the concepts behind how the glitch works.&nbsp; Given that 42 Fresh Water correspond to changing the ID number of the first Pokemon in your party, subsequently adding Fresh Water with move you one byte further into the Pokemon&#039;s data allowing you to overwrite things like moves by having 44 to 47 Fresh Waters or EXP by having 50 to 52.&nbsp; <br /><br />There&#039;s a simple list of the data structure here:<br />http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_structure_in_Generation_II<br /><br />An interesting way to use this is getting a level 100 by changing the EXP of a Pokemon and simply knocking out one wild Pokemon.&nbsp; I&#039;m pretty sure this takes 50 Fresh Water.<br /><br />So there&#039;s a rudimentary form of item mutation and also access to all the Pokemon&#039;s stats and their Attacks, EXP, Friendship etc.<br /><br />Oh, and a nice list of Pokemon, Moves, and Items by index number courtesy of TheZZAZZGlitch&#039;s video:<br />http://pastebin.com/raw/arPmsvYu<br />[/quote]Really nice :9


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=7518.msg200728#msg200728 date=1468283001]<br />[quote author=Torchickens link=topic=7518.msg200727#msg200727 date=1468249704]<br />I think this may be related to the sound bank addresses C0EF, C0F0 becoming corrupted (corrupted by the decompression of the glitch PokÃ©mon&#039;s sprite). When experimenting with the &quot;stable unstable&quot; Missingno. trick (the first unstable Missingno. you encounter is believed to never freeze the game unless you encounter further), I noticed that a value of 01 would give a &quot;learned&quot;/&quot;trying to learn&quot; effect.<br />[/quote]<br />So you mean it&#039;s corrupted to a infinite 01 loop?<br />It corrupted the enemy Pokemon value?<br />[/quote]<br /><br />It can get changed to 01 but I don&#039;t know if it is an infinite loop, and if you put a halt to the message you may be able to return the sound banks to normal. The sprite decompression causes corruption of the memory, so one of the C0EF/C0F0 (sound bank) addresses may have been corrupted to 01.<br /><br />All tunes in the game use sound banks: 02 (overworld music), 08 (battle music) 1F (dungeon music) and 20 in English Yellow/28 in Japanese Yellow (special music). But bank 01 is invalid and can lead to the game executing the &quot;learned&quot;/&quot;trying to learn&quot; message for unknown reasons. When some people try the 0120EFC0 0120F0C0 019F5AD3 code to play the PokÃ©mon Yellow unused track, the nurse in the PokÃ©mon Center can disappear and it seems the cause is related to the sound bank being forced to 20 where there are limited valid sounds.<br /><br />I don&#039;t know if invalid sprites can corrupt the enemy PokÃ©mon, except possibly Missingno. in Japanese Yellow who can turn the battle into a Trainer battle if I remember correctly (but I may be wrong).


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7518.msg200732#msg200732 date=1468331951]<br />[quote author=TheUnReturned link=topic=7518.msg200728#msg200728 date=1468283001]<br />[quote author=Torchickens link=topic=7518.msg200727#msg200727 date=1468249704]<br />I think this may be related to the sound bank addresses C0EF, C0F0 becoming corrupted (corrupted by the decompression of the glitch PokÃ©mon&#039;s sprite). When experimenting with the &quot;stable unstable&quot; Missingno. trick (the first unstable Missingno. you encounter is believed to never freeze the game unless you encounter further), I noticed that a value of 01 would give a &quot;learned&quot;/&quot;trying to learn&quot; effect.<br />[/quote]<br />So you mean it&#039;s corrupted to a infinite 01 loop?<br />It corrupted the enemy Pokemon value?<br />[/quote]<br /><br />It can get changed to 01 but I don&#039;t know if it is an infinite loop, and if you put a halt to the message you may be able to return the sound banks to normal. The sprite decompression causes corruption of the memory, so one of the C0EF/C0F0 (sound bank) addresses may have been corrupted to 01.<br /><br />All tunes in the game use sound banks: 02 (overworld music), 08 (battle music) 1F (dungeon music) and 20 in English Yellow/28 in Japanese Yellow (special music). But bank 01 is invalid and can lead to the game executing the &quot;learned&quot;/&quot;trying to learn&quot; message for unknown reasons. When some people try the 0120EFC0 0120F0C0 019F5AD3 code to play the PokÃ©mon Yellow unused track, the nurse in the PokÃ©mon Center can disappear and it seems the cause is related to the sound bank being forced to 20 where there are limited valid sounds.<br /><br />I don&#039;t know if invalid sprites can corrupt the enemy PokÃ©mon, except possibly Missingno. in Japanese Yellow who can turn the battle into a Trainer battle if I remember correctly (but I may be wrong).<br />[/quote]<br />Just asking, is there&#039;s more invalid sound banks?


