# smf_messages

subject: Re: English fossil conversion glitch (get absolutely any PokÃ©mon/glitch PokÃ©mon)
poster_name: PC4SH
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I know it&#039;s been a while since this has been posted but i&#039;ve been trying this to get index 202 PC4SH, and i&#039;m unable to encounter pokemon in grass after fixing fly locations, which means after i get to cerulean to rectify my name i can&#039;t get into a battle. to finish the glitch. any suggestions?<br />


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  For some reason, even though I haven&#039;t updated my 3DS, the exploit has stopped working for me. It seems to work as normal, but when I look in my box, the Pokemon isn&#039;t there. Could Nintendo have found some way to block the exploit without needing the update? Has this happened to anyone else? 


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7179.msg198491#msg198491 date=1430239796]<br />For some reason, even though I haven&#039;t updated my 3DS, the exploit has stopped working for me. It seems to work as normal, but when I look in my box, the Pokemon isn&#039;t there. Could Nintendo have found some way to block the exploit without needing the update? Has this happened to anyone else?<br />[/quote]<br /><br />Well, I just tried both with the QR for 2d2 you posted on the previous page, and a random pokÃ©mon with the latest PKHeX (which has the built in QR generator), and both worked. Seems to be something on your end...<br /><br />Did you use the 3DS browser for browsing recently, or it just happen all of sudden?


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pawny link=topic=7179.msg198492#msg198492 date=1430242578]<br />Did you use the 3DS browser for browsing recently, or it just happen all of sudden?<br />[/quote]<br /><br />I don&#039;t [i]think[/i] I&#039;ve been using it for browsing lately at least, but actually, I think I did forget to clear my cookies and history, since it&#039;s been a while since I&#039;ve used the exploit. So that might be it. I&#039;ll try it out later and see if that fixes it. 


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [img]http://36.media.tumblr.com/16c7689dc28eba348e8a0db1c09471e1/tumblr_nbvdm37lf31qgzn9po1_500.png[/img]


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So does Mewtwo being purchasable by the normies mean that it gets custom moves now? Or that they realise that was kind of stupid to nerf him and he isn&#039;t still mediocre?


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: bbbbbbbbba
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Just my two cents...<br /><br />[quote author=Quibz link=topic=36.msg198170#msg198170 date=1426449539]<br /><br />When you cut a tree down, it starts playing weird music that I don&#039;t think was in the original game. Maybe it was cut out but left in the programming, like the Oak battle? I don&#039;t know.<br /><br />[/quote]<br /><br />Or maybe the game interprets some other data as music data...<br /><br />[quote author=Quibz link=topic=36.msg198170#msg198170 date=1426449539]<br /><br />Also, if you leave the route, everything goes back to normal, but then it reactivates once you go back on the route.<br /><br />[/quote]<br /><br />The game has a separate script pointer for each route, which is why things may go unstable only in one route. <br /><br />[quote author=Quibz link=topic=36.msg198170#msg198170 date=1426449539]<br /><br />If you examine the merchandise in the poke mart, the ones that say, &quot;Wow! Tons of pokemon stuff!&quot; A bunch of glitch text will appear, but it will be almost all numbers with a few map tiles. After that, it will start a battle with a level 255 rhydon. Yeah... I have no idea why. It seems like too much to be a coincidence that it&#039;s the highest possible level and index number one, but I can&#039;t think of any reasons why that would happen.<br />[/quote]<br /><br />The game has a lot of FF&#039;s and 01&#039;s lying everywhere in the data. Pretty much every glitch team is some other data interpreted as team data, so yes, this is probably not a coincidence.


subject: Re: Save corruption-triggered Prevented Progress
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello,<br /><br />I recently wrote an article about save abuse for my website, and I&#039;ve been thinking about something you might know the answer to it. <br /><br />Let&#039;s say I wanna use the save abuse to get any item (like here : http://forums.glitchcity.info/index.php/topic,6472.msg198446.html#msg198446 )<br /><br />But I want to do this in yellow and not be stuck by the Prevented Progress Glitch. If I switch some other pokemons, can I set the seen/own dex to 1, in order to continue my game after the glitch is performed ?


subject: Odd Results
poster_name: PokeGlitchFanatic
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  After my extended absence, I am back with some peculiar glitch results.&nbsp; While using the cooltrainer move in Pokemon blue,&nbsp; depending on the location of where I use it. <br />Using it in the water outside of Cinnabar Island results in my game crashing extremely violently.&nbsp; Is this move affected by location,&nbsp; or is it completely random? 


subject: Re: Odd Results
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I felt that it would be best to explain this in detail; but I have highlighted some of the main points in purple. If you have any specific questions, feel free to ask.<br /><br />Location influences this, but [color=purple]the nature of the corruption when it happens is directly affected by the tile data on the screen when you open a menu such as the PokÃ©mon or item menu[/color]. When you open these menus, the game updates some screen tile data at CD81 onward with screen data as if you just had the start menu open (and no other menu). The glitch item 9F (hex:5E) will update the screen data too. <br /><br />This screen tile data affects the corruption, meaning that in PokÃ©mon Red and Blue opening a menu in certain places before entering battle allows you to have control over your results. In PokÃ©mon Yellow you sadly can&#039;t do this because the tile data is updated again when you enter battle.<br /><br />For example, the tile at the top-left corner of the screen (BGB coordinates y=00, x=00) affects CF5F. The next tile (BGB coordinates y=00,x=01) affects CF60. Jumping on ahead, the tile at y=06, x=01 affects CFD8 (the enemy PokÃ©mon in battle). You may know this address from the GameShark code 01xxD8CF that lets you obtain any PokÃ©mon.<br /><br />In other words, opening the PokÃ©mon, items, etc. menu from a certain place and then activating CoolTrainer in battle without opening another relevant menu allows you to get CoolTrainer corruptions you want if you know the identifiers of tiles on the screen and the addresses that they would corrupt. One trick is the ability to mutate the enemy PokÃ©mon into another species.<br /><br />There is another important detail though. To answer why a freeze happens, [color=purple]freezes normally happen when the saved screen data does not have a 0x50 tile within it (when the CoolTrainer corruption occurs which may take many tries; you can try again by scrolling through the fight menu or opening and closing it)[/color]. If there is no 0x50, the game will keep looking for a 0x50 from beyond the screen data and may never find one early enough. If so, the game will end up corrupting too much data and freeze.<br /><br />Additionally, unrelated freezes may happen after battle ends in Red and Blue (but these freezes do not occur in PokÃ©mon Yellow) when CoolTrainer corrupts the address CFC4 to an odd value (the tile at y=05 x=01 affects this). For unknown reasons, if the battle was in Diglett&#039;s Cave the freeze will not occur; so [color=purple]the player must often do CoolTrainer abuse in Diglett&#039;s Cave to avoid a freeze after battle.[/color]<br /><br />[color=purple]A 0x50 tile often look like the bottom-left corner of a bush 4x4 tile on the overworld tileset[/color]. [img]http://i4.minus.com/ibtP124N4TMldI.png[/img]<br /><br />This [url=http://hakuda2.web.fc2.com/wario/poke3/f3.html]page[/url] shows us other 4x4 tiles that have a 0x50 in them.<br /><br />Here is an image by TheZZAZZGlitch that shows us the tiles responsible for the enemy PokÃ©mon&#039;s level and species and where a 0x50 tile should be for CoolTrainer abuse (note that the 0x50 tile can be before the big rectangle below &quot;BLUE&quot; too; however, if it was before a certain tile (such as the one controlling the species), then you would not be able to corrupt the species/the relevant tile&#039;s &#039;corruption address&#039;.<br /><br />[img]http://i4.minus.com/ibw1X573SOYUPx.png[/img]<br /><br />You may want to watch [url=https://www.youtube.com/watch?v=Sst_5kAX2y4]TheZZAZZGlitch[/url]&#039;s video about catching PokÃ©mon with CoolTrainer other than those normally available by only opening the PokÃ©mon menu from within a battle (Missingno. and Horsea, [url=https://www.youtube.com/watch?v=aqy9QSbn1to]others[/url] by manipulating a PokÃ©mon name character on the screen at y=06, x=01).


subject: 0 maximum HP glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I came across an interesting bug.<br /><br />In Red, Blue, Yellow as well as Gold, Silver, Crystal, if a PokÃ©mon&#039;s maximum HP is 0 but has at least 1 current HP; then the game will often lock-up, presumably when it tries to update the HP bar. I suspect it is another divide by zero problem akin the Psywave and 95h, FFh experience group (Yellow&#039;s hex:CA and Yellow&#039;s 4(h4? hex:ED have them respectively) glitches.<br /><br />The game will lock up:<br /><br />If the user&#039;s PokÃ©mon:<br />*After &quot;Wild (POKÃ©MON) appeared!&quot; even if the PokÃ©mon isn&#039;t in the first position.<br />*After &quot;Go! (x)&quot; if the player encountered a Trainer and the PokÃ©mon is in the first position.<br />*After opening up the party.<br />*After switching the relevant PokÃ©mon.<br /><br />If the opponent:<br />*After &quot;Wild (POKÃ©MON) appeared!&quot;.<br />*After selecting a move.<br />*After closing Fight, Item or PkMn. If PkMn is closed when the lock up occurs the party&#039;s menu sprites become invisible. <br /><br />It should be possible to trigger this glitch with arbitrary code execution, and it may be possible to give the opponent a maximum of 0 HP with CoolTrainer corruption.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  [b]Pomeg Glitch Corruption :[/b]<br /><br />Pomeg Glitch RAM Corruption is about the [i]Party Pokemon Selection Pointer[/i] that selects blocks of RAM data that isn&#039;t Party Pokemon data, and corrupts them because the checksum performed on this data gives an incorrect result.<br />A Party Pokemon data is a [i]block of 25 double-words[/i].<br />The location of the double-words the Selection Pointer will read with Pomeg Glitch are fix.<br />In these blocks, you have [i]7 important areas[/i] for Pomeg Glitch.<br /><br />- The first ones are [i]for the Pokemon PID and TID[/i]. <br />These values determine the encryption of the 4 Pokemon substructures (crypted data = raw data xor PID xor TID, in double-words).<br />The PID also determines the order of these 4 sub structures (3 double-words each).<br /><br />- You have then a byte that seems to be only used for the [i]Legit/Bad Egg state[/i], between the Pokemon name and Trainer name.<br />This byte is usually at 0x02, and is turned into 0x07 if the Pokemon is a Bad Egg (to prevent the Egg from hatching, and giving it the name &quot;Bad Egg&quot;). This is performed by [i]setting bits 0 and 2 of the byte to 1[/i] (0x05).<br />This induces what I usually call the [i]0x05 corruption[/i], as in general you can see the 0x05 value appearing, even if a value can only gain 0x04 or 0x01 or nothing due to this corruption.<br />With Pokemon Corruption, this corruption has no use at all. Even worse than that, the 0x05 corruption is the main thing that can prevent a Pokemon corruption from working.<br /><br />- And you have 4 bytes that represent the [i]4 possible locations of the Pokemon Egg state[/i] (hatched/ non-hatched) in the Growth substructure.<br />The bit managing the Egg State is [i]bit 6 (0x40)[/i] of that byte.<br />Since this byte is in the data substructure, the location of the corruption will depend on the [i]PID value modulo 24[/i].<br />And the effect of that corruption ([i]forcing the bit to 1 or 0[/i]) will depend of the PID xor TID result, (the value of bit 6 of their leftmost byte, to be accurate) since this corruption is applied to the &quot;crypted&quot; substructure data.<br />If PID and TID both have the same bit 6 value (on their leftmost byte), the corruption forces a bit to 1 (sets 0x40).<br />If PID and TID don&#039;t have the same bit 6 value (on their leftmost byte), the corruption forces a bit to 0 (unsets 0x40).<br /><br />I generally call this corruption the 0x40 corruption to mention it faster.<br />The 0x40 corruption has 4 different locations related to the 0x05 corruption (who is always on the same byte on a given 25 double-words block), and can do 2 different things, all depending on the PID and TID values (or what the game wants to interprete as so).<br /><br /><br />[b]Screenshot :[/b]<br />[img]http://i.imgur.com/fzKw2Zk.png[/img]<br />Here&#039;s the location of the 7 interesting zones in a Party Pokemon data.<br />I bordered the 25 double-words blocks to distinguish them a bit better.<br />In blue (11111 and 2222), you have the PID and the TID (in that order).<br />In green, just below the PID, you have the 0x05 Corruption location.<br />In yellow, you have the 0x40 Corruption locations. They are all separated by 2 double-words.<br /><br /><br /><br />[b]Pokemon Corruption :[/b]<br />In Pokemon Corruption, the goal is to abuse the anti-cheating measure that moves the adresses of many RAM values in order to have a [b]PC Pokemon PID that is affected by a 0x40 Corruption[/b].<br />We want the PID to be corrupted because this affects the Pokemon substructures order, and allow us to manipulate values like species, item, xp, ogirins, IV, by knowing how its substructures order will be changed (ex : Attacks will be read on EVs).<br />But to make this work, the Pokemon checksum can&#039;t change, or it will turn into a Bad Egg.<br /><br /><br />[b]Bypassing the Checksum :[/b]<br />The checksum decrypts all the substrucutres data, cuts the double-words in words and adds them. It then stores the [i]4 first characters[/i] of the sum (they could have stored the whole sum, but thanks for us, they didn&#039;t).<br /><br />Since we&#039;re changing a value on the PID, the difference between corrupted PID and normal PID will be present 4*3 = 12 times (4 substructures containing 3 double-words), in the [b]&quot;general case&quot;[/b].<br />Since checksum adds words, 0x05 and 0x40 Corruption will give differences of 0x0500 (or 0x0400,0x0100) and 0x4000 (or 0x0000 if nothing happens).<br />You can see that 0x4000 is the [i]only value that won&#039;t change the checksum[/i] result since 0xC * 0x4000 = 0x3 0000.<br />For the 0x05 Corruption, the checksum will be screwed, and this will always result in a Bad Egg, which is why I said it wasn&#039;t useable for Pokemon Corruption.<br /><br />If the PC Pokemon PID is corrupted and its checksum stays valid, the Pokemon Corruption will be working.<br />Since this works with the 0x40 Corruption, the [i]Egg State value of the Pokemon is switched[/i], and so does its hatched/non-hatched state.<br />Since its PID was corrupted, the [i]order of its substructures is changed[/i], leading to interesting results.<br /><br /><br />[b]Double Corruption :[/b]<br /> But you can also [i]do the same thing with the Pokemon TID[/i], who will have the same checksum issue as PID (since they are both involved in checksum), and who will bring the same effects minus the substructures order.<br />It may not seem useful to corrupt TID, but it is.<br />Because if you do a single PID corruption, you&#039;ll get an Egg of your desired Pokemon.<br />Hatching the Egg will remove its EVs, Item, Ribbons, Contest Stats, and set its Lv to 5.<br />Also, because of the 0x40 Corruption only being performed once, there are some 0x40 &quot;values&quot; that still affect the Pokemon data (like a move being move 0x4000 instead of 0x0000, or item 0x4001 instead of 0x0001 if you wanted your Egg to hold a Master Ball).<br />The hatching is also risky for Glitch Pokemon, as their hatching sequence can freeze (I don&#039;t know if it&#039;s related to the Glitch Pokemon sprite, the Glitch Pokemon name, a part of RNG, or all of that).<br /><br /><br />If you corrupt the Pokemon PID and then its TID, you&#039;ll have the substructures order shift, on a Pokemon that isn&#039;t in an Egg (so no hatching animation + Exp/Item/EVs/Contest Stats / Ribbons/Met Location/Met Lv/Met Version/Met Trainer kept), and you don&#039;t have the &quot;0x4000 0000 leftovers&quot; on the substructure data from the 0x40 Corruption anymore, since both PID and TID had their bit 6 of leftmost byte value switched.<br />Thus, you [i]end up with the exact Pokemon you wanted[/i], without any issue even if you were to want a Glitch Pokemon/Move.<br /><br />This is Double Corruption, since you corrupt both PID and TID. It was brought by someone on that topic (I don&#039;t remember who, nor the page) who I give my thanks, as this method is really useful.<br /><br /><br />[b]Bypassing checksum (more detail) :[/b]<br /> But, there are other tiny things to deal with if you want to be sure to exactly have what you wanted.<br />For checksum, I mentioned a &quot;general case&quot; where everything goes right, but [i]2 things can screw up[/i] the checksum on a 0x40 Corruption.<br /><br /> The [b]first thing[/b] is to really have [i]0x4000 added or subtracted[/i] 12 times (or a [i]number of times that is a multiple of 4[/i]).<br />[b]For example[/b], if your Pokemon was caught in a Nest/Repeat/Timer/Luxury/Premier Ball, one of its non-crypted substructure double-word will have its bit 6 of leftmost byte set to 1 (0x4000 0000 will be there).<br />The other bit 6 of leftmost bytes for double-words of substructures concern : Item (0x4000), Moves (0x4000), Speed Evs (0x40), Beauty (0x40), Feel (0x40), Move 4 PPs (0x40), Egg State, a Special Ribbon, Exp (0x4000 0000).<br /><br />So unless your Pokemon has a good amount of Speed EVs or Contest Stats, or a Move 4 with 64 Pps, only 1 double-word of its substructure will have its bit 6 of leftmost byte set to 1.<br />This means that the checksum calculation after its PID corruption will differ by 11 - 1 = 10 times 0x4000 = 0x2 8000, since for 11 double-words, 0x4000 will be added, whereas it will be subtracted for the double-word containing Origins info.<br />And you see that the checksum difference isn&#039;t a multiple of 0x1 0000, so the checksum will be invalid, and the corruption won&#039;t work.<br />[u]Thus, for Pokemon Corruption, I ask to people to not have caught their Pokemon with a Nest/Repeat/Timer/Luxury/Premier Ball, nor have a Move 4 with 64 PPs, nor have between 0x40-0x7F or 0xC0-0xFF (64-127 or 192-255) in Speed EVs, Beauty, Feel.[/u]<br /><br />Since some people were catching their Pokemon with a Repeat Ball (or another forbidden Ball), and since they were only giving them HP and Atk EVs for Species Corruption, they weren&#039;t able to have a working corruption.<br /><br />If you want a [i]really specific specific[/i] corruption (on certain cases), you can [i]set bit 6 of leftmost byte of 2 double-words[/i] to 1 in order to have a checksum difference that won&#039;t be seen, since you&#039;ll have 8 times 0x4000, (8 is a multiple of 4, and 4*0x4000 = 0x1 0000), but don&#039;t do that for basic corruptions, that would only make the preparations more complex for nothing.<br /><br /><br />[b]Corruption Initiator :[/b]<br />&nbsp; The [b]second thing[/b] is the 0x05 Corruption from the 25 double-word block below.<br />Since everything happens in 25-double words blocks, each 0x40 Corruption is between 0x05 corruptions.<br />Here, we&#039;re seeing the 0x05 corruptions relatively to the 0x40 one, since we want to have the 0x40 Corruption on the PC Pokemon PID.<br />Again, we have 4 different locations for that 0x05 corruption (when 0x40 is on PC Poke PID) :<br /> - On 1st double-word of 2nd substructure<br /> - On 1st double-word of 3rd substructure<br /> - On 1st double-word of 4th substructure<br /> - On PID of the PC Pokemon below<br />[i]3 of them are a potential threat[/i] (1/4 chance that the double-word won&#039;t be affected by the 0x05 Corruption), and 1 is completely safe.<br /><br />Thus, we&#039;re totally going for that 4th location of 0x05 Corruption (when 0x40 is on PC Poke PID).<br />The case where the 0x40 Corruption can be on the PC Pokemon PID, and where the 0x05 Corruption will affect the PC Pokemon below is when the values that the Selection Pointer use as &quot;PID&quot; and &quot;TID&quot; are double-words 1 and 2 of substructure nÂ°2 of the Pokemon above the PC Pokemon we want to corrupt.<br />That&#039;s because the 0x05 Corruption is fix, as well as the &quot;PID&quot; and &quot;TID&quot;, and that it&#039;s the 0x40 that has 4 different locations.<br /><br />Thus, we will need the values of the 2 mentioned double-words to have specific values in order to give a good 0x40 Corruption location, as well as a 0x40 set or unset (Since we&#039;re doing 0x40 on a Pokemon PID, only the set or the unset corruption will do something, so this has to be manipulated too to fit for every Pokemon).<br /><br />And, since Double Corruption is also a thing, we can [i]do the same thing for the PC Pokemon TID[/i].<br />The double-words that need specific values for a PC Pokemon TID 0x40 Corruption are double-words 2 and 3 of substructure nÂ°2 of the Pokemon above.<br />By gathering both cases, we need to have a [i]Pokemon with a specific substructure nÂ°2[/i].<br /><br />These values are made on a Pokemon I call &quot;[u]corruption Initiator[/u]&quot;, as it&#039;s purpose is only to be put before the Pokemon you want to corrupt in order to ensure that a good corruption can happen on that Pokemon.<br /><br />With the values wanted there, I even call the Pokemon a &quot;perfect initiator&quot;, as it ensures you that you can corrupt any Pokemon you want (modulo tiny things to avoid).<br />Since we will need the 0x40 set and unset corruptions for both PID and TID, we&#039;ll [i]need 2 Corruption Initiators[/i], so we&#039;ll be sure that any Pokemon will be corrupted with one of them. (One Initiator will do the 0x40 set on PID and TID, and the other the 0x40 unset on PID and TID).<br /><br />[b]For the 0x40 set Corruption[/b], the substructure nÂ°2 of the initiator must verify :<br />- double-words 1,2 and 3 have their bit 6 of leftmost byte equal (0,0,0 or 1,1,1 pattern).<br />- double-words 1 and 2 have a specific congruence modulo 24. (I think it&#039;s 18,19,20,21,22,23, but I&#039;m not sure as I always do it by trial and error since there are 6 working values modulo 24).<br /><br />[b]For the 0x40 unset Corruption[/b], the substructure nÂ°2 of the initiator must verify :<br />- double-words 1,2 and 3 have their bit 6 of their leftmost byte forming a 1,0,1 or 0,1,0 pattern.<br />- double-words 1 and 2 have a specific congruence modulo 24. (I think it&#039;s 18,19,20,21,22,23, but I&#039;m not sure as I always do it by trial and error since there are 6 working values modulo 24).<br /><br /><br />[b]Why using an Initiator works :[/b]<br />This is a tiny EDIT, but I forgot to develop about that.<br />The anti-cheating measure that moves the RAM adresses of most values each time you open your bag, make a fight, change locations,... can move a designed value on 32 adresses (they are adjacent).<br /><br /> Thus, if you put in Box 1 your Corruption Initiator followed by a Pokemon to corrupt, you only have to try using Pomeg Glitch until the data of substructure nÂ°2 of the Corruption Initiator ends up on the adress of a &quot;PID&quot; and &quot;TID&quot; for the Party Pokemon Selection Pointer (these adresses are fix). <br /> When this will happen, the 0x40 corruption will be forced to happen on the PID of the PC Pokemon to corrupt (with the right set/unset type), and the 0x05 Corruption below will fall right below the PC Pokemon to corrupt data.<br /> Since the Party Pokemon data is a block of 25 double-words, there&#039;s always a certain movement of the anti-cheating measure that will put up the substructure nÂ°2 data on one of there &quot;PID&quot; and &quot;TID&quot; adresses (as the substructure nÂ°2 data can be placed on 32 different consecutive locations).<br /><br /><br />[b]Potential Initiators :[/b]<br />The only Pokemon who have substructures values that we know are Empty Slot and in-game trades Pokemon.<br /><br />Empty Slot will only give a 0x40 set Corruption, and when 0x40 is on a PC Pokemon PID, the 0x05 Corruption is on its 1st double-word of 2nd substructure. <br />Thus, leaving an empty slot before the PC Pokemon won&#039;t work well at all (half of your Pokemon won&#039;t have their PID corrupted, and 1/4 of them will suffer from the 0x05 Corruption, so only 1/8 of your PC Pokemon &quot;could&quot; work).<br /><br />You have 4 in-game trades Pokemon in Emerald :<br />Seedot : substructure order : EGAM -&gt; GMAE (the second substructure order is the one after a 0x40 PID Corruption)<br />Plusle : substructure order : EAMG -&gt; AGME<br />Horsea : substructure order : AGME -&gt; MEAG<br />Meowth : substructure order : MGEA -&gt; AMEG<br /><br /> -[i] Growth[/i] can be manipulated for congruence modulo 24, but since it contains Experience, it would be hard to have a general procedure to do that on console (since the Lv of these Pokemon can be drastically different).<br />The 0x40 unset Corruption couldn&#039;t be done. (there&#039;s one of the 3 leftmost bytes you can&#039;t manipulate, and you can&#039;t have 0x4XXX XXXX Exp)<br /> - [i]Attacks [/i]can be manipulated for congruence modulo 24, but the 0x40 unset Corruption couldn&#039;t be done. (you&#039;d need a 0x4XXX Glitch Move).<br /> - [i]Growth[/i] can&#039;t be manipulated for congruence modulo 24 nor 0x40 unset Corruption.<br /> - [i]EVs [/i]and Contest stats can be manipulated for both congruence modulo 24 and 0x40 set/unset corruptions.<br /><br />But as you can see, none of the traded Pokemon have EVs as their substructure nÂ°2.<br />[b]However[/b], a 0x40 corrupted Horsea has EVs as substructure nÂ°2.<br /><br />To perform a 0x40 Corruption on Horsea, I use the Seedot as a Corruption initiator.<br />Seedot won&#039;t be a perfect initiator, but with slight changes on him and Horsea, he&#039;ll work perfectly.<br />Here&#039;s the setup :<br /><br /><br />[b]Caterpie the Perfect Initiator :[/b]<br />Items :<br />Pokeblocks with 6 Chesto Berries at Lilycove with the old man. They must be Lv 12 Blue Pokeblocks, with 22-23 in Feel.<br />26 Hondew, and 26 Grepa Berries.<br />At least 13 Pomeg Berries.<br />Other Pomeg, Kelpsy,Qualot, Hondew, Grepa, Tamato Berries<br />5 Carbos, 5 Calcium, at least 2 HP Up.<br />TM Protect (sold at Lilycove).<br />Fluffy Tails.<br /><br />- Get the in-game traded Seedot.<br />- Get the in-game traded Horsea. He must have less than 65.536 Exp points. (Lv 40 or lower)<br />Horsea and Seedot (and any other Pokemon you&#039;ll train for double corruption) must not catch Pokerus during their training.<br />- If Seedot and Horsea already fought a bit and gained some EVs, use the Pomeg, Kelpsy, Hondew, Grepa, Tamato Berries to put them back at 0 EVs.<br />- Clone them both to have a safe copy.<br />- Give 1 Carbos and 3 Calcium to Seedot. (Now Seedot is ready)<br />- Give 1 HP Up to Horsea. (He&#039;ll transform into a Caterpie)<br />- Give 1 Carbos to Horsea, and make him fight 3 Zigzagoon (For 13 Speed EVs that will absorb the 0x05 Corruption)<br />- Change Horsea Moves to Waterfall, Protect, Surf, --(Fr)/Return(US). (Having a specific 4th Move is really important)<br />- Save and clone them 6 times. (1 copy in a safe box and 5 copies for the next steps).<br />- Place the 5 Seedots and Horsea in Box1 or 2 with a Seedot-Horsea-Seedot-Horsea-...-Horsea pattern (a block of 10 Pokemon + Seedot before Horsea as Seedot is the initiator for Horsea&#039;s corruption).<br /><br />- Save, and perform Pomeg Glitch (this is why Fluffy Tails is mentioned) to corrupt the Horsea. (you have 6-7/32 chances to corrupt Horsea&#039;s TID).<br />- Once one of the Horsea became an Egg,&nbsp; check its summary.<br />If the Egg doesn&#039;t have Pokerus and isn&#039;t about to hatch, keep the Egg and save. (its TID was corrupted)<br />If the Egg has Pokerus, reset and redo the corruption. (PID was corrupted)<br />(the TID corruption being first is really important because it won&#039;t screw up the 4th Move PPs and allw you to make a fast second corruption)<br />- Save, clone Seedot and Horsea&#039;s Egg 5 more time, and display them in the same pattern as earlier.<br /><br />- Save, and perform Pomeg Glitch again to corrupt an Horsea&#039;s Egg. (here it&#039;s 6-7/32 chance to get it, as you really can&#039;t move that Egg).<br />- Once a Egg became a Caterpie, save.<br />- Give him Pomeg, Hondew, and Grepa Berries to put its EVs back at 0. (they come from Horsea species + Exp since EVs are read on Growth)<br />- Give him 2 Carbos and 2 Calcium, and save. (Here it is, the first perfect initiator)<br />- Clone the Caterpie 2-3 times. (at least one copy in a safe box)<br />- Give the 6 Blue Pokeblocks to another clone (72=0x48 Beauty, 138=0x8A Feel), and give that clone a Heart marking. (here comes the second perfect initiator, the heart marking allowing you to distinguish both of them easily).<br />- Save, and clone these 2 Caterpies (marked and unmarked) a dozen of times.<br /><br /><br />[b]Using Caterpies :[/b]<br />- Now, every time you want to perform a Pokemon Corruption, once you&#039;ve prepared your Pokemon, clone it 10 times.<br />Place 5 clones with a Caterpie before each (Caterpie-clone-....-clone chain), and place the 5 remaining clones with a Marked Caterpie before each (M Caterpie-clone-...-clone chain). (if you knew beforehand what type of Caterpie would work with this Pokemon, you can only place this very type)<br />- Then, save and perform Pomeg Glitch to corrupt PC Pokemon, and if your Pokemon doesn&#039;t have the slight issues mentioned earlier (Balls, Beauty, Feel, Move 4 PPs,Item, Move2,....), you&#039;ll be sure to have 6 or 7/32 chances to corrupt the PID of one of your clones (and same chances for its TID).<br />- And if you want to go for a Double Corruption (because it&#039;s a very strong and useful corruption), you&#039;ll need to know beforehand if your TID can be corrupted with a 0x40 set or unset Corruption, as well as if your Pokemon&#039;s PID, because once a clone will turn into an Egg, you&#039;ll need to know what type of Caterpie you need to place before the Egg to perform the second corruption. (Remember to never take the Egg with the hand, or reset if you do so)<br />You can also try both of them, but since the second corruption only has a 1/32 working chance, this could be longer.<br /><br />- If you test your Pokemon beforehand to know what type of Caterpie corrupts him well, you can give a mark to that Pokemon to easily remember that (and also mark the Pokemon to distinguish its Corruption type).<br /><br /><br />[b]Caterpie data screenshot :[/b]<br />[img]http://i.imgur.com/UqmUfje.png[/img]<br /> The orange upper part is Caterpie&#039;s data. I cut it to directly start at its substructure nÂ°2 data.<br />Below Caterpie, you have the traded Horsea, who had its PID corrupted (0x4000 007F instead of 0x0000 007F, and who became an Egg. The part I circled is Horsea&#039;s data as a PC Pokemon (20 double-words only).<br /> In green, you have the 3 double-words of substructure nÂ°2.<br />The 2 first double-words are equal to 18 and 22 mod 24, and the Bit 6 of the leftmost byte of the 3 double-words has a 0,0,0 pattern (none of them have that bit set to 1), so we&#039;ll have a 0x40 set corruption that will perfectly work.<br /> And in Blue, you have the locations of the 0x05 and 0x40 Corruptions.<br />When one 0x40 fell on Horsea&#039;s PID, you have the 0x05 above on Caterpie&#039;s data, and the 0x05 below right below Horsea&#039;s data, showing that Horsea was corrupted well.<br /><br /><br /><br />[b]Caterpie file :[/b]<br />If you&#039;re on VBA, here&#039;s a .dmp file of Seedot + Horsea untouched + both Caterpies + 0x288A Glitch Pokemon to make easy clones : http://www.petit-fichier.fr/2015/05/02/horseaseedotcartepies0x288a/<br />I made a video on fast cloning before : http://www.youtube.com/watch?v=I8Mio5cA9fs<br />(RAM adresses for PC Pokemon are below 0x0202987C on Fr/US Emerald)<br /><br />The Marked Caterpie doesn&#039;t have the same Feel as the one described there, as the one I did is older, and I had a flaw for the Feel value, so I had to give him a Yellow Pokeblock to increase it over 0x7F.<br /><br />[b]Pomeg Glitch Lua Script :[/b]<br /> - Since I&#039;m there, here&#039;s also the link of the .lua script I&#039;m using to have useful information on PC/Party/Wild Pokemon on Emerald :<br />http://www.petit-fichier.fr/2015/05/02/emer-pomeg-glitch/<br />It&#039;s untranslated, but there&#039;s only a little bit of text (apart from the Pokemon moves and natures), and I think it&#039;s easy to understand who does what.<br />This script gives EVs, Contest stats, Moves, PPs, PID, TID, IVs, Nature, HP, Item, Pokerus, Shinyness, PID mod 24, obedience (if Mew or Deoxys), and substructure order (now and after a 0x40 Corruption) of a Pokemon by holding it in the PC or seeing its summary. <br />When you have a glitch Pokemon, Bad Egg, or Glitch Moves, it&#039;s always nice to have a quick look at the data without freezing the game.<br />(for the substructure order, E=EVs, A=Attack, C=Croissance=Growth, D=Divers=Miscellanous)<br /><br /><br /><br />


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Great research, thanks for sharing this Metarkai. 6-7/32 chance to get your EVs&gt;species corruption(?). That sounds much better. I&#039;ll try to get the Caterpie perfect initiator. Thanks for teaching us about fast cloning too.<br /><br />Is 0x2600 a fast clone glitch PokÃ©mon on English Emerald too? If not, do you know of a fast clone glitch PokÃ©mon on English Emerald?<br /><br />Edit: Got fast cloning to work with 0x2600 in the English version.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, that was something I should have written quite some time ago.<br />The 6-7 chances come from the 5 clones of the Pokemon you want to Corrupt.<br />As the Party Pokemon Selection Pointer select blocks of 25 double-words, and as PC Pokemon are stored in blocks of 20 double-words, with the initiator-Poke-initiator-Poke-...-Poke setup, you&#039;ll have a Corruption pattern that is periodic every 5 Pokemon.<br />And each of these 5 Corruption will also be different, so that makes at least 5/32 chances to have one Pokemon that has its PID corrupted (same for TID).<br />And, since the DMA can move a RAM double-word on 32 different consecutive adresses, if you take a certain double-word, you have either 1 or 2 positions of that double-word that will induce a good Corruption.<br />And with 5 clones, you have either 1 or 2 of them that will have 2/32 chances to be well corrupted, and the working corruptions are all with different RAM positionings from DMA, so you can sum all the cases to have a 6-7/32 total chance.<br /><br />A lot of Glitch Pokemon can do fast cloning, as they mostly need to have a long name, but a large majority of them will generate a Bad Egg in the way.<br />0x288A has the specificity to generate a Bad Egg of 0x0000 that you can release, so it&#039;s easier to clone with it.<br />There&#039;s a setup I randomly fell on after the video to not generate any Bad Egg, which is the following :<br />- Open PC with Move Pokemon.<br />- Go over the Glitch Pokemon.<br />- Open your party, grab a Pokemon, and deposit it right after that (leave him in the party). (this changes the glitched data stored for &quot;grabbed Pokemon&quot; into the data of a normal Pokemon)<br />- Go over the Pokemon you want to clone without going again over the Glitch Pokemon.<br />- Try to grab the Pokemon once, then trade the &quot;invisible&quot; Pokemon the hand grabbed with the Pokemon you wanted to clone. (the &quot;invisible Pokemon&quot; being the party Pokemon you grabbed earlier, so you&#039;ll be able to release it) (swapping Pokemon refreshed the &quot;grabbed Pkmn&quot; data)<br />- Deposit the Pokemon you wanted to clone elsewhere.<br />- Try to grab that Pokemon again, and deposit the &quot;invisible Pokemon&quot; on an empty PC slot. (now that&#039;s a clone of the Pokemon you want to clone)<br />- Repeat the last step until you&#039;ve got enough clones.<br /><br />The only difference with the video is that you go and grab a party Pokemon to change the &quot;grabbed Pokemon&quot; data, as for a certain reason, you can grab Party Pokemon without any issue, but not PC Pokemon.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Oh, I wasn&#039;t aware. It&#039;s the first time I&#039;ve seen it though and you post clear steps. :)<br /><br />I have made two VBMs for VBA-RR v24 svn422 ([url=https://code.google.com/p/vba-rerecording/downloads/detail?name=vba-v24m-svn-r422.7z&amp;can=2&amp;q=]this emulator I think[/url]). Please check them.<br /><br />In my first VBM I do all of what you said up to obtaining perfect initiator Caterpie clones (marked [fed PokÃ©blocks] and unmarked) and cloning them. I had good luck with getting the initial Horsea Egg; a sign that Seedot initator was working(?). It took a while for me to get the perfect initiator Caterpie; but I am satisfied that I did my first direct Egg&gt;PokÃ©mon conversion.<br /><br />Question 1: Though you don&#039;t regard Seedot as a &quot;perfect initiator&quot;, if I gave the Horsea something other than 10 HP EVs could I use that to get PokÃ©mon other than Caterpie? I have great luck with Seedot initiator, I hope it wasn&#039;t just me being particularly lucky though.<br /><br />For my second VBM I used A-Save to prepare a Deoxys Horsea (1 Attack, 154 HP) and cloned it 10 times. I arranged my PokÃ©mon in box 2 in the unmarked Caterpie clone&gt;Seasor (x5) and marked Caterpie clone&gt;Seasor (x5).<br /><br />I tried having those PokÃ©mon in order from box 1 but I actually didn&#039;t have much luck getting normal Eggs. However, when leaving three spaces before the first Caterpie I got a Deoxys Egg after only a few tries.<br /><br />[img]http://i.minus.com/ibpZzX3Hfzph2j.png[/img]<br /><br />Question 2: Was I doing everything correctly (in the VBM files) to maximize my chances? As I don&#039;t have full technical knowledge of what I&#039;m doing yet I&#039;m not sure.<br /><br />Question 3: Did I do a bad thing by leaving three spaces?<br /><br />Thanks in advance.<br /><br />Links to my VBM files:<br />Movie 1 - https://mega.co.nz/#!M51hnJ4B!BM2kXlMmw2hYNUjjadAhCosZ9eVrxNDrySHzj3Q0u5U<br />Movie 2 - https://mega.co.nz/#!V9FHHB6K!7dtW9dr7woG-HQMWCJdsyYC9sJw-t8bCA3HWXfy-Vrk


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  1) Yeah, the 10 HP Ev is just there to not have 0 HP &amp; Atk EVs so that Horsea doesn&#039;t turn into 0x0000 which is considered as a blank space (you can&#039;t grab him nor see him after the corruption), and it&#039;s the first easy to get EV amount that came to my mind as I preferred using items than fights.<br /><br />As long as you prepare the Corrupted Pokemon well (the last phase with specific EVs and Beauty), things will be ok.<br /><br /><br />2) The spaces you leave before the first Caterpie in Box 1 or 2 don&#039;t count.<br />You just need to have them placed in consecutively between Box 1 Slot 1 and Box 2 Slot 24, so that they can be corrupted with 5 clones each suffering a different corruption.<br />You could do other placements, like Caterpie - clone - space, which wouldn&#039;t change anything (since we&#039;re dealing with events that have a period of 5, the lenght of our Pokemon sequence can be 2,3 or 4 (or higher), that won&#039;t change the periodicity of the effects).<br />Apart from that, since I suppose that the Caterpie were finely made, and since the Horsea has the right EVs, the pattern and things should be working.<br /><br />Also, certain 3rd gen save editors can change the PID of your Pokemon since they don&#039;t really care about it (as long as it gives nature, gender and shinyness), so I don&#039;t know if A-save also does this, and if that preserves the substructure order or not.<br />This could be a hindrance regarding the Corruption type of your Pokemon that could change if you modify its EVs/Moves/... with a save editor, and I don&#039;t really have info about that as I&#039;m manually editing the stats of my Pokemon with Memory Viewer to skip some trainings.<br />EDIT : Apparently, A-save doesn&#039;t do that.<br /><br /><br />For the Double Corruption :<br />Once the preparations are done, the corruption in itself is just about the luck to have a good RAM positioning.<br />A tiny saddening thing is that on French Emerald versions, you can (most of the time) grab and clone the Eggs after the first corruption (or if the Pokemon TID was corrupted), as Glitch Move 0x4000 has a PP amount with its bit 6 set to 1, allowing you to keep high success chance for the second corruption phase.<br />In US Emerald, 0x4000 doesn&#039;t have a convenient amount of PPs to do that.<br />But you can find moves ID who will become convenient Glitch Moves (the PP byte has its Bit 6 set to 1) after the Move ID xor 0x4000 corruption (in general with the TID corruption as the PID corruption will nearly always swap the Attacks substructure because it&#039;s the best to manipulate with Smeargle) and do the same thing (being allowed to grab and clone the Egg).<br />However, I don&#039;t have a tool to see the properties of Glitch Moves on US Emerald (I have one for FR Emerald), but with manual corruptions (you change the TID with Memory Viewer) and my lua script, or Sketch + PP amount adress for the leading Poke during fights, you should be able to see what move Horsea (or another Pokemon you would use for Corruptions) could learn to allow you to go faster on the second corruption.<br /><br /><br />About the .vbm :<br />I watched the .vbm (that was my first time seeing ones, these things are so nice !), and the whole thing was well made.<br />Thanks to voltage, you can now skip the long Swampert poisoning phases (for me that was Banette using Curse with an odd amount of HP) with the Decaswitch.<br /> - You just have to get an Invisible Bad Egg from a Pokemon Corruption (that&#039;s a Decamark Bad Egg), and with a precise selection, you can switch this Invisible Bad Egg with your last alive Party Pokemon. (I didn&#039;t write the exact procedure, but it&#039;s like grabbing and depositing a PC Pokemon, then grabbing the invisible Bad Egg and switching it with the Party Pokemon, but that may not be exactly that so you might have to try out a few times before the game will alow you to switch these Pokemon).<br /><br />The values for Caterpie are the good ones (1400B4B2 0000B4A6 000.... for 2nd substructure on first Caterpie, and 1400B4B2 4800B4A6 8A0... for 2nd substructure on Marked Caterpie).<br /><br />But yeah, you did the good things to be sure that you have a chance that the Pomeg Corruption will work, and have great chances of success.<br /><br />About Deoxys Obedience :<br />Also, Deoxys isn&#039;t obedient and couldn&#039;t have been so, because by corrupting Horsea, Miscellanous was read on Attacks, so the Obedience Flag was read on Move 4 PPs.<br />However, you would have needed a Double Corruption (I don&#039;t remember if it&#039;s mandatory or not for this), and a Move with 64 PPs, and Horsea doesn&#039;t learn such a move.<br /><br />About Double Corruption possibilities :<br />But with Smeargles and Glitch Moves, it&#039;s easy to pull off a manipulation like this.<br />(To obtain any Glitch Move you want, use the in-game Plusle as it has Attacks read on EVs when corrupted)<br />(For Glitch Items, use Horsea again with Def and Spd EVs)<br />You can&#039;t do all the data manipulations you want with Smeargles and Double Corruption, as there are only 10 substructure permutations available with the 0x40 Corruption, and as you can&#039;t fully manipulate Smeargle EVs or Moves (you can&#039;t Sketch every Glitch Move as they may freeze the game when doing so), but you can go quite far with this.<br /><br />The biggest manipulation I did was for a Mewtwo :<br />Lv 0, caught in a Safari Ball at Lv 111 in Cerulean Cave, holding a Master Ball,<br />IVs : 31/23/31/27/31/31 ,&nbsp; EVs : 235/0/255/255/255/191<br /><br />He had Glitch Moves (removed with Day Care) because I focused on manipulating Growth, Miscellanous, and EVs.<br /><br />As for the 10 possible substructure permutations, that I call Corruption types (because it determines what your Pokemon will turn into), I have reported them in a list, and here&#039;s a quick translation of that list :<br />[img]http://i.imgur.com/LKR8RVG.png[/img]<br /><br /><br />For example, Horsea&#039;s Corruption type is GE AM EG MA (Type 8 ).<br />This is quite useful because when you&#039;re farming for Smeargles for Double Corruption manipulations, you only need one Smeargle of each Corruption type (a bit less since some types are useless, and some have nearly the same uses), and you can check that either by testing (you give the smeargles certain tiny characteristics and corrupt them to see what type they are), or by using my lua script (if doesn&#039;t directly give the type, but you can deduce it from the substructure orders before and after Corruption).<br /><br /><br />Getting an obedient event Mew (example) :<br />For example, if you were to need a Faraway Island Lv 30 Obedient Mew from Emerald, this means you need to manipulate Species, obedience, and Met Location + Met Lv + Met Game.<br />So you&#039;ll either do a Type 8 (Growth on Evs and Misc on Attacks) or Type 3 (Growth on Attacks and Misc on EVs) Corruptions.<br />Since you&#039;re not manipulating too much Miscellanous data, you can use EVs to get them all, so a Type 3 will be easier to set up.<br />You would need for that : <br />Move 0x97 (Acid Armor) as Move 1, 201 Atk EVs, 158 Speed EVs, 1 SpAtk EV, between 64-127/192-255 Feel.<br />Here, Speed EVs and Feel are maipulated, and Feel is in the 0x40-0x7F/0xC0-0xFF zone, but not Speed EVs, so you&#039;ll also need to have a &quot;forbidden&quot; Ball or 64-127 Beauty to make the Pokemon corruptible.<br />So use Pokeblocks that give Beauty like 4-player Blue Pokeblocks (12 Beauty, 21 Feel), so that with 6 of these Pokeblocks, you have 72 Beauty and 126 Feel.<br />Or use 6 Blue Pokeblocks then Red/Yellow/Green ones to make Feel higher than 192 and you&#039;ll be fine. (this will influence the Ribbons and IVs, so that won&#039;t really matter).<br />Also, be sure not to have any Move 3 and 4 so that the Mew will be at Lv 0 and you&#039;ll be able to remove its glitch moves from DayCare (or you can manipulate its Exp and Held Item to have specific moves like Sketch with 0x00A6 Item or 0x XXXX 00A6 Exp).<br />You could also we more picky about the Ball, IVs, and other stuff, but this will do the trick.<br /><br />It takes a bit of time to search and plan the Pokemon you need, and the preparations you need, but once you have your Smeargles, the rest is quite easy to do (teaching moves, making EVs, giving specific Exp, specific PP bonuses, specific Contest stats, specific Held Item) (with the help of Pomeg Glitch for certain values), and a Double Corruption finishes things off.


subject: Re: Odd Results
poster_name: PokeGlitchFanatic
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In a way,&nbsp; it is location based.&nbsp; Thank you,&nbsp; I will try this same location,&nbsp; but I will open the menu in the correct location.&nbsp; 


subject: Walking off the edge of the map in Tomb Raider 2013
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So this is a little thing I accidentally did in that one newfangled Tomb Raider game while replaying it, it occurs in that scene where the plane gets struck by lightning out of nowhere, and then you slide down a mountain while not getting Lara impaled by a pole, or deliberately having that happen if you&#039;re a guro fetishist. Anyway, ordinarily, some cutscene happens and you&#039;re at the top of the slope for a split second before the game pushes you down it. However, apparently it&#039;s possible to walk the wrong way (hold up on the controller) in that split-second and not fall down the mountain while the game thinks you are, which looks something like this:<br />[img width=800]http://images.akamai.steamusercontent.com/ugc/35244412495418419/A999FE1F670ECB20E1AC7D498D3F7AD0ACF71E60/[/img]<br />You can continue walking along like this, but because you&#039;re supposed to be falling, you can&#039;t jump or use your weapons or change the camera angle.<br />[img width=800]http://images.akamai.steamusercontent.com/ugc/35244412495419461/27D548E74027DA3629473C3CA310996A63913C4A/[/img]<br />Eventually you&#039;ll reach the point where they stopped programming solid ground, and fall off into the void.<br />[img width=800]http://images.akamai.steamusercontent.com/ugc/35244412495421771/42409BCC0942A6ACBD80CC9AD4AF2A61A61FF7AA/[/img]<br />And then you just keep falling forever, as the scenery around you disappears from the render distance. After a few seconds, Lara dies as she would falling from any other kind of great height. <br />[img width=800]http://images.akamai.steamusercontent.com/ugc/35244412495422337/2ECD969A9DE8A15291906480EED827185F37EE26/[/img]<br />You can only do this once, by the way, since after you die the game respawns you slightly down the mountain so you don&#039;t have a chance to avoid the scripted falling again. So make the most of it.


subject: Re: Vermilion City request plssssssss
poster_name: VaeporSage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Finished. Vermilion City&#039;s in the third one. :)<br /><br />https://www.youtube.com/watch?v=x81vlNREn4Q<br />https://www.youtube.com/watch?v=G74oJHk0evo<br />https://www.youtube.com/watch?v=cV3lWbL_HkQ


subject: Re: We should reproduce this on real game cartridges
poster_name: shaggs
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Man I think this is really cool but that is way too much trouble just to get Celebi. Great work though, I figure most people would still prefer doing the celebi egg trick or the bad clone glitch.


subject: Re: The Pokegod People People Eaters!! [PWN YOU!]
poster_name: shaggs
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;d be up for making a Pokegod site since I had one before but it got deleted because I left it unattended lol. But yeah if anyone needs help with this let me know I love anything that involves pokegod lore


subject: Re: We should reproduce this on real game cartridges
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks. Myself and Wack0 put it together. Wack0 suggested TM33 and using 8F to put the jump code (to the PC items here) in the PokÃ©mon&#039;s nickname.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not sure if this has been posted already, but I found something pretty interesting.<br />After scrolling past the 6th slot and using a fluffy tail, I attempted to talk to the Day-care man. However, when I pressed A, the game would freeze for a fraction of a second. Upon attempting to talk to him several times, I suddenly got a call on the PokÃ©nav which spouted an insanely long line of Å’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’Ãª which lasted several minutes.<br /><br />Upon ending the call, a variety of things happened:<br /><br />I was in a Safari game.<br />My name was changed to Å’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’Ãª.<br />My play time became ?84:43.<br />I now have 3 badges.<br />My gender changed to female.<br />My party became six Bad EGGs, all burned.<br />I have seen 50 and caught 50 PokÃ©mon in the PokÃ©dex.<br />Everything in my Bag became ????????, which I apparently had zero of.<br />My &quot;No. of battles&quot; counter on Match Call became ?????.<br /><br />Upon exiting the Safari game, my sprite became Red&#039;s sprite, of all things.<br /><br />At this point, attempting to use the PC, checking my Trainer Card or entering a battle all crashed the game.<br /><br />If I can find the pictures I took, I&#039;ll post them. This seems so similar to the ZZaZZ Glitch from R/B...


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Metarkai and I encountered the same effect but I haven&#039;t got name corruption with the Day Care man before. That&#039;s cool.<br /><br />Here is a video.<br /><br />https://youtu.be/QaPs2KZ7F70?t=802 (13:22)


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6868.msg198518#msg198518 date=1430912083]<br />Metarkai and I encountered the same effect but I haven&#039;t got name corruption with the Day Care man before. That&#039;s cool.<br /><br />Here is a video.<br /><br />https://youtu.be/QaPs2KZ7F70?t=802 (13:22)<br />[/quote]<br /><br />There&#039;s just a grey box with ellipsis on it where the video should be...


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Spectramark link=topic=6868.msg198519#msg198519 date=1430912525]<br />[quote author=Torchickens link=topic=6868.msg198518#msg198518 date=1430912083]<br />Metarkai and I encountered the same effect but I haven&#039;t got name corruption with the Day Care man before. That&#039;s cool.<br /><br />Here is a video.<br /><br />https://youtu.be/QaPs2KZ7F70?t=802 (13:22)<br />[/quote]<br /><br />There&#039;s just a grey box with ellipsis on it where the video should be...<br />[/quote]<br /><br />Did you click where the video should be to play it?


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=6868.msg198520#msg198520 date=1430914123]<br />[quote author=Spectramark link=topic=6868.msg198519#msg198519 date=1430912525]<br />[quote author=Torchickens link=topic=6868.msg198518#msg198518 date=1430912083]<br />Metarkai and I encountered the same effect but I haven&#039;t got name corruption with the Day Care man before. That&#039;s cool.<br /><br />Here is a video.<br /><br />https://youtu.be/QaPs2KZ7F70?t=802 (13:22)<br />[/quote]<br /><br />There&#039;s just a grey box with ellipsis on it where the video should be...<br />[/quote]<br /><br />Did you click where the video should be to play it?<br />[/quote]<br /><br />I did try earlier, but it didn&#039;t work. It seems to work now, however. Thanks.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Another thing: Can anyone help me out with this? I&#039;ve been trying to get a Gengar egg with the EVs -&gt; Species corruption but it&#039;s just not working, or I&#039;m just unlucky.<br /><br />I have Box 2 of my PC filled with Seasors with (I think, it&#039;s hard to calculate EVs on the cartridge version) 94 HP EVs and 0 Attack EVs.<br />I&#039;m at about 20 tries now, and every time they&#039;ve just turned into Bad EGGS.<br /><br />If this matters, here&#039;s Seasor&#039;s info:<br /><br />Name:SEASOR<br />Lv:35<br />Ability:Swift Swim<br />Brave Nature<br />No held item<br />No ribbons<br />EXP:43,296 - 3,360 to next Lv.<br /><br />Moves:<br />Smokescreen<br />Leer<br />Water Gun<br />Twister


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  [quote author=Spectramark link=topic=6868.msg198517#msg198517 date=1430911648]<br />Not sure if this has been posted already, but I found something pretty interesting.<br />After scrolling past the 6th slot and using a fluffy tail, I attempted to talk to the Day-care man. However, when I pressed A, the game would freeze for a fraction of a second. Upon attempting to talk to him several times, I suddenly got a call on the PokÃ©nav which spouted an insanely long line of Å’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’Ãª which lasted several minutes.<br /><br />Upon ending the call, a variety of things happened:<br /><br />I was in a Safari game.<br />My name was changed to Å’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’ÃªÅ’Ãª.<br />My play time became ?84:43.<br />I now have 3 badges.<br />My gender changed to female.<br />My party became six Bad EGGs, all burned.<br />I have seen 50 and caught 50 PokÃ©mon in the PokÃ©dex.<br />Everything in my Bag became ????????, which I apparently had zero of.<br />My &quot;No. of battles&quot; counter on Match Call became ?????.<br /><br />Upon exiting the Safari game, my sprite became Red&#039;s sprite, of all things.<br /><br />At this point, attempting to use the PC, checking my Trainer Card or entering a battle all crashed the game.<br /><br />If I can find the pictures I took, I&#039;ll post them. This seems so similar to the ZZaZZ Glitch from R/B...<br />[/quote]<br /><br />What happened here is that you corrupted the RAM value storing the Day Care man script adress (once you enter a map, locations and script adresses of NPC are copied into RAM).<br />The script adress becomes totally invalid (0x0DXX XXX or 0x48XX XXXX instead of 0x08XX XXXX), and that makes the game store a huge amount of values that overwrite a large part of RAM data when stored.<br />The read values depend a bit on RNG, since you can obtain certain different results depending on the time when you talk to the NPC.<br /><br />However, since the overwriting is brutal, there&#039;s for now no exploit of this method since it always (or nearly always ?) overwrites data related to current map data. And this makes the game freeze if you were to refresh the map by walking or opening&amp;closing party/bag/pokedex/..<br />A good amount of times, the script ends with a trainer battle, and losing it allow us to be teleported to another location. However, I don&#039;t remember any of these battle going well (if we were able to lose and black out without any freeze).<br /><br /><br />[quote author=Spectramark link=topic=6868.msg198522#msg198522 date=1430922893]<br />Another thing: Can anyone help me out with this? I&#039;ve been trying to get a Gengar egg with the EVs -&gt; Species corruption but it&#039;s just not working, or I&#039;m just unlucky.<br /><br />I have Box 2 of my PC filled with Seasors with (I think, it&#039;s hard to calculate EVs on the cartridge version) 94 HP EVs and 0 Attack EVs.<br />I&#039;m at about 20 tries now, and every time they&#039;ve just turned into Bad EGGS.<br />[/quote]<br /><br />Yeah, this is an issue that can happen (and frequetly) due to the fact that the corruption a PC Pokemon will suffer depends on some part of the data of the PC Pokemon before him.<br />And in a certain amount of cases, this makes it impossible to have a working corruption (you won&#039;t see any Pokemon turn into an Egg with its PID corrupted).<br />Since you trained 1 Horsea and cloned it, for each Horsea (except the first one), the data of the Pokemon before him is always the same.<br />Thus, if this data makes it impossible to corrupt one Horsea, all your Horsea won&#039;t be corrupted.<br /><br />This is one of the 2 main flaws of the &quot;basic&quot; Pokemon corruption : if has non-negligeable chances to not work with the Pokemon you&#039;re using.<br /><br /> What you could try here is to only use 1 Horsea and put him into Box 2 Slot 24.<br />This slot is a bit more specific than the others as it&#039;s the Slot where RAM Corruption stats, so the Pokemon in that very slot will suffer from less corruption than other PC Pokemon (in general, there will be no 0x05 Corruption on its data, so once the 0x40 Corruption goes onto its PID, he should be corrupted well).<br />You should have 1-2/32 chances to make the corruption work and have a Gengar like this.<br /><br /><br />If you want to do other corruptions and other things, I recommend you to read the post I made last page (most of the technical stuff isn&#039;t that important, but the procedure is), and to download the nice .vbm Torchickens did, where he created its own corruption initiator and used it to get a Deoxys with 100% chance to succeed.<br />And if you can do trades, you&#039;ll be able to get a corruption initiator with this.<br /><br /><br /><br />EDIT :<br /><br />I made AR codes for the Perfect Initiators (both of them), as well as a Cloning Glitch Pokemon 0x288A for easier use.<br />There&#039;s also .dmp and .vbm file to get them in previous page.<br /><br />Perfect Initiators :<br />-SEASOR Box 1 Slot 1 :<br />A2C5C596 17DA2752<br />F45EB5FD 537687FB<br />19DF4333 C4F74712<br />A152E8EA 8D4760CA<br />B13788DF 3B9B3A06<br />C779EE6C 581A95B9<br />21B17AD5 DA302C1D<br />9D1EF466 2A6BBE89<br />C8B2C039 BBAF6F10<br />C6EBC6F3 449F849A<br />3E96C2CF 7A857392<br />E961EBF3 AB0BCF93<br />0C9256C3 62ECB067<br />CEDF2D7F 2B16ACD8<br />A0C9067E 5DF79155<br />B54DF298 D5F5CBE8<br />938599D1 405D3286<br />BC4CC3E8 1780C0E0<br />EBB11B21 D831516F<br />0E1022AE 1D878554<br /><br /><br />-Marked SEASOR Box 1 Slot 1 :<br />A2C5C596 17DA2752<br />F45EB5FD 537687FB<br />19DF4333 C4F74712<br />A152E8EA 8D4760CA<br />B13788DF 3B9B3A06<br />C779EE6C 581A95B9<br />FD888EEC 3BF29F9D<br />7ECAB9C9 836C5CE0<br />C8B2C039 BBAF6F10<br />C6EBC6F3 449F849A<br />3E96C2CF 7A857392<br />E961EBF3 AB0BCF93<br />70733463 A2300296<br />551E03CE 8008DF22<br />A0C9067E 5DF79155<br />B54DF298 D5F5CBE8<br />938599D1 405D3286<br />BC4CC3E8 1780C0E0<br />EBB11B21 D831516F<br />0E1022AE 1D878554<br /><br /><br />0X288A Cloning Pokemon Box 1 Slot 1 :<br />F3FF8938 F2F0E0C9<br />E2702D51 7857D4A2<br />AB71E557 19AF41CC<br />0FE199FA B823C7D7<br />0ACA1C25 59581547<br />10E8FBDF 66A39775<br />C82FFF38 70FF74BC<br />653F342F CD0F6A08<br />1F84851D BEC5B4D6<br />2F151FF1 1728714F<br />61398186 8C5F9FC5<br />FD9E9546 E55D0B32<br />A406783C 0C3177A7<br />5DF1F989 3FACA9DD<br />89CEE4A4 EB64C63B<br />5EB054E7 1231876C<br />51F13B68 9594314D<br />6D1A2A74 D3E004EC<br />1CDFF57E A9407B53<br />4DAC86DE 3AFEB045<br /><br />


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spectramark
icon: xx
body:
  [quote author=Metarkrai link=topic=6868.msg198524#msg198524 date=1430935973]<br /> What you could try here is to only use 1 Horsea and put him into Box 2 Slot 24.<br />[/quote]<br /><br />I&#039;ll give that a few tries, thanks.<br /><br />EDIT: My 11th attempt got me an egg, but it was unhatchable and it contained the Horsea...<br /><br />EDIT 2: My 14th attempt got me an egg again, but this time containing the Gengar! It worked!


subject: Re: English fossil conversion glitch (get absolutely any PokÃ©mon/glitch PokÃ©mon)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I did the glitch again and found instead of entering a battle, you can indeed just keep viewing LM4&#039;s summary from [url=http://i.minus.com/ibxPoFRCenomoK.PNG]the spot[/url] to get the 16 PokÃ©mon and then proceed to clean things up and re-enable saving.<br /><br />However, a freeze happened even when trying to deposit Cancel. A work-around to this was to deposit one of the PokÃ©mon above Cancel e.g. the LM4 and only then start depositing Cancels.<br /><br />Note: After activating Super Glitch from the party menu, the B button may be disabled, but can be re-enabled by selecting a PokÃ©mon and backing out.<br /><br />I am sorry for the late reply.


subject: Shift/Set malfunction (Ruby/Sapphire/FireRed/LeafGreen/Emerald)
poster_name: VaeporSage
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: VaeporSage
icon: wink
body:
  I&#039;ve been meaning to make this thread for ages now. This is just an overview of most of the processes involved in the glitch, with lots of footage (some of which I&#039;ve recently annotated to make clearer) and updated terminology which you&#039;re free to employ or change up. Ideally &#039;Shift/Set malfunction&#039; (or whatever other name it should be assigned) and &#039;Pseudoclone&#039; (likewise) would each form their own little Wiki pages, with a pinch of revision, proofreading and simplification here and there.<br /><br />Hopefully you find at least some of this interesting. As glitch research goes, I&#039;ve left it relatively unpublicised, and I&#039;m certain there&#039;s so much more to find. After all, this is all the result of me piddling around on my GameBoy between the ages of 14 and 16 with little to no knowledge of the game&#039;s workings. Anyone with a clear understanding of the game&#039;s internal function could, in theory at least, have a field day with this one. :)<br /><br />[b][u]Shift/Set malfunction (Ruby/Sapphire/FireRed/LeafGreen/Emerald)[/u][/b]<br /><br />The Shift/Set malfunction is a glitch that occurs in the GBA games of Generation III. In the &#039;Battle Style&#039; section of the Options menu, the &#039;Shift&#039; option must be selected to perform this glitch. It is caused by the game&#039;s mismanagement of the event when the player&#039;s PokÃ©mon faints at an irregular moment in time during battle. The malfunction allows the player to battle with various different kinds of glitch PokÃ©mon without the use of a cheating device. As of yet, there are three documented means of triggering the effect: the Revive method, the Level-up method and the Volt/Water Absorb method.<br /><br />After the player&#039;s PokÃ©mon faints at an unusual point during the turn, and a new PokÃ©mon is selected to be sent into battle, the game will display the Shift/Set message (â€œ[Trainer] is about to use [PokÃ©mon]. Will [Player] change PokÃ©mon?â€). The act of the player sending out a PokÃ©mon is treated as though it were in fact the opponent who is switching in a new PokÃ©mon. <br /><br />Watch @ 6:05 â†“<br />https://youtu.be/vufS4iv5Ln0?t=6m5s<br /><br />This additional sequence is notable as selecting &#039;Yes&#039; and agreeing to choose a new PokÃ©mon to be sent out erases the player&#039;s first choice. No further choice of PokÃ©mon is necessary, as&nbsp; the Shift/Set switch is optional. Thus, exiting the switch via &#039;Cancel&#039; returns the player to the battle, without having chosen a PokÃ©mon to battle with. Glitch PokÃ©mon are then sent into battle, with Ruby/Sapphire, FireRed/LeafGreen and Emerald each containing their own unique types. Furthermore, the game will treat the glitch PokÃ©mon slightly differently according to which method was used to trigger the Shift/Set malfunction.<br /><br />[b]The Revive method:[/b]<br /><br />https://www.youtube.com/watch?v=AT29yzEGpvI<br /><br />Watch @ 1:15 â†“<br />https://youtu.be/wCZFk83j554?t=1m15s<br /><br />Requirements:<br />-A team of 2 or more PokÃ©mon consisting of only fainted PokÃ©mon and Eggs.<br />This can be achieved through use of the Pomeg glitch or via &#039;DecaSwitching&#039;.<br /><br />-A Revive, Max Revive or Revival Herb.<br /><br />Method:<br />(1) Enter a battle and use your revival item on any PokÃ©mon, except for the fainted PokÃ©mon in the first slot.<br />(2) Select the revived PokÃ©mon to send it into battle.<br />(3) Agree to switch into a new PokÃ©mon.<br />(4) Cancel the switch.<br /><br />[b]The Level-up method:[/b]<br /><br />https://www.youtube.com/watch?v=He4HakJUYss<br /><br />Requirements:<br />-A PokÃ©mon with a specific amount of HP in the first slot (explained in method).<br />-Another PokÃ©mon that is able to battle.<br />-A Poison-healing item, a HP Up and a Pomeg berry<br />	<br />Method:<br />(1) Select a PokÃ©mon that has sufficient EXP to level up after defeating one PokÃ©mon, and which gains 2 or more HP from the use of a single HP Up.<br />(2) Before using a HP Up on the selected PokÃ©mon, save the game, then have the selected PokÃ©mon gain EXP in battle so that it levels up. <br />(3) Take note of how much HP was gained via level-up and reset the game.<br />(4) Your desired HP value is [65536 â€“ (amount of HP gained via level-up)]. That way, leveling up will raise the HP to 65536 (zero), fainting the selected PokÃ©mon.<br />(5) Use a HP Up on the selected PokÃ©mon to so have it gain 2+ HP.<br />(6) Reduce the selected PokÃ©mon&#039;s health to 1 via Poison damage. <br />(7) Use a Pomeg berry, allowing the HP value to drop below 0. (0-&gt;65535-&gt;65534-&gt;65533, etc.)<br />([i]8[/i]) If necessary, apply further Poison damage so to reach the desired HP value.<br />(9) Heal the Poison.<br />(10) Place the selected PokÃ©mon in the first slot of the party, and place any another PokÃ©mon capable of battling in any other slot of the party.<br />(11) Enter a single battle against a trainer with 2 or more PokÃ©mon.<br />(12) Have the selected PokÃ©mon gain EXP. It will gain exactly the right quantity of health so that it faints.<br />(13) Choose a PokÃ©mon from your party to send into battle.<br />(14) Agree to switch into a new PokÃ©mon.<br />(15) Cancel the switch.<br /><br /><br />[b]Volt &amp; Water Absorb method:[/b]<br /><br />https://www.youtube.com/watch?v=E0yl0LMtMLg<br /><br />Requirements:<br />-A PokÃ©mon with the ability Volt Absorb or Water Absorb, and a specific amount of HP (explained in method).<br />-Any other PokÃ©mon that is able to battle.<br />-A Poison-healing item, a HP Up and a Pomeg berry.<br /><br />Method:<br />(1) Select a PokÃ©mon with the Ability Volt Absorb or Water Absorb, and which gains 2 or more HP from the use of a single HP Up.<br />(2) Before using a HP Up on the selected PokÃ©mon, find the amount of HP it will gain through its ability either by testing it during battle, or by dividing its total HP by 4 and rounding down (e.g. A PokÃ©mon with a total of 78 HP will give 19 HP).<br />(3) Your desired HP value is [65536 â€“ (amount of HP gained via Volt/Water Absorb)]. That way, activating the Ability will raise the HP to 65536 (zero), fainting the selected PokÃ©mon.<br />(4) Use a HP Up on the selected PokÃ©mon to so have it gain 2+ HP.<br />(5) Reduce the selected PokÃ©mon&#039;s health to 1 via Poison damage. <br />(6) Use a Pomeg berry, allowing the HP value to drop below 0. (0-&gt;65535-&gt;65534-&gt;65533, etc.)<br />(7) If necessary, apply further Poison damage so to reach the desired HP value.<br />([i]8[/i]) Heal the Poison.<br />(9) Place the selected PokÃ©mon in any slot of the party, and place any another PokÃ©mon capable of battling in any other slot of the party.<br />(10) Enter a single battle against any trainer.<br />(11) Have the selected PokÃ©mon gain HP via its Ability. It will gain exactly the right quantity of health so that it faints.<br />(12) Choose a PokÃ©mon from your party to send into battle.<br />(13) Agree to switch into a new PokÃ©mon.<br />(14) Cancel the switch.<br /><br />[b]Glitch PokÃ©mon available via the Shift/Set malfunction:[/b]<br /><br />Ruby/Sapphire:<br />All methods yield a shiny Bad EGG with the species of a Feraligatr, the Water typing, the Ability Torrent.<br /><br />https://www.youtube.com/watch?v=SDdAs_d1G8Q<br /><br />Watch @ 3:22 â†“<br />https://youtu.be/AT29yzEGpvI?t=3m22s<br /><br />FireRed/LeafGreen:<br /><br />All methods yield a glitch PokÃ©mon of the &#039;B oE An&#039; family. Depending on the method used, the PokÃ©mon&#039;s name may vary. It is also rumoured that the PokÃ©mon&#039;s name differs from player to player. Attempting to send out this glitch PokÃ©mon will softlock the game with an unending animation.<br /><br />https://www.youtube.com/watch?v=ELWGlBr_3Ps<br />https://www.youtube.com/watch?v=ZCQX5ntMME8<br /><br />Watch @ 2:26 â†“<br />https://youtu.be/AT29yzEGpvI?t=2m26s<br />https://www.youtube.com/watch?v=NWzyfQ696QY<br /><br />Emerald:<br />All methods yield a Pseudoclone, a glitch PokÃ©mon which shares numerous characteristics with both of the first PokÃ©mon sent out by both players at the start of the battle.<br /><br />~~~~~<br /><br />[u][b]Pseudoclones[/b][/u]<br /><br />Pseudoclones are a type of glitch PokÃ©mon available only in Emerald via the Shift/Set malfunction. They share many characteristics with the PokÃ©mon that the player first sent out at the beginning of the battle (Parent 1) as well as with the opponent&#039;s first PokÃ©mon (Parent 2).<br /><br />https://www.youtube.com/watch?v=aWg2X2m0Nb8<br /><br />Watch @ 0:51 â†“<br />https://youtu.be/He4HakJUYss?t=51s<br /><br />[u]Shared with the player&#039;s first PokÃ©mon (Parent 1):[/u]<br />Moveset<br />Item<br />Typing*<br />Ability*<br />Actual Species (i.e. Visible via Transform)*<br />Calculative HP value**<br /><br />[u]Shared with the opponent&#039;s first PokÃ©mon (Parent 2):[/u]<br />Displayed Species (On HP bar)<br />Battle sprite<br />Gender<br />Level<br />Maximum HP value**<br />Fainted/non-fainted status &amp; current HP value***<br /><br />*There are two classes of Pseudoclones: Azurill Pseudoclones and Gengar Pseudoclones. Azurill Pseudoclones carry the Ability Thick Fat and the Normal typing, while Gengar Pseudoclones carry the Ability Levitate and the Ghost/Poison typing. The class of the Pseudoclone is determined by the index number of its Parent 1. Celebi, and all PokÃ©mon with lower index numbers (as far as Bulbasaur), produce a Gengar Pseudoclone. Treecko, and all PokÃ©mon with higher index numbers (as far as Deoxys), produce an Azurill Pseudoclone.<br /><br />**Ex: Pseudoclone with 0 HP and:<br />-Parent 1, max HP 40 (knows Recover)<br />-Parent 2, max HP 60. <br /><br />Recover will restore health by 20 (instead of 30 as would otherwise be expected).<br /><br />Ex: Pseudoclone with 0 HP and:<br />-Parent 1, max HP 90 (knows Recover)<br />-Parent 2, max HP 40<br /><br />Recover will restore health by 45, increasing the total to 45/40.<br /><br />***When the Pseudoclone is active, the opponent&#039;s first PokÃ©mon will not be treated as fainted, and will be sent out once more after having been defeated previously.<br /><br />Revive method: The Pseudoclone will be notably less stable, forcing it to be sent out twice in a turn and treating it as fainted if it attempts to attack (triggering a new Shift/Set malfunction). Via this method, the only way to proceed beyond this loop is to throw a PokÃ© Ball, which allows the opponent to attack the player&#039;s Pseudoclone. On the player&#039;s following turn, the loop will continue (whereby the Pseudoclone must be re-chosen twice) unless the Pseudoclone had been hit by False Swipe, which renders it active with 1 HP remaining.<br /><br />Level-up method: The Pseudoclone will be active (i.e. able to attack and not treated as fainted). However, as the opponent&#039;s first PokÃ©mon (Parent 2) is fainted due to the requirement of the Parent 1 gaining EXP to trigger the Shift/Set malfunction, the Pseudoclone will be sent out with 0 HP. Damage inflicted onto the Pseudoclone while in this state will decrease its health value below 0, e.g. taking 5 damage will leave the Pseudoclone with 65,531 HP. As the Pseudoclone is active, the Parent 2 will no longer be treated as fainted. When sent out again, the Parent 2 will share the extra-maximum HP value of the Pseudoclone.<br /><br />Volt &amp; Water Absorb method: The Pseudoclone will be active. The Parent 2 remains active, and the Pseudoclone will be sent out with its same quantity of health.<br /><br />When the player knocks out the opponent&#039;s final active PokÃ©mon with a Pseudoclone through use of a draining move (Giga Drain, Leech Life, etc.), the game will send out a glitch PokÃ©mon of the B Ã³Ã‹ ÃN family. <br /><br />http://bulbapedia.bulbagarden.net/wiki/%C3%93%C3%8B_e_%C3%81i<br />https://www.youtube.com/watch?v=OjEE3TIOVMA


subject: Re: Pokemon Omega Ruby and Alpha Sapphire Discussion
poster_name: Ryccardo
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Ryccardo
icon: xx
body:
  Dexnav crown discussion again...<br /><br />Its color is calculated with this procedure (or most likely with a functional equivalent):<br />A = number of unlocked encounter sets (grass, surf if Norman defeated, combination of all 3 rods if you ever got any of them, special encounters if Groudon/Kyogre battled) for current location*<br />if A=0 disable DexNav<br />B = number of unlocked encounter sets for which you caught (for the Pokedex definition of caught) all of them<br />if A-B is 0, gold/platinum (1st result if main legendary not battled, 2nd if it is)<br />if A-B is 1, silver/gold<br />if A-B is 2, bronze/silver<br />if A-B is 3, none/bronze<br />if A-B is 4, ---/none<br /><br />But did anyone figure out what makes it shine?<br />I saved in Meteor Falls on the 25th of April and after loading the game it was shiny (with A-B=1=gold); after loading Streetpassess and walking through a door it wasn&#039;t shiny anymore, both in the new room and in the original room...<br />---------<br />It became shiny again after writing this post with the 3DS in standby!


subject: Re: (Newly discovered?) Super Mario Bros. glitch found.
poster_name: Ryccardo
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Pipes and vines in SMB1 work like pipes and doors in SMW -- you can only have one destination per &quot;screen&quot; (and being pushed to the right side of the currently viewable area makes it possible to access pipes of the next screen with them pointing to the active one, so practically you can get to the sky zone of 4-2 by entering a pipe)!<br /><br />Warp zones are the exception, where 3 different warps are set up in the area of a single view (and this is how minus world works: the game, by not having processed yet the &quot;lock camera and start warp zone&quot; &quot;enemy&quot;, is confused in using 4-2&#039;s warp zone, which only has the middle pipe to world 5 despite all warp zones having 3 exits -- the two side ones are conveniently set to world 36 as character 36 is a space...)


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7086.msg198498#msg198498 date=1430293247]<br />normies[/quote]<br /><br />Stop.<br /><br />But really, why wouldn&#039;t it get special moves? Also, saying nerfing him was stupid is pointless, since everyone returning from Brawl and Melee got nerfed hard.


subject: Re: The Member's Guide to Topiclessness
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So we can agree that [url=http://medarot.meowcorp.us/wiki/Pegasus_Rider]this[/url] is the coolest Medabot ever, right?<br /><br />&gt;Tiny knight<br />&gt;Becomes a fucking PEGASUS<br /><br />I mean shit Red Matador&#039;s my favorite and there&#039;s a hydra called Greek Head, but godDAMN I want an action figure of Pegasus Rider badly.


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=7086.msg198534#msg198534 date=1431565559]<br />[quote author=Zowayix link=topic=7086.msg198498#msg198498 date=1430293247]<br />normies[/quote]<br /><br />Stop.[/quote]<br />Normies normies normies normies normies normies normies normies normies normies.<br /><br />[quote]<br />But really, why wouldn&#039;t it get special moves? Also, saying nerfing him was stupid is pointless, since everyone returning from Brawl and Melee got nerfed hard.<br />[/quote]<br /><br />Because apparently either Sakurai is lazier than he makes himself out to be or for some reason thought people didn&#039;t want them, and not quite the case because characters like Sheik, Luigi, Bowser, Sanic, Yoshi, and especially Ness got buffed in their return from the previous games. And it doesn&#039;t make sense to nerf, for example, his weight as not being able to KO Mewtwo easily was not a prevalent issue at any level of Melee play, nor was Shadow Ball dealing damage while charging.


subject: Yellow Disassembly
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I decided to start a Yellow Disassembly because I&#039;ve been noticing many different changes from Red/Blue, many of which cannot be specified by &quot;IF(DEF)&quot;s.<br /><br />I was wondering about one thing: why is there an IF(DEF) option for Yellow Beach House? Is there anything special about it, or was it just one of the obvious differences for Yellow?


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Metarkrai link=topic=6868.msg198509#msg198509 date=1430683751]<br />About the .vbm :<br />I watched the .vbm (that was my first time seeing ones, these things are so nice !), and the whole thing was well made.<br />Thanks to voltage, you can now skip the long Swampert poisoning phases (for me that was Banette using Curse with an odd amount of HP) with the Decaswitch.<br /> - You just have to get an Invisible Bad Egg from a Pokemon Corruption (that&#039;s a Decamark Bad Egg), and with a precise selection, you can switch this Invisible Bad Egg with your last alive Party Pokemon. (I didn&#039;t write the exact procedure, but it&#039;s like grabbing and depositing a PC Pokemon, then grabbing the invisible Bad Egg and switching it with the Party Pokemon, but that may not be exactly that so you might have to try out a few times before the game will alow you to switch these Pokemon).<br /><br />The values for Caterpie are the good ones (1400B4B2 0000B4A6 000.... for 2nd substructure on first Caterpie, and 1400B4B2 4800B4A6 8A0... for 2nd substructure on Marked Caterpie).<br /><br />But yeah, you did the good things to be sure that you have a chance that the Pomeg Corruption will work, and have great chances of success.<br />[/quote]<br /><br />I&#039;m glad you liked my VBM. Thank you for the tip, I&#039;ll use a Curse PokÃ©mon next time and try Decaswitching.<br /><br />I want to get [url=https://www.youtube.com/watch?v=nedYzxCi3UM]this[/url] to work but FFFF always freezes the game for me when it hatches. Any advice?<br /><br />Edit: Never mind, I realized it is 0x0A0D and successfully hatched one.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I&#039;m trying to get the groovy Pomeg glitch effect caused by 0xCCD7 (who is presumably unhatchable). I forced it with memory viewer so I know this glitch PokÃ©mon has the same effect in English Emerald.<br /><br />If the Horsea becomes an Egg due to the highest 0x40 being set on its personality value (thus transforming it into 0xCCD7 early) instead of becoming a normal Horsea Egg, is it still possible to get a double corruption?


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  I&#039;ll write here what I answered to Torchickens about 0xFFFF since it&#039;s a key point of Double Corruption.<br /><br />Double Corruption directly gives the wanted Pokemon in a non-Egg state, so you don&#039;t have to worry about the hatching sequence if you&#039;re going for a Glitch Pokemon.<br /><br />And here&#039;s also one fast Pokemon Corruption setup if you just want to get a specific Glitch Pokemon.<br />- Get the species of the desired Pokemon and the in-game traded Horsea.<br />- Train Horsea in HP and Atk EVs to make them match the species (species = Atk Evs + 256*(HP Evs) )<br />- Place Horsea in Box 2 Slot 24, and empty Box 2 Slot 23.<br />- Perform a first Pomeg Glitch to change Horsea into an Egg. Don&#039;t take that Egg with the hand.<br />- Perform a second Pomeg Glitch to change the Egg into the desired Glitch Pokemon.<br /><br />Here, the 0x05 Corruption on Horsea&#039;s data is avoided by placing it in Box 2 Slot 24, the first Slot where Pomeg Glitch happens. It&#039;s the easiest preparation to make, but you can&#039;t have more than 1/32 chance to get a working corruption.<br />You can also manually change Horsea&#039;s TID and PID with Memory Viewer, that&#039;ll do the same thing.<br /><br /><br />And for the Glitch Pokemon on the video, who was 0x0A0D and not 0xFFFF (the author mistook the Egg for a 0xFFFF one), I isolated the sequence that induces the audio mess.<br />It is 28 8E 9B B4 03, and the first value (28) must be the 87th letter of the Glitch Pokemon&#039;s name for this to work.<br />I tried changing certain characters to see the effects, but I was only able to get a horrible audio mess.<br />If someone knows what kind of code can be executed like this, it would be interesting to check all the possible ones with Glitch Pokemon (since the name must only be more than 100 characters long, a large amount of Glitch Pokemon will interfere).<br /><br /><br />EDIT : <br />Torchickens :<br />Yeah, for Double Corruption, the order in which TID or PID are corrupted have no influence since the goal is to corrupt both of them, and since the Egg (after the first corruption) isn&#039;t touched (it&#039;s data concerning PPs isn&#039;t refreshed).<br /><br />EDIT 2 :<br />[url=http://www.youtube.com/watch?v=KVj23HYUiL0]Here&#039;s the video[/url] of the messy audio (obtained with 28 8E 9A B4 03)<br />I think it&#039;s best if you don&#039;t listen to it because it&#039;s really horrible.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Thanks for clarifying and re-posting your finds for others to see! You are surely very diligent about Pomeg glitch.


subject: Re: Yellow Disassembly
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Cool. Good luck. Is it on github?<br /><br />Edit: Found it https://github.com/luckytyphlosion/pokeyellow.


subject: Re: We should reproduce this on real game cartridges
poster_name: Kain
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Sorry for not updating something this time.<br /><br />I&#039;m still working on the video tutorial. It turned more hard than i had imagined. I&#039;m doing it in a way that will have more explanation on some specific topics, like item quantity and sorting. Also I&#039;m trying that the video does not be too long.<br /><br />So I&#039;m not dead, I am just busy (or &quot;socially dead&quot; if you like the dead word :-\).


subject: Re: The Pokegod People People Eaters!! [PWN YOU!]
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Papa Doc link=topic=1192.msg198514#msg198514 date=1430887087]<br />I&#039;d be up for making a Pokegod site since I had one before but it got deleted because I left it unattended lol. But yeah if anyone needs help with this let me know I love anything that involves pokegod lore<br />[/quote]<br /><br />yo dude i havent seen you in ages, how have you been


subject: Re: ZOMFG HAXXOR posts from Abwayaxmas
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Abwayax link=topic=2964.msg48185#msg48185 date=1201045999]<br />I&#039;m pretty sure she didn&#039;t hack anyone.<br />[/quote]<br /><br />lawl remember that time i &quot;hacked&quot; gcl, good times.<br />shoot me for bringing up an old topic (i&#039;m going thru my old posts) but it&#039;s too funny not to.


subject: Re: ZOMFG HAXXOR posts from Abwayaxmas
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SCf3 link=topic=2964.msg198548#msg198548 date=1431844354]<br />[quote author=Abwayax link=topic=2964.msg48185#msg48185 date=1201045999]<br />I&#039;m pretty sure she didn&#039;t hack anyone.<br />[/quote]<br /><br />lawl remember that time i &quot;hacked&quot; gcl, good times.<br />shoot me for bringing up an old topic (i&#039;m going thru my old posts) but it&#039;s too funny not to.<br />[/quote]<br /><br />Because GCLF just has so much activity right now that we just have to crack down on this necroposting, floods up the board and makes it hard to see all those new topics that are clearly being posted.


subject: Re: ZOMFG HAXXOR posts from Abwayaxmas
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=2964.msg198550#msg198550 date=1431865838]<br />[quote author=SCf3 link=topic=2964.msg198548#msg198548 date=1431844354]<br />[quote author=Abwayax link=topic=2964.msg48185#msg48185 date=1201045999]<br />I&#039;m pretty sure she didn&#039;t hack anyone.<br />[/quote]<br /><br />lawl remember that time i &quot;hacked&quot; gcl, good times.<br />shoot me for bringing up an old topic (i&#039;m going thru my old posts) but it&#039;s too funny not to.<br />[/quote]<br /><br />Because GCLF just has so much activity right now that we just have to crack down on this necroposting, floods up the board and makes it hard to see all those new topics that are clearly being posted.<br />[/quote]<br />Not gonna lie, I actually LOL&#039;d at this. Kinda makes me sad though. I miss back when GCLF was super active. &lt;3


subject: Re: The exact reason why unstable missingno crashes.
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  After looking at Unstable/Yellow Missingno again, I&#039;ve finally found out why it exactly crashes the game. Here&#039;s a summary of the first discovery, which I already covered in the previous post.<br /><br />[list]<br />[li]Unstable Missingno&#039;s Sprite has quite enormous dimensions (8x10 iirc?), which overflows into music and sprite related data. wc0ef and wc0f0 mark the bank in which the current music is stored in, so when its sprite is decompressed, those addresses are overflowed, which causes the game to run through garbage data and ultimately crash the game.[/li]<br />[/list]<br /><br />So if Unstable Missingno&#039;s Sprite overflows into WRAM, but the sprite data is clearly taken from ROM, then why do the effects seem random when encountering it?<br /><br />The &quot;randomness&quot; of Unstable Missingno is (unsurprisingly) caused by the content of unused SRAM, more specifically $BF66 and $BF67. When the game decompresses Missingno&#039;s sprite, it clears the sprite buffers, but not the unused SRAM. This means that the bytes copied to the Music Banks will always be different. I&#039;m not familiar with the decompression function, so I&#039;m not exactly sure if other sram portions affect whether Unstable Missingno would crash or not.<br /><br />In order to make Missingno stable, one would need to repeatedly encounter it until the SRAM bytes become re-written in a way that would write a stable music bank.


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey guys,<br /><br />I&#039;ve been trying this glitch. So I have two saves. The first one is the Twitch Plays Pokemon save, it has 8 badges, 30 pokemons owned and 132 seen. The second one is a custom save that is probably overcheated using gameshark, it has 151 pokemons, 8 badges.<br /><br />Cooltrainer corruption (not the trick, just the corruption using the fight menu) works fine in the first one but not with the second save file.<br /><br />Have you ever seen variations between save files for this glitch, and do you have any idea what could cause it ?<br /><br />Thanks !


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Yes, sometimes CoolTrainer corruption will refuse to work on certain saves. This happens when the random internal name of the move (viewable from CD6D when you select it) always (or perhaps it will eventually work) has a 0x50 character in its first twenty characters.<br /><br />I don&#039;t know the cause sadly. I might look into the routine where it gets the name.<br /><br />If the game is taking box PokÃ©mon names you can try changing the number of PokÃ©mon stored in the PC. This worked for TheZZAZZGlitch. But note that the names are not always taken from PC PokÃ©mon data.<br /><br />I&#039;m sorry that I couldn&#039;t be of much help.


subject: Re: The exact reason why unstable missingno crashes.
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=luckytyphlosion link=topic=7112.msg198552#msg198552 date=1431982178]<br />After looking at Unstable/Yellow Missingno again, I&#039;ve finally found out why it exactly crashes the game. Here&#039;s a summary of the first discovery, which I already covered in the previous post.<br /><br />[list]<br />[li]Unstable Missingno&#039;s Sprite has quite enormous dimensions (8x10 iirc?), which overflows into music and sprite related data. wc0ef and wc0f0 mark the bank in which the current music is stored in, so when its sprite is decompressed, those addresses are overflowed, which causes the game to run through garbage data and ultimately crash the game.[/li]<br />[/list]<br /><br />So if Unstable Missingno&#039;s Sprite overflows into WRAM, but the sprite data is clearly taken from ROM, then why do the effects seem random when encountering it?<br /><br />The &quot;randomness&quot; of Unstable Missingno is (unsurprisingly) caused by the content of unused SRAM, more specifically $BF66 and $BF67. When the game decompresses Missingno&#039;s sprite, it clears the sprite buffers, but not the unused SRAM. This means that the bytes copied to the Music Banks will always be different. I&#039;m not familiar with the decompression function, so I&#039;m not exactly sure if other sram portions affect whether Unstable Missingno would crash or not.<br /><br />In order to make Missingno stable, one would need to repeatedly encounter it until the SRAM bytes become re-written in a way that would write a stable music bank.<br />[/quote]<br /><br />Unstable Missingno. has a dimension of 11x13.<br /><br />So does it mean once you encounter Missingno. once in a save and it doesn&#039;t crash, it&#039;s safe to encounter it again?


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for your answer !<br /><br />Indeed in the non-working save, the data at CD6D appears to be the player&#039;s name - which is RED. So there is a 0x50 at fourth position. A fix to this would be to change the name to something above 20 letters, or to delete the 0x50 after the name using 8F maybe (though this would probably harm my game :p)<br /><br />But it doesn&#039;t help if you have no way to get 8F, which would be the case if you don&#039;t have any available trainer and you can&#039;t perform the Old Man Glitch (in french R/B, no MissingNo. outside of the fossil/ghost ones can be encountered without freezes).<br /><br />By the way, how does the corruption with the PKMN menu works ? If I use it, I will always get MissingNO., which is a quick way to get it if that was the point. Is there a chance this works &quot;everytime&quot;, even if the FIGHT corruption doesn&#039;t ?&nbsp; :P


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  You&#039;re welcome.<br /><br />Yeah. It&#039;s a quick way to obtain Missingno. and is also a good idea on PokÃ©mon Yellow (if you bring over a PokÃ©mon with - as the first move). Other than being an extra way to get Missingno. on Yellow, you could do it as a method to get a x255 item stack (the duplication works fine if you catch the Missingno.) with no long-range Trainers left for item underflow or creating a Special stat encounter.<br /><br />Opening the PokÃ©mon menu in the middle of a battle before CoolTrainer corruption saves some tile data that ensures that the enemy PokÃ©mon is corrupted to a level 127 hex:32 Missingno. If the inverse sprites effect was in effect (e.g. you can cause it by viewing that Missingno.&#039;s sprite) before opening the PokÃ©mon menu then the battle tiles will be different and let you get a level 127 Horsea when you perform the corruption.<br /><br />I don&#039;t know of a way to guarantee CoolTrainer working any time.


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6992.msg198557#msg198557 date=1432162199]<br />Yeah. It&#039;s a quick way to obtain Missingno. and is also a good idea on PokÃ©mon Yellow (if you bring over a PokÃ©mon with - as the first move). Other than being an extra way to get Missingno. on Yellow, you could do it as a method to get a x255 item stack (the duplication works fine if you catch the Missingno.) with no long-range Trainers left for item underflow or creating a Special stat encounter.<br />[/quote]<br /><br />Yup that&#039;s what I meant. But since it is related to the ability to trigger corruption, there will still be people who could not use Old Man Glitch (e.g. yellow players), have no long-range trainers left AND unable to perform this glitch ! I guess their only choice to get a pokemon they want is to buy a used pokemon game, perform save abuse and use the underflow to reach 8F, execute code and trade the obtained pokemon to the other game&nbsp; :P


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Just to make sure : every time I enter/exit the FIGHT menu in the non-working save, the memory at $CD6D changes. Sometimes I have pokemons of my teams (with a 0x50 at each end of name), sometimes I have the name of the game (RED), etc.<br /><br />Doesn&#039;t that means that, [b]theorically[/b], for every save there should be a moment in which the datas sent to this address allows the corruption to occurs ? 


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I&#039;m not sure. Yeah, if a Yellow user cannot use CoolTrainer; then their only options other than save corruption glitch to activate arbitrary code or get 255 items without GameShark might be the [url=http://www.prama-initiative.com/index.php?page=trade-center-blackout-glitch]Cable Club escape glitch[/url] with Missingno. (using the Safari Zone glitch to escape instead of Poison) or without linking [url=https://www.youtube.com/watch?v=l7FBp1BOEM0]Pikachu off-screen glitch arbitrary code[/url], which is a pain to set up as it stands.<br /><br />You&#039;re right; there are a selection of sources; however, I don&#039;t know what determines the selection. At the moment for me on a save that won&#039;t work ([url=https://mega.co.nz/#!wkEnDDiT!TMJthqBGa-aPr1q_PmRePE9usC8HGnKg1MWxqOme9SQ]link[/url]) the source is always around D2A5 and since this is Trainer name for party PokÃ©mon data there would be 0x50 here. So if the source is not going to change you would have to use arbitrary code execution or maybe get over six PokÃ©mon and swap some with un-terminated names up (with Q above to prevent a freeze) to get it to work.<br /><br />In BGB, if you set a breakpoint on write to CD6D via Debug&gt;Access breakpoints; you can see that hl is copied into CD6D (where CD6D is &#039;de&#039;); and this way you can check the source of the name each time.<br /><br />I got a different selection of hl pointers for another save where the glitch works.<br /><br />I think it&#039;s important to know, so I have just asked TheZZAZZGlitch on Youtube if he can look into where the pointer comes from.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Quibz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was messing around with WS M and found something new that works with it. Every time you use it, it increases the quantity of the second item in your inventory by one.<br /><br />WS M<br />(Item you want to increase quantity of)<br />Ice Heal x43 or Burn Heal x43 (Both seem to work)<br />Full Heal x201<br /><br />I&#039;m not an expert at programming, so I don&#039;t know if this might have some side effects that make it not worth it, but it works for me, so I thought I&#039;d put it here. Does anyone know if it would have side effects? It would be really useful if it didn&#039;t because you could clone items without having to encounter Missingno.


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Alright ! Let me know if he gets something.<br /><br />I honestly forgot about that cable club glitch, yes it&#039;s a good solution. However I did not know that new arbitrary code execution method in yellow using pikachu. You publish too many videos for me to have the time to watch them all&nbsp; :P it&#039;s a very interesting glitch, I hope I will have the time to work on it soon so I could add it to PRAMA.<br /><br />Thanks again !


subject: Re: The exact reason why unstable missingno crashes.
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystal_
icon: xx
body:
  The problem with Yellow MissingNo is not its 10x13 sprite size at 0x39fcc (base stats data), but the first byte of its sprite data which is also supposed to be the sprite size. This size value is used during the decompression while the one in the base stats data is used during the &quot;post-decompression&quot; to determine how to arrange and where to place the decompressed chunks of the sprite on the screen. This is all I know though.<br /><br />Yellow MissingNo.&#039;s frontsprite pointer points to 0x0006 which is 0x00. This means both height and width of 0. These width (high nybble) and height (low nybble) values are multiplied by 8 and saved to W_SPRITEWIDTH and W_SPRITEHEIGHT. I don&#039;t really know what happens from here but if you change 0x0006 to anything between 0x01 to 0xFF (i.e. anything not 0 width AND 0 height) everything will be fine other than the well-known HoF corruption which is still very far from reaching WRAM.


subject: Re: Yellow Disassembly
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I though until this point that Pokemon Yellow was complete and buildable with pokered but I just tried a make yellow and the build failed because SPRITE_JAMES at pokemontower7.asm isn&#039;t defined for yellow in the sprite constants (but I&#039;m guessing there would be more problems too). <br /><br />Which kind of differences cannot be fit into an ifdef though? 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Quibz link=topic=6638.msg198561#msg198561 date=1432259376]<br />I was messing around with WS M and found something new that works with it. Every time you use it, it increases the quantity of the second item in your inventory by one.<br /><br />WS M<br />(Item you want to increase quantity of)<br />Ice Heal x43 or Burn Heal x43 (Both seem to work)<br />Full Heal x201<br /><br />I&#039;m not an expert at programming, so I don&#039;t know if this might have some side effects that make it not worth it, but it works for me, so I thought I&#039;d put it here. Does anyone know if it would have side effects? It would be really useful if it didn&#039;t because you could clone items without having to encounter Missingno.<br />[/quote]<br /><br />In hex this is: (0C/0D) 2B 34 C9<br /><br />and in gb asm (which I helpfully commented):<br /><br />[code]inc c / dec c ; does nothing useful<br />dec hl ; decrease hl - it did contain a pointer to item #3 index*, it now contains a pointer to item #2 quantity<br />inc [hl] ; increase the memory address pointed to by hl - in this case item #2 quantity<br />ret[/code]<br /><br />* All bootstrap code to jump to item #3 that i&#039;ve seen puts &lt;address of item #3&gt; in hl and then does jp hl.<br /><br />If you had Ice Heal x43, Burn Heal x43, Full Heal x201 it&#039;d increase the index number of item #2.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Quibz link=topic=6638.msg198567#msg198567 date=1432350321]<br />Thanks Wack0. So it&#039;s safe to use then?<br />[/quote]<br />Yes.


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheZZAZZGlitch
icon: clip
body:
  [quote]I think it&#039;s important to know, so I have just asked TheZZAZZGlitch on Youtube if he can look into where the pointer comes from.[/quote]<br /><br />I decided to leave my answer here, since it may be useful for some people.<br /><br />Move name table in Gen I has an unusual structure - instead of using fixed-width fields (which would have been a lot more stable), programmers decided to store move names one after another, separated with an end string character (0x50):<br />[tt]<br />[color=black][b]004000[/b][/color]&nbsp; 8F 8E 94 8D 83 [color=red]50[/color] 8A 80 91 80 93 84 7F 82 87 8E&nbsp;  POUND[color=red]#[/color]KARATE CHO<br />[b][color=black]004010[/color][/b]&nbsp; 8F [color=red]50[/color] 83 8E 94 81 8B 84 92 8B 80 8F [color=red]50[/color] 82 8E 8C&nbsp;  P[color=red]#[/color]DOUBLESLAP[color=red]#[/color]COM<br />[b][color=black]004020[/color][/b]&nbsp; 84 93 7F 8F 94 8D 82 87 [color=red]50[/color] 8C 84 86 80 7F 8F 94&nbsp;  ET PUNCH[color=red]#[/color]MEGA PU<br />[b][color=black]004030[/color][/b]&nbsp; 8D 82 87 [color=red]50[/color] 8F 80 98 7F 83 80 98 [color=red]50[/color] 85 88 91 84&nbsp;  NCH[color=red]#[/color]PAY DAY[color=red]#[/color]FIRE&nbsp;  <br />[/tt]<br />To get the name pointer for a move with index number X, the game finds the Xth 0x50 character starting from address $4000 (this is where the table is loaded during the process), and returns the address to the string that&#039;s located before it.<br /><br />So for move 0x01, it returns $4000, for move 0x02 returns $4006, etc.<br />It works OK, until we try to get the name pointer for an out of bounds move, be it Super Glitch or Cooltrainer. Cooltrainer move is index 0x00, but because a standard &quot;subtract one, check if zero&quot; loop is used in the subroutine, the move index that the procedure actually searches for is 256.<br /><br />The last valid move, with index number 0xA5, is Struggle. After that, the entire ROM page is filled with 0x00 bytes:<br />[tt]<br />[b]004600[/b]&nbsp; 88 93 94 93 84 50 92 93 91 94 86 86 8B 84 50 00&nbsp;  ITUTE#STRUGGLE#.<br />[b]004610[/b]&nbsp; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&nbsp;  ................<br />*snip*<br />[b]007FF0[/b]&nbsp; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&nbsp;  ................<br />[/tt]<br /><br />We can already predict that the Super Glitch move 0xA6 will have it&#039;s name pointer at $460F, right after Struggle. This makes 0xA6 the only Super Glitch move that will cause memory corruption every time, since its name points to a constant ROM location.<br /><br />If the index number is greater than 0xA6, we enter the territory of undefined behavior. The entire memory space following the ROM sections (VRAM, SRAM, WRAM in order) will be searched as if it was the move name table. Where the pointer lands is dependent on the number of 0x50 bytes in the RAM.<br /><br />Our journey starts at VRAM. On real console it would be very unlikely to find too many 0x50 characters there, because VRAM is only accessible for short periods of time (during the vBlank interrupt to be exact) and any attempt of blindly reading VRAM contents will most commonly return a 0xFF byte, regardless of what is actually there.<br /><br />Older versions of VBA do not emulate VRAM inaccessiblity, so on VBA move 0xA7&#039;s name is &quot;qq&quot;, because of this pattern in VRAM at address $83C5:<br />[tt]<br />[b]0083C0[/b]&nbsp; 00 00 E0 E0 50 B0 B0 50 58 A8 AC 54 56 AA 0E F6 ...<br />&nbsp; &nbsp; &nbsp; &nbsp; -------------- ******** ---------------------------<br />&nbsp; &nbsp; &nbsp; &nbsp; 0xA6&#039;s name&nbsp; &nbsp; 0xA7&#039;s&nbsp;  0xA8&#039;s name<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  name<br />[/tt]<br /><br />On BGB (and real console), the finishing 0x50 byte at $83C7 is not read, causing Super Glitch effects:<br /><br />[img]http://i.imgur.com/6OPqcFH.png[/img]<br /><br />Besides 0xA7, almost no moves have their pointers in VRAM, since most of the bytes in VRAM are read as 0xFF.<br /><br />From now on, I will be specifically focusing on Cooltrainer move&#039;s name pointer, and how to predict its location.<br /><br />Next, the search passes through SRAM. In battle, this block of memory is used to decompress sprites. So where the search ends is also slightly determined by the opposing Pokemon&#039;s sprite. This is why Cooltrainer sometimes does not work against a specific Pokemon, but happens to work in a different battle against a different Pokemon.<br /><br />The biggest influence on Cooltrainer&#039;s name pointer comes from the game&#039;s RAM, and the number of 0x50 bytes in there. Statistically, the search has the biggest chance of stopping in a RAM block which contains a lot of text strings, as every text string in RAM has to end with a 0x50. This explains why Cooltrainer move&#039;s name pointer often lands in memory blocks responsible for storing Pokemon or trainer names. Probably the biggest memory block with lots of text strings is $DD00 - $DF00, which contains nicknames and OT names for Pokemon in the current PC box. Which is why I suggest changing around the PC box if the Cooltrainer move does not work.<br /><br />Of course, every action which will lead to increasing/decreasing the number of 0x50 bytes in memory will change the name pointer and increase the likelyhood of the Cooltrainer move working. You could fill your inventory with Ethers x80, have a full team of level 80 Slowbros, give all your Pokemon 10-letter names, and so on.<br /><br />Because the memory blocks at $D300 and $DD00 have the biggest concentration of 0x50 bytes, the name pointer will probably land between those two locations. Here are some ways to predict and control where the pointer will land (note that this is all derived from fuzzy logic and may not apply every time):<br /><br />- If you didn&#039;t ever nickname any Pokemon in your party, the pointer will probably be at your party Pokemon data. If the Pokemon is never nicknamed, its name is fully padded with 0x50 bytes to 10 characters (unnamed MEW is in fact named &quot;MEW[x50][x50][x50][x50][x50][x50][x50]&quot;), and the excess 0x50 characters cause the name pointer search to end earlier. If you nicknamed all Pokemon in your party, the pointer will probably be at boxed Pokemon data.<br /><br />- If you fought a trainer before encountering a wild Pokemon, the pointer will probably land somewhere between $D900 - $DB00. This is because in a trainer battle addresses $D9AC - $DA2F are populated with Pokemon names and trainer names, increasing the number of 0x50 characters between $D300 and $DD00.<br /><br />- If you want the Cooltrainer move memory corruption to work, my idea is: fill your box with a good amount of hex 0x50 Missingnos, and give a nickname to all Pokemon in your party. Hopefully the name pointer will then land somewhere in the $DA00 range, and then the 0x50 characters are separated from each other by 20 bytes, so the invalid name doesn&#039;t get terminated too early.<br /><br />- Another (way easier) way would be renaming all Pokemon in your party, and switching your box to an empty, never used one. This will cause the pointer to slide all the way down to echo RAM ($E000+).<br /><br />To see how the name pointer behaves, I wrote a small LUA script for use on VBA. It calculates the name pointer for the Cooltrainer move and displays it to the screen every frame. I included it as an attachment.


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=6992.msg198562#msg198562 date=1432289037]<br />Alright ! Let me know if he gets something.<br /><br />I honestly forgot about that cable club glitch, yes it&#039;s a good solution. However I did not know that new arbitrary code execution method in yellow using pikachu. You publish too many videos for me to have the time to watch them all&nbsp; :P it&#039;s a very interesting glitch, I hope I will have the time to work on it soon so I could add it to PRAMA.<br /><br />Thanks again !<br />[/quote]<br /><br />You&#039;re welcome. I wish you good luck for when you get around to it.<br /><br />TheZZAZZGlitch: Thank you very much. That looks very helpful.


subject: Re: Reddit leaks Viet Crystal box and manual
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Excellent, was waiting to see this ever since I came across [url=http://forums.glitchcity.info/index.php/topic,6982.0.html]the NFO of Viet Crystal[/url].


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]Next, the search passes through SRAM. In battle, this block of memory is used to decompress sprites. So where the search ends is also slightly determined by the opposing Pokemon&#039;s sprite. This is why Cooltrainer sometimes does not work against a specific Pokemon, but happens to work in a different battle against a different Pokemon.[/quote]<br /><br />Wouldn&#039;t the SRAM be closed (i.e. 0xFF) when you are attempting to use/view cooltrainer&#039;s name?


subject: Re: CoolTrainerâ™€ (and non hex:00 Super Glitch) yields documentation thread
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello TheZZAZZGlitch !<br /><br />Thank you for those very clear explanations. I now understand well how the glitch works, and how to maximize the chances to make it work. <br /><br />If it&#039;s ok for you, I&#039;d like to publish your script on the article I am currently writing for my website (http://prama-initiative.com/). I think it might help the readers to understand where the problem is, if they couldn&#039;t get the corruption to occur. :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello,<br /><br />I was thinking about the invalid encounter flag method to get 8F. Obviously you turn hex:4D (Good Rod) to hex:5D (8F). This method to get an item seems a little rough (especially if you can perform the cooltrainer corruption, that means you should be able to trigger item underflow which is an easier way to get an item) but it still have some interest. Does that mean you could use the cooltrainer corruption to get ANY item ?


subject: Re: Yellow Disassembly
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Crystal_ link=topic=7278.msg198565#msg198565 date=1432311840]<br />Which kind of differences cannot be fit into an ifdef though? <br />[/quote]<br /><br />It would require a lot of ifdefs to have pokeyellow buildable through pokered. It&#039;s mostly because many files have been even slightly modified, and making ifdefs for every simple modifications would be too messy. At that point, it would be better to just make pokeyellow another disassembly entirely.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The Pokemon used to get 8F through Cooltrainer distort can only mutate items up to index 0x5F, or the glitch item 10F. So no, you cannot use Cooltrainer corruption to get any item.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Doom Mortal
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello everyone,<br /><br />first I want to thank all of you guys who contributed to that amazing discovery, especially TheZZAZZGlitch I want to thank. <br /><br />Im currently trying to manipulate the move of the first Pokemon in the Box.<br />But it doesnt work. After using the 8S the first move of the Pokemon is Tm08.<br /><br />The GSCode to do that I have successfully tested with an Emulator.<br />Im playing the german Pokemon Blue Version.<br /><br />Here are the GSCodes:<br />01|69|9E|DA English<br />01|69|A3|DA German<br /><br />I have converted the GSCode into the Pattern that Wack0 [url=http://link]http://forums.glitchcity.info/index.php/topic,6638.msg189609.html#msg189609[/url] has posted.<br /><br />Here is my code:<br />[code]<br />Any Item<br />8F<br />Lemonade&nbsp; &nbsp; &nbsp;  x105<br />X-Accuracy&nbsp; &nbsp; &nbsp;  x163<br />Carbon	&nbsp; &nbsp; &nbsp; &nbsp; x218<br />Pokeball	&nbsp; &nbsp; &nbsp; &nbsp; x119<br />Fresh Water	x201<br />[/code]<br /><br />What is wrong with with the code ?<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Doom Mortal link=topic=6638.msg198580#msg198580 date=1432583262]<br />Yes it is the right quantity of Lemonade.&nbsp;  :(<br />[/quote]<br /><br />That&#039;s odd.<br /><br />0x69 = 0b01101001<br />0xD0 (identifier of TM08 move) = 0b11010000<br /><br />Are you able to set a breakpoint on write to $DAA3 and then use 8F?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Found part of the problem.<br /><br />The address for wNumBagItems is $d31d in English Pokemon Red/Blue. In the German version, it seems to be $d322.<br /><br />The pseudo-gameshark code jumps to d322, which is wNumBagItems in German. I don&#039;t have a method to change the bootstrap to jump to the third item, however.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: luckytyphlosion
icon: xx
body:
  Also something unrelated to the above problem: A very compact 8F bootstrap that can be achieved WITHOUT ACE!<br /><br />[u][font=verdana][b][size=16pt]Compact 8F Setup[/size][/b][/font][/u]<br /><br />[u][b]PokÃ©mon in Party:[/b][/u]<br />[tt]6 Pokemon<br />&lt;Anything&gt;<br />Tentacool<br />Electabuzz<br />&lt;Anything from here on&gt;<br />[/tt]<br /><br />Once you have the necessary PokÃ©mon, do either one of the below options:<br /><br />[font=verdana][u][b]Cheating method:[/b][/u][/font]<br />Set D91C/E/F to C324D3<br /><br />[font=verdana][u][b]Not Cheating method:[/b][/u][/font]<br />* Setup Inventory to this, from the top:<br /><br />[code]Great Ball x155<br />TM09 x0<br />Antidote x195<br />Protein x211<br />Ether x80[/code]<br /><br />[u][b]TEXTCODE:[/b][/u]<br />[code]WRA1:D320 03 9B D1&nbsp; &nbsp; &nbsp; &nbsp;  ; repoint text to address d19b<br />WRA1:D323 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ; print a string<br />WRA1:D324 0A C3 24 D3 ; print characters 0A, C3, 24, and D3 to address d19b. 0A does not matter.<br />WRA1:D328 50&nbsp; &nbsp; &nbsp;  ; end text printing mode<br />WRA1:D329 50&nbsp; &nbsp; &nbsp;  ; end text command mode&nbsp; [/code]<br /><br />* Then, acquire item underflow, either with the Dry Underflow method or the Fresh Water/Fossil Method.<br /><br />* Go to Route 6.<br /><br />* Swap a Repel x211 into the Text Pointer slot (Represented by TM01 x80)<br /><br />* Talk to the guy talking to the girl.<br /><br />* You now have a working compact 8F setup, as long as you have 6 Pokemon in the Party, and the specially crafted Tentacool and the Electabuzz are in the 2nd and 3rd slot respectively.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=luckytyphlosion link=topic=6638.msg198584#msg198584 date=1432682435]<br />Found part of the problem.<br /><br />The address for wNumBagItems is $d31d in English Pokemon Red/Blue. In the German version, it seems to be $d322.<br /><br />The pseudo-gameshark code jumps to d322, which is wNumBagItems in German. I don&#039;t have a method to change the bootstrap to jump to the third item, however.<br />[/quote]<br /><br />[url=http://forums.glitchcity.info/index.php/topic,6638.msg192543.html#msg192543]I posted one earlier in the thread[/url]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I had the same problem with my french game. See [url=http://forums.glitchcity.info/index.php/topic,7265.msg198432.html#msg198432]this post by Torchickens[/url] about the fact that you have to add 5 to any RAM address in european versions :)


subject: Combining 8F item with link cable hacks
poster_name: phasip
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: phasip
icon: xx
body:
  Hey!<br />This may not be your traditional glitch - but I hope it is welcome here anyway.<br />I have playing with hacking the pokemon red for gameboy color through a link cable. (https://github.com/Phasip/PokemonLinkHack)<br />Currently I have been using the BGB emulator to play with and a buspirate to connect to a real gameboy.<br />I think a raspberry pi with a 10kOhm resistor voltage drop should be usable too.<br /><br />Using a link cable one can get a 8F item by placing a old rod in the 4th item slot and trading Missingno pokemons to modify it to 8F.<br />Pokemons containing executable code can simply be traded - allowing for ~32 byte code execution.<br />Additional code can be transferred through the link cable (via pokemon with serial recv and execute code)<br /><br />No new hacks are used. Though the link cable has a &quot;patch list&quot; which allows for bytes a bit further than the end of the opponent trainer list to be set to 0xFE. Though apart from game time and number of pokemons in box, no reachable address seems usable.<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Doom Mortal
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Sorry for that delay. I was preparing the Pokemon team and items on my PC for testing with the debugger.<br /><br />But I see you were all on the right way.<br /><br />I substituded Onix by Graveler and now it works.<br /><br />It is weird because I tested the old constelation successfully with an MAX DV/ EV Item List.<br /><br />Thank you very much Wack0, luckytyphlosion, Krys3000.&nbsp; :D<br /><br /><br />


subject: [RBY] Trainer fly glitch disappearing item
poster_name: Trevor
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi everybody :)<br /><br />in Pokemon Blue I used the Trainer fly glitch in combination with the &quot;Ditto Trick&quot;, to get pokemon battles.<br />I always encountered the dittos on route 15, east from fuchsia city, everything worked normal.<br /><br />Then I realized that the item TM20 that should be on that route, but it wasn&#039;t there, and I am 100% sure I didnt pick it up before.<br />So using the glitch on that route must have made the item disappear.<br /><br />So now I am curious to find the answers for these 2 questions:<br />1. How can such a thing happen, and did anybody else experience this before?<br />2. How can I now obtain TM20, is there a &quot;fix&quot; for that bug, or a general &quot;generate item by ID&quot; glitch?<br /><br />Thanks in advance


subject: Re: Combining 8F item with link cable hacks
poster_name: phasip
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: phasip
icon: xx
body:
  Heyho!<br /><br />So, I found the 0x7A item - Allows us to jump to 0xFA58.<br />FA58 is wired to DA58 - which is four bytes into the daycare pokemons original trainer name -<br /><br />Using 8F and the serial transfer we can run the code<br />[code]push hl<br />ld hl,D31E ;First item<br />ld (hl),7a ;Set to 7a<br />inc hl<br />ld (hl),63 ;Set to 7a<br />ld hl,DA58 ; Daycare OT<br />ld (hl),18 ; Jump<br />inc hl<br />ld (hl),40 ; To DA9a<br />pop hl<br />ret[/code]<br />Which changes the first item in our inv to 0x7A and fixes the bytes in daycare to jump to fourth byte of first pokemon in current box.<br /><br />So, boxed pokemons don&#039;t have as much data - but some.<br />What we can do is box a first pokemon with the code:<br />[code]ld a,08 ;Bank to switch to<br />call 35bc ;Bankswitch<br />ld hl,da80 ;Pokemon location<br />call 56be ;Listpokemon<br />call 35cd ;Bankswitchback<br />ld hl,DA9a<br />ld a,(cc2b) ;chosen in listpokemon<br />ld b,00<br />ld c,21<br />call 3a87 ;AddNTimes<br />jp (hl)[/code]<br />( 180000003E08CDBC352180DACDBE56CDCD35219aDAFA2BCC06000E21CD873AE900 00...)<br />Which lists the names of the &quot;programs&quot; in selected box and jumps to the fourth byte in the selected pokemon.<br /><br />Bam! Now we can install and run programs.<br /><br />Edit.<br />I guess I should mention that all of this has only been tested on my pokemon blue (english), and offsets have been found at https://github.com/iimarckus/pokered/blob/master/wram.asm <br />Edit2:<br />Noticed that I said FA instead of 7A ...


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Mewtwo is one of the lighter characters, but that doesn&#039;t mean he&#039;s mediocre. His combo potential is just endless, and his air game is just insane. I mean this dude can dish out 25 percent with just down tilt to up smash. He get&#039;s ko&#039;d pretty early but he&#039;s still a very good character. And shadow ball can&#039;t hurt when charging but also got buffed in that it can now be used as a recovery saving your second jump, side b, and up b for mix ups if they challenge you in the air. Also like yoshi he keeps his momentum when you cancel out his second jump to an attack, which makes his down air a reliable spike, his neutral air a great engage, forward air can combo with itself, and back air to make it safely on stage.<br /><br />C tier at worst<br />but B tier at best<br /><br />also i&#039;m going to have to side with bert on this one.<br />stop with that word, it&#039;s ignorant.


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Zowayix
icon: xx
body:
  Well, I guess my secondary (to complement my main man Ganondorf) is either Dong or Jigglepuffs. I like Dong&#039;s range and Spinning Kong and spikeitude but the timings and such of his moves seem like they&#039;ll need a bit getting used to. Jigglypuff I already main in Melee just fine, though that&#039;s part of my problem that I don&#039;t want to accidentally ruin my Melee Jiggs play (because I dunno who else to main there) like I&#039;ve done with Brawl Marth and SSB4 Ganon. I do like Jiggs in this game though, plays the same as Melee though sadly nowhere near as good, and you spam forward air instead of back air. In terms of being a secondary she doesn&#039;t have the same playstyle as Ganon (like Dong does) so probably good for covering matchups, and I like Rest having a better hitbox though I don&#039;t know if it doesn&#039;t come out on frame 1 anymore. Anyway, I guess she&#039;s just fun. It might turn out that she can be played in both Melee and SSB4 without screwing up one or the other, like how I seem to be able to use Pikachu across all games if I can get myself to stop compulsively Thundering in SSB4 and Quick Attack Cancelling (trying to) in Melee.<br /><br />[quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=7086.msg198593#msg198593 date=1432998193]<br />Mewtwo is one of the lighter characters, but that doesn&#039;t mean he&#039;s mediocre. His combo potential is just endless, and his air game is just insane. I mean this dude can dish out 25 percent with just down tilt to up smash. He get&#039;s ko&#039;d pretty early but he&#039;s still a very good character. And shadow ball can&#039;t hurt when charging but also got buffed in that it can now be used as a recovery saving your second jump, side b, and up b for mix ups if they challenge you in the air. Also like yoshi he keeps his momentum when you cancel out his second jump to an attack, which makes his down air a reliable spike, his neutral air a great engage, forward air can combo with itself, and back air to make it safely on stage.<br />[/quote]<br />I&#039;m mostly salty because his tail hitboxes make no fucking sense, but the general consensus seems to be that he gets rekt by speedy rushdown types like Pikachu and Sheik. Otherwise I can agree with that tier placement.<br /><br />[quote]<br />also i&#039;m going to have to side with bert on this one.<br />stop with that word, it&#039;s ignorant.<br />[/quote]<br />Why? What&#039;s so bad about a particular word in that context? How does simply saying a word have anything to do with ignorance anyway?<br /><br /><br /><br />Also why the hell is Yoshi so god damned annoying? Why do I seem to have trouble with him more than say Diddy or Sheik? Do the characters I play have worse matchups against him than other top/high tiers? What the hell were they thinking with that fucking neutral B and that overly high priority Egg Throw? Am I just fucking salty? Do I need to get gud scrub? Why did I ask those last two if I know the answer is yes to both?<br /><br />And Lucina, even though I know she&#039;s a load of shit and probably one of the lowest in F tier. I guess it&#039;s because I end up being an aggressive player and she just counters my dick off every time, and I need to grab more often. Still though, I don&#039;t seem to have that much of a problem with stuff like Shulk or Little Mac who have better counters. It&#039;s probably also because the AI has its own characters who it&#039;s good and bad with, and Lucina is one of those characters who it&#039;s good with. I should really get onto Anther&#039;s Ladder, or figure out why the fuck I have a VDSL2 connection and get fucking lag in For Glory. Like 1 fucking whole second before it recognises my inputs and then I Wizard Foot off the stage when I just inputted a fucking Flame Choke lag. Wonder if that third party LAN adapter is just a load of shit. Guess I should get back into 3DS online and see how I go, or play something like Mario Kart 8 which I don&#039;t think has the same peer to peer shit, but then it&#039;s a shitty game where lag doesn&#039;t even matter so it&#039;s not a good benchmark.


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7086.msg198594#msg198594 date=1433007954]<br /><br />Also why the hell is Yoshi so god damned annoying? Why do I seem to have trouble with him more than say Diddy or Sheik? Do the characters I play have worse matchups against him than other top/high tiers? What the hell were they thinking with that fucking neutral B and that overly high priority Egg Throw? Am I just fucking salty? Do I need to get gud scrub? Why did I ask those last two if I know the answer is yes to both?<br /><br /><br />And Lucina, even though I know she&#039;s a load of shit and probably one of the lowest in F tier. I guess it&#039;s because I end up being an aggressive player and she just counters my dick off every time,<br />[/quote]<br />Yoshi is high tier in japan for a reason. Down aerial is horrendously broken, you can&#039;t mash out of egg, and he got back his super armor on his second jump which he needs tbh. Dorf probably isn&#039;t the best pick against the yoshster, but if you must i have a few tips for ganon and hopefully some of these will help out<br /><br />Up smash is the best bait in smash 4 hands down. It has very few end frames so you can IMMEDIATELY follow up with a side tilt or even a well timed warlock punch (side tilt is more reliable tho) <br /><br />Side b is broke, just predict what they will do when they are on the ground and you can use this practically infinitely. If you don&#039;t want to bother, side b to down tilt hits pretty consistently. <br /><br />warlock is only good on the ground, but it&#039;s usually not worth your time throwing out, down b is trash, and up b should pretty much be used for recovery only.<br /><br />If they&#039;re in the air, remember up aerial is your bestest friend in the whole wide world, it has the range of falcon&#039;s so it covers a lot of space. Down aerial is obviously good because spike, and fwd and back air are pretty underated ko moves imo.<br /><br />shield + a = insta punish on any character<br /><br /><br />and these tips should help with lucina matchup as well. Dorf hits harder than a semi, so if you&#039;re down in the percent wars don&#039;t freak you just have to land a few hits to get back on track. <br /><br />


subject: Minecraft Fans?
poster_name: PokeGlitchFanatic
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  wow this is awesome I have a Minecraft gift code and I can&#039;t believe it actually worked! I got it at <br /><br />[color=blue](Edit by Torchickens: Link removed, see my reply)[/color]


subject: Re: Combining 8F item with link cable hacks
poster_name: vaguilar
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Interesting stuff. I also investigated something similar and found a buffer overflow when printing out the Pokemon party in the Cable Club. It allows you to execute whatever program you send in the patch list. More info here if you&#039;re interested http://vaguilar.github.io/posts/1/


subject: PokÃ©mon Super Mystery Dungeon!
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Weee!<br /><br />[url=https://www.youtube.com/watch?v=lS8JwdD-VPk]Mini-Nintendo Direct trailer.[/url]<br /><br />Known info so far:<br />1. 720 PokÃ©mon (poor, poor Volcanion) are in the game, instead of 140something like in Gates to Infinity,<br /><br />2. Still no personality quiz, but there are 20 starters to choose from, including Pikachu and Riolu,<br /><br />3. Hunger appears to be back,<br /><br />4. Is due to be released in Japan in September 2015, and in winter 2015 for America and Canada, and early 2016 for everywhere else.<br /><br />So I&#039;m kinda hyped for this, and I really hope you can level up your moves like in Gates to Infinity. Hopefully the plot will lay of the melodrama this time.


subject: Re: Combining 8F item with link cable hacks
poster_name: phasip
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: phasip
icon: xx
body:
  Nice writeup! Was looking for similar work but didn&#039;t find this or the spoofing post - I guess I need to work on my google-fu.<br />I realized there was a problem with strings, but I assumed I would have to mess upp too much of the games memory to be usable.<br /><br />Will try to use this hack to get the 7a item faster.<br />Btw, the code above is not completely correct - will try to get stuff up on github later.<br />--Edit--<br />Cleanup done, code is nice and uses the exploit to install 7a. 


subject: Re: Minecraft Fans?
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow this is awesome I locked the thread! Also &gt;getting free vidya games<br /><br />Has that _ever_ been legitimate?


subject: Re: Minecraft Fans?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  PokeGlitchFanatic, I don&#039;t believe it&#039;s best to link to anywhere like that because of the questionable legality and a thread with just the link may be considered spam.<br /><br />But if you want to start a new thread about Minecraft in relation to what you think about the gameplay, etc. then you may.<br /><br />[quote author=Zowayix link=topic=7286.msg198600#msg198600 date=1433246082]<br />Wow this is awesome I locked the thread! Also &gt;getting free vidya games<br /><br />Has that _ever_ been legitimate?<br />[/quote]<br /><br />I don&#039;t like the way you put this. It sounds mean. She may have just wanted to start a discussion about Minecraft. There was nothing in the thread other than the link, yes. But please be more respectful next time because they probably just made a mistake.<br /><br />[quote author=Abwayax link=topic=88.msg882#msg882 date=1143397159]<br />[list][li]Do not act rude towards users who make mistakes, particularly new users. See [url=http://forums.glitchcity.info/index.php/topic,4646.0.html]this[/url] for an explanation.[/li][/list]<br />[/quote]


subject: Re: Minecraft Fans?
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7286.msg198601#msg198601 date=1433254840]<br />PokeGlitchFanatic, I don&#039;t believe it&#039;s best to link to anywhere like that because of the questionable legality and a thread with just the link may be considered spam.<br /><br />But if you want to start a new thread about Minecraft in relation to what you think about the gameplay, etc. then you may.<br /><br />[quote author=Zowayix link=topic=7286.msg198600#msg198600 date=1433246082]<br />Wow this is awesome I locked the thread! Also &gt;getting free vidya games<br /><br />Has that _ever_ been legitimate?<br />[/quote]<br /><br />I don&#039;t like the way you put this. It sounds mean. She may have just wanted to start a discussion about Minecraft. There was nothing in the thread other than the link, yes. But please be more respectful next time because they probably just made a mistake.<br /><br />[quote author=Abwayax link=topic=88.msg882#msg882 date=1143397159]<br />[list][li]Do not act rude towards users who make mistakes, particularly new users. See [url=http://forums.glitchcity.info/index.php/topic,4646.0.html]this[/url] for an explanation.[/li][/list]<br />[/quote]<br />[/quote]<br /><br />Didn&#039;t mean to come off as rude, my b. The combination of the topic and title came across to me as something like a spambot would make her say, which luckily I know she isn&#039;t because she&#039;s posted before (but malware may be involved), if not something a human would say if accidentally scammed into becoming part of some kind of Minecraft pyramid scheme. But it didn&#039;t look like it was &#039;Hey everyone I like Minecraft, oh and by the way here&#039;s this link.&#039;


subject: Re: The Member's Guide to Topiclessness
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  because i can&#039;t reply on locked topics i will just post this here:<br />in regards to &quot;Minecraft fans?&quot;<br /><br />to be honest I thought zowayixs post was pretty funny...<br />and i have to agree it did sound like something a spam bot would say.<br /><br /><br />


subject: Re: Combining 8F item with link cable hacks
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  This sounds very nice. It reminds me of [url=https://www.youtube.com/watch?v=e8CO_e_rKd8]what TheZZAZZGlitch did for PokÃ©mon Crystal[/url].<br /><br />I might look into your methods and do some PokÃ©mon link hacking too one day. :)<br /><br />Did you know [url=http://forums.glitchcity.info/index.php/topic,6638.msg196498.html#msg196498]that -g m (hex:6A) points to DA47[/url]? So that&#039;s another item for a stored PC bootstrap code instead of a party PokÃ©mon bootstrap code.


subject: Re: PokÃ©mon Super Mystery Dungeon!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I might try this one. I skipped Gates to Infinity so it&#039;s been a while since I&#039;ve got into Mystery Dungeon.


subject: Re: [RBY] Trainer fly glitch disappearing item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi Trevor, welcome to the forums!&nbsp; :D<br /><br />1. I&#039;m not exactly sure what might have happened if the TM20 disappeared and didn&#039;t go into your inventory I&#039;m afraid.<br /><br />It reminds me that you are able to get items in item balls (but without a jingle) if you bring up a specific text box other than the start menu before returning to the route you escaped from. You can pick up the item and it will be added to your inventory even if you have already obtained it.<br /><br />How it works is that the game brings up a text box for the new map with the same ID as the text box from the previous map, so an ID that may be a sign or NPC in one map may be an item ball in another.<br /><br />For instance, if you do the long-range Trainer glitch in Viridian Forest, enable the ability to get an encounter (with a Trainer, or by changing boxes/selecting the same box through change box, then resetting and being guided by the museum guy), then if the last text box ID was 08 (e.g. the Pewter City sign) you will pick up a Potion when you return to Viridian Forest. If you do not use up any Trainers, then you can keep getting Potions (infinitely?) each time you repeat the glitch.<br /><br />Here is a video.<br />https://www.youtube.com/watch?v=eJwq8N2QdF0<br /><br />2. You can generate items with TheZZAZZGlitch&#039;s [url=https://www.youtube.com/watch?v=98_azamLeh4]looping map trick[/url] that requires an expanded items pack.<br /><br />The easiest way to get an expanded items pack is to get an item stack x255 and an item with ID greater than the Celadon City x boundary (e.g. X Special x255) using a glitch called [url=https://www.youtube.com/watch?v=ZyppANEvnh8]dry underflow[/url].<br /><br />A stack of x255 can easily be achieved in Red and Blue with the old man trick (once you get a x129 stack, toss 2 and encounter another Missingno. to get x255).<br /><br />If you are using PokÃ©mon Yellow, you could try the Ditto trick to encounter a stable Missingno. (Special 182-184) - as regular Yellow Missingno. very often freezes the game. It can duplicate your sixth item by 128 perfectly upon encounter, just like regular R/B/Y Missingno. In order to get the x255 stack without having to do a Trainer-Fly again; make the sixth item a certain usable item other than a PokÃ© Ball such as a Potion, then use it twice to get x127 in the sixth slot and capture it, as capturing the PokÃ©mon will make the sixth item become duplicated (sets the encountered flag).<br /><br />Another option if you have a link cable is to use the [url=https://www.youtube.com/watch?v=JgVUZPTt21E]Cable Club escape glitch[/url] with a stable Missingno.<br /><br />If you are out of options, you can try [url=https://www.youtube.com/watch?v=evdxp0UgunQ]Pikachu off-screen arbitrary code execution[/url] (which can be performed with one Game Boy regardless of your progress) to get the expanded items pack, but it takes time as my non-TAS method stands (fighting many PokÃ©mon).<br /><br />--<br />I had a think about if it was possible to do the glitch I described in 1 to get the TM20.<br /><br />The TM20 item ball is ID 0B. If you are able to set up a Trainer-Fly on Route 15, that means you can talk to the Route 14 sign (as it is also ID 0B) before returning to the route, and that may mean you would be able to get the TM20.<br /><br />I&#039;m not aware of any long-range Trainers on that route, even though setting one up may be possible with &quot;Rival&#039;s effect&quot; glitch item (such as hex:94) that lets you hide a Trainer so that you can escape even if they aren&#039;t a long range Trainer. You could also manipulate item 118 identifier (representing D625/D624; the Route 15 map script) in an underflowed PC box to 1. Unfortunately the item with an identifier of 01 is the Master Ball, and to get a Rival&#039;s effect item or an underflowed PC, you would likely have to perform dry underflow on the way, in which case you probably would be better off generating the item.<br /><br />[img]http://i2.minus.com/iiGdVg5qGQPF8.png[/img]<br /><br />Hope this helps.


subject: Re: Minecraft Fans?
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  Yeah, it&#039;s a spam/scam type of deal. The site generates a spam message for someone to post in multiple places, and if the user does so (the page claims it can check if you&#039;ve posted the message, although I&#039;m not sure how that works), then the site claims to give out some kind of &quot;Minecraft code.&quot; The site presumably makes money by getting people on the internet to link to it, to increase ad traffic and Google rankings.<br /><br />It does look like some sort of scheme, not legit in the least, so I&#039;m not going to penalize PokeGlitchFanatic for falling for it. I just realized though that although we have a rule about being nice to people, we don&#039;t have one against spamming. Maybe we just never needed one?


subject: Re: The Member's Guide to Topiclessness
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=3088.msg198604#msg198604 date=1433287331]<br />because i can&#039;t reply on locked topics i will just post this here:<br />in regards to &quot;Minecraft fans?&quot;<br /><br />to be honest I thought zowayixs post was pretty funny...<br />and i have to agree it did sound like something a spam bot would say.<br /><br /><br /><br />[/quote]<br /><br />I sounded like a spam bot?<br /><br /><br />In all honesty I wasn&#039;t trying to be funny or even come across as disrepectful, just I forgot to turn my smartarse mode off, and by that I mean I have no smartarse off state.


subject: Re: PokÃ©mon Super Mystery Dungeon!
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I might try this one also... maybe. I&#039;ll first need to be convinced that it doesn&#039;t suck huge amounts of balls like PMD2 did.


subject: Re: PokÃ©mon Super Mystery Dungeon!
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7287.msg198607#msg198607 date=1433296067]<br />I might try this one. I skipped Gates to Infinity so it&#039;s been a while since I&#039;ve got into Mystery Dungeon.<br />[/quote]<br /><br />Am I the only person here who actually liked Gates to Infinity?<br /><br />...Well, I enjoyed the storyline at least.


subject: Re: Really bad jokes
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Zowayix
icon: xx
body:
  I&#039;ve been sleeping poorly lately, which does wonders for my creation of bad puns, and other jokes which aren&#039;t puns but still suck. I almost forgot about this thread.<br /><br />Where do data types go to swim?<br /><br />At the bool.<br /><br />[hr]<br /><br />What was the NES game where you played as an indifferent blue robot who gains powers from defeated enemies?<br /><br />Meh-ga Man.<br /><br />[hr]<br /><br />Why didn&#039;t Rick Astley&#039;s desktop publishing software sell very well?<br /><br />Because what you see is what you don&#039;t get.<br /><br />[hr]<br /><br />A man walks into a bar and orders a beer.<br /><br />Then he died.<br /><br />[hr]<br /><br />Playing Animal Crossing, palms are sweaty<br />Knees weak, arms are heavy<br />Vomit on the power button already<br />Mr. Resetti<br /><br />[hr]<br /><br />What do you call invisible radiation with longer wavelengths than normal light that I should go to instead of inventing convoluted puns?<br /><br />Infrabed.<br /><br />[hr]<br /><br />What does an English teacher sleep on?<br /><br />A grammattress.<br /><br />[hr]<br />[Posted to le Reddit on Easter]<br /><br />Despite being a religious holiday today, there are no jokes about convents. Nun whatsoever.<br /><br />[hr]<br /><br />When will all these jokes about Turning machines come to an end?<br /><br />You can&#039;t really know for sure.<br /><br />[hr]<br /><br />Infamous web entrepreneur and winner of Time Magazine&#039;s Most Influential Person of the Year 2009 award Christopher Poole (aka moot) has passed away aged 26.<br /><br />It&#039;s a very un-4chan-ate tragedy.<br /><br />[hr]<br /><br />What do you call Japanese robot singer meat?<br /><br />Hatsune Niku.<br /><br />[hr]<br /><br />What do you call cow meat which beeps? <br /><br />Beepf.<br /><br />[hr]<br /><br />What kind of mayonnaise do aliens use?<br /><br />Ayy lmayo.<br /><br />[hr]<br /><br />What do you call a mystery novel about a murdered cow?<br /><br />A moo-dunnit. 


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Metarkai solved part of the mystery guys! The curtains are influenced by the data of PokÃ©mon at slots 4-6 of box 8 of the PC! Earlier slots represent pixels higher up, later ones represent pixels lower down.<br /><br />Removing PokÃ©mon 4-6 removed the curtains, or if I just had slot 6; then only a lower part of the window was corrupted.<br /><br />[img]http://i3.minus.com/iIVQ20GSZ7iZF.png[/img]<br /><br />If you use the anti-DMA code B2809E31 3CEF5320 1C7B3231 B494738C; then memory addresses 0202DAE4-0202DB43 always represent curtain pixel data. Each byte will control the layout of up to four pixels on the screen.<br /><br />I think it may be the case that whatever value for each byte, you always have pixels opposite each other (it would make sense for programming a curtain, I suppose). Metarkai didn&#039;t know if it&#039;s possible to change the colours.<br /><br />I think that potentially you may be able to create nice art.<br /><br />It still seems to be a mystery why these curtains exist and why box PokÃ©mon matter though. In PokÃ©mon Ruby, none of the box slots affect the windows but perhaps some range of addresses memory or ROM still does.


subject: Re: Yellow Disassembly
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=luckytyphlosion link=topic=7278.msg198576#msg198576 date=1432569732]<br />[quote author=Crystal_ link=topic=7278.msg198565#msg198565 date=1432311840]<br />Which kind of differences cannot be fit into an ifdef though? <br />[/quote]<br /><br />It would require a lot of ifdefs to have pokeyellow buildable through pokered. It&#039;s mostly because many files have been even slightly modified, and making ifdefs for every simple modifications would be too messy. At that point, it would be better to just make pokeyellow another disassembly entirely.<br />[/quote]<br />I agree. Thanks for working on it.


subject: Transferring data from Gen 2 to Gen 5?
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  CGB has an IR Port.<br /><br />Gen 5 Carts have an IR Port.<br /><br />Transferring data from Gen 2 to Gen 5 confirmed?<br /><br />(In all honesty, it probably isn&#039;t possible, but you never know...)


subject: Re: Transferring data from Gen 2 to Gen 5?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, there is a way but it&#039;s not by IR.<br /><br />https://docs.google.com/document/d/1ILhyYIjArYLimeWEUJvSa0BsCnB5k706MWN2Pa7fA9c/edit


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=blahpy link=topic=6428.msg186937#msg186937 date=1331527433]<br />Actually, this occurence is rather common in all Emerald games (including real copies).<br /><br />It happens due to a thing in the RNG algorithm, and it can also cause some players to have extreme luck at finding shiny PokÃ©mon (although they will always have the same values, as you stated). I don&#039;t really know the in-depth technicalities of it, however.<br />[/quote]<br /><br />Smogon has various articles about Emerald&#039;s PRNG: http://www.smogon.com/ingame/rng/<br /><br />[quote author=Torchickens link=topic=6428.msg198614#msg198614 date=1433339567]<br />It still seems to be a mystery why these curtains exist<br />[/quote]<br /><br />Are they part of any standard tileset?


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t know much about GBA graphics, but I couldn&#039;t spot any curtain related tiles in the tile viewer. The curtains do not appear in map viewer either even when they are on the screen.


subject: Re: Transferring data from Gen 2 to Gen 5?
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: HÃ¡Äky
icon: xx
body:
  I donâ€™t have a Gen V game and know nothing about its IR protocol, but my bet would be that itâ€™s technically possible. It may also be possible to emulate the PokÃ©walkerâ€™s IR communication with HeartGold/SoulSilver. Now Iâ€™m tempted to go buy stuff.<br /><br />The game [i]Mission: Impossible[/i] included a function to use the GBCâ€™s IR port as a TV remote control, so at the very least it should be possible to do [i]that[/i] with Gen II arbitrary code execution. (Edit: Or non-Japanese versions of Yellow, since they run in CGB mode.)


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The glitch seems to cause empty tiles with IDs higher than 790 to be overwritten with Pokemon box data:<br /><br />[img]http://i.imgur.com/JJOFDYy.png[/img]<br /><br />Normally these tiles are unused, but for some reason window sides in Trainer School have tiles 791-793 laid on top of them. Maybe they were intended to have curtains at some point:<br /><br />[img]http://i.imgur.com/t656OIL.png[/img]<br /><br />Which causes the garbled graphics to become visible.<br /><br />This happens with all tilesets with empty tiles in that range. Makes me wonder if there are more locations with noticeable effects of this corruption.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Trevor
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Trevor
icon: xx
body:
  one problem solved, next problem here&nbsp; :P<br /><br />Hi everybody,<br /><br />I&#039;m currently trying to obtain the 8F Item using invlid encounter flags (because i have no event that takes an item away and I dont feel like playing the main story all over again...).<br />The problem has to do with that ditto with the Cooltrainer attack, when trying to use the attack in game I need to click 3 times on &quot;FIGHT&quot; and then again 3 times to read the next &quot;you have no moves for this attack left&quot;.<br />Also after a few tries the game crashes and I have to restart.<br /><br />But normally as I read it just should do nothing, you should be able to do this as often as you want and also without crashes. Additionally you should only need to click one time on &quot;FIGHT&quot;.<br /><br />To get that Cooltrainer Ditto I just encountered a wild pokemon, transformed into it and then switched attack 1 and 2 and then ran away from the battle - thats it.<br /><br />PS: I&#039;m using Pokemon Blue<br /><br />Thanks for help :)


subject: Re: [RBY] Trainer fly glitch disappearing item
poster_name: Trevor
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you for the reply,<br />it&#039;s really interesting how many glitches and variations of glitches can be performed to achieve various things.<br /><br />The looping map trick doesn&#039;t really suit me I dont feel like playing the main story all over again just to have an event that takes an item away from me :-X<br /><br />What I&#039;m trying to do now is to obtain the 8F Item be using invalid encounter flags - that is way more interesting to experiment a bit with that item - and I could also generate TM20 with that :)<br />But while trying to obtain that item I also ran into problems: http://forums.glitchcity.info/index.php/topic,6638.msg198622.html#msg198622


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah ! This glitch was rediscussed lately on PRAMA (where it was posted originally by VaePomeg), and it seemed to have motivated Metarkrai who asked on PRAMA&#039;s chat for save files to investigate it... When he came back on it and announced this, we were all like &quot;wtf where is the logic in this&quot;&nbsp; ;D<br /><br />It&#039;s cool it&#039;s finally solved, at least partly !<br /><br /><br /><br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]I&#039;m currently trying to obtain the 8F Item using invlid encounter flags (because i have no event that takes an item away and I dont feel like playing the main story all over again...).[/quote]<br /><br />Actually you don&#039;t need an event anymore. There is a &quot;dry&quot; variation of the item underflow glitch, for which all you need is a stack of 255 X Special. You can get it with MissingNo. using the glitch of your choice. Moreover, if the invalid encounter flag method works, it means the cooltrainer corruption works for you, so that you can encounter a MissingNo. This invalid encounter flag method is obsolete, you should not use it.<br /><br />The item underflow glitch requires you to have this :<br />[img]http://www.prama-initiative.com/RBJ/iug1.png[/img]<br />French screen, Special + is X Special and the two first item are useless.<br /><br />Toss the two first useless items, you will have this : <br />[img]http://www.prama-initiative.com/RBJ/iug2.png[/img]<br /><br />Toss several 255x of the first item until you only have access to two items. Toss 253 of that first X Special stack and switch item 1 and 2 twice.&nbsp; You should have X Special x0, like this :<br />[img]http://www.prama-initiative.com/RBJ/iug3.png[/img]<br /><br />Item underflow will be active. Now go there (near Celadon) :<br />[img]http://www.prama-initiative.com/RBJ/iug4.png[/img]<br /><br />Toss 255 X Special again, and switch the remaining X Special with the Nugget in 35th position. 5 steps right, 5 steps down, 20 steps right and open the item menu to see 8F, that you can switch to a &quot;normal&quot; place (eg : first place). Fly back to Celadon and buy items to fix the item menu.<br /><br /><br />If you still wanna use the invalid encounter flags, you don&#039;t need to USE the attack to trigger the corruption. Just enter/exit the FIGHT menu until it works. <br /><br />Fact is, cooltrainer corruption doesn&#039;t always work, it depends on the values of some RAM addresses. [url=http://forums.glitchcity.info/index.php/topic,6992.msg198569.html#msg198569]You wil find here[/url] TheZZAZZGlitch&#039;s methods to maximize the chances. I can tell you that the &quot;renaming party + open unused box&quot; method works very well.<br /><br />Good luck !


subject: Re: [RBY] Trainer fly glitch disappearing item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello,<br /><br />I answered your other post on the 8F thread. As you will see there, you have no need for an item-taking event to perform the dry underflow.


subject: Re: Transferring data from Gen 2 to Gen 5?
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can&#039;t do anything with HG/SS PokÃ©walker, because Sanqui said that HG/SS only sends video data to the PokÃ©walker, and not actual PokÃ©mon data. The actual PokÃ©mon data is saved for when the PokÃ©mon returns.<br /><br />I&#039;m not so sure that you could transfer Gen 2 Data to Gen 5 because the PokÃ©mon Data Structure for Gen 5 is unknown. Of course, if you can make [i]something happen[/i] by using the GBC IR Function, that would be progress.


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  For reference, the glitch occurs in Japanese Emerald as well, but with box 7 slots 26-28 instead.<br /><br />I haven&#039;t tested Ã‰meraude (French Emerald), Smaragd (German Emerald), Esmeralda (Spanish Emerald), Smeraldo (Italian Emerald) yet. If anyone wants to test one of those versions I&#039;d appreciate it.


subject: Re: The Member's Guide to Topiclessness
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Man, looking at the prices the retired Beanie Babies go for nowadays, I&#039;m glad I still have all mine. <br /><br />&gt;Bronty goes for $500<br />&gt;Rex goes for $450<br />&gt;Slither is worth a fucking $1000<br />&gt;Peace (royal blue) can fetch over $2000<br /><br />Not that mine are worth anything, since most of them have their tags cut off.


subject: Re: Transferring data from Gen 2 to Gen 5?
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=luckytyphlosion link=topic=7289.msg198627#msg198627 date=1433432621]<br />You can&#039;t do anything with HG/SS PokÃ©walker, because Sanqui said that HG/SS only sends video data to the PokÃ©walker, and not actual PokÃ©mon data. The actual PokÃ©mon data is saved for when the PokÃ©mon returns.[/quote]<br />I knew that the PokÃ©mon data is kept on the HG/SS side, but there are other possibilities.<br />[list][*]The best-case scenario would be if there were a bug in the code handling PokÃ©walker data that would allow arbitrary code execution in HG/SS. That would be nice.<br />[*]When two PokÃ©walkers communicate, they exchange the playersâ€™ party data so that the other playerâ€™s party will appear in the Trainer House in Viridian City. With IR spoofing, it should be possible to change the Trainer House data and maybe put level 255 glitch PokÃ©mon with glitch moves in there.<br />[*]Alternatively, it should be possible, albeit a bit pointless, to manipulate the PokÃ©walker itself. Maybe put a Missingno. sprite on it?[/list]<br /><br />[quote author=luckytyphlosion link=topic=7289.msg198627#msg198627 date=1433432621]I&#039;m not so sure that you could transfer Gen 2 Data to Gen 5 because the PokÃ©mon Data Structure for Gen 5 is unknown.[/quote]<br />Hmm? You donâ€™t mean [url=http://projectpokemon.org/wiki/Pokemon_Black/White_NDS_Structure]this data structure[/url], do you?<br /><br />[quote author=luckytyphlosion link=topic=7289.msg198627#msg198627 date=1433432621]Of course, if you can make [i]something happen[/i] by using the GBC IR Function, that would be progress.[/quote]<br />Itâ€™s always been my goal in life to make [i]something happen[/i] :P


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Metarkrai is french, but he also works often with english versions, so I&#039;m unsured what game he used for the original box slots discovery.<br /><br />I will ask, next time I see him on prama&#039;s skype group :)


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I just heard from him, he tested in french emerald as well. Since the addresses are the same in french and english versions, I assume it&#039;s also the case for german, spanish, etc. :)


subject: YOU'RE A KID NOW YOU'RE A SQUID NOW YOU'RE A KID YOU'RE A SQUID YOU'RE A KID
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Zowayix
icon: xx
body:
  So yeah, I purchased Splatoon. If anyone from Nintendo asks, it&#039;s because of that picture on Reddit where someone jizzed all over the girl Amiibo. That&#039;s not actually the case (it was because of the dank maymays), but I don&#039;t want them to start cracking down on that stuff because it&#039;s hilarious. They should team up with the rest of the cumming on figurines guys to form a new marketing strategy.<br /><br />All shitting while giggling aside, it&#039;s actually a pretty fun game. The default controls are maxim potato (because they involve flipping around the Wii U Gamepad like a fucking tool), but you can change that shit to use the more sensible right stick. It&#039;s reasonably easy to learn, though actually progressing is a bitch because you start at level 1 and right now (I understand the August patch will fix this) there&#039;s no matchmaking so you can be up against some level 10-14 dudes or whatever who will fuck you in the face with their weapons that you&#039;re not allowed to buy because fuck you (these shopkeepers are worse than the ones in Kalos). But if you figure out what you&#039;re doing (protip: Play defensively to start off with until you can upgrade stuff) it&#039;s not so bad. The game almost tries to discourage you from playing the single-player mode, going so far as to have the in-game guide you around disembodied text tell you that the the guy you have to talk to to do missions is some crazy homeless guy who smells. Once you realise that this game does actually have single-player, it&#039;s pretty fun, almost introduces a puzzle platforming element to the third-person tactical shootery (but not much). Those boss battles are deceptively challenging though (at least the one I&#039;ve fought), but Nintendo has moved on from their &quot;you died fuck you back to beginning&quot; stage, so you can just go in and have fun and enjoy yourself until you win or you give up. <br />The main aspect of the game is fucking cash either way, once the 4v4 with friends patch gets underway in August it might be the next Nintendo national e-sport in the ranks of Porkymans and Smash Bros. Maybe. You can get pretty deep into the strategies here because you have various different weapon types, so it&#039;s closer to something like TF2 in terms of balance except with a different equipment system. Something like that. It&#039;s a cool game, okay? Just take my word for it. Even the graphics are pretty impressive, I guess that&#039;s just coming from back in the days when Nintendo put potato GPUs in all their consoles and you had to hope the gameplay didn&#039;t suck to make up for it. Now they both don&#039;t suck.<br /><br />I only got the Inkling Girl amiibo because she&#039;s cute. Not in a waifu way, but in a daughteru way. Supposedly they&#039;re supposed to give you challenges which give you money for completing them, but I dunno if it&#039;s necessarily worth the real life money cost unless you just like figurines.<br /><br />Also, soundtrack is fucking amazing, can&#039;t even hold all these genres. I didn&#039;t even know Toru Minegishi can do this punk-rocky type thing (okay, &quot;squidcore&quot;), and the other tracks show a large Hideki Naganuma influence and then there&#039;s dat boss battle final phase theme. Physical CD when?<br /><br /><br />[size=20pt]Final score: Like Super Mario Sunshine with guns / 10 -- Machinima [/size]


subject: Re: YOU'RE A KID NOW YOU'RE A SQUID NOW YOU'RE A KID YOU'RE A SQUID YOU'RE A KID
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve been thinking of getting Splatoon, but given that I&#039;m not putting my Wii U online because it might auto-update (my Wii U is delightfully on the last firmware (5.1.0) with a browser exploit, and I got it that way (yay for preowned stuff))...


subject: Re: Transferring data from Gen 2 to Gen 5?
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah, didn&#039;t check any other sites for the Gen 5 Structure. I only looked at Bulbapedia :P<br /><br />By any chance, does anyone know what the PokÃ©walker is coded in? (Most likely some sort of assembly language)


subject: Re: Generation IV and V Trade Cloning (without GTS)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  BTW, some dude made a video for Gen IV trade cloning :<br /><br />https://www.youtube.com/watch?v=XrXXjtzz5UA&amp;t=11m<br /><br />Language is french but you will understand. Successful try is around 11:00.<br /><br />I will try to make one for Gen V


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Trevor
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Trevor
icon: xx
body:
  Big thanks for your help!<br />I would suggest to add that to the first post, it can make users unsure if they thing they need to have access to an event, when its also possible without it.<br /><br />But well, I now got the item, experimented with it a bit and &quot;ported&quot; some codes to the european non-english versions of pokemon red/blue by just adding 5 to every immediate value in the asm code(I tested it on the german version only)<br />Adding 5 works if only ram adresses are modified, but [b]how could one figure out what the call adresses in other languages of the games are?[/b] Is there like a &quot;call adress map&quot; in addition to the ram map, or is debugging while playing in an emulator needed?<br />[b]Is it also possible to make a script that plays the final rival battle music or the credits music at the next battle instead of the gym leaders?[/b] that music is more fun to listen to :P<br />And finally a code where you can [b]modify the species and the level of the Pokemon you battle[/b] would be also nice (modified &quot;CATCH &#039;EM ALL&quot; SCRIPT) :)<br /><br /><br />Ported codes:<br />Codes for Inventory slot 2 item ID and item count modifier stay the same, because no imm. values are used.<br /><br />[size=12pt][u][b]GYM LEADER MUSIC PLAYS FOR NEXT BATTLE R/B EUROPE(NON-ENGLISH)[/b][/u][/size]<br />Use this outside of battle to make the next battle play the Gym Leader theme.<br /><br />[u][b]ITEM LIST (starting from the first slot):[/b][/u]<br />[tt]* Any item<br />* 8F<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x97<br />TM08&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x201[/tt]<br />[u][b]ASM:[/b][/u]<br />[code]WRA1:D327 EA 61 D0&nbsp; &nbsp; &nbsp; &nbsp;  ld (d061),a<br />WRA1:D32A C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret[/code]<br /><br /><br />[u][b][size=12pt]&quot;CATCH &#039;EM ALL&quot; SCRIPT R/B EUROPE(NON-ENGLISH)[/size][/b][/u]<br /><br />[u][b]ITEM LIST (starting from the first slot):[/b][/u]<br />[tt]* Preferably Master Balls<br />* 8F<br />TM50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x36<br />TM11&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x4<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x94<br />TM08&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x201[/tt]<br />[u][b]ASM:[/b][/u]<br />[code]WRA1:D327 FA 24 D3&nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  a,(D324)<br />WRA1:D32A 04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; b<br />WRA1:D32B EA 5E D0&nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  (D05E),a<br />WRA1:D32E C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret&nbsp; [/code]<br /><br /><br />[size=12pt][u][b]WALK THROUGH WALLS R/B EUROPE(NON-ENGLISH)[/b][/u][/size]<br />Jump off a ledge after using 8F to walk through walls.<br /><br />[u][b]ITEM LIST (starting from the first slot):[/b][/u]<br />[tt]* Any item<br />* 8F<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x25<br />TM15&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x201[/tt]<br />[u][b]ASM:[/b][/u]<br />[code]WRA1:D327 EA 19 D7&nbsp; &nbsp; &nbsp; &nbsp;  ld (d719),a<br />WRA1:D32A C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret[/code]<br /><br /><br />[size=12pt][u][b]ESCAPE FROM A TRAINER BATTLE R/B EUROPE(NON-ENGLISH)[/b][/u][/size]<br />This turns 8F into an item which allows escaping from any battle, including trainer battles.<br /><br />[u][b]ITEM LIST (starting from the first slot):[/b][/u]<br />[tt]* Any item<br />* 8F<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x125<br />TM08&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x201[/tt]<br />[u][b]ASM:[/b][/u]<br />[code]WRA1:D327 EA 7D D0&nbsp; &nbsp; &nbsp; &nbsp;  ld (d07D),a<br />WRA1:D32A C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret[/code]<br /><br /><br />[size=12pt][u][b]CATCH OTHER TRAINER&#039;S POKEMON R/B EUROPE(NON-ENGLISH)[/b][/u][/size]<br />Use this in a Trainer battle to enable the ability to catch the enemy PokÃ©mon and escape from battle.<br />You can also use it to disable wild battles, but you can&#039;t use it to turn a Trainer into a PokÃ©mon.<br /><br />[u][b]ITEM LIST (starting from the first slot):[/b][/u]<br />[tt]* Any item<br />* 8F<br />Lemonade&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x1<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x92<br />TM08&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x201[/tt]<br />[u][b]ASM:[/b][/u]<br />[code]WRA1: D327 3E 01		&nbsp; ld a, 01<br />WRA1: D329 EA 5C D0		&nbsp; ld (D05C),a:<br />WRA1: D32C C9			&nbsp; ret[/code]


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Considering this is a &quot;significant reason&quot; as per forum rules, I&#039;ll go ahead and post it here.<br /><br />I&#039;ve been working, for the past month, on e-Reader content and generating custom content for fangames, and I&#039;ve come a long way even before I found this thread. Anyways, last night, I found some interesting content in copies of PokÃ©mon FireRed&#039;s ROM, as well as similar data being in Emerald (I have backed up my own copies for this research (If you need proof I can provide it)). Anyways, there is a chunk of data in each game that is actually e-Card data that can be saved to a Card-e+ console and run. I&#039;m not entirely sure what it&#039;s for though. After decompressing the VPK data (VPK data is the data that the RGBDS assembly creates, but as is, not re-compressed), I found similarities and important differences to the data that you have established.<br /><br />Main differences:<br />1. The card is in ARM/Thumb rather than Z80<br />2. The cards do vastly different things from regular cards (They seem to take an e-Card for some form of input):<br /><br />FireRed Card data:<br />[img]http://i.imgur.com/9kZfMuZ.png[/img]<br /><br />Emerald Card data:<br />[img]http://i.imgur.com/N2lOMLP.png[/img]<br /><br />3. The 10-byte Unknown is actually different, although I&#039;m not sure what the difference is supposed to be for yet (It shows as 00 00 00 00 [b]02[/b] 55 00 00 00 00 in the data)<br /><br />I&#039;m not sure what this is for, perhaps could someone shed some light on this application? Also, if you guys want me to, I can upload the decompressed copies of these applications onto my dropbox if you&#039;d like to take a peek at them or disassemble them. I&#039;m trying to find what I can for game data in there, as well as the strings, but I&#039;ve been preoccupied with other things at the moment.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The Ruby/Sapphire Battle-e cards work by scanning them using the e-Readerâ€™s â€œScan Cardâ€ (ã‚«ãƒ¼ãƒ‰ãƒªãƒ¼ãƒ‰) option. The FireRed/LeafGreen/Emerald cards require the e-Readerâ€™s â€œCommunicationâ€ (ã¤ã†ã—ã‚“) option; if you try to scan them using Scan Card, you just get this message telling you to use Communication instead:<br /><br />[img]http://i.imgur.com/1PGlXUk.png[/img]<br /><br />The e-Reader menu describes the Communication option as â€œLoad application from Game Boy Â® Advance or Nintendo GameCube â„¢.â€ I think what youâ€™ve found is the application thatâ€™s sent to the e-Reader when this option is used.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah, that&#039;d explain it, that was going to be my next theory, however, I don&#039;t have a Card-e+ so I couldn&#039;t test that without having region issues. I was given a large set of unnamed e-Cards and if memory serves, there&#039;s some of the cards that, presumably, these applications can use. I&#039;ll have to dig them out, but did you want a peek at those? You may be able to add them to your disassembly that you have going and it&#039;d probably complete the set a bit more.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Team Fail link=topic=7114.msg198640#msg198640 date=1433571204]<br />Ah, that&#039;d explain it, that was going to be my next theory, however, I don&#039;t have a Card-e+ so I couldn&#039;t test that without having region issues. I was given a large set of unnamed e-Cards and if memory serves, there&#039;s some of the cards that, presumably, these applications can use. I&#039;ll have to dig them out, but did you want a peek at those? You may be able to add them to your disassembly that you have going and it&#039;d probably complete the set a bit more.[/quote]<br />Nearly all of the Battle-e cards have been dumped and are generally available online; the ones that arenâ€™t include seven cards from the Emerald set (19-A029, 19-A057~A060, 19-A062, 19-A064) and the Club Nintendo exclusive cards (08-N001~N008 and 15-N001~N004). There are a few other missing promo cards which Iâ€™ve recently obtained myself and will be dumping soon.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Trevor link=topic=6638.msg198637#msg198637 date=1433542208]<br />Big thanks for your help!<br />I would suggest to add that to the first post, it can make users unsure if they thing they need to have access to an event, when its also possible without it.[/quote]<br /><br />I guess this is the reason why TheZZAZZGlitch wrote a warning asking for newcomers to read beyond the first post. But, yes, I think it is necessary and would be useful to add the dry underflow to this post.<br /><br />[quote author=Trevor link=topic=6638.msg198637#msg198637 date=1433542208]<br />But well, I now got the item, experimented with it a bit and &quot;ported&quot; some codes to the european non-english versions of pokemon red/blue by just adding 5 to every immediate value in the asm code(I tested it on the german version only)<br />Adding 5 works if only ram adresses are modified, but [b]how could one figure out what the call adresses in other languages of the games are?[/b] Is there like a &quot;call adress map&quot; in addition to the ram map, or is debugging while playing in an emulator needed?[/quote]<br /><br />I don&#039;t understand well what your problem is. <br /><br />To create 8F codes for european versions, the only thing you need outside of the [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map]RAM Map[/url] (for which you need to add 5 to every address) is [url=http://www.pastraiser.com/cpu/gameboy/gameboy_opcodes.html]a list of gameboy opcodes[/url]. Their match with hex values is the same regardless of the game&#039;s localization. Understanding basic opcodes is not complicated, but you might find [url=http://gameboy.mongenel.com/dmg/opcodes.html]some help here[/url] and I have also wrote [url=http://www.prama-initiative.com/index.php?page=8f-code-execution#pro]an article[/url] about it, but it&#039;s in french.<br /><br />However, you must also know that, even if it&#039;s fun to create new codes, there is a very easier way to deal with 8F : Gameshark code simulation. Using it with the following items will trigger the gameshark code 01xxyyzz in european versions :<br /><br />Any item<br />8F<br />Lemonade *xx<br />TM34 *yy<br />[item which hex value is zz] *201 (=&gt; [url=http://glitchcity.info/biglist.htm]Comprehensive big list[/url])<br /><br />Don&#039;t forget quantities are decimal values. You must get 18 lemonades if your xx is 12. If the zz item appears to be a glitch item, or if you need high quantity of some item, you can use the underflow to get them (using Celadon loop, for example). You can also simulate the gameshark code which changes the first item :<br /><br />Item you want to change (eg pokeball)<br />8F<br />Lemonade *hex value of the glitch item you want to get (in decimal of course)<br />TM34 *17<br />TM11 *201<br /><br />By activating 8F, you will change the first item into your glitch item. Quantity remains the same. Another solution is to use the &quot;morphing second item&quot; code in its european version :<br /><br />8F<br />Item which will be changed<br />Burn Heal x43<br />Ice Heal x43<br />Full Heal x201<br /><br />Every time you activate 8F, the second item will lose a hex, and keep its quantity. With all this, you should not be facing any problem.<br /><br />[quote author=Trevor link=topic=6638.msg198637#msg198637 date=1433542208]<br />[b]Is it also possible to make a script that plays the final rival battle music or the credits music at the next battle instead of the gym leaders?[/b] that music is more fun to listen to :P<br />[/quote]<br /><br />This audio track is hex:F3 of bank hex:08 according to the RAM map. If you want to use a &quot;normal&quot; 8F code rather than gameshark simulation, there must be a way to do it by manipulating audio channel into thoses values.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Trevor link=topic=6638.msg198637#msg198637 date=1433542208]<br />[b]how could one figure out what the call adresses in other languages of the games are?[/b] Is there like a &quot;call adress map&quot; in addition to the ram map, or is debugging while playing in an emulator needed?<br />[/quote]<br /><br />The call addresses are ROM pointers that contain existing code to execute (these functions are called routines). &quot;Call&quot; tells the game to execute this code and return to what it was doing (e.g. if your code has call 3E62 ld a,01; the game will run the code at ROM pointer 3E62 and go back to run ld a,01 after it has finished (unless where it goes back wasn&#039;t corrupted)).<br /><br />Some of the pointers for routines can be found in the [url=https://github.com/iimarckus/pokered/blob/master/main.asm]PokÃ©mon Red disassembly[/url] (e.g. [url=https://www.youtube.com/watch?v=rENVogF7izQ]SetIshiharaTeam[/url]: ; 64ca (1:64ca).<br /><br />Sadly there is no consistent way to port English ROM pointers to other languages. However, because the games are similar, you can with BGB debugger and a hex editor using the method I&#039;ll show below.<br /><br />Let&#039;s try to find the equivalent of Red&#039;s 3E48 (give PokÃ©mon) for German Red:<br /><br />With English Red open, go on to BGB, right click on the game and choose Other&gt;Debug. Then right click, select &quot;Go to...&quot; and enter 3E48.<br /><br />You should get this, which is what code the give PokÃ©mon routine is made up of.<br /><br />[img]http://i3.minus.com/ibgOkC7BawA6ji.png[/img]<br /><br />Leave the window open because we will need to remember the numbers (like 78) next to the ASM instructions (like ld a,b).<br /><br />Now, open up a hex editor such as HxD (it&#039;s freeware) for German Red and use your hex editor&#039;s search function (search&gt;find for HxD). Choose to find hex values and enter the values that you think will be shared for the other language&#039;s routine.<br /><br />Note that the values greater than in brackets may be +5 in the non-English European version, except for things in the ROM (values lower than 8000) and specific memory addresses like CD38, C0EF, C0F0 - I&#039;m not sure of the specifics of which addresses get changed and which addresses do not get changed, it may be earlier RAM (CXXX) values.<br /><br />The start of the routine has 78 EA 91 CF 79; so we can try searching for 78 EA 96 CF 79 (EA 96 CF because there is a &quot;ld (CF91),a&quot;).<br /><br />[img]http://i1.minus.com/iY4rwMEhnK4l1.png[/img]<br /><br />This resulted in one match which was at address 3E62.<br /><br />[img]http://i2.minus.com/iETYma7vcV1vp.png[/img]<br /><br />If the address in the hex editor is less than 0x3FFF, you don&#039;t have to do anything with it to turn it into a pointer(*) - and you don&#039;t have to use the bank switch routine.<br /><br />So in TheZZAZZGlitch&#039;s alternative catch &#039;em all, CD 48 3E (call 3E48) must be replaced with CD 62 3E (call 3E62).<br /><br />Sometimes a search may give more than one result, in which you could try checking what you think is the right routine with the most similar code in BGB debugger then test your code with S7, or you could try a search for different values.<br /><br />These items from item 3 will work with [url=http://forums.glitchcity.info/index.php/topic,7265.msg198432.html#msg198432]the modified PokÃ©mon set up[/url] (Graveler instead of Onix) for non-English European versions:<br /><br />Schutz x(PokÃ©mon index)<br />X-Tempo x14<br />Hyperball x64<br />TM05 x98<br />Lemonade x201<br /><br />i.e. 1E xx 43 0E 02 40 CD 62 3E C9 FF<br /><br />[quote author=Trevor link=topic=6638.msg198637#msg198637 date=1433542208]<br />[b]Is it also possible to make a script that plays the final rival battle music or the credits music at the next battle instead of the gym leaders?[/b] that music is more fun to listen to :P<br />[/quote]<br /><br />Yes. You can do this either by calling a play music routine with the correct register values (register &#039;a&#039;=tune and register &#039;c&#039;=bank) or by modifying both the memory address CFCC (CFC7 in English Red) and the addresses C0EF, C0F0.<br /><br />CFCC forces the game to play a tune based on the ID you choose. C0EF, C0F0 changes the music bank value (either 02, 08, 1F and 20 is used for a few tracks exclusively in Yellow).<br /><br />[url=http://pastebin.com/1epAd2aT]Here are all the tune ID and bank ID values[/url].<br /><br />I originally made a [url=https://www.youtube.com/watch?v=DZiMfJJT2So]sound test program[/url] using the former method. It resets the tune ID and bank ID values back to 0 after you play the tune, so you can select all other tunes afterwards by tossing the quantities.<br /><br />https://www.youtube.com/watch?v=DZiMfJJT2So<br /><br />The code for the English version:<br /><br />Lemonade x(tune ID)<br />Awakening x(bank ID)<br />TM05 x161<br />HP Up x62<br />Ultra Ball x61<br />Soda Pop x5<br />TM34 x35<br />TM11 x4<br />PokÃ© Ball x234<br />Iron x211<br />TM01 x(anything)<br /><br />3e (add tune ID here) 0e (add bank ID here) cd a1 23 3e 02 3d 3d 05 ea 23 d3 04 04 ea 25 d3 c9<br /><br />[code]ld a, xx - tune<br />ld c, yy - bank<br />call 23A1 - play music<br />ld a, 02 - a=02<br />dec a - a=01<br />dec a - a=00<br />dec b<br />ld (D323),a - item 3 quantity =a (00)<br />inc b<br />inc b<br />ld (D325),a - item 4 quantity =a (00)<br />ret[/code]<br /><br />The only things you have to do here is check the equivalent of 23A1 (using the debugger and hex editor) and change D323/D325 to D328/D32A, and there was one situational problem.<br /><br />The situational problem: 2A was represented as a Helix Fossil and it&#039;s not good to have key items with quantities over one. So I used some alternate code without key items or duplicate stacks.<br /><br />Often when you want to not use a key item, you can use a one byte opcode to manipulate some registers that you aren&#039;t using for your code so that they take the place of an item (e.g. inc b is represented as a good item; a PokÃ© Ball). [url=http://iimarck.us/etc/asmopcodes.txt]This page[/url] has a list of opcode IDs.<br /><br />Equivalent pointer: Using the method I showed you above, it turns out that basically the same routine (ignoring memory address changes) is also at 23A1 in the German Red, so you don&#039;t have to change it.<br /><br />(Note that this is not the case for every language; in the French version that routine is at 239D).<br /><br />The following code will work for the German version:<br /><br />3e (add tune ID here) 0e (add bank ID here) cd a1 23 3e 02 3d 3d 05 ea 28 d3 04 2e 2a 04 77 c9<br /><br />Limonade x(tune ID)<br />Aufwecker x(bank ID)<br />TM05 x161<br />KP-Plus x62<br />Hyperball x61<br />Sprudel x05<br />TM34 x40<br />TM11 x04<br />X-Treffer x42<br />PokÃ©Ball x119<br />TM01 x(any)<br /><br />[code]ld a, xx - tune<br />ld c, yy - bank<br />call 23A1 - play music<br />ld a, 02 - a=02<br />dec a - a=01<br />dec a - a=00<br />dec b<br />ld (D328),a - item 3 quantity =a (00)<br />inc b<br />ld l,2A&nbsp; - hl=D32A<br />inc b<br />ld (hl),a - item 4 quantity =a (00)<br />ret[/code]<br /><br />So to play Champion music for example, [url=http://pastebin.com/1epAd2aT]this[/url] tells us the bank ID is 08 and the tune ID is $F3; hence you&#039;d need Limonade x243 (hex:F3) and Aufwecker x8.<br /><br />[quote author=Trevor link=topic=6638.msg198637#msg198637 date=1433542208]<br />And finally a code where you can [b]modify the species and the level of the Pokemon you battle[/b] would be also nice (modified &quot;CATCH &#039;EM ALL&quot; SCRIPT) :)<br />[/quote]<br /><br />I was working on one but found it hard to get good items for execution, I&#039;m afraid. I may come back to this another time, or maybe TheZZAZZGlitch can help. Sorry.<br /><br />[hr]<br />[u](*): About banks - the give PokÃ©mon function does not require a bank switch (and knowledge of how to convert a Game Boy offset into a pointer):[/u]<br /><br />If the address in the hex editor is greater than $3FFF, it has something called a bank (greater than 0); and our pointer (call/jump value) is no longer necessarily the same as a hex editor address (offset).<br /><br />The game can run from &quot;bank 0&quot; (pointers $0000-3FFF e.g. &quot;give PokÃ©mon&quot;) all of the time, but not data from other banks without the game changing banks (in games that support it, PokÃ©mon included) if it is currently on the wrong bank. <br /><br />The bank is the same as this address modulo divided by $4000 rounded down to the nearest whole number, for example, offset $0F807A contains code that will run Pikachu&#039;s Beach in Yellow. $0F807A/$4000 rounded down equals 3E, so the bank is 3E.<br /><br />If you wanted to run the code at $0F807A, you would have to make the game change banks before running it because the game won&#039;t be running on bank 3E when ws m is used.<br /><br />The 3E is the first byte of a three byte pointer (3E:XXXX). There are two other bytes to the pointer (XXXX) and this represents the pointer you will call, like how we call 3E48 (3E62 on German version) for the give PokÃ©mon function.<br /><br />To work out bytes 2 and 3 of the pointer, you can do Offset-(0x4000*Bank)+0x4000; so for Pikachu&#039;s Beach: ($F807A-$F8000)+$4000; which is $407A.<br /><br />Or you can use [url=https://mega.co.nz/#!1w0nlRZb!iFkbg_WvtY_ia8PvcAxPLkzDR4RWfTeHhutBlHsgoQc]a pointer calculator[/url] (note that this tells you the second and third bytes the wrong way round; 3E7A40 instead of 3E407A, so you have to remember to swap them for execution).<br /><br />To execute Pikachu&#039;s Beach (which we found has the pointer 3E407A), there is a routine to change ROM banks and jump to an address (the routine for each language can be found [url=http://hax.iimarck.us/viewtopic.php?id=4007]here[/url] thanks to Wack0 - in German Yellow it&#039;s $3E89).<br /><br />Register purposes for this routine:<br />c=Bank<br />h=Pointer byte 2<br />l=Pointer byte 3<br /><br />So you need to set c to 3E, h to 40, l to 7A then do a call $3E89. This would execute Pikachu&#039;s Beach.<br /><br />([url=http://forums.glitchcity.info/index.php/topic,6638.msg192600.html#msg192600]Wack0&#039;s German Pikachu&#039;s Beach code[/url] does this)<br /><br />If you want to turn a three byte pointer back into an offset, you can do:<br />romAddress = (bankNumber * 0x4000) + (twoBytePointer - 0x4000)


subject: Re: Black Curtains of Rustboro (Emerald)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah OK! :)<br /><br />[url=http://bulbapedia.bulbagarden.net/wiki/List_of_glitches_in_Generation_III#Black_curtains_glitch]I added the glitch to Bulbapedia[/url] and made [url=https://www.youtube.com/watch?v=tqdssikLGBk]a new video[/url] that shows manipulating the data and making custom &#039;face&#039; art (with memory viewer though). I couldn&#039;t make a mouth so I instead mainly did whiskered creatures. :P<br /><br />[img]http://i3.minus.com/iOajgGy0Ccatd.png[/img]<br /><br />An image that shows you what values you need for facial features (eyebrows, eyes, ears or whiskers).<br />https://mega.co.nz/#!19lUCayC!jdASe02hwWA8PXCQg1Y-CRZdoIJEJZkSJ3Ss9HzufBc<br /><br />An image that shows you what values you need for the completed faces I showed in the video.<br />https://mega.co.nz/#!9pVUUbgD!e2bUw2yRfOes3oMuzxF7gjMaGuU-hjgFtelJCeaYSYg<br /><br />Image of what all bytes look like as the only FF.<br />https://mega.co.nz/#!11tHWAaJ!9qhb9TcgM8OXvQGzRoje4RTJMq2LzlToIlRijNldkWw


subject: Re: The Member's Guide to Topiclessness
poster_name: Raven Freak
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Huh I haven&#039;t been here in a while... I just recently became interested in doing some more glitch research. :V Oh and I&#039;m eager to start hacking Red version now. xD I almost have the disassembly set up. I stopped setting it up yesterday because I had to eat dinner and I never went back and continued. :V So how&#039;s everyone doing?


subject: Help with the self-hacking Pokemon Blue Version (-kinda)
poster_name: Thracia776
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Anyone know what kind of program I need for editing the data to allow the self-hacking to happen? I found a hex editor and tried to use that, but it did nothing for me.


subject: Re: Help with the self-hacking Pokemon Blue Version (-kinda)
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What do you mean by &quot;self-hacking&quot;? If you&#039;re looking for ways to use Arbitrary Code Execution, you might want to check out the 8F thread.


subject: Re: Help with the self-hacking Pokemon Blue Version (-kinda)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystal_
icon: xx
body:
  Both TheZZAZZGlitch&#039;s and my self-hacking Pokemon Red/Blue videos have information about the bytes you need to change to implement it in the description (including info about how to make it a faster/slower corruption):<br /><br />[quote]Every 17 ms, there&#039;s aproximately a 1 in 4 chance that a random byte in memory (WRAM area in the range C000 - DEFF) gets corrupted, that is, overwritten with a random value. <br /><br />Implementing this hack (in hex):<br /><br />Starting at address 0040, write: C3 A6 3F C3 24 20<br />Starting at address 3FA6, write: F5 C5 D5 E5 CD 5C 3E E6 03* A7 20 14 CD 5C 3E E6 1F C6 C0 67 FE DF 28 F4 CD 5C 3E 6F CD 5C 3E 77** E1 D1 C1 F1 C3 43 00<br /><br />*Try 07 for slower glitching (1 in 8 chance) and 01 for even faster glitching (1 in 2 chance). <br />**Alternatively, try 34, 35, 70, 71, 72, or 73.[/quote]<br /><br />They aren&#039;t exactly the same, but both versions (TheZZAZZGlitch&#039;s and mine) will work.<br />


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ll probably look at the FireRed-based cards for now then, I&#039;ve been working for the past few hours to re-activate the e-Reader functionality in an English copy of FireRed to a varying degree of success.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Team Fail link=topic=7114.msg198649#msg198649 date=1433722869]<br />I&#039;ll probably look at the FireRed-based cards for now then, I&#039;ve been working for the past few hours to re-activate the e-Reader functionality in an English copy of FireRed to a varying degree of success.<br />[/quote]<br /><br />The localizations of FireRed and LeafGreen still have the e-Reader code from the Japanese versions, right? What about Mystery Events? I tried replicating [url=https://www.youtube.com/watch?v=sozc4oaxyKw]this[/url] in the Japanese versions and it didn&#039;t work but they likely left it in completely unused, unlike in Japanese Emerald.


subject: I need some help...
poster_name: Toasty_Guy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I have a lua script that shows me the changes by walking in certain paths in Pokemon Gold, and displays them in red if there&#039;s a high number of changes. I want to use this for the Coin Case glitch, but I dunno how to load in the script. Is there a certain emulator I need?


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Team Fail
icon: xx
body:
  [quote author=SatoMew link=topic=7114.msg198651#msg198651 date=1433760691]<br />[quote author=Team Fail link=topic=7114.msg198649#msg198649 date=1433722869]<br />I&#039;ll probably look at the FireRed-based cards for now then, I&#039;ve been working for the past few hours to re-activate the e-Reader functionality in an English copy of FireRed to a varying degree of success.<br />[/quote]<br /><br />The localizations of FireRed and LeafGreen still have the e-Reader code from the Japanese versions, right? What about Mystery Events? I tried replicating [url=https://www.youtube.com/watch?v=sozc4oaxyKw]this[/url] in the Japanese versions and it didn&#039;t work but they likely left it in completely unused, unlike in Japanese Emerald.<br />[/quote]They do have the e-Reader code, it&#039;s just skipped out on. Normally, if a Wireless Adapter is not detected, it will default to e-Reader mode in the Japanese versions (Otherwise go to Mystery Gift if it is attached), but this check simply errors out on you and tells you it&#039;s not attached (Or if attached, it does go to Mystery Gift), so it never does jump to the code responsible for e-Reader usage in the international releases. However, by editing the Main Menu option to allow the original Japanese behaviour, you can connect to an e-Reader, all the code is still there and completely functional:<br /><br /><br />[img]http://i.imgur.com/Fg42lhj.gif[/img]<br />(Note that the text is not actually in the ROM, so I had it ripped from the Japanese games and translated. [url=http://i.imgur.com/MJ7047C.png]This is how it looks without the text[/url].)<br /><br /><br /><br />It also seems that in FireRed and LeafGreen, both are unlocked at the same time, as opposed to Emerald needing two methods of unlocking to have both options. However, I can&#039;t seem to get the game and the e-Reader to communicate, and I&#039;m not sure what I&#039;m doing wrong. The code that&#039;s left over is virtually identical to the Japanese games, so it should be able to communicate, but it doesn&#039;t for some reason. I&#039;ve even tried it on hardware, but because I lack a card e-Reader+ unit, I can&#039;t do a full hardware test to troubleshoot.


subject: Re: Generation II's item 00h
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=luckytyphlosion link=topic=7180.msg198657#msg198657 date=1433793478]<br />Just to make sure, did you remember to enable SRAM? (Write $0A to Address $0000)<br />[/quote]<br />The game reads item $00â€™s description from $A793 while SRAM is disabled. The point of my experiments was to understand what happens when it does that, so, obviously, I didnâ€™t enable SRAM.


subject: MOVED: I need some help...
poster_name: Photon-Phoenix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=http://forums.glitchcity.info/index.php?board=76.0]Emulation &amp; ROM Hacking[/url].<br /><br />[iurl]http://forums.glitchcity.info/index.php?topic=7292.0[/iurl]


subject: Re: I need some help...
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  http://vba-rerecording.googlecode.com/files/VBA22-lua51dll.zip<br /><br />This is the specific vba with lua functionality.


subject: Re: The Member's Guide to Topiclessness
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m continuing to exist, as usual. I&#039;m also writing a story about an alien, a knight&#039;s ghost, and a vacuum cleaner going on wacky adventures.


subject: Re: Foreign language R/B glitches (project)
poster_name: Raven Freak
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh hey I&#039;m back. :V I&#039;ve done some more research on some glitches in Gelbe Edition. I&#039;m just going to focus on this one game until every glitch mon is documented. Still need to get the stats for these Glitches but here&#039;s some images, and movesets. Here&#039;s my list. :) <br />Pokemon Gelbe Edition (Pokemon German Yellow) Glitchmon Documentation<br />It&#039;s been about three years since I&#039;ve worked on glitchmon documentation in foreign versions of the Pokemon games. I recently got<br />back into doing more research after watching various different videos from a few distinguished Members/staff here on GCL. (BTW I also<br />go by TheRavenfreak on Youtube haha. xD) Anyways here is a guide that documents the glitch Pokemon in the German Yellow version.<br />(I honestly can&#039;t recall what versions I&#039;ve documented glitches in as it&#039;s been years since I&#039;ve worked on this project and the other topic<br />is probably locked since it&#039;s been so long. Please bare with me if I have already documented some of this already. I&#039;m pretty sure I didn&#039;t<br />even touch this version yet, as I do remember documenting glitches in the Spanish version...) I also apologize if the formatting is off.<br />(Which it probably will be since I&#039;m typing this in Notepad instead of Notepad++... and usually while copy/pasting text on the forum, the<br />formatting is off anyways. :V) Enough stalling let&#039;s get to the good stuff! <br /><br /><br />$BF- Already Documented by myself earlier in the topic. :V However I was wrong, it doesn&#039;t know super glitch<br />at level 1 but instead the Cooltrainer move. It&#039;s base stats structure is located at offset $39F1A which of course<br />by &quot;normal&quot; standards is part of the in game Trainer Pokemon Data.<br /><br />$C0- 44 HY (Slowbro Hybrid like in English Yellow)<br />Type 1/Water<br />Type 2/Psychic<br />Level 1 Moveset:<br />Confusion, Disable, Headbutt<br /><br />By Leveling Up:<br />Lv. 2- TM 34<br />Lv. 3- Super Glitch<br />Lv. 4- TM 05<br />Lv. 8- TM 05<br />Lv. 15- Softboiled<br />Lv. 16- Payday<br />Lv. 21- Take Down<br />Lv. 22- Aurora Beam<br />Lv. 33- High Jump Kick<br />Lv. 36- Double Kick<br />Lv. 37- TM 34<br />Lv. 40- Double Slap<br />Lv. 60- TM 34<br />Lv. 62- TM 05<br />Lv. 68- Thrash<br />Lv. 71- TM 30<br />Lv. 79- Poison Sting<br />Lv. 107- Thrash<br />Lv. 135- Soft Boiled<br />Lv. 146- Tail Whip<br />Lv. 161- Swords Dance<br />Lv. 163- TM 05<br />Lv. 166- TM 08<br />Lv. 167- TM 08<br />Lv. 170- TM 08<br />Lv. 172- TM 08<br />Lv. 173- TM 08<br />Lv. 203- Water Gun<br />Lv. 205- Hyper Fang<br />Lv. 208- Super Glitch<br />Lv. 230- Cut<br />Lv. 234- Super Glitch<br />Lv. 235- Swords Dance<br />Lv. 250- Super Glitch<br /><br />Evolutions?<br />Evolves Into Male Symbol At Level 201<br /><br />$C1- Female Symbol <br />This glitch locks up the game unfortunately... Even trading over it&#039;s Blau equvalent it seems that doing anything with this<br />glitch locks the game up. Upon using VBA&#039;s disassembler in real time the game seems to be stuck in a loop and continues to write to various <br />different addresses such as FF96h, FF95h in RAM. However it&#039;s type is Ground/Rock like Rhydon but it&#039;s probably only because Rhydon is the first<br />Pokemon via index order rather than Pokedex order. It&#039;s Pokedex number is 205.<br /><br />$C2- ppkmp&#039;&#039; <br />Type 1/ Fighting<br />Type 2/ Water<br />PokeDex No. 230<br />Moveset Level 1:<br />Karate Chop, Double Team, Double Slap, Pound<br />Moveset By Leveling Up:<br />Lv. 3- TM 50<br />Lv. 6- Pay Day<br />Lv. 17- Rage<br />Lv. 21- TM07<br />Lv. 25- Pin Missle<br />Lv. 33- TM 34<br />Lv. 34- Mimic<br />Lv. 48- TM 25<br />Lv. 61- TM 41<br />Lv. 62- TM 50<br />Lv. 76- Night Shade<br />Lv. 88- TM 04<br />Lv. 95- Tackle<br />Lv. 100- Super Glitch<br />Lv. 102- Defense Curl<br />Lv. 133- Mimic<br />Lv. 137- Aurora Beam<br />Lv. 166- Poison Sting<br />Lv. 201- Sludge<br />Lv. 205- Spike Cannon<br />Lv. 215- TM 03<br />Lv. 217- Bone Club<br />Lv. 225- Supersonic<br />Lv. 234- Ember<br />Lv. 240- Super Glitch<br />Lv. 241- TM 29<br />Lv. 245- TM 50<br /><br />$C3- c&#039;c&#039;ee4 Hybrid of Beedril (Same in English Yellow)<br />Type 1/Bug<br />Type 2/Poison<br />Moveset at Level 1:<br />Fury Attack<br />Moveset By Leveling Up:<br />Lv. 13- Horn Drill<br />Lv. 32- TM 43<br />Lv. 35- Nameless Glitch Move (Cooltrainer Move?)<br />Lv. 41- Super Glitch<br />Lv. 61- Body Slam<br />Lv. 62- Pound<br />Lv. 67- Water Gun<br />Lv. 105- Horn Attack<br />Lv. 128- Super Glitch<br />Lv. 175- Super Glitch<br />Lv. 182- Super Glitch<br />Lv. 201- TM 05<br />Lv. 208- TM 30<br />Lv. 224- Super Glitch<br />Lv. 225- TM01<br />Lv. 229- Tackle<br />Lv. 241- Super Glitch<br />Lv. 245- TM 05<br />Lv. 250- TM 01<br />Evolves At 104 into Rhydon<br /><br />$C4- :<br />Type 1/ Flying<br />Type 2/ Bug<br />Level 0 Moveset:<br />Kinesis, Poison Gas, Clamp, Spore<br />Moveset by leveling up:<br />Lv. 1- Super Glitch<br />Lv. 11- Cooltrainer Move<br />Lv. 12- Double-Edge<br />Lv. 13- Tail Whip<br />Lv. 14- Disable<br />Lv. 40- Cooltrainer Move<br />Lv. 76- Mega Punch<br />Lv. 80- Cooltrainer Move<br />Lv. 191- Scratch<br />Lv. 255- Wrap<br /><br />$C5- 4.e. (Hybrid of Golduck)<br />Type 1/ Water<br />Moveset at Level 0:<br />Scratch, Tail Whip, Disable<br />Moveset by leveling up:<br />It doesn&#039;t learn a single move. :V It&#039;s pretty much the same as it&#039;s english equilvalent minus the name.<br /><br />$C6- 7G (Hybrid of Slowpoke)<br />Type 1/ Water<br />Type 2/ Psychic<br />Level 0 Moveset:<br />Confusion<br />Moveset by Leveling Up:<br />Lv. 25- TM 25<br />Lv. 32- TM 29<br />Lv. 107- Quick Attack<br />Lv. 205- Horn Attack<br />Lv. 241- TM 24<br />Here are the Pokedex Entries and Encounter Sprites images of each of these glitch mons. <br />$C0:<br />[IMG]http://imagizer.imageshack.us/v2/xq90/661/bBjNUR.png[/img]<br /><br />[IMG]http://imagizer.imageshack.us/v2/xq90/661/pykYr2.png[/img]<br /><br />$C1:<br />[IMG]http://imagizer.imageshack.us/v2/xq90/673/y1mmDi.png[/img]<br /><br />[IMG]http://imagizer.imageshack.us/v2/xq90/537/dTUn9L.png[/img]<br /><br />$C2:<br />[IMG]http://imagizer.imageshack.us/v2/xq90/633/Sjsoyu.png[/img]<br /><br />[IMG]http://imagizer.imageshack.us/v2/xq90/661/5YPcu8.png[/img]<br /><br />$C3:<br />[IMG]http://imagizer.imageshack.us/v2/xq90/540/10hFcP.png[/img]<br /><br />[IMG]http://imagizer.imageshack.us/v2/xq90/538/ZCp2Dp.png[/img]<br /><br />$C4:<br />[IMG]http://imagizer.imageshack.us/v2/xq90/673/KzgPfo.png[/img]<br /><br />[IMG]http://imagizer.imageshack.us/v2/xq90/540/gv40zS.png[/img]<br /><br />$C5:<br />[IMG]http://imagizer.imageshack.us/v2/xq90/537/O4kz1W.png[/img]<br /><br />[IMG]http://imagizer.imageshack.us/v2/xq90/661/HAsxGq.png[/img]<br /><br />$C6:<br />[IMG]http://imagizer.imageshack.us/v2/xq90/538/bNKdgz.png[/img]<br /><br />[IMG]http://imagizer.imageshack.us/v2/xq90/540/UJw8ZU.png[/img]


subject: Re: PokÃ©mon Yellow - easy walk through walls glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I recently bought a PokÃ©mon Rouge (French Red) cartridge, and in this version, this glitch doesn&#039;t work along with the Amazing Man glitch (I think there is a link between these). As soon as I enter Pewter City, I get the museum dialog, then the guy teleports away. But as soon as I move, he pops back straight next to the Mart.<br /><br />I&#039;m going to try entering Pewter City not through the Mart (either re-entering the Safari Zone, then Digging out 1. to Pewter City PokÃ©mon Center or 2. to another PokÃ©mon Center, then entering Pewter city by a) Walking (probably from Viridian City) or b) Flying ; or blacking out)<br /><br />Can this glitch be performed in European R/B versions using the Walk around with only fainted PokÃ©mon glitch ? I doubt it, but maybe...<br /><br />Just an [i]apartÃ©[/i] : the Amazing Man glitch doesn&#039;t teleport NPCs, but their orientation remains South-facing until the START menu is closed.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Team Fail link=topic=7114.msg198656#msg198656 date=1433790083]<br />They do have the e-Reader code, it&#039;s just skipped out on. Normally, if a Wireless Adapter is not detected, it will default to e-Reader mode in the Japanese versions (Otherwise go to Mystery Gift if it is attached), but this check simply errors out on you and tells you it&#039;s not attached (Or if attached, it does go to Mystery Gift), so it never does jump to the code responsible for e-Reader usage in the international releases. However, by editing the Main Menu option to allow the original Japanese behaviour, you can connect to an e-Reader, all the code is still there and completely functional:<br /><br /><br />[img]http://i.imgur.com/Fg42lhj.gif[/img]<br />(Note that the text is not actually in the ROM, so I had it ripped from the Japanese games and translated. [url=http://i.imgur.com/MJ7047C.png]This is how it looks without the text[/url].)<br />[/quote]<br /><br />I see, thanks. So, to clarify, the Japanese FireRed and LeafGreen will load the same Mystery Gift screen as the localizations when the Wireless Adapter is attached and detected by the game, correct?


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=36.msg198209#msg198209 date=1426881799]<br />[quote author=Pal link=topic=36.msg198197#msg198197 date=1426720556]<br />Hey guys new here and I need some help regarding Dry Underflow in Pokemon Yellow. So I&#039;ve been trying to set it up and I&#039;ve been using the same set-up as here https://www.youtube.com/watch?v=M8XmgPTs6mw and I can get the underflow to happen fine, however when I do start scrolling down I don&#039;t actually get to any of the memory addresses because the game just freezes once the item that like changes the sprites around the menu flashes.<br /><br />I don&#039;t exactly know what my problem could be, but I&#039;m fairly sure it&#039;s the emulator I&#039;m using, which is Gambatte. Or it could be the ROM I&#039;m using. If anyone could help it would be much appreciated.<br />[/quote]<br /><br />It probably isn&#039;t an emulation error or a bad ROM (I&#039;ve personally never experienced something where the latter is the case). Try pressing B a few times until the &#039;V&#039; arrow starts flashing. While doing this, it may be a good idea to hold down a button on the d-pad. With items such as hex:83, something about them (probably their long name) causes a problem where you can&#039;t scroll through the menu without doing the steps above.<br />[/quote]<br />I&#039;ve got that problem in Celadon City on a real cartridge. It happened only depending on my position (I think the item name corrupts something...)


subject: Re: WTW mechanics discussions
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  Something else : for the ledge method of WTW, we simply have CD38 non-zero with bit 7 of D730 deactivated.<br />However, the Museum guy method is different.<br /><br />There is a path, indeed, that is written and that you follow; but it is THAT large, that it actually overwrites another very important byte : wOverrideSimulatedJoypadStatesMask (according to PokÃ©red&#039;s disassembly), which is CD3B.<br /><br />To make things clear, this is a piece of pseudo-code that seems to be the game&#039;s logic for movement.<br />[code]<br />If D730 &#039;s 7th bit is set, then<br />&nbsp; Perform logical AND of CD3B and joypad input<br />&nbsp; If result is non-zero then<br />&nbsp; &nbsp; Put joypad input in _move<br />&nbsp; Else<br />&nbsp; &nbsp; Read the byte at CCD3 + [content of CD37], and put it into _move<br />&nbsp; &nbsp; Increase CD37<br />&nbsp; &nbsp; Decrease CD38<br />&nbsp; &nbsp; If CD38 is zero, then<br />&nbsp; &nbsp; &nbsp; Reset bit 7 of D730<br />&nbsp; &nbsp; EndIf<br />&nbsp; EndIf<br />Else<br />&nbsp; Put the joypad state into _move<br />EndIf<br />Change direction the player is facing<br />If the tile the player is facing is non-solid OR CD38 is non-zero<br />&nbsp; Move once in the direction the player is facing<br />EndIf<br />[/code]<br />Note : _move isn&#039;t the content of a memory address, I suppose it is any of the 8-bit z80 registers.<br />There is a logic behind collision deactivation if CD38 is non-zero : as much more code is read if CD38 is non-zero, it seems legit do skip collision detection to compensate. Also pre-programmed paths should never fail (we all know that when glitches are thrown into the mix, pre-programmed paths DO fail :P)<br />All this code and hypotheses are totally empirical, and have NOT been checked against the disassembly. It just seems that it works so.<br /><br />I&#039;d then categorize WTW methods as follows :<br />1. CD38 non-zero, but bit 7 of D730 reset (ledge method, select bug/ACE methods)<br />2. CD38 non-zero, bit 7 of D730 set, but CD3B is non-zero (Museum guy, Youngster methods)<br /><br />According to [url=http://forums.glitchcity.info/index.php/topic,6675.msg198359.html#msg198359]this post of mine[/url], a spot for &quot;Museum guy&quot; WTW disallows up/down movement. However, holding left/right will allow up/down movement, and as up/down key presses are checked first in the overworld movement script, you may go up/down. (e.g. it wouldn&#039;t work if only U/D was allowed)<br /><br /><br />[quote author=Torchickens link=topic=7221.msg197888#msg197888 date=1424638561]<br />This means if you Trainer-Flied from Route 8, beat a Trainer from another route, viewed that sign in Lavender Town then returned to Route 8 the game would bring up her text (I confirmed it bringing up her text from after battle and I previously beat her, maybe the game would bring up her text before battle if you didn&#039;t beat her?)<br />[/quote]<br />Absolutely, tested it on VBA and real hardware.<br /><br />[quote author=bbbbbbbbba link=topic=7221.msg198147#msg198147 date=1426109155]<br />Right, bit 7 of D730 determines whether &quot;the joypad simulation script is running&quot;. More accurately, that bit is checked every time the game reads joypad input in the overworld. If it is set, a simulated input is read from a sequence (starting at CCD3), with CD38 as an decreasing index (it is decreasing so that the game knows to end the simulation when it goes to 0).<br />[/quote]<br />Looks like CD37 is an increasing index, to track the position of the player in the guide list ? Or is it a step counter ?<br />Still, CD38 is used by the collision engine, and D730 by the overworld movement script.<br /><br />I have a theory about guidance list reading :<br /># Either the list is read backwards, then the game reads byte at CCD3 + [content of CD38] if CD38 is non-zero;<br /># Or the list is read forwards, then the game uses the formula presented in the above pseudo-code section.<br />No idea which is correct.<br />[EDIT after testing on BGB]<br />The list is read backwards.<br /><br />Initialization seems to work like so :<br />1. Start at CCD3<br />2. Increment (CD38).<br />3. Is it $FF ?<br />4. If no, repeat from step 2, looking at the next address in RAM.<br />(like this asm ?)<br />[code]<br />&nbsp; ld bc, CCD3<br />&nbsp; ld hl, CD38<br />guidanceInitLoop:<br />&nbsp; inc (hl)<br />&nbsp; ld a, (bc)<br />&nbsp; inc bc<br />&nbsp; cp $FF<br />&nbsp; jr nz, guidanceInitLoop<br />[/code]<br /><br /><br />[quote author=pigdevil2010 link=topic=7221.msg197905#msg197905 date=1424718646]<br />Collision check will check this value. If it&#039;s non-zero, it won&#039;t block the player (this thing may applied to avoid a player bumping with an NPC or unwanted objects during walking I suppose?)<br />.<br />[/quote]<br />Actually, you&#039;re right : you partially clip into the NPC guiding you.<br />[img]http://i.imgur.com/ViH15wX.png[/img]<br />Should try changing the collision detection to still work during guidance. I think you&#039;ll bump into Oak ? (If yes, you&#039;ll freeze after a while, when Oak enters the lab, much like the glitch using the girl to prevent Red correctly following Oak and thus, never entering the lab)<br /><br /><br />[quote author=SatoMew link=topic=7221.msg197907#msg197907 date=1424726241]<br />[quote author=pigdevil2010 link=topic=7221.msg197905#msg197905 date=1424718646]<br />Collision check will check this value. If it&#039;s non-zero, it won&#039;t block the player (this thing may applied to avoid a player bumping with an NPC or unwanted objects during walking I suppose?)<br />. But since the joypad simulation script is not running, this value won&#039;t be decremented.<br /><br />Also, I found out that the code at $3486 also involves setting bit 7 of D730 ([D730] = [D730] | $80) too. Maybe this is used for overworld movement script.<br />[/quote]<br /><br />Thanks. Do you know if there&#039;s an equivalent to CD38 in the Generation II games?<br />[/quote]<br />More or less. Looks like Generation II uses a different method : there are four addresses that control collision (one per direction). That&#039;s the &quot;WTW&quot; part of CD38. For the &quot;guidance&quot; part, there must be an equivalent of CD38, but I have no idea where it is located in memory.<br /><br />I&#039;ll peek at the disassembly later to (in-)validate my &quot;bullshit theories&quot;, I&#039;ll be back !


subject: Re: The Member's Guide to Topiclessness
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve been popping in once in a while. Very busy, and tired these days. Work, college, no car, paying bills and rent on an apartment, pretty much my entire life right now.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7114.msg198665#msg198665 date=1433948700]<br />[quote author=Team Fail link=topic=7114.msg198656#msg198656 date=1433790083]<br />They do have the e-Reader code, it&#039;s just skipped out on. Normally, if a Wireless Adapter is not detected, it will default to e-Reader mode in the Japanese versions (Otherwise go to Mystery Gift if it is attached), but this check simply errors out on you and tells you it&#039;s not attached (Or if attached, it does go to Mystery Gift), so it never does jump to the code responsible for e-Reader usage in the international releases. However, by editing the Main Menu option to allow the original Japanese behaviour, you can connect to an e-Reader, all the code is still there and completely functional:<br /><br /><br />[img]http://i.imgur.com/Fg42lhj.gif[/img]<br />(Note that the text is not actually in the ROM, so I had it ripped from the Japanese games and translated. [url=http://i.imgur.com/MJ7047C.png]This is how it looks without the text[/url].)<br />[/quote]<br /><br />I see, thanks. So, to clarify, the Japanese FireRed and LeafGreen will load the same Mystery Gift screen as the localizations when the Wireless Adapter is attached and detected by the game, correct?<br />[/quote]<br /><br /><br />Yes, that would be correct. They made use of the Wireless Adapter as well.


subject: Re: The Most Memorable Threads of GCLF
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &#039;cause I&#039;m serious (why so serious ??... okay --&gt;&#91;]), I only nominate the &quot;Arbitrary code execution with 8F&quot; http://forums.glitchcity.info/index.php/topic,6638.0.html<br /><br />Seriously, that&#039;s the one that, quote :<br />[quote author=Abwayax link=topic=6638.msg192407#msg192407 date=1385864209]<br />Congratulations for your epic discovery!<br /><br />This thread made front page of [url=http://news.ycombinator.com]Hacker News[/url] today, resulting in hundreds of viewers reading the thread and setting a record for the [url=http://forums.glitchcity.info/index.php?action=stats]most visitors online[/url] on our humble forum.<br /><br />It&#039;s awesome that the server can handle this much traffic today. I remember back in the early days when it went down roughly once a week.<br /><br />The video is also currently the top post in [url=http://www.reddit.com/r/programming/]/r/programming[/url] today.<br /><br />I would award you &quot;Distinguished Member&quot; status but someone beat me to it. This makes me wish we had something higher. Distinguished Member+ perhaps?<br />[/quote]


subject: GBC-like Graphical Engine
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello everyone, ISSOtm here !<br /><br />I am currently programming a game on my TI 84 Plus, and I wanted to display graphics in the same manner as a GBC.<br /><br />I wrote some code, but it doesn&#039;t work that well...<br />[code]<br />; arguments :<br />; bc -&gt; pointer to tile map (tile ID list)<br />; ix -&gt; pointer to tile data (see tile structure)<br /><br />GBClikeEngine:<br />	ld de, appBackupScreen<br />	ld hl, plotSScreen<br />	ld a, 192&nbsp; ; there are 384 tiles, but we are only going to draw half of them<br />	push bc<br />	<br />drawEvenTiles:<br />	push ix&nbsp; &nbsp; ; we will later need to restore ix to load another tile pointer<br />	push af<br />	<br />	ld a, (bc) ; get the first tile&#039;s ID<br />	push bc<br />	add a, a&nbsp;  ; a contains the current tile&#039;s ID<br />	add a, a&nbsp;  ; four bytes per tile<br />	ld b, 0<br />	ld c, a<br />	add ix, bc ; now ix contains a pointer to the tile being drawn<br />	<br />drawEvenTile:&nbsp; ; for some reason, evenly-numbered tiles must be drawn in one go, then all odd-numbered tiles will be.<br />	ld b, 4&nbsp; &nbsp; ; we are going to draw 4 lines<br />evenTileLoop:<br />	ld a, (ix)<br />	rld&nbsp; &nbsp; &nbsp; &nbsp; ; load to main buffer. This is placed incorrectly, but &quot;drawOddTiles&quot; will rotate this into a correct position<br />	and $F0<br />	ld (de), a ; load to back-buffer<br />	push bc&nbsp; &nbsp; ; save counter<br />	ld bc, 12<br />	add hl, bc ; go 12 bytes later (one screen line)<br />	ex de, hl<br />	add hl, bc ; same<br />	ex de, hl<br />	inc ix&nbsp; &nbsp;  ; go to next byte of current tile data<br />	pop bc&nbsp; &nbsp;  ; restore counter<br />	djnz evenTileloop<br />	<br />	pop bc<br />	inc bc&nbsp; &nbsp;  ; we will draw the next tile<br />	pop af<br />	pop ix&nbsp; &nbsp;  ; restore the base tile pointer<br />	dec a<br />	jr nz, drawEvenTiles<br />	<br />	pop bc<br />	inc bc&nbsp; &nbsp;  ; we are going to draw the odd-numbered tiles, so add an offset of 1<br />	ld de, L3<br />	ld hl, L6<br />	ld a, 192<br />	<br />drawOddTiles:<br />	push ix&nbsp; &nbsp; ; we will later need to restore ix to load another tile pointer<br />	push af<br />	<br />	ld a, (bc) ; get the first tile&#039;s ID<br />	push bc<br />	add a, a&nbsp;  ; a contains the current tile&#039;s ID<br />	add a, a&nbsp;  ; four bytes per tile<br />	ld b, 0<br />	ld c, a<br />	add ix, bc ; now ix contains a pointer to the tile being drawn<br />	<br />drawOddTile:<br />	ld b, 4&nbsp; &nbsp; ; we are going to draw 4 lines<br />oddTileLoop:<br />	ld a, (ix)<br />	rld&nbsp; &nbsp; &nbsp; &nbsp; ; load to main buffer. This rotates the previously incorrectly-placed nibble into a correct position<br />	and $F0<br />	rrca<br />	rrca<br />	rrca<br />	rrca<br />	ld c, a<br />	ld a, (de)<br />	or c<br />	ld (de), a ; load to back-buffer<br />	push bc&nbsp; &nbsp; ; save counter<br />	ld bc, 12<br />	add hl, bc ; go 12 bytes later (one screen line)<br />	ex de, hl<br />	add hl, bc ; same<br />	ex de, hl<br />	inc ix&nbsp; &nbsp;  ; go to next byte of current tile data<br />	pop bc&nbsp; &nbsp;  ; restore counter<br />	djnz oddTileloop<br />	<br />	pop bc<br />	inc bc&nbsp; &nbsp;  ; we will draw the next tile<br />	pop af<br />	pop ix&nbsp; &nbsp;  ; restore the base tile pointer<br />	dec a<br />	jr nz, drawOddTiles<br /><br />	ret<br />[/code]<br />(appBackupScreen and plotSScreen are two RAM areas within the TI 84+)<br />The way it should be used is so :<br />Create some tile data, which is composed of four bytes per tile (one per line). The first byte goes to appBackupScreen, the second to plotSScreen.<br />Create some tile map, which is composed of 384 bytes (because the TI&#039;s screen is 96 * 64 pixels large, divided by 4 * 4 pixels per tile -&gt; 384 tiles). Each byte holds the ID of the corresponding tile.<br />Call GBClikeEngine, with ix pointing to the tile data, and bc pointing to the tile map.<br /><br />As I said, its objective is to reproduce the way the GBC screen works, on a TI 84 Plus (which as a B/W only display)<br /><br />Could someone help me ? Thanks.


subject: Re: PokÃ©mon Yellow - easy walk through walls glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6675.msg198664#msg198664 date=1433927863]<br />I recently bought a PokÃ©mon Rouge (French Red) cartridge, and in this version, this glitch doesn&#039;t work along with the Amazing Man glitch (I think there is a link between these). As soon as I enter Pewter City, I get the museum dialog, then the guy teleports away. But as soon as I move, he pops back straight next to the Mart.<br /><br />I&#039;m going to try entering Pewter City not through the Mart (either re-entering the Safari Zone, then Digging out 1. to Pewter City PokÃ©mon Center or 2. to another PokÃ©mon Center, then entering Pewter city by a) Walking (probably from Viridian City) or b) Flying ; or blacking out)<br /><br />Can this glitch be performed in European R/B versions using the Walk around with only fainted PokÃ©mon glitch ? I doubt it, but maybe...<br /><br />Just an [i]apartÃ©[/i] : the Amazing Man glitch doesn&#039;t teleport NPCs, but their orientation remains South-facing until the START menu is closed.<br />[/quote]<br /><br />Je vois que tu es franÃ§ais, ISSOtm, connais-tu PRAMA ? N&#039;hÃ©site pas Ã  venir sur notre forum aussi :) et merci de nous Ã©viter de faire ce test, du coup !


subject: Re: Help with the self-hacking Pokemon Blue Version (-kinda)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I&#039;m sorry you couldn&#039;t get the changes you wanted. Are you using Windows? For other platforms, [url=http://alternativeto.net/software/hxd/?platform=linux]these[/url] may be some open source hex editors.<br /><br />The hex editor I personally use is a freeware program known as HxD, for Windows. It can be found [url=http://mh-nexus.de/en/downloads.php?product=HxD]here[/url] (fifth row).<br /><br />You will need to open the ROM (make sure it isn&#039;t marked read only on Properties), then type in the changes. It may be quicker to get to 3FA6 with Search&gt;Goto... 3FA6 (on hex).<br /><br />If done correctly, the changes should look like this.<br /><br />[img]http://i3.minus.com/iTUYczwVSMrMc.png[/img]<br /><br />Afterwards, you can save your ROM as another .GB file.<br /><br />It could be that you entered the wrong values by mistake, as it&#039;s easy to do that or forgot to save the changes, or maybe your hex editor just didn&#039;t work.<br /><br />Make sure that you overwrite the offsets without inserting bytes (if you inserted bytes the last offset is no longer FFFFF; avoid that) or the hack may not work.<br /><br />I hope this helps.<br /><br />[quote author=Crystal_ link=topic=7291.msg198648#msg198648 date=1433715686]<br />Both TheZZAZZGlitch&#039;s and my self-hacking Pokemon Red/Blue videos have information about the bytes you need to change to implement it in the description (including info about how to make it a faster/slower corruption):<br /><br />[quote]Every 17 ms, there&#039;s aproximately a 1 in 4 chance that a random byte in memory (WRAM area in the range C000 - DEFF) gets corrupted, that is, overwritten with a random value. <br /><br />Implementing this hack (in hex):<br /><br />Starting at address 0040, write: C3 A6 3F C3 24 20<br />Starting at address 3FA6, write: F5 C5 D5 E5 CD 5C 3E E6 03* A7 20 14 CD 5C 3E E6 1F C6 C0 67 FE DF 28 F4 CD 5C 3E 6F CD 5C 3E 77** E1 D1 C1 F1 C3 43 00<br /><br />*Try 07 for slower glitching (1 in 8 chance) and 01 for even faster glitching (1 in 2 chance). <br />**Alternatively, try 34, 35, 70, 71, 72, or 73.[/quote]<br /><br />They aren&#039;t exactly the same, but both versions (TheZZAZZGlitch&#039;s and mine) will work.<br /><br />[/quote]<br />Spoink also has [url=http://forums.glitchcity.info/index.php/topic,7253.0.html]a PokÃ©mon Red/Blue ROM hack[/url] with a self-hacking script already enabled.


subject: Re: Favorite PokÃ©mon
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  My favourite PokÃ©mon are Torchic and Emolga.<br /><br />Glad you like 3TrainerPokÃ© $, I think it&#039;s very cool with its huge base stats except for HP and Speed and through TM/HM and equivalent trade it can learn good moves like Thunder Wave and Softboiled to restore its HP and attacking moves like Earthquake, Mega Drain, Ice Beam, Tri Attack (but it is the fake hex:0E Normal so probably doesn&#039;t gain STAB for it).<br /><br />My other favourite Generation I glitch PokÃ©mon are [url=http://bulbapedia.bulbagarden.net/wiki/94]94[/url] (Red/Blue hex:F1), [url=http://bulbapedia.bulbagarden.net/wiki/%E3%82%A5_4%E3%81%81_4]ã‚¥ 4- 4[/url] (Yellow hex:F8 - it looks vaguely like a blue Bulbasaur totem pole if you imagine it, I love it), [url=http://bulbapedia.bulbagarden.net/wiki/._%E3%82%A5_(_.I%27_.]. ã‚¥ ( .I&#039;[/url] (Yellow hex:F0).[url=http://bulbapedia.bulbagarden.net/wiki/X_%E3%82%A5-_x%E3%82%A5,]X ã‚¥- xã‚¥,[/url] (Red/Blue hex:C4) and various others like those with large base stats or interesting things that make them more special (PokÃ©WTrainer, â™€ ., etc).


subject: Re: The dream thread
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Bert
icon: xx
body:
  Well for whatever reason I was petsitting for my uncle, and he tells me he has two new pets. He doesn&#039;t tell me what they are, because why the hell not.<br /><br />I head down to the basement and come across a super secret door leading to...Noki Bay&#039;s underwater city. Well, that makes sense since I&#039;ve been playing lots of Super Mario Sunshine lately. So I&#039;m swimming around and losing health when suddenly MOTHERFUCKING PHANTA MANTA OUT OF NOWHERE. I bail from Noki Bay back to the basement, assuming this is one of his new pets.<br /><br />I go looking around to see if the other pet is this bad, when suddenly MOTHERFUCKING WIGGLER OUT OF NOWHERE. Not only is this Wiggler not prone to anger, but he&#039;s the happiest living thing I&#039;ve ever met. We spent the rest of the dream running around the house and having fun.<br /><br />Uh...huh.


subject: Re: PokÃ©mon Super Mystery Dungeon!
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=http://serebii.net/news/2015/12-June-2015.shtml]Megas confirmed[/url], as expected. Hoopa Unbound is also in the game.


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So apparently [url=https://www.youtube.com/watch?v=Nmo6rFJDFsA]Ryu[/url] and [url=https://www.youtube.com/watch?v=D8Jjz-V8jE4]Roy[/url] are playable.<br /><br />Kinda hyped for Ryu, but Roy is just a huge WHY.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I figure that Team Fail has a better handle on the FR/LG side of this than I do, so I decided to look into how the program run on the e-Reader works.<br /><br />It uses the e-Reader API to load the VPK data of a scanned card into a buffer at $2005C6D, and decompress it into another buffer at $200645C. It then grabs a $3D4-byte Trainer Tower data structure from offset $100 of the card data. (It ignores everything else on the card, which is just a Z80 program that displays the error screen I posted earlier.) The data from up to 8 cards is stored consecutively starting at $200749C.<br /><br />The data is sent to the game using a very similar protocol to the R/S/E Mystery Events. First the â€œGameFreak inc.â€ packet is sent, which, as Team Fail noted earlier, has the value $02 instead of $01 at offset $24. The second packet contains the card data preceded by two dwords: the first is the number of cards, and the second is a bytewise checksum of all the card data.<br /><br />The Trainer Tower data structure appears to be the same as [url=http://bulbapedia.bulbagarden.net/wiki/Trainer_Tower_data_structures_in_Generation_III]the one on Bulbapedia[/url] except that the trainer names are 8 bytes instead of 11, and consequently an alignment byte is added at offset $3CF. The dword at $3D0 is a bytewise checksum. (Itâ€™s possible that if the English FR/LG can be made to accept Trainer Tower e-Reader data, it will expect the trainer names to be 11 bytes.)<br /><br />It seems that the language code at offset $2A of the â€œGameFreak inc.â€ packet is the only method of language lockout used. Thereâ€™s nothing in the card data indicating which language version of FR/LG itâ€™s for, although the Japanese cards can only be scanned on a Japanese e-Reader+. Curiously, the program contains the string ã€Œãƒªãƒ¼ã‚¸ãƒ§ãƒ³ã‚¨ãƒ©ãƒ¼ã€ [i]Region error[/i], but itâ€™s unreferenced. (ã€Œã¤ãã‚‰ã‚ŒãŸã€€ã‚«ãƒ¼ãƒ‰ãƒ‡ãƒ¼ã‚¿ã‚’ã€€ãŠãã‚Šã€€ãªãŠã—ã¾ã™ã‹ã€ is also unreferenced.)<br /><br />Thereâ€™s also no apparent indicator that Trainer Tower data, rather than some other type of data, is being sent, unless this is what the $02 at offset $24 of the â€œGameFreak inc.â€ packet means. It could be that FR/LGâ€™s Mystery Gift will accept only Trainer Tower data over the link cable, and any other kind of Mystery Gift requires the wireless adapter.<br /><br />The Japanese FR/LG is able to communicate with this program even if itâ€™s already running on the e-Reader; itâ€™s not strictly necessary for the game to send the program to the e-Reader first before it receives the data. This implies that it would be possible to write an e-Reader dotcode application that can send data to the game without using the built-in program.


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=7086.msg198684#msg198684 date=1434229763]<br />but Roy is just a huge WHY.<br />[/quote]<br /><br />He can literally roast Falco with his forward smash, what more do you want?


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I saw the leak this morning lol, everybody hyped about the new characters meanwhile im like...<br /><br />RHYTHM HEAVEN!? KEN&#039;S THEME!? FUCK YEAH 2 NEW OMEGA STAGES!!!!<br />


subject: 94 backsprite crashes
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  94&#039;s back sprite will crash the game when certain defending PokÃ©mon appear.<br />I&#039;ve only encountered two.<br /><br />Pidgey - Very low chance. Plays weird glitch noises akin to 9ã‚¥to ($E6), other times it just loads for a while before sending out.<br />Geodude - High chance. Freezes the game.


subject: Re: 94 backsprite crashes
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spoink
icon: xx
body:
  94&#039;s backsprite pointer is at $9181.<br />This means that if a PokÃ©mon&#039;s sprite is smaller than the black line shown in the image below, then it should 100% cause a freeze.<br />Of course, it could be that the area is white or of only one color on the sprite.<br />[img]http://i.imgur.com/YjWSMxH.png[/img]


subject: Re: PokÃ©mon Yellow - easy walk through walls glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6675.msg198664#msg198664 date=1433927863]<br />I recently bought a PokÃ©mon Rouge (French Red) cartridge, and in this version, this glitch doesn&#039;t work along with the Amazing Man glitch (I think there is a link between these). As soon as I enter Pewter City, I get the museum dialog, then the guy teleports away. But as soon as I move, he pops back straight next to the Mart.<br /><br />I&#039;m going to try entering Pewter City not through the Mart (either re-entering the Safari Zone, then Digging out 1. to Pewter City PokÃ©mon Center or 2. to another PokÃ©mon Center, then entering Pewter city by a) Walking (probably from Viridian City) or b) Flying ; or blacking out)<br />[/quote]<br />The glitch does not work on my cartridge. I&#039;m beginning to doubt about this glitch also working on Us carts, that would mean this glitch is emulator-only ? That&#039;s sad.<br /><br />The &quot;Best&quot; result I could achieve was to teleport to Vermilion City, then to fly to Pewter City : the guy began walking downwards as he does infinitely on emulator, but he snapped back towards his normal location after a few steps.<br /><br />Could someone please test this on a US cartridge ?


subject: Re: Recent purchases
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Record shows are great.<br /><br />Metallica - ...And Justice for All<br />Ramones - Adios Amigos!<br />The Kings - Are here and More<br />Queen - lol some 1979 bootleg concert DVD<br /><br />This shit cost like $15.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: HÃ¡Äky
icon: xx
body:
  It looks like the e-Reader side of Mystery Gift is in fact limited to Trainer Tower data, and everything else goes through the Wireless Adapter.<br /><br />The functions of R/S/Eâ€™s Mystery Events are present in FR/LG (see the jump table at $81DBCF0 in the English FireRed), with the exceptions of $0B (gift item when mixing records) and $0E (in-game clock adjustment), which understandably display the message â€œThis data canâ€™t be used in this version.â€ It appears that this system is somehow tied into the Wireless Adapter side of Mystery Gift. The upside is that these functions ought to work in the English version without alteration; the downside is that I have no idea how to go about accessing them.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7114.msg198694#msg198694 date=1434341323]<br />It looks like the e-Reader side of Mystery Gift is in fact limited to Trainer Tower data, and everything else goes through the Wireless Adapter.<br /><br />The functions of R/S/Eâ€™s Mystery Events are present in FR/LG (see the jump table at $81DBCF0 in the English FireRed), with the exceptions of $0B (gift item when mixing records) and $0E (in-game clock adjustment), which understandably display the message â€œThis data canâ€™t be used in this version.â€ It appears that this system is somehow tied into the Wireless Adapter side of Mystery Gift. The upside is that these functions ought to work in the English version without alteration; the downside is that I have no idea how to go about accessing them.<br />[/quote]So at this point, all that the e-Reader can send over is trainers then, while other events use the Wireless Adapter?<br /><br /><br />Also, if you want a fixed copy of the ROM for testing with, I can probably provide you with a patch or something.


subject: Re: Pokemon Yellow &quot;Save Abuse&quot; Glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t really know if this is known, but you can trigger the item underflow while still having 0 PokÃ©mon by doing 9&gt;10, 10&gt;11. This allows you to get rid of any Prevented Progress in Yellow.<br /><br />Also, about hitmonlee/hitmonchan, I saw in a vid from Torchickens that you can trigger a WTW by doing a 1&gt;62 swap so this help much in the dojo.


subject: Re: The Most Memorable Threads of GCLF
poster_name: GARYM9
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was about to go &quot;OH SHIT IT&#039;S SHERKEL&quot; but then I realized his posts were made in 2010.<br /><br />Regardless, I&#039;m moving this to forum discussion.


subject: MOVED: The Most Memorable Threads of GCLF
poster_name: Photon-Phoenix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=http://forums.glitchcity.info/index.php?board=100.0]Forum Discussion[/url].<br /><br />[iurl]http://forums.glitchcity.info/index.php?topic=5865.0[/iurl]


subject: Re: Bert's Album Reviews
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [b][u]Ramones: Adios Amigos![/u][/b]<br />If you don&#039;t know who the Ramones are, then get your ass over to YouTube or something. Goddamn, it&#039;s 2015 and not knowing who the Ramones are is inexcusable.<br /><br />After 20 years of rocking people&#039;s faces off with bombastic punk rock classics like &quot;Blitzkrieg Bop,&quot; &quot;I Wanna Be Sedated,&quot; &quot;Rock &#039;n&#039; Roll High School,&quot; and &quot;The KKK Took My Baby Away,&quot; the New Yorkers decided it was time to call it a day. In 1995, with 13 albums under their belt, they released the self-explanatory [i]Adios Amigos![/i]. To drive the point home that this was definitely going to be the last one, title aside, the back cover shows the band lined up against a wall, preparing to be executed by firing squad.<br /><br />[i]Adios Amigos![/i] isn&#039;t too different from the Ramones&#039; &#039;70s classics, aside from its slightly slower pace to accompany Joey&#039;s aging vocals. Not that it&#039;s really noticable, &#039;cause he carries the songs like nobody&#039;s business. Like previous albums it also has a few covers, notably &quot;I Don&#039;t Want to Grow Up&quot; by Tom Waits which became a minor hit for the band, reaching the Top 40 on the Billboard Rock Charts. The Johnny Thunders song &quot;I Love You&quot; is on the album as well. Two songs from C.J.&#039;s solo projects, &quot;Makin&#039; Monsters for My Friends&quot; and &quot;It&#039;s Not for Me to Know,&quot; and &quot;The Crusher,&quot; from Dee Dee&#039;s rap album (you read that right) [i]Standing in the Spotlight[/i] are also here, but retooled to fit the Ramones&#039; sound.<br /><br />Much like every other Ramones release, the songs are quick and to the point, and only three songs - &quot;Life&#039;s A Gas,&quot; &quot;She Talks to Rainbows&quot; and &quot;Born to Die in Berlin&quot; last over 3 minutes. &quot;Have a Nice Day&quot; and &quot;Got Alot to Say&quot; are both under 2 minutes at 1:40, much like the fan-favorite &quot;Wart Hog&quot; from [i]Too Tough to Die[/i]. However, these songs are actually [i]sung[/i] by C.J., instead of that maniacal sceaming Dee Dee performed them in. &quot;Have a Nice Day&quot; in particular has a nice little bouncy rhythm to it, but that&#039;s like saying every DragonForce song as a long guitar solo.<br /><br />While everything here&#039;s a standout, the one song I would classify as my favorite is &quot;Life&#039;s A Gas,&quot; written by Joey. Its lyrics, in their entirety, are as follows:<br /><br />&quot;Life&#039;s a gas, life&#039;s a gas, life&#039;s a gas, a gas, oh yeah<br />Life&#039;s a gas, life&#039;s a gas, life&#039;s a gas, a gas, oh yeah<br /><br />So don&#039;t be sad &#039;cause I&#039;ll be there<br />Don&#039;t be sad at all&quot;<br /><br />Nice and simple, but as far as I can tell it was never performed by the band. Joey performed it at a 1995 solo concert, though.<br /><br />The album is also notable for featuring an appearance from Dee Dee Ramone, who left when the band started working on 1989&#039;s [i]Brain Drain[/i], where he sings &quot;Born to Die in Berlin&quot;&#039;s final verse over the phone in German. The song ends the album on a bit of a sour note with passively optimistic lyrics, which leads me to their final show.<br /><br />On August 6th, 1996, the Ramones performed pretty much the same setlist as always, but with a few choice songs like &quot;The Crusher,&quot; &quot;Chinese Rock&quot; and the fucking Spider Man theme song, which appeared on [i]Adios Amigos![/i] as a bonus track. It also featured several artists who were influenced by the Ramones, including Lemmy, Chris Cornell, and Eddie Vedder. Frankly, I wish the band spruced up their set a bit, throwing in &quot;Too Tough to Die,&quot; &quot;Go Lil&#039; Camaro Go&quot; and ending with &quot;Life&#039;s a Gas.&quot; Ah well, that&#039;s what dream setlists are for!<br /><br />Their whole career ended disappointingly, since they were unhappy with how their last show went, and the subsequent years being marked by the deaths of its band members: Joey died in 2001, Dee Dee in 2002, and Johnny in 2004. Gee, why does this sound familiar? The longest of the original members to survive was Tommy, who died in 2014.<br /><br />So aside from the unpleasant demise of the band, [i]Adios Amigos![/i] is, for all intents and purposes, a damn fine note to go out on. Good luck getting their final show&#039;s CD/video release, [i]We&#039;re Outa Here![/i], &#039;cause it&#039;s out of print.<br /><br />Bert&#039;s score: 90/100<br /><br />Recommended songs: Makin&#039; Monsters for My Friends, The Crusher, Life&#039;s a Gas, Have a Nice Day, Scattergun, Born to Die in Berlin


subject: Re: SETTLE IT! In SMASH! (SSB4 thread)
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7086.msg198701#msg198701 date=1434525693]<br />So does Ryu suck or do I just suck at using him? 90% sure it&#039;s the latter.<br />[/quote]<br />ryu&#039;s really good, a very solid character with combos that come straight from SFIV .<br /><br />He&#039;s easily the most technical character you can pick up, and literally requires you to transfer your SFIV knowledge into smash bros. He does tremendous amounts of damage and his moves have stupid amounts of priority, however he&#039;s countered by zoning and other smash fundamentals. Fun character, especially if you played SFIV at some competitive level.<br /><br />


subject: Big problem with hacking a stock Gold ROM
poster_name: theparanoiabug97
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: theparanoiabug97
icon: clip
body:
  I&#039;ve started building a Pokemon hack based on GSC today, and at first, everything was running pretty smoothly. I made a new starting town, new wild encounters on route 29, and changed the starters (to Phanpy, Smoochum and Houndour), with G2Map and StartEd. The next thing on my list was to change the text while you&#039;re picking your starter to say SMOOCHUM, PHANPY and HOUNDOUR rather than CYNDAQUIL, TOTODILE and CHIKORITA. Since this particular bit of text doesn&#039;t show up in the PokeText banks (at least, not that I could find), I downloaded Translhextion and replaced the individual bytes of data. However, when I tried to start the game again, after the &quot;New Game&quot; screen, I got the message in the screenshot. I should note that I made the file 100 or so bytes smaller by changing the names and removing the &quot;the fire/water/grass Pokemon&quot; text for each starter. Now the game is broken, and ever G2Map shows an error. I also tried it with GEST, and no luck. Please tell me why this happened, and how to fix it.<br /><br />EDIT: I returned the file to its original size by adding some empty 00 bytes with Translhextion. Still no luck.


subject: Re: Big problem with hacking a stock Gold ROM
poster_name: GARYM9
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  When you start deleting bytes in the middle of the ROM, you are changing the location of each and every subsequent byte causing fixed pointers to point to different data and subroutines because the data has been shifted left.&nbsp; This can cause data such as mappings, sprites, music, etc. to be misinterpreted as operation codes for the z80 to handle and when this happens, invalid machine codes (such as f4) and other oddities can occur causing crashes amongst other things.<br /><br />The tools you used change certain areas of the ROM via hex editing without deleting/making the ROM smaller/larger and does so in an efficient manner as those tools were created with high trial and error.<br /><br />As for fixing it, you will need to copy and paste the old code into the code you have changed.


subject: Re: Big problem with hacking a stock Gold ROM
poster_name: theparanoiabug97
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the suggestion. I&#039;ll try that and report back.<br /><br />That being said, how could I recreate what I did without shifting the existent data around?


subject: Saffron City 'odd Rocket' glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Spoink uploaded a video of a glitch involving the Rocket closest north to the Silph Co. building sign who blocks a house before you rescue Silph Co., where after you move down he appears elsewhere momentarily on the screen (top corner but not top left corner) and disappears.<br /><br />The steps are:<br /><br />[quote]<br />1. Leave and enter saffron city.<br />2. Talk to rocket guarding house.<br />3. Go in the space between the houses on the left, downwards, until the rocket is on screen.<br />[/quote]<br /><br />https://www.youtube.com/watch?v=MYAqZwr3Yv4<br /><br />I tried these steps but I unfortunately wasn&#039;t able to replicate the glitch on both an emulator and physical cartridge.<br /><br />On the emulator, I tried it both for when a Rocket doesn&#039;t block the Silph Co. building (if you have saved Mr. Fuji) and for when a Rocket does block Silph Co.<br /><br />However, on my physical cartridge I have only tried it for when a Rocket blocks the Silph Co. building so far, on a save that got to Saffron City via save abuse.<br /><br />I wonder why it wasn&#039;t working. Is anybody else able to replicate it?


subject: Re: Saffron City 'odd Rocket' glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I wasn&#039;t able to reproduce this glitch (with an emulated french version) using save abuse, or gameshark warp code from the beginning of the game. Weird.


subject: Re: The dream thread
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Some time ago I dreamt that I was a detective investigating a murder in a house on a hill. The maid had been murdered so I go in to look for clues, finding finger marks on her neck. Somebody taps my shoulder, I turn around, and get splashed in the face with hot water and pass out.<br /><br />[Scene missing]<br /><br />I was in a car chase against the murderer, the house&#039;s owner, who was returning home to dispose of any evidence he think he might&#039;ve missed. We crash on a neighboring hill, and I explain, in a very Columbo-esque way, how I figured out it was him. I don&#039;t remember what I said, but it involved CSI: Miama-tier logic and I recall saying, &quot;You said there were no witnesses, but did you take the [i]clouds[/i] into account?&quot;<br /><br />This culminated into a big fistfight that ended with me killing him after punching him down the hill, closing the case and ending the dream.<br /><br />S**t was great, yo. I wish I could remember what happened between me passing out and the car chase.


subject: Re: The dream thread
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=6554.msg198708#msg198708 date=1434846017]<br />Some time ago I dreamt that I was a detective investigating a murder in a house on a hill. The maid had been murdered so I go in to look for clues, finding finger marks on her neck. Somebody taps my shoulder, I turn around, and get splashed in the face with hot water and pass out.<br /><br />[Scene missing]<br /><br />I was in a car chase against the murderer, the house&#039;s owner, who was returning home to dispose of any evidence he think he might&#039;ve missed. We crash on a neighboring hill, and I explain, in a very Columbo-esque way, how I figured out it was him. I don&#039;t remember what I said, but it involved CSI: Miama-tier logic and I recall saying, &quot;You said there were no witnesses, but did you take the [i]clouds[/i] into account?&quot;<br /><br />This culminated into a big fistfight that ended with me killing him after punching him down the hill, closing the case and ending the dream.<br /><br />S**t was great, yo. I wish I could remember what happened between me passing out and the car chase.<br />[/quote]<br /><br />And then Bert was the true murderer, who just pushed some random dude down the hill after chasing him down with his car.<br /><br />You probably don&#039;t remember what happened after passing out because you were passed out.


subject: Re: Saffron City 'odd Rocket' glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Krys3000 link=topic=7301.msg198707#msg198707 date=1434838328]<br />I wasn&#039;t able to reproduce this glitch (with an emulated french version) using save abuse, or gameshark warp code from the beginning of the game. Weird.<br />[/quote]<br /><br />Hmm, OK. Thanks for trying though. :D


subject: Re: Saffron City 'odd Rocket' glitch
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I can&#039;t reproduce it on Japanese Red v1.0 in BGB. This seems to be [url=http://www.oxforddictionaries.com/definition/english/glitch]a glitch in the literal sense of the word[/url] (temporary, random issue) and not [url=http://www.oxforddictionaries.com/definition/english/bug]a bug[/url] (an error in the system or program that&#039;s reproducible by following a given set of steps) ;)


subject: Re: Updating the wiki and its future
poster_name: hpokÃ©_coloradohugge
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Okay, i&#039;ve been inactive for almost a year now and im finally getting back to some pokÃ©mon glitch hunting.<br />so im thinking about finally finishing all the sprites of foreign glitch pokÃ©mon.<br /><br />The games i have left to get the sprites for are:<br /><br />German Yellow, French Red/Blue, French Yellow, Italian Red/Blue, Italian Yellow<br /><br />after that, the sprite collection is finished.<br /><br />Im thinking about makeing a personal goal to actually finish this during this summer, so looking forward to that! =)


subject: Re: The dream thread
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=6554.msg198709#msg198709 date=1434856075]<br />And then Bert was the true murderer, who just pushed some random dude down the hill after chasing him down with his car.<br />[/quote]<br /><br />I guess that&#039;s how things go <br /><br />(â€¢_â€¢)<br /><br />when push<br /><br />( â€¢_â€¢)&gt;âŒâ– -â– <br /><br />comes to shove.<br /><br />(âŒâ– _â– )<br /><br />[size=24pt][b]YEEEEEEEEEEEEEAAAAAAAAAAAAAAAAAAAAAAH![/b][/size]<br /><br />I wonder if I woke up after being splashed in the face, then tried to continue the dream, and that explains the sudden car chase. Guess I&#039;ll never know!


subject: Re: English fossil conversion glitch (get absolutely any PokÃ©mon/glitch PokÃ©mon)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Hello Torchickens,<br /><br />This glitch makes actually a lot of sense while used within the save abuse glitch. Although there is many ways to get any PokÃ©mon, this appears to be a very good way to start the game with any PokÃ©mon of your choice.<br /><br />If you start the game with save abuse, your first PokÃ©mon is a Charizard &#039;M with 65535 in attack. But you also have a Dome Fossil in position 31 of the items thanks to a standard 1&gt;10 underflow. Here are the steps you have to follow :<br />[list]<br />[li]Warp to Cinnabar using the 36th item (ID = 8 )[/li]<br />[li]Store the Dome Fossil in the PC[/li]<br />[li]Swap item 31 (still the Dome Fossil) with item 36. Make a step to the left to turn it into Rare Candies x255. (You might also wanna use another item that changes with the location). It glitches a bit, so maybe you can&#039;t do that everywhere. Here is a good spot (inside cinnabar&#039;s pokemon center)<br />[img]http://www.prama-initiative.com/saveabuseconversion.PNG[/img][/li]<br />[li]Use as many Rare Candies on your first PokÃ©mon as you need to have the correct attack. The first candy makes the PokÃ©mon to go lvl 1 with an attack stat of 7. Vitamins also works, and it&#039;s easy to have them once you swapped, just walk 4 more steps to the left (in another spot, then, but it is better to end your steps above an exit mat, since exiting a building is the safest way to correct glitches) and you have the correct one for attack.<br />[img]http://www.prama-initiative.com/saveabuseconversion2.PNG[/img][/li]<br />[li]Swap back item 31 with item 36 and go to the PC. If you were in the aforementioned spot (or any other building), get out of the center and go back inside to correct the glitches.[/li]<br />[li]Withdraw the Potion, then the Dome Fossil. Bring it to the scientist[/li]<br />[li]Swap PokÃ©mon 1 and 33, exit the lab and go back inside to talk to the scientist and receive the PokÃ©mon who is sent to the PC. You can now reswap Pokemon to underflow the item menu (remember, in Yellow, you must have 0 PokÃ©mon while going to Oak&#039;s Lab, so a 8&gt;10, 10&gt;11 switch is required) and warp to Viridian, reduce your team, store glitch PokÃ©mon, fix your bag thanks to the NPC, and continue the game... with your newly acquired PokÃ©mon !<br />[img]http://www.prama-initiative.com/saveabuseconversion3.PNG[/img][/li]<br />[/list]


subject: Re: Saffron City 'odd Rocket' glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yep. We can probably try any ways to access Saffron, with many conditions (badges, etc.) but I&#039;m not sure it would change something. How many chances there are that this glitch would be only active if you gave the drink to the guard ?


subject: Re: Saffron City 'odd Rocket' glitch
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7301.msg198715#msg198715 date=1434964864]<br />How many chances there are that this glitch would be only active if you gave the drink to the guard ?<br />[/quote]<br /><br />Well, I gave the guard a drink and tried replicating the behavior but it didn&#039;t change the outcome.


subject: Re: We should reproduce this on real game cartridges
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello there,<br /><br />I was wondering if there was a way to trigger this arbitrary code execution in Gold/Silver (obviously not for the ilex forest celebi event) since the Coin Case doesn&#039;t work for us non-english people&nbsp; :P<br /><br />Do you know of a TM that would make it possible, for example, to simulate gameshark codes ? How exactly did you found out where TM33 jumped ?


subject: Re: Saffron City 'odd Rocket' glitch
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spoink
icon: xx
body:
  I will try to do this on a different save file, i seriously don&#039;t even know what i did, maybe walking in and out of the guard house triggered it.<br /><br />Edit: I tried again and the guard disappeared completely. It is probably my cartridge, (the label is scratched a bit, too&nbsp; :P )


subject: Re: English fossil conversion glitch (get absolutely any PokÃ©mon/glitch PokÃ©mon)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  [youtube]https://www.youtube.com/watch?v=NOM1MHDRYT0[/youtube]<br /><br />Here is the video I just made for the Save Abuse x Fossil Conversion crossover to get Mew before your starter, as part of the PRAMA Initiative. Red annotations are in English for international viewer. I couldn&#039;t add an English description because of YouTube&#039;s limit so I&#039;m posting it here and I will add a link :<br /><br />[EN] : Video done by Krys3000 of the PRAMA Initiative.<br />I use the Save Abuse Glitch and the international variation of the Fossil Conversion Glitch discovered by Torchickens/ChickasaurusGL (https://www.youtube.com/watch?v=tEpohfkBg8Q), allowing me to start the game with any Pokemon I want (Mew for this video).<br /><br />Read the indications before each part of this video (pause the video to read), and turn on annotations. The red ones are for international viewers.<br /><br />Save abuse is done by turning off the game immediately after saving, when no save file already exists. <br /><br />It works in Red Blue and Yellow and gives access to 255 glitch Pokemon in the team. I&#039;m only using this glitch here to access to the 33rd Pokemon which is necessary for the Fossil Conversion.<br /><br />This glitch allows to change the Pokemon that will come out of a fossil. When you switch Pokemon 1 and 33, after you gave a fossil to the scientist, you will get the Pokemon whose decimal value matches with the attack value of your first Pokemon in this list : http://glitchcity.info/biglist.htm<br /><br />Another used feature of the save abuse is the underflow of the item menu. By changing the quantity of the 36th item, I change the value of RAM address $D365 which controls the ID of the map I&#039;ll reach by exiting a building.<br /><br />The underflow also allows me to get the Dome Fossil, but if you can&#039;t find it in your own underflow, you can do that :<br />- When you are in Cinnabar&#039;s Pokemon Center, face the PNJ which allows you to link with another game.<br />- Switch item 22 (CARD KEY) with item 30 (MASTER BALL).<br />- Switch item 30 (CARD KEY) with item 36 (MASTER BALL x8).<br />- Walk 7 steps to the left.<br />- Switch item 36 (now being DOME FOSSIL) with item 30 again.<br />- Switch item 30 (DOME FOSSIL) with item 31.<br />- Go down until you leave the Center, then back inside to continue the glitch as I show in the video.<br /><br />Here is a summary of the steps :<br /><br />1. Start the game with save abuse (see above)<br />2. Switch Pokemon 1 and 10 to trigger the underflow in the item menu.<br />3. Go to item 36 and toss 248. Exit the house to reach Cinnabar.<br />4. Go to the PC and store a Dome Fossil.<br />5. Go on the spot shown in the video, then switch the Fossil to the 36th place. Go one step left to turn it in rare candies, four more steps to turn it into Proteins. Use either or both to get the first Pokemon&#039;s attack to 21.<br />6. Go down to exit the center, then back in to withdraw the Potion then the fossil. <br />7. Give the fossil to the scientist then switch Pokemon 1 and 33. Go out of the lab, then go talk to him.<br />8. Go to the Safari Zone by switching Pokemon 3 and 36. Catch a Pokemon, then walk until you don&#039;t have steps anymore.<br />9. Switch 8 - 10 then 10 - 11 to bring the dex to 0 and trigger underflow again. <br />10. Toss all but one unit of the 36th item and exit the building to warp to Viridian.<br />11. Change the active PC box and store every Pokemon but one. Withdraw Mew then store the last one. <br />12. Go get the Potion to the NPC on Route 1, then to Oak to get your starter ! If your item menu is not fixed, getting Oak&#039;s Parcel will.<br />


subject: Re: English fossil conversion glitch (get absolutely any PokÃ©mon/glitch PokÃ©mon)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I watched your video, I enjoyed it. Thanks for teaching us how to get Mew before your starter.<br /><br />I much appreciate the mention and recommendation too. I feel bad because I have not been active on Glitch City or Youtube in relation to glitch research for a while (I normally upload a video every week but it has been over two weeks). I hope to continue uploading videos soon.<br /><br />I saw your post about non-English Gold arbitrary code execution. I will look into this when I get the chance.<br /><br />Thank you for your effort and good luck with digging up more tricks for French glitchers.


subject: Re: We should reproduce this on real game cartridges
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  To see whether a TM or HM executes code from the memory when it is outside of the TM/HM pocket, you can set a breakpoint in BGB to writable memory being executed.<br /><br />To do that, right click on the window and enter the debugger. Then go to debug&gt;access breakpoints, tick &quot;on execute&quot; and then enter C000-FEFF as the address range . Then use the TM or HM (which with GameShark can be forced into the Objets pack of French Gold with 01xxB8D5) - without GameShark you may have to do the duplicate key items glitch to access it in the Balls pocket.<br /><br />Note. Here EXXX and FXXX addresses are in Echo RAM. That means E12A would effectively be the same as C12A and F222 would effectively be the same as D222, etc.<br /><br />There is also a tool created by Mateo called [url=http://www.mediafire.com/?vauymob8dzg4dez]GSC Item Editor[/url]. The tool tells us the execution pointer for Gold/Silver/Crystal in little endian. For example, TM33&#039;s execution pointer is 18F4 in little endian which is F418. I am not sure if any of the pointers point to the same data in the French version though.<br /><br />I will look for a suitable TM or HM in the French version.<br /><br />BGB breakpoints for C000-FEFF:<br /><br />CT03 - CA31<br />CT05 - D14F<br />CT08 - C4B1<br />CT11 - CBD1<br />CT15 - FA0F (DA0F)<br />CT16 - D114<br />CT17 - FA47 (DA47)<br />CT18 - D119<br />CT21 - FA6A (DA6A)<br />CT22 - D002<br />CT25 - FA6A (DA6A)<br />CT26 - D002<br />CT33 - F418 (D418)<br />CT37 - E9D5 (C9D5)<br /><br />Comments:<br /><br />DA47 (CT17) -Caught data byte 1 of party PokÃ©mon 1.<br />DA6A (CT21)&nbsp; - Defense EV byte 2 of party PokÃ©mon 2<br /><br />Edit: CS01 is like a portable name rater. While testing, one of the TMs that didn&#039;t breakpoint seemed to place me in a Glitch City when used. Somehow I got one of the ?????, will do more testing.<br /><br />CT02 - Disco effect<br />CT09 - Turned the lab into a Glitch City but made the game freeze when closing the bag.<br />


subject: Re: We should reproduce this on real game cartridges
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you for those explanations. Looking though the board, I just found one of your posts that mentions TM25 in G/S. I tried (using the &quot;PC items access from the bag&quot; glitch) and it indeed jumps in FA6A so this is a working entry point for ACE reading from the Defense EV byte of the second Pokemon !<br /><br />It might not be the most easy to handle, but it can be dealt with :)<br />


subject: Re: We should reproduce this on real game cartridges
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7202.msg198725#msg198725 date=1435244746]<br />Thank you for those explanations. Looking though the board, I just found one of your posts that mentions TM25 in G/S. I tried (using the &quot;PC items access from the bag&quot; glitch) and it indeed jumps in FA6A so this is a working entry point for ACE reading from the Defense EV byte of the second Pokemon !<br /><br />It might not be the most easy to handle, but it can be dealt with :)<br />[/quote]<br /><br />Awesome!


subject: Re: English fossil conversion glitch (get absolutely any PokÃ©mon/glitch PokÃ©mon)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for your comment, and also for the share and retweet. I think you&#039;ve done more glitch video and research than we ever will do so, that&#039;s great !<br />Besides it&#039;s good that you don&#039;t do too many videos as it will give us the time to watch them all, and, maybe, adapt some of thoses for french viewers&nbsp; :P


subject: Re: Big problem with hacking a stock Gold ROM
poster_name: pikalax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  if you don&#039;t want to mess with pointers in any bank, you have to change the script so that it&#039;s no longer than the original, and then pad the end of the script to make it the same length as the original.


subject: Cool 8F Script Based on Location
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I made an 8F script that runs code based on map stuff<br />It is based on a modified version of TheZZAZZGlitch&#039;s &quot;Run code from 3rd item&quot; script. It jumps to D35E:<br />*any item<br />*any item<br />Glitch item $C3 x94<br />TM11 x(Any quantity)<br />*you can store additional items here.<br /><br />Unfortunately, not very much can happen with this.<br /><br />I will document effects:<br />Standing here (Victory Road):<br />[img]http://i.imgur.com/c2sVgaa.png[/img]<br />will give you 99 PokÃ©mon.


subject: Minor Aesthetic Glitch in Generation VI
poster_name: DaWoblefet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello! I didn&#039;t see this documented anywhere, though I might have simply looked in the wrong places. In Generation VI (confirmed on the latest versions of Alpha Sapphire and X, anyway), if you use a multi-turn move such as Fly, Dive, Shadow Force, Dig, etc. and that Pokemon somehow gains enough experience to level up, the previous level is displayed until the game has an opportunity to &quot;refresh&quot; that area. I demonstrate this by using a level one Fletchling in a Double Battle.<br /><br />[youtube]http://youtu.be/e3k4VaPDUmc[/youtube]<br /><br />Unfortunately, it&#039;s just a minor visual error. No negative HP or arbitrary code execution or something fancy like that. I couldn&#039;t think of any potential spinoffs that would lead to something, but if someone thinks of anything, I&#039;d love to hear about it.


subject: Re: Cool 8F Script Based on Location
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Interesting way to deal with 8F ! There might be some cool, visually impressive features to get out of this. I might try a few locations too :)


subject: Re: The Member's Guide to Topiclessness
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Zowayix
icon: xx
body:
  [quote author=Raven Freak link=topic=3088.msg198645#msg198645 date=1433638768]<br />So how&#039;s everyone doing?<br />[/quote]<br /><br />I have retained my complete lack of ability to respond to small talk properly, because I read this question and acknowledged it 2 weeks ago and still haven&#039;t gotten around to it.<br /><br />In all honesty this is actually because my depression has returned once more, and it&#039;s one of those returns where it was partially destroyed but got rebuilt as a robot and all that shit.<br /><br />So, you know, not so good, this is what happens when I get burned out at work, procrastinate the making of appointments to refill prescriptions as a result (this was like 1 month and a fortnight ago), and get burned out even more along the way.<br /><br />On the plus side, I have found a new circle of friends lately (and I don&#039;t mean the word new as to replace the old ones, I just don&#039;t talk to them more because they haven&#039;t talked to me lately and I don&#039;t do initiating conversations very well and especially not in this mental state, so I don&#039;t hate them by any means and I would love to see them all again but who knows) who are some of the best people to hang around with... online of course, but some of these people might actually exist in real life, and they seem to be willing to help me through these partially troubled times.<br /><br />Still though, my entire life basically feels like it&#039;s been on hold for several months now. It&#039;s almost like it was all an artificial setup to cause me to be asked this question and not have an answer because I haven&#039;t had the mental energy to do anything, really.<br /><br />[quote author=voltage link=topic=3088.msg198674#msg198674 date=1434098583]<br />I&#039;ve been busy...but I recently came out as gay in real life. I feel liberated.<br />[/quote]<br /><br />Also congratulations, was going to do so earlier but my brain demands I write this long-winded post at the same time and so I had to wait for me to write this. Shit like that.<br /><br />By posting that you&#039;ve implicitly outed yourself on the internet as well, just so you know.


subject: Re: Wiki Bug List and Reports
poster_name: pokemaniaco
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello there,<br /><br />Not sure if this is the place where I should say this, but here it goes:<br /><br />When playing PokÃ©mon Red, and battling Koga in Fuschia&#039;s city&#039;s Gym, I was battling his Weezing, having 6 pokÃ©mon, but only 1 (Pidgeotto) not fainted. Weezing used selfdestruct, I pressed B, and while his Weezing exploded and fainted, my Pidgeotto remained intact and I did not lose the battle.<br /><br />Don&#039;t know if this is a glitch, but this fact sure happened to me, so please check it out and if it is possible. Thank you.<br /><br />Best regards,<br />Pokemaniaco


subject: Re: Surviving Selfdestruct - PokÃ©mon Red
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Might there be a chance you were in the very specific conditions of the &quot;god mode&quot; glitch (missing a two-turn move like fly because of paralysis in the second turn) ?<br /><br />This glitch makes you invincible for a fight. I know enemy moves usually faints, but I am not sure of what happens when an enemy uses selfdestruct with the glitch active. I was thinking about this only because you mentioned having a fly-type Pokemon.


subject: Hi, GCLF!
poster_name: TuxedoGlasses
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m new here, and I&#039;ve previously been lurking the forum as a guest. So hi, everyone!&nbsp; :)


subject: Re: Hi, GCLF!
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Howdy, TuxedoGlasses! Is this you?<br /><br />[img]https://upload.wikimedia.org/wikipedia/en/4/46/Horatio_Caine.jpg[/img]<br /><br />Naw, but really, welcome to GCLF!<br /><br />[img]http://images4.wikia.nocookie.net/__cb20120510221731/unanything/images/8/80/Don&#039;t_forget_you&#039;re_here_forever.jpg[/img]


subject: Re: The dream thread
poster_name: xtreme713ify
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I had a dream where I went to purgatory, which was an office building where they determined whether you go to heaven or hell. I make it to heaven, and I have the ability to fly low, but really quickly like a character in DBZ or something. I also had a dream where I went super saiyan. 


subject: Re: The dream thread
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t usually post here, but I don&#039;t usually dream about PokÃ©mon.<br /><br />It was weird. I was in Hoenn, and it started coming out of a cave and then onwards to a town, (for some reason it was supposedly Lilycove City despite Lilycove City being nowhere near a cave, unless you count that place you catch one of the Regis, forget which one. Or Mt. Pyre, and I sure didn&#039;t cross water) and into a building, where there ended up being a triple battle between myself, May(?) and an NPC, and Archie, Maxie and an NPC (why would Archie and Maxie be on the same side??). I was late getting into the battle, because I couldn&#039;t find my PokÃ© Balls for some reason, but as soon as I sent out a PokÃ©mon, the battle was over quickly.<br /><br />Cut to Wally(?) buying a Rayquaza (lolwut) from someone, then getting into some random car for some reason.<br /><br />I forget the rest, it didn&#039;t last long after that.<br /><br />Like I said, it was weird.


subject: Re: The dream thread
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=6554.msg198744#msg198744 date=1436038557]<br />Cut to Wally(?) buying a Rayquaza (lolwut) from someone[/quote]<br /><br />Going from Magikarp to Rayquaza is quite a sales leap.


subject: Cool exploit with Egg-like Decamarks (FR/LG)
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Requirements:<br />1. A decamark that acts like an egg, with only thunderpunch. (e.g. 0x1D08)<br />2. Another PokÃ©mon with two moves.<br />Steps:<br />1. Go into the summary of your normal PokCmon and scroll to moves.<br />2. Go down to the egg decamark and hit A on the first move, and swap it with the second.<br /><br />If the decamark had only thunderpunch, you can now use - without having it use struggle.<br />Unfortunately, - has 0 PP, is normal type, and you can&#039;t switch to thunderpunch.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you replace the text ID of an NPC to 08160504, then talk to them, it will ask you to save, say no. You will now have access to beyond the 6th slot.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Team Fail
icon: xx
body:
  I really hate double-posting, but I think this is a rather important development in this particular thing, so I&#039;m going to go out on a limb here and do this.<br />[quote author=HÃ¡Äky link=topic=7114.msg198685#msg198685 date=1434244697]<br />I figure that Team Fail has a better handle on the FR/LG side of this than I do, so I decided to look into how the program run on the e-Reader works.[/quote]<br />That I do, and I come bearing good news.<br /><br /><br />Prof9 and I were talking on Project PokÃ©mon&#039;s IRC, and he told me of a way to activate e-Reader support for USA copies of Emerald, and funny enough it literally only requires you to change ONE BYTE to enable it.<br /><br />&quot;Change the byte at 0x02F97E to 0x02&quot; as he said. Then, when on the Continue screen, select &quot;Mystery Gift&quot; to access a glitchy version of the application. It works in the same way as the FireRed one, although you&#039;ll still need a Japanese e-Reader to work with it. Scanning and sending cards seems to error out for some reason though.<br /><br />Anyways, on the FRLG front, I finally got it working with the English e-Reader, yet again with Prof9&#039;s assistance (And in the process showing how little I know of No$GBA&#039;s debugger and how powerful it is). I&#039;ll probably issue a preliminary patch so people can try getting cards working, however, I think I&#039;m encountering region errors, because I cannot scan in any FRLG cards, they all result in this:<br /><br />[img]http://i.imgur.com/bbNeJAO.png[/img]<br />If I revert to a version that connects with a Japanese e-Reader, it will accept the cards, but when I go to transmit the data to FRLG, it errors out, same as Emerald, presumably because of a region error. I think at this point, a disassembly of the FRLG and Emerald cards may be necessary to change their region and get them working on English games.<br /><br /><br />Edit: I have a preliminary patch [url=http://www.pokecommunity.com/showpost.php?p=8835338&amp;postcount=18]here[/url] if you wish to try this.<br /><br />Edit 2: After looking at your first post in the thread again, I may be able to adjust the VPK data and get it working. I may know how to fix this.<br /><br /><br />Edit 3: Nothing yet. Haven&#039;t gotten it working. [url=http://www.pokecommunity.com/showpost.php?p=8837441&amp;postcount=19]I do have the cards working on USA systems though[/url], but the card scanning application still won&#039;t accept it for whatever reason.


subject: Re: PokÃ©mon Super Mystery Dungeon!
poster_name: Krazyguy75
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Eh, I love PMD1.<br /><br />PMD2 was mediocre (though you could do a surprisingly large amount of hacking, and it basically had things similar to hybrids or decamarks, glitch moves, and hidden and/or glitch dungeons. It&#039;s actually really awesome to fool around it.<br /><br />PMD:GTI was worse in terms of story than 1. Its story was OK. I did not like the change to 3D, it took away the unique art style. In other ways than that, I dislike it for all the things they changed that made PMD what it was.<br /><br />I have no hope for the new one, as the thing that made PMD1 great was that it had a good story, good music, good characters, and a unique sense of gameplay. All the sequels have really only aimed for improving the last one, but you can&#039;t get a unique sense of gameplay from a formula.<br /><br />PS: If anyone is interested in fooling around in PMD2 to figure out all the glitches, I&#039;d love to assemble a team.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was able to read a card through the application on the English e-Reader after altering the card header to have the correct region code. (Specifically, I took card 15-A001, converted the .raw to .bin with nedcenc, and changed offset $0D [region code] to $F1 and offset $2E [checksum] to $0E.)<br /><br />The remaining issue is that, as I suspected earlier, the English games expect a 992-byte Trainer Tower data structure as documented on Bulbapedia rather than the 980-byte structure used in the Japanese version. Attempts to send the Japanese card data will fail when the English game tries to verify the checksums. The cards and the application will both need to be modified to use the 992-byte structure.<br /><br />As a test, I dummied out the function at $0815D6B4, which is called by the Mystery Gift routine to verify the checksums. With that alteration, I was able to successfully complete the Mystery Gift process. The data was stored in the save file, but had no apparent effect on the Trainer Tower. I then tried editing the saved data to match the 992-byte structure, but I still saw no effect. I would guess some further reprogramming is needed to restore the Trainer Towerâ€™s original functionality.<br /><br />(While editing the saved data, I noticed that on Trainer Tower cards with fewer than three trainers, the unused trainer slots have their names set to ã‚²ãƒ¼ãƒ•ãƒª, which was previously used as a hidden default name in the Japanese PokÃ©mon Blue.)<br /><br />By the way, in case youâ€™d like to spell PokÃ©mon properly in your translated application title and cards, $7F represents Ã© in the English e-Readerâ€™s pseudo-ASCII.<br /><br />[hr]<br /><br />In unrelated news, after looking at the leftover Mystery Events functions in FireRed, I discovered that the header (chunk $01) has a totally different structure than what Iâ€™d previously thought. I suppose it was purely accidental that my earlier German Eon Ticket experiment worked.<br /><br />[code]$0&nbsp; 4&nbsp; Pointer base address ($02000000)<br />$4&nbsp; 2&nbsp; Language group bitfield<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 0: Japanese<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 1: English<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 2: German, French, Italian, Spanish<br />$6&nbsp; 4&nbsp; Language bitfield<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 0: Japanese<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 1: English<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 2: German<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 3: French<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 4: Italian<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 5: Spanish<br />$A&nbsp; 2&nbsp; Game region bitfield<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 0: FireRed, LeafGreen<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 2: Ruby, Sapphire, Emerald<br />$C&nbsp; 4&nbsp; Game version bitfield<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 0: FireRed<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 1: LeafGreen<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 7: Ruby<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 8: Sapphire<br />&nbsp; &nbsp; &nbsp; &nbsp;  bit 9: Emerald[/code]<br /><br />â€œThis data canâ€™t be used in this version.â€ will appear if any of the four bitfields donâ€™t have the necessary bit set.<br /><br />All versions of FireRed, LeafGreen, and Emerald expect Mystery Events data to be marked as Japanese, regardless of the actual game language. (I still donâ€™t know of a way to actually send Mystery Events to FireRed/LeafGreen or non-Japanese Emerald.)<br /><br />It seems fairly pointless to have used four bitfields for this rather than two, and fairly obvious what the unassigned version bits might have represented.


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  *bump*<br /><br />When I did this with Silver in Japanese Crystal (thanks to the walk through walls codes 01083ED1 01083FD1 010840D1 010841D1), I experienced mainly just Trainer challenge (Juggler?) BGM playing, Electabuzz&#039;s cry playing and the GBC incompatibility message appearing.<br /><br />However, another time the game executed arbitrary code from somewhere in the D5XX or D4XX (I can&#039;t quite remember) range. I haven&#039;t been able to replicate this yet.<br /><br />Another time the low HP sound played, the music faded out and 9s were written to the screen (perhaps the game was copying too much data), and I remember the text box getting more text but not being able to scroll through it.<br /><br />In German Crystal, with assistance of the following code:<br /><br />013E10C6<br />012011C6<br />012112C6<br />017613C6<br />015B14C6<br />01CF15C6<br />01C916C6<br /><br />i.e.<br /><br />ld a,20<br />ld hl, 5B76<br />rst $08<br />ret<br /><br />; Execute ROM pointer 20:5B76.<br /><br />...I could load up the unused Trainer debug menu after talking to glitch Silver with no PokÃ©mon, though the cursors were glitched and I couldn&#039;t alter Falkner&#039;s sprite.<br /><br />With this code:<br /><br />013E10C6<br />013811C6<br />012112C6<br />016313C6<br />015E14C6<br />01CF15C6<br />01C916C6<br /><br />i.e.<br /><br />ld a,38<br />ld hl, 5E63<br />rst $08<br />ret<br /><br />; Execute ROM pointer 38:5E63.<br /><br />...I could access the memory game but it didn&#039;t boot up properly.<br /><br />Unfortunately the data at C610 where arbitrary code is executed changes as you step. Hence this is tricky to be make viable even with glitch TM/HM arbitrary code.<br /><br />I tried altering the data at DD63 (PokÃ©mon data) to add my custom code but sadly it wouldn&#039;t work for some reason. But the game executed it on BGB. So maybe extra data to bring control back to the game is needed.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, I&#039;ll keep my eyes out for other cards, like the trainer cards for the house on Seven Island. That&#039;s the card type that I&#039;m wanting to be able to import, at least for now. I&#039;m also trying to figure out on what part of the data the checksum is calculated so I can import my edited e-Reader file with the original header data intact, in case there&#039;s anything important that&#039;s read from there. Or would using nedcmake be perfectly fine for turning the VPK data into valid card data, and would the FRLGE application still accept it?


subject: Questions about the Pokemon Merge Glitch
poster_name: 1000000000000000000000000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: 1000000000000000000000000
icon: question
body:
  I have two questions about the Merge Glitch:<br /><br />1. Is it possible to set this glitch up in the party menu instead of the PC?<br /><br />2. Would this work in the Generation 2 games?


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Team Fail link=topic=7114.msg198752#msg198752 date=1436466991]<br />Well, I&#039;ll keep my eyes out for other cards, like the trainer cards for the house on Seven Island. That&#039;s the card type that I&#039;m wanting to be able to import, at least for now.[/quote]<br />The Trainer Tower cards were the only kind of card released for FireRed/LeafGreen, and Iâ€™m fairly sure Trainer Tower data is the only type of data accepted by the e-Reader version of Mystery Gift. The house on Seven Island, by analogy to those in Mossdeep and Sootopolis, would likely house a Mystery Events trainer if there were some way to send Mystery Events data to FireRed/LeafGreen, but I still donâ€™t know if there is. The [url=http://wiki.ãƒã‚±ãƒ¢ãƒ³.com/wiki/7ã®ã—ã¾]PokÃ©mon Wiki article on Seven Island[/url] seems to say that the house was unused: ã€Œæ°‘å®¶ã«ã¯ç®±ã«è¦†ã‚ã‚ŒãŸè¬Žã®æ‰‰ãŒã‚ã‚‹ãŒã€è§£æ˜Žã•ã‚Œã‚‹ã“ã¨ã¯ãªãã€ã‚¤ãƒ™ãƒ³ãƒˆãªã©ã¯ä¸€åˆ‡èµ·ã“ã‚‰ãªã„ã€‚ã€<br /><br />[quote author=Team Fail link=topic=7114.msg198752#msg198752 date=1436466991]I&#039;m also trying to figure out on what part of the data the checksum is calculated so I can import my edited e-Reader file with the original header data intact, in case there&#039;s anything important that&#039;s read from there. Or would using nedcmake be perfectly fine for turning the VPK data into valid card data, and would the FRLGE application still accept it?[/quote]<br />For some reason, nedcmake generates a completely different type of card header than what the original cards useâ€”compare [url=http://problemkaputt.de/gbatek.htm#gbacartereaderdataformat]GBATEKâ€™s documentation[/url], which matches the original cards (and tells you how the checksums are calculated), to [url=https://caitsith2.com/ereader/ereader%20card%20info.txt]nedclibâ€™s documentation[/url]. The format generated by nedcmake works with Scan Card, but apparently not with the Mystery Gift application.


subject: Re: Questions about the Pokemon Merge Glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=1000000000000000000000000 link=topic=7309.msg198753#msg198753 date=1436481884]<br />I have two questions about the Merge Glitch:<br /><br />1. Is it possible to set this glitch up in the party menu instead of the PC?<br /><br />2. Would this work in the Generation 2 games?<br />[/quote]<br /><br />Great questions and welcome to the forums.<br /><br />1. Yes. One way is to arrange your party like this:<br /><br />Pidgey<br />Q<br />Z4<br />Omanyte<br />Seaking<br />Gengar<br /><br />Then deposit Pidgey and you will get:<br /><br />Q<br />Q (picture)/Z4 (recipient)<br />Z4 (picture)/Omanyte (recipient)<br />Omanyte (picture)/Seaking (recipient)<br />Seaking (picture)/Gengar (recipient)<br /><br />Instead of using the box, you can do the same thing with the Day Care man south of Cerulean City provided your first PokÃ©mon doesn&#039;t have a HM move because the Day Care man wouldn&#039;t be able to accept it.<br /><br />2. The PokÃ©mon merge glitch as it is traditionally done in Generation I probably doesn&#039;t work in Generation II because you cannot deposit an FF into the box (it appears as a Cancel that doesn&#039;t get the Deposit/Stats/Release box) to get the PokÃ©mon 1, FF, PokÃ©mon 3, PokÃ©mon 4 set up.<br /><br />However, both aforementioned methods in 1) work in Generation II. So you can turn the red Gyarados into another shiny e.g. Charmeleon, that you could stabilize (donor into recipient variation) by evolving into a stable shiny Charizard, for instance.<br /><br />Here is a video of making hybrids in Generation II by depositing a PokÃ©mon above ????? (FF).<br /><br />https://www.youtube.com/watch?v=KPiJStUldjI


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I haven&#039;t seen this thread before, it&#039;s very interesting! Congratulations for your work on this.<br /><br />You guys are very lucky to be able to perform ACE with Coin Case. I hope someday, we&#039;ll also find something easy that allows us to get rid of the very painful TM25/33 method&nbsp; ;D


subject: Trading Missingno With the Time Capsule
poster_name: Cryptic_Lynx
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m just curious... What would happen if you used a cheat or a glitch to trade Missingno to Generation II? 


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Krys3000 link=topic=7166.msg198756#msg198756 date=1436553061]<br />I haven&#039;t seen this thread before, it&#039;s very interesting! Congratulations for your work on this.<br /><br />You guys are very lucky to be able to perform ACE with Coin Case. I hope someday, we&#039;ll also find something easy that allows us to get rid of the very painful TM25/33 method&nbsp; ;D<br />[/quote]<br /><br />Thanks! Yes.<br /><br />I agree that it&#039;s still painful. You would need a bad clone or link cable to get duplicate key items and TM25 in the wrong pocket in the first place. What we need is a completely new glitch to get it in the items, balls or key items pocket or a new relatively easy to set up arbitrary code execution method altogether I suppose.<br /><br />PokÃ©mon Crystal&#039;s out of bounds Glitch Cities can corrupt your items (I haven&#039;t observed this in Gold), but getting there in the first place may be impossible without a bad clone, and luck would have it TM33 still requires linking. I can&#039;t remember finding a better item, but maybe on hindsight there are ones with pointers in an expanded items pack. Also, you would need to escape from the out of bounds Glitch City.<br /><br />Comparing TM25 with TM33, TM25 (FA6A - Pokemon 2 Defense EV byte 2) in Gold is not as bad as TM33 in Crystal (F418 - Fifth enemy PokÃ©mon character 5). The factor where you have to link up in the current session is eliminated with TM25.<br /><br />A nice detail with TM/HM arbitrary code execution is that you should be able to end your code with a ret using it.<br /><br />With Coin Case glitch you couldn&#039;t and needed to use a work around (due to corrupted stack apparently) after the end of your program like below (from TheZZAZZGlitch&#039;s code) if you wanted to make RAM modifications.<br /><br />ld l, F5<br />ld bc, 0134<br />ld h, 12<br />sbc a,(hl)<br />inc sp<br />push bc<br />ld bc, XXXX<br />jp hl<br /><br />2E F5 01 34 01 26 12 9E 33 C5 01 XX XX E9<br /><br />Conveniently, I think the requirements for TM25 arbitrary code may be shared with French, German, Italian, Spanish versions (where TM25 jumps to DA6A). That is if DA6A is PokÃ©mon 2 Defense EV byte 2 on all of these versions. But it seems likely because one of the addresses close to it (DA76) is PokÃ©mon 2 PokÃ©rus byte in these versions, like in English Gold.<br /><br />You could use an untrained PokÃ©mon as PokÃ©mon 2 so that data slides through to PokÃ©mon 3 and the same Quagsire holding a HP Up with Sleep Talk as the first move as the PokÃ©mon 3 (instead of the PokÃ©mon 4), because this data spells C3 1A D6 (jump to D61A, PC item slot 2 quantity)<br /><br />Another means of arbitrary code are through glitch PokÃ©dex modes (mode is determined by D959 in English Crystal). They can be accessed with the key items glitch because D959 is one of the &#039;ball&#039; addresses beyond slot 12 (the final slot).<br /><br />Though I think TM arbitrary code execution is better. Glitch PokÃ©dex mode ACE will break your PokÃ©dex&#039;s ability to view entries and sadly seem to be more complicated to set up than TM25 (though they do not appear to mess up the stack).<br /><br />In a route for [url=http://forums.glitchcity.info/index.php/topic,7150.0.html]speedrunning PokÃ©mon Crystal[/url], PokÃ©dex mode 09 (FA20) is used. This is somewhere in the glitched balls pocket inventory, and Burn Heal x195, Dragon Fang x251 were used to jump to $FB90 (box names) because these items with quantities of 0 happened to be in the glitch inventory; so you could deposit 195 and 251 of them into the PC to force them into the PC items slots (accessible with an expanded balls pocket).<br /><br />I wonder what useful glitch TM/HM pointers may exist in Japanese and Korean Gold?


subject: Re: Pokemon XY weird graphics glitch.
poster_name: shutterbug2000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, it doesn&#039;t really affect anything, as in the game doesn&#039;t crash, it&#039;a like the PC numbers glitch in a way. Only sometimes, and only for a split second. I was using a full restore, backed out of the menu, and then sometimes this happens. I was in a friend safari too. (Just giving as much info as possible). 


subject: Re: Trading Missingno With the Time Capsule
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Cryptic_Lynx link=topic=7310.msg198757#msg198757 date=1436556864]<br />I&#039;m just curious... What would happen if you used a cheat or a glitch to trade Missingno to Generation II?[/quote]<br />It would be converted to a Generation II PokÃ©mon based on its index number; see [url=http://bulbapedia.bulbagarden.net/wiki/List_of_PokÃ©mon_by_index_number_(Generation_I)]this list[/url].<br /><br />Itâ€™s possible to trade fossil/ghost Missingno. to Generation II under [url=http://forums.glitchcity.info/index.php/topic,6985.msg195962.html#msg195962]particular circumstances[/url], and there are also [url=http://forums.glitchcity.info/index.php/topic,6985.msg195948.html#msg195948]three other glitch PokÃ©mon in English Red/Blue and five in Yellow[/url] that are naturally able to be traded through the Time Capsule, because they happen to have the same types in Generation I as the equivalent Generation II PokÃ©mon.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This script must be one script in Battle Frontier where your Pokemon team is stored, and where few Pokemon from your team are taken to make the team you&#039;ll have for the building.<br /><br />You can trigger that in Battle Frontier with a Glitch Pokemon&#039;s name (making Slateport&#039;s journalist reading it), and when entering any Battle Frontier Building, you can be instantly considered winner/loser, and the stored team will be given back to you.<br />But the adress is a bit far, and by doing that you&#039;ll also corrupt the stored team, so that would work for certain specific glitch Pokemon.<br />However, you can directly use a Glitch Pokemon name to have an empty first party slot, which is done easier and with less corruption.<br /><br />Also, this doesn&#039;t work in RS because the winner/loser scripts of the receptionist do not contain the stored team withdrawal (it is done just before that), which is quite saddening since this could have been a way to perform Pomeg Glitch corruption in RS.<br />However, with the &quot;continuing streak after a pause&quot; script, you can be taken into a Battle Tower fight with a team that can have empty slots, which allows you to make a little corruption before the game freezes.<br /><br />I tried to abuse of such scripts in Emerald in order to illegally bring a Smoke Ball and Master Balls into Battle Pyramid, but it didn&#039;t work as there was no Glitch Pokemon that would trigger the &quot;continuing streak after a pause&quot; script while giving me at least one party Pokemon, and while taking me to a Battle Pyramid floor that doesn&#039;t freezes the game.<br />(when you register into a Battle Frontier building, the game stores your team, stores the slots of the Pokemon you&#039;ve chosen, as well as the floor you&#039;ll be taken to (in case you would do a pause), and some other tiny things that are less important)(and in Battle Pyramid, the fleeing mechanic is different, and the fleeing chance is capped at a value which isn&#039;t 100%, regardless of Run Away. Thus, you have to kill the wild Pokemon or teleport yourself or use a Smoke Ball, Smoke Ball being more efficient, but you can&#039;t find it in Battle Pyramid as wild held items are disabled.)<br /><br />This also can&#039;t be used to steal Battle Factory Pokemon or bring your own Pokemon to Battle Factory,(not like the way I tried, at least), as Battle Factory works a bit differently in terms of Pokemon selection (the game stores somewhere the PID of the selected Pokemon, and their value in the list of Battle Frontier Pokemon).<br />Since these values are below party pokemon and wild pokemon data, you also can&#039;t use this to be taken back into a Battle Frontier facility with one Pokemon of your previous battle, as the data of this Pokemon would be wiped in the process. (as once you go into Pyramid/Pike with a certain team, you can use Safari Mode to be warped back to Safari Zone with your current team, and thus successfully get back the Pokemon in your team during Pyramid/Pike)<br /><br />However, you can use a Glitch Pokemon with 14.900-15.000 characters and corrupt the Battle Dome matches layout. It is quite funny even if you can&#039;t glitch anything with this, and even if the layout is remade after some minutes.<br /><br /><br />Also, you can&#039;t corrupt NPC scripts well with Glitch Pokemon Names, as they are refreshed once you change maps, so you could only do that into the house in Slateport that contains the Journalist, and as the adresses for NPC scripts are below the adress for player location, which means that you would need to have a nearly accurate double-word for the NPC script as well as a certain nearly accurate double-word for player location (a location that would still be in the house, so that the player can still go talk to other NPC, and can get out of the house with the door or with Safari Mode).


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: Team Fail
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hm. I was hoping to be able to import other things, like perhaps an unofficial gift for the special tickets, but it looks like that won&#039;t be possible then. I did notice though, that there were special FRLG cards that changed the layout of Trainer Tower. Are those still undumped?<br /><br /><br />As for the header issues, perhaps if I can figure out how to re-calculate the checksum programmatically, I can simply import VPK data into a ripped header and perform any necessary calculations on the checksum that are needed rather than making a new header completely.


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]PokÃ©mon Crystal&#039;s out of bounds Glitch Cities can corrupt your items (I haven&#039;t observed this in Gold), but getting there in the first place may be impossible without a bad clone, and luck would have it TM33 still requires linking. I can&#039;t remember finding a better item, but maybe on hindsight there are ones with pointers in an expanded items pack. Also, you would need to escape from the out of bounds Glitch City.[/quote]<br /><br />I have not been Bad Cloning for a while, how exactly do you access to Glitch City with a Bad Clone? I was under the impression you could get &quot;?????&quot;-induced Glitch Cities only by fighting them, which the Bad Clone Trick doesn&#039;t allow.<br /><br />[quote]You could use an untrained PokÃ©mon as PokÃ©mon 2 so that data slides through to PokÃ©mon 3 and the same Quagsire holding a HP Up with Sleep Talk as the first move as the PokÃ©mon 3 (instead of the PokÃ©mon 4), because this data spells C3 1A D6 (jump to D61A, PC item slot 2 quantity)<br />[/quote]<br /><br />Yep, I haven&#039;t thought about this!<br /><br />[quote]Another means of arbitrary code are through glitch PokÃ©dex modes (mode is determined by D959 in English Crystal). They can be accessed with the key items glitch because D959 is one of the &#039;ball&#039; addresses beyond slot 12 (the final slot).<br /><br />Though I think TM arbitrary code execution is better. Glitch PokÃ©dex mode ACE will break your PokÃ©dex&#039;s ability to view entries and sadly seem to be more complicated to set up than TM25 (though they do not appear to mess up the stack).<br /><br />In a route for speedrunning PokÃ©mon Crystal, PokÃ©dex mode 09 (FA20) is used. This is somewhere in the glitched balls pocket inventory, and Burn Heal x195, Dragon Fang x251 were used to jump to $FB90 (box names) because these items with quantities of 0 happened to be in the glitch inventory; so you could deposit 195 and 251 of them into the PC to force them into the PC items slots (accessible with an expanded balls pocket).<br />[/quote]<br /><br />I will look more into this, to find out what&#039;s more painful&nbsp; :XD: thanks for the method!


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7166.msg198758#msg198758 date=1436558671]<br />I agree that it&#039;s still painful. You would need a bad clone or link cable to get duplicate key items and TM25 in the wrong pocket in the first place. <br />[/quote] <br />Are bad clones that hard to get in Crystal? I had plenty of bad clones on my previous save file. It&#039;s been a while, but I don&#039;t recall having too much trouble. 


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Did you use PokÃ©mon Stadium 2? Without PokÃ©mon Stadium 2, it seems to be a pain for me in Crystal. (it is somewhere between 2.3-2.4 seconds after &quot;SAVING...DO NOT TURN OFF THE POWER.&quot; is printed) if you deposited 5 PokÃ©mon according to luckytyphlosion.<br /><br />Mind you, I just tried on Japanese Crystal (because I have something planned for this and it&#039;s coming to fruition) without Stadium 2 and succeeded. It didn&#039;t take me that many attempts, so maybe it&#039;s not that bad or I&#039;ve just been particularly lucky.<br /><br />[quote author=Krys3000 link=topic=7166.msg198767#msg198767 date=1436695119]<br />I have not been Bad Cloning for a while, how exactly do you access to Glitch City with a Bad Clone? I was under the impression you could get &quot;?????&quot;-induced Glitch Cities only by fighting them, which the Bad Clone Trick doesn&#039;t allow.<br />[/quote]<br /><br />I have never actually got to an OoB Glitch City with the bad clone glitch now that you say, I&#039;m sorry. ;_;<br /><br />Some glitch Unown in PokÃ©mon Gold and Silver corrupt the map (I&#039;m not sure about PokÃ©mon Crystal), meaning that there may be potential to move off it and access an out of bounds Glitch City.<br /><br />You can register a glitch Unown by having a PokÃ©mon 5 with the Defense stat modulo 256 of the Unown you want. Then put ????? (00) at the top of the party and obtain 11 PokÃ©mon with Move w/o Mail and your PokÃ©dex and glitch Unown will become corrupted, with the first one depending on PokÃ©mon 5&#039;s Defense stat.<br /><br />With a number of party PokÃ©mon based [url=http://tasvideos.org/4140S.html]map distortion[/url] you can use Move w/o Mail to glitch 27 PokÃ©mon in the party and corrupt the map by opening the party menu. However, I sadly haven&#039;t attempted this before, and it&#039;s for PokÃ©mon Gold/Silver, where I haven&#039;t seen any OoB Glitch Cities that corrupt your items.<br /><br />[quote author=Krys3000 link=topic=7166.msg198767#msg198767 date=1436695119]<br />I will look more into this, to find out what&#039;s more painful&nbsp; :XD: thanks for the method!<br />[/quote]<br /><br />You&#039;re welcome.


subject: Updating Games?
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I haven&#039;t updated my 3DS in ages so that I can use the exploit to get glitch Pokemon in Gen 6. Unfortunately, that means I can&#039;t use the e-shop, which I need to update games that require an update to use wifi. Does anyone know if it would be possible to update a 3DS game with a friend&#039;s 3DS? And would updating X and OR stop me from using the exploit, or only 3DS updates? Also, would it be possible for Nintendo to make 3DS games that force the system to update like some Wii U games? 


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: MidnightNinetales
icon: xx
body:
  No, just Crystal. It took a bunch of tries, but each try doesn&#039;t take that long. And I&#039;m pretty sure it was less than 2.3 - 2.4 seconds after for me. Is it normal for it to vary a bit? <br /><br />Anyway, I started a new save file after accidentally corrupting my old one, and I haven&#039;t managed to get a single bad clone since then. I&#039;m still pretty early in the game though, and have a very small variety of Pokemon to use. The most that&#039;s happened is a clone of my Cyndaquil gained the nickname and moveset of a Stantler.


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7166.msg198771#msg198771 date=1436741722]<br />No, just Crystal. It took a bunch of tries, but each try doesn&#039;t take that long. And I&#039;m pretty sure it was less than 2.3 - 2.4 seconds after for me. Is it normal for it to vary a bit? <br />[/quote]<br /><br />Maybe so, based on [url=http://forums.glitchcity.info/index.php/topic,7150.msg197248.html#msg197248]this[/url].


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: MidnightNinetales
icon: xx
body:
  If you want, I can work on getting further in the game and then try to get some bad clones. If it works, I can try to help out. I only have English Crystal, though. And English Yellow, if I need to link to a Gen I game. <br /><br />Edit: I managed to get some bad clones. I&#039;ll make a post about it in the G/S/C glitch discussion sticky, since it probably doesn&#039;t really belong here. 


subject: Re: Updating Games?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No; game updates are stored in internal memory.<br />Only 3DS updates.<br />If a game has a higher firmware in its update partition than you have installed, then yes, it&#039;ll force you to update before you can play it.


subject: Satoru Iwata died
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  http://www.nintendo.co.jp/ir/pdf/2015/150713e.pdf<br /><br />https://en.wikipedia.org/wiki/Satoru_Iwata#Death<br /><br />R.I.P.


subject: Re: Burned Tower Silver executing arbitrary code in German and Spanish Crystal.
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for all the indications Torchickens, I will work on all this and tell you what comes out.<br /><br />About Bad Clones, by the time I was doing this glitch oftenly, I remember it was pretty easy to do but not all bad clones were OK for the glitch. With some practice, it&#039;s probably not that long to have one in Crystal. In Gold and Silver however, it&#039;s very hard.


subject: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: argentum
icon: xx
body:
  [s]i&#039;m crying mentally right now. i really am.[/s]<br />I really needed to get this out of me.<br />I don&#039;t know why, but instead of getting a regular egg from the lady in Lavaridge who gives (I think) a Wynaut egg, I got something that reminds me a little [i]too much[/i] of the Mystery egg from X/Y.<br />I can&#039;t upload a screenshot of it, but even after a Lv. 3 Hatching Power, it&#039;s stuck at &quot;It looks as though this Egg will take a long time yet to hatch,&quot; which I&#039;m 99% sure isn&#039;t even legitimately possible in-game without cheating, which is something I&#039;ve never done in XYORAS.<br />As if to make it more confusing to me, it even says the correct date and location.<br />Has this ever happened to anyone else, and is there a way to get rid of it? (Seeing as how I was stupid enough to save with it on my game even though I didn&#039;t know this until after.)<br />I&#039;m really scared it&#039;ll corrupt my save file or something.<br /><br />[b]Edit:[/b] I took a screenshot of the egg&#039;s summary about ten minutes before it was traded, but I can&#039;t get it to my SD card to put it here. xP<br />[b]Edit the Second:[/b] Unrelated, but I just battled the Youngster who loves shorts and I just //trails off//<br />Though I did find a slight glitch in that if a PokÃ©mon uses a move like Wrap (Gen 1 only) on a PokÃ©mon it doesn&#039;t affect (e.g. Wrap on Gengar) it&#039;ll continue the attack but it&#039;ll never do any damage.<br />[b]Edit the Third:[/b] [s](Who else thinks I should stop editing now?)[/s] Ahahah so it appears that egg was supposed to be a Togepi; by that logic the Wynaut egg is still in my PC and it&#039;s got the same message as the first one, though I know I&#039;ve seen it as a different one. It does nothing in the PC except sit there and I do believe it&#039;s just any old egg at this point.<br />Though I think I&#039;ll hold on to this one until I know what the first one will do.<br />[b]Edit 4#:[/b] Strangely enough, both eggs hatched into what they were supposed to. I&#039;m not sure about the other, but the one I kept took a while to hatch: three level 3 Hatching powers, a PokÃ©mon with Flame Body, and numerous laps around the resort place. (when it normally only should have taken around 5355 steps at most without any of those)<br />I don&#039;t understand.


subject: Re: Satoru Iwata died
poster_name: Krazyguy75
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That is sad news indeed.<br /><br />Also,<br />[quote author=Spoink link=topic=7313.msg198782#msg198782 date=1436829360]<br />s**t.&nbsp; :(<br />[/quote]<br />Is it bad that I read this as &quot;s**tface&quot;?


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Krazyguy75
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Y&#039;know, the hatching power doesn&#039;t just take away steps. It merely doubles your steps for the purposes of hatching the egg for the next 3 minutes. So I suspect you just didn&#039;t walk enough... or maybe at all, during that period. In addition, it still requires 5,120 steps without the power.<br /><br />Also, bad eggs aren&#039;t a thing in every game, and they don&#039;t do the same thing in every game. It&#039;s highly unlikely that you just managed to get a random glitch, especially in newer generations. In addition, bad eggs are easy to identify in most games. Because they have a name: &quot;BAD EGG&quot;. Even an egg hybrid glitch usually can be sent into battle. Furthermore, the games in which bad eggs have corrupting tendencies are the easiest to identify: they do things like 1.) Hatch every step, 2.) Overwrite anything you swap their position with 3.) Glitch if deposited into the PC.<br /><br />TL;DR: I doubt you have a bad egg, I suspect you just need to put on your running shoes and get to doing laps.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I get what you&#039;re saying, and you&#039;re probably right, but I was using the bike and doing laps all across the town before checking the summary and seeing that.<br />It would have probably said at least that it would have been close to hatching, but it said what I quoted above which only happens in an amount of remaining egg cycles (41 or more) that would probably only happen in the event that someone cheated in order to get an egg of like a Mew or Entei or something else of the like.<br /><br />It seems like if anything, it must be a legendary PokÃ©mon or something like that. It didn&#039;t do any of those things which probably means it&#039;s not, but there&#039;s definitely something not right about it. 


subject: New Japanese PokÃ©mon Crystal speedrun route (test: 43 minutes in game time)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I found what may be a new development in PokÃ©mon Crystal speedrunning (that does not work for the English version) thanks to the &quot;Missingning&quot; glitch, so I used that to beat PokÃ©mon Crystal in 43 minutes (with save states).<br /><br />The most important glitch here other than the bad clone glitch is &quot;[url=https://www.youtube.com/watch?v=M-gZOSGRtwE]Missingning[/url]&quot;, found by Paco81, in which you view a hex:FF&#039;s status and corrupt data.<br /><br />In Japanese Crystal, Spanish Crystal (possibly others) but not English Crystal (at least not in the same place), when you step three steps right or more from the Goldenrod PokÃ©mon Center and view the status of an FF ?????, you will be warped to the Bug Catching Contest building.<br /><br />Your items and TM/HMs will become corrupted.<br /><br />If you used a spot more than three steps east away, your balls, key items, TM/HMs, some of your PC items become corrupted too (the number of items get corrupted to a large value too). The large number of PC items means you cannot deposit the items you need in the PC for this route without a workaround (the game will state storage is full).<br /><br />The workaround is that you can buy some items to introduce an FF in the PC items before Missingning (this means items appear properly in the PC and you do not need too many unique items, maybe 5), and then keep swapping &quot;?&quot; items with themselves to get a reasonable amount of items.<br /><br />However, this takes time, so it seems to be better to use the spot exactly three steps away and corrupt the key items and balls pocket manually; because the only thing you have to do for this is swap items around/make the Lure Ball the first ball/make a higher ID item like TM01 the first ball (doesn&#039;t really take time at all).<br /><br />Assuming that the Missingning corruption effects work on cartridge, I want to see if this route is really faster (it seems to be), so I would like a PokÃ©mon speedrunner to run it, but there is one problem:<br /><br />Sadly the route requires lots of counting to know where you are in the Balls pocket. However, if we are able to set the number of items to a specific amount that is not too high (when we byte shift the balls pocket a second time so that item 1 e.g TM01 becomes the number of items), this may mean you could scroll to the bottom of the balls pocket and count just a few times.<br /><br />Potential problem 2:<br /><br />Due to a glitch (I assume the save file $A800=FF glitch), simply entering the PokÃ©Com Center may freeze the game.<br /><br />This happened to me when I tried the run from power on. However, after I tried the run from power on again but used the reset save data function, the PokÃ©Com Center no longer froze. Perhaps using the reset save data function fixes it, but I don&#039;t know for sure.<br /><br />Potential problem 3:<br /><br />One time after Missingning the game froze after I closed the Bug-Catching Contest results. The second time I tried this it worked. I wasn&#039;t really paying attention to what I was doing sadly, but maybe you have to only press B to avoid it.<br /><br /><br />Steps:<br /><br />1) Do [url=http://wiki.pokemonspeedruns.com/index.php/Pok%C3%A9mon_Crystal/Any%25_Guide]route[/url] as normal up to Goldenrod City. Pick up Kurt&#039;s Lure Ball and make it your only PokÃ© Ball after catching a second PokÃ©mon.<br />&nbsp;  The second PokÃ©mon should be Abra if possible, so you can Teleport to the PCC Center to avoid Trainers north of Goldenrod after Missingning takes us into the north-east Bug-Catching Contest building.<br />2) Get a Bad Clone (hex:00) then turn it into a hex:FF using move w/o mail. Make sure you put Abra in the PC so you don&#039;t corrupt it (I need to elaborate on these steps)<br />&nbsp;  If party refuses to work, somehow fix it. Name boxes here or at Bug Catching Contest.<br />3) Enter Goldenrod PCC Center, do Missingning three steps right of Goldenrod PCC Center to warp to the north-east Bug Catching Contest building.<br />4) Step out of the contest building and back in to avoid a possible freeze when you open the bag and close it.<br />5) Deposit a TM01 into PC from glitched TM/HM pocket inventory as well as TM15 x195.<br />6) In regular items pocket, swap TM38 into ? x0 (corrupts key items pocket) (note: other swaps may work too)<br />7) In Key Items pocket, swap first ? x0 with ? x1 (above Kurt&#039;s ball) (note: other swaps may work too).<br />Ball ID becomes number of balls and you will receive Master Ball x255.<br />8) Move the TM01 up to the first balls slot.<br />9) In Key Items pocket do step 7 again to get 191 (TM01&#039;s index number) balls.<br />10) Deposit 251 Star Pieces from the items pocket into the PC.<br />11) The TM15 x195 and Star Piece x251 will appear in the glitched balls pocket. Swap them into the right place (PokÃ©gear may disappear). (the hardest part because it&#039;s hard to know what item quantity represents DA10)<br />12) Teleport back to Goldenrod with Abra (otherwise you&#039;ll probably have to walk it)<br />13) Enter Goldenrod Department Store. Go up to the second floor. Use balls pocket TM15. It should execute the code you wrote in box names. Enter the lift. Go out to warp to Mt. Silver summit.<br />14) Talk to Red to beat the game.<br /><br />Execution details:<br />When TM/HMs are outside of their relevant pocket, they can execute arbitrary code. Using Missingning, we obtain all TM and HMs and can store them in the PC. With an expanded balls pocket, PC items will appear beyond the balls pocket, allowing us to use the TM/HM&#039;s glitch effect.<br /><br />TM15 is most useful and jumps to FA10 (DA10), which is somewhere in the glitched balls inventory (what item quantity exactly is it?). I think it is slightly better than glitch PokÃ©dex mode 09 for this run because you don&#039;t need to place 09 into D94C (the glitch PokÃ©dex mode) and FA20 (glitch PokÃ©dex mode 09) is the earliest glitch balls inventory PokÃ©dex mode pointer.<br /><br />List of execution pointers (TM/HMs):<br />[url=http://pastebin.com/vMa147xv]here[/url]<br /><br />List of execution pointers (glitch PokÃ©dex modes):<br />[url=http://pastebin.com/1hVmpZ5Q]here[/url]<br /><br />At DA10 (in the middle of glitched balls inventory) we need:<br /><br />(item) x195, Star Piece x 252 (represents C3 84 FB - a jump to FB84, box 4 name character 2)<br /><br />We place them into glitched balls pocket by putting it into the items PC, then swap them into DA10+.<br /><br />For (item) x 195 I used TM15; the item that executes FA10. Star Piece x0 is found somewhere in the glitched regular items pocket (luckily) and you can deposit 195 of them.<br /><br /><br />Now, if you name your boxes from box 4 the following, you can use TM15, then make Red appear, change your number of PokÃ©mon to 0 (allowing instant victory by challenging any Trainer), change the map to Mt. Silver and warp there if were at Goldenrod Department Store 2F, entered the lift and exited.<br /><br />ãƒ§ãƒ§ãƒ§ãŒã‚ãœ<br />ã˜ã¥ãŒã‚ãœãƒžã¥<br />ã¶ã¶ã¶ãŒã‚ãœã‚¢ãš<br />ãšãšãšãšã¥ãœã€€ãš<br />ãšãšã‚ˆãã¥ãã¿<br /><br />Final box name @DB83 code (actual execution at DB84):<br /><br />Bytes:<br />[code]AF AF AF 26 DB 2E 50 00 00 2C 32 26 DC 2E 9D 32 50 00 3C 3C 3C 26 DC 2E 80 2D 50 2D 2D 2D 2D 32 2E 7F 2D 50<br />2D 2D D6 B7 32 B7 D0 50[/code]<br /><br />ASM:<br />[code]<br />xor a<br />xor a<br />xor a<br />ld h,DB<br />ld l,50<br />nop<br />nop<br />inc l<br />ldd (hl),a<br />ld h,DC<br />ld l,8D<br />ldd (hl),a<br />ld d,b<br />nop<br />inc a<br />inc a<br />inc a<br />ld h,DC<br />ld l,80<br />dec l<br />ld d,b<br />dec l<br />dec l<br />dec l<br />dec l<br />ldd (hl),a<br />ld l,7F<br />dec l<br />ld d,b<br />dec l<br />dec l<br />sub a,B7<br />ldd (hl),a<br />or a<br />ret nc<br />ld d,b<br />nop<br />[/code]<br /><br />How to improve:<br />1) Try to remove the element of counting too much in order to find the DA10 quantity more easily.<br />2) The code could be optimized, and perhaps it would be better if you could make it change your Teleport location to Mt. Silver.<br />3) My menuing wasn&#039;t very good, so a speedrunner who is more experienced with menuing should be able to save time in that respect.<br /><br /><br />Video (click to load): https://www.youtube.com/watch?v=D0VVZY5s_ac<br />BizHawk-1.9.1 movie: https://mega.co.nz/#!cos3hDAQ!nuv99WzlbuYeKN7onI-jiTx-SojQ942uHiuvhaSJtIA


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you like argentum we can trade and I will happily take the Egg off of you on a save file I don&#039;t mind about.


subject: Re: Satoru Iwata died
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krazyguy75 link=topic=7313.msg198783#msg198783 date=1436839509]<br />That is sad news indeed.<br /><br />Also,<br />[quote author=Spoink link=topic=7313.msg198782#msg198782 date=1436829360]<br />s**t.&nbsp; :(<br />[/quote]<br />Is it bad that I read this as &quot;s**tface&quot;?<br />[/quote]<br /><br />It is supposed to be &quot;Shit! I am sad&quot;


subject: Google Document for Every PokÃ©dex Number in the 1st Gen
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: drc
icon: smiley
body:
  This is a document online that anybody can view, that contains the whole glitch PokÃ©dex in each game below<br /><br />https://docs.google.com/spreadsheets/d/1v81TksEV2Fi90cz1REr0IrMLlxcC3yCMvRg8KzzV2aQ/edit?usp=sharing<br /><br />The list:<br /><br />[color=lime]PokÃ©mon Red<br />PokÃ©mon Blue[/color]<br />[color=red]PokÃ©mon Yellow<br />PokÃ©mon JP Red<br />PokÃ©mon JP Green<br />PokÃ©mon JP Blue<br />PokÃ©mon JP Yellow<br />PokÃ©mon SP Red<br />PokÃ©mon SP Blue<br />PokÃ©mon SP Yellow<br />PokÃ©mon GE Red<br />PokÃ©mon GE Blue<br />PokÃ©mon GE Yellow<br />PokÃ©mon FR Red<br />PokÃ©mon FR Blue<br />PokÃ©mon FR Yellow<br />[s]PokÃ©mon SK Red[/s] Questionable existence<br />[s]PokÃ©mon SK Blue[/s] Questionable existence<br />[s]PokÃ©mon SK Yellow[/s] Questionable existence[/color]<br /><br />That&#039;s a lot of games, but I&#039;ll do it over a period of time


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;d be great :o<br />Except, where I am right now I can&#039;t ever get my DS to connect to the internet, so that wouldn&#039;t be possible for another hour and a half.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=argentum link=topic=7314.msg198790#msg198790 date=1436900743]<br />That&#039;d be great :o<br />Except, where I am right now I can&#039;t ever get my DS to connect to the internet, so that wouldn&#039;t be possible for another hour and a half.<br />[/quote]<br /><br />OK. Send me a PM when you&#039;re ready. :) I just need to find my PokÃ©mon X.<br /><br />Edit: I found it.


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nice. That&#039;s some great work well done. You even included the front sprite and back sprite pointers. Will you consider doing the same for Red and Blue please?


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;d do exactly that, but I don&#039;t know how to PM on this site as I only joined yesterday.<br /><br />On an unrelated side note, it appears it&#039;s trying to copy the egg cycle values of like Groudon or something (which would make sense as this is OR)<br />[s](admittedly, as much as I&#039;d like to get rid of it, I&#039;m really curious as to what it may do/hatch into.)[/s]


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  If you roll your mouse over the &quot;My Messages&quot; button below the &quot;Glitch City Laboratories&quot; link near the top of the page there should be a &quot;Send a message&quot; link and you can try sending your friend code to me.<br /><br />[img]http://i1.minus.com/ii2MDOGws4Fvo.png[/img]<br />http://forums.glitchcity.info/index.php?action=pm;sa=send<br /><br />If not, or it won&#039;t let you send a private message for some reason, my friend code is 3566-1530-1631.<br /><br />[quote author=argentum link=topic=7314.msg198794#msg198794 date=1436907188]<br />I&#039;d do exactly that, but I don&#039;t know how to PM on this site as I only joined yesterday.<br /><br />On an unrelated side note, it appears it&#039;s trying to copy the egg cycle values of like Groudon or something (which would make sense as this is OR)<br />[s](admittedly, as much as I&#039;d like to get rid of it, I&#039;m really curious as to what it may do/hatch into.)[/s]<br />[/quote]<br />There may be a way using the 3DS browser exploit (prior to version 9.5.0-23 of the firmware) that you could check the contents of an Egg from your save file (perhaps you could export the PokÃ©mon and view it in PkHex). I think I could look into this because one of my other (non-3DS XL) Nintendo 3DS still hasn&#039;t updated beyond this version.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: argentum
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7314.msg198796#msg198796 date=1436908151]<br />Are you going to try to hatch it? I&#039;d like to see what&#039;s in it too. <br />[/quote]<br />I really want to, but I don&#039;t want to risk losing my save file. Not when there&#039;s a Mythical PokÃ©mon and a mountain of Shiny PokÃ©mon as well&nbsp; xP<br />[quote author=Torchickens link=topic=7314.msg198795#msg198795 date=1436907813]<br />If you roll your mouse over the &quot;My Messages&quot; button below the &quot;Glitch City Laboratories&quot; link near the top of the page there should be a &quot;Send a message&quot; link and you can try sending your friend code to me.<br /><br />[img]http://i1.minus.com/ii2MDOGws4Fvo.png[/img]<br />http://forums.glitchcity.info/index.php?action=pm;sa=send<br /><br />If not, or it won&#039;t let you send a private message for some reason, my friend code is 3566-1530-1631.<br />[/quote]<br />I see it now. Wow, I feel stupid now xD<br />I doubt I can handle that so mine would be (not entirely sure if it&#039;s needed) 0963-0061-0769<br />[quote author=Torchickens link=topic=7314.msg198795#msg198795 date=1436907813]<br />There may be a way using the 3DS browser exploit (prior to version 9.5.0-23 of the firmware) that you could check the contents of an Egg from your save file (perhaps you could export the PokÃ©mon and view it in PkHex). I think I could look into this because one of my other (non-3DS XL) Nintendo 3DS still hasn&#039;t updated beyond this version.<br />[/quote]<br />I&#039;d do that, but my 3DS is somewhere either on or past that version because I update every time it comes up with a message telling me to because of how stupid I am. xP<br /><br />Unrelated again, took quite a while to post. xPPP<br />Edit: Wait, no, not actually that long xD


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7314.msg198796#msg198796 date=1436908151]<br />Are you going to try to hatch it? I&#039;d like to see what&#039;s in it too. <br />[/quote]<br /><br />I will cycle around with it for about an hour if it lets us trade it (I hope), and record it with my capture card.<br /><br />[quote author=argentum link=topic=7314.msg198798#msg198798 date=1436908812]<br />I see it now. Wow, I feel stupid now xD<br />[/quote]<br />Nah, don&#039;t worry. I think it&#039;s easy to miss. :)<br /><br />[quote author=argentum link=topic=7314.msg198798#msg198798 date=1436908812]<br />I doubt I can handle that so mine would be (not entirely sure if it&#039;s needed) 0963-0061-0769<br />[/quote]<br /><br />Added you.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: argentum
icon: xx
body:
  [quote author=Torchickens link=topic=7314.msg198799#msg198799 date=1436909183]<br />[quote author=MidnightNinetales link=topic=7314.msg198796#msg198796 date=1436908151]<br />Are you going to try to hatch it? I&#039;d like to see what&#039;s in it too. <br />[/quote]<br /><br />I will cycle around with it for about an hour if it lets us trade it (I hope), and record it with my capture card.<br />[/quote] <br />Besides the impossible egg cycle value, it&#039;s just a regular egg (at least, I think so xD), so if eggs can be traded in XYORAS (I don&#039;t know, I&#039;ve never tried.), then this one likely will be able to.<br />[quote author=Torchickens link=topic=7314.msg198799#msg198799 date=1436909183]<br />[quote author=argentum link=topic=7314.msg198798#msg198798 date=1436908812]<br />I doubt I can handle that so mine would be (not entirely sure if it&#039;s needed) 0963-0061-0769<br />[/quote]<br /><br />Added you.<br />[/quote]<br />Did the same.<br /><br />Edit: I just remembered there was once a Shiny Shaymin on my save file I got from Wonder Trade that was clearly made with an AR. Since Shaymin easily can get that message (hypothetically) it might be one.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: argentum
icon: xx
body:
  I&#039;m ready, aside from the fact that my logic states it&#039;s clearly a necessity to check the egg every few seconds. xP<br /><br />Edit: I wonder if it&#039;ll reset one of the values in the egg cycles or something? I don&#039;t know what I&#039;m saying anymore ahahah


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  To MidnightNinetales and other readers: We successfully traded the Egg.<br /><br />Ha ha.<br /><br />[quote author=argentum link=topic=7314.msg198802#msg198802 date=1436910303]<br />Edit: I wonder if it&#039;ll reset one of the values in the egg cycles or something? I don&#039;t know what I&#039;m saying anymore ahahah<br />[/quote]<br /><br />Not sure. I&#039;m going to see if I can hatch the Egg and if not check what is in the Egg/number of cycles using [url=http://projectpokemon.org/forums/showthread.php?44567-Web-Browser-RAM-based-Box-Import-Export-code]this[/url], then see if I can hatch it. I&#039;m afraid I&#039;ve got to go shortly, so I will have to try this tomorrow.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7314.msg198803#msg198803 date=1436910937]<br />To MidnightNinetales and other readers: We successfully traded the Egg.<br /><br />Ha ha.<br /><br />[quote author=argentum link=topic=7314.msg198802#msg198802 date=1436910303]<br />Edit: I wonder if it&#039;ll reset one of the values in the egg cycles or something? I don&#039;t know what I&#039;m saying anymore ahahah<br />[/quote]<br /><br />Not sure. I&#039;m going to see if I can hatch the Egg and if not check what is in the Egg/number of cycles using [url=http://projectpokemon.org/forums/showthread.php?44567-Web-Browser-RAM-based-Box-Import-Export-code]this[/url], then see if I can hatch it. I&#039;m afraid I&#039;ve got to go shortly, so I will have to try this tomorrow.<br />[/quote]<br />All I can say is that I wish you luck, because if my hypothesis is correct, you may be doing that for a while.<br />Hopefully I knocked off a good amount of cycles (in the hopes that the hatching power lv.3 did its job, which it should have if the egg can be hatched, and since it seems like a normal egg, it should be able.) that should take away enough of the time. xP<br />The last thing I have to ask is if it still says that it&#039;ll take a long time yet to hatch.<br /><br />Ah, well, my curiosity is satisfied for now. I&#039;m just glad I can get back to training my Ralts and Umbreon. xP


subject: Re: Bad Egg without cheating in ORAS?
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I kinda wish there was a cloning glitch in gen VI, so I could try hatching the egg too. But I wouldn&#039;t be able to anyway, since both X and Y need to be updated, and I can&#039;t do that without updating my 3DS. 


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7314.msg198806#msg198806 date=1436911701]<br />I kinda wish there was a cloning glitch in gen VI, so I could try hatching the egg too. But I wouldn&#039;t be able to anyway, since both X and Y need to be updated, and I can&#039;t do that without updating my 3DS. <br />[/quote]<br />I&#039;m pretty sure there is one, the classic shut-off-one-console-in-the-middle-of-the-trade-and-maybe-also-corrupt-someone&#039;s-save-file-and-also-risk-losing-the-egg-altogether method. xD<br />Though even if there was that&#039;d prevent it anyway so it doesn&#039;t matter 


subject: Re: New Japanese PokÃ©mon Crystal speedrun route (test: 43 minutes in game time)
poster_name: kaikun97
poster_ip: ***.***.***.***
modified_name: kaikun97
icon: xx
body:
  I watched this on YouTube and its really interesting. What else can you do with this arbitrary code execution method? I don&#039;t have a full understanding of this as I do not know assembly.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7314.msg198806#msg198806 date=1436911701]<br />I kinda wish there was a cloning glitch in gen VI, so I could try hatching the egg too. But I wouldn&#039;t be able to anyway, since both X and Y need to be updated, and I can&#039;t do that without updating my 3DS.<br />[/quote]<br /><br />The cloning glitch from Gen I, IV and V still works in Gen VI. However, successive updates of the game seems to minimize the timing in which you have to shut down the game. Last time I tried in a 1.3 X and 1.3 RO/SA, it worked though was slightly harder than in 1.2. <br />There are some reports saying that 1.4 RO/SA cloning is considerably harder, and a user of PRAMA&#039;s board also reported that when you suceed, the PokÃ©mon might disappear at the following trade, though I have not verified such statement so far.


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I have plans to do something like this in french versions for ages, since the glitch PokÃ©mons are very different. One day, I&#039;ll motivate me enough to start&nbsp; ;D


subject: Re: New Japanese PokÃ©mon Crystal speedrun route (test: 43 minutes in game time)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=kaikun97 link=topic=7315.msg198809#msg198809 date=1436951451]<br />I watched this on YouTube and its really interesting. What else can you do with this arbitrary code execution method? I don&#039;t have a full understanding of this as I do not know assembly.<br />[/quote]<br /><br />Thanks! Anything you can code that is short enough really.<br /><br />Using the items in the run (TM17 x195 Star Piece x251), you can write 47 byte long programs from box names (or more if you make use of the terminator 50 in your code like I did here to access DB50; one off the Red address); and if you get an alternative item (Pink Bow x251, maybe you could write a program with the Star Piece method that gives you that) then you could start your code at box 1 and have space for a 72 byte long program (8*9: Maximum box name length*9 boxes).<br /><br />The possibilities are endless if an [url=http://iimarck.us/etc/asmopcodes.txt]opcode[/url] or operand (xx or yy value for the opcode) ID is the same as a reasonable character and the program fits.<br /><br />Using ld h,D8 ld l,E6 jp (hl) - &quot;ãŒã‚Šãœ?ã‚¡&quot; we can redirect the code to D8E6 (PC item 1 quantity) and run programs longer than 47/72 bytes with specific stored PC items.<br /><br />We can change values in RAM to anything if that can be represented with text character IDs.<br /><br />Let&#039;s say we want to get Celebi. We can turn PokÃ©mon 1&#039;s species byte 2 into Celebi (this can be an Egg if you like so it hatches and appears in the PokÃ©dex or you can put it in the Day Care and out to get the PokÃ©mon you desire) by setting DCA5 to FB (the equivalent of the GameShark code 01xxA5DC).<br /><br />We can try:<br /><br />ld h,DC<br />ld l,A5<br />xor a&nbsp;  ; a=00<br />sub 05 ; a=FB (Celebi)<br />ld d,b (50 box name terminator)<br />ldd (hl),a<br />or a<br />ret nc<br /><br />This is:<br /><br />Box 4: (any character)ãŒã‚ãœãƒ©ãƒ§ã‚ˆã‚¬<br />Box 5: ã¥ãã¿<br /><br />P.S. A regular ret (ã®) may work as well so box 5&#039;s name might only need to be &quot;ã¥ã®&quot;. I&#039;m unsure why the or a ret nc was part of the English Crystal glitched run but I seem to remember there being a reason unless I imagined it.


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7316.msg198811#msg198811 date=1436952522]<br />I have plans to do something like this in french versions for ages, since the glitch PokÃ©mons are very different. One day, I&#039;ll motivate me enough to start&nbsp; ;D<br />[/quote]<br />I would guess the format is the same as in my chart, but I actually found out that the TM&#039;s are stored weird for some reason, i.e.:<br /><br />1st byte: TM08, TM07, TM06, TM05, TM04, TM03, TM02, TM01,<br />2nd byte: TM16, TM15, TM14, TM13, TM12, TM11, TM10, TM09,<br />...<br />6th byte: none, HM05, HM04, HM03, HM02, HM01, TM50, TM49<br />This is why the chart took longer than expected. I&#039;m just glad I found it out early on.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Argentum, I hatched the Egg you gave me earlier today and it hatched into a level 1 male Togepi, Jolly nature, with the ability Hustle and the quick tempered characteristic.<br /><br />It has normal moves (Growl, Charm) so I&#039;m not sure if you gave me the wrong Egg. Do you want this PokÃ©mon back?


subject: Re: Trading Missingno With the Time Capsule
poster_name: kaikun97
poster_ip: ***.***.***.***
modified_name: kaikun97
icon: xx
body:
  [quote author=Cryptic_Lynx link=topic=7310.msg198757#msg198757 date=1436556864]<br />I&#039;m just curious... What would happen if you used a cheat or a glitch to trade Missingno to Generation II?<br />[/quote]<br />Quite often Gen 2 games will stop you from trading glitch pokemon and give you the message &quot;Your friend&#039;s *pokemon* appears to be abnormal&quot; It&#039;s a failsafe. There are only 5 Hexadecimal slots that contain glitch pokemon anyway (and they are at the end of the list) so likely it will get comverted into whatever pokemon the hex is on pokemon g/s/c as HÃ¡cky said.


subject: Re: Bad Egg without cheating in ORAS?
poster_name: argentum
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: argentum
icon: xx
body:
  [quote author=Torchickens link=topic=7314.msg198815#msg198815 date=1436978170]<br />Argentum, I hatched the Egg you gave me earlier today and it hatched into a level 1 male Togepi, Jolly nature, with the ability Hustle and the quick tempered characteristic.<br /><br />It has normal moves (Growl, Charm) so I&#039;m not sure if you gave me the wrong Egg. Do you want this PokÃ©mon back?<br />[/quote]<br />Huh, that&#039;s honestly surprising. I guess the message change thing is just aesthetic, so I&#039;ll hatch the other one and see what happens. <br />I don&#039;t really need it back, though. You can keep it.<br /> <br />Edit: After six minutes of laps, Hatching Powers, and Flame Body, I&#039;ve managed to get it down to &quot;It doesn&#039;t seem close to hatching.&quot;<br />Maybe it&#039;s got something to do with how hacked PokÃ©mon have been on my save file to make it like this? <br />Edit 2#: It finally hatched, but it was what it was supposed to be. <br />Strangely enough, it still took a lot more egg cycles that it should have. I wonder why.


subject: Protean + Curse
poster_name: voltage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Move this to the Glitch Discussion thread if this is the wrong subforum. (It relates to game mechanics more so than glitches and can be legally done via doubles)<br />[youtube]https://www.youtube.com/watch?v=B8tI72fHBYU[/youtube]<br /><br />Basically, when a Protean mon uses Curse, it targets the user, changes the user&#039;s type to ghost and then the Damage Over Time effect of a GhostUser!Curse is applied on the user.<br /><br />I wonder how Protean + Roost would work. My guess is that it&#039;ll change the user&#039;s type to Flying, and then remove the Flying type and become Normal type. I have this reasoning because from Gen V onwards, a pure Flying type using Roost becomes Normal type (unlike ??? in Gen IV).<br /><br />Thank Sleepy Jirachi for this find.


subject: Gen III Sleep Talk
poster_name: voltage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Sleep Talk turns are reset once the Pokemon is switched out. Initially thought to be a glitch and found from the folks at Smogon. [url=http://replay.pokemonshowdown.com/smogtours-gen3ou-75016]A Replay displaying this mechanic[/url].The implications of this are metagame changing for those into the Gen III metagame.&nbsp; [url=http://www.smogon.com/forums/threads/new-mechanic-sleep-talk-doesnt-burn-sleep-turns.3544205/]Smogon&#039;s thread on this mechanic.[/url] So beware of sleep absorbers.


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Spoink link=topic=7316.msg198814#msg198814 date=1436978159]<br />[quote author=Krys3000 link=topic=7316.msg198811#msg198811 date=1436952522]<br />I have plans to do something like this in french versions for ages, since the glitch PokÃ©mons are very different. One day, I&#039;ll motivate me enough to start&nbsp; ;D<br />[/quote]<br />I would guess the format is the same as in my chart, but I actually found out that the TM&#039;s are stored weird for some reason, i.e.:<br /><br />1st byte: TM08, TM07, TM06, TM05, TM04, TM03, TM02, TM01,<br />2nd byte: TM16, TM15, TM14, TM13, TM12, TM11, TM10, TM09,<br />...<br />6th byte: none, HM05, HM04, HM03, HM02, HM01, TM50, TM49<br />This is why the chart took longer than expected. I&#039;m just glad I found it out early on.<br />[/quote]<br /><br />doesn&#039;t look weird to me?


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7316.msg198820#msg198820 date=1437010133]<br />[quote author=Spoink link=topic=7316.msg198814#msg198814 date=1436978159]<br />[quote author=Krys3000 link=topic=7316.msg198811#msg198811 date=1436952522]<br />I have plans to do something like this in french versions for ages, since the glitch PokÃ©mons are very different. One day, I&#039;ll motivate me enough to start&nbsp; ;D<br />[/quote]<br />I would guess the format is the same as in my chart, but I actually found out that the TM&#039;s are stored weird for some reason, i.e.:<br /><br />1st byte: TM08, TM07, TM06, TM05, TM04, TM03, TM02, TM01,<br />2nd byte: TM16, TM15, TM14, TM13, TM12, TM11, TM10, TM09,<br />...<br />6th byte: none, HM05, HM04, HM03, HM02, HM01, TM50, TM49<br />This is why the chart took longer than expected. I&#039;m just glad I found it out early on.<br />[/quote]<br /><br />doesn&#039;t look weird to me?<br />[/quote]<br />They are stored partly in reverse, if a PokÃ©mon learns TM01 and TM06, then it is stored as:<br />00100001<br />Instead of:<br />10000100


subject: Re: .xlsx file for every possible glitch PokÃ©dex number (PokÃ©mon Yellow)
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Spoink link=topic=7316.msg198821#msg198821 date=1437059921]<br />[quote author=Wack0 link=topic=7316.msg198820#msg198820 date=1437010133]<br />[quote author=Spoink link=topic=7316.msg198814#msg198814 date=1436978159]<br />[quote author=Krys3000 link=topic=7316.msg198811#msg198811 date=1436952522]<br />I have plans to do something like this in french versions for ages, since the glitch PokÃ©mons are very different. One day, I&#039;ll motivate me enough to start&nbsp; ;D<br />[/quote]<br />I would guess the format is the same as in my chart, but I actually found out that the TM&#039;s are stored weird for some reason, i.e.:<br /><br />1st byte: TM08, TM07, TM06, TM05, TM04, TM03, TM02, TM01,<br />2nd byte: TM16, TM15, TM14, TM13, TM12, TM11, TM10, TM09,<br />...<br />6th byte: none, HM05, HM04, HM03, HM02, HM01, TM50, TM49<br />This is why the chart took longer than expected. I&#039;m just glad I found it out early on.<br />[/quote]<br /><br />doesn&#039;t look weird to me?<br />[/quote]<br />They are stored partly in reverse, if a PokÃ©mon learns TM01 and TM06, then it is stored as:<br />00100001<br />Instead of:<br />10000100<br />[/quote]<br /><br />So, bits 0 and 5 on. Like I say, it doesn&#039;t look weird...


subject: Re: New Japanese PokÃ©mon Crystal speedrun route (test: 43 minutes in game time)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey!<br /><br />Just to mention,<br /><br />The missingning/warp method does not work either in French versions. I have no idea why this works on Spanish ones&nbsp; :o


subject: Can I please have some emulator saves for Blue and Silver?
poster_name: shutterbug2000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I have the physical cartridges for Silver and Blue, but Silver&#039;s battery is dead, and Blue is fine, but I would like an emulator save just in case. I would just play the game, but playing through an entire pokemon game takes forever, and I&#039;m kinda impatient, and I just want to expirement with glitches :P.<br /><br />Thanks in advance!


subject: 3DS System Transfer Question
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: question
body:
  I just got a New 3DS XL, and I was hoping to use the system transfer to transfer from my 3DS. Will I have to update my 3DS to transfer? 


subject: Re: 3DS System Transfer Question
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pawny
icon: xx
body:
  Yeah. If both systems were on 9.2 you could do some black magic to spoof the firmware but it&#039;s harder on the N3DS side and I don&#039;t know much detail on that.<br /><br />If you really want to keep your old 3DS on an exploitable firmware and can&#039;t do that you could call Nintendo and say you lost it or something and they&#039;d unlink your NNID from it and you could use it on the N3DS and re-download your digital stuff, but you&#039;d lose your save files sadly.<br /><br />EDIT: I&#039;m kinda out of date with 3DS hax since I had to update to get online in pokÃ©/smash so I pretty much stopped following the scene. I&#039;m I&#039;m wrong somewhere please correct me.


subject: Re: 3DS System Transfer Question
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, that could work. The only save files I&#039;m worried about are X/OR, since I think I heard boxed Pokemon are stored on the SD card. I have a physical copy of the game though, so I don&#039;t really know if it would even affect it. Would ram2sav work for those if necessary? 


subject: Executing arbitrary code on the SNES with 8F and the Super Game Boy
poster_name: shutterbug2000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So, this whole thing started with me learning about a group at AGDQ 2015, who used the SGB and &quot;TASbot&quot; to display the twitch chat on the SNES, using the save corruption total control. But, I got thinking &quot;Well, if it can be done with that code execution, it could surely be done with 8F. It is. I haven&#039;t executed &quot;code&quot; using the SGB yet, but it&#039;s definitely possible. What I HAVE done is send a &quot;packet&quot; from the Pokemon Red, to the SGB, to the SGB&#039;s pallet. The same could be done to execute arbitrary code on the SNES. You&#039;d write the data somewhere in the SNES using packets, then use a JUMP packet to move the SNES program counter to the correct position. <br /><br />Here&#039;s a video I made showing the pallet changing:<br /><br />https://youtu.be/SITpiVC64sw<br /><br />(I use a memory editor, but you could use the coordinate entering as well)


subject: Pokemon Pinball &quot;Glitch Dimension&quot;
poster_name: kaikun97
poster_ip: ***.***.***.***
modified_name: kaikun97
icon: xx
body:
  So after experimenting with some memory addresses on Pokemon Pinball, I found a way to forcibly restart the game into gameboy mode with glitched palettes (much like the glitch dimension in G/S).<br /><br />The memory address is D85B and setting it to a value such as 00 or FF will forcibly restart the game in Gameboy (Original) mode. Screen fade ins/outs are gone and It seems to use whatever palette was last used before as you can see in the following video<br /><br />[youtube]https://youtu.be/sVynXZadfMk[/youtube]<br /><br />D85B also seems to be related to Sound I/O as far as I can tell. There are other addresses in which you can use for the same effect but I found this one first. Quite possibly this will work in many GBC games that are GB compatible if you find a way to restart them like that<br /><br />And sorry if I don&#039;t have a good understanding of this but I wanted to show you what I found&nbsp; :) I made a new youtube channel (GlitchDimention) so that hopefully I can post more stuff like this<br />


subject: Re: Can I please have some emulator saves for Blue and Silver?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [url=https://mega.co.nz/#!olk0DR7b!wRd6VfB4y3oywwT8jdWKWCCPLly7TkE5AGzSQxz-yfY]Here is a ZIP file I put together[/url]. It contains saves for:<br /><br />PokÃ©mon Green, PokÃ©mon Blue, PokÃ©mon Yellow (Japanese)<br />PokÃ©mon Red (one with long range Trainers left, the other without/with less), PokÃ©mon Blue<br />PokÃ©mon Yellow (one completed, one completed with long range Trainers left, one with save abuse glitch set up)<br />PokÃ©mon Gold, PokÃ©mon Silver, PokÃ©mon Crystal<br />PokÃ©mon Crystal (Japanese)<br />PokÃ©mon Ruby<br />PokÃ©mon Ruby (Japanese)<br />PokÃ©mon Emerald<br />PokÃ©mon Emerald (Japanese)<br />PokÃ©mon FireRed<br /><br />This [url=http://hax.iimarck.us/post/35307/]thread[/url] on Skeetendo has some more save files as well; of Red/Blue about to perform the Trainer escape glitch and Crystal with New York PokÃ©mon Center gifts (via [url=http://projectpokemon.org/forums/showthread.php?14531-Pokemon-Crystal-Version-%28with-PCNY-event-Pokemon%29]here[/url]).<br /><br />I hope it helps.<br /><br />Note that some of these save files have used cheats to beat the game, so many event flags (such as whether you have removed the Rocket in the Game Corner) may be left unchecked, and there may be little PokÃ©mon in the boxes.<br /><br />Edit: Fixed a mistake where the main PokÃ©mon Red save file was a duplicate of the long range Trainers left one.


subject: Re: New Japanese PokÃ©mon Crystal speedrun route (test: 43 minutes in game time)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7315.msg198824#msg198824 date=1437234564]<br />Hey!<br /><br />Just to mention,<br /><br />The missingning/warp method does not work either in French versions. I have no idea why this works on Spanish ones&nbsp; :o<br />[/quote]<br /><br />Hey Krys3000!<br /><br />OK. Thanks for that information. :)


subject: Re: Pokemon Pinball &quot;Glitch Dimension&quot;
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  There is a way to get glitch pokemon with gameshark. They are all japanese text and are named nothing. They don&#039;t appear in pokedex


subject: Re: Pokemon Pinball &quot;Glitch Dimension&quot;
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ok, I&#039;ve got a few codes that produce glitchy messes:<br />01XX79D5 - PokÃ©mon to Catch<br />01XX0CD6 - Left Side Number<br />01XX0DD6 - Right Side Number<br />01XX0CD9 - Pikachu Eye State<br />01XX13D9 - Course Number<br />01XX16D9 - Option Number<br />01XX17D9 - Rumble On/Off<br />01XX1AD9 - Music Number<br />01XX1BD9 - Sound Number<br />01XX59D9 - PokÃ©dex Number


subject: Re: Pokemon Pinball &quot;Glitch Dimension&quot;
poster_name: kaikun97
poster_ip: ***.***.***.***
modified_name: kaikun97
icon: xx
body:
  Oh and I found the code for location too Ill use that<br /><br />01??E1D4 Location<br />91??7ED4 Pokeball<br />91??4AD5 - Level Map (Same as location?)<br />91??E3D4 - Level Map (Same as location?)


subject: New glitch (?) found in FRLG engine
poster_name: theparanoiabug97
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  SO!<br /><br />I was playing a hack of Fire Red (Advanced Adventure, same engine) and I happened to have a full team of 6, with 5 pokemon fainted. The non-fainted one, a Scyther, was in my 5th party slot, and one of my other pokemon, a Tyrogue, had an EXP share on. Entering a double trainer battle, the first thing that happened was, upon entering the battle, the text &quot;Go! SCYTHER and SCYTHER!&quot; even though there was only one Scyther on my team. Both had the same moves, and there were two Scyther sprites onscreen. I tried to go to the Switch screen, and things looked a bit odd. For one, my Servine and my Tyrogue, both fainted, were in the double battle slots at the top of the party. Instead of my Scyther and a Remoraid, two other party slots were being occupied by another Servine and Tyrogue. I tried battling. It now said, for both allies, &quot;What will TYROGUE do?&quot; but showed my Scyther&#039;s moveset. The playing field on my side now appeared empty. On the first turn, my Scyther, being low on health, fainted. Instead of the battle continuing, the game crashed. That is all.


subject: Re: Pokemon Pinball &quot;Glitch Dimension&quot;
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=kaikun97 link=topic=7323.msg198837#msg198837 date=1437662894]<br />Oh and I found the code for location too Ill use that<br /><br />01??E1D4 Location<br />91??7ED4 Pokeball<br />91??4AD5 - Level Map (Same as location?)<br />91??E3D4 - Level Map (Same as location?)<br />[/quote]<br />Thank you I needed the pokÃ©ball one.


subject: Re: New glitch (?) found in FRLG engine
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes, that happens when the game doesn&#039;t verify you have two non-fainted Pokemon before entering a double battle. It&#039;s the hacker&#039;s fault.


subject: G/R/B/Y Pokemon trainer
poster_name: Denny
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi, my name is Denny, Sorry for my bad English but I am from Italy.<br />Recently I&#039;ve found this interesting gameshark codes:<br /><br />[url=http://postimg.org/image/ln4t9pdyn/][img]http://s27.postimg.org/ln4t9pdyn/Pokemon_trainer_gameshark.jpg[/img][/url]<br /><br />I think the image above is self explanatory, but if you have questions about these codes, I will try my best to answer to you.<br /><br /><br /><br />


subject: Re: G/R/B/Y Pokemon trainer
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Welcome to GCLF, Denny. Thank you for this interesting table of trainer modifying gameshark codes!<br /><br />Se hai bisogno di spiegare qualcosa in Inglese e non sai come dire, lo puoi anche dire in Italiano. Mi occuperÃ² del resto&nbsp; ;)


subject: Re: G/R/B/Y Pokemon trainer
poster_name: Denny
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7325.msg198842#msg198842 date=1437948708]<br />Welcome to GCLF, Denny. Thank you for this interesting table of trainer modifying gameshark codes!<br />[/quote]<br />You are welcome!<br /><br />[quote author=Krys3000 link=topic=7325.msg198842#msg198842 date=1437948708]<br />Se hai bisogno di spiegare qualcosa in Inglese e non sai come dire, lo puoi anche dire in Italiano. Mi occuperÃ² del resto&nbsp; ;)<br />[/quote]<br /><br />Grazie per l&#039;aiuto, voglio comunque provare a scrivere in Inglese... Correggimi pure se scriverÃ² qualche cavolata!!!&nbsp; ;)<br /><br />----------------------------------------------------------------------------------<br /><br />About the Red sprite... I&#039;ve discovered something new while I was playing a colosseum battle with the tgb dual.<br />The main character share the same slot with the Rival (19), and, apparently, he has this sprite address: &quot;DE&quot; &quot;6E&quot;.<br />I said apparently, because when I try to use this code in a Single Player battle, it doesn&#039;t work.<br />


subject: Text Variations Page
poster_name: glitchuntress
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey, I haven&#039;t been here for awhile but I recently have been thinking about a old topic of mine, the Mew Trick Experiments thread.<br />http://forums.glitchcity.info/index.php/topic,3979.msg87101.html#msg87101<br /><br />It basically is catalogues the different results you could get from Test ID matching without cheating. (http://glitchcity.info/wiki/index.php/Trainer_escape_glitch#Text_box_ID_matching)<br /><br />I was wondering if I should make a page about it on the wiki. It&#039;s not complete, there&#039;s still a lot of variations I&#039;m missing. Plus, I tried putting it up on Bulbapedia and they took it down so I don&#039;t really want to put it up here just for it to be taken down again.<br /><br />So, is this wiki material or not?<br />


subject: Re: Text Variations Page
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=glitchuntress link=topic=7327.msg198846#msg198846 date=1438089776]<br />Hey, I haven&#039;t been here for awhile but I recently have been thinking about a old topic of mine, the Mew Trick Experiments thread.<br />http://forums.glitchcity.info/index.php/topic,3979.msg87101.html#msg87101<br /><br />It basically is catalogues the different results you could get from Test ID matching without cheating. (http://glitchcity.info/wiki/index.php/Trainer_escape_glitch#Text_box_ID_matching)<br /><br />I was wondering if I should make a page about it on the wiki. It&#039;s not complete, there&#039;s still a lot of variations I&#039;m missing. Plus, I tried putting it up on Bulbapedia and they took it down so I don&#039;t really want to put it up here just for it to be taken down again.<br /><br />So, is this wiki material or not?<br />[/quote]<br /><br />Sure, go ahead. :)


subject: Re: A picture of myself having dinner with my waifu
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Reusing the same pic because I&#039;m lazy.<br /><br />[img width=800]http://i.imgur.com/hVsWP6f.jpg[/img]


subject: Re: A picture of myself having dinner with my waifu
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=6728.msg198848#msg198848 date=1438152830]<br />Reusing the same pic because I&#039;m lazy.<br />[/quote]<br /><br />&gt;LanetteMK2<br /><br />So do you also have computers named Bill, Bebe, Amanita, and Cassius?


subject: Re: A picture of myself having dinner with my waifu
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=6728.msg198849#msg198849 date=1438263594]<br />[quote author=Zowayix link=topic=6728.msg198848#msg198848 date=1438152830]<br />Reusing the same pic because I&#039;m lazy.<br />[/quote]<br /><br />&gt;LanetteMK2<br /><br />So do you also have computers named Bill, Bebe, Amanita, and Cassius?<br />[/quote]<br /><br />My other computer is named Bridgette, as it so happens.


subject: Super Glitch corruption questions
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey there,<br /><br />I&#039;d like to understand more about how Super Glitch behave, most particularly how do we control it as we do in Fossil Conversion ou Doko-Kashira Door Glitch for example. I have read GCL&#039;s wiki page about it, Bulbapedia&#039;s too, but still have some questions.<br /><br />I basically understand the fact that the move takes his name from somewhere in the RAM, and that it corrupts data starting from D0E1. But that&#039;s a starting point right, is the number of addresses affected by the corruption always the same or totally random ?<br /><br />What particularly I don&#039;t get is why for some glitches in which we use SG as the trigger, we put three moves with a total of 27 or 28 letters before the move. I mean, I saw this on bulbapedia :<br /><br />[quote]StartingLocation = D0E1 + MoveLengths + NumberOfMovesBeforeSuperGlitch[/quote]<br /><br />So I understand the idea is to change the starting location, but I don&#039;t get how and why this gives you access beyond the sixth slot. If the idea is just to change the &quot;7th slot&quot; FF to something else, is it really necessary to shift this location using a precise number of characters ? I&#039;m not sure to understand what gets corrupted and how this equation works.<br /><br />Thanks a lot for the help !


subject: Coin Case &quot;Menu Popping&quot;
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I am getting PokÃ©mon Gold soon and I decided to play around with a ROM. I used the coin case glitch and tried a path when I accidentally opened the menu, I continued and the game crashed when I used the coin case. This effect, although I haven&#039;t played with it, depends on where you open the menu.<br />Without menu popping, five right in game corner: [img]http://i.imgur.com/bPTvpE6.png[/img]<br />Two right, menu pop, three right in game corner: [img]http://i.imgur.com/R4maAfs.png[/img]<br />As you can see, using TheZZAZZGlitch&#039;s script, we find that the memory is different.


subject: Speedrunning
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Any of you guys here interested in speedrunning Pokemon? After seeing the Pokemon Blue runs on SGDQ I really want to try it, considering some of the crazy glitches people use. Reminds me of the good ol days on GCLF haha.


subject: Re: PokÃ©mon Super Mystery Dungeon!
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m actually pretty hype for this, as long as it doesn&#039;t suck as much as GTI did. It looks like they&#039;re making it more similar to the originals.


subject: Re: Speedrunning
poster_name: Vuroja5
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Shenanagans&#039; Catch &#039;Em All run was really fun to watch. These days it&#039;s really the speedrunning community that is at the forefront of Pokemon glitch hunting, building on the foundations laid here at Glitch City over the years. For instance the insane glitch using the items like 8 8, 9F and 4848 that he uses to catch a bunch of Pokemon (LG-Fly I think they call it) has pretty much only been documented by speedrunners as far as I&#039;ve seen. Shenanagans didn&#039;t explain it during the run (too complicated I guess), and I have little understanding how it works.<br /><br />It was nice to see Chickasaurus get Glitch City affiliated with pokemonspeedruns.com - a nod to all the research done by members here that is now being applied in speedruns. ZZAZZ&#039;s discoveries about Super Glitch/Cooltrainer come to mind especially.


subject: Re: Speedrunning
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Vuroja5 link=topic=7330.msg198858#msg198858 date=1438558971]<br />Shenanagans&#039; Catch &#039;Em All run was really fun to watch. These days it&#039;s really the speedrunning community that is at the forefront of Pokemon glitch hunting, building on the foundations laid here at Glitch City over the years. For instance the insane glitch using the items like 8 8, 9F and 4848 that he uses to catch a bunch of Pokemon (LG-Fly I think they call it) has pretty much only been documented by speedrunners as far as I&#039;ve seen. Shenanagans didn&#039;t explain it during the run (too complicated I guess), and I have little understanding how it works.<br /><br />It was nice to see Chickasaurus get Glitch City affiliated with pokemonspeedruns.com - a nod to all the research done by members here that is now being applied in speedruns. ZZAZZ&#039;s discoveries about Super Glitch/Cooltrainer come to mind especially.<br />[/quote]<br /><br />Yeah I agree, it was super fun. When I started researching glitched speedruns, I saw a bunch of references to GCLF and I was like whoaaa this is awesome! Didn&#039;t know we were affiliated with them either. <br /><br />I tried out a Blue Any% No Save Corruption run last night, after learning it for the first time the other day, and it actually went decent. 


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [b]PSA: everyone who&#039;s on latest firmware download Ironfall Invasion ASAP. 1.1 is optional.[/b]<br /><br />Look at smealum&#039;s twitter if you&#039;re curious.


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pawny link=topic=7179.msg198860#msg198860 date=1438692722]<br />[b]PSA: everyone who&#039;s on latest firmware download Ironfall Invasion ASAP. 1.1 is optional.[/b]<br /><br />Look at smealum&#039;s twitter if you&#039;re curious.<br />[/quote]<br /><br />So if this works, will I no longer need the browser exploit, or should I still refrain from updating my 3DS? 


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7179.msg198861#msg198861 date=1439137285]<br />[quote author=Pawny link=topic=7179.msg198860#msg198860 date=1438692722]<br />[b]PSA: everyone who&#039;s on latest firmware download Ironfall Invasion ASAP. 1.1 is optional.[/b]<br /><br />Look at smealum&#039;s twitter if you&#039;re curious.<br />[/quote]<br /><br />So if this works, will I no longer need the browser exploit, or should I still refrain from updating my 3DS?<br />[/quote]<br /><br />Well, for glitch researching it&#039;s not that good. It actually will let you edit savefiles and that&#039;s it (along with other homebrew software, custom 3ds themes, etc), and you know, we&#039;d probably be unable to even boot the game with those pokÃ©mon as they&#039;re really unstable (I&#039;m not sure if they do softlock the game on boot if they&#039;re in the box though, only on party, so if someone still has Powersaves and exploit access I&#039;d like a confirmation if possible please).<br /><br />But on the other hand, this may actually unbrick Flameduck&#039;s savefile given we will be able access savefiles now.<br /><br />And the Ironhax is not out yet nor is the save editor, but they&#039;ll supposedly come out today (though I&#039;m doubting it).


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7179.msg198863#msg198863 date=1439141821]<br />I&#039;m guessing it probably won&#039;t work on the New 3DS?<br />[/quote]<br /><br />It actually will.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spectramark
icon: xx
body:
  Apologies if this seems a bit late, but I found something weird about certain Decamarks.<br /><br />I managed to hatch the Decamarks &quot;WATERFALL&quot;, &quot;WITHDRAW&quot;, &quot;BSTITUTE&quot;, &quot;SUPERPOWER&quot; and &quot;OAT&quot; (Sadly, I don&#039;t know their Hex values, as the .txt file I had used to record them got corrupted). I&#039;ll get pictures up soon showing these Decamarks.<br /><br />Upon seeing the amazing stats of the Lv.5 &quot;BSTITUTE&quot;, I attempted to switch it into a battle to let it gain experience. However, upon leveling up, the game crashed after showing the level-up stat gains...<br />I tried putting BSTITUTE in the Day-care to let it level up that way, but once again, the game crashed after paying the Day-care lady to return it to me.<br /><br />I tried levelling up all of my Decamarks, and found that WITHDRAW and BSTITUTE both froze the game, while SUPERPOWER and OAT didn&#039;t. I can remember that SUPERPOWER and OAT are a higher Hex value than the others, so I think that may be a cause of the problem.<br />I&#039;ve yet to try WATERFALL, but it&#039;ll take a while since it needs 65,536 EXP to reach the next level, and I don&#039;t have any rare candies...<br /><br />Due to this, it seems that my Decamarks will be unable to level up at all without crashing the game, and due to the four glitch moves they have, it&#039;s impossible to battle with them, make them learn any new moves, or even trade them over to my Sapphire game.<br />So, is it at all possible to level up these Decamarks without them freezing up the game?


subject: Greetings GCL people
poster_name: Alaistar
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi everyone, Iâ€™m new here and this is my first post! :3<br />I am a PokÃ©mon aficionado (especially I and II generation games) and a complete glitcher noob. Iâ€™m quite ignorant about the subject but I really like it and Iâ€™d like to know more. Of course I already read many Glitch City Laboratoriesâ€™ posts (you guys are great!) and watched as many Youtube videos. I have a question: how did you start doing glitches? I mean.. do I need any sort of knowledge about something like rom programming, assembly.. ? Do you know any sources I can consult that gives me the tools in order to do researches on my own?<br />


subject: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: rortik
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As shown in this video (https://www.youtube.com/watch?v=ddSHGg4-qSY), you can &quot;permanently&quot; edit ingame maps.<br /><br />However there are a few questions I had about the topic.<br /><br />The main one would be: What if I tried this in Yellow? Can ws m do the same thing? I assume that if it did, the executed code would have to be different, but is it at least possible?<br /><br />Other minor questions are:<br />What if you hacked a grass tile into a city?<br />What if you hacked a warp to a nonexistant map, then hacked that map to have an actual tileset? Could you make new cities entirely?


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: kaikun97
poster_ip: ***.***.***.***
icon: xx
body:
  No idea if wsm can do it, possibly hacking new maps in is possible if you can find free space in RAM to do it. Hacking in a grass tile wont do anything as a) it has to part of the tileset and b) have wild pokemon data assigned to the map. Try it in a map editor and see.


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So Ironfall got removed from both EU and NA eShops yesterday. Hopefully everyone interested downloaded it in time.


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I know that grass area PokÃ©mon are not overwritten in Red and Blue when you enter a city. That&#039;s basically the reason why Old Man Trick works, as by talking to the Old Man, your name changes to &quot;Old Man&quot;, and your real name is stored in the provisory empty grass PokÃ©mon slot ; but, because shore tiles works as grass tiles, and grass PokÃ©mon data are not overwritten, surfing onto them in Cinnabar allows you to get PokÃ©mon from your name.<br /><br />This would mean if you implement grass in a city, I guess you would encounter the PokÃ©mon from the last area containing grass tiles you visited.


subject: Re: Greetings GCL people
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Hey Alaistar, welcome to the forums!<br /><br />There are a lot of glitches in the PokÃ©mon games that you can already try out, such as the [url=https://www.youtube.com/watch?v=NU-lcw8-G-c]old man trick[/url], [url=https://www.youtube.com/watch?v=JkF7Xjxn9jc]Trainer-Fly glitch[/url] and [url=https://www.youtube.com/watch?v=Sst_5kAX2y4]&quot;CoolTrainer&quot; type move corruption[/url], that might be nice for you to experiment with. My approach is when you try a completely new glitch is to follow the steps carefully. Then once you have done the glitch a few times, it will become more natural to exploit.<br /><br />You do not need to have much knowledge of programming or the game&#039;s inner workings to do your own research. By doing glitches a little differently, you can discover things for yourself (such as returning to the route you escape from with a Trainer-Fly immediately to avoid battles on that route).<br /><br />The [url=http://glitchcity.info/biglist.htm]big list[/url] is a valuable so you can know what characters in your name will give which PokÃ©mon for the old man trick, or what Special stats for the Trainer-Fly glitch give which PokÃ©mon, etc.<br /><br />One useful thing if you are playing on an emulator is to refer to or learn [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map]PokÃ©mon Red and Blue&#039;s memory structure[/url] (not everything is on this link, but you can find more on the GameShark code archives on this site by reversing the order of the last two bytes pairs in a code, e.g. 01xxD8CF edits CFD8), for example, if you don&#039;t have all badges to be able to Fly and can&#039;t access all fly locations, you can set D356 to FF (every badge) and D70B, D70C (fly locations) to FF FF too.<br /><br />You can have fun with memory editing through a memory editor such as VBA or the BGB debugger. You can also do something like edit D31E to obtain a glitch item easily and see what it does without having to obtain one with [url=https://www.youtube.com/watch?v=98_azamLeh4]TheZZAZZGlitch&#039;s looping map trick[/url]. Note that memory addresses are generally -1 in Yellow (so Yellow&#039;s item 1 is D31D), with the exception of certain ones like CD38 (lets you walk through walls when a non 00 value).<br /><br />With glitches that corrupt the memory, such as Super Glitch/CoolTrainer, you can also observe what values areas of the memory get corrupted too. For instance, CoolTrainer corruption has proved most useful for corruption of the species of the opponent in battle (CFD8); hence, you could view that to see what PokÃ©mon got corrupted beforehand, or if the game corrupted data that far, you could view CFF1 to see what the foe&#039;s DVs became, etc.<br /><br />These [url=http://forums.glitchcity.info/index.php/topic,7320.msg198831.html#msg198831]save files[/url] should also come in handy if you&#039;re using an emulator.<br /><br />Good luck and have fun.


subject: Re: The Pokegod People People Eaters!! [PWN YOU!]
poster_name: shaggs
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m doing great, working and going to school you know the usual things in life and sometimes the unusual haha. Every time I post here I leave because I don&#039;t expect anyone to respond but I have you on Pokemon x so I guess I&#039;ll see there sometime if I don&#039;t catch you here. Hope you&#039;re doing well yourself. Take it easy


subject: Save Abuse Extended Warp
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Do the save abuse glitch, and instead, switch&nbsp; the first Ultra ball (screen brightness) with the second Masterball stack, and toss 0-255. THis works better because:<br />1. It always works.<br />2. You can go to any area.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Shina69
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Good evening, guys.<br />First of all, you people are absolute unrecognized geniuses for coming up with such amazing programming tricks for the eyes of this humble gamer who spent his childhood exploring the neat forests of pokemon yellow, not regretting knowing so little as i did. Although times change and nostalgia grabs us once again to pick the old dusty cartridges and face our old childhood enemies... a magnificent team starts to assemble. Glitches were learned, stats analyzed, moves tactical duplicated in order to fulfill the needs, but... there&#039;s one thing that wasn&#039;t forgotten - [b]i can&#039;t delete the HM moves.[/b]<br />So i went deep and deeper, cause transfer my beloved X_ã‚¥-_xã‚¥, to a Gen 2+ wasn&#039;t an option, and i decided to come to you guys, as i got so fascinated with the wonders of arbitrary code execution.<br /><br />[b]Is there any way to come up with a move deleter for HM&#039;s or simply overwrite this annoying Flash move of X_ã‚¥-_xã‚¥, on Pokemon Yellow European Version (English)?[/b] [size=8pt](i believe this is the proper version, i&#039;m from Portugal and i will try to find that old box!)[/size]<br /><br />Not sure if this is the proper topic to send my request, but i&#039;m deeply thankful for the attention.<br />Keep mesmerizing us with new knowledge applied to old technologies, you guys rock! 


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you want to know the hexadecimal values of the Glitch Pokemon you hatched, you can find them back with the extended 3rd Gen Pokedex (I forgot its exact name, but there is a subject on the forum where a download link is given, and I can&#039;t find it back) as they have a really clear name that you can trace back.<br /><br />For the issue about levelling crashes, I don&#039;t know if this is due to the Pokemon trying to learn a new Glitch Move, its Exp curve being too glitchy, something about the stat increase he has, or the Glitch Pokemon trying to evolve, but it&#039;s something that is related either to the species or the stats increase.<br /><br />Trying to obtain Glitch Pokemon with the &quot;classic&quot; Pomeg Glitch corruption and Egg hacthing is very tough, as the success rate is inconsistent, and as many Glitch Pokemon won&#039;t hatch.<br /><br />However, by using a corruption initiator, alias HYPY the Caterpie, you can perform Pokemon Corruptions with a consistant and higher success rate, and also perform double Corruptions to remove the Egg state of the corrupted Pokemon and thus be able to obtain every Glitch Pokemon. (see at the end of the post here to have the detailled procedure to obtain HYPY the Caterpie http://forums.glitchcity.info/index.php/topic,6868.msg198505.html#msg198505 ) (a few comments after that, Tochickens made a vba file where he obtained HYPY and made a double corruption with it, if you want to directly get HYPY from it. I also made AR codes for this Pokemon a bit below on the same page.)<br />Also, by using the in-game traded Seedot, you&#039;ll b able to have any Gitch Pokemon with Seedots HP and Atk EVs, and its moves will be kept, so he won&#039;t have &quot;annoying&quot; glitch moves preventing you from trying to train a Glitch Pokemon.<br />And if you want a specific Glitch Move, you can use the in-game traded Plusle and its HP and Atk Evs.<br /><br />However, for what you&#039;re trying to pull, Seedot wouldn&#039;t be good as its Exp would be read on EVs and Contest stats, and being an in-game traded Pokemon, he already has Contest stats, (so he would already be at Lv 100 for a good amount of Exp curves).<br /><br />To be able to manipulate the Exp of the Glitch Pokemon you would like to have during the Corruption, you would need to catch Smeargles, give them one HP Up, put them in Boxes 1 and 2 with the corruption initiator, save, and try to corrupt some of them to see if they become a Caterpie in an Egg when their PID is corrupted. Thus, you would have a smeargle with no contest stats nor EVs and you could modify them to have the Glitch Pokemon you want with the Exp amount you want, which can be more helpful sometimes than a couple of Rare Candies.<br />(to know if the Egg you have after one Pomeg Glitch is from a corrupted PID or TID, check if he&#039;s going to hatch quickly or not. If the Pokemon has no Contest Stats, 4th Move, nor Ribbons, this will be enough to know it).


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Shina69
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Shina69
icon: xx
body:
  [quote author=Spoink link=topic=6638.msg198878#msg198878 date=1439585339]<br />Shina69:<br />Catching above L:12 might erase the move, unless you want to keep your current one.<br />[/quote]<br /><br />Oh i also tried that, forgot to mention&nbsp; );<br />Managed to make ditto swords dance 3 times and actually got a L:13 one but the move was still there.<br />Some other guy got the same results as i read on a youtube video comment, that&#039;s why i run out of options&nbsp; :&#039;(<br />(by the way, Flash is the 2nd move on the Fight list, if it helps :o)


subject: Re: The Pokegod People People Eaters!! [PWN YOU!]
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Papa Doc link=topic=1192.msg198874#msg198874 date=1439536559]<br />I&#039;m doing great, working and going to school you know the usual things in life and sometimes the unusual haha. Every time I post here I leave because I don&#039;t expect anyone to respond but I have you on Pokemon x so I guess I&#039;ll see there sometime if I don&#039;t catch you here. Hope you&#039;re doing well yourself. Take it easy<br />[/quote]<br /><br />Yeah same here pretty much haha. And yeah I don&#039;t expect any of the old people to respond cuz the forums have been RIP lately. But yeah I&#039;m gonna try to get back into ORAS so I&#039;ll probably see you online. You too!


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pawny link=topic=7179.msg198870#msg198870 date=1439392400]<br />So Ironfall got removed from both EU and NA eShops yesterday. Hopefully everyone interested downloaded it in time.<br />[/quote]<br /><br />&quot;EVERYONE interested in 3DS homebrew should download YouTube from eshop for FREE. tell all your friends, please RT&quot;<br />https://twitter.com/smealum/status/632280379982938112<br /><br />Just a PSA.


subject: Battle Spot Save Corruption
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Have you guys heard about this?<br />http://pokemonforever.com/Thread-IMPORTANT-A-Warning-to-ALL-Battle-Spot-Players<br /><br />[quote]The most important thing that I want to outline here is that there is a hacking method being utilized that is able to [b]completely erase your save file[/b].<br /><br />This has not been confirmed yet to my knowledge, but it seems that players are using Cybergadgets and similar editing software to pull this off. From what I understand, this type of device will only work on Japanese 3DSes, and all reports that I&#039;ve seen feature a Japanese hacker.<br />[/quote]<br /><br />Thoughts?


subject: Re: Battle Spot Save Corruption
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I saw the thing on saves being deleted a couple weeks ago, someone linked [url=http://pk-mn.com/n/pokemon-kaizou-report-battle-house/]this[/url] and [url=http://pk-mn.com/n/pokemon-kaizou-seve-date-kowareru/]this[/url], but I can&#039;t read Japanese. And I saw two people who couldn&#039;t participate the current competition so apparently the bans announced on PGL are already taking place, but them seem more focused on the pokÃ©mon legality than on edited save data. I managed to enter it and I have Wally icon and 721 pokÃ©mon registered. Someone else who had pokÃ©center and &quot;?&quot;s on battle victories/etc on PSS also made through.<br /><br />I&#039;m really curious to know how this works.


subject: Re: Save Abuse Extended Warp
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Doesn&#039;t it always work and allow you to go to any area anyway ? I mean with the normal technique. I don&#039;t remember limitations.


subject: Re: Save Abuse Extended Warp
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7333.msg198887#msg198887 date=1439617800]<br />Doesn&#039;t it always work and allow you to go to any area anyway ? I mean with the normal technique. I don&#039;t remember limitations.<br />[/quote]<br /><br />Yes, depending on what you throw away and in what order.<br /><br />Experimenting is much more fun though.