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  That&#039;s right. You can access 256 with the code 01xxEFC0, 01xxF0C0. I don&#039;t know if any are effectively duplicates, however.<br /><br />Sometimes these invalid sound banks will cause the game to freeze.


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7518.msg200735#msg200735 date=1468345414]<br />That&#039;s right. You can access 256 with the code 01xxEFC0, 01xxF0C0. I don&#039;t know if any are effectively duplicates, however.<br /><br />Sometimes these invalid sound banks will cause the game to freeze.<br />[/quote]<br />So in drc&#039;s case, most of the value, I think it&#039;s just a 01 loop and a crash...<br />Hmm<br />[quote author=drc link=topic=7518.msg200723#msg200723 date=1468171919]<br />It actually takes the back sprite from 0xFAC9, which is in RAM. It reads this, and draws too many bytes, corrupting some stuff, and then... I don&#039;t know.<br />[/quote]<br />I think there&#039;s something missing<br />What comes after 0xFAC9?


subject: Re: Glitch-Inspired Music
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This is wonderful music! :) You should publish this on Soundcloud or Youtube. I&#039;m sorry to hear circumstances are you can&#039;t continue at the moment.


subject: Re: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Crystal_ link=topic=7521.msg200638#msg200638 date=1467048541]<br />So I&#039;ve been looking into this glitch...<br />https://www.youtube.com/watch?v=I_JjAIvG9zA<br /><br />The thing is, there are a total of 11 sprites in the oak&#039;s lab before getting your first Pokemon: 2 Pokedex, Oak, Blue, 3 Pokeballs, a lady, 2 scientists, and yourself. That&#039;s one more than the number allowed to be displayed at once, as the OAM buffer can only hold data for 40 objects (fe00-fe9f) and each sprite is made of 4.<br /><br />There is a 10-half-block vertical separation between the two dexes and the two scientists though, meaning they should never be all displayed at once, EXCEPT when you are four half-blocks above the scientists and walk up, or when you are four half-blocks below the dexes and walk down. In these cases, parts of all four sprites are on screen as the background map scrolls during your movement.<br /><br />The issue comes from the clear unused OAM routine: https://github.com/pret/pokered/blob/2b2c6fe/engine/overworld/oam.asm#L147<br />If there are 11 sprites, hOAMBufferOffset is going to end up becoming $b0 given that PrepareOAMData is taking care of what would be a total of 44 objects ($00 to $af). Normally, it should be multiples of $10 from $00 through $a0. The game would then attempt to clear unused OAM data starting from what should be the last sprite in use, indicated by hOAMBufferOffset. If there are, say, 6 sprites on screen, every four bytes from $c360 to $c3a0 are set to $a0 in order to make all those sprites invisible in the wram sprite buffer (y coordinate of $a0 is just below the screen). If there are 11 sprites, however, every four bytes from $c3b0 through $c4a0 are going to become corrupted with $a0 because the game won&#039;t stop until the lower byte of the address equals $a0 (supposed to be the address of the last sprite when preceded by $c3). With the tilemap starting at $c3a0, this leads to the screen getting corrupted with character &quot;a&quot; every four tiles.<br /><br />Most of the times, however, the scientists are alrealdy invisible by the time the pokedexes show up, so there are never more than 9 sprites overlapping. But it&#039;s not always, given that the glitch pops up every once in a while, which leaves me wondering, what is the timing factor that leads to the pokedex sprites appearing when the scientists are still considered to be visible?<br /><br />Anyway, after that, some sprites seemingly at random became invisible, leaving only a total of five on screen, but I haven&#039;t really looked beyond that. So yeah, has anyone been able to figure out more than me about this mysterious glitch?<br /><br />EDIT: Figured out why the sprites disappear. If they are above one of the corrupted tiles, the tile will have a value higher than $60 (because they were corrupted with $a0), so the game thinks they are hidden by a text box: https://github.com/pret/pokered/blob/master/engine/overworld/movement.asm#L508<br />[/quote]<br />Yeah... it&#039;s really intresting<br />https://youtu.be/7IQVBi9azjU<br />I still do not get what&#039;s wrong though ._.


subject: Re: Glitch-Inspired Music
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  This&#039;ll be GCL exclusive, as it&#039;s written [i]for[/i] GCL members. :P<br />Can&#039;t have outsiders listening, can we?&nbsp; :XD:


