# smf_messages

subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The issue is not with Skeef&#039;s code. It translates to the following ASM:<br />[code]<br />xor a<br />or a,$ff<br />ld ($d5b9),a<br />or a<br />ret nc<br />[/code]<br /><br />...which does it&#039;s intended job of giving x255 of the first item. All i can say is ensure you have setup your bootstrapper correctly. It&#039;s<br />AnyPkmn<br />SlidePkmn<br />Quagsire (Holding TM02, Return as first move)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  The slide-PokÃ©mon I provided works specifically for Coin Case. If you`re using TM25 not only does execution start at the second pokÃ©mon (compared to the third for Coin Case/first for TM17), but also at a different Place in its data.<br />I didn&#039;t check it, but it might even guarantee a failure when used with TM25. To my knowledge there&#039;s no setup which doesn&#039;t involve ACE to guarantee a working TM25-slide-pokÃ©mon, so you either have to use to Coin Case or try your luck with random low levels.<br /><br /><br />[quote author=Epsilon link=topic=6716.msg208722#msg208722 date=1519387411]<br />The issue is not with Skeef&#039;s code. It translates to the following ASM:<br />[code]<br />xor a<br />or a,$ff<br />ld ($d5b9),a<br />or a<br />ret nc<br />[/code]<br /><br />...which does it&#039;s intended job of giving x255 of the first item. All i can say is ensure you have setup your bootstrapper correctly. It&#039;s<br />AnyPkmn<br />SlidePkmn<br />Quagsire (Holding TM02, Return as first move)<br />[/quote]<br /><br />Don&#039;t forget the terminator character at the end of box name 1 which is a &quot;ld d,b&quot; instruction. Here it doesn&#039;t really change anything (maybe set 0 flag), but still could add confusion when you forget it.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg208723#msg208723 date=1519398192]<br />Don&#039;t forget the terminator character at the end of box name 1 which is a &quot;ld d,b&quot; instruction. Here it doesn&#039;t really change anything (maybe set 0 flag), but still could add confusion when you forget it.<br />[/quote]<br /><br />ld instructions do not update flags, so the $50 terminator &quot;ld d,b&quot; isn&#039;t really worth mentioning in this context.


subject: Original Dex trilogy (GlitchDex, AttackDex, ItemDex) completed in MediaWiki form
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  It took a while, but the GlitchDex, AttackDex and ItemDex pages have now been converted into MediaWiki format with information that they were missing before.<br /><br />Due to many of the glitch moves in the AttackDex being virtually the same between Red/Blue/Yellow, some of the AttackDex articles have been moved to have the format RBY indicating they are the same between Red/Blue/Yellow instead of just Red/Blue.<br /><br />I took the time to do this with the TypeDex as well, and also create a stub for the StatDex (documenting glitch stats which can be changed by glitch moves).<br /><br />From now on I will be working on finishing the UnownDex in depth including details like induced Trainer House trainers and Mystery Gifts (which will take relatively a lot of time to complete), and adding missing articles for the TrainerDex.<br /><br />TMHMDex (wrong pocket TM/HM data), DexDex (glitch PokÃ©dex modes) and PhoneDex (glitch PokÃ©gear contacts) may follow.


subject: Glitch weather conditions
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  I came across this code on our PokÃ©mon Gold and Silver GameShark codes page:<br /><br />01xxE8CB<br /><br />(It was wrong at first as 01xxE9CB so I fixed it)<br /><br />The available values are said to be:<br /><br />Weather Mod <br />00 - Nothing <br />01 - Rain <br />02 - Sun <br />03 - Sandstorm <br />04 - Rain dying <br />05 - Sun fading <br />06 - Sandstorm fading <br />07 and up - nothing but lond delay after attack <br /><br />However the effect described for 07 and up is just one effect, and it looks like there are more glitch weathers. Two of them so far have displayed an error code &quot;(x)Df-&quot; for its text every turn, with another resetting the game in a Glitch Dimension.<br /><br />I wonder what other interesting glitch weather conditions exist?<br /><br />Edit: I got weather effect 0x10 to execute FA57 in Echo RAM (in the party slot 1 data where a slide PokÃ©mon could be)<br />Edit 2: 0x12 executed DEE0 as well (enemy 4 nickname slot 2), which is nice. But how could we force it to the other opponent using ACE when linked?


subject: Re: Original Dex trilogy (GlitchDex, AttackDex, ItemDex) completed in MediaWiki form
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  DexDex and TMHMDex listings have been added based on luckytyphlosion&#039;s pastes.<br /><br />https://pastebin.com/u/luckytyphlosion<br /><br />If anyone wants to create articles for these feel free.


subject: Re: Glitch weather conditions
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Cool! It&#039;s always interesting to find new ACE vectors. This one requires ACE to be setup but it could be an interesting alternative to WPTM.<br /><br />In Crystal, the corresponding address is $C70A. I wonder if glitch weather executes code also in this game, because if so, we could use it as a good source of ACE instead of using BC-ACE to set up WPTM.<br /><br />PS: I&#039;ve researched a lot RAM addresses using maps and disasm on G/S/C lately, to build the 2G Gameshark section of PRAMA. So I may want to add a lot of Gameshark codes to GCL&#039;s pages soon :)


subject: Re: Shiny hunting
poster_name: Marv231
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I managed to get all, but one shiny out of the odd egg.&nbsp; ;D<br />The only one, who`s missing is Shiny Tyrogue. <br /><br />Even resetting shiny Celebi was easier then getting the last one 


subject: Re: Shiny hunting
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Lucky to both of you.<br /><br />I&#039;m still soft-resetting for my Shiny Celebi, ha ha.<br /><br />I have two of the Odd Eggs Shinies, Pichu (now Alolan Raichu) and Magby (now Magmortar). I may attempt to get more soon.


subject: Recreating the hybrid glitch PokÃ©mon as PokÃ©mon Bank PokÃ©mon
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Has anyone else thought of this idea?<br /><br />Basically in the Generation I game you take a [url=https://glitchcity.info/wiki/Category:Glitch_Pok%C3%A9mon_by_family]hybrid glitch PokÃ©mon[/url] of a real PokÃ©mon, and assign its nickname to that PokÃ©mon, then use PokÃ© Transporter to get it in Generation VII as if you brought over a glitch PokÃ©mon into Generation VII.<br /><br />You could try for example, a Nidorino named [url=https://glitchcity.info/wiki/GlitchDex/Y:201]ã‚¡ / g J 1[/url].<br /><br />You could also possibly try this with PokÃ©mon like a Kangaskhan named &#039;M evolved from &#039;M (00). Sadly the nickname may go away from this method and illegal moves are blocked, but you could still use another glitch or hacking to get those names.


subject: Re: Glitch weather conditions
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks Krys and thanks for the address! :)<br /><br />That&#039;s awesome, will look forward to seeing it. ^^<br /><br />I have in mind if you could somehow set the weather in a link battle and convince the game that&#039;s the weather for both sides it could be a form of both arbitrary code execution and remote code execution, which could be used to create two player pong again. I don&#039;t know if you can do that though.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Masuta Satoshi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Epsilon link=topic=6638.msg208710#msg208710 date=1519237419]<br />[quote author=Masuta Satoshi link=topic=6638.msg208707#msg208707 date=1519230928]<br />Can anyone help me?<br /><br />Is there any Arbitrary Code to control what DVs I want to change to a Pokemon? For example:<br /><br />-15/15/15/15<br />-15/10/10/10<br /><br />Ive been seen some videos but they just pust the neccesary items (and in different ways, so I cant find a pattern). Some examples:<br /><br />https://www.youtube.com/watch?v=H8AgGp5cqPI&amp;t=308s<br />https://www.youtube.com/watch?v=RCrzcqLEauQ<br /><br />Ty.<br />[/quote]<br /><br />The following codes are used to edit the DVs of box Pokemon 1.<br /><br />You can use<br /><br />8f<br />Any<br />Carbos x218 (hex:DA)<br />X Accuracy x178 (hex:B2)<br />Lemonade xDVOne<br />TM03 x55 (hex:37)<br />Elixer x71 (hex:47)<br />Awakening xDVTwo<br />Escape Rope x121 (hex:79)<br />Max Elixer x176 (hex:B0)<br />Ether x119 (hex:77)<br />TM01 x[Any qty]<br /><br />To write to the Speed/Special IVS. Then, to write to attack/defense IVs, toss one X Accuracy.<br /><br />Alternatively, you may also use this code, which writes to all DVs in one go. It takes a bit of math to use, however.<br /><br /><br />8f<br />Any<br />Thunderstone x177 (hex:B1)<br />TM18 x4 (hex:04)<br />Lemonade x#FirstNum<br />Water Stone x82 (hex:52)<br />Awakening x#SecondNum<br />Escape Rope x121 (hex:79)<br />Max Elixer x119 (hex:77)<br />TM01 x[Any qty]<br /><br />To find the numbers, simply take the first DV * 16 + the second DV. For the second number, do this with the third and fourth DVs<br /><br />So<br /><br />15/10/10/10<br /><br />...would be<br /><br />Thunderstone x177 (hex:B1)<br />TM18 x4 (hex:04)<br />Lemonade x250 (hex:FA)<br />Water Stone x82 (hex:52)<br />Awakening x170 (hex:AA)<br />Escape Rope x121 (hex:79)<br />Max Elixer x119 (hex:77)<br />TM01 x[Any qty]<br />[/quote]<br />Thanks a lot, I&#039;ll test results. I have some doubts: what happens if you put numbers that surpass 16 (max DV is 15 in generation I and II). And...<br />Is it possible to make a generic ACE like generation II in this video?: https://www.youtube.com/watch?v=PsIb3OZaYAs<br />Finally: What discussion or theme/topic do u recommend me to learn about this kind of topics? I know generation I and II has a lot of glitches and they have many possibilities, and they use and hex system, but I cant understand at all so I can control the game in the way i want. I dont know if i let me understand, thanks in advance.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Most DVs in Generations I/II are determined by the upper and lower nybble of bytes. There are two addresses which control the Attack/Defense DV and the Speed/Special DV respectively, with the HP DV being calculated in a different way based on the other DVs.<br /><br />The nybble can be read from one digit of the DV byte. For example, if this value is D5 on the Attack/Defense DV address it means an Attack DV of D (13 in decimal) and a Defense DV of 5 respectively. Since hexadecimal only ranges between 0-F (15), it isn&#039;t possible to have a DV that exceeds 15.<br /><br />For generic uses, the reusable RAM writer does the trick as long as you know the RAM addresses (which can be found on Datacrystal and the PokÃ©mon Red disassembly). For the below code Lemonade&#039;s quantity controls the value, Carbos&#039;s quantity controls the first byte of the address and X Accuracy&#039;s quantity controls the second byte of the address.<br /><br />If you wanted to write 0x15 to D059 then for example (giving a Mew encounter in Red/Blue), you would need Lemonade x 0x15 (x21 in game; decimal), Carbos x 0xD0 (x208 in game) and X Accuracy x 0x59 (x89 in game).<br /><br />The reusable RAM writer is made so that it resets the quantities back to x0 afterwards. As x0 is in this sense x256 you can toss 1-255 of them without destroying the stacks, and access every possible byte.<br /><br />At item 3:<br /><br />[code]3E xx 26 xx 2E xx 04 77 26 D3 3E 00 2E 23 04 22 23 22 23 22 C9[/code]<br /><br />Lemonade x(xx)<br />Carbos x(yy)<br />X Accuracy x(zz)<br />PokÃ© Ball x119<br />Carbos x211<br />Lemonade x0<br />X Accuracy x35 (x34 in Yellow)<br />PokÃ© Ball x34<br />HP Up x34<br />HP Up x34<br />TM01 x0<br /><br />ld a, 00 - a (value)=xx<br />ld h, 00 - h (address byte 1)=yy<br />ld l, 00 - l (address byte 2)=zz<br />inc b - useless code<br />ld (hl),a - load a into the address (e.g. D059)<br />ld h, D3 - we load the address byte 1 as D3 (item quantities are in the D3XX region)<br />ld a, 00 - we load &#039;a&#039; as 0 (quantity of 0)<br />ld l,&nbsp; 23 - l=23, now our address is D323 (item 3 quantity)<br />inc b - useless code<br />ld (hli),a - means we put &#039;a&#039; in D323, and then increase the hl value to D324<br />inc hl -&nbsp; hl value=D325<br />ld (hli),a - means we will load a (0) into D325 (item 4 quantity), and increase hl to D326<br />inc hl - hl value =D327<br />ld (hli),a - means we put &#039;a&#039; in D327 (item 5 quantity) 


subject: Re: Original Dex trilogy (GlitchDex, AttackDex, ItemDex) completed in MediaWiki form
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Abwayax link=topic=8256.msg208735#msg208735 date=1519508202]<br />Awesome work! Thanks!<br />[/quote]<br /><br />You&#039;re welcome! :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg208723#msg208723 date=1519398192]<br />The slide-PokÃ©mon I provided works specifically for Coin Case. If you`re using TM25 not only does execution start at the second pokÃ©mon (compared to the third for Coin Case/first for TM17), but also at a different Place in its data.<br />I didn&#039;t check it, but it might even guarantee a failure when used with TM25. To my knowledge there&#039;s no setup which doesn&#039;t involve ACE to guarantee a working TM25-slide-pokÃ©mon, so you either have to use to Coin Case or try your luck with random low levels.<br /><br /><br />[quote author=Epsilon link=topic=6716.msg208722#msg208722 date=1519387411]<br />The issue is not with Skeef&#039;s code. It translates to the following ASM:<br />[code]<br />xor a<br />or a,$ff<br />ld ($d5b9),a<br />or a<br />ret nc<br />[/code]<br /><br />...which does it&#039;s intended job of giving x255 of the first item. All i can say is ensure you have setup your bootstrapper correctly. It&#039;s<br />AnyPkmn<br />SlidePkmn<br />Quagsire (Holding TM02, Return as first move)<br />[/quote]<br /><br />Don&#039;t forget the terminator character at the end of box name 1 which is a &quot;ld d,b&quot; instruction. Here it doesn&#039;t really change anything (maybe set 0 flag), but still could add confusion when you forget it.<br />[/quote]<br /><br />That&#039;s what I suspected. I REALLY should get around to learning the assembly code for this... but I&#039;m lazy. Though, I&#039;d like to have the ACE for a working tm-25 slide pokÃ©mon. &#039;Till then I&#039;m gonna go find myself a temporary slide pokÃ©mon until then since that&#039;s the only thing I can see in my case that could be wrong here (I wrote the box name code correctly and put the Quagsire [holding TM02 and with Return as the first move] and slide pokÃ©mon in the correct places in slots 3 and 2 respectively).<br /><br />Thanks!<br /><br />[quote author=Epsilon link=topic=6716.msg207251#msg207251 date=1507933257]<br />[quote author=Nostalgia link=topic=6716.msg207249#msg207249 date=1507917503]<br />[quote author=Lost-Paisley link=topic=6716.msg207247#msg207247 date=1507882774]<br />I&#039;ll be keeping that in mind~ how many steps does it take for the mon to develop its happiness value? And does it decrease if left in the box?<br /><br />I&#039;m curious, the box codes that let you change one mon to another, if you have an egg that is shiny (let&#039;s say it&#039;s a Wooper for example) and you alter it into a different mon (like Zapdos) via the box codes, would the egg result in a shiny Zapdos?<br />[/quote]<br /><br />Happiness won&#039;t decrease if left in the box. And I&#039;m not sure, but I think if the slide Pokemon gets any noticeable happiness increase then it will mess up the code, because the slide Pokemon has to be freshly caught or hatched with no stat experience and happiness is another one of those factors I guess. <br /><br />However, I was using the coin case a lot yesterday with the same slide Pokemon and walking from the PC in Cherrygrove to outside the mart in Cherrygrove for coin cases glitches, when you repeat that enough times you&#039;re certainly walking a good number of steps, but still my slide Pokemon still worked. And today I was using the hatched Togepi as a slide Pokemon as a test and it worked, so I would certainly recommend freshly hatched Pokemon.<br /><br />As for your question, I haven&#039;t messed around with shiny codes yet but if the first code changed the egg to shiny and then you changed the Pokemon species then it should still be shiny as that is determined by the DV&#039;s which are made when you use you shiny code.<br />[/quote]<br /> Not quite. Even if your slide&#039;s happiness value increases, it doesn&#039;t matter too much unless it reaches a malicious opcode. What I mean by that is, any opcode that changes code flow (call,ret,jp,jr), any opcode that stops the cpu (stop, and MAYBE halt, I&#039;m not quite sure), any op that messes with the stack (inc sp,push,pop,ld sp,rst,etc.), any invalid ops ($D3,$DB,$DD,$E3,$E4,$EB,$EC,$ED,$F4,$FC,$FD), and &quot;di&quot;.<br /><br />The Happiness value increments upon walking 256 steps, and when freshly caught, has a value of $00. The first &quot;malicious&quot; opcode it encounters first is &quot;stop&quot;, which is hex $10. So, a freshly caught slide pokemon is considered &quot;broken&quot; after 4096 steps. [b]However[/b], you can easily set this value to $11 (ld de,$xxyy) by walking 256 more steps. So if you find that your slide has stopped working, walk 256 more steps and see if that fixes it.<br /><br />Also, it is worth noting that happiness is not the only thing that affects slide pokemon.<br />Here&#039;s a list of all factors that affect slide pokemon:<br /><br />Attack EV<br />Defense Ev<br />Speed EV<br />Special EV<br />Attack/Defense IV<br />Speed/special IV<br />PP of current moveset<br />Happiness/Hatch Time<br />Pokerus<br />Caught Information<br />Level<br />Status<br />Hp<br />Max Hp<br />Attack<br />Defense<br />Speed<br />Special Defense<br />Special Attack - Must correspond to an instruction that is one byte long, otherwise the jump instruction that executes your code will be absorbed!<br />[/quote]<br /><br />I was also wondering about this. What values or value ranges of each of these would be needed to make a suitable slide pokÃ©mon? As in, just a regular working slide pokÃ©mon, not a specific one like the special coin case one which jumps over a lot of these factors.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Epsilon link=topic=6716.msg208724#msg208724 date=1519400606]<br />[quote author=spamviech link=topic=6716.msg208723#msg208723 date=1519398192]<br />Don&#039;t forget the terminator character at the end of box name 1 which is a &quot;ld d,b&quot; instruction. Here it doesn&#039;t really change anything (maybe set 0 flag), but still could add confusion when you forget it.<br />[/quote]<br /><br />ld instructions do not update flags, so the $50 terminator &quot;ld d,b&quot; isn&#039;t really worth mentioning in this context.<br />[/quote]<br /><br />Ah, so they don&#039;t.<br />I always forget since I never had to use them other then after specifically setting them (i.e. by dec statement).<br /><br />[quote author=Azarokkusu link=topic=6716.msg208737#msg208737 date=1519548536]<br />I was also wondering about this. What values or value ranges of each of these would be needed to make a suitable slide pokÃ©mon? As in, just a regular working slide pokÃ©mon, not a specific one like the special coin case one which jumps over a lot of these factors.<br />[/quote]<br /><br />Not contain any values that interrupt execution, jump somewhere else or set a random byte.<br />In general you&#039;re fine with values &lt;10.<br />If you plan to look at values anyway I&#039;d advice to use TM17 instead of TM25. IIRC it starts execution somewhere in the stats of PokÃ©mon 1 (i.e. slide as first, quagsire as second) instead of some invisible value of pokÃ©mon 2.


subject: Re: PokÃ©mon XD: Decamark 0x19D converts into Bonsly?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not sure if you can trade it back sorry, but may try that soon.<br /><br />In answer to your second question though TheMirageTV was apparently able to trade it to Emerald and have it on video (but not sure if they could trade it back).<br /><br />https://www.youtube.com/watch?v=jZD-ZSZDWKM


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I like to use this setup to arbitrarily write 2 bytes of data to any address. This code writes [AA] to XXYY and [BB] to XXYY + 1. XX goes to h, YY goes to l, so for the address 0xDAA2, you&#039;d use [XX] = 0xDA = 218 and [YY] = 0xA2 = 162. I like this one because all of the items except the Max Revive can be purchased from the Celadon Mart, and there&#039;s a Max Revive on cycling road.<br /><br />[list]<br />[li]Carbos x[XX][/li]<br />[li]X Accuracy x[YY][/li]<br />[li]Lemonade x[AA][/li]<br />[li]Water Stone x04[/li]<br />[li]Max Revive x[BB][/li]<br />[li]TM01 xany[/li]<br />[/list]<br /><br />[code]ld h, [XX]<br />ld l, [YY]<br />ld a, [AA]<br />ld (hl+), a<br />inc b ; padding<br />ld (hl), [BB]<br />ret[/code]<br /><br /><br />As an example, you can make the first Pokemon in your current box shiny by loading 0xFAAA into 0xDAB1, which would correspond to:<br />[list]<br />[li]XX = 0xDA = 218[/li]<br />[li]YY = 0xB1 = 177[/li]<br />[li]AA = 0xFA = 250[/li]<br />[li]BB = 0xAA = 170[/li]<br />[/list]<br /><br />And so the inventory would be:<br />[list]<br />[li]Carbos x218[/li]<br />[li]X Accuracy x177[/li]<br />[li]Lemonade x250[/li]<br />[li]Water Stone x04[/li]<br />[li]Max Revive x170[/li]<br />[li]TM01 xany[/li]<br />[/list]


subject: save file destroyed bypass gameshark codes
poster_name: Adam_12
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Adam_12
icon: question
body:
  Hi everyone. First post here.&nbsp; I&#039;m a long time lurker, and a big fan of the site and all the work you guys do.<br /><br />I&#039;m not sure if this is the right board to post this.&nbsp; If not please feel free to move it.<br /><br />Herds my problem: while experimenting a bit with various glitches I stupidly managed to corrupt the save files on both my Gold and Crystal carts.&nbsp; Its not a huge deal, because no have backup saves on my Mega Memory Cards.<br /><br />But I&#039;d like to explore the corrupted saves a bit.&nbsp; If I remember correctly there&#039;s a problem with a chat cksum causing the &quot;save file is corrupted&quot; message, and most of the data is still intact.<br /><br />I was hoping someone could share gameshark codes to bypass the error message, and force the games to load the corrupted saves anyway.<br /><br />I&#039;ve had interesting results with corrupt data before.&nbsp; When I did a similar thing on my red years ago my name was the default &#039;NINTEN&#039; and lots of my pokemonhad the species of the Pokemon next to it, but the name and moves of what it originally was.<br /><br />In a slightly related case, I once played a Gold cart with a dead batters, saving using my Game shark&#039;s be nap shot feature.&nbsp; This doesn&#039;t save PC Pokemon correctly and iendednup with a bunch of level 100 random Pokemon with garbage names, weird moves location caught data, even though it was gold, and Pokerus.I still have many of those to this day and spread the pokerus around as much as possible.&nbsp; <br /><br />When I loaded that game into stadium 2, I had a mystery gift waiting for me of a gs ball<br /><br />Well, enough reminiscence.<br /><br />TLDR: I have corrupt saves on Gold and Crystal, not the batteries fault.&nbsp; Does anyone know and can share gameshark codes to bypass the error traps?


subject: Re: save file destroyed bypass gameshark codes
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t believe that&#039;s possible, since the data is destroyed and cannot be recovered. Neither of GCL&#039;s GameShark pages for English GS/C codes have anything for this, and those pages are exhaustive. 


subject: Re: save file destroyed bypass gameshark codes
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  GameShark is impossible. Game Genie might do the job, but I&#039;m not sure how.<br />Anyways, if your save is corrupt, it&#039;s for a good reason - it probably wouldn&#039;t load if you forced it to.


subject: Re: Shiny hunting
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8209.msg208730#msg208730 date=1519494565]<br />I have two of the Odd Eggs Shinies, Pichu (now Alolan Raichu) and Magby (now Magmortar). I may attempt to get more soon.<br />[/quote]<br />I actually have a spare Odd Egg shiny Cleffa for you, so if you want it just DM me or maybe reply here (I would prefer if you would DM me on Discord though but it&#039;s your choice).<br />I also hunted for a few shiny UBs and got them relatively quick, these were Xurkitree, Guzzlord and Blapcehalon, I still want to get the others but I lack the time nor interest at times.<br />I also hatched a few gen 2 1/64s, Pichu and Larvitar to be more exact, And Charmander.<br />I also have a box of spare wormhole shinies.


subject: Re: &quot;The Ghost of Glitch City&quot;
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Let me ask you Cello, were you using VBA for the video? As I can&#039;t seem to be able to replicate the effect on a any other emulators.


subject: Re: Delivery man out of bounds glitch (PokÃ©mon Sun/Moon)
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Replicated, while you can&#039;t go back in bounds after going out of them, you can get back in bounds right after loading the save so it&#039;s not 100% trashed. Also, you cannot open any menus except the bag while in this state.


subject: Re: Shiny hunting
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Charmy link=topic=8209.msg208747#msg208747 date=1519923696]<br />[quote author=Princess Torchic â¤ link=topic=8209.msg208730#msg208730 date=1519494565]<br />I have two of the Odd Eggs Shinies, Pichu (now Alolan Raichu) and Magby (now Magmortar). I may attempt to get more soon.<br />[/quote]<br />I actually have a spare Odd Egg shiny Cleffa for you, so if you want it just DM me or maybe reply here (I would prefer if you would DM me on Discord though but it&#039;s your choice).<br />I also hunted for a few shiny UBs and got them relatively quick, these were Xurkitree, Guzzlord and Blapcehalon, I still want to get the others but I lack the time nor interest at times.<br />I also hatched a few gen 2 1/64s, Pichu and Larvitar to be more exact, And Charmander.<br />I also have a box of spare wormhole shinies.<br />[/quote]<br /><br />Wow that&#039;s really nice, thank you Charmy.&nbsp; :)<br /><br />You want anything in return?<br /><br />I&#039;ll go on Discord tomorrow and if we&#039;re both on I&#039;ll try and pick it up.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So, avoiding things like unwanted SUB, ADD and JMP instructions for example then. Fair enough! The more I think about this the more I am convinced I need to learn the gameboy Assembly (modified version of Z80 iirc.)&nbsp; Not like it&#039;d even be the first assembly language i&#039;ve learned.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Haircoolass
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg208071#msg208071 date=1514517563]<br />Little helper code which might be useful to someone else as well:<br />Maximize all PC items (quantity x 255) while leaving the item type unchanged.<br />[code]<br />1)&nbsp;  A&nbsp;  p&nbsp; &#039;v&nbsp;  5&nbsp;  Ã©&nbsp;  4&nbsp;  2&nbsp;  5		XOR A; SUB fb; LD [faf8], A			| A-&gt;05<br />2)&nbsp; &#039;v&nbsp;  9&nbsp;  Ã©&nbsp;  /&nbsp;  2&nbsp;  p&nbsp; &#039;v&nbsp;  .		SUB ff; LD [f3f8], A; XOR A; SUB e8		| A-&gt;06; A-&gt;18<br />3)&nbsp;  Ã©&nbsp;  0&nbsp;  2&nbsp; &#039;v&nbsp;  2&nbsp;  Ã©&nbsp;  5&nbsp;  2		LD [f6f8], A; SUB f8; LD [fbf8], A		| A-&gt;20<br />4)&nbsp; &#039;v&nbsp;  9&nbsp;  Ã©&nbsp;  â™€&nbsp;  2&nbsp; &#039;v&nbsp;  9&nbsp;  5		SUB ff; LD [f5f8], A; SUB ff			| A-&gt;21; A-&gt;22<br />5)&nbsp;  Ã©&nbsp;  2&nbsp;  2&nbsp; &#039;v&nbsp;  9&nbsp;  Ã©&nbsp;  3&nbsp;  2		LD [f8f8], A; SUB ff; LD [f9f8], A		| A-&gt;23<br />6)&nbsp; &#039;v&nbsp;  Ã—&nbsp;  Ã©&nbsp;  ,&nbsp;  2&nbsp;  0&nbsp;  9&nbsp;  9		SUB f1; LD [f4f8], A; OR ff; LD B, 32		| A-&gt;32<br />7)&nbsp;  0&nbsp;  0&nbsp;  0&nbsp;  5&nbsp;  5&nbsp;  5&nbsp;  5&nbsp;  5		LD HL, 18f6; LD [HLI], A; INC HL; DEC B; JR NZ, fb	| HL-&gt;f618<br />8)&nbsp;  x&nbsp; &#039;d					OR A; RET NC<br />[/code]<br /><br />Fun little thing about x0 quantity (at least in the PC):<br />You can withdraw/toss any quantity you want, it won&#039;t change the quantity of the item. While tossing obviously does nothing, withdrawing works without problems (creates items).<br />Depositing an additional item of the type simply adds the amount which restores normal functionality.<br />Possibly also works in the inventory to give you an infinite amount of an item, but I didn&#039;t test that.<br />[/quote]<br /><br />Hey there im pretty now to the world of ACE-glitches in gen 2. <br /><br />I used the wild shiny celebi-glitch yesterday and wanted to try this code to multiply some items. <br />My questions are: how do I use this code in the quote? Is it for CoinCase or TM25? <br />And in case of using tm 25 do I always need to have quagsire as my 3rd mon and my slide-Pokemon (I use the traded Onix &quot;Rocky&quot;) on the 2nd slot? <br />Is there a way I can identify a code if it is used for tm 25 or coincase?<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  There is an explanation of the differences between Coin Case and TM codes in a few replies to [url=https://forums.glitchcity.info/index.php?topic=8126.0]the newcomers guide to G/S/C ACE[/url]. You will basically read there what is needed in a Coin Case code compared to TM codes so you can see if a code is designed for Coin Case.<br /><br />Also, I wonder why people keep doing the TM25 setup. Preparing TM17 for ACE is easier...


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Pokeglitch86
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ho-oh Save File: https://sabercathost.com/dy8n/Virus_Save_-_Ho-oh_-_1.04_.SAV<br /><br /><br />Pikablu Virus: https://sabercathost.com/dy8o/Virus_Save_-_Pikablu_Virus_-_1.03_.SAV<br />(Uses MrCheeze&#039;s virus to allow Pikablu to be traded to other Red and Blue versions)<br />https://youtu.be/fHF_Moez8nM


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pokeglitch86 link=topic=7888.msg208756#msg208756 date=1520017292]<br />Ho-oh Save File: https://sabercathost.com/dy8n/Virus_Save_-_Ho-oh_-_1.04_.SAV<br /><br /><br />Pikablu Virus: https://sabercathost.com/dy8o/Virus_Save_-_Pikablu_Virus_-_1.03_.SAV<br />(Uses MrCheeze&#039;s virus to allow Pikablu to be traded to other Red and Blue versions)<br />https://youtu.be/fHF_Moez8nM<br />[/quote]<br /><br />Neato :) Thanks Pokeglitch.<br /><br />Mind if I mirror them on my Google Sites website? (I&#039;ll give credit to you)


subject: Re: Ho-oh on a Real Pokemon Red Cartridge (SRAM Hack)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pokeglitch86 link=topic=7888.msg208758#msg208758 date=1520018292]<br />Yeah, of course.<br />[/quote]<br /><br />Added<br /><br />https://sites.google.com/site/torchickens2/pokemon-save-files


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;Cat is in the bathtub drinking the water from the shower I just had<br /><br />What the fuck are you even...?


subject: Party not healed after Plasma Frigate event?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This may not be significant but wanted to note it, just in case.<br /><br />Several months ago I did another playthrough of PokÃ©mon White 2, and noticed after the Plasma Frigate event (the one with the puzzles where you confront Colress), after defeating Zinzolin in the Double Battle that the game would take you out without healing your party PokÃ©mon.<br /><br />If this battle was a tie (using Selfdestruct/Explosion) could you end up with all fainted PokÃ©mon? It&#039;s unlikely, but would be interesting if it did and could open up something bigger.<br /><br />Video of this point (not mine but from Lueroi)<br />https://youtu.be/xtTPEZcRE6A?t=477


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Tabbender link=topic=6868.msg208721#msg208721 date=1519386634]<br />Hey, i think i just discovered a glitch move that might be interesting<br /><br />I was trying to get TheZZAZZGlitch&#039;s arbitrary code execution move (0x27A2) but it gave me this move instead. Idk if i failed the EV&#039;s or if the move&#039;s id is different on French versions...<br />[/quote]<br /><br />From the information you gave, you obtained Glitch Move 0x27A2.<br />Its characteristics on a French Emerald are : <br />NÂ° 27A2 .Lenght 110 /Effect 198 /Pow 4 /Type 217 /Acc 80 /PPs 3 /Acc2 204 /Flag 60 /Prio 195 / Animation : 0x0E0F14C0<br />On an US Emerald, these characteristics are :<br />NÂ° 27A2 .Lenght 70 /Effect 0 /Pow 102 /Type 87 /Acc 117 /PPs 86 /Acc2 70 /Flag 84 /Prio 100 / Animation : 0x0E0F14C0<br /><br />The animation pointer adress is the same, but the move&#039;s effect is different (from No effect on US to Double-Edge&#039;s effect),&nbsp; as well as the priority (a priority over 128 is a negative priority).<br /><br />Even though the move&#039;s name is short, the name the game uses when the move is used in battle is longer (I don&#039;t really know where he pulls the other name off), and the latter overwrites the battle type, which causes a lot of mess in the battle.<br />Thankfully the &quot;flee by hitting B&quot; mode is set, so you can always flee by hitting B.<br />(This &quot;flee&quot; also explains why you can&#039;t abuse this effect in Battle Frontier, except for the trainers in Battle Pyramid.<br /><br />For the difference in effects between your two Dragonairs, I think that this may come from the fact that your first Dragonair was obtained with a single corruption and thus has different moves in Move slots nÂ°2 and nÂ°4 thant your double-corrupted Dragonair, these moves being glitch moves.<br />Considering the EVs you gave to your Plusle, you should have :<br />Single-Corrupted Dragonair : Move 0x27A2 / Move 0x4000 / Move 0x0000 / Move 0x4505.<br />Double-Corrupted Dragonair : Move 0x27A2 / Move 0x0000 / Move 0x0000 / Move 0x0505.<br />Even though moves 0x4000,0x0505,0x4505 have short names in Emerald FR, they may cause a change in behaviour during all the mess that happens when the game tries to call the move&#039;s animation.<br /><br />As you tried to use the Glitch Move with battle animations ON, you got various effects when the move hit (mostly freezes, but sometimes something else) due to the fact that the ROM adress pointed by the move&#039;s animation doesn&#039;t always store the same values (the save is segmented in 15 sections whose order changes everytime you save the game and maybe when you load it), and due to the fact that the commands executed by the console when reading the move&#039;s animation code may rely on other values that can easily change.<br />Else, when the move missed, the battle animation script wasn&#039;t called, and you can continue the battle (although the written name overwrote a lot of values managing the battle, making it a huge mess, so that continuation may be limited to a turn or even a single A press).<br /><br />While Glitch Move 0x27A2 can produce Arbitrary Code Execution with PC Items, it relies on the saved data, whose location can&#039;t be easily predicted from what I know. (and the patterns of the 15 saved data segments can vary from a save file to another too)<br />Thus, future Abritrary Code Execution on console will rely on Animation Pointer adresses that point to RAM data (echo RAM data of PC PokÃ©mon), where the value at such a RAM adress can be predicted by a DMA pattern check.<br />


subject: Re: Shiny hunting
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh didn&#039;t notice you were there, like, I don&#039;t use the forums often anymore, I still sometimes lurk and reply, but I still use Discord way more than the forums, The only thing I could recommend would be you checking on the server more often.


subject: Re: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Anna Says Hi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Anna Says Hi
icon: xx
body:
  Why is this not pinned. I was about to create a thread for bad clone ACE and then found out this existed.<br /><br />Also, this is a much better setup for bad clone ACE: https://pastebin.com/DaWmYHLF<br /><br />(Note that you will have to pop something one additional time before returning, or else values in the range of (HL) will be corrupted after returning)


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the info ! So it was the same move after all.<br /><br />Weird, because i did try to save twice often, and to move PC items around, i always got the same result, which was a freeze. Well actually once i got the music to slow down, so maybe it&#039;s due to that ? Not sure if i can properly exploit it though.<br /><br />Also for my 2 Dragonairs, i did change the moves of the 2nd by using the Day Care, and the effect of his attack didn&#039;t change. I also now have a Charizard with the same glitch move, he have the same effect as my 1st Dragonair (text displaying at normal speed instead of slower when the move is used + impossible to end the fight with B).


subject: Re: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks Torchic&nbsp; ;)<br /><br />[quote author=Anna Says Hi link=topic=8126.msg208765#msg208765 date=1520109150]<br />Why is this not pinned. I was about to create a thread for bad clone ACE and then found out this existed.<br /><br />Also, this is a much better setup for bad clone ACE: https://pastebin.com/DaWmYHLF<br /><br />(Note that you will have to pop something one additional time before returning, or else values in the range of (HL) will be corrupted after returning)<br />[/quote]<br /><br />That setup is already in the guide in section IV.2 (B). Indeed it&#039;s a very cool setup because it allows mail box codes, which is not allowed by Crystal_&#039;s setup in section IV.2 (A). I use items codes quite often so I don&#039;t mind doing Crystal_&#039;s setup but I think it would be very cool to have a lot of mail box codes to use with lucky&#039;s setup :)


subject: Re: [request][help] Clone Pokemon Using &quot;ws m&quot; ACE in pokemon Yellow.
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I know this post is a bit old, but i have tried the codes that were suggested here and they don&#039;t seem to work for me. I might be doing something wrong, but the code listed above doesn&#039;t seem to let me clone via the daycare (i put the pokemon in, take it out and use the code, but it just asks if i want to deposit another pokemon). The code that was given to me on my other post makes hybrids, but I might have been doing something wrong as well as even though they became mews, their moves and names were glitched. so I am in need of some help.<br /><br />I could really use a cloning code that would let me clone a pokemon without having to use the day care, like the code mentioned above where it clones in the box. I don&#039;t want to use the daycare as that resets the experience to the base value, and i need to keep the experience they have as I am planing on transfering these up to gen 7. However with yellow ACE using pokemon in the box to execute code, I am not sure how i would go about doing something like this. Maybe if there was a code that cloned pokemon in your party (Take pokemon one and put its data into pokemon 2&#039;s slot, without making a hybrid), then that would work. I&#039;d try and come up with a code myself but I don&#039;t know anything about coding or ACE. If anyone can help It would mean a lot.


subject: Re: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Anna Says Hi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Anna Says Hi
icon: xx
body:
  In that case, I have a mail/box code to give party Pokemon 3 maxed out DVs/IVs:<br /># means that any symbol can go there, since that slot will be overwritten by something later on.<br />[code]<br />Mail:<br />t##)&#039;vQÃ©h5?!Ã©e50&quot;<br />?cÃ©k5AÃ©o5l0A&#039;m:5<br /><br />Box names, starting from box 5 (the Pk is one character):<br />###Ã©p5?7<br />07#&#039;vt#09<br />#&#039;vj##i5#<br />09Pk&#039;d####[/code]<br /><br />[code]target: get 67 in FBA4, 6F in FBA7, 22 in FBAA, BD in FBAE, C2 in FBAF, jump to FB9C<br /><br />org $F001<br /><br />F002: or E; B3, t<br />F003: ld BC, 9B01; 01 01 9B; # # )<br />F006: sub $90; &#039;v Q<br />F008: ld (FBA7), A; EA A2 FB, Ã© h 5<br />F00B: and $E7; ? !<br />F00D: ld (FBA4), A; Ã© e 5<br />F010: or $72; 0 &quot;<br />F012: ld C, (HL);<br />F013: and $A2; ? c<br />F016: ld (FBAA), A; Ã© k 5<br />F019: add A, B; A<br />F01A: ld (FBAE), A; Ã© o 5<br />F01D: xor E; l<br />F01E: or 80; 0 A<br />F020: jp NC, FB9C; &#039;m : 5<br /><br /><br />target: get FF into DD4A - DD54<br /><br />org $FB9C<br /><br />$FB9C: ld (FBAF), A; EA AF FB, Ã© p 5<br />$FB9F: and $FD; ? 7<br />$FBA2: or $FD; F6 FD, 0 7<br />$FBA4: ld H, A; 67<br />$FBA5: sub $B3; D6 B3, &#039;v t<br />$FBA7: ld L, A; 6F<br /><br />$FBA8: or $FF; F6 FF, 0 9<br />$FBAA: ld (HLi), A; 22<br />$FBAC: sub $A9; D6 A9, &#039;v j<br />$FBAE: cp L; BD<br />$FBAF: jp nz, $FBA8; C2 A8 FB, # i 5<br />$FBB2: or $FF; F6 FF, 0 9<br />$FBBD: pop HL; E1, Pk <br />$FBBE: ret nc; D0, &#039;d<br />[/code]


subject: Re: [request][help] Clone Pokemon Using &quot;ws m&quot; ACE in pokemon Yellow.
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Apparently, the original creator of the code I ported for you wrote to $DA72. When I ported it for Yellow, I simply subtracted the address -1 to get $DA71. However, upon further analysis, it appears neither of these addresses point to anything useful.<br /><br />Try:<br />Carbos x69 (hex:45)<br />X Accuracy x218 (hex:DA)<br />Lemonade x1 (hex:01)<br />PokÃ© Ball x119 (hex:77)<br />TM01 x[Any qty]


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;Visit long-dead Smash Bros. forum I was a part of<br />&gt;All the old threads are still there<br />&gt;RPs<br />&gt;Fanfics<br />&gt;Fan clubs<br />&gt;Everything<br /><br />I still miss it.<br /><br />[quote author=ISSOtm link=topic=8204.msg208761#msg208761 date=1520069166]<br />&quot;I&#039;m just collecting samples after this night&#039;s experiment!&quot;<br />[/quote]<br /><br />Turned out her water bowl was empty. I found it kind of suspicious she was hanging around the bathroom door when I got out.


subject: boulder badge and cascadebadge to modify items
poster_name: Adam_12
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was wondering if it were possible to throw rocks and/or bait using the glitch items in the title to modify a PokÃ©mon&#039;s catches e and therefore the item it holds when traded to Generation 2.


subject: Re: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Thanks for that code, that&#039;s very helpful!<br /><br />The good thing with mail codes is that just like item codes, they are international and can be used in every localization. Box charset in German G/S/C and French Crystal doesn&#039;t allow coding, unfortunately; so we have to translate everything into another type of code everytime for international members, and this takes a lot of time&nbsp; :(


subject: Re: boulder badge and cascadebadge to modify items
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=Adam_12 link=topic=8262.msg208773#msg208773 date=1520236041]<br />I was wondering if it were possible to throw rocks and/or bait using the glitch items in the title to modify a PokÃ©mon&#039;s catches e and therefore the item it holds when traded to Generation 2.<br />[/quote]<br /><br />Unfortunately no, sadly.<br /><br />While these glitch items do modify the catch rate constant within battle and allow for a greater or worse catch success rate, the changes aren&#039;t saved after you catch them so a PokÃ©mon like Rattata/Pidgey would still have the 255 catch rate in its data structure.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I tried out a doujin of the Touhou series (itself a doujin series) yesterday called Touhou Kobuto V: Burst Battle (the Nintendo Switch version) as suddenly thought why not explore this series as I hadn&#039;t played a Touhou game before.<br /><br />Some people regard it as a bad Touhou game, but I enjoyed the game regardless (although I agree the battle system seems a little repetitive at times), and the &quot;yukkuri shiteitte ne&quot; meme reference was fun.<br /><br />It inspired me to want to try out Touhou Mountain of Faith from the main series next. (Chose to get that one as it works with no issues on Windows 10)<br /><br />I know some people on these forums like Touhou too, what are your favourites?


subject: Re: The Thing on Route Eight
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If that is purely your own than I would say you made a believable story there Bert! Good going! Those glitches used to scare the hell out of me as well when they funked up and locked down my game. I can relate.


subject: Re: The Thing on Route Eight
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Epsilon
icon: xx
body:
  [list][quote author=Pokedude link=topic=6566.msg208780#msg208780 date=1520350160]<br />If that is purely your own than I would say you made a believable story there Bert! Good going! Those glitches used to scare the hell out of me as well when they funked up and locked down my game. I can relate.<br />[/quote]<br /><br />Just wanted to bring to your attention that posting in topics that are older than 4 months old are prohibited by forum rules, unless the topic is stickied/ the content provided by the bump contributes to the content of the topic.<br /><br />Refer [url=https://forums.glitchcity.info/index.php?topic=88.msg882#msg882]here[/url]:<br />[quote author=Abwayax link=topic=88.msg882#msg882 date=1143397159]<br />Do not post in topics that are over 4 months old, unless there is significant reason to do so<br /><br />Stickies, by their nature, cannot be &quot;bumped&quot; and thus are exempt from this rule.<br /><br />In general &quot;significant reason&quot; means new content relevant to the topic, or recent news concerning said topic.[/li][/list]<br />[/quote]<br /><br />(Note that this topic was posted to the Writing board in 2012)<br /><br />Just wanted to point this out as moderators and admins tend to frown upon this.


subject: Re: The Thing on Route Eight
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  With this post I don&#039;t mind much as he is thanking Bert, but to Pokedude I suggest maybe rather than revive an old thread without adding much to the discussion to private message Bert next time, as otherwise older threads will stay on top. Thanks.


subject: Re: Free CreepyPasta
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  THIS IS THE STORY OF A DAY WHERE THERE WAS ALL THIS BLOOD. A MAN WAS WALKING AROUND AND BLOOD STARTED COMING OUT OF HIM EVERYWHERE. THERE WAS SO MUCH BLOOD THAT IT FILLED UP AN ELEVATOR. HE WENT TO THE STORE AND THERE WAS JUST BLOOD ALL OVER THE PLACE! PEOPLE WERE SLIPPING IN IT AND THEY WERE ALL GROSSED OUT. HE TRIED TO GO SWIMMING AND ALL OF THE SHARKS WENT NUTS AND BITTENED EVERYBODY. HE GOT CHASED BY ALL THE VAMPIRES EVER. ONE TIME THE BLOOD GOT A KID AND A DOG. AT THE END OF THE DAY EVERYONE DECIDED THEY WOULD SEND HIM TO SPACE SO THAT HE WOULD STOP GETTING BLOOD EVERY WHERE. THE SCARIEST PART IS THAT THE MAN WAS YOU!!! (OR HE WAS A LADY IF YOU ARE A LADY) AND YOU FORGOT THAT THIS HAPPENED.


subject: Teaching pokemon moves with WS M problem
poster_name: TheAngryrRampardos
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So after a painful journey of getting the bootstrap code &amp; the items i finally got WS M but with that said i need help with translating the gameshark codes to the in game numbering in pkmn yellow.


subject: Re: Teaching pokemon moves with WS M problem
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello,<br /><br />We&#039;re here to help; but please guys, do some researching effort sometimes. You can read [url=https://forums.glitchcity.info/index.php?topic=7906.msg204874#msg204874]this[/url] to learn how to use a gameshark code or RAM Map with arbitrary code execution. The only difference is that RAM addresses in Yellow are shifted by one (encounter address is $CFDD in R/B, $CFDC in Y; as a result, the gameshark code will be 01XXDDCF in R/B and 01XXDCCF in Y)


subject: Re: Teaching pokemon moves with WS M problem
poster_name: TheAngryrRampardos
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8263.msg208786#msg208786 date=1520405936]<br />Hello,<br /><br />We&#039;re here to help; but please guys, do some researching effort sometimes. You can read [url=https://forums.glitchcity.info/index.php?topic=7906.msg204874#msg204874]this[/url] to learn how to use a gameshark code or RAM Map with arbitrary code execution. The only difference is that RAM addresses in Yellow are shifted by one (encounter address is $CFDD in R/B, $CFDC in Y; as a result, the gameshark code will be 01XXDDCF in R/B and 01XXDCCF in Y)<br />[/quote]<br /><br />I feel stupid i apologise. :(


subject: [Request] 8f - Make a box of pokemon shiny with max stat EXP?
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I saw a code on the 8F page that said it could max out the DVs and stat experience for a whole box. It said it only worked for European versions of the games, but It got me wondering it there could be a way to alter a similar code to do the same thing, but instead of making the ivs all 15, making them maybe all 10, or 15/10/10/10? I&#039;d like to be able to make my pokemon shiny and have their stats maxed out so I could use the shiny pallets and still have them be strong (in gen 2/stadium of course). Would that kind of code be possible? And would anyone be able to make it? also is there a way to make the max DV&#039;s and stat exp code work in the US versions of the game (if it doesn&#039;t already), as if the code I want isn&#039;t possible then I could use the original code and then just change the ivs after the fact. Ideally i&#039;d like to be able to do it all at once as changing it all one address at a time would be tedious when doing multiple pokemon.


subject: PokÃ©mon Red and Blue Memory Viewer Revisited
poster_name: FarruZero
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  Based on this topic: [url=https://forums.glitchcity.info/index.php?topic=7773.15]https://forums.glitchcity.info/index.php?topic=7773.15[/url], I have been working on an improvement for this ACE hack: I have made it so it starts from the last address visited and have redesigned it to look better, as can be seen in this picture:<br /><br />[img]https://i.imgur.com/H2T78qZ.png[/img]<br /><br />Despite my Z80 skills, I have tried reverse engineering the original ASM code by Princess Torchic â¤ so that anyone interested can learn it. I have attached my ASM file, as well as the binary code / the XY positions for the English and Spanish versions. The Spanish version starts at address $DA85 and the reason is that, for some strange reason, most RAM addresses are shifted 5 bytes in this version.<br /><br />I have also included the SAV files for both versions to be tested on emulator. I have also tried it on real console.<br /><br />As a matter of fact, you can skip the tedious ACE process by taking the SAV file and putting it directly to your catridge using some back-up method detailed in the following link: [url=https://www.reddit.com/r/Gameboy/comments/4w8xjf/guide_how_to_backup_your_game_save_files/]https://www.reddit.com/r/Gameboy/comments/4w8xjf/guide_how_to_backup_your_game_save_files/[/url].<br /><br />This procedure can be applied to the other game localizations provided you know the corresponding addresses and the Joypad Low Sensitivity address and thus modifying the ASM file. It assembles with tniASM, which is a free assembler/disassembler.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I found this code on a post about how to get a legit mew in pokemon yellow. I didn&#039;t make it, but I tough i&#039;d share as its pretty useful.<br /><br />ws# #m# / any item<br />ws# #m# / any item<br />Repel x[SpeciesIndex] {e.g. x21 = Mew}<br />X Speed x64<br />Awakening x[Level] {e.g. x5 = Lv5}<br />TM05 x89 <br />Lemonade x201<br /><br />(I don&#039;t know if this is the case, but since the code on this post has tm05 being 72, maybe changing it to that will make it work with 8F? Don&#039;t know about the X Speed though.)<br /><br />This code is a variation of the alternate catch-em-all code, which lets you chose the level it is gifted to you at. I don&#039;t know what you would need to change to make it work in red bule with 8F, but it does work in yellow!<br /><br />Credit goes to chickenstickers on redit. The original post can be found here: https://www.reddit.com/r/pokemon/comments/5q8zlg/getting_gen_1_mew_in_yellow_guide_does_not_work/dd7bqfp/<br />


subject: Re: PokÃ©mon Red and Blue Memory Viewer Revisited
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Thanks FarruZero! :)<br /><br />Note I didn&#039;t make the original and that credit goes to offgao (original Japanese version) and the port by cryo (English Red/Blue version) or TheZZAZZGlitch (updated version). The only thing I did was port offgao&#039;s version to Yellow and non-English localisations. Thanks for the mention though.


subject: Re: Pokemon XD: Gale of Darkness - Walk Through Walls via Platform Distortion?
poster_name: RETIRE
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t know much about gen 3, but after reading this I just had a single theory put into mind. Idk how plausible it is never having played XD, but here goes.<br /><br />You mentioned the camera increase when wailord is put on screen. I wonder if near the area where the battle takes place, there would be a loading zone. If you stood within a certain potential framespecific spot and unloaded the platforms, but the wailord battle somehow loads them / loads more data, it might cause either a sprite/npc overflow or something else causing it to load in this glitched manor?


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  This took way longer than intended (along with a few pauses), but here is my first version of console-doable Abritrary Code Execution on Emerald, Fire Red and Leaf Green with the use of Pomeg Glitch (and variants).<br /><br />Other posts about ACE should come next as I have two &quot;easy&quot; procedures to execute ACE, and one &quot;general&quot; way.<br />This post will only cover the &quot;easy&quot; ACE procedure that allows you to execute many useful codes in Emerald.<br />A large part of the procedure is common between all methods, but the way to store code differs.<br /><br />I also don&#039;t have many codes prepared yet, as I needed to recompute many things due to changes in the procedures.<br />As of now, the only codes you can concretely execute are for non-Jpn Emerald versions, as well as some codes for FrLg non-Jpn.<br />I will rewrite and fatten up the list of ACE codes in the coming days (for Jpn Emerald and FrLg).<br /><br />[u]EDIT :[/u] Some issue on Emerald Jpn pointed its nose, so I&#039;m back at work for this case. (for Pyramid Bag Items Code Execution).<br />But the Emerald non-Jpn ACE works like a charm, aside from some unwanted PC PokÃ©mon corruptions that are in the verge of being figured out.<br /><br /><br />========================<br /><br />How to perform ACE in E/Fr/Lg, super short summary :<br />[quote]<br />0) Start everything on Emerald.<br />1) Obtain a Glitch Move with an Animation Pointer that points towards PC PokÃ©mon Data.<br />2) Manipulate the data of a PC PokÃ©mon to make the bootstrap of the code. (Bootstrap PokÃ©mon)<br />This Bootstrap PokÃ©mon will either redirect the code to PC Items, Pyramid Bag Items (Emerald only), or PC PokÃ©mon Data (RS mainly).<br />Pomeg Glitch is used to manipulate the data of the PokÃ©mon.<br />3) Generate many Glitch Items with Pomeg Glitch.<br />4) Use a sub-glitch to deposit these Glitch Items in Pyramid Bag in order to write the rest of the code in Pyramid Bag Items. (Pyramid Bag Items)<br />or<br />4) Deposit these Glitch Items in the PC and use a sub-glitch to make their quantities overflow and manipulate them in order to write the rest of the code in PC Items. (PC Items)<br />or<br />4) Train/Glitch a PokÃ©mon to store the rest of the code in PC PokÃ©mon Data. (PC PokÃ©mon Data).<br />5) Train and clone some PokÃ©mon.<br />Transfer everything you need on the version you want (FrLg or another Emerald).<br />Turn the Animations On.<br />6) Use a method that allows you to check if the current DMA pattern is the required one for the ACE you want.<br />7) Use the ACE Glitch Move.<br />8 ) Profit. [/quote]<br /><br />===========================<br /><br />How to perform ACE in Emerald, Pyramid Bag Items / PC Items Code Execution, more detailed version :<br />0) <br />Obtain :<br />- You can see this paste to have a list of all the required stuff that appears during all the procedure : https://pastebin.com/0NMAtJ9j (Preparing Gen III games for ACE)<br />It is a bit outdated and I haven&#039;t corrected it, but it contains everything you will need for the current procedure with more details and more explanations than this post gives.<br />- The in-game traded Horsea,Seedot,Plusle,Skitty,&nbsp; all with 0 EVs. (use EV-reducing Berries for that)<br />- EV-reducing Berries<br />- Some cash<br />- Balls<br />- A party to perform Pomeg Glitch.<br />- A Cloning Glitch PokÃ©mon, and how to use it : https://www.youtube.com/watch?v=I8Mio5cA9fs<br />- A PokÃ©mon for Instant Pomeg Glitch<br />- Corruption Initiators : https://www.youtube.com/watch?v=hBWkshUJv_8<br />- See how to perform a General double corruption : https://www.youtube.com/watch?v=PIAzyNTGibw<br />- Smeargles with Corruption Types of 7 and 4 : https://www.youtube.com/watch?v=-LgQJEHBHdA<br />- Know your TID Corruption : https://www.youtube.com/watch?v=9zNhX8tAQZg<br />- Know how to perform Decaswitch : https://www.youtube.com/watch?v=QB67-pKKY3Q <br />To setup Pomeg Glitches faster.<br />- Know how to perform Instant Pomeg Glitch : https://www.youtube.com/watch?v=PwYP6D1iTio<br />To setup Pomeg Glitch even faster. (can&#039;t be used for every corruption, but I always indicate it)<br />- Turn off the battle animations.<br />- Pen and paper to note what you did (glitch moves/glitch items obtained)<br />- Don&#039;t forget to nickname your clones of Smeargle and mark them during EV-training in order to never confuse two of them.<br />- Boxes 1 and 2 empty, as well as 2-3 other boxes.<br /><br />1) <br />EV-train a Smeargle with a Corruption Type of 4, nickname it &quot;ACE Move&quot;, and double-corrupt it to obtain a PokÃ©mon with an ACE Glitch Move.<br />EVs required : Emer (non Jpn) : 0x1608 (22 Atk, 08 HP) | Emer Jpn : 0x3110 (49 Atk, 16 HP)&nbsp; | FrLg (non Jpn) : 0x0713 (07 Atk, 19 HP) | FrLg Jpn : 0x0713 (07 Atk, 19 HP).<br /><br />Deposit the PokÃ©mon with the ACE Glitch Move in safety in PC (in a box different than Boxes 1 and 2)<br /><br />2)<br />Obtain a Bootstrap PokÃ©mon : https://pastebin.com/2aEzxFU4 (Obtain a Bootstrap PokÃ©mon for ACE)<br />Here, the Bootstrap PokÃ©mon for Pyramid Bag Code Execution on Emerald is required.<br />You can also make a Bootstrap PokÃ©mon for PC Items Code Execution on Emerald/FrLg if you are interested into other codes.<br /><br />3)<br />Choose codes that you want to execute from this list : https://pastebin.com/42RPYDQA (List of ACE codes to execute)<br />Pick them from 1.1) PC Items Code Execution and 1.2) Pyramid Bag Code Execution. (for now)<br />Note the identifiant of the Glitch Items that you will need to have in order to execute each code.<br /><br />The most useful Code Executions are thought to require as less Items as possible, so you shouldn&#039;t need that much Glitch Items even if you want to execute 4-5 different codes.<br />Many codes also require the exact same items in the Lv 50 Pyramid Bag, so if you execute these codes back to back, the Items placed in the Lv 50 Pyramid Bag will directly be ready.<br /><br />Obtain these Glitch Items with this procedure : https://pastebin.com/qQ91bzuM (Obtain Glitch Items)<br />If you need Item 0xFFFF, see : https://www.youtube.com/watch?v=XZFF7-VZmy8 (Obtain Item 0xFFFF)<br /><br />4)<br />Follow this procedure to store Items in Pyramid Bags : https://pastebin.com/tQSDqkdU (Setting Pyramid Bag Items in Emerald)<br /><br />or<br />4)<br />Follow this procedure to store and duplicate PC Items in Emerald : https://pastebin.com/Ke3wUsZX (Setting PC Items in Emerald)<br />Procedure to set up PC Items in FrLg : https://pastebin.com/yHBhvbLh (Setting PC Items in FrLg)<br /><br />5)<br />If you&#039;re doing things on FrLg, transfer the Bootstrap PokÃ©mon and the PokÃ©mon with the ACE Glitch Move to your version with : https://pastebin.com/237FpUTf. (Transfer Glitch PokÃ©mon/Moves to RSEFrLg).<br /><br />6) and 7)<br />See this paste : https://pastebin.com/U5ajVMp8 (Trigger ACE in Emerald/FrLg)<br />in order to know the PokÃ©mon you will need to perform a DMA Translation Check<br />Edit : New method for Emerald Non Jpn : https://forums.glitchcity.info/index.php?topic=6868.msg209366#msg209366<br /><br />8 ) Profit.<br /><br /><br />===================<br /><br />--Grouped list of pastebin/videos :<br />-Techniques :<br />Perform Pomeg Glitch : https://www.youtube.com/watch?v=ZTNJQPVOKdU<br />Perform Pomeg Glitch Data Corruption/Glitzer Popping : https://www.youtube.com/watch?v=uGMmIPtzd14<br />Obtain any PokÃ©mon/Item/Move : https://pastebin.com/2kJpBQCr<br />Perform Decaswitch : https://www.youtube.com/watch?v=QB67-pKKY3Q<br />Clone with a Cloning Glitch PokÃ©mon : https://www.youtube.com/watch?v=I8Mio5cA9fs<br />Perform Reverse Cloning : https://www.youtube.com/watch?v=GDSJY0ScjzU<br />Obtaining Corruption Initiators on Emerald : https://www.youtube.com/watch?v=hBWkshUJv_8<br />Corruption Types, How to obtain them : https://www.youtube.com/watch?v=-LgQJEHBHdA<br />Testing TID Corruption : https://www.youtube.com/watch?v=9zNhX8tAQZg<br />Specific Criteria for Double Corruption : https://www.youtube.com/watch?v=65e-SKeE5Ec<br />General Procedure for Double Corruption : https://www.youtube.com/watch?v=PIAzyNTGibw<br />Perform Instant Pomeg Glitch : https://www.youtube.com/watch?v=PwYP6D1iTio | https://pastebin.com/wsYtbzpG<br />Transfer Pomeg Glitch to FrLg : https://pastebin.com/UUXRJ1bA<br />Trade Glitch PokÃ©mon/Glitch Moves to RSEFrLg : https://pastebin.com/237FpUTf<br />Make a PokÃ©block with 8 Beauty only : https://www.youtube.com/watch?v=20wL2X4ixZ0<br />Why PokÃ©balls are important : https://www.youtube.com/watch?v=LskqsVgIr4g<br /><br /><br />-ACE :<br />Explanative summary of Gen III ACE : https://pastebin.com/B3siVSU4 (incomplete)<br />Various technical information for ACE : https://pastebin.com/0pU2SUXG<br />Preparing your games for ACE : https://pastebin.com/0NMAtJ9j<br />Obtain a Bootstrap PokÃ©mon : https://pastebin.com/2aEzxFU4<br />Obtain a PokÃ©mon storing a &quot;copy-paste and overwrite&quot; Code : -- (not done yet)<br />List of Codes to execute : https://pastebin.com/42RPYDQA (incomplete)<br />Obtain Glitch Items : https://pastebin.com/qQ91bzuM<br />Setting Pyramind Bag Items in Emerald : https://pastebin.com/tQSDqkdU<br />Setting PC Items in Emerald : https://pastebin.com/Ke3wUsZX<br />Setting PC Items in FrLg : https://pastebin.com/yHBhvbLh<br />Trigger ACE : https://pastebin.com/U5ajVMp8<br />Trigger ACE in Emerald Non Jpn : https://forums.glitchcity.info/index.php?topic=6868.msg209366#msg209366<br /><br />Pyramid Bag Items Code Execution on Emerald : -- (not done yet)<br />PC Items Code Execution on Emerald/FrLg : -- (not done yet)<br />PC PokÃ©mon Code Execution on Emerald/FrLg : -- (not done yet)<br /><br /><br /><br />


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Awesome job, Metarkrai!<br /><br />Would personally love to see a code to activate the sound test (if you ever get it to work on Ruby/Sapphire or Japanese Emerald where the sound test wasn&#039;t removed in English versions according to PokÃ©mon Emerald&#039;s page on TCRF).


subject: Re: NIWA - should we consider joining them?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  A discussion about this on the NIWA Forums was revived recently. The proposal is for at least affiliation and I&#039;m unsure yet whether Raltseye meant full membership.<br /><br />I have links to NIWA as I work for the now independent Starfy Wiki, so can discuss this directly with them and keep us updated.<br /><br />http://www.niwanetwork.org/forums/index.php?topic=1476.0<br /><br />What are our thoughts?


subject: Re: NIWA - should we consider joining them?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Regarding the post you wrote, I would also have added that Bulba&#039;s pages are unmaintained and tend to say quite some bullshit. (Since it had been argued that we were redundant with them)<br /><br />Regarding the affiliation itself, I think it&#039;s a good idea. Not really much to say besides the obvious &quot;The larger the network, the better.&quot;


subject: Re: NIWA - should we consider joining them?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=ISSOtm link=topic=6296.msg208798#msg208798 date=1520641953]<br />Regarding the post you wrote, I would also have added that Bulba&#039;s pages are unmaintained and tend to say quite some bullshit. (Since it had been argued that we were redundant with them)<br /><br />Regarding the affiliation itself, I think it&#039;s a good idea. Not really much to say besides the obvious &quot;The larger the network, the better.&quot;<br />[/quote]<br /><br />I don&#039;t agree, but see where you&#039;re coming from. I feel Bulbapedia organizes its pages well and are generally accurate. There have been inaccurate glitch claims yes (for example I think their Trainer House glitch article needs work I tried the time change method but it didn&#039;t work) and in relation to their glitch PokÃ©mon articles not all of the glitch PokÃ©mon effects happen all the time, but from a general perspective Bulbapedia is quite accurate.


subject: Re: NIWA - should we consider joining them?
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  My head canon:<br /><br />Bulbapedia is stealing our info from an old cloned version of the site from back before we did the mass update of the Wiki.<br /><br />i have nothing relevant to add, they&#039;re just a shittier fork of our site with a new skin and general info along with their outdated glitch info.


subject: Re: NIWA - should we consider joining them?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=6296.msg208801#msg208801 date=1520700825]<br />My head canon:<br /><br />Bulbapedia is stealing our info from an old cloned version of the site from back before we did the mass update of the Wiki.<br /><br />i have nothing relevant to add, they&#039;re just a shittier fork of our site with a new skin and general info along with their outdated glitch info.<br />[/quote]<br /><br />That just sounds unreasonable to reject them though. Regardless if they have taken information from the GlitchDex I don&#039;t think it&#039;s wrong. They still source us, not all of their information is from the site and they have a lot of information we haven&#039;t covered (but is often taken for granted as &#039;known&#039;) such as on their list of glitches pages.


subject: Re: NIWA - should we consider joining them?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The discussion about Bulba&#039;s relevancy is out of this topic, though ; it might be worth arguing over that if NIWA admins think we are redundant over Bulba, but it&#039;s not here that it should be discussed.


subject: Re: NIWA - should we consider joining them?
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  There&#039;s less of a focus on Bulbapedia for glitches. The site is less structured for such so it seems less comprehensive.<br /><br />I suggest that if we link to NIWA, then that would add more activity surrounding and people learning about glitchology.


subject: Re: NIWA - should we consider joining them?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=Sasara link=topic=6296.msg208805#msg208805 date=1520719159]<br />There&#039;s less of a focus on Bulbapedia for glitches. The site is less structured for such so it seems less comprehensive.<br /><br />I suggest that if we link to NIWA, then that would add more activity surrounding and people learning about glitchology.<br />[/quote]<br /><br />True. Coverage of the games, anime, manga is more popular/more of Bulbapedia&#039;s priority than glitches which only makes sense (these are the &#039;core&#039; elements of the franchise). At the same time they don&#039;t rule them out and (while not as big in number) there are a few interested in covering glitches there like SnorlaxMonster (former head of Bulbapedia Project GlitchDex).<br /><br />My thoughts too, I think the whole of NIWA has a great number of glitch experts/enthusiasts too and affiliation/membership could encourage a greater interest in the subject.


subject: Re: NIWA - should we consider joining them?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m fine with us joining the NIWA but please be aware of why it was founded in the first place: [url=https://bulbanews.bulbagarden.net/wiki/New_Nintendo_wiki_network_launches]it was a way for Bulbapedia to take a stab at Wikia who wanted to buy it[/url]. Not to mention the sort of war that existed between Bulbapedia and the PokÃ©mon Wiki on Wikia a decade ago due to plagiarism and similar issues.<br /><br />[quote author=Parzival link=topic=6296.msg208801#msg208801 date=1520700825]<br />My head canon:<br /><br />Bulbapedia is stealing our info from an old cloned version of the site from back before we did the mass update of the Wiki.<br /><br />i have nothing relevant to add, they&#039;re just a shittier fork of our site with a new skin and general info along with their outdated glitch info.<br />[/quote]<br /><br />They aren&#039;t doing that but their focus is neither bugs or unused content as both types of information there are a huge mess and one which nobody seems to be interested in. It is currently disservicing their readers so it would actually be an improvement if they removed it altogether and pointed to us as a source for bugs while linking to TCRF as a source for unused content and general datamining. Note that I&#039;m not saying that they shouldn&#039;t have info on bugs or unused content at all but that it would be better handled if they limited it to contextual references on the relevant articles (e.g.: mentioning that the Kanto Safari Zone was planned then scrapped for Gold and Silver on the location&#039;s article itself, which they already do, and pointing to here and/or TCRF if people want to find out more about it).


subject: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: BUGLITCH
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: BUGLITCH
icon: xx
body:
  Hello guys, I found a way to get glitch PokÃ©mon in D/P without using any emulator-only glitches like &quot;glitch scripts&quot; or similar things. (however I couldn&#039;t test on real hardware for now)<br /><br />It&#039;s using a glitch I will call the Battle Corruption Glitch from now on.<br /><br />This glitch will corrupt the wild encounters as well as the Great Marsh encounters. I called it Battle Corruption Glitch because it&#039;s actually affecting every battles, you will get why later.<br /><br />I think the best way to explain it is to go through the process of its discovery.<br /><br />[u][b]Pomeg Glitch[/b][/u]<br /><br />You may know that you can&#039;t directly get a Fainted Pokemon with the Pomeg in D/P/Pl, however it&#039;s easy to get one by using Pomeg in order to get a negative amount of HP, so that you can use a Rare Candy to raise its HP to 0.<br /><br />[img]http://www.prama-initiative.com/DPP/BCG/pomeg.png[/img]<br /><br />You may also know that, if you have less than six PokÃ©mon in your team, and if all your PokÃ©mon are Fainted, the game will pick the Pokemon just after your last one (the 5th if you have 4, the 6th Pokemon if you have 5 etc) which will result in you sending in battle the well known &quot;DPBox&quot;.<br /><br />If you have 6 Pokemon, the game will crash, because it wants to access the 7th Pokemon of your team, which is out of bound. (However I&#039;m not quite sure about this anymore because double battles work if you have 5 fainted PokÃ©mon on you, so the problem might be elsewhere)<br /><br />I wanted to avoid this crash to see what was really happening, the way I did it is by having 6 invalid PokÃ©mon in my team (KO, Eggs), but I cheated to have some invalid Pokemon that could fight (the empty PokÃ©mon). Basically, I had 3 Fainted PokÃ©mon in my team, and I edited my team size to 6.<br /><br />This was the result of it :<br /><br />[img]http://www.prama-initiative.com/DPP/BCG/empty.png[/img]<br /><br />As you can see, the wild Pokemon is glitched, this is what I called the Battle Corruption Glitch.<br /><br />[u][b]Battle Corruption Glitch[/b][/u]<br /><br />So this is what the BCG is: having a team of 6 invalid PokÃ©mons will result in a wild encounter against glitched PokÃ©mon, however it was impossible to know because of the crash.<br /><br />[u][b]How to not crash[/b][/u]<br /><br />So from there, it&#039;s easy to conclude than the crash was the result of our PokÃ©mon, not of the wild corrupted one.<br /><br />So all I had to do is to find a place where our PokÃ©mon wasn&#039;t appearing, I picked the Great Marsh.<br /><br />[img]http://www.prama-initiative.com/DPP/BCG/BCG.png[/img]<br /><br />So here it is guys, all you have to do is to get 6 invalids Pokemon in your team by using the Pomeg, before heading to the Great Marsh.<br /><br />Most of the time, it will crash, all Pokemons called &quot;Bad eggs&quot; are a no go, I couldn&#039;t catch any of them. But I could catch some of the non-bad eggs one :<br /><br />[img]http://www.prama-initiative.com/DPP/BCG/box.png[/img]<br /><br />[img]http://www.prama-initiative.com/DPP/BCG/e.png[/img]<br /><br />


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow! This is groundbreaking :).<br /><br />Amazing find BUGLITCH.<br /><br />If you bring up the PokÃ©dex entry of one of these glitch PokÃ©mon could that lead to reliable arbitrary code execution?


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: BUGLITCH
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks!<br />Hmm, I&#039;m not sure what you meant but sadly I don&#039;t think the entry is accessible. 


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I think we&#039;ll need to find a way to circumvent the crashes on hardware, but it has potential to work with the correct setups, I hope


subject: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Lost-Paisley
icon: question
body:
  So I started playing Crystal VC and learned that the cloning glitch has more precision than in Gold/Silver.<br /><br />I did it so I could have all 3 starters and managed to do it perfectly on the first go with Totodile (nicknamed &quot;Dile&quot;). However, my second attempt with Cyndaquil didn&#039;t go so well.<br />While Cyndaquil itself turned out ok, it ended up getting Totodile&#039;s nickname but was otherwise intact with no other issues. Totodile didn&#039;t get the same treatment:<br /><br />https://i.imgur.com/2xyn5AR.jpg<br />https://i.imgur.com/nKAkWCE.jpg<br />https://i.imgur.com/QYj42iN.jpg<br /><br />Totodile&#039;s nickname is glitched with my player&#039;s name at the end (Yuuki), but it&#039;s very short and doesn&#039;t lock up the game or anything if I use it in battle (the name appears as &quot;?&quot; in the party). The OT is &quot;?&quot;, but other than that it&#039;s still a Totodile according to the game and has no other issues I&#039;m aware of.<br /><br /><br /><br />What I wanna know is, [u]is this Totodile safe to keep[/u]? [u]Could I potentially breed it and get a regular Totodile and get rid of it if I can&#039;t fix the garbled name[/u]?<br /><br />I&#039;m asking this because most people say that blank named clones or clones with strange names shouldn&#039;t be kept, but I really don&#039;t wanna keep cloning starters if I could just breed this Totodile for a regular one in the end or it simply has a glitched nickname (and I don&#039;t wanna give up my awesome ID number either). Is there an exception to some clones that have slight issues?<br /><br />[b]EDIT[/b]: Scratch that, leveling up this Totodile actually crashed the 3DS (had to hold down the Power button; Cyndaquil levels up fine though).&nbsp; :-\ Might I be able to breed it instead?


subject: Hunting a &quot;Gift Pokemon&quot; Script in PokÃ©mon Crystal
poster_name: Arkazra
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  After tinkering with PokÃ©mon Yellow ACE, I was able to build a PokÃ©mon Dispenser, that used the gift pokÃ©mon script at $3E59 to give me whichever PokÃ©mon I was after at whatever level I was after. ([url=https://pastebin.com/i3tW2705]https://pastebin.com/i3tW2705[/url] for anyone interested)<br /><br />Now I&#039;ve moved on to PokÃ©mon Crystal, and I&#039;ve been analyzing the ROM/RAM contents in and around the Eevee and Dratini gifts, looking for a similar gift script. I&#039;ve tracked down where in memory the species and level of the gifts are loaded from, but I&#039;m struggling to find where the code actually gives you the PokÃ©mon.<br /><br />At the end of the conversations that give you the gift, (Eevee and Dratini at least, the Shuckle seem&#039;s to do things differently), the code somehow manoeuvers its way to $7932 (in Bank 25)<br />$7932 contains &quot;call 26D4&quot;. $26D4 has a series of instructions I haven&#039;t entirely deduced the purpose of, apart from a few, which notably include:<br />[list]<br />[li]$26D9 loads register a with the value at $D439, which is the ROM bank containing the gift pokemon infomation (Bank 15 for Eevee, Bank 63 for Dratini)[/li]<br />[li]$26DD loads register hl with the value at $D43A, which is the address containing the species of the gift pokemon (15:4C06 for Eevee, 63:51D7 for Dratini)[/li]<br />[li]$26E3 loads that species value into register a[/li]<br />[/list]<br />After returning from the call 26D4, the code continues at $7935, by putting species value currently stored in register a into RAM at $D108.<br />This is followed by another call 26D4, but this time the value returned in register a is the gift PokÃ©mon&#039;s level, which is put into RAM at $D143.<br />A third call 26D4 retrieves the held item of the gift pokemon, putting it into RAM at $D106.<br /><br />After all this, the pc is at 7944, the PokÃ©mon&#039;s species, level and held item are all in RAM at D108, D143 and D106 respectively, but I lose track of things from there, and can&#039;t follow the thread to actually getting the PokÃ©mon. I&#039;ve almost given up hope of finding a simple script as there was in gen 1, but does anyone have any ideas about how to progress forward? (Or in this case, backward?) It&#039;s easy enough work forward through the code (I&#039;m using the debugger on BGB to step through it line by line), but I&#039;m struggling to find how the code reaches $7932 in the first place.<br /><br />My next step is probably going to be manually setting D108, D143 and D106 and jumping to $7944, just to see what happens, but I thought I&#039;d bring it up here and see if anyone else has been tinkering in this area of the code :)


subject: Open role play
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Inspired by [url=https://forums.glitchcity.info/index.php?topic=144.0]the Avatar Wars game[/url], this is a place where you can role play in any way, as any character, etc.<br /><br />You don&#039;t need to sign up new characters.<br /><br />[i]*licks neapolitan ice cream*[/i]


subject: Re: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Hello!<br /><br />In G/S, Bad Clone&#039;s unterminated name is displayed as &quot;empty&quot;, resulting in the game not reading it, and therefore it doesn&#039;t cause any harm. In Crystal versions however, Bad Clone&#039;s unterminated name, when displayed (as a bunch of &quot;?&quot; because of some obscure subprogram), keep being read until eventually finding the end of the name (known as a &quot;terminator&quot; - an ingame character which is supposed to end a name but in this case is absent).<br /><br />This eventually corrupts pretty much everything in the way to the next terminator and can result in freezes or PokÃ©mon box or party corruptions. It is the basis for many glitches, because if you save/reset just before opening the PC box containing the Bad Clone, you can manage to corrupt the sprites of the other PokÃ©mon in this box into Kingdra (because the buffer for PokÃ©mon sprite gets corrupted by the Bad Clone&#039;s name) and this allows you to transform these PokÃ©mon into another PokÃ©mon (based on its moves for example) - it&#039;s called the Bad Clone Trick.<br /><br />Another clever use of the Bad Clone is to view a Max Elixer in the Bag (WITHOUT SELECTING IT) before opening a PC Box containing a Bad Clone, which results (if correctly done) in arbitrary code execution.<br /><br />The more things you do before opening a box or party with a Bad Clone inside, the more chances you have it will cross a terminator instantly and won&#039;t corrupt anything. The safest way to keep you Bad Clone quiet is to save/reset in front of a PC, view a Ice Berry in your bag and then open the PC Box containing the Bad Clone. This process will insert a terminator right after the unterminated name.<br /><br />If you intend to use the Bad Clone for glitching purpose, maybe in the future, keep that clone around in an unused box until you&#039;re ready. If you don&#039;t wan&#039;t to, I advise you to release it asap.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=8204.msg208330#msg208330 date=1516413878]<br />Just got 4 foils in an Ixalan set draft. Currently 0-1 of 5 games as of posting.<br />[/quote]<br />Yes hello I play Magic: The Gathering too :D


subject: Re: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Lost-Paisley
icon: xx
body:
  [quote author=Krys3000 link=topic=8269.msg208827#msg208827 date=1520936966]<br />Hello!<br /><br />In G/S, Bad Clone&#039;s unterminated name is displayed as &quot;empty&quot;, resulting in the game not reading it, and therefore it doesn&#039;t cause any harm. In Crystal versions however, Bad Clone&#039;s unterminated name, when displayed (as a bunch of &quot;?&quot; because of some obscure subprogram), keep being read until eventually finding the end of the name (known as a &quot;terminator&quot; - an ingame character which is supposed to end a name but in this case is absent).<br /><br />This eventually corrupts pretty much everything in the way to the next terminator and can result in freezes or PokÃ©mon box or party corruptions. It is the basis for many glitches, because if you save/reset just before opening the PC box containing the Bad Clone, you can manage to corrupt the sprites of the other PokÃ©mon in this box into Kingdra (because the buffer for PokÃ©mon sprite gets corrupted by the Bad Clone&#039;s name) and this allows you to transform these PokÃ©mon into another PokÃ©mon (based on its moves for example) - it&#039;s called the Bad Clone Trick.<br /><br />Another clever use of the Bad Clone is to view a Max Elixer in the Bag (WITHOUT SELECTING IT) before opening a PC Box containing a Bad Clone, which results (if correctly done) in arbitrary code execution.<br /><br />The more things you do before opening a box or party with a Bad Clone inside, the more chances you have it will cross a terminator instantly and won&#039;t corrupt anything. The safest way to keep you Bad Clone quiet is to save/reset in front of a PC, view a Ice Berry in your bag and then open the PC Box containing the Bad Clone. This process will insert a terminator right after the unterminated name.<br /><br />If you intend to use the Bad Clone for glitching purpose, maybe in the future, keep that clone around in an unused box until you&#039;re ready. If you don&#039;t wan&#039;t to, I advise you to release it asap.<br />[/quote]<br /><br />The Totodile&#039;s name doesn&#039;t corrupt the boxes when I open the PC, everything, including the Cyndaquil with Totodile&#039;s old nickname is unchanged. Nothing else happens even if I reset, the game crashes if it levels up though as far as I know.<br /><br />But I&#039;m guessing this Totodile is a completely bad clone then, right? It seems a little odd because it wasn&#039;t at lv. 0 nor female when I withdrew it; it has the exact same stats, moves, exp., gender and lv. when I last put it in the box. Its nickname and OT are the only things that changed.&nbsp; :-\


subject: Re: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Corruption induced by Bad Clone unterminated names are based on hard-to-predict things (somewhat similarly to Cooltrainer corruptions); mostly the content of buffers. You might not have any issues with your game, but then someday you play with your Bad Clone and your game start freezing&nbsp; ;)<br /><br />Also you appear to be confusing two Bad Clones characteristics here. Every Bad Clone has an unterminated name, but this characteristic has no utility in G/S because the game doesn&#039;t read that name :( Any glitch that relies on the unterminated name (Crystal-only glitches, then), such as the original Bad Clone Trick, Bad Clone ACE, etc. can be performed with any Bad Clone because ALL Bad Clones have unterminated names. Aside from this, we can distinguish two classes of Bad Clones:<br />- Incomplete Bad Clones, which is a normal clone but with some missing data (at least an unterminated name, but it can also be lvl0, has no ID, no moves, etc.)<br />- Full Bad Clones, which always are unstable hybrids of the PokÃ©mon used for cloning and the absence of PokÃ©mon - as a result every single data from this PokÃ©mon, including its PokÃ©dex number, is missing; and if this Bad Clone is given to the Daycare, it will stabilize into Glitch PokÃ©mon hex:00.<br />The only distinguishable marker between Incomplete and Full BCs is the PokÃ©dex number in the profile. The fact that it is lvl 0, female and stuff is not sufficient - if the PokÃ©dex number is not 0, the PokÃ©mon won&#039;t turn into a Glitch PokÃ©mon hex:00&nbsp; :)<br /><br />Having a Full Bad Clone is not important for Crystal glitches relying on unterminated name, because this is a different thing that is shared by every Bad Clone. However, if you intend to use a glitch that requires a Glitch PokÃ©mon hex:00 (such as the modern Bad Clone Trick) then you will need a Full Bad Clone.<br /><br />It is important to note that this is rarely done in Crystal because using unterminated name-based glitches are as powerful as Glitch PokÃ©mon hex:00-based glitches; but using the aforementioned corruption in Crystal, you can turn any Incomplete Bad Clone into an hybrid, which gives him the possibility to turn into a Glitch PokÃ©mon hex:00 and enjoy any glitch anyway without having to specifically generate a Full Bad Clone&nbsp; ;D. To that extent, Crystal is a good game for Bad Cloning.


subject: Best way to get glitch Pokemon in Japanese Red?
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  According to my research, the old man glitch does not work in Red/Green and the Mew glitch will only get me Pokemon with the index numbers 190-199 (provided they don&#039;t crash or freeze upon encounter), any reliable method to get the glitches with index numbers 200-255? Of course there&#039;s the fossil conversion glitch, but that may be quite tedious to do with 55 Pokemon (not to mention I&#039;ve got a few questions about that whole process). I don&#039;t have any Japanese Generation 2 games, so the Johto guard glitch is out. Also, I&#039;d like to mention that I am on cartridge. No emulators for me :/<br /><br />I&#039;d like to do research on glitch Pokemon in the Japanese games, document my findings, and possibly add them to the &quot;international&quot; portion of the GlitchDex since that section is tiny right now. Of course, what I find may not be consistent with what others may find but every little bit helps, no? :) If anyone wants me to share my research notes in the future, feel free to let me know.


subject: Re: Intresting find regarding Glitch PokÃ©mon sprites with Prof.Oak &amp; Old Man
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Cool! Thanks SatoMew! I should see if any of the unused cries would fit my&nbsp; Fakemon. I love the mystery of glitchmon.


subject: Re: Write PokÃ©dex entries for Glitch PokÃ©mon as if they were normal pokÃ©mon!
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This looks fun! Ok so this is not a Pokedex entry but more of an idea for glitchmon. So what if glitchmon were not pokemon at all but humans probably from Team Rocket who tried to infuse themselves with the energy of other pokemon but instead ended up distorting themselves. Is this a possibly good idea or a bad one? Just a thought.


subject: Re: Pokemon that should be real!
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Can somebody move this to Creative Moments, Art? I figured there would be more people interested in this there.


subject: Re: Bert's Little Shop of Horrors
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=6923.msg195091#msg195091 dat<br />e=1399675119]<br />I think the voltorbs should be at the bottom side by side, both supporting the diglett.<br />[/quote]<br />I know your trying to make a mans stuff but you don&#039;t need that. Just get a Onix. I think its stupid that people think Onix is like that. <br />[quote author=Bert link=topic=6923.msg195087#msg195087 date=1399671096]<br />[quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=6923.msg195067#msg195067 date=1399605515]<br />a diglett and two voltorbs.<br />[/quote]<br /><br />Lol okie dokie. How&#039;s this?<br />[/quote]<br />Great Bert! LOL! Nice way to show home his creation!


subject: Re: Bert's Little Shop of Horrors
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Here are some ideas for you Bert!<br />____________________________________________________________________________________Clefable+ Gengar<br />Lucario+ Zoroark<br />Onix+ Cloyster&nbsp; ( Just thought it would be funny)<br />Pichu+ Pikachu+ Raichu+ Plusle+ Minun+ Pachirisu+ Emolga+ Dedenne<br />____________________________________________________________________________________Please do these Bert!


subject: Re: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: SgvSth
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I do want to throw in that you might be able to have Totodile be sent up to Bank instead of releasing.&nbsp; Of course, this still causes the problem of getting a second Totodile without using other glitches.


subject: Re: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  About this, it should also be said that since Bad Clones can corrupt the active box (sometimes not allowing you to place new PokÃ©mon in it anymore), placing a Bad Clone in box 1 is an act of faith: if this box gets corrupted you will never be able to use the PokÃ©transfer to send your 2G PokÃ©mon to the bank, since it only accepts box 1.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Sasara
icon: xx
body:
  hmmph. what&#039;s spam?<br /><br />probably stuff that pollutes across various threads?<br /><br />this line of thought also relates to Discord


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m surprised we don&#039;t have a spam board. Then we could shitpost all we want without raising the post count.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Sasara
icon: xx
body:
  â˜…internet [color=red]a[/color] [color=orange]n[/color] [color=yellow]a[/color] [color=green]r[/color] [color=blue]c[/color] [color=indigo]h[/color] [color=violet]y[/color]â˜…


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [code]â˜…internet [color=red]a[/color] [color=orange]n[/color] [color=yellow]a[/color] [color=green]r[/color] [color=blue]c[/color] [color=indigo]h[/color] [color=violet]y[/color]â˜…[/code]<br /><br />ooh Glitch City glitchified


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  blah blah I edited in a clause allowing spamming and double-posting to the OP<br /><br />enjoy everybody


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=Sasara link=topic=8204.msg208846#msg208846 date=1520977345]<br />â˜…internet [color=red]a[/color] [color=orange]n[/color] [color=yellow]a[/color] [color=green]r[/color] [color=blue]c[/color] [color=indigo]h[/color] [color=violet]y[/color]â˜…<br />[/quote]<br /><br />I can sing a rain..... dvfgcgbyiuyhTMTRAINERvrvgurdREDREDROCKETrfe .. DARN YOU MISSINGNO.!!!!!&nbsp; &gt;:(<br /><br />https://www.youtube.com/watch?v=nRTdq0VsLGQ<br />Let&#039;s all sing together


subject: Re: Pokemon that should be real!
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Back in the year 2000, a young man named Christian Weston Chandler was given an assignment in high school: create your own CD cover. However, as he was not allowed to use copyrighted characters on it, he took a different route and mashed two of them together. The end result was Sonichu, the electric hedgehog PokÃ©mon. <br /><br />[img]https://sonichu.com/w/images/1/1d/SonichuOriginal.jpg[/img]<br /><br />This character would go on to appear in a series of groundbreaking webcomics named after him, and on some TRUE and HONEST merchandise created by Chandler, such as amiibos and medallions. He tried to convince Nintendo and Sega to create a Sonichu video game with Chris serving as the director/writer/artist, but alas, this never happened.<br /><br />Then, in 2017, a challenger appeared from the depths of Ultra Sun and Ultra Moon&#039;s PokÃ©Dex:<br /><br />[img]https://img.pokemondb.net/artwork/tmp/zeraora.jpg[/img]<br /><br />Its name is Zeraora (more like Derpaora, amirite?) and is known as the Thunderclap PokÃ©mon, but 100% of the Internet agrees it&#039;s really just a shitty ripoff of Sonichu that fully represents how bankrupt GameFreak is in terms of new PokÃ©mon ideas.<br /><br />[size=7pt]Original shitpost do not steal.[/size]


subject: Re: Open role play
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This looks nice. :) Do we have to commit to that character or can we post as little as we like or multiple characters?<br /><br />My Melody: Ah.. today is a nice day to do my gardening. The daffodiles are lovely, and the weather is bright and sunny, hehe. ^_^


subject: ASLR scripts/overlays confirmed on hardware!
poster_name: RETIRE
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: RETIRE
icon: smiley
body:
  Edit: After nearly a year I decided to revisit this subject and was able to get the Hall of Fame script working on Hardware<br />Here&#039;s the video evidence: <br />https://www.youtube.com/watch?v=d740tdPTTDM&amp;feature=youtu.be<br /><br />Also a long video showing off how to do this on hardware / explaining this a bit more in depth<br />https://youtu.be/z5taufgobuA<br /><br />I said Map 168 but it was Map ID 163.<br /><br />For anyone who has not read the HoO document, out of bounds scripts (oob scripts for short) are scripts and overlays loaded<br />via RETIRE, when there aren&#039;t at least 4 scripts in runtime in the current map id.<br />For nearly a year, it was unknown as to how to recreate it, even on an emulator, however, while testing a different glitch I accidentally stumbled<br />upon it. <br /><br />ASLR<br /><br />When you start up your console, Address Space Layout Randomization kicks into action.<br />It does what the name implies, it randomises address space for memory.<br />Because of this, it&#039;s supposed to be harder to use action replay codes, and other hacking tools.<br />From the looks of it, there are 64 different randomisations that you could get on startup. <br />As you might have guessed by now, the section of memory used by RETIRE if there are less than 4 scripts, will be randomised.<br />This means that there are 64 different results/map id you could potentially get from using RETIRE. Before we go further, let&#039;s show some examples.<br /><br />[img]https://i.imgur.com/PjZyw3T.png[/img] [img]https://i.imgur.com/5kB1331.png[/img] [img]https://i.imgur.com/48RnYqS.png[/img] <br /><br />Odd continuous surfing script: https://www.youtube.com/watch?v=9HR-yCyEuLo<br />Changing player name: https://www.youtube.com/watch?v=hp2TKubjBC0&amp;t=18s<br />Changing map width/coordinates/void: https://www.youtube.com/watch?v=2LkBXYXW_Xk,<br />Chosing new starters: https://www.youtube.com/watch?v=CzuMAdM_kPA<br /><br />These are just some examples, and I&#039;ll show more later in the thread.<br /><br />As you can see, the results can be quite spectacular. <br />As far as I&#039;ve noticed, these scripts only activate if the map id has some kind of script in it&#039;s runtime.<br />If it does not, it doesn&#039;t do anything. This might mean that RETIRE reads this as the data needed.<br />But, remember when I said that there are only 64 randomisations? <br />While this is in fact true, it doesn&#039;t mean we can&#039;t get more results/map.<br /><br />In the void, there&#039;s a specific set of map&#039;s that are used in the battle tower.<br />These Battle tower map&#039;s move bytes by about 8000. This also influences the results heavily, and actually gives you 2x64, or 128 results/map!<br /><br />We have been actively looking for ways to get some kind of ACE with this. <br />To end off, I&#039;ll add some more fun scripts!<br /><br /> [img]https://i.imgur.com/T05CGu9.png[/img] [img]https://i.imgur.com/HYAdWtK.png[/img] [img]https://i.imgur.com/vKxm0Tl.png[/img] [img]https://i.imgur.com/qqZjpcK.png[/img] [img]https://i.imgur.com/mRuSPPd.png[/img] [img]https://i.imgur.com/lqYLooN.png[/img]


subject: Re: Pokemon that should be real!
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Are you Chris Bert or just telling his story?<br />That is kind of sad that Chris got zero credit for Zeraora even though for just Pokemon Zeraoara&#039;s feuding fits but Chris should have gotten credit for the altered design of Sonichu.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;Listening to Ramones<br />&gt;It&#039;s snowing outside like a Jamaican spilled his cocaine<br />&gt;Browsing a Kirby thread on /v/<br /><br />Comfy.


subject: Re: Star Wars Expanded Universe or Disney Movies
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Sorry about how my last post sounded mean but I was trying to say that I don&#039;t understand what you said but you don&#039;t have to explain it because as long as that&#039;s how you feel then that&#039;s ok!&nbsp; Again sorry. It was close to midnight I believe when I made that post.


subject: Re: Finish the story!
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  got killed by a passing Nyan Cat that bled rainbows because it was just that evil. So there the little wee man died of rainbow overload and fell into the grip of the exploding kitten.


subject: Re: Open role play
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Sasara
icon: xx
body:
  You don&#039;t have to commit to the character, and multiple characters is allowed.<br /><br />[i]*hops off brick wall after finishing ice cream cone and walks down the street. she opens up a city map and in it showing an ocean to the southwest with the city in the center and a few rivers running throughout it, suburbs surrounding the city, farms and ranches surrounding further outwards, then forest, with mountains edging everything else from the northeast; further northeastwards is desert while southwestwards is islands*[/i]


subject: Re: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8269.msg208830#msg208830 date=1520943297]<br />The only distinguishable marker between Incomplete and Full BCs is the PokÃ©dex number in the profile. The fact that it is lvl 0, female and stuff is not sufficient - [b]if the PokÃ©dex number is not 0, the PokÃ©mon won&#039;t turn into a Glitch PokÃ©mon hex:00[/b]&nbsp; :)[/quote]<br /><br />So since my Totodile still has no. 158 in its summary, it should stay a Totodile even if I put it in the Daycare right? And still be able to breed with a Ditto and make a non-glitched Totodile?<br /><br />[quote author=SgvSth link=topic=8269.msg208840#msg208840 date=1520962269]<br />I do want to throw in that you might be able to have Totodile be sent up to Bank instead of releasing.&nbsp; Of course, this still causes the problem of getting a second Totodile without using other glitches.<br />[/quote]<br /><br />I have no intention of sending it through Bank, the purpose is getting all the starters on a Crystal save file and whether this glitched Totodile can be kept and bred at the Daycare for a non-glitched one instead, then released to prevent future issues. I&#039;m not planning on using a glitched clone for anything.<br />


subject: Re: Are gen 2 &quot;somewhat&quot; glitched clones ok to keep? Can I breed them?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes it will stay a Totodile once in daycare and be able to breed indeed&nbsp; :)<br /><br />Just make sure to understand that any movement of the Bad Clone is made at your own risks. Withdrawing, Moving, Storing or Depositing at the Day care a Bad Clone may or may not corrupt stuff :)


subject: Re: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is there a certain type of bad clone that is needed to get the kingdra clone in crystal? I was cloning eevee&#039;s and i got one with ?&#039;s as a name. I deposited into a box and then put 5 normal eevees into it, and trying to do the withdraw trick, but they never turned into kindras. the eevee didn&#039;t seem have anything wrong with it besides the name, so Do i need a more glitched out clone for it to work? or is there a specific way you have to do it? i read you need to save and reset the game before doing the tick, but is that all you need to do?<br /><br />Also, would it be possible to use the gameshark/memory editor-item code to get the right tm in the wrong pocket, instead of using the bellsproud/mystery egg method? Or do you need to do the mystery egg method?


subject: Gun Control in the US
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;d love to hear the opinions of other people on gun control/gun bans in the US, as that&#039;s a hot topic right now.<br /><br />Personally, I feel that weapons like pistols, shotguns, rifles, etc. are fine as they are, but weapons that can be more powerful, exotic weapons, weapon platforms (AR-15), etc. should require extra training (along the lines of conceal carry training and certification) to be owned (unless modified to be inoperable, like a prop or smth). And, of course, you&#039;d need the training to buy the ammo too (something like presenting the certificate of training when you go to buy it).


subject: Re: Downloading save files from another Gameboy with Pokemon Red/Blue
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Of course, but it&#039;s better to do write to the screen, to signal that the transfer is properly progressing.


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Reminds me of this, which was the same effect (well, seems so anyway) caused by editing a save file with 0 PokÃ©mon in the party to have partycount=6: https://forums.glitchcity.info/index.php?topic=7168.0


subject: Re: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  About the corruption induced by Bad Clones, you can read this: https://forums.glitchcity.info/index.php?topic=8269.msg208830#msg208830<br />I guess changing the Bad Clone and the clones used is the best move if you don&#039;t manage to get the corruption.<br /><br />[quote]Also, would it be possible to use the gameshark/memory editor-item code to get the right tm in the wrong pocket, instead of using the bellsproud/mystery egg method? Or do you need to do the mystery egg method?[/quote]<br /><br />Of course this is possible but then it requires another ACE method to do it :)


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Trying this on my Diamond cartridge yielded a crash before the battle transition showed up. Interestingly, Desmume crashes, but later.


subject: Re: Pokemon that should be real!
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Sasara
icon: clip
body:
  SatoMew: &quot;Also Victory Road sounding like Mt. Itoi&quot;<br /><br />I&#039;ve joked with some friends about how Giegue from MOTHER/Earthbound Zero should be Mewthree.<br /><br />Plus, the game is about psychic powers, and Mewtwo is psychic.


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: BUGLITCH
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=8267.msg208871#msg208871 date=1521145292]<br />Reminds me of this, which was the same effect (well, seems so anyway) caused by editing a save file with 0 PokÃ©mon in the party to have partycount=6: https://forums.glitchcity.info/index.php?topic=7168.0<br />[/quote]<br /><br />Oh yep, never saw this topic, but yes, having your partycount to 6 while having no PokÃ©mon means having 6 invalid PokÃ©mon, so that&#039;s it.


subject: Good Super Mario Maker Levels!
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: exclamation
body:
  So this is a area to post high&nbsp; quality SMM levels or levels that you put a lot of time into. Here is one I am especially proud of!&nbsp; :D<br />Bonus-L2 Full The Office Theme ./~&nbsp; ./~<br />ID 019F-0000-0933-852F <br />Hope you enjoy it!<br />Check my other levels if you like a bit of challenge or want to wait for my next music level! Also please post levels here so others cantry them ! :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  What I think is the fastest possible route to get 8F is as follows: <br />Follow the NSC route up to item underflow, but make sure the item you underflow with is X Special x 255 (buy X Special x 1 instead of one of the other items) http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Red/Blue/Glitched_No_Save_Corruption/Route <br /><br />Then walk to the bottom right corner of Celdaon (Using the fresh water/lemonade/soda pop you bought to trigger overflow on the way, of course), toss 254 x specials, swap X special x 1 with nugget x 1 in slot 35, walk right till the x special x 1 is an 8F, switch 8F with the nugget x 1 again, teleport away, store 8F in the pc, and then return your inventory to normal by buying/withdrawing items. Then withdraw 8F. <br /><br />Basically it&#039;s a hybrid between the NSC route and the trick to get 8F.<br /><br />P.S. Thanks to Sanqui for helping me out a bit with the NSC route stuff and Brock Through Walls, which I didn&#039;t really have a grasp of before.


subject: I found arbitary code execution in Pokemon Black 2!!!
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  I discovered this completely by accident.<br />So, I found arbitary code execution in Pokemon Black 2.<br />I don&#039;t know where the code is executed.<br />The first time I experienced this, the game froze without bringing up the crash handler.<br />The second time and onwards it brought up the PC Pokemon screen, which has the cursor set to an glitch location. The game then crashed bringing up the crash handler.<br />I&#039;ve attached the save in the attachment.<br />Just exit the gym and it&#039;ll happen.


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: RichardG867
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: RichardG867
icon: xx
body:
  This is also possible in the HG/SS Safari Zone. The following screenshots were taken on HeartGold with a party of 6 fainted PokÃ©mon. Ending the encounter in any way results in a crash while returning to the overworld (black screen), however the glitches never run away from too many throws/bait/mud.<br /><br />[img]https://i.imgur.com/WgoMgOb.png[/img] [img]https://i.imgur.com/kwSuyoq.png[/img] [img]https://i.imgur.com/PuwDXLO.png[/img] [img]https://i.imgur.com/fL7Gwzr.png[/img]<br /><br />The Bad Eggs hang the game and eventually crash with a stuck music note, while the blue boxes appear to just hang. All Bad Eggs have a really long animation (normal hop, then sprite jumps around randomly), but I did find a blue box that had Bulbasaur&#039;s cry and animation followed by the jump-around sequence.<br /><br />I did manage to catch some that didn&#039;t crash immediately, but they do crash before the summary (see second image). Throwing bait also crashes (third image):<br /><br />[img]https://i.imgur.com/71gWjie.png[/img] [img]https://i.imgur.com/WGZ69KB.png[/img] [img]https://i.imgur.com/vaMDf17.png[/img]<br /><br />This one broke out of the ball, started watching carefully and promptly crashed with some top screen corruption:<br /><br />[img]https://i.imgur.com/SOXra8u.png[/img]<br /><br />This blue box broke out of 20 balls and was only catchable with an Action Replay code to increase the catch rate, it didn&#039;t crash at first, although it crashed while loading the overworld as I mentioned above:<br /><br />[img]https://i.imgur.com/XskLDgH.png[/img] [img]https://i.imgur.com/AP3C8fh.png[/img] [img]https://i.imgur.com/XOlvumg.png[/img]<br /><br />Also, my very first attempt ended in a crash [i]during[/i] the battle transition, although I never manage to reproduce that.


subject: Re: Open role play
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Sasara
icon: xx
body:
  [i]*arrives at her studio apartment after a long escalation in a elevator in a skyscraper central to the city, standing in front of the mirror*[/i]<br /><br />Her name is Luci Nacile. She has light strawberry blonde hair and light skin, with a pair of cat ears, tail, and wings that match her hair. She wears a black dress with a white shirt underneath. She was sent down to Los Angeles below from the floating islands in the sky to search for an entryway to Hell, which is accessible from some of the many underground complexes.<br /><br />So far, she has failed. She has asked around and followed various detective leads, but people are distrustful towards her.


subject: Re: I found arbitary code execution in Pokemon Black 2!!!
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I just saved by myself. I made a save state before this even occured and saved my game.<br />I didn&#039;t know it would end like that.


subject: [Request] - Crystal ACE Code for Max Stat EXP / Shiny Ivs?
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey, So I am working on setting up ACE in crystal, but it doesn&#039;t seem like there are a lot of codes for crystal at the moment. There are 2 codes I liked to use in GS that were really helpful: One that maxes out Stat Exp and DVs, and another that made pokemon shiny. I was wondering If someone could help make some codes that would do the same thing in crystal. the codes i used are as follows:<br /><br />https://www.youtube.com/watch?v=JEOOCpNTx88&amp;t=2s<br />https://www.youtube.com/watch?v=bvoT4LLI9Lk<br /><br /><br />Ideally I&#039;d like a Box name/Item code that would let me max out the stat exp for each stat while also changing the ivs to whatever i&#039;d like. However a crystal version of the 2 codes I linked would also be very helpful as well. I don&#039;t know much about gen 1 or 2 ACE, or coding for that matter, so I can&#039;t write the code myself atm. Any help with either coming up with a new code or translating these codes would be very much appreciated!


subject: Re: I found arbitary code execution in Pokemon Black 2!!!
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I think he is asking what steps you took in order to get this save? Did you do anything special or did it just occur during normal gameplay? 


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: 0ErrorYT
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I have uploaded a video on this, mostly bad egg, but got a few cool things.<br />https://youtu.be/oBcZrfUr-dE


subject: Re: I found arbitary code execution in Pokemon Black 2!!!
poster_name: Flameduck
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Judging from the save this looks to be from a randomized ROM which could change some things as well, so the more details the better we can determine how it happened exactly.


subject: Re: I found arbitary code execution in Pokemon Black 2!!!
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I just did walk through walls past the guard and beat the gym.<br />Before this happened I saved a save state, so I was able to save the game normally.


subject: My Box 1 Is glitched. Is there any way to reset it?
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Inkblot
icon: xx
body:
  I Was cloning pokemon in the crystal virtual consol and ended up getting a bad clone that turned into a kingdra. I ended up withdrawing it and putting it in the day care to stabilize it, but when i checked my boxes I found that my box 1 said it had 0 pokemon in it when it actually had 20. I withdrew a pokemon from it and then all the pokemon ended up disappearing. A glitched symbol appeared where it says how many pokemon are in the box. I filled the box with pokemon and they would glitch out (the names of the pokemon becoming my characters name, and getting shorter by one letter every time i added an extra pokemon). I kept filling the box with pokemon, thinking it might fix itself once its full again. However, after filling it up with pokemon, it is still glitched. Nothing shows up in the box when i look inside it, but it still has the glitched symbol where it says how many pokemon are in the box. also when i try putting pokemon in it, it restarts the game in gameboy mode for some reason.<br /><br />The point is, i was wondering if there is any way to reset the box to having 0 pokemon it it, as i can&#039;t seem to find a way to fix this.<br /><br /><br />EDIT: would it be possible to possibly reset the box with ACE? Like maybe set all the values to 00 to completely empty it/reset it? Or is it more complicated than that? If there is a way to possibly undo it with ACE that would be good to know, as then I can continue to play through the game till I can perform the ACE needed to fix it.


subject: Re: My Box 1 Is glitched. Is there any way to reset it?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The glitched symbol means you underflowed the number of PokÃ©mon in the box. I suppose you might be able to fix it by capturing PokÃ©mon and getting them sent to the PC, but I think you would end up triggering Withdraw Smash.<br /><br />Anyways, to fix this using ACE, you&#039;d simply need to set the number of mons in that box to 0, and write a $FF in the first slot of the ID list.<br />This could be done by :<br />[list type=decimal]<br />[li]Switching to box 1[/li]<br />[li]Setting up a RAM writer setup[/li]<br />[li]Writing 0A to 0000[/li]<br />[li]Writing 01 to 4000[/li]<br />[li]Writing 00 to AD10[/li]<br />[li]Writing FF to AD11[/li]<br />[li]Switching boxes[/li]<br />[/list]


subject: Re: I found arbitary code execution in Pokemon Black 2!!!
poster_name: Flameduck
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Flameduck
icon: xx
body:
  I guess if there actually is this kind of effect on a vanilla B2 ROM, it could be interesting just to see what exactly happened here. Did someone test this yet?


subject: Re: My Box 1 Is glitched. Is there any way to reset it?
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8281.msg208897#msg208897 date=1521426966]<br />The glitched symbol means you underflowed the number of PokÃ©mon in the box. I suppose you might be able to fix it by capturing PokÃ©mon and getting them sent to the PC, but I think you would end up triggering Withdraw Smash.<br /><br />Anyways, to fix this using ACE, you&#039;d simply need to set the number of mons in that box to 0, and write a $FF in the first slot of the ID list.<br />This could be done by :<br />[list type=decimal]<br />[li]Switching to box 1[/li]<br />[li]Setting up a RAM writer setup[/li]<br />[li]Writing 0A to 0000[/li]<br />[li]Writing 01 to 4000[/li]<br />[li]Writing 00 to AD10[/li]<br />[li]Writing FF to AD11[/li]<br />[li]Switching boxes[/li]<br />[/list]<br />[/quote]<br /><br /><br />Cool! Thank you! I&#039;ll Keep this in mind! I was worried i would be stuck with a dead box and wouldn&#039;t be able to transfer anything from this game. thank you for the help!


subject: Re: My Box 1 Is glitched. Is there any way to reset it?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Nooooo you did the mistake to clone in box 1 hahaha<br /><br />Anyway a while back someone had this issue on Prama&#039;s Discord and issotm made that process to help him. I still have the tm code version of it and will post it asap<br /><br />EDIT: I made this in form of a TM code.<br /><br />Use a code to get 255 TMs of all TMs (or at least 1 to 20) then store/toss all the following TMs<br />- 80 TM01 (you now have x175)<br />- 168 TM02 (you now have x87)<br />- 160 TM03 (you now have x95)<br />- 193 TM04 (you now have x62)<br />- 245 TM05 (you now have x10)<br />- 237 TM06 (you now have x18)<br />- 193 TM07 (you now have x62).<br />- 254 TM08 (you now have x1)<br />- 21 TM09 (you now have x234)<br />- 254 TM10, then, the last TM10 (don&#039;t store 255 as once)<br />- 191 TM11 (you now have x64)<br />- 222 TM12 (you now have x33)<br />- 239 TM13 (you now have x16)<br />- 82 TM14 (you now have x173)<br />- 80 TM15 (you now have x175)<br />- 221 TM16 (you now have x34)<br />- 194 TM17 (you now have x61)<br />- 136 TM18 (you now have x119)<br />- 237 TM19 (you now have x18)<br />- 54 TM20 (you now have x201)<br /><br />Organise stored items this way:<br />TM04 x89 (not the real TM04 but the fake one, that you can obtained with a &#039;get any item&#039; code)<br />TM25 x4<br />TM10 x(any quantity)<br /><br />Execute code from items.


subject: Re: My Box 1 Is glitched. Is there any way to reset it?
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8281.msg208900#msg208900 date=1521453422]<br />Nooooo you did the mistake to clone in box 1 hahaha<br /><br />Anyway a while back someone had this issue on Prama&#039;s Discord and issotm made that process to help him. I still have the tm code version of it and will post it asap<br /><br />EDIT: I made this in form of a TM code.<br /><br />Use a code to get 255 TMs of all TMs (or at least 1 to 20) then store/toss all the following TMs<br />- 80 TM01 (you now have x175)<br />- 168 TM02 (you now have x87)<br />- 160 TM03 (you now have x95)<br />- 193 TM04 (you now have x62)<br />- 245 TM05 (you now have x10)<br />- 237 TM06 (you now have x18)<br />- 193 TM07 (you now have x62).<br />- 254 TM08 (you now have x1)<br />- 21 TM09 (you now have x234)<br />- 254 TM10, then, the last TM10 (don&#039;t store 255 as once)<br />- 191 TM11 (you now have x64)<br />- 222 TM12 (you now have x33)<br />- 239 TM13 (you now have x16)<br />- 82 TM14 (you now have x173)<br />- 80 TM15 (you now have x175)<br />- 221 TM16 (you now have x34)<br />- 194 TM17 (you now have x61)<br />- 136 TM18 (you now have x119)<br />- 237 TM19 (you now have x18)<br />- 54 TM20 (you now have x201)<br /><br />Organise stored items this way:<br />TM04 x89 (not the real TM04 but the fake one, that you can obtained with a &#039;get any item&#039; code)<br />TM25 x4<br />TM10 x(any quantity)<br /><br />Execute code from items.<br />[/quote]<br /><br />thank you as well! I&#039;ll try and give these a shot and see if i can fix the problem!


subject: Re: My Box 1 Is glitched. Is there any way to reset it?
poster_name: Arkazra
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I ran into a similar problem with the box I was using for bad clones, but I did find a relatively easy solution. But, if you&#039;re too far into your game it might not be one you want to use.<br /><br />What I did was to withdraw the 6 most important pokemon from my boxes, and put another 2 in daycare, then restart the game. <br />Don&#039;t save over your old game, but play through until you catch your first pokemon.<br />Head to the PokÃ©mon centre and clone your starter.<br />Risky, as you only get 1 shot. But if done correctly, a set of fresh, uncorrupted boxes will be saved into your old save game without saving over any of your progress. <br /><br />The PokÃ©mon in your party and daycare will be unaffected, but anything left in your boxes will be lost. You will end up with the cloned starter from the new game as well, so take that into consideration when choosing which PokÃ©mon to save. <br /><br />Depending on how far through you are, that might be an option :)


subject: Consistent ACE Birth Island Warping?
poster_name: eliasthompson
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi all,<br /><br />I&#039;m in the middle of trying to complete a Living Dex where all Pokemon come from the generation that they were introduced, and I&#039;m up to the point where I&#039;d like to try and get the in-game event Deoxys for that purpose (Mew in FR/LG would be a plus). I&#039;ve tried to look up information on how do this in this decade, and once again it seems like ACE is the only viable possibility. (Sidenote: ACE in Gen 1-2 was documented and easy enough to follow, but Gen 3 takes it to a whole other level.)<br /><br />The end result I&#039;m trying to get to seems at the very least possible with [url=https://www.youtube.com/watch?v=1pb-6hMDQBs]TheZZAZZGlitch&#039;s demonstration[/url], but it seems like his explanation was more of an over-arching methodology on the techniques behind how to go about, without much of a detailed step-by-step. It also make use of some convenient Lua scripts that I can&#039;t really take advantage of on console.<br /><br />Looking at that method as well as some of Princess Torchic â¤&#039;s posts and videos, it looks like enough pieces are out there to get this done, but figuring out how to obtain the correct glitch move &amp; Pokemon for an escape rope spawn change, as well as how to obtain the necessary glitch items and they&#039;re order doesn&#039;t seem to be broken down in detail anywhere that I can find. In addition, there&#039;s also the hurdle on console of how to tell if the save file alignment starts odd or not, making it 50/50 that the game I start on Emerald would even work or not. It just seems like there&#039;s enough collective knowledge and pieces out there to make something like this doable on console (maybe), but it&#039;s not all together for specific locations warps.<br /><br />If anyone&#039;s done this, or has more of an idea on how to string together some Glitzer Popping ACE steps to get here, then that&#039;d help me and I imagine a few others out there who use these complicated glitches to get these old Pokemon late out a ton. Otherwise, I&#039;ll continue to try and string together what I can find once I get to it.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  [quote author=Metarkrai link=topic=6868.msg208763#msg208763 date=1520089790]<br />Even though the move&#039;s name is short, the name the game uses when the move is used in battle is longer (I don&#039;t really know where he pulls the other name off)<br />[/quote]<br /><br />I&#039;ve mentioned this in the past. This comes from some code that substitutes a placeholder name for when the move is used in battle, which is used if the move index is above the last valid move (0x162).<br /><br />The code is basically something like this:<br />[tt]<br />if ( *ptrSelectedMoveIndex &lt;= 0x162 )<br />&nbsp;  strcpy(UsedMoveName, &amp;MoveNames[13 * *ptrSelectedMoveIndex]);<br />else<br />&nbsp;  strcpy(UsedMoveName, ptrGenericTypeMoveStrings[SelectedMoveType]);<br />[/tt]<br /><br />..you should easily be able to see, how if the move type is invalid, a pointer from past the end of the array of pointers is used, and strcpy()&#039;d over, classic buffer overflow.


subject: Re: Making &quot;Super Glitch&quot; moves useful (Red/Blue/Green)
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Tabbender
icon: xx
body:
  My game reacts oddly to the Cooltrainer move. Its type isn&#039;t even Cooltrainer, it&#039;s garbage data. Is this because it&#039;s the french version of the game ?<br /><br />Also, i&#039;m trying all i can to do the Cooltrainer glitch, and i actually did it once, but the game softlocked by repeatedly telling me Oak&#039;s &quot;This isn&#039;t the time to use that&quot; text as soon as i got in the bag, forcing me to reset without catching the pokemon. <br /><br />Since then i absolutely can&#039;t trigger the corruption again. I tried changing the current box to an empty one and switching my 3rd and 5th party pokemon, nothing changed


subject: Re: Making &quot;Super Glitch&quot; moves useful (Red/Blue/Green)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, the type is different in French versions.<br />Make sure your current box is an empty one, preferably one you never used (or the one which contained the least amount of PokÃ©mon).<br />Also empty your party, preferably by depositing PokÃ©mon 1 over and over, which will duplicate the remaining PokÃ©mon&#039;s data in the party (thus, if it&#039;s a CT-friendly PokÃ©mon, all stlos will contain its data).<br />The enemy PokÃ©mon may also prevent the glitch from fulfilling itself ; I never got the corruption to work against Dugtrios.<br /><br />The softlock was caused by an invalid battle mode, which forced you to use your first item constantly. This is usually caused by corrupting too much data, so ensure you have a $50 tile in a proper spot on-screen.<br />You can also mitigate such a softlock by placing your Balls in the first pack slot, so if it happens again, you&#039;ll capture the PokÃ©mon like normal.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: DocB
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: DocB
icon: xx
body:
  I&#039;m sorry if this is a question already solved but I wasn&#039;t able to find anything anywhere and there are 52 pages only of this thread to check so...<br /><br />I&#039;m playing a PokÃ©mon Yellow ita ROM on 3Ds, i&#039;ve got the ws m long ago, setted my last box in the slowpoke set up and prepeared my iteam but the ws m never worked :(<br /><br />So I&#039;ve decided to extract the savefile, put it in vba-m emulator and check the ram to find the problem. I&#039;ve discovered that there is an offset before the asm code, i mean: <br /><br />[code]What shuld it be:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; What it actually is:<br /><br />[0xDA7F = 0x14]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA7F = 0x00]<br />[0xDA80 = 0x25]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA80 = 0x00]<br />[0xDA81 = 0x25]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA81 = 0x00]<br />[0xDA82 = 0x25]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA82 = 0x00]<br />[0xDA83 = 0x25]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA83 = 0x00]<br />[0xDA84 = 0x25]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA84 = 0x14]<br />[0xDA85 = 0x25]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA85 = 0x25]<br />[0xDA86 = 0x06]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA86 = 0x25]<br />[0xDA87 = 0x21]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA87 = 0x25]<br />[0xDA88 = 0x68]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA88 = 0x25]<br />[0xDA89 = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA89 = 0x25]<br />[0xDA8A = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA8A = 0x25]<br />[0xDA8B = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA8B = 0x06]<br />[0xDA8C = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA8C = 0x21]<br />[0xDA8D = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA8D = 0x68]<br />[0xDA8E = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA8E = 0xA9]<br />[0xDA8F = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA8F = 0xA9]<br />[0xDA90 = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA90 = 0xA9]<br />[0xDA91 = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA91 = 0xA9]<br />[0xDA92 = 0xA9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA92 = 0xA9]<br />[0xDA93 = 0x06]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA93 = 0xA9]<br />[0xDA94 = 0xFF]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA94 = 0xA9]<br />[0xDA95 = 0x25]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA95 = 0xA9]<br />[0xDA96 = 0x00]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA96 = 0xA9]<br />[0xDA97 = 0xE9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xDA97 = 0xA9]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xDA98 = 0x09]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xDA99 = 0xFF]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xDA9A = 0x25]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xDA9B = 0x00]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xDA9C = 0xE9][/code]<br /><br />Well, they&#039;re all a bunch of nope, so i don&#039;t think that this could ba a problem, the real problem imho is that there is an offset also for the iteam. For example i was tryng to use this code<br /><br />ws m<br />Item<br />Burn Heal&nbsp;  x43<br />Ice Heal&nbsp; &nbsp;  x43<br />Full Heal&nbsp; &nbsp; x201<br /><br />[code]What shuld it be:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; What it actually is:<br /><br />[0xD322 = 0x0C]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xD322 = 0x63]&nbsp; &lt;- the wsm, so it starts from the first element of the bag<br />[0xD322 = 0x2B]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xD323 = 0x01]<br />[0xD324 = 0x0D]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xD324 = 0x05]<br />[0xD325 = 0x2B]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xD325 = 0x01]<br />[0xD32A = 0x34]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xD326 = 0x0C]<br />[0xD32B = 0xC9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  [0xD327 = 0x2B]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xD328 = 0x0D]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xD329 = 0x2B]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xD32A = 0x34]<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [0xD32B = 0xC9][/code]<br /><br />Also the disassembler of the emulator says that [0xDA9C = 0xE9] is a [code]LD PC,HL[/code] instead of a [code]JP HL[/code]<br />But maybe is just the same (i never heard of LD I program in other hardware usually) or is just the disassembler...<br /><br />Can you help me very please?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  Very, very simple code to give you 0 of the item in the second slot<br /><br />from slot 1:<br />8f<br />item you want 0 of<br />Lemonade x 1<br />soda pop x 234<br />thunderstone x 211<br />tm01 x any<br /><br />[code]<br />ld a, 01<br />dec a<br />ld $d321,a<br />ret<br />[/code]<br /><br />All the items are buyable at the Celadon department store and can be cloned easily to get the amounts you need.<br /><br />All fly locations (incase you skipped any to get 8F early such as using BTW to rush to it)<br /><br />from item 3:<br />Lemonade x 255<br />TM34 x 11<br />TM15 x 234<br />Burn heal x 215<br />tm01 x any<br /><br />[code]<br />ld a,255<br />ld d70b,a<br />ld d70c,a<br />ret<br />[/code]<br /><br />Though you&#039;d probably just want to use Aldrasio&#039;s 2 byte writer to write the 2 consecutive bytes anyway. *Shrug* <br /><br />Note this sets both flyable location bytes to ff, (ie d70b = ff, d70c = ff) but the regular value to unlock all locations is ff 07 (d70b = ff, d70c = 07). However, with valid bytes activated in d70c it seems to ignore the unused locations regardless. If you wanted to be really thorough and write ff 07 you would have to ld a,07 after the lod d70b,a but at that point it&#039;s definitely better to just use Aldrasio&#039;s 2 byte writer.<br /><br />Though for something this simple as writing 2 consecutive bytes you would probably rather just use the two byte writer by aldrasio above, 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Opcode 0xE9 is `jp hl`, as per the most recent spec. `jp [hl]` is and old syntax, and `ld pc, hl` is another way to write it... but it&#039;s really stupid.<br /><br />As for the offset, that&#039;s a specificity of EU versions, which have a +5 offset everywhere. Please refer to [url=https://glitchcity.info/wiki/Arbitrary_code_execution#Using_.22ws_m.22_.28English_and_European-non_english_Yellow.29]this post on our wiki[/url] for a EU-compatible box setup.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  [quote author=Wack0 link=topic=6638.msg189609#msg189609 date=1367338119]<br />Well, just decided to quickly code something for 8F...<br /><br />[u][b][size=12pt]CHANGE ANY BYTE IN RAM TO ANYTHING[/size][/b][/u]<br />[i][size=8pt](or, psuedo-GameShark in software)[/size][/i]<br /><br />This code uses only 5 basic items, and will easily allow you to modify any byte in RAM one wants to.<br /><br />Item 1: any item<br />Item 2: 8F<br />Item 3: Lemonade, quantity (byte to change to, or 2nd byte of GScode)<br />Item 4: X Accuracy, quantity (low byte of RAM address to change, or 3rd byte of GScode)<br />Item 5: Carbos, quantity (high byte of RAM address to change, or 4th byte of GScode)<br />Item 6: PokÃ© Ball, quantity 119<br />Item 7: Fresh Water, quantity 201<br /><br />[u][b]ASM:[/b][/u]<br />[code]D322: 3E xx&nbsp; &nbsp; &nbsp; &nbsp;  ld a, xx<br />D324: 2E xx&nbsp; &nbsp; &nbsp; &nbsp;  ld l, xx<br />D326: 26 xx&nbsp; &nbsp; &nbsp; &nbsp;  ld h, xx<br />D328: 04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc b<br />D329: 77&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld (hl), a<br />D32A: 3C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc a<br />D32B: C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ret[/code]<br /><br />So, for GameShark code 011559D0, which would encounter a Mew after you close the menu (and yes, this is the one i tested it with -- on a real cart no less), use the following item list:<br /><br />Item 1: any item (but I guess you&#039;d want Master Balls here for this example!)<br />Item 2: 8F<br />Item 3: Lemonade, quantity 21<br />Item 4: X Accuracy, quantity 89<br />Item 5: Carbos, quantity 208<br />Item 6: PokÃ© Ball, quantity 119<br />Item 7: Fresh Water, quantity 201<br /><br />By the way, since no address is hardcoded, this *should* work on Yellow too; but I haven&#039;t tested it there. (obviously the example posted above won&#039;t!)<br />[/quote]<br /><br />Why not tm01 x any rather than Fresh Water x 201? You don&#039;t need the inc a instruction, and tm01 is buyable at celadon too - you don&#039;t even have to dupe it!<br /><br />Item 1: any item<br />Item 2: 8F<br />Item 3: Lemonade, quantity (byte to change to, or 2nd byte of GScode)<br />Item 4: X Accuracy, quantity (low byte of RAM address to change, or 3rd byte of GScode)<br />Item 5: Carbos, quantity (high byte of RAM address to change, or 4th byte of GScode)<br />Item 6: PokÃ© Ball, quantity 119<br />Item 7: TM01 x any<br /><br />[code]D322: 3E xx&nbsp; &nbsp; &nbsp; &nbsp;  ld a, xx<br />D324: 2E xx&nbsp; &nbsp; &nbsp; &nbsp;  ld l, xx<br />D326: 26 xx&nbsp; &nbsp; &nbsp; &nbsp;  ld h, xx<br />D328: 04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc b<br />D329: 77&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld (hl), a<br />D32A: c9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ret<br />D32B: anything&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; not read as code because already returned[/code]<br /><br />Edit: you can also get the 4 glitch item (id $77) and cut out the pokeballs of course. But dealing with glitch items is annoying.<br /><br />Item 1: any item x any qty<br />Item 2: 8f<br />Item 3: lemonade x XX<br />Item 4: X Accuracy x XX<br />Item 5: Carbos x XX<br />Item 6: 4 x 201<br /><br />[code]<br />ld a,xx<br />ld l,xx<br />ld h,xx<br />ld (hl),a<br />ret<br />[/code]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  Another writer for writing consecutive bytes! Based off of Wack0&#039;s write to any byte code. This is for people like me who have trouble keeping track of their map coordinates (for the old coordinate based memory writer) or step count (for the newer step counter based memory writer) when writing a memory editor in. Here, you can see exactly what you are writing and the addresses you are writing to (ZZYY or, number of Carbos in slot 5, number of X Accuracy in slot 4) Only problem is that you can&#039;t increase the high byte automatically so you would still have to do so manually (I&#039;d say it could be modified to automatically detect when to increase the high byte, but I haven&#039;t gotten around to it and it might require more items than we can hold normally meaning we&#039;d have to underflow) however this doesn&#039;t matter if you&#039;re writing less than 256 bytes (eg writing either version of theZZAZZglitch&#039;s memory editor)<br /><br />from slot 3<br /><br />lemonade x XX<br />X accuracy x YY<br />Carbos x ZZ<br />pokeball x 119<br />Burn heal x 125<br />Fresh water x 234<br />Iron x 211<br />Lemonade x 0<br />TM34 x 35<br />TM 11 x 201<br /><br />[code]<br />;write XX to ZZYY<br /><br />ld a, XX ;lemonade x XX (amount writing). bytes: 3E XX<br />ld l, YY ;X Accuracy x YY (low byte of address). Bytes: 2E YY<br />ld h, ZZ ;Carbos x ZZ (high byte of address) Bytes: 26 ZZ<br />inc b&nbsp; ; pokeball (padding) Bytes: 04<br />ld (hl), a ; quantity of pokeballs (119) Bytes: 77<br />inc c ; burn heal (padding) Bytes: 0C<br /><br />;inc quantity of item 4 by 1, thus increasing the low byte to the next one in sequence<br />ld a,l ;quantity of burn heal (125) bytes: 7D<br />inc a ; fresh water bytes: 3C<br />ld ($d325),a ; quantity of fresh water (234), Iron x 211 bytes: EA 25 D3<br /><br />;set quantity of item 3 to 0 to allow to get any amount!<br />ld a, 00 ; lemonade x 00 bytes: 3E 00<br />ld ($d323),a ;TM34 x 35, TM11. bytes: EA 23 D3 <br />ret ; TM11 quantity (201) bytes: c9<br />[/code]<br /><br />Bytes (if you want to write them using a memory editor, say, in bgb)<br /><br />3E xx 2e yy 26 zz 04 77 0c 7d 3c ea 25 d3 3e 00 ea 23 d3 c9<br /><br /><br />So to write ISSOtm&#039;s version of theZZAZZglitch&#039;s memory editor (https://forums.glitchcity.info/index.php?topic=8200.0) you&#039;d start with <br /><br />lemonade x 229 (229 = $E5, the byte to write at DB01)<br />X accuracy x 1<br />Carbos x 219 <br />pokeball x 119<br />Burn heal x 125<br />Fresh water x 234<br />Iron x 211<br />Lemonade x 0<br />TM34 x 35<br />TM 11 x 201<br /><br />use 8f, which would write the value, set the quantity of lemonades to 0 and increase the quantity of X accuracies by 1, to 2. Throw lemonades until you had 17 (hex 11), use 8f, etc etc.<br />


subject: Re: TheZZAZZGlitch's memory editor - 1.1 version
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  If you are using my sequential byte writer ( https://forums.glitchcity.info/index.php?topic=6638.msg208911#msg208911 ) to write this you will need all the values as decimal, so I provided that here:<br /><br />https://pastebin.com/raw/3f39BSpS<br /><br />ps to execute<br /><br />X accuracy x 1<br />carbos x 219<br />tm 33 x any


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: DocB
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: DocB
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg208909#msg208909 date=1521523006]<br />Opcode 0xE9 is `jp hl`, as per the most recent spec. `jp [hl]` is and old syntax, and `ld pc, hl` is another way to write it... but it&#039;s really stupid.<br /><br />As for the offset, that&#039;s a specificity of EU versions, which have a +5 offset everywhere. Please refer to [url=https://glitchcity.info/wiki/Arbitrary_code_execution#Using_.22ws_m.22_.28English_and_European-non_english_Yellow.29]this post on our wiki[/url] for a EU-compatible box setup.<br />[/quote]<br /><br />Thank you for the reply, I followed that bootstrap before post my question but i wrongly didn&#039;t put a 10th pokemon in the box so... :-[<br />Now it work pretty well but it&#039;s a pretty unconfortable setup in the 3Ds for me, there is a way to edit the slowbre setup to jump to 0xD326 (i don&#039;t know if this bootstrap do actually this because the disassmler hasn&#039;t debug function so no interrupt function...)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: DocB
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: DocB
icon: xx
body:
  Thank you dude, that&#039;s awesome<br />If someone like me already set the box in the slowpokesetup and play in the Eu non english version you just have to switch [code]Growlithe [0xDA87 = 0x21][/code] with [code]kadabra [0xDA87 = 0x26][/code]


subject: Re: Making &quot;Super Glitch&quot; moves useful (Red/Blue/Green)
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Tabbender
icon: xx
body:
  Weird, because i&#039;m pretty sure i did everything right with the starting position, it does have some 50&#039;s at the end of the zone unless i missed something<br /><br />[url=http://image.noelshack.com/fichiers/2018/12/2/1521573060-20180320-200449.jpg]http://image.noelshack.com/fichiers/2018/12/2/1521573060-20180320-200449.jpg[/url]<br /><br />Also i did change the first item in the bag to a ball in case it happens again, and there&#039;s quite a lot of boxes i never used in my game, however i don&#039;t really get what you&#039;re saying about my party, are you saying i should deposit all pokemons besides my Ditto and the pokemon with Fly ?<br /><br />EDIT: Just realized the 50&#039;s are probably too low, hm... the thing is, i was trying to have a 45 as the pokemon species in order to have a MissingNo, since encountering him in french versions will freeze the game


subject: Safe code for ace
poster_name: DocB
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: DocB
icon: xx
body:
  What kind of instruction can be used just like a nop in an ace with the ws m?<br />Tere are some register that you can edit without any impact? There are some instructions that do nothing?<br />I noticed that [code]inc e[/code] could be pretty harmless but I didn&#039;t test it properly...<br />What about [code]ld b,b[/code] ?<br /><br />Any help?


subject: Re: Making &quot;Super Glitch&quot; moves useful (Red/Blue/Green)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  To encounter Missingno in EU R/B, just perform Cooltrainer while having the last menu opened being the in-battle PkMn or Item menu, and PokÃ©mon sprites are not flipped (if so, watch a PokÃ©dex entry to cancel sprite flipping).<br />This will consistently give you a Missingno to capture.


subject: Re: Safe code for ace
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It simply depends on what registers are clobbered at a given time.<br />`ld b,b` is always safe, and `inc e` is, as long as the value of E when it&#039;s executed isn&#039;t meaningful. (Or you can cancel it out with a `dec e`)


subject: Re: The Official ACE Guide - READ THIS IF YOU ARE NEW TO ACE
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7995.msg205851#msg205851 date=1498485789]<br />NOTE : This guide is a WIP, I&#039;m going to add new questions as they come up. [b]Please don&#039;t post unless it&#039;s for this purpose :)[/b]<br />[/quote]<br />Anyways, your PokÃ©mon setup is correct, instead the item list needs to be adjusted. (I didn&#039;t take a look at it yet.)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Xavi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I posted in a wrong thread, I think it is the correct one.<br /><br />[quote]My first will was to have a legal shiny Mew for Crystal. I have no 3DS. But looking for arbitrary code, I discovered about the &quot;legitimitation&quot; and I said to me &quot;let&#039;s try it&quot;. And if it&#039;s possible, share the Mew with friends that have a 3DS.<br /><br /><br />I was trying to legitimate Mew in a Spanish version of Red, and it did&#039;t work. I tried the same in an English and it worked fine.<br /><br />[quote]Partys: 1. Mew, 2. Pidgey with 233 CURRENT HP (Max HP doesn&#039;t matter), 3. Parasect, 4. Onix, 5. Tentacool, 6. Arbok <br /><br />Set up your bag as follows: 1. 8F, 2. Any item x89, 3. Dire Hit x58, 4. Iron x37, 5. X Accuracy x119, 6. Water Stone x62, 7. Burn Heal x50, 8. PokÃ© Ball x43, 9. Antidote x43, 10. Protein x62, 11. PP Up x60, 12. Ice Heal x50, 13. Lemonade x133, 14. Great Ball x50, 15. Fresh Water x34 16. TM01 x[any #][/quote]<br />This is the combination I used; all that happened is that Mew&#039;s Pound became Guillotine.<br /><br />I tried it following https://glitchcity.info/wiki/Arbitrary_code_execution#Using_7eme_etage_.2F_P7_.2F_S7_.28French_.26_Italian_.2F_Spanish_.2F_German_Red.2FBlue.29 to change Onix for a Graveler and for a Fearow, but nothing happened.<br /><br />Someone can help me? Thanks![/quote]<br /><br />I also shinied the Mew in a USA Red version. The settings doesn&#039;t work in spanish version. What&#039;s the difference? There&#039;s any way to translate from english to Spanish?<br /><br />Thank you.


subject: Re: Safe code for ace
poster_name: DocB
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: DocB
icon: xx
body:
  Well ld b,b is very useful for odd code shorter than 8 byte, instead of use 201 amount of the final iteam for the ret you can use x64 of that iteam and a TM 01<br /><br />If you use the ws m/8F for the first time you don&#039;t have to meet another missing no


subject: Re: Safe code for ace
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The problem with `ld b, b` is that it maps to the Gold Tooth item, the quantity of which you can&#039;t modify. So that removes most of its usefulness.<br /><br />And if you&#039;re trying to pad the tailing `ret`, it&#039;s better to use 3 of that item which maps to `inc bc` - but since you&#039;re RET-ing right after, BC doesn&#039;t matter anymore by that point.<br />3 items is better than 64.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The PokÃ©mon setup isn&#039;t the cause (nothing / a crash would have happened if it was wrong). The item setup needs to be modified to account for the memory address change in EU versions.Â²


subject: Thread move requests
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Sasara
icon: xx
body:
  I just created the Video Game Glitches Discussion board. I assume people read old threads on occasion -- if anyone finds threads that I missed, can they please report them here?<br /><br />This also goes for other boards and in the future.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  perl -pe &quot;s/\\&lt;br\\&gt;// and s/(.+ )?([0-9?A-F]{8})/* \\1\\&lt;code\\&gt;\\2\\&lt;\\/code\\&gt;/&quot;<br /><br />[quote author=Derxwna link=topic=2738.msg192312#msg192312 date=1385460910]<br />o..oh dear........<br />Forgive me for this monstrosity, I had it pasted to pastebin earlier and forgot to clear it.<br /><br />Touhoumon Faith &amp; Prayer Version Read-me File - Please take the time to read this all out.<br /><br />Sections:<br />* FP01. OFFICIAL DOWNLOAD LINKS<br />* FP02. SYSTEM COMPATABILITY<br />* FP03. IMPORTANT INFORMATION<br />* FP04. GAME INFORMATION<br />* FP05. DEFAULT CONTROLS<br />* FP06. BUGS AND UNFINISHED THINGS IN THE CURRENT RELEASE<br />* FP07. CHANGE LOG<br />* FP08. GRATITUDES AND CREDITS<br />* DERX. CONTACT INFORMATION<br />* LEGAL INFORMATION<br /><br />----------------------------------------------------------------------<br />FP01. OFFICIAL DOWNLOAD LINKS<br />----------------------------------------------------------------------<br />The official downloads can be found at the following locations:<br />	* http://chaoticinfinity.wordpress.com/<br />	* http://chaoticinfinitydev.tumblr.com/<br />	* http://www.pokecommunity.com/showthread.php?t=293880<br /><br />As such, if you downloaded this from a website not on this list, please reconsider downloading so you can be sure you have everything. Also, please send me a message so I can inspect it myself.<br /><br />If you downloaded it, please make sure you got it from one of the official websites listed above. It ensures you have the latest, up-to-date version, and cuts down on the chance of an outdated version being released. It also makes it easier for me to give you bug support help if you&#039;re using a current version.<br /><br />----------------------------------------------------------------------<br />FP02. SYSTEM COMPATABILITY<br />----------------------------------------------------------------------<br />This game was created in RPG Maker XP, a computer program that allows you to create RPG-genre games on the computer, compatible for the Computer only. As such, Touhoumon: Faith &amp; Prayer version will NOT be compatible with any Game Boy Advance emulator, DS Emulator, or any Handheld emulator of the sort. Please do not ask me how to make it compatible with any emulator, there is no way to do so. <br /><br />On the same note, please do not ask me how to play it on an Android Phone/iPhone/Whatever smart phone you may possess. The same applies as above, there is no way to play Touhoumon: Faith &amp; Prayer Version on a Smart-phone. EDIT: There is a Pokemon Essentials port for Android now. My answer changes slightly - I will not be porting Faith &amp; Prayer to the Android any time soon.<br /><br />----------------------------------------------------------------------<br />FP03. IMPORTANT INFORMATION<br />----------------------------------------------------------------------<br />Please do not mess with the system files, they keep the game running stable. If you need something addressed, please send me a message so I can help you. Contact information will be below. Furthermore, if you do mess with the system files of the game, or use memory editors to mess with the game, and you manage to break something, I am not responsible for what breaks. You brought it upon yourself, and the only advice you&#039;ll get from me is &quot;Start a new game.&quot;<br /><br />There are documents in the folder labled &quot;THIS IS USEFUL STUFF&quot; which provide information about certain subjects, including the 1.8 Type Chart for those who don&#039;t understand it.<br /><br />Do not get too attached to your save file, and be prepared to ending up having to start a new game sometime as the game develops further. Some changes to the internal coding may render the game unplayable with your old save, and require a full restart. I will repeat this again: DO NOT GET ATTACHED TO YOUR SAVE FILE WHILE THE GAME IS IN PRE-FULL RELEASE STATE. I do not want people to come crying to me when their save breaks because of an update, when it&#039;s explicitly stated that an update could/will break your save.<br /><br />----------------------------------------------------------------------<br />FP04. GAME INFORMATION<br />----------------------------------------------------------------------<br />Touhoumon: Faith &amp; Prayer Version, and the Touhoumon Essentials Development Kit, is an attempt to bring the 1.8x generation of Touhou Puppet Play (Japanese title) to RPG Maker XP. It features vastly different things from the generation of Pokemon it was based off of. 17 new types to the type chart, a physical/special split. <br /><br />From the original Touhou Puppet Play it differs as well, evolutions are different. Things start off as Chibi, and from that point could potentially branch off into either an Attack Form, a Defence Form, a Speed Form, a Tech Form, a Helper Form, an Advent Form, or their normal level-up evolution. Each of these forms is specialized in its own way, and is explained in detail in game.<br /><br />Touhoumon Faith &amp; Prayer Version is a somewhat non-linear game, focusing more on &quot;Plot&quot; than on becoming a Pokemon/Puppet Master or filling the Pokedex. As such, the Gym Challenge is an optional part of the game. Some gyms will be forced for the sake of plot, but will not be mandatory.&nbsp; Most of the areas will be traversable from the get-go, but if you find yourself being road-blocked, perhaps it might be a good idea to go look for something to remove the roadblock?<br /><br />----------------------------------------------------------------------<br />FP05. DEFAULT CONTROLS<br />----------------------------------------------------------------------<br />These are the default controls for the game. Once you start a new game, most of these controls can be configured to your will.<br /><br />Arrow Buttons<br />	* Movement across the Overworld<br />	* Scrolls the cursor within menus<br />C Button/Enter Button<br />	* Used to confirm a choice, check things, and talk to people.<br />X Button<br />	* Used to exit a choice, cancel a choice or mode, and open the pause menu.<br />Z Button<br />	* Press and hold while walking to run (Requires Running Shoes)<br />F5 Button<br />	* Press to use a registered Key Item.<br />S Button<br />	* Enable Turbo mode, doubles the FPS of the game. Press again to disable. Can only be enabled when a text box or menu is not on the screen presently.<br />	<br />----------------------------------------------------------------------<br />FP06. BUGS AND UNFINISHED THINGS IN THE CURRENT RELEASE<br />----------------------------------------------------------------------<br />The game may lag on some older machines, due to how much information the game has to process from the internal scripts. Aside from that, there are no other bugs I am aware of currently. <br /><br />The Type Chart is not completely done yet, expect that in a future release with Pokemon and Touhoumon types conjoined.<br /><br />Pokemon and Touhoumon do not have abilities that exist side-by-side. That will come in a future release.<br /><br />----------------------------------------------------------------------<br />FP07. CHANGE LOG<br />----------------------------------------------------------------------<br />201*: Beta 3<br />- A NEW GAME WILL NEED TO BE STARTED DUE TO A SMALL CHANGE MADE IN HOW THE GAME HANDLES SOMETHING IN THE INTRODUCTION. IF YOU DO NOT START A NEW GAME, A LATER EVENT WILL NOT WORK.<br />- At the request of numerous people, the Red battle now gives out EXP if you beat him. This change was made on 5/12/2013.<br />- Changed the Red overworld sprite to be a different one. Source unknown, was provided with the old Essentials kit. (5/16/2013)<br />- Changed some puppets, according to the Touhoumon Emerald change list (5/16/2013):<br />	* Chibi Daiyousei now carries Camouflage at a 5% rate instead of Sitrus Berry<br />	* Mystia line now carries Stewardess at a 5% rate instead of Chesto/Petaya Berries<br />	* TSanae now naturally learns Giga Drain instead of Mega Drain<br />	* Gengetsu now gives Speed EVs instead of Special Defence EVs<br />	* Iku line now able to learn Surf.<br />	* Yuugenmagan now has a new ability; Levitate. Replaces Keen Eye.<br />	* TSakuya now learns Luster Purge by Tutor.<br />	* Yoshika line now has Gatekeeper as an ability. This replaces Guard Armour.<br />	* Seiga line is now Dark/Faith instead of Dark/Reason. Additional changes include:<br />		+ Chibi: SDEF+5<br />		+ Evo: ATK-5, SDEF+10<br />		+ Learns Extrasensory instead of Mana Burst at level 53<br />		+ Learns Silver Wind instead of Luster Purge by breeding<br />	* Tojiko no longer learns Aeroblast.<br />	* Futo line now has Torrent instead of Inner Focus.<br />	* Miko line gained Limber as an Alternate Ability.<br />- Updated the engine to Pokemon Essentials v12.2. Any bugs that were present in Pokemon Essentials before that are fixed in this build. (10/9/2013)<br />- Added a way to change the control scheme ingame. (10/9/2013)<br />- Unown cries were given to a majority of the Touhoumon, to make evolutions work. Otherwise it would crash the game if it evolved into something without a cry. (10/10/2013)<br />- Added a PC to Bill&#039;s House. I mean seriously, it makes sense to have a PC all the way out there, at the location of the person who made the PC System. (11/17/2013)<br />- Changed some puppets, according to the Touhoumon Emerald change list (11/17/2013):<br />	* Evolved Nazrin: Learns Slash at Level 40 instead of Roar. Also learns Body Slam as a Tutor Move instead of Quick Attack.<br />	* Evolved Letty: Gains Focus as an Alternate Ability instead of Damp. Also Changes were made to her BST.<br />	&nbsp; &nbsp; Old&nbsp; &nbsp; &nbsp; New<br />		75&nbsp;  HP&nbsp;  85<br />		70&nbsp; ATK&nbsp;  60<br />		80&nbsp; DEF&nbsp;  85<br />		80&nbsp; SPD&nbsp;  70<br />		115 SATK 115<br />		80&nbsp; SDEF&nbsp; 85<br />	* Technical Iku: Swapped Attack and Special Attack Stats.<br />	* Seiga Line: Can learn Decision via TM.<br />- Chibi Kokoro and Kokoro, the final boss of Touhou 13.5: Hopeless Masquerade, was added to the list of obtainable puppets. (5/28/2013)<br />	* This is more than likely the last new puppet that will be added from games post 13.<br />	* There will be a Level 5 Chibi Kokoro Mystery Gift up until the full release of Kanto. get it while you can! (11/20/2013)<br />- Added a Hiker to the Route 10 Pokemon Center. The Hiker gives you Flash, so you can use it to illuminate cave systems. (11/22/2013)<br />	* No, Flash will not act like a Repel Replacement like it does in Generation 6. (At least, I don&#039;t intend to make it that way.)<br />- Items were added to Demo 2 locations. NPCs were added to the Power Plant and the Vermilion City Houses. (10/10/2013 - 11/25/2013)<br />- Modified the Text Speed settings a microbit. Should go a bit faster. Maybe. (11/25/2013)<br />- Demo ends at Fuchsia City, as there is no way to surf across the ocean.<br />	* Surf and the Inflatable Boat will be available, but Cinnabar Island is not accessible in this demo.<br /><br />April 22nd, 2013: Beta 2<br />- Fixed some minor bugs pertaining to text, tiles on the overworld, and the sort.<br />- Opened up Route 3 to the player, allowing them to travel to Mt. Moon and onward.<br />- Fixed an issue involving Evolutionary Stones not being able to be used<br />- Added NPC houses to Pallet Town, Viridian City, and Pewter City.<br />- Added the items within Viridian Forest.<br />- Tinkered with the trainers and encounters on Route 1. Should be bit easier now than it was.<br />- Added the Burn Heal to Viridian City Mart.<br />- Added the Antidote, Awakening, Burn Heal, Parlyz Heal, Escape Rope, and Repel to the Pewter City Mart.<br />- Changed the music within Pokemon Centers.<br />- Fixed some music issues with inconsistent sound quality.<br />	* Not all songs have been fixed yet. Some are still forthcoming. Expect more music changes in later releases.<br />- Minor modification to the Pickup Table. You should no longer be able to pick up Sun Stones, Moon Stones, or Heart Scales.<br />- Added the ability to give the watering pail to the player. It&#039;s in Viridian City, with the person standing in a small garden of flowers.<br />- Minor alterations to Viridian City&#039;s layout. Should be marginally easier to traverse.<br />- Fixed some issues with the Town Map not showing the correct location of where you are.<br />- After much blood, sweat, and tears, the gender icons now show up as Yin and Yang Halves, much like they do in 1.8 proper.<br />- The route north of Viridian City, Route 2, has had some minor altering done to it. If you are currently saved on Route 2, please move off of it so you aren&#039;t stuck on something that may have changed.<br />- Pewter Museum&#039;s NPCs will not show up unless you start a new game. I highly suggest starting a new one.<br />- Various text strings have been changed to show Species-Neutrality.<br />	* I&#039;m not sure if I missed any. If I did, please send me a message at one of the contact links below.<br />- Silently added the Jukebox to the player inventory at game start. The Jukebox can play all the songs in the game.<br />	* NOTE ABOUT THE JUKEBOX: It will override all other music in the game while it is playing. To disable, go back to the jukebox and press &quot;(Default)&quot;.<br />	* Icon forthcoming<br />- Gave places with Automatic Doors a proper Sound Effect.<br />- Changed the icon that the game uses on the taskbar and the launcher.<br />- Minor changes to Pallet Town<br />- Placed a demo-ending roadblock at Rock Tunnel and all currently accessible ways into Saffron City. <br />	* You are not allowed to advance into Rock Tunnel, Saffron City, Celadon City, or Lavender Town in this release.<br /><br />January 2nd, 2013: Beta 1 (Proof of Concept)<br />- Initial Release<br />- Currently went from Pallet Town to Pewter City, placed a demo-ending roadblock at Pewter City.<br /><br />----------------------------------------------------------------------<br />FP08. GRATITUDES AND CREDITS<br />----------------------------------------------------------------------<br />I&#039;m proud to say these people have helped make this possible<br /><br />- Nintendo, Game Freak: Pokemon, of course! Pokemon&#039;s just left a large impact on todays world, and it&#039;d be pretty hard to imagine what life would be like without it as a contributing factor.<br /><br />- ZUN: Head of Team Shanghai Alice, also the Lead and Sole developer of the Touhou Project.<br /><br />- Enterbrain: For developing RPG Maker XP.<br /><br />- HemoglobinA1C: Head honcho of the entire Touhou Puppet Play business. Developed the original THPP, and all the graphics that went along with it, up till its current and final release in 1.812. His blog can be found at:<br />	* http://hemoa1c.blog22.fc2.com/<br />	<br />- Poccil, Flameguru: For initially creating Pokemon Essentials for RPG Maker XP<br /><br />- Maruno: Picking up Pokemon Essentials after Poccil and Flameguru stopped updating it, and continuing to work on it to this day.<br /><br />- Agastya: For numerous things. Developing Touhoumon Emerald 1.812, which this game used as a base import from, as well as development feedback and advice, as well as the occasional beat to the head when I did things wrong, and how I could theoretically improve them. He also helped to localize Touhoumon 1.8x.<br /><br />- EX Sariel: Helped to localize Touhoumon 1.8.<br /><br />- digiDiskette, Kaena, LeoModesto, Stuffman: Providing with graphics when they were needed in the situations that called for them.<br /><br />- Mugendai (DoctorInfinity): Writing the PokeExtractor tools, which extracted the Touhoumon information from Touhoumon Emerald and compiled it into the proper format needed to insert it into RPG Maker XP. Also helped provide the Title Screen graphic.<br /><br />- The Pokemon Essentials Development team gets a special shout out, since I don&#039;t know who all is helping Maruno.<br /><br />- And YOU: For playing this game, and hopefully enjoying it!<br /><br />----------------------------------------------------------------------<br />DERX. CONTACT INFORMATION<br />----------------------------------------------------------------------<br />I can be reached at my Tumblr account if needed for anything:<br />	* http://derxwnakapsyla.tumblr.com/<br /><br />If you have bugs to report about the game, the DevKit, or want to report an unauthorized distribution site, please send it to the ChaoticInfinity Development Blog at:<br />	* http://chaoticinfinitydev.tumblr.com/<br />	<br />If you would like to get ahold of me in Real-time, I can be reached at these places:<br />	* IRC server: irc.rizon.net<br />	* IRC Channel: #ChaoticInfinity OR #Letohhalb<br />	* Link: irc://irc.rizon.us/chaoticinfinity OR irc://irc.rizon.us/letohhalb<br />	<br />Or the Shoddy Touhoumon server (You will have to download the client and register an account in the program): <br />	* http://thpp.supersanctuary.net/forum/index.php?topic=7.0<br />	<br />----------------------------------------------------------------------<br />LEGAL INFORMATION<br />----------------------------------------------------------------------<br />I do not own Pokemon nor Touhou, and I don&#039;t own any of the characters either.<br />Pokemon is (c) Gamefreak/Nintendo, Touhou is (c) Team Shanghai Alice.<br />I do not own any of the sprites featured in this game, any custom sprites were nabbed<br />from the Japanese Touhou Puppet Play 1.8 hack, or made by other people listed in the credits.<br />[/quote]<br /><br />Hi Derx, are you still working on this game?


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Also, I made the Forum Games board publicly viewable again. So hopefully there&#039;s more participation in that board.


subject: Re: Making &quot;Super Glitch&quot; moves useful (Red/Blue/Green)
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the info, but won&#039;t the 50 be missing then ? Is the glitch actually dangerous if there&#039;s no 50 ?


subject: Re: My Box 1 Is glitched. Is there any way to reset it?
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Are you able to Move Pokemon w/o Mail? See if that works, I read that someone had a similar issue and fixed it that way: [url=https://www.reddit.com/r/pokemon/comments/7ubmo0/warning_you_can_in_fact_glitch_out_your_game_to/]https://www.reddit.com/r/pokemon/comments/7ubmo0/warning_you_can_in_fact_glitch_out_your_game_to/[/url]


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;It&#039;s a &quot;Bert decides to call one of his friends and then realizes that even though they have his number they never call him&quot; episode<br /><br />Oh well maybe tomorrow.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Xavi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg208931#msg208931 date=1521631623]<br />The PokÃ©mon setup isn&#039;t the cause (nothing / a crash would have happened if it was wrong). The item setup needs to be modified to account for the memory address change in EU versions.Â²<br />[/quote]<br />I know I need to modify the items, but in what way?<br />Quoting myself: &quot;There&#039;s any way to translate from english to Spanish?&quot;<br /><br />I&#039;m a n00b in ACE, I understand it exploits de 8bits of the game and can copy the item and pokÃ©mon set up, but not create or undersant how to done them.<br /><br />Thank you.


subject: Re: The whole site Translated into a few languages with Google Chrome.
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  https://www.bing.com/translator<br /><br />I use Microsoft&#039;s translator to read posts from Japanese people on Twitter.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ll try to help you as soon as i have a moment :)<br /><br />(But for the future you should try to learn some basics :))


subject: Re: Safe code for ace
poster_name: DocB
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: DocB
icon: xx
body:
  [quote author=ISSOtm link=topic=8284.msg208930#msg208930 date=1521631548]<br />The problem with `ld b, b` is that it maps to the Gold Tooth item, the quantity of which you can&#039;t modify. So that removes most of its usefulness.<br />[/quote]<br /><br />In wich way? ld b,b desn&#039;t simply put the value of the b semiregister in the b semiregister


subject: Re: Safe code for ace
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  He&#039;s talking about the item matching the hex ID for ld b,b.<br /><br />Inc b/d and dec b/d are better placeholders because they match cheap items and low quantities.


subject: Re: &quot;ZZAZZ glitch&quot;?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Funny little trivium. In the Japanese versions the hex:99 character is ãƒ (ha). So by performing the ZZAZZ glitch a lot of ãƒ (&quot;ha&quot;) appear in your name (hence the glitch could be named for instance the &quot;hahaha glitch&quot;) and hahaha happens to be of course an expression for laughing.


subject: Re: Open role play
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Sasara link=topic=8271.msg208859#msg208859 date=1521003303]<br />You don&#039;t have to commit to the character, and multiple characters is allowed.<br />[/quote]<br /><br />I see, thanks Sasara.<br /><br />*A mouse falls from the sky on to My Melody&#039;s face. It is Flat-kun.*<br />My Melody: Ahhh Flat-kun! ^^ What brings you to my house today?<br />Flat-kun: My Melo! Absent minded as always, can&#039;t you see I could have got hurt by the fall?<br />My Melody: Ohhh.. Me also can&#039;t wait for fall, beautiful Autumn leaves hehe.<br />Flat-kun: ......<br />Flat-kun: So My Melo, have you ever been to space?<br />My Melody: No, My Melo would love to go though.<br />Flat-kun: Luckily for us, I won tickets to go to space. But there was a fault in the rocket, it exploded, I could have died. Fortunately I ended up right in your garden though.<br />My Melody: That&#039;s sad :(. <br />Flat-kun: They have fixed the rockets now though. They did get a huge fine for their damages but no one high up ever prosecuted them for their wrongs... you know, large corporations; they often get away with what would be considered a serious crime for a laymen. <br />My Melody: Ahhhh<br />Flat-kun: But we can go to space again now My Melo, they made great care for the same thing not to happen again. Would you like to go?<br />My Melody: Yesss, My Melo would love to.<br />Flat-kun: All right then.&nbsp; :)<br /><br />*So My Melody and Flat-kun head off to the national space centre, where they book in to ride the next rocket*


subject: PokÃ©gear map glitch (Gold/Silver/Crystal)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  SatoMew found this and shared it with me on Discord. It works in both English Gold and English Crystal and likely most if not all other versions (I think SatoMew may have researched it for one of the Japanese versions first but I&#039;m not entirely sure). Today I decided to research it a little. Note you need the PokÃ©gear map from the guide in Cherrygrove City before doing this.<br /><br />What you need to do to 100% replicate this glitch is to be in a Johto location and then warp to Pallet Town, prior to having visited Kanto before.<br /><br />This can be done with either the GameShark codes 010D00DA and 010201DA (Gold/Silver) or 010DB5DC 010DB6DC (Crystal) or arbitrary code execution. To use these codes, activate them in a PokÃ©mon Center, then go up to the second floor and back down again. You should warp to Pallet Town.<br /><br />[img]https://i.imgur.com/C7YDPqb.png[/img]<br /><br />Next you need to go to the PokÃ©gear map and scroll down from Pallet Town (from now on you must scroll down, if you scroll up you may not be able to access all the available locations from this glitch). If done correctly the game should erroneously give Johto locations while the map is still in Kanto. If you go down further you should encounter glitch locations.<br /><br />[img]https://i.imgur.com/cVG8hFJ.png[/img] [img]https://i.imgur.com/lKMDpaj.png[/img] [img]https://i.imgur.com/Y2l22U8.png[/img]<br /><br />Many of these glitch locations take their name from VRAM (and are presumably subject to VRAM inaccessibility hence the many 9s in their name). However, if I remember rightly two of these glitch locations were taken from Echo RAM. The only one I remember though is sourced from E88E (Echo RAM for C88E).<br /><br />The contents of this address can be modified with arbitrary code execution (without the need of OAM DMA hijacking to lock it) so you can create cool screens such as this (Cloud City was the subject of a PokÃ©god rumour in the past):<br /><br />[img]https://i.imgur.com/hS50axJ.png[/img]<br /><br />An E88E location is also available for the Crystal selection of locations and glitch locations.<br /><br />Side-note:<br /><br />Map 21FF (DA00=21, DA01=FF) in Gold and Silver is a non-freezing glitch map.<br /><br />I don&#039;t know what controls its PokÃ©gear location, however this time it was set to SPECIAL and scrolling down would also eventually bring up the E88E location.<br /><br />So perhaps you don&#039;t need to have accessed Kanto earlier than you&#039;re supposed to (although more research is needed regarding whether that is a requirement at all).<br /><br />[img]https://i.imgur.com/0q2OKEb.png[/img] [img]https://i.imgur.com/8FzGvPw.png[/img]<br /><br /><br />Edit: A video :)<br /><br />https://www.youtube.com/watch?v=r32agevxdw4


subject: Mail glitch discovered in US version of Emerald.
poster_name: Npo
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Npo
icon: xx
body:
  By using a sub glitch of the instant pomeg glitch, I was able to recreate the Mail glitch from Ja Ruby and Sapphire.<br /><br />[b]How to perform:[/b]<br />First you need to have a party containing the Instant Pomeg glitch Pokemon (0x29C0 for emerald US) in the first slot, a dummy Pokemon that will be sacrificed, and a third Pokemon to give some mail. Make sure you have plenty of mail to give to your Pokemon and some extra dummy items to give to your Pokemon to swap out for the mail, antidotes are pretty cheap. Then perform the instant Pomeg glitch by talking to the reporter at the Pokemon fan club to remove the first Pokemon in your party.<br /><br />The first thing to note about this glitch is that when you give a pokemon outside the normal party an item, so by pressing up twice after opening the party menu and then selecting the item option, the item will not be given to the selected pokemon but instead be given to the first pokemon in your party, in this case the empty space, and will replace whatever item the Pokemon was holding. We make use of this to replace the mail item the pokemon is holding without properly deleting the message atached to the mail.<br /><br />so once you have the IPG set up just follow these steps.<br />Step 1) Open the pokemon menu and press A, then give the pokemon some mail and write any message.<br />Step 2) press UP twice then A, give the pokemon an antidote (or any non mail item).<br />Step 3) press A and give the Pokemon a new piece of mail swapping out the antidote. (the selected Pokemon will have moved back to the first Pokemon in your party)<br />Step 4) repeat steps 2 and 3 6 times until you will see the message allready filled out when giving the pokemon mail, (you wil have to write a new message this time)<br />Step 5) give the third pokemon in your party mail and you will see the mail message be filled with question marks (most likely, there may be other messages in their too).<br /><br />[b]Potential Uses of glitch[/b]<br />So unlike the Ja version of Ruby/Sapphire when changing the message of the glitched mail you will not alter tile data on the map, however you will be changing the Pokemon sub data of the Box 2 slot 27 Pokemon (Bottom row 3rd slot). if you move any Pokemon away from that space and then write a message, an invisible bag egg will appear there.<br /><br />The data you corrupt starts at the second word of the second substructure of Pokemon data, and will end at the last byte of the third substructure. So on the in game traded Seedot that would be from experience in Growth substructure up to PP of move 4 in Attack substructure.<br />This means we have a new way edit one of the substrucers of a pokemon! For example we could alter the EVs gained by a pokemon without having to worry about the 510 EV limit or have to worry about messing up the EV training. Another great thing about this corruption is that it&#039;s 100% consistant, so there is no randomness involved!<br /><br />Another use of this is that based off the messages that appear in the mail you can read the Pokemon&#039;s substructure, so you could potentially use this to calculate a Pokemons entire TID. However because of the limited number of valid messages that can appear, versus the total possible amount of data, there is about a 1 in 64 chance of a given two bytes of data being readable. however this is much more likely than finding a shiny Pokemon, which would be the only other method of legitimately finding out your entire TID. <br /><br />[b] Limitations [/b]<br />As mentioned before, because there are only about a thousand or so valid messages, you are quite limited in the number of bytes you can write to the Pokemon data and because of the check sum you would have to be careful in how you make these changes so as to not cause a net change in sum. However with some more research I believe this find can be very useful!<br /><br />I plan to continue to research this glitch and update my findings here, and If there are any questions I will try my best to answer them! :)


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Amazing! Thanks for this Npo.<br /><br />While I don&#039;t fully understand the process, in the Japanese version there was also a recently documented way to get infinite Rare Candies. (https://www.speedrun.com/pkmnrubysapphire/run/yjk2ldnm) Could this be applied to Rare Candies or Master Balls in the English version too?


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Npo
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can use this to get infinite items by having the Pokemon in the third slot hold an item, every time you give them mail after performing this glitch you will receive the item they were holding but the Pokemon will still be holding the item in their hand, you can then repeat this process as many times as needed so long as you have enough pieces of Mail. However I doubt this would be useful in a speedrun, as to perform the glitch requires having an &#039;empty&#039; Pokemon in the first slot of your party, and the only way i know of to do this is through the Pomeg Berry glitch. I&#039;m sorry if my description of how to perform the glitch isn&#039;t very clear, I will try to come up with a better documentation so that others can recreate it.


subject: Re: (G/S) &quot;Bad Clone&quot; (hex00) acquisition without ACE or Save Corruption
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  *bump*<br /><br />SM has confirmed that this works in Korean Gold/Silver on Virtual Console, so this is a likely indicator it works on the other non-English localizations as well.<br /><br />https://www.youtube.com/watch?v=NXvpmSmhtYU


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Npo link=topic=8289.msg208958#msg208958 date=1521820663]<br />You can use this to get infinite items by having the Pokemon in the third slot hold an item, every time you give them mail after performing this glitch you will receive the item they were holding but the Pokemon will still be holding the item in their hand, you can then repeat this process as many times as needed so long as you have enough pieces of Mail. However I doubt this would be useful in a speedrun, as to perform the glitch requires having an &#039;empty&#039; Pokemon in the first slot of your party, and the only way i know of to do this is through the Pomeg Berry glitch. I&#039;m sorry if my description of how to perform the glitch isn&#039;t very clear, I will try to come up with a better documentation so that others can recreate it.<br />[/quote]<br /><br />I see, thanks.<br /><br />That&#039;s OK. :) Your description is clear, it&#039;s just in general I tend to have difficulty processing new glitches sometimes before I try them.


subject: Re: Making &quot;Super Glitch&quot; moves useful (Red/Blue/Green)
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Tabbender
icon: xx
body:
  Okay, so something really weird happened to me.<br /><br />I switched to a box with exactly 9 Pokemon in it and since i did, the glitch started to work really well. I caught 6 MissingNo&#039;s and a Mankey. However, i then tried to load Pokemon 255 (Charizard &#039;M). When i tried to get to my Ditto&#039;s moves the game froze. Then i reseted, and since then i&#039;m back to the state where i seemingly can&#039;t perform the glitch. <br /><br />That&#039;s weird. I&#039;ll try to have less Pokemon in the current box and see what happens. Also, do you think the freeze might have anything to do with this or was it just a coincidence ?


subject: Re: New Viridian Forest arbitrary code execution method
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Gifvex did a TAS of this glitch, which was published on the TASVideos website yesterday.<br /><br />http://tasvideos.org/5859S.html<br />https://www.youtube.com/watch?v=7MI_s3xcE-c


subject: Re: PokÃ©gear map glitch (Gold/Silver/Crystal)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  I initially found it in Korean Gold and Silver and then checked Japanese Crystal.<br /><br />p-p-pfero from the pret Discord looked into the bug and found it was in [url=https://github.com/pret/pokecrystal/blob/master/engine/pokegear.asm#L664-L673]this snippet[/url]:<br /><br />[code].down<br />&nbsp; &nbsp; ld hl, wPokegearMapCursorLandmark<br />&nbsp; &nbsp; ld a, [hl]<br />&nbsp; &nbsp; cp e<br />&nbsp; &nbsp; jr nz, .wrap_around_down<br />&nbsp; &nbsp; ld a, d<br />&nbsp; &nbsp; inc a<br />&nbsp; &nbsp; ld [hl], a<br />.wrap_around_down<br />&nbsp; &nbsp; dec [hl]<br />[/code]<br /><br />The fix:<br />[code]<br />.down<br />&nbsp; &nbsp; ld hl, wPokegearMapCursorLandmark<br />&nbsp; &nbsp; ld a, [hl]<br />&nbsp; &nbsp; inc e<br />&nbsp; &nbsp; cp e<br />&nbsp; &nbsp; jr nc, .wrap_around_down<br />&nbsp; &nbsp; inc d<br />&nbsp; &nbsp; ld [hl], d<br />.wrap_around_down<br />&nbsp; &nbsp; dec [hl]<br />[/code]<br /><br />And I&#039;m glad that it was exploitable for ACE! :) 


subject: Custom maps?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  I was wondering whether this was possible yesterday.<br /><br />With the Generation II location digits covering 65536 maps (two bytes), could it possible that at least one of these maps take their data from RAM?<br /><br />Also the first digit for the map as well is apparently the bank. I don&#039;t know the Game Boy well enough or have tested anything to assert this, but could out of bounds banks represent RAM?<br /><br />You can access glitch maps with 01xx00DA, 01xx01DA (requires being in a PokÃ©mon Center going up the floor and back down) or 01xx44D0, 01xx45D0 (walk through a door) (Gold/Silver) or 01xxB5DC 01xxB6DC (PokÃ©mon Center floor requirement) (Crystal).<br /><br />Would be cool if we could have our own town to go to without having to modify an existing one. :)


subject: Re: PokÃ©gear map glitch (Gold/Silver/Crystal)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the info! :)<br /><br />[quote author=SatoMew link=topic=8288.msg208966#msg208966 date=1521835340]<br />And I&#039;m glad that it was exploitable for ACE! :) <br />[/quote]<br /><br />Yeah, if I remember rightly while the details are hazy you can execute arbitrary code with this or at least a freeze either by closing the PokÃ©gear map from certain locations or as a side effect of the name in Crystal. Then you have the maps with arbitrary names which while they do not execute code can be customized to any location name you want as long as long as it fits.


subject: Tile 0x3E bump noise glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Is anybody able to replicate this?<br /><br />Source: https://github.com/pret/pokecrystal/blob/master/docs/bugs_and_glitches.md<br /><br />[quote author=PokÃ©mon Crystal disassembly]<br />No bump noise if standing on tile $3E<br />This is a bug with DoPlayerMovement.CheckWarp in engine/player_movement.asm:<br /><br />; Bug: Since no case is made for STANDING here, it will check<br />; [.edgewarps + $ff]. This resolves to $3e at $8035a.<br />; This causes wd041 to be nonzero when standing on tile $3e,<br />; making bumps silent.<br /><br />	ld a, [wWalkingDirection]<br />	; cp STANDING<br />	; jr z, .not_warp<br />	ld e, a<br />	ld d, 0<br />	ld hl, .EdgeWarps<br />	add hl, de<br />	ld a, [wPlayerStandingTile]<br />	cp [hl]<br />	jr nz, .not_warp<br /><br />	ld a, 1<br />	ld [wd041], a<br />	ld a, [wWalkingDirection]<br />	; This is in the wrong place.<br />	cp STANDING<br />	jr z, .not_warp<br />[/quote]<br /><br />I don&#039;t quite know how to replicate this bug and what type of tile or event the page is referring to here.<br />(Is it to do with things like exit mat warps?)<br /><br />However the 0x3E sub-tile varies between tilesets and can easily be found with BGB.<br /><br />Example:<br /><br />[img]https://i.imgur.com/nfOoQC8.png[/img]<br /><br />When I lock D041 to 01 the bump sound for touching a wall still persists. Setting a breakpoint to D041 on read confirms it is read while touching a wall or using a warp though.<br /><br />I tried bumping into a wall while I was standing on a tree (which contains the 0x3E sub-tile on the bottom-right) but with no luck unfortunately, the &#039;bump&#039; noise still occurred.<br /><br />I wonder if &#039;tile&#039; could be referring to objects that consist of the &#039;sub-tiles&#039; in a 2x2 pattern like the sub-tiles on the VRAM viewer in the image above, but haven&#039;t been able to test if you can manipulate those. I imagine though that these may be arranged in blocks, as was the case in Generation I.<br /><br />Example:<br />This glitch block top-left edited in is the first block, the tall grass block the second block, the greenery the third block, greenery on the left and bushes on the right the fourth block and so on.<br /><br />[img]https://i.imgur.com/laI3Ktv.png[/img]<br /><br />Thanks.


subject: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello everyone! This might be a bit long-winded, but I&#039;ve got some stuff to say quickly first. To start, I want to give a huge thanks to SatoMew and everyone else on the GCL Discord for assisting with this glitch research and helping with translations. I will give credit where credit is due as needed, of course. Second, I apologize for having to provide Imgur links for the pictures, I am playing on cartridge and don&#039;t really have any reliable method of taking screenshots apart from straight up taking pictures of my GBA. Finally, I&#039;ll be updating this thread on a regular basis with new content that I am hoping to add to the GlitchDex in the future. I am playing Pocket Monsters Red version 1.1 (22A is on the sticker), so some of these glitches may be different in version 1.0 and Pocket Monsters Blue/Pikachu.<br /><br />Without further ado, allow me to share my notes so far!<br /><br />[u][b]3/23/18[/b][/u]<br /><br />[b]191[/b]<br /><br />Hex- BF<br /><br />Name (romanized)- can be interpreted as Zu, Dzu, or Du<br /><br />https://imgur.com/UXnfnlX<br /><br />Cry- Nidoran (female)<br /><br />Zu will cause the game to delay for a good amount of time on the black battle transition, so much so I thought the game had froze the first time I encountered it. The battle music will become corrupted and the game might softlock before the &quot;wild Pokemon appeared&quot; message is shown, but not always. I&#039;m not sure exactly why that happens, it may have something to do with the music corruption. It may be similar to Yellow Missingno in that it may corrupt the sound bank. Any insight on this phenomenon would be appreciated :)<br /><br />Pokedex- https://imgur.com/m3BwmBP<br /><br />Pokedex data triggers the Rhydon trap.<br /><br />Stats page- https://imgur.com/vRn7ndw<br /><br />Type- Normal/Boy (LOL what?)<br /><br />Moves- https://imgur.com/5kEiOuM<br /><br />Moves (at level 7)- Screech, Pay Day, Cut, TM05<br /><br />[b]192[/b]<br /><br />Hex-C0<br /><br />Name- A (katakana)<br /><br />https://imgur.com/K46XO11<br /><br />Cry- A quick buzz, reminded me of Tentacool/Tentacruel<br /><br />Pokedex- https://imgur.com/0l0zs1N<br /><br />Stats page- https://imgur.com/nW1Q7aO<br /><br />Type- Water<br /><br />Moves- https://imgur.com/r8swBD7<br /><br />Moves (at level 7)- Bubble, Hypnosis, Water Gun<br /><br />Hmm... given A&#039;s Dex number (61), Water typing, and moves, I think it would be safe to assume that it is a hybrid of Poliwhirl. That&#039;s too bad, since hybrid glitch Pokemon don&#039;t usually have much going for them :(<br /><br />[b]193[/b]<br /><br />Hex- C1<br /><br />Name (romanized)- Fuizi<br /><br />https://imgur.com/vqCQJez<br /><br />Cry- Slowpoke<br /><br />Pokedex- https://imgur.com/Du48M95<br /><br />Pokedex data triggers the Rhydon trap.<br /><br />Out of the glitches I&#039;ve played around with so far, Fuizi has been the most interesting of the bunch. When encountered, it will increase the quantity of the third item. I started with one Elixir, but ended up with 18 of them. SatoMew had 5 Poke Balls and ended up with 21. Another thing I noticed quickly was that when captured (after seeing the Dex entry to avoid the Rhydon trap), the game would hang as soon as &quot;Yes/No&quot; was selected after the nickname prompt. Curious, I inquired about it on Discord. Both SatoMew and Parzival used BGB and found that Fuizi points to address FFB8 in HRAM, but none of us were able to figure out exactly what that was. SatoMew found that Fuizi knows Disable (at least at level 3) and awards 0 experience when defeated. What Parzival found was quite intriguing. Fuizi&#039;s softlocking seems to be caused by the game executing address 4318 in ROM bank 10h, but once again none of us were able to figure out what that is exactly. Parzival persevered and looked in further and found out that the hang was caused by a division by 0- caused by Fuizi&#039;s [i]sprite[/i] of all things. Apparently the sprite buffer is not written to during decompression, and it seems something goes terribly wrong from there. If anyone has any more insight on this, I&#039;d be curious to hear about it.<br /><br />[b]194[/b]<br /><br />Hex- C2<br /><br />Name (romanized)- Gi[arrow]ago<br /><br />https://imgur.com/Y58BUyS<br /><br />Cry- a short, staticky buzz<br /><br />When captured, no Pokedex entry is shown for reasons unknown to me at the moment. Upon capture, the game would hang after choosing &quot;Yes/No&quot; after the nickname prompt. Unfortunately, unlike with Fuizi, I haven&#039;t been able to find any explanation as to why the game hangs, so insight is greatly appreciated.<br /><br />[b]195[/b]<br /><br />Hex- C3<br /><br />Name (romanized)- Amu (mu character has a dakuten above it, which I have been told is not supposed to be there)<br /><br />https://imgur.com/nXdxGx4<br /><br />Cry- Kangaskhan<br /><br />Pokedex- https://imgur.com/qLg6E6C<br /><br />Stats page- https://imgur.com/dAN58sX<br /><br />Type- Poison<br /><br />Moves- https://imgur.com/khVsh7E<br /><br />Moves (at level 7)- Pound, Disable, Poison Gas<br /><br />Seems to be another hybrid, this time of Muk. Kind of disappointing, but this is all in the name of science!<br /><br />That&#039;s all for now! I hope to get all the other glitch Pokemon that are obtainable through the Mew glitch, then hopefully find a method more reliable than the fossil conversion glitch for the glitches from index 200-255, but if that&#039;s the method I have to use then so be it. Like I said, for science!


subject: MOVED: Should I write a malware-collector starter guide?
poster_name: Sasara
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=//forums.glitchcity.info/index.php?board=9.0]General Discussion[/url].<br /><br />[iurl]//forums.glitchcity.info/index.php?topic=8193.0[/iurl]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  [b]add 1 to id of item 1 (early game viable version)[/b]<br />Uses [b]stored items[/b] starting from stored item 3. Requires Quagsire with Sleep talk as first move and holding protein.<br /><br />Item 3: poke ball x 38 <br />Item 4: TM 23 x 04 <br />Item 5: Fresh Water x 23 <br />Item 6: X speed x 04 <br />Item 7: TM10 x any <br /><br />[code]<br />dec b<br />ld h,d6<br />inc b<br />ld l,17<br />inc (hl), inc b<br />ret<br />[/code]<br /><br />lots of filler but this way you don&#039;t require anything you can&#039;t easily get early game (use torchicken&#039;s get all tms and hms code, or the modified 255x version, first for the tms).<br /><br />The best thing about this is it&#039;s easy to change to decrement, or to change to item 1 quantity. To make it decrement boxed item 1&#039;s id by 1, change x speed to x special. To make it increment item 1 quantity, make it Fresh Water x 24. To make it decrement item 1&#039;s quantity, do both. Note you can use this to get pretty much any item setup you will need, ever (withdraw all but 1 of item in slow 1, decrement twice, withdraw all but amount you need) However, I&#039;d use it to get certain things and then do a more efficient setup once you had what you&nbsp; needed for said more efficient setup.<br /><br />For example:<br />[b]<br />Write to any byte in memory by Wack0, ported by Azarokkusu[/b]<br /><br />Same Quagsire setup here.<br /><br />Item 3: Full Heal x XX ; XX = higher byte of address you&#039;re going to write to<br />Item 4: Fresh Water x XX ; XX = lower byte of address you&#039;re going to write to<br />Item 5: PP up x XX ; XX is value you want to write<br />Item 6: Focus Band x 201<br /><br /><br />[code]<br />ld h,xx<br />ld l,xx<br />ld a,xx<br />ld (hl),a<br />ret<br />[/code]<br /><br />You could do 1 less item with coin case x (value you want to write) but then you can&#039;t see what that value is because key items.<br /><br /><br /><br />Here&#039;s a sprawling code to set the quantity of all your items in your items and balls pockets to 0 AND all your hms and tms to a quantity of 255. Note you can&#039;t have 0 of a tm in your tm pocket or it doesn&#039;t show up, but you CAN have 0 of a tm in your box. This is due to it storing inventory TMs only as quantities, but box items as ID and quantity. Also, getting ? (id $0) is incredibly easy if you already underflowed your ball pocket, but is also doable with the above code.<br /><br />Same Quagsire setup again<br /><br />	item 3: X accuracy x 183 <br />	item 4: TM22 x 6<br />	item 5: repel x 62<br />	item 6: master ball x 61 <br />	item 7: dire hit x 44 <br />	item 8: ? x 119 <br />	item 9:poke ball x 184<br />	item 10: TM04 x 35<br />	item 11: TM23 x 0<br />	item 12: X accuracy x 252 <br />	item 13: TM 22 x 6 <br />	item 14: Awakening x 184 <br />	item 15: dire hit x 44 <br />	item 16: ? x 119 <br />	item 17:poke ball x 184 	<br />	item 18: TM04 x 51<br />	item 19: TM23 x 0<br />	item 20: X accuracy x 125 <br />	item 21: TM 22 x 6<br />	item 22: X special x 4<br />	item 23: great ball x 04 <br />	item 24: great ball x 184<br />	item 25: dire hit x 119<br />	item 26: X special x 5<br />	item 27: ? x 184 <br />	item 28: TM04 x 71<br />	item 29: tm23 x 201<br /><br />Note the tm04s here are the normal one ($c2), not the one that does nothing ($c3).<br /><br />[code]<br />ld hl,d5b7<br />ld b,14<br />ld a,01<br />dec a<br />inc l<br />inc l<br />nop<br />ld (hl),a<br />dec b<br />cp b<br />jp nz,d623 <br />nop<br />ld hl,d5fc<br />ld b,0c<br />cp b<br />inc l<br />inc l<br />nop<br />ld (hl),a<br />dec b<br />cp b<br />jp nz,d633<br />nop<br />ld hl,d57d<br />ld b,35<br />inc b<br />inc b<br />inc b<br />inc b<br />cp b<br />inc l<br />ld (hl),a<br />dec (hl)<br />dec b<br />nop<br />cp b<br />jp nz,d647<br />ret<br />[/code]<br /><br />The nops can be replaced with inc d, dec c etc etc (since we don&#039;t use c, d etc) but I used nop simply because 1 it&#039;s easy to get high amounts of ? and 2. I wasn&#039;t sure if I&#039;d have to re-write the number of items in each inventory since I had a problem with that earlier where it wrote FF to the bytes you initially set hl to in each setup phase. However that problem is gone now.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  Something nice for y&#039;all. Complete your pokedex (251 seen, 251 caught, and no glitched entries etc)<br /><br />	item 3: X accuracy x 227 <br />	item 4: TM28 x 6<br />	item 5: Ether x 62<br />	item 6: master ball x 61 <br />	item 7: Dire hit x 189<br />	item 8: TM11 x 61<br />	item 9: TM23 x 119<br />	item 10: X special x 20<br />	item 11: pokeball x 184<br />	item 12: TM04 x 35<br />	item 13: TM23 x 46<br />	item 14: Brightpowder x54<br />	item 15: poke ball x 52<br />	item 16: X speed x 46 <br />	item 17: Metal Powder x 54<br />	item 18: poke ball x 52<br />	item 19: X speed x 201<br />	item 20: nugget x 195<br />	item 21: Max revive x 214<br /><br />[code] <br />;setup<br />	ld hl,dbe3<br />	ld b,3f <br />	ld a,01<br />	dec a<br />;execution<br />	inc l<br />	cp l<br />	jp z,d63d<br />	ld (hl),a <br />	dec (hl)<br />	inc d <br />	dec b<br />	cp b <br />	jp nz,d623<br />	ld l,03<br />	ld (hl),05<br />	inc (hl)<br />	inc (hl)<br />	ld l,23<br />	ld (hl),05<br />	inc (hl)<br />	inc (hl)<br />	ret<br />;increase h if l rolls over (first conditional jump)<br />	inc h<br />	jp d628<br />[/code]


subject: Re: Custom maps?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8290.msg208971#msg208971 date=1521856797]<br />Bank IDs wrap around.<br />[/quote]<br /><br />Ah OK. Thanks :)


subject: Map 0xDA00 (English Gold/Silver)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  This is another nice non-freezing glitch map in English Gold/Silver.<br /><br />By sheer coincidence as well, you may be placed on tile above a Surf tile when you get there. You can use a rod in this spot and encounter PokÃ©mon over Level 200 (Umbreon and Hypno), Bulbasaur, ????? and possibly more PokÃ©mon as well.<br /><br />To access this glitch map, go to Cherrygrove City PokÃ©mon Center (important, other PokÃ©mon Centers can freeze) and enter GameShark codes 01DA00DA, 010001DA. Go up and down the stairs. You may be placed in the glitch map.<br /><br />Now face the tile one tile below you and use a rod to get PokÃ©mon.<br /><br />[img]https://i.imgur.com/7XbcKel.png[/img] [img]https://i.imgur.com/YF9brwW.png[/img] [img]https://i.imgur.com/m8k1Dlr.png[/img] [img]https://i.imgur.com/OcHoxTL.png[/img]<br /><br />I haven&#039;t explored this area with walk through walls yet though, which might be interesting.<br /><br />This is like a map hibiki ganaha found with wild Celebi.<br /><br />https://www.youtube.com/watch?v=jEvdkEbCx00<br /><br />The map plays the Vermilion City music and is at a glitched location in Kanto on PokÃ©gear map.<br /><br />[img]https://i.imgur.com/HRt3XBM.png[/img]<br /><br />Edit:<br /><br />More finds!<br /><br />Good Rod:<br />Jigglypuff, Corsola, Staryu<br /><br />Old Rod:<br />????? (FF), Ho-Oh, Jolteon<br /><br />Also try saving and resetting. I&#039;ve had different effects happen depending on where you were standing including non-freezes.


subject: Arbitrary Code for Hidden Power DVs
poster_name: Miku
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Miku
icon: xx
body:
  Hi everyone,<br /><br />This is my first message here. Not my first time, as I&#039;ve known and occasionally read this forum since RBY were released on VC a little over two years ago.<br /><br />I know how to use the w sm glitch item in Yellow. I&#039;ve used it countless times to obtain max DV PokÃ©mon, to clone items and to change Mew&#039;s OT/ID information to GF/22796, which is the event Mew that was distributed a couple years ago.<br /><br />However, I&#039;ve done all those code executions following instructions made by others. I don&#039;t understand what the items correspond to in terms of code etc. I assume that there are a lot of folks here that know how specific arbitrary code is created, so could some one please generate a code / item list for Yellow&#039;s w sm item that would be similar to the max DV code?<br /><br />The video I used as my guide was this: https://www.youtube.com/watch?v=jR5rov2e6PU&amp;t=804s<br /><br />So basically I assume the setup would be exactly the same as it is in that video, but the item list would be different. Also, it would be awesome if the code only changes the DVs and does not max out stat experience. (I really don&#039;t like soft-resetting e.g. Zapdos for a week or so just to get a Hidden Power spread, but I wouldn&#039;t mind training one legitimately.) If it isn&#039;t possible to generate a code that doesn&#039;t max out stat experience, it&#039;s fine, but I would just prefer it to just affect the DVs.<br /><br />I&#039;m looking for the following DV spreads:<br /><br />7 / 14 / 13 / 15 / 15 (Hidden Power Water)<br />15 / 15 / 13 / 15 / 15 (Hidden Power Ice)<br />7 / 14 / 15 / 15 / 15 (Hidden Power Electric)<br />3 / 14 / 14 / 15 / 15 (Hidden Power Grass)<br /><br />The Hidden Power spreads are mainly for the Kanto&#039;s legendary birds, as I would like to use them in Crystal&#039;s Battle Tower.<br />


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Sasara link=topic=8204.msg208977#msg208977 date=1521889527]<br />needs more oldbies<br />[/quote]<br /><br />[quote]Oldbie:<br /><br />This title is granted to those who were on Glitch City Laboratories&#039; previous incarnations at or before 2005.[/quote]<br /><br />Lmao the only oldbies who are even active anymore are admins and mods.<br /><br />[size=7pt]Make me one for shits and giggles.[/size]


subject: Re: BLOOD and other glitches encountered in pirated Green version on MEBOY emulator
poster_name: Mefista
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi, I finally remembered to record two sirviving savestates demonstrating glitches (technically, I have a third one, but it just has me stuck in a pokecentre, unable to move from the place, only rotate...doubt it is interesting).<br />Both of these are a result of select button switches again and again.<br />https://youtu.be/l4ZBsRI_pM4<br />https://youtu.be/COmRODOCwvQ


subject: Re: PokÃ©gear map glitch (Gold/Silver/Crystal)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You&#039;re most welcome and likewise ;)<br /><br />I updated my post to include the complete patch.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: CytricAcid
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  my old accounts been around since 2007, but im really just a longtime lurker whos never contributed anything of worth, oh well.<br />acknowledge me senpai!


subject: Re: BLOOD and other glitches encountered in pirated Green version on MEBOY emulator
poster_name: hpokÃ©_coloradohugge
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  Yo,<br /><br />last year me and a couple of other members from the forum recently did a pretty big project where we went through every glitch pokÃ©mon in Pirate Green version.<br /><br />And yeah it is indeed named BLOOD and i&#039;m fairly certain that the reason for it is because it&#039;s just a false translation of MISSINGNO.&#039;s japanese name Ketsuban. <br />And since blood in japanese is Ketsueki and they couldn&#039;t fit the entire name for the translated english name in the pirated version only the first part of Ketsuban&#039;s name got translated and confused with Ketsueki which is blood.<br /><br />


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: jo12100
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi,<br />I try to go there using the Gameshark codes you mentionned but it desn&#039;t work.<br /><br />Is there any special conditions apart the CherryGrove City Pokemon Center?<br />I&#039;m using English Gold/Silver.


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=jo12100 link=topic=8294.msg208987#msg208987 date=1521979642]<br />Hi,<br />I try to go there using the Gameshark codes you mentionned but it desn&#039;t work.<br /><br />Is there any special conditions apart the CherryGrove City Pokemon Center?<br />I&#039;m using English Gold/Silver.<br />[/quote]<br /><br />Hi.<br /><br />Sorry, I completely forgot to mention another requirement. You must keep these codes on then go up and down the stairs otherwise you won&#039;t warp.


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: jo12100
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Still doesn&#039;t work unknown opcode fc at 8019.<br /><br />I tried PalletTown warp code and it works, don&#039;t know why.


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=jo12100 link=topic=8294.msg208989#msg208989 date=1521991564]<br />Still doesn&#039;t work unknown opcode fc at 8019.<br /><br />I tried PalletTown warp code and it works, don&#039;t know why.<br />[/quote]<br /><br />That&#039;s a shame. That&#039;s probably something about the map then as you definitely warp regardless of the third and fourth digit in the code after going down the stairs.<br /><br />Pallet Town and all real location codes with 01xx00DA 01xx01DA codes should work as they are properly defined.<br /><br />Maybe keep trying it from different PokÃ©mon Centers.<br /><br />Edit: Or there&#039;s the chance it could be an emulator error that it doesn&#039;t work.<br /><br />Edit 2: Shouldn&#039;t be something too big that&#039;s causing it to not work as got it on my Game Boy Advance SP save that hasn&#039;t advanced much from a new game.<br /><br />[img]https://i.imgur.com/7iViQTs.jpg[/img]


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: jo12100
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So is it possible only on real cardriges?<br /><br />It doesn&#039;t work in VBA anyway.<br />How did you get it?


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=jo12100 link=topic=8294.msg208991#msg208991 date=1521994056]<br />It doesn&#039;t work in VBA anyway.<br />[/quote]<br /><br />It has never been a good emulator. Try [url=http://bgb.bircd.org/]BGB[/url], [url=https://sourceforge.net/projects/gambatte/]Gambatte[/url], [url=https://mgba.io/]mGBA[/url], and/or even [url=https://github.com/visualboyadvance-m/visualboyadvance-m]VBA-M[/url] (the present-day maintained version of VBA).


subject: Glitch maps in Pokemon Gold/Silver (my finds)
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: MarcinTVP8
icon: clip
body:
  I searched all glitch maps from 0001 to 0015. These are my finds.<br /><br />0001: Glitch dimension.<br />0002: Varies. One time it froze the game with the music still playing at white screen. One time glitch dimension.<br />0003: Executes code from D621 (stored item 6 ID). This map has potential to be an arbitary code setup.<br />0004: Glitch dimension.<br />0005: Crashes with rst 38. Possibly executing code somewhere, but not in SRAM.<br />0006: Executes code, running into invalid opcode at C310.<br />0007: Glitch dimension.<br />0008: Glitch dimension.<br />0009: Glitch dimension.<br />000A: Varies. One time same effect as in 0006, one time executes code, running into the VRAM area.<br />000B: Glitch dimension.<br />000C: Glitch dimension.<br />000D: Executes code from C300.<br />000E: Glitch dimension.<br />000F: Glitch dimension.<br />0010: Executes code, running into the VRAM area.<br />0011: Glitch dimension.<br />0012: Glitch dimension.<br />0013: Interesing. Freezes for a while, then loads map succesfully but then glitch dimension. I&#039;ve attached what it looks like.<br />0014: Same effect as in 000D.<br />0015: Same effect as in 0002.<br /><br />Don&#039;t worry, more maps will be very soon :)


subject: Re: Glitch maps in Pokemon Gold/Silver (my finds)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Nice finds :).<br /><br />Generally you tend to get these effects:<br /><br />1. Freeze<br /><br />2. Glitch Dimension<br /><br />3. Lock-up before warp<br /><br />4. Glitch map appears to load for a while but freezes (uncommon), like what you got for 0013. Unfortunately get a different effect to you though.<br /><br />5. Explorable glitch map (uncommon-rare)<br /><br />6. Other effect unique to other maps


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=jo12100 link=topic=8294.msg208991#msg208991 date=1521994056]<br />So is it possible only on real cardriges?<br /><br />It doesn&#039;t work in VBA anyway.<br />How did you get it?<br />[/quote]<br /><br />Either there are specific unseen requirements that cause this not to work (which is more common than not, for example the border tiles of the glitch map seems to vary per save file), or it could just be an outdated version of VBA, so if you download the latest one it might work. <br /><br />https://github.com/visualboyadvance-m/visualboyadvance-m<br /><br />I tested this on both VBA v24 svn422 and Nintendo 3DS Virtual Console (TM17 code execution and GameShark codes) and Game Boy Advance SP (GameShark codes).<br /><br />Hope that works out for you.


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: jo12100
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jo12100
icon: clip
body:
  I tested on your recommanded VbaM version and it almost worked?<br />I say almost because it doesn&#039;t seem to be the same place than yours.<br /><br />Edit: I did another try with a new save and lol. Is it totally random?


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah that&#039;s interesting. Darn you glitch, why do you have to be so random lol?<br /><br />I think maybe if this or a similar tile appears in your Glitch City you may be able to use a rod on it if you disable walk through walls before using the rod.<br /><br />[img]https://i.imgur.com/spC4ZYm.jpg[/img]<br /><br />The walk through walls codes are this if you don&#039;t have them:<br /><br />0108A3CE <br />0108A4CE <br />0108A5CE <br />0108A6CE 


subject: Re: Glitch maps in Pokemon Gold/Silver (my finds)
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  More glitch maps now!<br /><br />0016: Executes code from C9CF.<br />0017: Freezes game with music still playing at white screen.<br />0018: Glitch dimension.<br />0019: Executes code from CBD1.<br />001A: Same effect as in 0016.<br />001B: Glitch dimension.<br />001C: Executes code from C5C0.<br />001D: Same effect as in 000D.<br />001E: Glitch dimension.<br />001F: Same effect as in 000D.<br />0020: Glitch dimension.<br />0021: Glitch dimension.<br />0022: Same effect as in 000D.<br />0023: Glitch dimension.<br />0024: Executes code somewhere I do not know, landing on address 0333 (halt).<br />0025: Same effect as in 0017.<br />0026: Glitch dimension.<br />0027: Executes code from DAE0 (4th party Pokemon 1st Attack byte). This also could become an ACE setup.<br />0028: Executes code from D6E0 (possibly Pokegear). I don&#039;t know if this could become an ACE setup.<br />0029: Glitch dimension.<br />002A: Executes code from EAD1.<br />002B: Glitch dimension.<br />002C: Executes code from C36D.<br />002D: Same effect as in 002A.<br />002E: Same effect as in 0027.<br />002F: Executes code, running into an invalid opcode at 4CF4.<br />0030: Same effect as in 0027.<br /><br />That&#039;s all I have for today. More glitch maps tommorow!<br />


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: jo12100
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks,<br />It finally works after a third try,<br /><br />Now my question is: why Corsola is so [s]fucking[/s] rare?<br />I mean I&#039;m pretty sure that I&#039;ll get a shiny Jigglypuff before.


subject: Re: BLOOD and other glitches encountered in pirated Green version on MEBOY emulator
poster_name: Mefista
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It is a very neat thing to know!<br /><br />Also, I&#039;d be interested in knowing what causes glitches in my videos, as the one that replays ALL the attack animations over a glitched background seems neat.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Marv231
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Marv231
icon: xx
body:
  [quote author=Xavi link=topic=6638.msg208941#msg208941 date=1521674816]<br />[quote author=ISSOtm link=topic=6638.msg208931#msg208931 date=1521631623]<br />The PokÃ©mon setup isn&#039;t the cause (nothing / a crash would have happened if it was wrong). The item setup needs to be modified to account for the memory address change in EU versions.Â²<br />[/quote]<br />I know I need to modify the items, but in what way?<br />Quoting myself: &quot;There&#039;s any way to translate from english to Spanish?&quot;<br /><br />I&#039;m a n00b in ACE, I understand it exploits de 8bits of the game and can copy the item and pokÃ©mon set up, but not create or undersant how to done them.<br /><br />Thank you.<br />[/quote]<br /><br />To make your Item Setup work, add 5 X-Accuracy to the stack, so you have 124 of them<br /><br />https://pastebin.com/JBjzuGeS


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Tabbender
icon: xx
body:
  Did this today, i finally got a legit Arceus. Well, i already had one in Platinum (with Roar of Time, Spacial Rend and Shadow Force at that; it was the event for the Jewel of Life movie), but yeah. I would have loved this as a kid. I&#039;d also like to use this to get Darkrai or Shaymin, but i already AR&#039;d them into my game at the time. Boy i was dumb as a kid. Guess that&#039;s what happens when you keep the same save file for 10 years.<br /><br />Also would there be a way to use Retire on other maps ? Like, just lose to Arceus and you&#039;ll be sent to a Pokemon center. From there you can theorically take it anywhere... maybe Shaymin will work then ? And i know that the Hall of Origins can&#039;t be accessed without the Azure Flute, but what would happen if you were to use Retire in the Spear Pillar ? This can potentially open for many possibilities, and you can use NCP&#039;s to save (since i assume the Explorer Kit doesn&#039;t work in Pal Park mode)


subject: Re: Map 0xDA00 (English Gold/Silver)
poster_name: jo12100
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Got it, it was&nbsp; time exclusive.<br /><br />I also tried to get hibiki ganaha glitch but without the exact location it&#039;s really hard + there is a lot of corruptions.


subject: Re: I maked good drawing
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &#128077;&#128540;&#128077; I suck at drawing humans or anything realistic but I can draw my own Fakemon.<br />Good effort! I would do worse probably.<br />Like so:&nbsp;  O<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  /|\<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /\&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  LOL!


subject: Re: ART CONTEST (character sketches)
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Any prize? I got some black and white fakemon copies I keep to print extra to color in for my friends because my printer has crappy color ink.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Your confusing me. I was under the impression that you could get shaymin and darkrai using the void glitch from the same location as arceus. Also asking agai n because I&#039;m not a noob any more, does anyone know how to bypass the invisible wall because my research has been fruitless so far. 


subject: hello all!!
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve been a lurker on the wiki and forums for a long time now, and have been binge watching Gen I glitch videos for the last few weeks, and finally decided to officially join the community. Even though I really can&#039;t do a lot of deep coding stuff at the moment (hex editing, ACE, etc.) I&#039;ve always had a really strong interest in quirks in programming and code. I recently bought VC Pokemon Silver and Crystal, and also own Sun and Ultra Moon, and am excited to research glitches and maybe try a few of my own =D I&#039;m even planning on writing my official AP task project on Pokemon Blue and its memory setup and associated glitches!<br /><br />For a little more about me, my name is Etoile and I&#039;m 17 and a lesbian. My favorite glitch pokemon is Female Symbol, and my favorite glitches are Charizard &#039;M and any other particularly destructive/dangerously corrupting glitches, like unterminated/doubled ZZAZZ, which destroy the game&#039;s playability but don&#039;t outright crash it. It&#039;s super interesting how much you can do to the game and have it keep taking the data you give it, which is why I&#039;m so interested in Gen I despite never playing the games. I&#039;m happy to be here and excited to join the discussion!


subject: Re: hello all!!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Welcome to the forums etoile! :)<br /><br />Hope you have fun playing around with the many glitches in PokÃ©mon.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can get them via the same glitch, but only once. I already got them via AR as a kid, so i can&#039;t get them via the glitch now.<br /><br />Also i never tried it in Platinum, but depending on where the invisible wall is located maybe you can just try another path ? Or is it literally impossible to access the Void in Platinum ?


subject: Re: Glitch maps in Pokemon Gold/Silver (my finds)
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  More glitch maps for today, as promised :)<br /><br />0031: Glitch dimension.<br />0032: Glitch dimension.<br />0033: Same effect as in 0027.<br />0034: Glitch dimension.<br />0035: Same effect as in 0027.<br />0036: Same effect as in 0027.<br />0037: Glitch dimension.<br />0038: Glitch dimension.<br />0039: Oh my! It loaded! And it does not crash! But it seems I can&#039;t move anywhere. I&#039;ve attached what it looks like.<br />003A: Glitch dimension.<br />003B: Same effect as 0017.<br />003C: Executes code from C560.<br />003D: Same effect as in 000D.<br />003E: Executes code from CD00.<br />003F: Executes code from C1D1.<br />0040: Glitch dimension.<br />0041: Same effect as in 002A.<br />0042: Glitch dimension.<br />0043: Same effect as in 002A.<br />0044: Interesing. Freezes for a while, then loads map succesfully but then glitch dimension. I&#039;ve attached what it looks like.<br />0045: Glitch dimension.<br /><br />More glitch maps tomorrow! :)


subject: Re: Glitch maps in Pokemon Gold/Silver (my finds)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  I love that 0039 map. For me the Team Rocket battle music is playing too, and you can walk around if you enable walk through walls which is quite cool.<br /><br />Here are all the maps I have noted down for being interesting on my 3DS notes when going up and down Cherrygrove City PokÃ©mon Center. But I imagine not all of them will work the same between different save files.<br /><br />Like you I&#039;m focusing on one group at a time, namely those that end with 00 and FF.<br /><br />D900<br />D600<br />CD00<br />C400<br />BD00<br />B900<br />B200<br />AC00<br />A900<br />9600<br />FE00<br />FF00 (you can also get this with call 2232)<br />E600<br />FE0A<br />FE07<br />5700<br />4E00<br />3600<br />2600<br />1A00<br />0F00<br />0E00<br />0A00<br />10FF<br />21FF (this one was known before)<br />22FF<br />0DFF<br />23FF


subject: Re: hello all!!
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yo.<br /><br />[img height=300]http://images4.wikia.nocookie.net/__cb20120510221731/unanything/images/8/80/Don&#039;t_forget_you&#039;re_here_forever.jpg[/img]


subject: Re: hello all!!
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8299.msg209015#msg209015 date=1522119100]<br />o/<br />[/quote]<br />\o


subject: Re: hello all!!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello etoile! Nice to meet you :)<br />Funny, you have a french name. Are you french? [s](we have a super cool french community with a lot of cookies)[/s]


subject: Re: Glitch maps in Pokemon Gold/Silver (my finds)
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s here! More glitch maps.<br /><br />0046: Same effect as in 000D.<br />0047: Same effect as in 002A.<br />0048: Glitch dimension.<br />0049: Glitch dimension.<br />004A: Glitch dimension.<br />004B: Executes code from D2D3.<br />004C: Glitch dimension.<br />004D: Same effect as in 002A.<br />004E: Same effect as in 002A.<br />004F: Glitch dimension.<br />0050: Glitch dimension.<br />0051: Same effect as in 002A.<br />0052: Executes code from C927. Arbitary code execution possible.<br />0053: Same effect as in 002A.<br />0054: Varies. One time glitch dimension, one time executes code, landing on a invalid opcode at FF07.<br />0055: Glitch dimension.<br /><br />More glitch maps today or tommorow. :)


subject: Re: hello all!!
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8299.msg209017#msg209017 date=1522157373]<br />Hello etoile! Nice to meet you :)<br />Funny, you have a french name. Are you french? [s](we have a super cool french community with a lot of cookies)[/s]<br />[/quote]<br />I&#039;m not french, sorry to disappoint ;0; I speak some french, though!


subject: Re: Some grass surfing glitch (Spanish and Italian Red/Blue) technical details
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Sorry for bumping this up, Torchic. I wonder if you know any other item with the same capacity than hex:7C has? This item doesn&#039;t seem to behave this way in french games, so I&#039;d like to find a similar item. If you don&#039;t, I guess I&#039;ll have to test all of them!


subject: Re: Some grass surfing glitch (Spanish and Italian Red/Blue) technical details
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7344.msg209020#msg209020 date=1522164945]<br />Sorry for bumping this up, Torchic. I wonder if you know any other item with the same capacity than hex:7C has? This item doesn&#039;t seem to behave this way in french games, so I&#039;d like to find a similar item. If you don&#039;t, I guess I&#039;ll have to test all of them!<br />[/quote]<br /><br />That&#039;s OK! :)<br /><br />Hmm I don&#039;t know either, sorry about that Krys. I noticed however hex:7C has an unterminated name there, so you can try forcing a 0x50 sub-tile on the screen (0150A0C3) to test its &#039;real effect&#039;.<br /><br />Hope you&#039;re able to find one that works.


subject: Re: Some grass surfing glitch (Spanish and Italian Red/Blue) technical details
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the Gameshark code! Unfortunately, even by preventing the unterminated name corruption, the item just freezes the game while attempting to perform the steps for this glitch.<br /><br />I will look for another item :)


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  Nice find !<br /><br /><br />So, from my tests, it turns out to be something like :<br /><br />-You give a letter to the first party PokÃ©mon (empty slot).<br />-Then, you hit Up twice in order to select party PokÃ©mon 0xFF, and you give him an Item (the &quot;Item&quot; option is always available, probably due to a coding insight that overrides the &quot;check if the party slot is not an Egg/Bad Egg/empty slot&quot; condition).<br />-Then, either the Item is directly given to the first party PokÃ©mon during the &quot;give an Item&quot; procedure, or the empty party slot 0xFF is moved in front of the party.<br />In either cases, the empty slot in first party slot now has a non-mail item.<br />-However, the contents of its mail hasn&#039;t been suppressed, as well as a counter that keeps how many letters have been written, and which letter is held by which PokÃ©mon.<br /><br />-When you repeat the procedure, the new mail will take on the second mail slot, then 3rd, then... up to the 6th mail slot.<br />Once the game reaches the 6th given mail, more non-intended behaviour happens.<br /><br />-When you try to give a new mail to a PokÃ©mon after that, the game will look at the contents of mail 0xFF. [The game may be counting down the amount of mail given to party PokÃ©mon, which could then trigger this effect.]<br />A copy of the selected mail is subtracted from the Bag.<br />If the PokÃ©mon was already holding an Item, a copy of this Item is added to the Bag (with a check that the Bag isn&#039;t full). [The Item is indeed returned to the Bag at this moment in the procedure since even if you quit the mail menu that comes out later by hitting B, the item is still duplicated and one exemplary of the mail is removed.]<br />The contents for mail 0xFF are read in Pc PokÃ©mon data [Box 2 Slot 27, as Npo said. The mail data is affected by DMA so a specific manipulation of PC PokÃ©mon data is indeed possible.]<br />Due to another coding insight, the game doesn&#039;t check if the 0xFF-th mail already exists [The -- word is 0xFFFF. 0x0000 is treated as ????, probably like all non-valid words. Thus, the 0xFF-th mail most always have non-FFFF data, but even if everything is set to 0xFFFF the game will present you the writing mode for the 7th mail]<br />When exiting this menu, the &quot;change the PokÃ©mon&#039;s held Item by a mail&quot; command doesn&#039;t happen due to another coding error.<br />Thus, the PokÃ©mon keeps its previous item, there is one less mail in the Bag, and no mail is given.<br /><br /><br />This also allows one to modify the data read as 0xFF-th mail data with all the possible non-glitched words. <br /><br /><br />Regarding the potential data modification, you can affect, as Npo pointed out :<br />PC PokÃ©mon, Box 2 Slot 27 (located around 0x0202A98C with DMA)<br />2nd substructure : double-words 2 and 3<br />3rd substructure : doubles-word 1 and 2, 1st word of double-word 3. [the whole double-word 3 isn&#039;t affected]<br />4 double-words + 1 word = 9 words = 9 mail words you can manipulate<br /><br />However, the PokÃ©mon will turn into a Bad Egg after such a modification if its checksum isn&#039;t preserved.<br />This requires to know beforehand the data that is written in such double-words, which requires the ID/Secret ID couple of the trainer, the PID of the PokÃ©mon, and some information regarding its EVs and contest stats.<br />Hopefully, all these things are known for in-game traded PokÃ©mon. <br /><br />This manipulation procedure could be used to create a Bootstrap PokÃ©mon for ACE in a faster way than the one I planned, but this is completely dependant on the list of hex words that can be used for mail words.<br />This piece of code looks like this in general : 0258C903 0800B402. [For ACE redirected to Pyramid Bag Items in Emer non-Jpn, with a DMA translation of 18 double-words]<br />By having the 3rd substructure of the PokÃ©mon being its EVs, xxxxC903 0800B402 could be obtained reasonably (08 is via PokÃ©blocks, while the rest requires EV manipulation on 4 stats).<br />Then, 0x0258 could be obtained with this glitch without having to play on double-corrupting the PokÃ©mon and then use the held Item data and one more double-corruption to get it.<br /><br />This glitch could also be used to obtain certain glitch moves on in-game traded PokÃ©mon quite easily, or certain Items.<br /><br />Is there a table/list somewhere of all the valid words for mails/tv news in RSE ?<br /><br /><br />Edit : I couldn&#039;t get to the contents of the 8th mail even by setting the contents of the 7th mail to 0xFFFF.<br />This may be possible, but I don&#039;t know how.<br /><br />This opens to something that I didn&#039;t consider.<br />With another Instant Pomeg Glitch PokÃ©mon (or with the same one but with a specific DMA pattern), it should be possible to affect the value of the 1st party PokÃ©mon that managed the number of the held mail.<br /><br />Since the data for held mails is quite short, it should start a bit before PC PokÃ©mon data (unless I&#039;m wrong), so not many things other than PC PokÃ©mon corruption could be achieved this way.<br />However, this could allow us to modify the PID/TID/name/OT/.. of a PC PokÃ©mon.<br /><br />Edit : In Japanese Emerald, the PC PokÃ©mon data affected by the 0xFF-mail data may be different.<br />


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Npo
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Npo
icon: xx
body:
  Wow that is awesome Metarkrai!<br />I looked into trying to find a list of valid words for the easy chat system (the system used to write mail, reporter questions, questionnaire ect.) and wasn&#039;t able to find any. but by doing some experimentation I was able to figure out how it&#039;s organized. Each Word in the easy chat system is made of two bytes, The high byte marks what category the word is found under, and the low byte is the index of the word for that item. so for example the word &quot;BAG&quot; has the Hex index of 0x0215, 02 for being in the &quot;TRAINER&quot; group and 15 for being the 21&#039;st word in that group stored in memory, (the words are NOT stored in alphabetical order).<br />I was able to find the order of the words stored in memory from a disassembly of Pokemon emerald found here: [url=https://github.com/pret/pokeemerald/tree/master/data/text/easy_chat]https://github.com/pret/pokeemerald/tree/master/data/text/easy_chat[/url]<br /><br />It&#039;s also important to note that some groups need to be unlocked like the &quot;Trendy Saying&quot; witch requires talking to a man in Mauville Pokemon center to unlock a new saying once a day, &quot;Pokemon 1&quot; witch requires seeing the Pokemon form the Hoen Pokedex to be able to write, and &quot;Pokemon 2&quot; which requires getting the national Pokedex <br /><br />So all the 16bit numbers we can write are organized into 22 groups of varying length.<br /><br />Here is the list of bytes than can be written with the easy chat system:<br /><br />Pokemon 1&nbsp; &nbsp; (See note)<br />Trainer&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x0200-0x021B<br />Status&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  0x0400-0x046D<br />Battle&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x0600-0x063f<br />Greetings&nbsp; &nbsp; &nbsp; 0x0800-0x082a<br />People&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  0x0a00-0x0a4b<br />Voices&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  0x0c00-0x0c3f<br />Speach&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x0e00-0x0e3c<br />Endings&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x1000-0x1045<br />Feelings&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x1200-0x1245<br />Conditions&nbsp; &nbsp; &nbsp; 0x1400-0x1445<br />Actions&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  0x1600-0x164e<br />Lifestyle&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x1800-0x182d<br />Hobbies&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  0x1a00-0x1a36<br />Time&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  0x1c00-0x1c2d<br />Misc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x1e00-0x1e2a<br />Adjectives&nbsp; &nbsp; &nbsp;  0x2000-0x2024<br />Events&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x2200-0x221d<br />Move 1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x2400-0x249a<br />Move 2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x2600-0x26c8<br />Trendy Saying&nbsp; 0x2800-0x2821<br />Pokemon 2&nbsp; &nbsp; &nbsp;  (see note)<br /><br />[b]Note:[/b] in Pokemon 1 data the index of the Pokemon name is the same as that Pokemon&#039;s index in game, for example &quot;ABRA&quot; would be 0x003f. So the index&#039;s of all Pokemon in the hoen pokedex can be written. Pokemon 2 data works similarly in that the index is based off the Pokemon index, but only Pokemon from gen 2 or earlier are included and the upper byte is written as 0x2A so for example &quot;BULBASAUR&quot; would be 0x2a01 coincidentally this means there are duplicates of Pokemon names from the Pokemon 1 group, for example if you pick &quot;ABRA&quot; from Pokemon 2 instead of Pokemon 1 you will write 0x2a3f instead.<br /><br />[b]Edit:[/b] Here is a link to a paste-bin with the hex index of each word (hopefully there aren&#039;t any mistakes)<br />[url=https://pastebin.com/s53DQyxX]https://pastebin.com/s53DQyxX[/url]


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Npo
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Metarkrai link=topic=8289.msg209024#msg209024 date=1522172328]<br />Nice find !<br /><br /><br />So, from my tests, it turns out to be something like :<br /><br />-You give a letter to the first party PokÃ©mon (empty slot).<br />-Then, you hit Up twice in order to select party PokÃ©mon 0xFF, and you give him an Item (the &quot;Item&quot; option is always available, probably due to a coding insight that overrides the &quot;check if the party slot is not an Egg/Bad Egg/empty slot&quot; condition).<br />-Then, either the Item is directly given to the first party PokÃ©mon during the &quot;give an Item&quot; procedure, or the empty party slot 0xFF is moved in front of the party.<br />In either cases, the empty slot in first party slot now has a non-mail item.<br />-However, the contents of its mail hasn&#039;t been suppressed, as well as a counter that keeps how many letters have been written, and which letter is held by which PokÃ©mon.<br /><br />-When you repeat the procedure, the new mail will take on the second mail slot, then 3rd, then... up to the 6th mail slot.<br />Once the game reaches the 6th given mail, more non-intended behaviour happens.<br /><br />-When you try to give a new mail to a PokÃ©mon after that, the game will look at the contents of mail 0xFF. [The game may be counting down the amount of mail given to party PokÃ©mon, which could then trigger this effect.]<br />A copy of the selected mail is subtracted from the Bag.<br />If the PokÃ©mon was already holding an Item, a copy of this Item is added to the Bag (with a check that the Bag isn&#039;t full). [The Item is indeed returned to the Bag at this moment in the procedure since even if you quit the mail menu that comes out later by hitting B, the item is still duplicated and one exemplary of the mail is removed.]<br />The contents for mail 0xFF are read in Pc PokÃ©mon data [Box 2 Slot 27, as Npo said. The mail data is affected by DMA so a specific manipulation of PC PokÃ©mon data is indeed possible.]<br />Due to another coding insight, the game doesn&#039;t check if the 0xFF-th mail already exists [The -- word is 0xFFFF. 0x0000 is treated as ????, probably like all non-valid words. Thus, the 0xFF-th mail most always have non-FFFF data, but even if everything is set to 0xFFFF the game will present you the writing mode for the 7th mail]<br />When exiting this menu, the &quot;change the PokÃ©mon&#039;s held Item by a mail&quot; command doesn&#039;t happen due to another coding error.<br />Thus, the PokÃ©mon keeps its previous item, there is one less mail in the Bag, and no mail is given.<br /><br /><br />This also allows one to modify the data read as 0xFF-th mail data with all the possible non-glitched words. <br /><br /><br />Regarding the potential data modification, you can affect, as Npo pointed out :<br />PC PokÃ©mon, Box 2 Slot 27 (located around 0x0202A98C with DMA)<br />2nd substructure : double-words 2 and 3<br />3rd substructure : doubles-word 1 and 2, 1st word of double-word 3. [the whole double-word 3 isn&#039;t affected]<br />4 double-words + 1 word = 9 words = 9 mail words you can manipulate<br /><br />However, the PokÃ©mon will turn into a Bad Egg after such a modification if its checksum isn&#039;t preserved.<br />This requires to know beforehand the data that is written in such double-words, which requires the ID/Secret ID couple of the trainer, the PID of the PokÃ©mon, and some information regarding its EVs and contest stats.<br />Hopefully, all these things are known for in-game traded PokÃ©mon. <br /><br />This manipulation procedure could be used to create a Bootstrap PokÃ©mon for ACE in a faster way than the one I planned, but this is completely dependant on the list of hex words that can be used for mail words.<br />This piece of code looks like this in general : 0258C903 0800B402. [For ACE redirected to Pyramid Bag Items in Emer non-Jpn, with a DMA translation of 18 double-words]<br />By having the 3rd substructure of the PokÃ©mon being its EVs, xxxxC903 0800B402 could be obtained reasonably (08 is via PokÃ©blocks, while the rest requires EV manipulation on 4 stats).<br />Then, 0x0258 could be obtained with this glitch without having to play on double-corrupting the PokÃ©mon and then use the held Item data and one more double-corruption to get it.<br /><br />This glitch could also be used to obtain certain glitch moves on in-game traded PokÃ©mon quite easily, or certain Items.<br /><br />Is there a table/list somewhere of all the valid words for mails/tv news in RSE ?<br /><br /><br />Edit : I couldn&#039;t get to the contents of the 8th mail even by setting the contents of the 7th mail to 0xFFFF.<br />This may be possible, but I don&#039;t know how.<br /><br />This opens to something that I didn&#039;t consider.<br />With another Instant Pomeg Glitch PokÃ©mon (or with the same one but with a specific DMA pattern), it should be possible to affect the value of the 1st party PokÃ©mon that managed the number of the held mail.<br /><br />Since the data for held mails is quite short, it should start a bit before PC PokÃ©mon data (unless I&#039;m wrong), so not many things other than PC PokÃ©mon corruption could be achieved this way.<br />However, this could allow us to modify the PID/TID/name/OT/.. of a PC PokÃ©mon.<br /><br />Edit : In Japanese Emerald, the PC PokÃ©mon data affected by the 0xFF-mail data may be different.<br /><br />[/quote]<br /><br />In regards to trying to construct a bootstrap Pokemon using the mail glitch, since there is no valid message that corresponds with 0x0258 you cannot simply write this message to edit the Pokemon, however, it may be possible to write a number that would result in the Pokemon having more EVs then needed, and then reduce it to the desired EV count using berries. for example on an in game traded Pokemon, that has been successfully corrupted, the higher two bytes of the PID would be 0x4000, and writing &quot;MUK&quot; from Pokemon 2 (0x2a58) to the corresponding EV stats would result in 106 and 88 EVs (once decrypted). We want to write 0x0258 which is 66 and 88 EVs once decrypted, so by giving the Pokemon 4 EV reducing berries, the encrypted data will be what we desire. A similar strategy can be used to construct bootstrap Pokemon for other purposes.<br /><br />


subject: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: Miku
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Miku
icon: xx
body:
  I know how to use the w sm glitch item in Yellow. I&#039;ve used it countless times to obtain max DV PokÃ©mon, to clone items and to change Mew&#039;s OT/ID information to GF/22796, which is the event Mew that was distributed a couple years ago.<br /><br />However, I&#039;ve done all those code executions following instructions made by others. I don&#039;t understand what the items correspond to in terms of code etc. I assume that there are a lot of folks here that know how specific arbitrary code is created, so could some one please generate a code / item list for Yellow&#039;s w sm item that would be similar to the max DV code?<br /><br />The video I used as my guide was this: https://www.youtube.com/watch?v=jR5rov2e6PU&amp;t=804s<br /><br />So basically I assume the setup would be exactly the same as it is in that video, but the item list would be different. Also, it would be awesome if the code only changes the DVs and does not max out stat experience. (I really don&#039;t like soft-resetting e.g. Zapdos for a week or so just to get a Hidden Power spread, but I wouldn&#039;t mind training one legitimately.) If it isn&#039;t possible to generate a code that doesn&#039;t max out stat experience, it&#039;s fine, but I would just prefer it to just affect the DVs.<br /><br />I&#039;m looking for the following DV spreads:<br /><br />7 / 14 / 13 / 15 / 15 (Hidden Power Water)<br />15 / 15 / 13 / 15 / 15 (Hidden Power Ice)<br />7 / 14 / 15 / 15 / 15 (Hidden Power Electric)<br />3 / 14 / 14 / 15 / 15 (Hidden Power Grass)<br /><br />The Hidden Power spreads are mainly for the Kanto&#039;s legendary birds, as I would like to use them in Crystal&#039;s Battle Tower.


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Npo link=topic=8289.msg209027#msg209027 date=1522206418]<br />In regards to trying to construct a bootstrap Pokemon using the mail glitch, since there is no valid message that corresponds with 0x0258 you cannot simply write this message to edit the Pokemon, however, it may be possible to write a number that would result in the Pokemon having more EVs then needed, and then reduce it to the desired EV count using berries. for example on an in game traded Pokemon, that has been successfully corrupted, the higher two bytes of the PID would be 0x4000, and writing &quot;MUK&quot; from Pokemon 2 (0x2a58) to the corresponding EV stats would result in 106 and 88 EVs (once decrypted). We want to write 0x0258 which is 66 and 88 EVs once decrypted, so by giving the Pokemon 4 EV reducing berries, the encrypted data will be what we desire. A similar strategy can be used to construct bootstrap Pokemon for other purposes.<br />[/quote]<br /><br /><br />Oh yeah, I completely forgot about the potential use of EV-reducing berries.<br /><br />I haven&#039;t looked at all the potential PokÃ©mon names that can be used (especially those with a high second byte).<br /><br />However, when corrupting the PID/TID of a PokÃ©mon, you will only have a non-Egg form with 2 corruptions (PID and TID) and not just one (except two special cases).<br />And since PID xor TID is used for data encryption, the 0x4000xxxx that appear on the in-game traded PokÃ©mon&#039;s PID and TID after a double-corruption (or 0x4001xxxx for Meowth and Plusle&#039;s PID) compensate together.<br />Thus, regarding (Speed Es)(Def EVs), the desired values are 0x02 and 0x058 to form 0x0258.<br />For the other EVs, the xor-ing changes everything, so it will really be dependent on the possible valid words.<br /><br />The single in-game traded PokÃ©mon that have their EVs substructure as 3rd substructure is Meowth (normal and double-corrupted)<br />[ Meowth : PID 0x0000008B, TID 0x00016559, PID xor TID : 0x000165D2, MGEA-&gt;AMEG ]<br />Its second substructure will be either Growth (normal) or Miscellanous (double-corrupted).<br />The data in Growth substructure that could then be changed is its Exp, PP bonuses, Happiness, and ??? (something whose use I don&#039;t know).<br /><br />Thus, two contest stats, the ??? thing (that&#039;s at 0x0000), the PP bonuses, and the happiness can be determined beforehand and then be used to get a constant checksum after modifying Meowth&#039;s EVs with the Emerald Mail glitch.<br /><br />An happiness of 0xFF could be useful as its crypted version is FF xor 65 = 9A.<br />Thus, a change of this 9A for something like 0x12 would change the happiness to 0x77, which would induce a checksum subtraction of 0x8800. (near the 0x8000 maximal change).<br /><br /><br />Unfortunately, none of the Emerald in-game traded PokÃ©mon have their Growth substructure as their 3rd substructure (in either their normal or double-corrupted form).<br /><br />However, for the Attacks substructure, Seedot (normal and double-corrupted) and Horsea (double-corrupted) have this substructure as their 3rd substructure.<br /><br />


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  First, place the PokÃ©mon you want to edit in slot #4 of your party.<br /><br />Then, have your bag set up like so :[code]<br />8F/ws m<br />[any item] x[any qty]<br />Lemonade x1<br />PokÃ© Ball x35<br />Revive x1<br />Water Stone x3<br />TM01 x[any qty]<br />X Accuracy x10 (11 if R/B)<br />Carbos x210<br />[/code]<br /><br />[list type=decimal]<br />[li]Toss all your Lemonades but one, so you have only 1[/li][li]Use ws m/8F[/li][li]Toss 1 Lemonade, you now have 255.[/li][li]Swap [u]PokÃ© Ball[/u] with [u]X Accuracy[/u][/li][li]Swap [u]Revive[/u] with [u]Carbos[/u][/li][li]Toss the appropriate number of Lemonades (see below)[/li][li]Use ws m/8F[/li][li]Toss 1 X Accuracy[/li][li]Toss the appropriate number of Lemonades (see below again)[/li]<br />[li]Use ws m/8F[/li]<br />[li]Buy 1 X Accuracy[/li]<br />[li]Swap [u]X Accuracy[/u] with [u]PokÃ© Ball[/u][/li]<br />[li]Swap [u]Carbos[/u] with [u]Revive[/u][/li]<br />[li]Change the item you have in party slot #4[/li]<br />[li]Rinse and repeat ![/li]<br />[/list]<br /><br /><br />[b][u]Regarding the number of Lemonades :[/u][/b]<br />All numbers past 99 have their left digit glitched, but the units are still as accurate.<br /><br />For the first write, the quantity of Lemonades you&#039;ll target is {SPD DVs} * 16 + 15<br /><br />For the second write, the quantity will be {ATK DVs} * 16 + {DEF DVs}<br /><br /><br />For the Ice Hidden Power, instead of doing exactly what I mentioned above, you should first toss 1 X Accuracy, use ws m with 255 Lemonades, then buy 1 X Accuracy and perform the write relative to SPD DVs (with 223 Lemonades)


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: Miku
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Miku
icon: xx
body:
  Thanks for your answer! I tried it, but it didn&#039;t do anything.<br /><br />I used my Zapdos with 15 / 15 / 15 / 15 / 15 DVs. Please correct any mistakes I made.<br /><br />[quote author=ISSOtm link=topic=8301.msg209030#msg209030 date=1522236973]<br />For the first write, the quantity of Lemonades you&#039;ll target is {SPD DVs} * 16 + 15<br /><br />For the second write, the quantity will be {ATK DVs} * 16 + {DEF DVs}[/quote]<br /><br />So as this Zapdos has 15 in every DV, I should not toss any Lemonades, correct? 15 * 16 +15 = 255. That&#039;s the amount I want to have when using w sm, correct?<br /><br />[quote author=ISSOtm link=topic=8301.msg209030#msg209030 date=1522236973]<br />Change the item you have in party slot #4[/quote]<br />I&#039;m a bit confused here. What do I have to change the #4 slot item with?<br /><br />Do I have to use w sm one more time after the final step?


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Npo
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Metarkrai link=topic=8289.msg209029#msg209029 date=1522227818]<br /><br /><br />Oh yeah, I completely forgot about the potential use of EV-reducing berries.<br /><br />I haven&#039;t looked at all the potential PokÃ©mon names that can be used (especially those with a high second byte).<br /><br />However, when corrupting the PID/TID of a PokÃ©mon, you will only have a non-Egg form with 2 corruptions (PID and TID) and not just one (except two special cases).<br />And since PID xor TID is used for data encryption, the 0x4000xxxx that appear on the in-game traded PokÃ©mon&#039;s PID and TID after a double-corruption (or 4001xxxx for Meowth and Plusle&#039;s PID) compensate together.<br />Thus, regarding (Speed Es)(Def EVs), the desired values are 0x02 and 0x058 to form 0x0258.<br />For the other EVs, the xor-ing changes everything, so it will really be dependent on the possible valid words.<br /><br />The single in-game traded PokÃ©mon that have their EVs substructure as 3rd substructure is Meowth (normal and double-corrupted)<br />[ Meowth : PID 0x0000008B, TID 0x00016559, PID xor TID : 0x000165D2, MGEA-&gt;AMEG ]<br />Its second substructure will be either Growth (normal) or Miscellanous (double-corrupted).<br />The data in Growth substructure that could then be changed is its Exp, PP bonuses, Happiness, and ??? (something whose use I don&#039;t know).<br /><br />Thus, two contest stats, the ??? thing (that&#039;s at 0x0000), the PP bonuses, and the happiness can be determined beforehand and then be used to get a constant checksum after modifying Meowth&#039;s EVs with the Emerald Mail glitch.<br /><br />An happiness of 0xFF could be useful as its crypted version is FF xor 65 = 9A.<br />Thus, a change of this 9A for something like 0x12 would change the happiness to 0x77, which would induce a checksum subtraction of 0x8800. (near the 0x8000 maximal change).<br /><br /><br />Unfortunately, none of the Emerald in-game traded PokÃ©mon have their Growth substructure as their 3rd substructure (in either their normal or double-corrupted form).<br /><br />However, for the Attacks substructure, Seedot (normal and double-corrupted) and Horsea (double-corrupted) have this substructure as their 3rd substructure.<br /><br /><br />[/quote]<br /><br />Although after performing a single corruption to a any Pokemon would result in it turning into an egg, you can still hatch the egg into a Pokemon to be able to modify it&#039;s EVs but still have a PID xor TID of 4000xxxx (or 4001xxxx in Meowths case) you would just have to make sure that the species of the Pokemon that is hatched is a non glitch Pokemon, or a Pokemon who doesn&#039;t cause the game to crash upon hatching. This way you can still modify the PID xor TID value (is there a shorthand name for that value?) through corruption and still be able to modify it&#039;s EVs. Unfortunately the only in game traded Pokemon who has EVs in the third substructure is Meowth and because of it&#039;s PID xor TID value, the required EVs to write the bootstrap code is over the limit, even with the work around I described previously. However this means you are not necessarily restricted to only being able to write valid hex values. <br /><br />Also, although not as nice as using the in game traded Pokemon, we can use rng manipulation to catch pokemon with a specific PID, and using the fact that you can also READ the encrypted data (so long as it&#039;s a valid message) as well as write to it, you can calculate your players entire TID without needing to catch a shiny pokemon normally.<br />The method would work like this. Catch a bunch of spinda (since you can easily figure out their PID from their spots / IVs) and place one in the Box 2 slot that is edited by the mail glitch, and check to see if you can read any data on the left side of the mail (the values that would be Xord with your SID) if you can&#039;t replace the spinda with a new one until you find one that works (shouldn&#039;t take too long since there are ~1800 valid messages and your checking 4 different values each time) then you would figure out what data the valid message corresponds too and plug it into this equation <br />PID(high) Xor MessageIndex Xor Data = SID<br /><br />This is just a rough over view of the method, I will type up a better step by step method when I have time later today.&nbsp; :)<br /> <br /><br />


subject: Re: Glitch maps in Pokemon Gold/Silver (my finds)
poster_name: MarcinTVP8
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  More glitch maps for today.<br /><br />0056: Executes code from CD03.<br />0057: Glitch dimension.<br />0058: Same effect as in 0027.<br />0059: Glitch dimension.<br />005A: Same effect as in 002A.<br />005B: Same effect as in 0027.<br />005C: Glitch dimension.<br />005D: Glitch dimension.<br />005E: Same effect as in 002A.<br />005F: Freezes for a while, then loads map succesfully but then glitch dimension. I&#039;ve attached what it looks like.<br />0060: Executes code, running into an invalid opcode at 4616. <br />0061: Same effect as in 000D.<br />0062: Same effect as in 0016.<br />0063: Executes code, running into an invalid opcode at 42A7.<br />0064: Same effect as in 0016.<br />0065: This has never occured before. The game restarts completely. No glitch dimension, just a normal soft reset.<br /><br />More glitch maps tomorrow.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;New laptop<br />&gt;Install word processor (Libreoffice 4 lyfe)<br />&gt;Gotta go through all my documents now and add shit to the dictionary<br />&gt;All those Glitchmon names from TSOG<br />&gt;Probably just as many Pokemon names<br />&gt;God knows what else<br /><br />[img]https://pics.me.me/heavy-be-heavy-breat-heavy-breathing-avy-breathing-heavy-brea-22783999.png[/img]


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Npo
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Npo
icon: xx
body:
  Ok here is the method I came up with for figuring out your players Secret ID using the Mail Glitch.<br />You will need to know / have these things:<br />1 Know how to set up the mail glitch <br />2 Know how to calculate the PID of a Spinda based of it&#039;s spots<br />3 Know how to calculate a Pokemon&#039;s IVs<br />4 A programming calculator that can do bit-wise Xor (or find one online)<br /> <br />In game you will need the following:<br />1: Have gotten the National Pokedex (not necessary but can help)<br />2: Have the necessary Pokemon party to set up and perform the Mail Glitch<br />3: Lots of extra Mail<br />4: About 10 or so Repeat Balls<br /><br />Here are the steps<br />[b]Step 1:[/b] Register a Spinda in your pokedex by capturing one, so that you can catch some more using the repeat balls.<br /><br />[b]Step 2:[/b] Save your game<br /><br />[b]Step 3:[/b] catch about ten or so Spinda on route 113<br /><br />[b]Step 4:[/b] place one of the Spinda in Box 2 slot 27<br /><br />[b]Step 5:[/b] Give a piece of mail to a Pokemon in your party to activate the mail glitch and check to see if there are any Valid Messages (anything that is not &quot;???&quot;) in one of the four slots on <br />the right hand side of the mail.<br /><br />[b]Step 6:[/b] If the spinda dose not have any valid messages then go back to step 4 swapping the spinda out for a new one, if none of the spinda work reset and try again.<br /><br />[b]Step 7:[/b] Once you have a Spinda that has a valid message on the right hand side of the mail, <br />copy down what the message is and what &#039;slot&#039; the message is in the top right most slot being one, and the bottom right being 4. <br />If the message is the name of a Pokemon that existed in gen 2 but also exist in the Hoen pokedex, Abra for example, then you will have to double check to see if it&#039;s from the Pokemon 1 or Pokemon 2 group. You can do this by re writing the name of the Pokemon from Pokemon group 2 and then attempt to give the mail to the Pokemon, if a message appears asking you if you want to stop giving the mail to the Pokemon, than note that the Pokemon name came from group 2, if it&nbsp; ask you if your OK with giving this message to the Pokemon then note down that the Pokemon name came from group 1. DO NOT GIVE the Pokemon the mail!<br /><br />[b]Step 8:[/b] Calculate the PID of the spinda who has a valid message using this website:<br />[url=http://www.freewebs.com/gatorshark/Spinda%20Painter.htm]http://www.freewebs.com/gatorshark/Spinda%20Painter.htm[/url]<br /><br />[b]Step 9:[/b] Now we need to know what data the message you copied down references, to do that we find the PID modulo 24 then use the table from the Bulbapedia page on pokemon substructure to figure out the order of the substructures of the spinda. <br />[url=https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III]https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III[/url]<br /><br />For example my spinda had a PID of 0xA0953C09, <br />Modulo 24 comes out to 9 so the order of the substructures is AEMG <br />If the message appeared in slot 1 or 2 then the data we are looking for is in the 2nd substructure (in my case E),<br />if the message appeared in slot 3 or 4 then the data we are looking for is in the third substructure (in my caseM)<br /><br />Now depending on what substructure / slot your message appeared in you can find what data it&#039;s referencing<br /><br />[b]Growth (G)[/b]<br />[u]Slot 1 and 4:[/u] upper Experience bytes<br />your Spinda&#039;s total EXP should be less than 65535 so the data should be 0x0000<br />[u]Slot 2:[/u] Unknown data<br />for all Pokemon this data is 0x0000<br />[u]Slot 3:[/u] Held Item<br />Check to see if your spinda is holding a chesto berry (5%) if it is the data is 0x0086<br />otherwise it will be 0x0000<br /><br />[b]Attacks (A)[/b]<br />[u]Slot 1 and 4 :[/u] Move 4<br />Attack 4 should be either Psybeam or nothing, if it&#039;s Psybeam then the data is 0x003c<br />otherwise it will be 0x00<br />[u]Slot 2:[/u] PP4 + PP3<br />Move 3 will be Faint attack and move 4 is either Psybeam or nothing, so these two bytes will either be 0x0014 if there is no Psybeam or 0x1414 if there is.<br />[u]Slot 3:[/u] Move 2<br />Attack 2 should be Uproar, the data is 0x00FD<br /><br />[b]EVs and Conditions (E)[/b]<br />[u]All slots:[/u]<br />Since you just caught the spinda all of it&#039;s eves and conditions should be zero,<br />the data is 0x0000<br /><br />[b]Miscellaneous (M)[/b] (a little more complicated)<br />[u]Slot 1 and 4:[/u]&nbsp; IVs<br />You will have to calculate the spindas IVs for Special Defense, Special Attack, and Speed. then write out the following number using those values,<br />00(SpD)(SpA)(Spe*)<br />*only need to write the 4 most significant bits of the speed IV<br />then that would be your data.<br /><br />[u]Slot 2:[/u]Ribbons and Obedience<br />Since you just caught the spinda it shouldn&#039;t have any ribbons<br />the data is 0x0000<br /><br />[u]Slot 3:[/u] Origins Info <br />Fill out the following info in binary from the Origins info table from the bulbapedia page:<br />[url=https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III]https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III[/url]<br /><br />you will need to know your characters gender the poke-ball spinda was caught in (repeat ball) <br />the game of origin (Emerald) and the level you caught it at (14,15, or 16)<br /><br />[b]Step 10:[/b]<br />Now you should have 3 pieces of information, the Spindas PID, the valid message it corresponds to, and the data it&#039;s referencing. find the hex id of the message using the info from my previous post and the link it goes to, and then find the bit wise Xor of the higher 4 bytes of the PID the Data you found and the Hex id of the message. This is your SID<br /><br />So for example my spindas PID was 0xA0953C09, I found the message &quot;SEALEO&quot; in slot one which has a hex id of 0x0156 and corresponds to the EVs section for my spinda, and so my data is 0x0000, then I xor the three numbers,<br />0xA095 XOR 0x0156 XOR 0x0000 = 0xA1C3 so my SID is 0xA1C3 or 41411 in decimal, now i can use this number for rng manipulation of shiny pokemon or for other uses.


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No, the quantities you need to use are based on the DVs you [b]want to[/b] obtain, not the PokÃ©mon&#039;s current DVs.<br />For example, for a Grass-type Hidden Power, you&#039;ll need 14 * 16 + 15 = 239 Lemonades (thus tossing 16 from 255), then 3 * 16 + 14 = 62 Lemonades (thus tossing 177 from 239)<br /><br />If you want to use this to set your PokÃ©mon&#039;s DVs to 15/15/15/15, you should use 255 both times, yes.<br /><br />I meant &quot;change the PokÃ©mon in party slot #4&quot;, but everyone makes mistakes when tired, right ?<br /><br />No, if I don&#039;t say to use ws m, don&#039;t use it.


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  [quote author=Npo link=topic=8289.msg209035#msg209035 date=1522253965]<br />Although after performing a single corruption to a any Pokemon would result in it turning into an egg, you can still hatch the egg into a Pokemon to be able to modify it&#039;s EVs but still have a PID xor TID of 4000xxxx (or 4001xxxx in Meowths case) you would just have to make sure that the species of the Pokemon that is hatched is a non glitch Pokemon, or a Pokemon who doesn&#039;t cause the game to crash upon hatching. This way you can still modify the PID xor TID value (is there a shorthand name for that value?) through corruption and still be able to modify it&#039;s EVs. Unfortunately the only in game traded Pokemon who has EVs in the third substructure is Meowth and because of it&#039;s PID xor TID value, the required EVs to write the bootstrap code is over the limit, even with the work around I described previously. However this means you are not necessarily restricted to only being able to write valid hex values.&nbsp; This is just a rough over view of the method, I will type up a better step by step method when I have time later today.&nbsp; :)<br />[/quote]<br /><br />Well, unfortunately no.<br />When hatching an Egg, its TID is changed to yours and all its data is re-encrypted with the new PID xor TID.<br />Thus, you completely lose the 0x0000xxxx TID from the in-game trainer of the in-game traded Meowth, which makes the rest of the procedure undoable unless you can determine your Secret ID and do many calculations.<br /><br /><br />[quote author=Npo link=topic=8289.msg209035#msg209035 date=1522253965]<br />Also, although not as nice as using the in game traded Pokemon, we can use rng manipulation to catch pokemon with a specific PID, and using the fact that you can also READ the encrypted data (so long as it&#039;s a valid message) as well as write to it, you can calculate your players entire TID without needing to catch a shiny pokemon normally.<br />The method would work like this. Catch a bunch of spinda (since you can easily figure out their PID from their spots / IVs) and place one in the Box 2 slot that is edited by the mail glitch, and check to see if you can read any data on the left side of the mail (the values that would be Xord with your SID) if you can&#039;t replace the spinda with a new one until you find one that works (shouldn&#039;t take too long since there are ~1800 valid messages and your checking 4 different values each time) then you would figure out what data the valid message corresponds too and plug it into this equation <br />PID(high) Xor MessageIndex Xor Data = SID<br /><br />This is just a rough over view of the method, I will type up a better step by step method when I have time later today.&nbsp; :)<br />[/quote]<br /><br />This is a really nice idea, and a really nice way to determine the Secret ID of a save file in Gen III !<br />Good PokÃ©mon to catch for an easy PID determination are Smeargles as they are high levelled and are easy to find and by catching them up to a few minutes after a soft-reset, their TID is easily found on RNG Reporter.<br /><br /><br /><br />For them, the indicative information becomes :<br /><br /><br />[quote author=Npo link=topic=8289.msg209038#msg209038 date=1522279353]<br />[u]List of decrypted values depending on their slot and substructure :[/u]<br />[b]Growth (G)[/b]<br />[u]Slot 1 and 4:[/u] upper Experience bytes<br />0x0000 if Smeargle&#039;s EXP is lower or equal to 65.535<br />0x0001 else. (as they have less than 131.072 exp at Lv 50)<br />[u]Slot 2:[/u] Unknown data<br />0x0000 for every PokÃ©mon<br />[u]Slot 3:[/u] Held Item<br />0x0000 (No held Item)<br /><br />[b]Attacks (A)[/b]<br />[u]Slot 1 and 4 :[/u] Move 4<br />0x0000 (No 4th Move)<br />[u]Slot 2:[/u] 256*PP4 + PP3<br />0x0000 (0 PPs for Move 3 and 0 PPs for Move 4)<br />[u]Slot 3:[/u] Move 2<br />0x0000 (No Move 2)<br /><br />[b]EVs and Conditions (E)[/b]<br />[u]All slots:[/u]<br />0x0000 (No EVs, No Contest stats)<br /><br />[b]Miscellaneous (M)[/b] (a little more complicated)<br />[u]Slot 1 and 4:[/u]&nbsp; IVs<br />Compute : (floor(Speed IV/2))+16*(Special Atk IV) + 512*(Special Def IV) + 32.768*(Ability) in decimal.<br />Then convert this value to hexadecimal to obtain the decrypted value.<br /><br />Ability is 0 if the PokÃ©mon has its first ability, and 1 if it has its second ability. (It is 0 for a wild Smeargle.)<br /><br />[u]Slot 2:[/u]Ribbons and Obedience<br />0x0000 (No Ribbons)<br /><br />[u]Slot 3:[/u] Origins Info <br />Compute : Met Lv + (Origin version)*128 + (Ball)*2048 + (Trainer gender)*32.768 in decimal.<br />Then, convert it to hexadecimal to obtain the decrypted value.<br /><br />Origin version is 3 for Emerald<br />Ball is 1 for Master Ball, 2 for Ultra Ball, 9 for Repeat Ball. <br />Trainer gender is 0 for male and 1 for female<br />For the whole possible values, check bulbapedia&#039;s page : [url=https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III]https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III[/url]<br /><br /><br />- Obtain the hexadecimal value tied to the mail word.<br />If this isn&#039;t a PokÃ©mon name, find the value here : https://pastebin.com/s53DQyxX<br />If this is the name of a Gen 3 PokÃ©mon, the tied value is the hexadecimal identifiant of this PokÃ©mon in Gen III. (not the national PokÃ©dex number) List of Gen III identifiants : https://bulbapedia.bulbagarden.net/wiki/List_of_Pok%C3%A9mon_by_index_number_(Generation_III)<br />If this is the name of a Gen 1-2 PokÃ©mon that isn&#039;t in the Hoenn PokÃ©dex, the tied value is the hexadecimal identifiant of this PokÃ©mon.<br /><br />If the message is the name of a Gen 1-2 that is in the Hoenn PokÃ©dex, Abra for example, then you will have to double check to see if it&#039;s from the Pokemon 1 or Pokemon 2 group. You can do this by re writing the name of the Pokemon from Pokemon group 2 and then attempt to give the mail to the Pokemon, if a message appears asking you if you want to stop giving the mail to the Pokemon, than note that the Pokemon name came from group 2, if it ask you if your OK with giving this message to the Pokemon then note down that the Pokemon name came from group 1. DO NOT GIVE the Pokemon the mail!<br />If the PokÃ©mon&#039;s name is from the &quot;PokÃ©mon 1&quot; group, then its tied value is 0x00yy the hexadecimal identifiant of this PokÃ©mon.<br />If the PokÃ©mon&#039;s name is from the &quot;PokÃ©mon 2&quot; group, then its tied value is 0x2Ayy, where yy is the hexadecimal dentifiant of this PokÃ©mon.<br /><br /><br />- Then, obtain the PID in hexadecimal with the formula : PID = (mail word value) xor (high PID) xor (decrypted value).<br />[/quote]


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: Miku
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Miku
icon: xx
body:
  My item setup is:<br />ws m<br />Burn Heal x43 (This can be anything, right?)<br />Lemonade x1<br />PokÃ© Ball x35<br />Revive x1<br />Water Stone x3<br />TM01 x1<br />X Accuracy x10<br />Carbox x210<br /><br />Iâ€™m trying to get Hidden Power Water first, which corresponds to a DV spread of 7 / 14 / 13 / 15 / 15.<br /><br />So for the first write, I donâ€™t have to toss any Lemonades, right? SPD DVâ€™s mean Speed, right? I want Zapdosâ€™ Speed DV to be 15, so I donâ€™t have to toss any Lemonades, correct?<br /><br />For the second write, the quantity will be ATK DVs * 16 + DEF DVs, which in Hidden Power Waterâ€™s case corresponds to 14* 16 + 13 = 237, so I have to toss 255-237 = 18 Lemonades, right?<br /><br />I followed your steps by doing these and nothing seems to happen to Zapdosâ€™ DVs. After I had done all that you described, I changed Zapdos with Pikachu (who was third in my party slot) and nothing happened.<br /><br />Edit: I even followed your instructions for the Hidden Power Grass by tossing the exact amount of Lemonades you described, but nothing happened. What am I doing wrong here?


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Npo
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Npo
icon: xx
body:
  [quote author=Metarkrai link=topic=8289.msg209040#msg209040 date=1522331830]<br /><br /><br />Well, unfortunately no.<br />When hatching an Egg, its TID is changed to yours and all its data is re-encrypted with the new PID xor TID.<br />Thus, you completely lose the 0x0000xxxx TID from the in-game trainer of the in-game traded Meowth, which makes the rest of the procedure undoable unless you can determine your Secret ID and do many calculations.<br /><br />[/quote]<br /><br />I compleatly forgot about the TID being replace once hatched.&nbsp; :P<br /><br /><br /><br />[quote author=Metarkrai link=topic=8289.msg209040#msg209040 date=1522331830]<br />This is a really nice idea, and a really nice way to determine the Secret ID of a save file in Gen III !<br />Good PokÃ©mon to catch for an easy PID determination are Smeargles as they are high levelled and are easy to find and by catching them up to a few minutes after a soft-reset, their TID is easily found on RNG Reporter.<br /><br /><br /><br />For them, the indicative information becomes : ....<br />[/quote]<br /><br />I like the idea of using smeargle better, calculating a PID from spinda spots gets kinda finicky. I did do some calculations for the odds of finding a spinda that would work for my method and it comes out to about 7%, so a box for a box full of spinda there is a ~89% chance one of them will work. The odds would be slightly different for smeargel since most of the possible values that could be read from ie. Move 4 , PP3 + PP4 Move 2, ext. would always have the same value of zero unencrypted, so if smeargles PID mod 24 = 0 for example, all for slots would be the same number. This is also true in some cases for spinda as well, so it would ultimately be a pretty small change in odds. It would still be better to go for the smeargle strategy. <br /><br />Either way this method is MUCH faster then trying to find a shiny Pokemon! And using rng manipulation you can now search for PID&#039;s that would xor with your trainer id so that you can write values into the item slot to get specific glitch items much faster and easier. Or even to set up bootstrap pokemon.


subject: Re: Mail glitch discovered in US version of Emerald.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  [quote author=Npo link=topic=8289.msg209042#msg209042 date=1522334564]<br />I like the idea of using smeargle better, calculating a PID from spinda spots gets kinda finicky. I did do some calculations for the odds of finding a spinda that would work for my method and it comes out to about 7%, so a box for a box full of spinda there is a ~89% chance one of them will work. The odds would be slightly different for smeargel since most of the possible values that could be read from ie. Move 4 , PP3 + PP4 Move 2, ext. would always have the same value of zero unencrypted, so if smeargles PID mod 24 = 0 for example, all for slots would be the same number. This is also true in some cases for spinda as well, so it would ultimately be a pretty small change in odds. It would still be better to go for the smeargle strategy. <br /><br />Either way this method is MUCH faster then trying to find a shiny Pokemon! And using rng manipulation you can now search for PID&#039;s that would xor with your trainer id so that you can write values into the item slot to get specific glitch items much faster and easier. Or even to set up bootstrap pokemon.<br />[/quote]<br /><br />I thought once again, and the Smeargle idea is not that good in the end.<br /><br />It is more interesting to have a decrypted value different in each case in order to maximize the chances to have a mail word value that ends up valid.<br />Thus, things like giving an Item are interesting.<br /><br />With 935 + 220 + 251=1406 valid mail words and 4 different decrypted values, I found a ~8.4% chance that a PokÃ©mon deposited at Box 2 Slot 27 will give a valid word in one of the 4 different slots. (in the uniform and independant care, but it&#039;s less in reality since the 4 values that are read are not independent)<br /><br /><br />I thought of a modified version of the procedure with catches that are a bit slower, but with Spindas that give the maximal (or near-maximal) chance to get a positive result.<br /><br />This procedure may be a bit slower time-wise, but it makes the final computations easier by removing some cases.<br /><br />[b]Step 0 :[/b]<br />Obtain an Instant Pomeg Glitch PokÃ©mon, and Glitch Item 0x6400.<br />You can obtain one by performing a double-corruption on an in-game traded Seedot with an in-game traded Plusle with Growl only as a corruption initiator. (See a reference about double-corruption for that)<br />The EVs you need to give to a clone of the in-game traded Seedot are :<br />Emer Fr: 0x29C8 (41 Atk,200 HP) | Emer US : 0x29C0 (41 Atk,192 HP) | Emer Spa : 0x948C (148 Atk,140 HP) | Emer Ger : 0x29C9 (41 Atk, 201 HP) | Emer Jp : 0x4360 (67 Atk,96 HP) | Emer Ita : 0x9481 (148 Atk,129 HP) |<br />As well as 100 Speed EVs (10 Carbos) for Glitch Item 0x6400.<br /><br />Here&#039;s some Ev-training data to help you in the EV-training :<br /> - Macho Brace : Doubles the EVs won in a battle.<br /> - Exp.Share : The holder also receives EVs when PokÃ©mon are KOed.<br /> - PokÃ©Rus : Doubles the EVs won in a battle. /!\ AVOID IT /!\ (Obtaining odd EVs with PokÃ©Rus is a problem)<br /> - HP : HP Up : +10 HP (Up to 100 HP) | Marill (Route 102,111) : +2 HP | Wishmur (Rusturf Tunnel) : +1 HP.<br /> - Attack : Protein : +10 Atk (Up to 100 Atk) | Mighthyena (Route 120,121) : +2 Atk | Poochyena (Route 101,102,120,121) : +1 Atk.<br /><br />Once you obtain the Instant Pomeg Glitch PokÃ©mon, don&#039;t try to take its Item directly.<br />Catch a Smeargle/wild PokÃ©mon, and nickname it &quot;Item 6400&quot;.<br />Withdraw the Instant Pomeg Glitch PokÃ©mon in your party and take its Item.<br />Then, give this Item to the PokÃ©mon nicknamed &quot;Item 6400&quot;.<br />This way, you know that Glitch Item 0x8000 is held by this PokÃ©mon. (since all glitch items look the same, this is important to distinguish them)<br /><br />[b]Step 1 :[/b]<br />Perform the Emerald Mail Glitch. (See NPO&#039;s first post of this topic)<br />Once you filled all 6 slots for party PokÃ©mon mails and can access Mail NÂ°255, break the Instant Pomeg Glitch and save.<br /><br /><br />[b]Step 2 :[/b]<br />Make around 5 PokÃ©blocks with 3 NPC, with Chesto Berries, at ~93 maximum RPM. (They should be Blue PokÃ©blocks at Lv12 with 21 Feel)<br />Clone Glitch Item 0x6400.<br />Buy/clone 10 Master Balls/Repeat Balls.<br />Buy/clone 20 Carbos.<br />Go to Route 117 and save.<br /><br />[b]Step 3 :[/b]<br />Find a wild Spinda.<br />Find the PID of each Spinda by using http://www.freewebs.com/gatorshark/Spinda%20Painter.htm<br />(Check Spinda&#039;s gender and nature to see if you are correct)<br />Take the decimal value of the PID, and compute PID modulo 24. (or the remainder in the euclidian division of PID by 24)<br />If the value is : 00,02,06,08,12,14,18,19,20,21,22,23, then catch the Spinda and nickmane it with the value. (Nickname it &quot;23&quot; if the result of the computation is 23).<br />Else, flee and meet another Spinda.<br /><br />Repeat the process until 10 Spindas are caught.<br /><br />[b]Step 4 :[/b]<br />Once you have caught 10 Spindas, go into the PC and withdraw a Spinda.<br />Look at the first Spinda in your party.<br /><br />-If the value is 00 or 21 (MAEG or GAEM) : Give it 2 Carbos and Teach it Strenght as its 4th Move. (replace Psybeam if he knows it).<br />Its 2nd substructure is Attacks, and its 3rd substructure is EVs.<br />-If the value is 02 or 23 (MEAG or GEAM) : Give it a Blue PokÃ©block (Lv 12, 21 Feel), and teach it Strenght as its 4th Move. (replace Psybeam if he knows it).<br />Its 2nd substructure is EVs, and its 3rd substructure is Attacks.<br />-If the value is 14 or 20 (EAGM or MAGE) : Teach it Strenght as its 4th Move. (replace Psybeam if he knows it).<br />Its 2nd substructure is Attacks, and its 3rd substructure is Growth.<br />-If the value is 12 or 18 (EGAM or MGAE) : Teach it Strenght as its 4th Move (replace Psybeam if he knows it), and make it hold Glitch Item 0x6400.<br />Its 2nd substructure is Growth, and its 3rd substructure is Attacks.<br />-If the value is 06 or 19 (AGEM or MGEA) : Give it a Blue PokÃ©block (Lv 12, 21 Feel), give it 2 Carbos, and make it hold Glitch Item 0x6400.<br />Its 2nd substructure is EVs, and its 3rd substructure is Attacks.<br />-If the value is 08 or 22 (AEGM or MEGA) : Give it a Blue PokÃ©block (Lv 12, 21 Feel), and make it hold Glitch Item 0x6400.<br />Its 2nd substructure is EVs, and its 3rd substructure is Attacks.<br /><br /><br />Repeat the process with all the Spindas you caught.<br />Deposit all your Spindas in Box 2, but avoid Slot 27.<br /><br />[b]Step 5 :[/b]<br />Move 1 Spinda to Box 2 Slot 27.<br />Close the PC.<br />Open the bag, and give a mail to a party PokÃ©mon.<br />This will display you the contents of the mail NÂ°255, which are read on the data of the PokÃ©mon at Box 2 Slot 27.<br /><br />Look if one of the 4 words in the right is a normal word (and not &quot;????&quot;). (it must be on the right column, and not on the left column)<br /><br />If yes, proceed to the next step.<br />If no, close the Bag, open the PC, put another Spinda at Box 2 Slot 27, and repeat the process.<br /><br />If all 10 of your Spindas don&#039;t work, reset and go back to step 3 to catch 10 more Spindas.<br /><br />The chance that a normal word appears instead of a &quot;????&quot; is less than 10% per Spinda. (It is ~8.5% in the uniformly randomized theoretical case, so it&#039;s less than that in reality.)<br /><br /><br />[b]Step 6 :[/b]<br />Note the word that appeared.<br />Note the line at which the normal word appeared. (Line 1,2,3 or 4.)<br />Close the mail, close the Bag, and save.<br />Open the PC and note the nickname of the Spinda that is in Box 2 Slot 27.<br />Use the information at step 4 and note the 2nd substructure and the 3rd substructure of this Spinda.<br />These substructures will be used later on to compute some other values.<br /><br />Determine the PID of this Spinda again with http://www.freewebs.com/gatorshark/Spinda%20Painter.htm<br />Write down the hexadecimal value of this PID.<br />Cut this PID in two and note the left part. (Ex : If PID is 0x001457AF, I note 0x0014)<br />This part of the PID is called &quot;high-PID&quot;, and will be used later.<br /><br />[b]Step 7 :[/b]<br />Obtain &quot;word value&quot;, the hexadecimal value tied to the mail word.<br />If this isn&#039;t a PokÃ©mon name, find the value in this list : https://pastebin.com/s53DQyxX<br />If this is the name of a Gen 3 PokÃ©mon, the tied value is the hexadecimal identifiant of this PokÃ©mon in Gen III. (not the national PokÃ©dex number) <br />Here is a list of Gen III identifiants : https://bulbapedia.bulbagarden.net/wiki/List_of_Pok%C3%A9mon_by_index_number_(Generation_III)<br />If this is the name of a Gen 1-2 PokÃ©mon that isn&#039;t in the Hoenn PokÃ©dex, the tied value is the hexadecimal identifiant of this PokÃ©mon.<br /><br />If the message is the name of a Gen 1-2 that is in the Hoenn PokÃ©dex (Abra for example) then you will have to double check to see if it&#039;s from the Pokemon 1 or Pokemon 2 group. <br />You can do this by re writing the name of the Pokemon from Pokemon group 2 and then attempt to give the mail to the Pokemon, if a message appears asking you if you want to stop giving the mail to the Pokemon, than note that the Pokemon name came from group 2, if it ask you if your OK with giving this message to the Pokemon then note down that the Pokemon name came from group 1. DO NOT GIVE the Pokemon the mail!<br />If the PokÃ©mon&#039;s name is from the &quot;PokÃ©mon 1&quot; group, then its tied value is 0x00yy the hexadecimal identifiant of this PokÃ©mon.<br />If the PokÃ©mon&#039;s name is from the &quot;PokÃ©mon 2&quot; group, then its tied value is 0x2Ayy, where yy is the hexadecimal dentifiant of this PokÃ©mon.<br /><br />Step 8 :<br />Note the value of the &quot;dectypted data&quot; from the list below that corresponds to your situation.<br /><br />If the line at which your normal word appeared is the 1st or the 2nd line, look at the part of the list tied to the 2nd substructure of your Spinda.<br />If the line at which your normal word appeared is 3rd or the 4th line, look at the part of the list tied to the 3nd substructure of your Spinda.<br />(Ex : If the Spinda&#039;s nickname is &quot;21&quot;, its 2nd substructure is Attacks and its 3rd substructure is EVs. If the non-glitched word appeared in 4th line, I need to look at the EVs section in the list).<br /><br /><br />[b]Growth (G) :[/b]<br />Line 1 : upper Experience bytes<br />0x0000 (Spinda has less than 65.536 exp)<br />Line 2: Unknown data<br />0x0000 for every PokÃ©mon<br />Line 3: Held Item<br />0x6400 (Glitch Item 0x6400 held)<br />Line 4 : upper Experience bytes<br />0x0000 (Spinda has less than 65.536 exp)<br /><br />[b]Attacks (A) :[/b]<br />Line 1 : Move 4<br />0x0046 (Strenght)<br />Line 2: 256*PP4 + PP3<br />0x0F14 (20 PPs for Faint Attack and 15 PPs for Strenght)<br />Line 3 : Move 2<br />0x00FD (Uproar)<br />Line 4 : Move 4<br />0x0046 (Strenght)<br /><br />[b]EVs and Conditions (E) :[/b]<br />Line 1 : 256*(Beauty)+Coolness<br />0x0D00 (13 Beauty, 0 Coolness)(if Spinda&#039;s nature is Modest, Mild, Quiet, or Rash)<br />0x0B00 (11 Beauty, 0 Coolness)(if Spinda&#039;s nature is Adamant, Impish, Jolly, or Careful)<br />0x0C00 (12 Beauty, 0 Coolness)(if Spinda&#039;s nature is not one of the previous ones)<br />Line 2: 256*Feel + Toughness<br />0x1500 (21 Feel, 0 Toughness)<br />Line 3 : 256*(Speed EVs) + Def<br />0x1400 (20 Speed EVs, 0 Def EVs)<br />Line 4 : 256*(Beauty)+Coolness<br />0x0D00 (13 Beauty, 0 Coolness)(if Spinda&#039;s nature is Modest, Mild, Quiet, or Rash)<br />0x0B00 (11 Beauty, 0 Coolness)(if Spinda&#039;s nature is Adamant, Impish, Jolly, or Careful)<br />0x0C00 (12 Beauty, 0 Coolness)(if Spinda&#039;s nature is not one of the previous ones)<br /><br /><br />Step 9 :<br />Obtain your Secret ID in hexadecimal by computing : Secret ID = (decrypted data) xor (high-PID) xor (word value).


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Are you using an US version ?<br />Also, the DV spreads you&#039;re posting are wrong, since there are only 4 DVs. ATK, DEF, SPD and SPE.


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: Miku
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Miku
icon: xx
body:
  [quote author=ISSOtm link=topic=8301.msg209044#msg209044 date=1522344457]<br />Are you using an US version ?<br />Also, the DV spreads you&#039;re posting are wrong, since there are only 4 DVs. ATK, DEF, SPD and SPE.<br />[/quote]<br />I&#039;m using the English European version. The DV&#039;s I listed were in the order of HP / ATK / DEF / SPCL / SPE.<br /><br />I assume that you were referring to Speed DV with SPD? What was I doing wrong, as it didn&#039;t work and I tried it many times?


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  There are only 4 HP DVs in Generation I and II. ATK, DEF, SPD, and SPE. Maybe HP DVs are shared with one of these stats.<br />I assumed the last two DVs (always identical) were Spe Atk and Spe Def DVs, which is why my calculations were wrong.<br /><br />Also, if you&#039;re playing on an EU version, you need to use five more X Accuracies than presented here.


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Alright, I documented myself on DVs, and apparently HP DVs are calculated from all other four DVs -- which explains everything.<br /><br />So, you will indeed need 255 Lemonades for the first write of each spread, and the second write will indeed be ATK * 16 + DEF. HP DVs will be automatically &quot;set&quot;.


subject: DecDex data bot (ambitious idea but might work?)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  Would it be viable for us to extract Decamark data from the ROM and use a bot to import this data on to the wiki?<br /><br />There are certain things that may be suitable for the bot, like the Decamark&#039;s base stats and starting moves, level-up moves.<br /><br />Other things such as whether the Decamark freezes may be harder. However it may be better to have the incomplete data there than none at all?<br /><br />If I remember rightly Koolboyman actually worked on a tool that extracted the data (and we already have Wack0&#039;s modified version of a tool for looking up PokÃ©mon data in the ROM to look up Decamark data instead; [url=https://sites.google.com/site/torchickens2/glitching-tools]Gen3ES[/url] was it?) however not sure if we still have the data on the Internet available in text form anymore.<br /><br />Documenting so many Decamarks and/or glitch PokÃ©mon as well may take up a lot of storage on the server (you have Ruby, FireRed, Emerald which is ((65536-386)*3)) glitch PokÃ©mon).<br /><br />Thoughts?


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [u][b]3/30/18 Update[/b][/u]<br /><br />I&#039;m back with more! I&#039;ve gotten some stuff from the last Glitch Pokemon that are available using the Mew Glitch. Is there a reliable method to getting the Glitch Pokemon 200-255 aside from the fossil conversion glitch? I just feel like that method might get tedious after a while, but if I have to do it I will. Anyway, on with the entry!<br /><br />[b]196[/b]<br /><br />Hex- C4<br /><br />Name (romanized)- Iaze (I&#039;ve been told the &quot;I&quot; character has an impossible dakuten on it)<br /><br />https://imgur.com/9RetEf6<br /><br />Cry- Two quick buzzes<br /><br />At first glance, I could tell Iaze would be similar to Fuizi. It&#039;s sprite was the same, and would also vary between encounters. No Dex entry would be shown upon capture, and the game would hang on the nickname prompt. Since it&#039;s sprite is basically the same as Fuizi&#039;s I&#039;m willing to bet that Iaze&#039;s sprite also causes a division by 0.<br /><br />[b]197[/b]<br /><br />Hex- C5<br /><br />Name (romanized)- Nu<br /><br />https://imgur.com/TjilJRk<br /><br />Cry- Distorted Charizard/Rhyhorn cry<br /><br />Iaze was quite similar to Fuizi, and Nu shares a lot of its traits with Zu! The battle transition stays on the black screen for a long time, but the first time I encountered Nu the game actually [i]did[/i] freeze on that screen. The second encounter with Nu was successful, though. The battle music distorted during the black battle transition, and after a few moments it stopped completely. A few glitch noises were played, then the music became a slowed down version of the &quot;wild Pokemon defeated&quot; music and stayed that way until the battle was over. After exiting the battle, something strange happened. Similar to how Yellow Missingno causes a whole bunch of Reds to walk around on screen, the sprite of a male trainer appeared on the top right of the screen and moved to the bottom of the screen, then Red turned into a glitch square but went back to normal when I went back into Cerulean. I tried to get a picture of the guy flying across the screen but he disappeared before I got a chance :(<br /><br />No Dex entry was shown upon capture, so I&#039;m not sure if Nu can trigger the Rhydon trap.<br /><br />Stats page- https://imgur.com/JZmWzvu<br /><br />Type- Normal/Boy (again, LOL what?)<br /><br />Moves- https://imgur.com/nnuvFBp<br /><br />Moves (at level 7)- Screech, Pay Day, Cut, TM05<br /><br />No doubt that Nu is very similar to Zu. They have the same type and starting moves, both are listed as #250, and they both cause audio glitches, though Zu never caused any visual glitches the way Nu did. I&#039;m thinking they may have the same encounter/capture flag, since no Dex entry was shown upon capture. Perhaps they&#039;re hybrids of each other, or members of the same &quot;family&quot;?<br /><br />Out of curiosity, I tried out TM05 in battle to see what would happen. It had 56 total PP and appeared to have no type. It had the same animation as Scratch and would drain HP like Absorb. Definitely different from TM05 in English Red/Blue, where it has 33 total PP, is ,kPkMn(player name) x X type, and has the same animation as Pound but raises Evasion by 2 stages.<br /><br />[b]198[/b]<br /><br />Hex- C6<br /><br />Name (romanized)- Aga<br /><br />https://imgur.com/X45uDGk<br /><br />Cry- A staticky buzz<br /><br />Pokedex- https://imgur.com/ivGW6ec<br /><br />Stats page- https://imgur.com/rkq3drt<br /><br />Type- Water/Fighting<br /><br />Moves- https://imgur.com/JTn45Zd<br /><br />Moves (at level 7)- Hypnosis, Water Gun, Doubleslap, Body Slam<br /><br />Ok, given the type, starting moveset, and Dex number of 62, it&#039;s probably safe to say that Aga is a hybrid of Poliwrath. Funny that it shares its index number with LM4, which is also a hybrid of Poliwrath.<br /><br />[b]199[/b]<br /><br />Hex- C7<br /><br />Name- There&#039;s nothing there. It&#039;s literally blank. A few people on Discord suggested that the first character of 199&#039;s name might be the hex 50 character, which causes its name to be terminated early. Unfortunately, I have no way of checking this on cartridge :(<br /><br />https://imgur.com/cotuepm<br /><br />Since 199 shares its sprite with both Fuizi and Iaze, I wasn&#039;t terribly surprised when the game softlocked at the nickname prompt. No Pokedex entry was shown upon capture, either.


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=MewFlare link=topic=8292.msg209051#msg209051 date=1522441439]<br />I&#039;m back with more! I&#039;ve gotten some stuff from the last Glitch Pokemon that are available using the Mew Glitch. Is there a reliable method to getting the Glitch Pokemon 200-255 aside from the fossil conversion glitch? I just feel like that method might get tedious after a while, but if I have to do it I will. Anyway, on with the entry!<br />[/quote]<br /><br />Cool!<br /><br />Unfortunately I&#039;m not sure (unless you have a GameShark where 01xxBFCF can be used in the middle of a battle to change the species of the foe) other than if you can execute [url=https://glitchcity.info/wiki/Remaining_PP_into_species_Select_glitch]this glitch[/url] which relies on the remaining PP of a PokÃ©mon instead (where every PP Up adds +hex:40 to the value represented by the remaining PP. So 5 PP and 3 PP Ups would be for instance 0xC3). The really high PP values should in theory be available with a [url=https://glitchcity.info/wiki/PP_underflow_glitch_(disambiguation)]PP underflow glitch[/url], which would also apply max PPs (from no PP ups used) otherwise remove one of the PP Up bonuses.<br /><br />I imagine there should be an even easier way though. Another possible way to get the glitch PokÃ©mon might be to set up the expanded items pack and use the Select glitch to dig up a PokÃ©mon that represents an item quantity (which can be duplicated with - move corruption (open the PokÃ©mon menu just before scrolling the Fight menu)) or [url=https://www.youtube.com/watch?v=tcTB_IaNtqU]this glitch[/url] but I&#039;m unsure how that would work out, it&#039;s not confirmed that there are quantities that map to species in the party after a switch.<br /><br />Another way while a hassle is to use arbitrary code execution with [url=https://forums.glitchcity.info/index.php?topic=6573.0]5ã‹ã„[/url] or similar:<br /><br />Lemonade x (xx)<br />TM34 x191<br />TM07 x201<br /><br />Hope that might come in handy.


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hmm... using the 5 thingamajig wouldn&#039;t really be a feasible option since my ID number is 10105 and I don&#039;t really have the patience to continuously create new saves with only a 1/256 chance of getting an ID that would work, and I have basically no knowledge of how to manipulate RNG. I also don&#039;t have a Gameshark unfortunately. My life would be a lot easier if I did :P<br /><br />However, the Select glitch with remaining PP seems promising. However, iirc even with the usage of the PP underflow glitch the maximum PP value that can be attained is 63, and it might just be me but the explanation on the wiki for that glitch seems a bit confusing. For as much as I love glitches, sometimes I can&#039;t get my head around them&nbsp; :-[


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  there is no code WTF, the page is just automatically generated, the labels were generated before the values. The code generating the values was just tracking inflation in the intervening time. Just need faster processors.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=8204.msg208982#msg208982 date=1521927163]<br />[quote author=Sasara link=topic=8204.msg208977#msg208977 date=1521889527]<br />needs more oldbies<br />[/quote]<br /><br />[quote]Oldbie:<br /><br />This title is granted to those who were on Glitch City Laboratories&#039; previous incarnations at or before 2005.[/quote]<br /><br />Lmao the only oldbies who are even active anymore are admins and mods.<br /><br />[size=7pt]Make me one for shits and giggles.[/size]<br />[/quote]<br /><br />yes these oldbies


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=8204.msg208982#msg208982 date=1521927163]<br />[size=7pt]Make me one for shits and giggles.[/size]<br />[/quote]<br /><br />Bert for Mod 2018


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MewFlare link=topic=8292.msg209055#msg209055 date=1522465705]<br />However, the Select glitch with remaining PP seems promising. However, iirc even with the usage of the PP underflow glitch the maximum PP value that can be attained is 63, and it might just be me but the explanation on the wiki for that glitch seems a bit confusing. For as much as I love glitches, sometimes I can&#039;t get my head around them&nbsp; :-[<br />[/quote]<br /><br />Don&#039;t worry. I think I may have found it a bit confusing too.<br /><br />The maximum is 63 because with one PP Up counting as +hex:40, you have 63 (hex:3F [dec:63]+hex:40*3) for the maximum value with all three PP Ups applied, and $3F+$40+$40+$40 is 0xFF. So despite the game saying there are 63 PP remaining its hex representation with 3 PP Ups is 0xFF, or if you applied two PP Ups 0x3F+0x40+0x40 = 0xBF and so on.<br /><br />Another way of looking at it is there are four copies of values 0-63 (but the only way to know their true index number is to remember how many PP Ups were used). I recommend Windows Calculator on programmer mode to switch from decimal to hexadecimal mode.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Bert
icon: clip
body:
  And now it&#039;s time for HOW TO KILL ALL FORMS OF DISCUSSION ON 4CHAN WITH UNCLE HIROSHIMOOT.<br /><br />/b/ has a cute bunny video playing tho.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: maskedkoopa
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Heya, is it possible to create a code which fills your first box with a pokemon (preferably all shiny but thats probs asking too much), or would that take too much space in the bag to do?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Depends. If you only want to duplicate a PokÃ©mon, it&#039;s doable, otherwise, it&#039;s not possible.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=maskedkoopa link=topic=6638.msg209063#msg209063 date=1522575541]<br />Heya, is it possible to create a code which fills your first box with a pokemon (preferably all shiny but thats probs asking too much), or would that take too much space in the bag to do?<br />[/quote]<br /><br />[url=https://forums.glitchcity.info/index.php?topic=7833.0]luckytyphlosion made one[/url], but it requires a bit more setup than just item code.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg209064#msg209064 date=1522579626]<br />Depends. If you only want to duplicate a PokÃ©mon, it&#039;s doable, otherwise, it&#039;s not possible.<br />[/quote]<br /><br />It&#039;d be much easier to have a code that just transformed all the pokemon already in the box to a shiny version of a pokemon, rather than actually c reating each pokemon from scratch, too - basically you catch a box full of any pokemon then transform them with 8F


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: maskedkoopa
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  My main aim here is to have the first box be filled with shiny mewtwos, they can be duplicates for all I care, the issue right now is that I have to manually make them all shiny and manually use the get pokemon code and whatnot. If I can clone an existing pokemon into every slot in box 1 that works too.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: RETIRE
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: RETIRE
icon: xx
body:
  [quote author=Tabbender link=topic=7770.msg209010#msg209010 date=1522080959]<br />You can get them via the same glitch, but only once. I already got them via AR as a kid, so i can&#039;t get them via the glitch now.<br /><br />Also i never tried it in Platinum, but depending on where the invisible wall is located maybe you can just try another path ? Or is it literally impossible to access the Void in Platinum ?<br />[/quote]<br /><br />We have tested all map id&#039;s in the entire game and we have a list with all scripts accesible, shaymin and darkrai are script 3, not 4, <br />so they can&#039;t be caught with regular RETIRE but they can be caught with alt-retire theorethicly, even tho that&#039;s still harder than the 15 minute route by aera.<br />Aera had created a route that kicks you out, with the only problem that you can&#039;t disable it because entering the pal park house has an autorun script that pushes you into the void and you can&#039;t disable it. I modified it to do this autorun before you enter the overworld this way you can disable it at any point as long as you own a gen 3 game. I had a faster route but forgot to save it unfortunatly and can&#039;t find it in discord, <br />but a couple hundred extra steps shouldn&#039;t hurt.<br /><br />1 S <br />17 W <br />14 N<br />574 W <br />SR <br />1937 S <br />19 W <br />544 S <br />51 E <br />256 S <br />33 W <br />14 E <br />64 S <br />115 E <br />14 S (Pal Park) <br />4 S<br />63 E (Or 64 if you havenâ€™t been) <br />177 N (Until Pal Park) <br />178 S<br />32 W (autorun script)<br />5 N<br />33 E<br />178 N<br />211 W<br />608 N <br />19 E <br />320 N <br />1 W (PokÃ©mon League outrun will push you up a few tiles) <br />West until kicked out <br />(Theres actually a mistake in this route wait untill I fix it this evening pls)<br /><br />We also have no need to be in the overworld at any point to reach map id&#039;s with RETIRE because we manipulate them in the void to be whatever we want just like in this route to arceus. We also used RETIRE in hall of origin to get arceus I don&#039;t know what you&#039;re on about here. Spear pillar has no connection in scripts with hall of origin whatshowever. <br /><br />


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=8204.msg208606#msg208606 date=1518323118]<br />have there been any guesses regarding the running speed of the [url=https://en.wikipedia.org/wiki/Europasaurus]europasaurus[/url]? Google brings up dick.<br />[/quote]<br /><br />Still wondering this. The reason I ask is because my newest* story idea involves the protagonist being partnered with a europasaurus because it seemed like an ideal dinosaur steed and because theropods - which would probably make more sense - are overrated trash.<br /><br />Even though brachiosaurus could only move at 10mp/h (or 16km/h), europasaurus is a dwarf species, being 20ft long at most and went shoulder-to-shoulder with an adult male (see [url=http://www.prehistoric-wildlife.com/images/species/e/europasaurus-size.jpg]this[/url] for a basic idea) and weighed as much as a cow. As such, it might&#039;ve been faster than its colossal relatives. Even then, 16km/h is pretty good for&nbsp; brachiosaurus when you take the length of its strides into account. <br /><br />On a completely unrelated note, this laptop keyboard is shit.<br /><br />[size=8pt]*I actually wrote two full stories but neither one of them were any good and I&#039;ve tweaked the concept quite a bit. It was originally called Dinocop, about a cop who had a pet europasaurus, but then I decided to make him a vigilante instead. The europasaurus was also the only dinosaur in both stories but I&#039;ve since decided to add more. So the whole thing is basically getting a reboot.[/size]<br /><br />[quote author=ISSOtm link=topic=8204.msg209065#msg209065 date=1522579692]<br />@someone<br />[/quote]<br /><br />4chan&#039;s admin Hiroshimoot Nagashitposter added this retarded team thing to posts you see in the attachment, kind of like the IDs on /pol/. It&#039;s completely killed discussion on boards like /tv/, /mu/ and /v/ (yeah yeah &gt;implying /v/ talks about video games).


subject: Re: Pokemon XD: Gale of Darkness - Walk Through Walls via Platform Distortion?
poster_name: VaeporSage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=RETIRE link=topic=8229.msg208794#msg208794 date=1520531580]You mentioned the camera increase when wailord is put on screen. I wonder if near the area where the battle takes place, there would be a loading zone. If you stood within a certain potential framespecific spot and unloaded the platforms, but the wailord battle somehow loads them / loads more data, it might cause either a sprite/npc overflow or something else causing it to load in this glitched manor?<br />[/quote]<br /><br />Yeah that&#039;s definitely a possibility, like in other words it could (?) just be a super specific confluence of events going on here:<br /><br />[i]-The Wailord messing up the camera<br />-The camera distortion taking place where there&#039;s stuff to distort (platforms)<br />-The platforms possibly being especially liable to distortion on a particular frame (?)[/i]<br /><br />Unless someone&#039;s able to actually<br /><br />[i](1) replicate the glitch<br />or<br />(2) analyse the code in some way (?) - beats me lol<br />or<br />(3) deduce some other potential cause from the pre-glitch footage we have[/i]<br /><br />then until then it&#039;s somewhat of a mystery.&nbsp; :P


subject: Re: PokÃ©mon XD: Decamark 0x19D converts into Bonsly?
poster_name: VaeporSage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It would be cool if you could obtain 0x019D and 0x019E glitch Pokemon and trade them to XD: Gale of Darkness to morph them into Bonsly/Munchlax. I mean, I doubt that&#039;s how it&#039;d play out in reality because Colosseum/XD are ultra hostile to anything even slightly glitchy coming in from other games, but I&#039;d be interested to know what does happen.<br /><br />I guess someday I might test this on console, but last time I tried hatching glitch Pokemon was like 2 years ago, and I spent countless hours with no success aiming for 3 different glitch species at different times. I was able to get Jirachi, Deoxys and a few others without much difficulty, so I&#039;m not sure why it never worked out.


subject: Re: Is there a way to control what glitch moves I get using the Pomeg glitch?
poster_name: VaeporSage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Metarkrai link=topic=8049.msg206492#msg206492 date=1503077153]<br />You can do a &quot;list&quot; of all glitch moves (name, and effect) from a Gen III Rom then use a program to search through that list for glitch moves with certain characteristics.<br />For example, if you want a move with high power, more than 100 accuracy, and some priority, using a tool like that will make things easier for you.<br />If you&#039;re interested into this, I can give you the scripts that ThezzAzzGlitch kindly made for me (even though they aren&#039;t very deep) and indicate you where the lists start from.[/quote]<br /><br />(Sorta bumping an &#039;old&#039; topic but I don&#039;t see the need to post a new thread)<br /><br />Is there a list like this for glitch moves in Gen IV? It would be really useful considering how smoothly glitch moves can be transferred from Gen III.


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So if Iâ€™m understanding this correctly, if I have a move with 62 PP and 3 PP Ups applied to it, then it would be equivalent to 0xFE? Or am I getting that totally wrong?


subject: Re: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Inkblot
icon: xx
body:
  So I went and set up bad clone ACE in crystal, and it worked! however, I have two things I want to ask about<br /><br />1) Well, not really a question, but something that was a bit confusing. I used the code to get any item, as i needed to change a tm 43 into a tm 42 in order to start setting up wrong pocket ACE. the way you have the code set up, it makes it look like in crystal the 9th item should change, as the way you have it listed is makes it seem like the 2 items needed for coin case ACE in the beginning aren&#039;t needed and don&#039;t affect the code in crystal at all. I got really annoyed when i followed the bad clone ACE guide and my tm didn&#039;t change. However i quickly found out that the code had worked, just the item 2 slots down had changed. The code still changes item 11, but the way you wrote the code out is kinda confusing if using it for crystal. I think you should make it more clear that regardless of the game, its the 11th item that changes.<br /><br />2) When i used that code, I saw that instead of making the item decreases by 1, it did it by 2. So my tm 43 became tm 41. This wasn&#039;t a huge issue, as I just used tm 44 instead, but i wasn&#039;t sure if this was intentional or if there is some odd quirk on my end that caused the extra jump.<br /><br /><br />EDIT: I always wanted to ask if the box codes listed here and on the thread with compeditive ones would work on crystal. I assume no as you only mention gold and silver when you talk about them, but i just wanted to check to make sure as If I can use them It would be really helpful.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Xavi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Marv231 link=topic=6638.msg209001#msg209001 date=1522014906]<br />[quote author=Xavi link=topic=6638.msg208941#msg208941 date=1521674816]<br />[quote author=ISSOtm link=topic=6638.msg208931#msg208931 date=1521631623]<br />The PokÃ©mon setup isn&#039;t the cause (nothing / a crash would have happened if it was wrong). The item setup needs to be modified to account for the memory address change in EU versions.Â²<br />[/quote]<br />I know I need to modify the items, but in what way?<br />Quoting myself: &quot;There&#039;s any way to translate from english to Spanish?&quot;<br /><br />I&#039;m a n00b in ACE, I understand it exploits de 8bits of the game and can copy the item and pokÃ©mon set up, but not create or undersant how to done them.<br /><br />Thank you.<br />[/quote]<br /><br />To make your Item Setup work, add 5 X-Accuracy to the stack, so you have 124 of them<br /><br />https://pastebin.com/JBjzuGeS<br />[/quote]<br /><br />Thank you, it worked.<br />What about make them shiny?<br />I tried adding x5 to in both X-Accuracy but it didn&#039;t worked. (I get the IVS 13, 0 13, 0 instead). Can someone help me?<br />Thanks and sorry for the inconvenience.


subject: Re: Is there a way to control what glitch moves I get using the Pomeg glitch?
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=VaeporSage link=topic=8049.msg209073#msg209073 date=1522707313]<br />(Sorta bumping an &#039;old&#039; topic but I don&#039;t see the need to post a new thread)<br /><br />Is there a list like this for glitch moves in Gen IV? It would be really useful considering how smoothly glitch moves can be transferred from Gen III.<br />[/quote]<br /><br />I tried to find the data used for Glitch Moves characteristics by looking at the rom data that is after valid moves data (as this is how it works for Glitch Moves in Gen III), but it seems that in Gen IV things are not done this way as changing the rom values right after the moves data tables didn&#039;t change anything for glitch moves that are right after Shadow Force.<br /><br />Unfortunately, it seems that I didn&#039;t keep the Gen IV moves data structure on my files, but someone else may have it.


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: MewFlare
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: MewFlare
icon: xx
body:
  Ok, but now Iâ€™ve stumbled across another thing thatâ€™s confusing me.<br /><br />Taken from the â€œHyper Beam automatic select glitchâ€ page-<br /><br />If the PP was 0 with no PP Ups applied, it will underflow to 63 with full PP Ups applied. If it was 0 with at least one PP Up applied, it will underflow to 63 with one less PP Up applied.<br /><br />Does this mean that if I want to get, say, 63 PP with 2 PP Ups applied, Iâ€™ll have to give 3 PP Ups beforehand since it removes the effect of one PP Up? (provided that one has been used beforehand)<br /><br />EDIT: Never mind, got that all cleared up.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: maskedkoopa
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Actually, now that I think about it, an option that would be better is if I could dupe the contents of another box to also be in box 1, since that&#039;s just copying one existing set of data to another. OFC idk if thats actually how it works...


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  --File Generated by CleanRip v2.0.0--<br /><br />Filename: SQLPGN<br />Internal Name: CNSR<br />MD5: A09B0932F209A171D12D7B127FB2DD3F<br />SHA-1: 71343ADDC4DB0AB3ABFA7AACCB0EA2A54C271AD4<br />CRC32: AFE6BF1E<br />Version: 1.00<br />Verified: No<br />Seconds: 1702<br />


subject: Avoiding the effects of a dead save battery on Generation II Pokemon Games
poster_name: DGZUpkmn/
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: DGZUpkmn/
icon: exclamation
body:
  &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Before reading the rest of this post, I want to make sure you are familiar with the Mega Memory Card (MMC) accessory for the Gameboy, as it is essential for the understanding of the post. If you know what this is and what it does, please continue to the paragraph below. The MMC is a device that allows you to backup or restore save files of GB and GBC games.<br /><br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; To begin, an awkward property unique to the Gen II Pokemon games (as far as I know) is that when the save batteries are dead, the save file actually lingers for around 45-60 seconds. As soon as a few minutes after I heard of the MMC, I theorized that you may be able to exploit that property to take the save off of the cart, or put it back on and reset. So naturally, after getting my MMC in the mail, it was one of the first things I attempted, and despite what I thought was likely, my idea actually worked! So you can use the MMC to negate the effects of a dead save battery on Pokemon Gold, Silver, and maybe Crystal (I don&#039;t know if it possesses that effect as well, as I bought my copy with a fresh battery). If I am the first&nbsp; to discover this, I will be very amazed.<br /><br />[b][color=maroon]EDIT[/color][/b]: When poking around, I have seen a few people mentioning this, so I am not the first to discover it :(


subject: Re: Avoiding the effects of a dead save battery on Generation II Pokemon Games
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Crystal save files do indeed linger for a little bit on a dead cart, so it&#039;s possible to load it onto the MMC and then put it back on the cart.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  So Team Kirby Clash Deluxe is pretty fun but F**K YOU PYRIBBIT STOP JUMPING INTO THE FUCKING BACKGROUND YOU GODDAMNED PIECE OF s**t f**k ALL I WANT TO DO IS GET A FUCKING PLATINUM MEDAL FOR BEATING YOU BUT NOOOOOOOOOO YOUR STUPID ASS WON&#039;T SIT STILL FOR TWO GODDAMNED SECONDS REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  And that works in Platinum to get Arceus, Darkrai, and Shaymin? Also where and what must you do and be to get started on this path because I forgot how to start the glitch.<br />It should work for me though because I do have a gen 3 game and a DS lite which is what you need to use the gen 3 h game to stop it.


subject: MOVED: Hi I'm new
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=//forums.glitchcity.info/index.php?board=36.0]Introductions[/url].<br /><br />[iurl]//forums.glitchcity.info/index.php?topic=8283.0[/iurl]


subject: The pokegear option on my pause menu is gone
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I somehow seemed to have removed the pokegear option from my pause menu when playing crystal on the virtual console . I don&#039;t know how it happened. I was trying to get the expansion card, but it said I didn&#039;t have the radio option. I went and got it, and then got the expansion card. However, when I went to use it, I found that the option was gone.<br /><br />I have set up ACE, and I might have done something by mistake that caused this. I was wondering if there is an even flag I could edit to unlock the option again. What memory adresses would I need to change, and what would I need to set it to so I can get the option back?


subject: Re: The pokegear option on my pause menu is gone
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  That&#039;s odd.<br /><br />If you set D957 to FF you should be able to get it back.<br /><br />Which type of ACE are you using? There is the unterminated name/0x15 control character one but also wrong pocket TM33 or wrong pocket TM21/TM25.<br /><br />If you are using a wrong pocket TM/HM (box 1 character 1; DB75), then this code should do the trick:<br /><br />Box 1: p0!&#039;vQÃ©C5<br />Box 2: p09Ã©A3&#039;vA<br />Box 3: px&#039;d55555<br /><br />Doing this with the Lapras with Safeguard and Bide setup then should include code to pop hl, so should look like this:<br /><br />Box 1: p0!&#039;vQÃ©C5<br />Box 2: p09Ã©A3&#039;vA<br />Box 3: pPkx&#039;d5555<br /><br />Hope this helps.


subject: Re: The pokegear option on my pause menu is gone
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8306.msg209096#msg209096 date=1522867526]<br />That&#039;s odd.<br /><br />If you set D957 to FF you should be able to get it back.<br /><br />Which type of ACE are you using? There is the unterminated name/0x15 control character one but also wrong pocket TM33 or wrong pocket TM21/TM25.<br /><br />If you are using an unterminated name ACE to box names (box 1 character 1; DB75), then this code should do the trick:<br /><br />Box 1: p0!&#039;vQÃ©C5<br />Box 2: p09Ã©A3&#039;vA<br />Box 3: px&#039;d55555<br /><br />Doing this with the Lapras with Safeguard and Bide setup then should include code to pop hl, so should look like this:<br /><br />Box 1: p0!&#039;vQÃ©C5<br />Box 2: p09Ã©A3&#039;vA<br />Box 3: pPkx&#039;d5555<br /><br />Hope this helps.<br />[/quote]<br /><br />I am using wrong pocket ACE, which i set up with back clone ACE. I wasn&#039;t paying attention to my pause menu so i don&#039;t know when i lost the option, but I just can&#039;t seem to select it. my phone numbers are still intact, as I keep getting calls. But the option isn&#039;t there<br />


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MewFlare link=topic=8292.msg209080#msg209080 date=1522757712]<br />Ok, but now Iâ€™ve stumbled across another thing thatâ€™s confusing me.<br /><br />Taken from the â€œHyper Beam automatic select glitchâ€ page-<br /><br />If the PP was 0 with no PP Ups applied, it will underflow to 63 with full PP Ups applied. If it was 0 with at least one PP Up applied, it will underflow to 63 with one less PP Up applied.<br /><br />Does this mean that if I want to get, say, 63 PP with 2 PP Ups applied, Iâ€™ll have to give 3 PP Ups beforehand since it removes the effect of one PP Up? (provided that one has been used beforehand)<br />[/quote]<br /><br />That&#039;s true, yes. :)<br /><br />An alternative to using the 3 PP Ups first is to do the underflow glitch twice without having to get any PP Ups; once to get 3 PP Ups applied, and a second time to get 2 PP Ups applied (or a third/fourth time to get 1 or 0 applied).


subject: Re: The pokegear option on my pause menu is gone
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  That&#039;s good then, if you have the right setup to box name character 1 the first code should work.<br /><br />Changing D957 may bring it back when the value is FF, because if that value is 00 (or theoretically a certain bit is unset) you don&#039;t have the option like you described.<br /><br />I think the option can disappear when swapping entries in the expanded Balls pocket because that can shift memory addresses backwards.<br /><br />Edit: I made a mistake in my message and didn&#039;t mention it was for wrong pocket TM/HM in the first box name code.


subject: Re: The pokegear option on my pause menu is gone
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8306.msg209099#msg209099 date=1522867791]<br />That&#039;s good then, if you have the right setup to box name character 1 the first code should work.<br /><br />Changing D957 may bring it back when the value is FF, because if that value is 00 (or theoretically a certain bit is unset) you don&#039;t have the option like you described.<br /><br />I think the option can disappear when swapping entries in the expanded Balls pocket because that can shift memory addresses backwards.<br /><br />Edit: I made a mistake in my message and didn&#039;t mention it was for wrong pocket TM/HM in the first box name code.<br />[/quote]<br /><br />I ended up Using a memory editor code set up to change the address, and it worked! I have my pokegear back! 


subject: Re: The pokegear option on my pause menu is gone
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Inkblot link=topic=8306.msg209100#msg209100 date=1522868312]<br />[quote author=Princess Torchic â¤ link=topic=8306.msg209099#msg209099 date=1522867791]<br />That&#039;s good then, if you have the right setup to box name character 1 the first code should work.<br /><br />Changing D957 may bring it back when the value is FF, because if that value is 00 (or theoretically a certain bit is unset) you don&#039;t have the option like you described.<br /><br />I think the option can disappear when swapping entries in the expanded Balls pocket because that can shift memory addresses backwards.<br /><br />Edit: I made a mistake in my message and didn&#039;t mention it was for wrong pocket TM/HM in the first box name code.<br />[/quote]<br /><br />I ended up Using a memory editor code set up to change the address, and it worked! I have my pokegear back!<br />[/quote]<br /><br />Great, pleased to hear it! :)


subject: Re: The pokegear option on my pause menu is gone
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8306.msg209101#msg209101 date=1522868369]<br />[quote author=Inkblot link=topic=8306.msg209100#msg209100 date=1522868312]<br />[quote author=Princess Torchic â¤ link=topic=8306.msg209099#msg209099 date=1522867791]<br />That&#039;s good then, if you have the right setup to box name character 1 the first code should work.<br /><br />Changing D957 may bring it back when the value is FF, because if that value is 00 (or theoretically a certain bit is unset) you don&#039;t have the option like you described.<br /><br />I think the option can disappear when swapping entries in the expanded Balls pocket because that can shift memory addresses backwards.<br /><br />Edit: I made a mistake in my message and didn&#039;t mention it was for wrong pocket TM/HM in the first box name code.<br />[/quote]<br /><br />I ended up Using a memory editor code set up to change the address, and it worked! I have my pokegear back!<br />[/quote]<br /><br />Great, pleased to hear it! :)<br />[/quote]<br /><br />So now i have another issue. the radio option on my pokegear won&#039;t let me play any music, and the scrolling seems to be glitched as it can scroll past the boundaries of the border. Is there any way to fix this?


subject: Re: The pokegear option on my pause menu is gone
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That should be D958. Changing it to 00 should fix it.<br /><br />Also check D959 (last PokÃ©dex mode) it might be glitched so if it is try changing it to 00 (new), 01 (old) or 02 (A-Z).


subject: Art contest for Legendary Pokemon 6th gen!
poster_name: Pokedude
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: exclamation
body:
  Hi! So here is an art contest page where when I give a description of a thing or person you draw them and I choose which one looks best and the best wins a legendary Pokemon in gen 6 games! No AR on my part though I get them from online people so I am not 100% sure though I am careful.<br />First drawing contest for a Phione or Larvesta!<br /><br />A man in his 20s who has long navy blue hair and a short goatee. He is tall and well built and he wears a silver breast plate over a blue tunic rimmed with gold thread. Under the tunic he wears beige pants with brown leather boots. His weapon is a katana like sword.


subject: Re: The pokegear option on my pause menu is gone
poster_name: Inkblot
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8306.msg209103#msg209103 date=1522869774]<br />That should be D958. Changing it to 00 should fix it.<br /><br />Also check D959 (last PokÃ©dex mode) it might be glitched so if it is try changing it to 00 (new), 01 (old) or 02 (A-Z).<br />[/quote]<br /><br />cool, that fixed it! Thanks!


subject: Re: The pokegear option on my pause menu is gone
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Inkblot link=topic=8306.msg209106#msg209106 date=1522872570]<br />[quote author=Princess Torchic â¤ link=topic=8306.msg209103#msg209103 date=1522869774]<br />That should be D958. Changing it to 00 should fix it.<br /><br />Also check D959 (last PokÃ©dex mode) it might be glitched so if it is try changing it to 00 (new), 01 (old) or 02 (A-Z).<br />[/quote]<br /><br />cool, that fixed it! Thanks!<br />[/quote]<br /><br />You&#039;re welcome :)


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  And the thing is? That all was snake NP entropy. Or Rozzier or whatever. Like, sound waves generated ffrom movement. As in, unconscious. I didn&#039;t know that the software development community was a nightmare nor do I use antebellum.


subject: Re: &quot;The Ghost of Glitch City&quot;
poster_name: Cello2WC
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, I was on VBA. I normally use BGB but I was trying to replicate this specific effect and it seems like it only happens in VBA. There was some text in the video where i mention this briefly but it was during the intro cutscene so I don&#039;t blame you if you skipped it.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Masuta Satoshi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Masuta Satoshi
icon: xx
body:
  [quote author=Epsilon link=topic=6638.msg208710#msg208710 date=1519237419]<br />[quote author=Masuta Satoshi link=topic=6638.msg208707#msg208707 date=1519230928]<br />Can anyone help me?<br /><br />Is there any Arbitrary Code to control what DVs I want to change to a Pokemon? For example:<br /><br />-15/15/15/15<br />-15/10/10/10<br /><br />Ive been seen some videos but they just pust the neccesary items (and in different ways, so I cant find a pattern). Some examples:<br /><br />https://www.youtube.com/watch?v=H8AgGp5cqPI&amp;t=308s<br />https://www.youtube.com/watch?v=RCrzcqLEauQ<br /><br />Ty.<br />[/quote]<br /><br />The following codes are used to edit the DVs of box Pokemon 1.<br /><br />You can use<br /><br />8f<br />Any<br />Carbos x218 (hex:DA)<br />X Accuracy x178 (hex:B2)<br />Lemonade xDVOne<br />TM03 x55 (hex:37)<br />Elixer x71 (hex:47)<br />Awakening xDVTwo<br />Escape Rope x121 (hex:79)<br />Max Elixer x176 (hex:B0)<br />Ether x119 (hex:77)<br />TM01 x[Any qty]<br /><br />To write to the Speed/Special IVS. Then, to write to attack/defense IVs, toss one X Accuracy.<br /><br />Alternatively, you may also use this code, which writes to all DVs in one go. It takes a bit of math to use, however.<br /><br /><br />8f<br />Any<br />Thunderstone x177 (hex:B1)<br />TM18 x4 (hex:04)<br />Lemonade x#FirstNum<br />Water Stone x82 (hex:52)<br />Awakening x#SecondNum<br />Escape Rope x121 (hex:79)<br />Max Elixer x119 (hex:77)<br />TM01 x[Any qty]<br /><br />To find the numbers, simply take the first DV * 16 + the second DV. For the second number, do this with the third and fourth DVs<br /><br />So<br /><br />15/10/10/10<br /><br />...would be<br /><br />Thunderstone x177 (hex:B1)<br />TM18 x4 (hex:04)<br />Lemonade x250 (hex:FA)<br />Water Stone x82 (hex:52)<br />Awakening x170 (hex:AA)<br />Escape Rope x121 (hex:79)<br />Max Elixer x119 (hex:77)<br />TM01 x[Any qty]<br />[/quote]<br />It&#039;s me again. Thanks for this information. I was able to manipulate at 100% and now I have all the 151 PokÃ©mon with MAX DV, sometimes i make the DVs 15/10/10/10 so I could get a shiny when I trade to Gen II, but i am already using Coin case glitch there, so i was just checking.<br /><br />I noticed there are different ACEs but the order of items are the same. At least I&#039;m using Pidgey 233 current HP, Paras, Onix, Tentacool and Kangaskhan in my party in that order. In Yellow, i had to fullfill a box with slowpokes voltorb, jolteon and geodudes to manipulate the DVs of the first pokemon of my party, i&#039;m wondering if there will be a simpler ACE in Yellow with ws&amp;m.<br /><br />Before I forget, can someone pass me the list of items to get max stat experience in every DV using 8F?<br /><br />Before u answer all my doubts, thanks in advance. I really appreciate your support.<br /><br />EDIT: and any item setup to make Pokemon level 100 instead of training of using rare candies? and any item setup to make any item x255 to not use the missingno glitch? I have already the setup to have any item I want (transform the second item in another item with the next index number) but I watch a video using ws&amp;m to get x255 of the second item, what about 8F?


subject: Re: Pocket Monsters Red- Glitch Pokemon Diary (will be updated periodically)
poster_name: CytricAcid
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Fuizi&#039;s crash sounds more like a crash from an invalid growth rate, not the sprite. its using an experience rate that divides by zero, not the sprite<br /><br />https://forums.glitchcity.info/index.php?topic=6588.0 this is a topic about invalid growth rates and the description of the growth rates that divide by zero sound like the type of crash youre experiencing, especially the hang after the nickname screen.


subject: Re: [request] Hidden Power DVs Arbitrary Code using w sm in Yellow
poster_name: Miku
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  These codes don&#039;t work at all. I did exactly what you said and nothing happens to Zapdos&#039; DVs. Could you maybe try it yourself and see if it works? Or am I still doing something wrong?


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Tabbender
icon: xx
body:
  I&#039;m currently trying to learn glitch moves 0xFFFF and 0x3FFF to a Smeargle so that i can corrupt them into a full 31 set of IV&#039;s<br /><br />But for some reasons 0xFFFF, despite being a normal, damage-dealing move, is impossible to Sketch. Sketch will simply fail if you try to use it to get this move. As for 0x3FFF, the game softlocks as soon as the enemy Ditto tries to use it, for some reason. It doesn&#039;t freeze, as i&#039;m still able to reset, but it softlocks.<br /><br />Does anyone know a way around either of these issues ? With a lucky RNG and Type 8 corruption (the best one if used well imo) i&#039;m able to obtain basically any pokemon with any moveset, and shiny to top it off. I really wish i could corrupt the IV&#039;s as well.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Tabbender link=topic=6868.msg209116#msg209116 date=1523038249]<br />I&#039;m currently trying to learn glitch moves 0xFFFF and 0x3FFF to a Smeargle so that i can corrupt them into a full 31 set of IV&#039;s<br /><br />But for some reasons 0xFFFF, despite being a normal, damage-dealing move, is impossible to Sketch. Sketch will simply fail if you try to use it to get this move. As for 0x3FFF, the game softlocks as soon as the enemy Ditto tries to use it, for some reason. It doesn&#039;t freeze, as i&#039;m still able to reset, but it softlocks.<br /><br />Does anyone know a way around either of these issues ? With a lucky RNG and Type 8 corruption (the best one if used well imo) i&#039;m able to obtain basically any pokemon with any moveset, and shiny to top it off. I really wish i could corrupt the IV&#039;s as well.<br />[/quote]<br /><br /><br />There are several reasons that can prevent a glitch move from being Sketched :<br />- The move&#039;s name used in battle softlocks the game (see Wack0&#039;s post for what I&#039;m meaning)<br />- The move&#039;s name used in battle overwrites battle data, which freezes/crashes the game after a few text screens/after 1 turn/when trying to flee, or forces Smeargle to miss its Sketch.<br />- The move&#039;s effect prevents it from being Sketched.<br />- Some pointer used during the skecthing subroutine gets a value that makes the game crash (the graphics shift and then the game crash, usually).<br />- The move&#039;s name that is read once again when the move is Sketched messes up the battle and makes it impossible to end/crashes the game.<br />- Something (for some glitch moves) makes the game crash if the sketcher&#039;s nickname has a certain amount of letters. (This is a bit odd and I don&#039;t know what causes it)(In general, using a shorter nickname does the trick).<br />- The other glitch moves that your PokÃ©mon know mess up the battle or freeze the game and makes your Smeargle unable to use Sketch. (This can technically be circumvented by using a glitch move that turns the battle into a Battle Palace fight, in order to prevent Smeargle&#039;s moves from being displayed, but that makes things a bit more tedious)<br /><br /><br />On a French Emerald, the best Glitch moves I could get for a &quot;Misc read on Attacks&quot; were 0x3FBF and 0xFEFF.<br />0x3FBF had to be Sketched first as 0xFEFF interferes too much with the fight.<br />Luckily, both of these moves have a glitch type that allows them to be seen and swapped on the contest stats summary.<br /><br /><br />Making a PokÃ©mon learn any move could be doable with ACE by calling the function that makes a PokÃ©mon at a set party slot learn a chosen move.<br />Else, you would need to know your PokÃ©mon&#039;s checksum and overwrite a part of its data with an ACE in order to manually change its moves.<br />


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [flash=480,360]https://www.youtube.com/watch?v=iWwvg3aXUzk[/flash]<br /><br />&quot;Are you that sure?&quot;<br /><br />&quot;Yes, I&#039;m Thatcher.&quot;


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Tabbender
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Tabbender
icon: xx
body:
  Would putting the wild Ditto to sleep do the trick ? I know that in gen 4 a sleeping pokemon trying to use a move will make it its last move used, but i&#039;m not sure if it was already the case in gen 3.<br /><br />Also i don&#039;t know anything about ASM so i really don&#039;t know which ACE code you would need to use in order to get this result.<br /><br />EDIT: Just tried the sleep thing, somehow Sketch still fails for 0xFFFF and trying to use it on 0x3FFF is apparently enough to softlock the game.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  &gt;Using Google Chrome<br />&gt;Looking up possible guns for the hero of my story to use<br />&gt;A little window appears in the top left corner:<br />&gt;&quot;Google would like to know your location.&quot;<br /><br />Kek fuck off CSIS.<br /><br />[size=7pt]I eventually chose the CZ SP 75 Phantom. Did I do good?[/size]<br /><br />Also, now that we can add Flash things to our posts, how about bringing back the spoiler tags?


subject: Re: Gun Control in the US
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I donâ€™t understand why everyoneâ€™s focusing on ARâ€15s when the vast, vast majority of gun deaths, including homicides, are from handguns.


subject: Re: Gun Control in the US
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The NRA started coming out in support of gun control when the Black Panther began equipping African Americans with guns.<br /><br />Guns allow people for an out from abusive situations.


subject: Re: Religion
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Sasara
icon: xx
body:
  Atheism implies white noise empiricism. Technically, Charles Darwin was correct, but if quantum suicide is true, then evolution happened along a line of NP noise rather than true randomness.<br /><br />Black people and especially Asian people usually notice that the Universe organizes itself to keep itself consistent.<br /><br />Also, Mohammad was an anarchist(?)<br /><br />[quote author=IIMarckus link=topic=4813.msg208439#msg208439 date=1516926512]<br />[quote author=Parzival link=topic=4813.msg208430#msg208430 date=1516883774]<br />neither of you are gonna bring up why the KJV exists in the first place? <br />[/quote]<br /><br />What, that King James had an agenda? Of course he did.<br />[/quote]<br /><br />all I know is that the English language gobbles up every single other language in existence


subject: Re: 2-PokÃ©mon Yellow ACE setup using 4F item (works in all games now)
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I managed to construct a jump that only requires a special PokÃ©mon as the last one that visited the day care:<br /><br />[u]For european non-english games:[/u]<br />Take any pokÃ©mon with [b]24 current HP[/b] at [b]Lv 25[/b].<br />It&#039;s moveset has to consist of 4 moves with the first move at [b]33 current PP (no PP-Up)[/b], second move at [b]38 current PP (no PP-Up[/b]; has to be [i][b]39 for red/blue[/b][/i]), third move at [b]19 current PP (3 PP-Up)[/b], fourth move at [b]41 current PP (3 PP-Up)[/b].<br /><br />As pokÃ©mon that satisfies this moveset (enough max PP) you can use a Bellsprout with Poisonpowder, Growth, Sleep Powder &amp; Stun Spore as its moves.<br /><br />Here&#039;s the asm code associated with these values:<br />[code]HP &amp; Lv (jump to current PP values)<br />-----------<br />jr 19<br /><br />current PP values<br />------------------<br />ld hl, d327<br />jp (hl)[/code]<br /><br /><br />[u]For english games:[/u]<br />This one is a bit more complicated and is untested, but should still work.<br />Note that some 8F codes like maximize previous item count relying on a specific value of the hl register won&#039;t work with this one.<br /><br />First, you have to trade the pokÃ©mon from a Gen2-game holding a [b]Water Stone[/b] as its item. It&#039;s first move has to be [b]Bind[/b].<br />Afterwards, you have to set up the current PP of its first three moves: <br />first move at [b]3 current PP (3 PP-Up)[/b], second move at [b]33 current PP (no PP-Up[/b]; has to be [i][b]34 for red/blue[/b][/i]), third move at [b]19 current PP (3 PP-Up)[/b].<br /><br /><br />asm code:<br />[code]Item/Catch Rate &amp; first move<br />------------------<br />jr 14<br /><br />current PP values<br />------------------<br />jp d327[/code]<br /><br /><br />It might be possible to create a Gen1-only PokÃ©mon using a Nidorina with Doublekick and Scratch to jump to some EV-value and tailor them to jump forward to PP-Values.


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Mefista
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I think I found either a glitch or a very odd intetional thing in Xi Kong Shin Shou (on that dumbass mobile emulator, so can&#039;t provide a save): if your monster holds that sphere that regenerates a part of health if it&#039;s low, and hurts itself from being confused, the sphere regenerates opponent&#039;s health instead, and your monster stays alive with 0 health (that remains that way even post-battle without becoming an obligatory 1hp, tho you can give the monster a potion and it&#039;d be fine).<br />It happened to my Bladeberus TWICE, with that one jiagshi monster in the lighthouse.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  http://www.refused-classification.com/censorship/games/s.html#spin-the-bottle-adults-only-interactive-dvd-game


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  https://www.reddit.com/r/DestinyTheGame/comments/8aod0z/destiny_2_could_learn_a_lot_from_splatoon_2_in/


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Kyoukipichi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As for Rin, she started talking to me on her own basis and some time after that she referred to herself as Lucifer out of nowhere


subject: Re: 2-PokÃ©mon Yellow ACE setup using 4F item (works in all games now)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks spamviech! This is a better setup than mine, I didn&#039;t think about the possibility to have a move with 41 PP once PP Ups are used. I&#039;ll add this to the wiki page :)


subject: Re: The Glitchy Thread of Topiclessness (#3)
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Sasara link=topic=8204.msg208302#msg208302 date=1516363283](stuff)[/quote]<br /><br />I like your new avatar.


subject: Re: If you had to (...) game
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If it doesn&#039;t defeat the point (e.g. glitch showcase, playing casually), then sure.<br /><br />If you had to flee the country, where would you go?


subject: Re: You know you've been playing PokÃ©mon too long when...V2
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  (y tho. and why don&#039;t they use mGBA.)<br /><br />When you start wishing you were a pokemon rather than a human.


subject: Re: 1000 Ways to get kicked out of Wal-Mart/Target
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  212. Exile the cashier.<br />213. Shuffle the cashier into its owner&#039;s library.<br />214. Cyclonic Rift overloaded.


subject: Re: The V,^,and &lt; game
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  ^ No. :(<br />= Some games are too big to fail. Also, I wonder why Yeniaul deleted their account.<br />v Have you ever played [i]Doki Doki Literature Club![/i]?


subject: Re: The magic Machine
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The machine roars back to life, spitting out a steady stream of foxgirls.<br /><br />Inserts a cowboy hat, sets the big dial to SPARC, and presses the octarine &amp; BZZ buttons.


subject: Re: The magic Machine
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You roll a critical miss, the machine destroys the single other form of intelligent life in the universe. Gr8 job m8<br /><br />I remove the wire between the WAH and WAAAAAAAAAAAAH plugs, flick the REBOOTIFY switch and kick the machine.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  <br />03:B4FD BestPacketEverThanksZZAZZ<br />03:B502 SHOUTOUTSTOSIMPLEFLIPS<br />03:B506 CANTSTOPTHEMEMZ


subject: Re: The magic Machine
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Waluigi stumbles out of the output chamber and kicks you.<br /><br />Inserts a Shy Guy into the machine and presses the TEXAS button.


subject: Re: Nintindo DS Vs. Gamecube
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  DS : portable, decent battery, TWO SCREENS (it&#039;s awesome to have information such as mini-maps that don&#039;t clobber the play screen), touchscreen (which offers a refreshing amount of new control schemes, or at least did when it was launched). Graphics are good, too (I&#039;m not bothered by the &quot;meh&quot; screen resolution)


subject: Re: Gun Control in the US
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So do knives. Apparently in London the government tells you thereâ€™s [url=https://twitter.com/MayorofLondon/status/982906526334668800]never a reason to carry a knife[/url]. Sounds like they have small imaginations if they canâ€™t think of a legitimate reason to carry a knife. I honestly thought this was a joke tweet at first:<br /><br />[img]https://iimarckus.org/etc/london-knives.png[/img]<br /><br />Now acid attacks are [url=https://www.cnn.com/2018/01/26/europe/london-acid-attacks-2017-intl/index.html]on the rise[/url]. Starting to think that banning every potentially dangerous item in common use may not be the solution here.


subject: Re: Gun Control in the US
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Epsilon
icon: xx
body:
  [quote author=IIMarckus link=topic=8276.msg209154#msg209154 date=1523355205]<br />Starting to think that banning every potentially dangerous item in common use may not be the solution here.<br />[/quote]<br /><br />this-&gt;Exactly() ;


subject: ã‚®â–¼ã‚¢ã‚´ (0xC2)'s arbitrary PokÃ©dex data in Japanese Yellow
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  I found this on a 2ch discussion thread about PokÃ©mon glitches<br />https://2ch.vet/re_nozomi_poke_1477904768_2_100<br /><br />Basically somebody found one of my videos<br />(https://www.youtube.com/watch?v=_yBGAVUm0dk) and applied it to Japanese Yellow.<br /><br />[quote]<br /><br />ç¬¬ä¸€ä¸–ä»£ã ã‘ã©ã€ã¾ãŸæ–°ã—ã„ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œæ–¹æ³•ãŒç™ºè¦‹ã•ã‚Œã¦ãŸ <br />ã§ã‚‚ã“ã‚Œæ—¥æœ¬èªžç‰ˆã ã¨ç„¡ç†ã‹ã‚‚ <br />http://www.youtube.com/watch?v=_yBGAVUm0dk <br /><br />ä¸€å¿œã€å›³é‘‘å†…å®¹ã®æé€ ã¾ã§ãªã‚‰VCãƒ”ã‚«ãƒãƒ¥ã‚¦ã§ã‚‚å¯èƒ½ã ã£ãŸï¼ˆã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã§ã¯ãªã„ï¼‰ <br />ãƒœãƒƒã‚¯ã‚¹ã®ãƒã‚±ãƒ¢ãƒ³ã«ãƒ‹ãƒƒã‚¯ãƒãƒ¼ãƒ ã‚’ä»˜ã‘ãŸã‚ã¨ã€ã‚®â–¼ã‚¢ã‚´ï¼ˆC2hï¼‰ã‚’å‡ºã—ã¦æ•ç²ã™ã‚‹ <br /><br />ãƒ‹ãƒƒã‚¯ãƒãƒ¼ãƒ ä¾‹ <br />ã€€17ï¼šã†ã†ã‚‰ã‚ã– <br />ã€€18ï¼šã‚“ãƒ¥ã‚²ãƒã‚° <br /><br />ã‚®â–¼ã‚¢ã‚´ã®è£œè¶³ <br />ãƒ»æ•ç²æ™‚ã«å›³é‘‘ã‚’è¡¨ç¤ºã™ã‚‹ã«ã¯ã€ã‚®ãƒ£ãƒ­ãƒƒãƒ—ã‚’è¦‹ã¤ã‘ã¦ã„ãªã„å¿…è¦ãŒã‚ã‚‹ <br />ãƒ»5ç•ªç›®ã®ç¨®é¡žã‚’64ã§å‰²ã£ãŸä½™ã‚ŠãŒ32æœªæº€ã®å ´åˆã€32å¤§ãã„é“å…·ã«å¤‰åŒ–ã™ã‚‹ï¼ˆã‚³ã‚¤ãƒ³ã‚±ãƒ¼ã‚¹ã¯ã¯ã‚„ã¶ã•ãƒãƒƒãƒ‚ã«ãªã‚‹ã¯ãšï¼‰ <br />ãƒ»æˆ¦é—˜é–‹å§‹ã®æš—è»¢å¾Œã€ã‚³ãƒžãƒ³ãƒ‰å…¥åŠ›å¯èƒ½ã«ãªã‚‹ã¾ã§ã‚„ãŸã‚‰æ™‚é–“ãŒã‹ã‹ã‚‹å ´åˆãŒã‚ã‚‹ï¼ˆã‚°ãƒ©ãƒ•ã‚£ãƒƒã‚¯ãŒåŽŸå› ï¼Ÿï¼‰ <br />[/quote]<br /><br />What the post is saying basically is if you catch ã‚®â–¼ã‚¢ã‚´ (0xC2) (possible with Trainer escape glitch and a Special stat of 194) and do not have Rapidash set as seen in the PokÃ©dex, its PokÃ©dex entry will appear. Its category will be based on the second character of PokÃ©mon 17 in the PokÃ©mon storage system (beginning at DEC5) and the data that follows.<br /><br />This is what you get for the quoted example.<br /><br />[img]https://i.imgur.com/KRXn8ak.png[/img]<br /><br />è£æŠ€	ã€ã†ã‚‰ã‚ã–ã€‘ means &quot;secret trick&quot; but is actually a [url=https://en.wikipedia.org/wiki/Urawaza]cultural phrase[/url]. In this case ã‚®â–¼ã‚¢ã‚´ is now the &#039;secret trick&#039; PokÃ©mon and has the word &quot;ãƒã‚°&quot; (bug as in a software bug) in the main text of its PokÃ©dex entry. <br /><br />According to my research for â‚½ (hex:F9) in English Yellow, the source is F403 (copy of D403) and using the 08 text command character five bytes after the category name&#039;s first 0x50 byte could execute arbitrary code.<br /><br />However, I don&#039;t know if the poster was ever able to execute arbitrary code, and placing the 08 five bytes after the category name&#039;s 0x50 for ã‚®â–¼ã‚¢ã‚´ doesn&#039;t want to work for me for some reason (in fact the main entry text box text occupies this region but it ignored the text command character).<br /><br />I tested this in v1.0 so there is a chance it could work differently in v1.1, v1.2 or v1.3. However the 2ch poster said it works on Virtual Console Yellow which could be v1.1+(?)


subject: Why does ????? (00) break out of a Master Ball?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  ????? (00) surprisingly can break out of a Master Ball if you throw a Master Ball at it.<br /><br />I was wondering whether anyone knows why this occurs?<br /><br />This isn&#039;t to be confused with the low or 1/256 Master Ball miss on other PokÃ©mon which is false.<br /><br />You can test this with the following GameShark codes:<br /><br />PokÃ©mon Gold and Silver:<br /><br />0101FDD5 - Have Master Ball in Balls pocket<br />0163FED5&nbsp; - x255<br /><br />0100EDD0 - Wild PokÃ©mon is ????? (00)<br />010042D0 - Prevent in Link Battle glitch<br /><br />PokÃ©mon Crystal:<br /><br />0101D8D8 - Have Master Ball in Balls pocket<br />01FFD9D8 - x255<br /><br />010004D2 - Wild PokÃ©mon is ????? (00)


subject: Re: Why does ????? (00) break out of a Master Ball?
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I gave this a go on my dead Crystal cart and it broke out of every single Master Ball I threw before struggling itself and my starter to death. Is it possible for Glitchmon to have glitched catch rates?


subject: Re: Why does ????? (00) break out of a Master Ball?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=8311.msg209158#msg209158 date=1523402974]<br />I gave this a go on my dead Crystal cart and it broke out of every single Master Ball I threw before struggling itself and my starter to death. Is it possible for Glitchmon to have glitched catch rates?<br />[/quote]<br /><br />Definitely, but for some reason those with 0 in the catch rate constant data for Red/Blue/Yellow still can&#039;t break out of a Master Ball (for example https://glitchcity.info/wiki/GlitchDex/Y:200).


subject: Re: Why does ????? (00) break out of a Master Ball?
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The function [url=https://github.com/pret/pokecrystal/blob/7307fc8dce605823fbdf8e5ec8530d7aaf675cfa/engine/items/item_effects.asm#L200][tt]PokeBallEffect[/tt][/url] sets [tt]wWildMon[/tt] to the value of [tt]wEnemyMonSpecies[/tt] when a PokÃ©mon is caught (either because the catch rate check succeeds, the battle is the Dudeâ€™s tutorial, or a Master Ball was used), and to 0 when a ball fails to catch the PokÃ©mon. If the species is number 0, [tt]wWildMon[/tt] will be 0, just as if the ball failed.


subject: Re: Why does ????? (00) break out of a Master Ball?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=8311.msg209160#msg209160 date=1523407856]<br />The function [url=https://github.com/pret/pokecrystal/blob/7307fc8dce605823fbdf8e5ec8530d7aaf675cfa/engine/items/item_effects.asm#L200][tt]PokeBallEffect[/tt][/url] sets [tt]wWildMon[/tt] to the value of [tt]wEnemyMonSpecies[/tt] when a PokÃ©mon is caught (either because the catch rate check succeeds, the battle is the Dudeâ€™s tutorial, or a Master Ball was used), and to 0 when a ball fails to catch the PokÃ©mon. If the species is number 0, [tt]wWildMon[/tt] will be 0, just as if the ball failed.<br />[/quote]<br /><br />Thank you HÃ¡Äky! :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Azarokkusu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Azarokkusu
icon: xx
body:
  Enemies constantly have 0 hp (insta fainting enemy pokemon) in R/B. In two parts: <br /><br />inventory (from item 3):<br />awakening x 128<br />lemonade x 195<br />carbos x 59<br />repel x 213<br />tm26 x 12<br />great ball x 124 <br />tm26 x 12<br />fresh water x 123<br />tm26 x 201<br />(any items can be from here on)<br /><br />[code]<br />ld c,$80<br />ld a,$C3<br />ld h,$3b<br />ld e,$d5<br />ld ($FF00+c),a<br />inc c&nbsp; <br />inc b<br />ld a,h<br />ld ($FF00+c),a<br />inc c<br />inc a<br />ld a,e<br />ld ($FF00+c),a<br />ret<br />[/code]<br /><br />Stored items: (from stored item 1):<br />Thunderstone x 230<br />TM07 x 54<br />Master Ball x 53<br />poke ball x 44<br />max revive x 1<br />revive x 201<br />(any items can be from here on)<br /><br />[code]<br />ld hl,$cfe6<br />ld (hl),$01<br />dec (hl)<br />inc b<br />inc l<br />ld (hl),$01<br />dec (hl)<br />ret<br />[/code]<br /><br />Basically, the boxed items are the code that sets $cfe6=0 and $cfe7=0, and the inventory items set $ff80 through $ff82 so it jumps to the boxed items, meaning the code in the boxed items is executed every frame (OAM DMA hijacking)<br /><br />The boxed item code is intentionally padded so you don&#039;t have to have two stacks of the same item in the&nbsp; box because that can get messy if you aren&#039;t careful.


subject: Re: ã‚®â–¼ã‚¢ã‚´ (0xC2)'s arbitrary PokÃ©dex data in Japanese Yellow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This might be due to PokÃ©dex entries being printed using a certain control char, which probably ignores all other control chars (since text is printed differently).<br />I might be wrong though, I haven&#039;t looked into it.


subject: Best settings for BGB emulator for glitches
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m kind of a glitching newbie, and have been fooling around with glitches in Pokemon Blue emulated via BGB. The problem I&#039;m encountering is that nearly 100% of the time, instead of achieving the desired glitch, the game crashes. Is this due to incorrect performance of a glitch, or are there certain settings on the BGB emulator that make glitches easier to perform/the game less likely to crash?


subject: Re: Best settings for BGB emulator for glitches
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=etoile link=topic=8312.msg209165#msg209165 date=1523457646]<br />I&#039;m kind of a glitching newbie, and have been fooling around with glitches in Pokemon Blue emulated via BGB. The problem I&#039;m encountering is that nearly 100% of the time, instead of achieving the desired glitch, the game crashes. Is this due to incorrect performance of a glitch, or are there certain settings on the BGB emulator that make glitches easier to perform/the game less likely to crash?<br />[/quote]<br /><br />That&#039;s odd (BGB is quite accurate and you shouldn&#039;t need to change any settings most of the time), though a lot of glitches are quite specific. Which glitches are you attempting?


subject: Re: Best settings for BGB emulator for glitches
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: etoile
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8312.msg209166#msg209166 date=1523461748]<br />That&#039;s odd (BGB is quite accurate and you shouldn&#039;t need to change any settings most of the time), though a lot of glitches are quite specific. Which glitches are you attempting?<br />[/quote]<br />[font=verdana][size=2]It might be more that I&#039;m impatient and don&#039;t like playing through the game proper to get to the glitches so I just edit RAM and such directly, but I did legitimately attempt the &quot;walk through walls to fight pokemon before obtaining a pokemon&quot; glitch and it only ever crashed.[/size][/font]


subject: Re: Best settings for BGB emulator for glitches
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=etoile link=topic=8312.msg209167#msg209167 date=1523462257]<br />[quote author=Princess Torchic â¤ link=topic=8312.msg209166#msg209166 date=1523461748]<br />That&#039;s odd (BGB is quite accurate and you shouldn&#039;t need to change any settings most of the time), though a lot of glitches are quite specific. Which glitches are you attempting?<br />[/quote]<br />[font=verdana][size=2]It might be more that I&#039;m impatient and don&#039;t like playing through the game proper to get to the glitches so I just edit RAM and such directly, but I did legitimately attempt the &quot;walk through walls to fight pokemon before obtaining a pokemon&quot; glitch and it only ever crashed.[/size][/font]<br />[/quote]<br /><br />Hmm. In Red and Blue battling with 0 PokÃ©mon causes a freeze after the battle (unless you are in Diglett&#039;s Cave) which doesn&#039;t occur in Yellow, so that could explain why if the freeze occurred then.<br /><br />If your PokÃ©mon has move 0 as its first move (or a Super Glitch move in any slot 1-4) and the freeze occurred after choosing to fight, that could also be responsible as viewing it can cause corruption that freezes the game without the proper setup.


subject: Re: Best settings for BGB emulator for glitches
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: etoile
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8312.msg209168#msg209168 date=1523464329]<br />Hmm. In Red and Blue battling with 0 PokÃ©mon causes a freeze after the battle (unless you are in Diglett&#039;s Cave) which doesn&#039;t occur in Yellow, so that could explain why if the freeze occurred then.<br /><br />If your PokÃ©mon has move 0 as its first move (or a Super Glitch move in any slot 1-4) and the freeze occurred after choosing to fight, that could also be responsible as viewing it can cause corruption that freezes the game without the proper setup.<br />[/quote]<br /><br /><br />That sounds like it might be part of the problem! Unfortunately, the crash happens the moment I open the fight menu.<br /><br /><br />What would be the proper setup?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The problem with this code is that sprites will cease to be updated anymore. Here&#039;s a replacement :<br />[code]<br />Carbos x255 (hex:FF)<br />X Accuracy x128 (hex:80)<br />Lemonade x205 (hex:CD)<br />Water Stone x62 (hex:3E)<br />Max Repel x60 (hex:3C)<br />Fresh Water x34 (hex:22)<br />Parlyz Heal x198 (hex:C6)<br />Super Repel x34 (hex:22)<br />Awakening x13 (hex:0D)<br />PokÃ© Ball x129 (hex:81)<br />Great Ball x34 (hex:22)<br />TM01 x[Any qty]<br />[/code]<br /><br />Box items :<br />[code]<br />Awakening x70<br />Thunderstone x230<br />TM07 x175<br />Water Stone x34<br />Lemonade x165<br />TM01 x[any qty]<br />[/code]<br /><br /><br />Code :<br />[code]<br />ld h, $FF<br />ld l, $80<br />ld a, $CD<br />ld [hli], a<br />ld a, $39<br />inc a<br />inc a<br />ld [hli], a<br />rrca ; a = $9D<br />add a, $38 ; a = $D5<br />ld [hli], a<br />ld c, $0D<br />inc b<br />add a, c<br />inc bc<br />ld [hli], a<br />ret<br /><br />; Code written :<br />; call D53B (wBoxItems)<br />; ld [c], a<br />; CD 3B D5 E2 <br />[/code]<br />Box items :<br />[code]<br />ld c, $46<br />ld hl, $CFE6<br />xor a<br />ld [hli], a<br />ld [hli], a<br />ld a, $C3<br />ret<br />[/code]<br /><br /><br />Btw, here are some precautions that must be taken while this is active :<br />[list]<br />[li]Ensure that the box items are set up BEFORE using 8F!![/li]<br />[li]Once the setup is active, it will stay active until your reset (whether you saved or not)[/li]<br />[li]DO NOT modify the listed box items while the setup is active. Modifying the items below the listed ones is fine, but be careful about depositing items that would alter the quantities of listed items.[/li]<br />[li]To temporarily disable the setup, swap TM01 with Thunderstone. This allows you to freely modify listed items BELOW TM01. Swap again to re-enable the setup. (Note: this might cause garbage sprites to appear on-screen, but it&#039;s only a visual issue, don&#039;t worry.)[/li]<br />[/list]


subject: Re: Best settings for BGB emulator for glitches
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=etoile link=topic=8312.msg209169#msg209169 date=1523465358]<br />[quote author=Princess Torchic â¤ link=topic=8312.msg209168#msg209168 date=1523464329]<br />Hmm. In Red and Blue battling with 0 PokÃ©mon causes a freeze after the battle (unless you are in Diglett&#039;s Cave) which doesn&#039;t occur in Yellow, so that could explain why if the freeze occurred then.<br /><br />If your PokÃ©mon has move 0 as its first move (or a Super Glitch move in any slot 1-4) and the freeze occurred after choosing to fight, that could also be responsible as viewing it can cause corruption that freezes the game without the proper setup.<br />[/quote]<br /><br /><br />That sounds like it might be part of the problem! Unfortunately, the crash happens the moment I open the fight menu.<br /><br /><br />What would be the proper setup?<br />[/quote]<br /><br />The easiest solution is if you open the PokÃ©mon menu just before viewing the Fight menu (all within battle), then the corruption shouldn&#039;t freeze the game due to a hidden 0x50 sub-tile (which the game interprets as the end of the move&#039;s name basically) on the battle screen. However you may still get the [url=https://glitchcity.info/wiki/Super_Glitch_(Generation_I)#TMTRAINER_effect]TMTRAINER effect[/url] and a freeze after the battle ends (unless you&#039;re in Diglett&#039;s Cave).<br /><br />The corruption can be avoided entirely in Red/Blue by having [url=https://glitchcity.info/wiki/0x50_sub-tile]the 0x50 sub-tile[/url] early on the screen (towards the top preferably as close to the top-left corner as possible) and opening the PokÃ©mon or items menu before battle, but can be awkward to pull off unless you&#039;re at a place such as Route 1. (Note this method does not work in Yellow)<br /><br />0150A0C3 will also place it at the top-left corner of the screen for you, but you still have to flash the PokÃ©mon menu in battle with this code enabled (works in Red/Blue/Yellow).<br /><br />Hope that helps. :)


subject: Re: Best settings for BGB emulator for glitches
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Princess Torchic â¤ link=topic=8312.msg209171#msg209171 date=1523467289]<br />The easiest solution is if you open the PokÃ©mon menu just before viewing the Fight menu (all within battle), then the corruption shouldn&#039;t freeze the game due to a hidden 0x50 sub-tile (which the game interprets as the end of the move&#039;s name basically) on the battle screen. However you may still get the [url=https://glitchcity.info/wiki/Super_Glitch_(Generation_I)#TMTRAINER_effect]TMTRAINER effect[/url] and a freeze after the battle ends (unless you&#039;re in Diglett&#039;s Cave).<br /><br />The corruption can be avoided entirely in Red/Blue by having [url=https://glitchcity.info/wiki/0x50_sub-tile]the 0x50 sub-tile[/url] early on the screen (towards the top preferably as close to the top-left corner as possible) and opening the PokÃ©mon or items menu before battle, but can be awkward to pull off unless you&#039;re at a place such as Route 1. (Note this method does not work in Yellow)<br /><br />0150A0C3 will also place it at the top-left corner of the screen for you, but you still have to flash the PokÃ©mon menu in battle with this code enabled (works in Red/Blue/Yellow).<br /><br />Hope that helps. :) <br />[/quote]<br /><br /><br />Awesome! Thank you!!


subject: Re: How to catch glitch PokÃ©mon in D/P(Pl?)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Princess Torchic â¤
icon: xx
body:
  [quote author=RichardG867 link=topic=8267.msg208884#msg208884 date=1521309861]<br />This is also possible in the HG/SS Safari Zone. <br /><br />(...)<br />[/quote]<br /><br />I think this is an obscure fact but I&#039;m not sure if Pomeg glitch works in HeartGold/SoulSilver. <br />Unfortunately for that reason this may be a Diamond/Pearl/Platinum(?) only glitch. I didn&#039;t test the Japanese version however.<br /><br />In at least English HeartGold/SoulSilver I wasn&#039;t able to get the Pomeg glitch to work and I believe I did the same things for it to successfully work in Diamond/Pearl/Platinum (as in this video https://www.youtube.com/watch?v=E12pPXg4-dM).<br /><br />For what its worth if it is possible in HeartGold/SoulSilver you can also activate a glitch where the walking PokÃ©mon stays on the spot by having only fainted PokÃ©mon but can&#039;t remember how.<br /><br />Going to go test this on physical Diamond/Pearl and Platinum by modifying the save file first.<br /><br />Edit 1: US Diamond results: Set up the party like BUGLITCH did but the game froze before battle. :(<br />Edit 2: EU Platinum results: Freeze as before<br />Edit 3: JP Diamond results: Freeze as before<br />Edit 4: Also for what it&#039;s worth, I tried this on the original DS (&#039;DS phat&#039;), a DS Lite and New Nintendo 3DS XL. Same result sadly.<br />Edit 5: Added PKM file for hacked Azumarill. To get it to 0 HP use the Pomeg Berry and then the Rare Candy. https://sites.google.com/site/torchickens2/miscellany<br />Edit 6: Yep, HeartGold/SoulSilver can&#039;t be used for the Pomeg glitch, including Japanese versions (only the maximum HP is reduced). :(


subject: Re: Best settings for BGB emulator for glitches
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  BGB is one of the most accurate GB emulators out there, so, as a general rule, if a crash happens on BGB but didn&#039;t on other emulators, BGB got it right. It does have some emulation issues, but they are extremely few, and beware has been squashing more and more of them.


subject: [English Red/Blue] Using item 0x7A instead if 8F for ACE
poster_name: Dark
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dark
icon: xx
body:
  I recently spent some time working on a setup for using 0x7A as an alternative for using 8F. 0x7A will jump to a spot in daycare data instead of the party, removing the the requirement of having to have certain pokemon in your party to execute code. Currently, 8F is a requirement to set this up as I do not have a method for obtaining 0x7A and bootstrapping the code without needing to use 8F.<br /><br />[b]The following method requires you to be able to use 8F[/b]<br /><br />First, you will need to obtain 0x7A, this can be easily done with the following item list.<br /><br />Item 1: 8F<br />Item 2: Any Item x1<br />Item 3: Lemonade x122 <br />Item 4: X Accuracy x32<br />Item 5: Carbos x211<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br />Then you should remove your pokemon from the daycare (if you have one in there you care about) as the following 4 item lists will modify the OT of that pokemon. They can be executed in any order, as long as all 4 are ran.<br /><br />Item 1: 8F<br />Item 2: 0x7A<br />Item 3: Lemonade x33<br />Item 4: X Accuracy x88<br />Item 5: Carbos x218<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br />Item 1: 8F<br />Item 2: 0x7A<br />Item 3: Lemonade x34<br />Item 4: X Accuracy x89<br />Item 5: Carbos x218<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br />Item 1: 8F<br />Item 2: 0x7A<br />Item 3: Lemonade x211<br />Item 4: X Accuracy x90<br />Item 5: Carbos x218<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br />Item 1: 8F<br />Item 2: 0x7A<br />Item 3: Lemonade x233<br />Item 4: X Accuracy x91<br />Item 5: Carbos x218<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br /><br />Once this is done, you should be ready to use 0x7A like you do with 8F, but without the party pokemon bootstrap needed for 8F<br /><br />(credit goes to Wack0 for the item list used to modify ram, which I made use of here)<br /><br />[s](also this is my first post here)[/s]<br />


subject: MOVED: [English Red/Blue] Using item 0x7A instead if 8F for ACE
poster_name: Princess Torchic â¤
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=//forums.glitchcity.info/index.php?board=115.0]Arbitrary Code Execution Discussion[/url].<br /><br />[iurl]//forums.glitchcity.info/index.php?topic=8313.0[/iurl]


subject: Re: Best settings for BGB emulator for glitches
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8312.msg209175#msg209175 date=1523482558]<br />BGB is one of the most accurate GB emulators out there, so, as a general rule, if a crash happens on BGB but didn&#039;t on other emulators, BGB got it right. It does have some emulation issues, but they are extremely few, and beware has been squashing more and more of them.<br />[/quote]<br /><br /><br />I care less about emulation accuracy than how much I can glitch up the game and have it keep running. :&gt;


subject: Glitch Dimension (ish) in R/B
poster_name: etoile
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  This might have either already been documented or isn&#039;t that powerful, but I managed to trigger a glitch dimension-like effect while fooling around with a ã‚¥ .4 who knew Super Glitch move A6 as its first move. I don&#039;t remember the exact thing I did to trigger this effect, but I do have screenshots (attached to this post); the game was remarkably still pretty playable (though I did force my trainer name to terminate when normally it would be unterminated). Has anyone else seen something like this and/or know how to trigger it?<br /><br /><br />


subject: Re: Glitch Dimension (ish) in R/B
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This occurs because the SGB palette layout isn&#039;t refreshed. I&#039;m not sure what exactly causes this, perhaps the flag tracking whether SGB mode is enabled has been overwritten.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: lel
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: lel
icon: xx
body:
  [quote author=Masuta Satoshi link=topic=6638.msg209111#msg209111 date=1522892481]<br />I noticed there are different ACEs but the order of items are the same. At least I&#039;m using Pidgey 233 current HP, Paras, Onix, Tentacool and Kangaskhan in my party in that order. In Yellow, i had to fullfill a box with slowpokes voltorb, jolteon and geodudes to manipulate the DVs of the first pokemon of my party, i&#039;m wondering if there will be a simpler ACE in Yellow with ws&amp;m.<br />[/quote]<br /><br />There are other somewhat easier ones in my opinion. Rather than the filled box, you could use the other one in the OP, which is only 10 PokÃ©mon (most of which aren&#039;t too hard to catch).<br /><br />You can also use 4F, which isn&#039;t [i]awful[/i]. https://forums.glitchcity.info/index.php?topic=8056.0 . (Note below that I think Krys got an address wrong here).<br /><br />Another possible bootstrap for 4F would be this one I came up with a few nights ago, which I think is a lot better because it allows you to get everything required without any glitches (because I don&#039;t think it&#039;s possible to get a Nidorina unevolved from a NidoranF without Ditto glitch):<br /><br />Put in daycare a Hitmonlee with these moves (you can take it out afterward if you want):<br />* Any move.<br />* Any move that won&#039;t crash the game when used on its own (I use Meditate for this).<br />* Double Kick.<br />* Mega Kick. <br /><br />Then you just need to box:<br />* Any pokemon with current pp as follows: <br />	1) Any PP<br />	2) 33<br />	3) 33 (you can do this method in Red/Blue too, but if you do you just need to change this to 34)<br />	4) 19 with 3 PP Up used<br />* Clefairy (or anything else that won&#039;t crash the game or alter h or l registers) at 233 hp<br />* Anything<br />* Tentacool<br />* Parasect<br /><br />Unless both BGB and the disassembly are giving me the wrong values (and believe me, I&#039;ve double-checked myself on this more than 20 times to make absolutely sure), the value at FA64 is *not* the catch rate of the Daycared PokÃ©mon, it&#039;s the secondary type of the Daycared PokÃ©mon. Since Krys was using Nidorinas, the opcode executed was &quot;inc bc&quot; because Nidorina has type POISON POISON, so DA64=03. This meant that nothing of interest happened and the next byte was executed, which was the catch rate, which is why assuming it jumped to the catch rate didn&#039;t have any harmful effects. I use a Hitmonlee because it&#039;s convenient and learns the moves we need pretty easily, but I think a ton more PokÃ©mon will work as a result, because if you use Fighting type, that&#039;s 01, which means that it eats the next two bytes, the catch rate and the first move. (And other types presumably could be used for other effects. I&#039;m not a fan of the type constants, so I&#039;m not looking any further than this.)<br /><br />So here&#039;s the ASM for this:<br />[code]WRA1:DA64:	01 2D 1B	ld bc,$1B2D<br />WRA1:DA67:	60		ld h,b<br />WRA1:DA68:	24		inc h<br />WRA1:DA69:	18 19		jr DA83<br />WRA1:DA83:	18 2E		jr DAB3<br />WRA1:DAB3:	21 21 D3	ld hl,D321<br />WRA1:DAB6:	04		inc b<br />WRA1:DAB7:	00		nop<br />WRA1:DAB8:	E9		jp [hl][/code]<br /><br />I mean unless BGB&#039;s debugger is giving me the wrong information and I&#039;m counting in the disassembly wrong. But it works when I do it. And the breakpoints I&#039;m setting claim that the things being executed are the things I&#039;m saying are being executed.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: HumptyAce
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello everyone, I&#039;m new here, and it&#039;s now been a while since I started experimenting with ACE. I&#039;d like to step up my knowledge a bit as I&#039;m not much of a programmer myself, and it&#039;s very hard for me to follow everything you guys say here. <br />My goal was to make a setup to be used with ws m in US yellow to set the text speed to 0 (and yes, I know with item underflow this would probably be easier, but oh well).<br />At first I thought id use the &quot;standard&quot; gameshark-&gt;ACE conversion to get to the setup, but cant find any code that does that in yellow. How would i have to proceed? How do I locate the correct part of ram to edit? is there some kind of Register dump of the game?<br />Again, sorry if I&#039;m asking something obvious but again, im pretty much new to this stuff :) 


subject: Re: 2-PokÃ©mon Yellow ACE setup using 4F item (works in all games now)
poster_name: lel
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: lel
icon: xx
body:
  I hate to kind of post this twice, but I guess I should probably put this here since it&#039;s more relevant here than the 8F thread. I&#039;m like 99.9% sure DA64 isn&#039;t catch rate. Like, I&#039;ve looked into this a lot. I just checked again before I started typing here because I want to make absolutely sure.<br /><br />I just went into BGB&#039;s debugger and set D16F-D172 counting down from 9A (that was entirely arbitrary) and then Daycared my first PokÃ©mon. D170 (Type 2 of PokÃ©mon 1 in Yellow) was equal to 99. When I deposited, DA64 was equal to 99.<br /><br />Soooooo, DA64 is the second type in US English. If you count in the disassembly (Daycare begins at DA5F, then count from there to DA64) it confirms this.<br /><br />The reason it looks like DA64 is catch rate is because poison type (like Nidorina) just does &quot;inc bc&quot;. So that does nothing, then moves to the catch rate at DA65. So if you use, for instance, the fighting type, it&#039;ll just eat the next two bytes (catch rate and first move).<br /><br />So then I thought for a second and put a Hitmonlee there because it&#039;s easy to get a Hitmonlee that&#039;s got the necessary moves to do a jump (there are almost definitely better ones for this; it was just the first thing I thought up).<br /><br />So consider this:<br /><br />Put in daycare a Hitmonlee with these moves (you can take it out afterward if you want):<br />* Any move.<br />* Any move that won&#039;t crash the game when used on its own (I use Meditate for this).<br />* Double Kick.<br />* Mega Kick. <br /><br />Then you just need to box:<br />* Any pokemon with current pp as follows: <br />&nbsp;  1) Any PP<br />&nbsp;  2) 33<br />&nbsp;  3) 33 (you can do this method in Red/Blue too, but if you do you just need to change this to 34)<br />&nbsp;  4) 19 with 3 PP Up used<br />* Clefairy (or anything else that won&#039;t crash the game or alter h or l registers) at 233 hp<br />* Anything<br />* Tentacool<br />* Parasect<br /><br />[code]WRA1:DA64:	01 2D 1B	ld bc,$1B2D<br />WRA1:DA67:	60		ld h,b<br />WRA1:DA68:	24		inc h<br />WRA1:DA69:	18 19		jr DA83<br />WRA1:DA83:	18 2E		jr DAB3<br />WRA1:DAB3:	21 21 D3	ld hl,D321<br />WRA1:DAB6:	04		inc b<br />WRA1:DAB7:	00		nop<br />WRA1:DAB8:	E9		jp [hl][/code]<br /><br />This was the best I could think of where you didn&#039;t have to do some stat/EV manipulation or anything and where everything (except 4F itself, of course) is available without doing any glitches.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: lel
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: lel
icon: xx
body:
  [quote author=HumptyAce link=topic=6638.msg209182#msg209182 date=1523580394]<br />At first I thought id use the &quot;standard&quot; gameshark-&gt;ACE conversion to get to the setup, but cant find any code that does that in yellow. How would i have to proceed? How do I locate the correct part of ram to edit? is there some kind of Register dump of the game?<br />Again, sorry if I&#039;m asking something obvious but again, im pretty much new to this stuff :)<br />[/quote]<br /><br />There is! There&#039;s a complete disassembly of the game at [url=https://github.com/pret/pokeyellow]https://github.com/pret/pokeyellow[/url]. This contains literally everything in the entire game (you can use an assembler and turn this disassembly into a perfect, bootable ROM, so it sorta by definition has everything).<br /><br />Then there&#039;s the perhaps more user friendly but somewhat less complete RAM map at [url=https://datacrystal.romhacking.net/wiki/PokÃ©mon_Red/Blue:RAM_map]https://datacrystal.romhacking.net/wiki/PokÃ©mon_Red/Blue:RAM_map[/url]. It&#039;s for Red and Blue, though, but it works for Yellow because [i]most[/i] Yellow RAM addresses are exactly 1 less than those in Red/Blue. So if it says the third bag item is D322 in this list, it actually is D321 in Yellow. <br /><br />So I just control+f&#039;d &quot;text speed&quot; in there, and found that D355 is options, which means $D354 in Yellow. So if you look at that, it says the lower nibble is the text speed, which means the last 4 bits of the byte, which effectively means if you&#039;re representing each byte as a two-digit hex number, the second digit of that hex number is the text speed. It also says that lower numbers in this nibble are faster.<br /><br />In my current settings, it&#039;s set to C1. That is the fastest you can set it by default, because, as you see, the second digit in that is 1. But we could always use ACE to set it to 0, so it would say C0 there.<br /><br />So you&#039;d wanna do something like this:<br /><br />* ws m or something<br />* ws m or something<br />* lemonade x 64<br />* tm34 x 85<br />* tm11 x 201<br /><br />That&#039;s:<br />[code]WRA1:D321:	3E 40		ld a,40<br />WRA1:D323:	EA 55 D3	ld D355,a<br />WRA1:D326:	C9		ret[/code]<br /><br />This is what you&#039;re talking about, right? If you&#039;re talking about like bootstraps to even make ws m work, then there are some in the OP, or you could use like 4F or something using the Krys3000 bootstrap or the one I just posted a few hours ago in this thread.<br /><br />Really, if you want to get started making your own ACE scripts, you just gotta know like the absolute basics about gb z80 asm (really just what the registers are and what the most common mnemonics are and how to use them, like &quot;ld&quot;, &quot;ret&quot;, &quot;jp&quot;, &quot;jr&quot;, &quot;inc&quot;, &quot;dec&quot;, you&#039;ll pick up more as you go along) and just sort of know how to find a particular RAM/ROM address in a RAM/ROM map or the disassembly. You&#039;ll pick up more after that, but that&#039;s enough to get started understanding how a lot of the stuff in this thread works.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: HumptyAce
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s exactly what I needed, I dont know how to thank you. I&#039;ll get into work and let you know if I come up with something at least fun, cause it probably wont be any useful&nbsp; 8) 


subject: Re: Game Boy Game Genie codes?
poster_name: xtreme713ify
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;d like to reignite this thread because I&#039;ve taken interest in Game Genie again. I have an updated code list which I&#039;ll post soon. I have two&nbsp; pages of codes for Wario Land, it&#039;s ridiculous. I&#039;ve managed to do some crazy stuff in tandem with these codes. I&#039;ve found secret paths and glitchy underworlds, maybe I&#039;ll start a thread about it. I got some codes for Pokemon too, but not too many unfortunately.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=lel link=topic=6638.msg209184#msg209184 date=1523582423]<br />Then there&#039;s the perhaps more user friendly but somewhat less complete RAM map at [url=https://datacrystal.romhacking.net/wiki/PokÃ©mon_Red/Blue:RAM_map]https://datacrystal.romhacking.net/wiki/PokÃ©mon_Red/Blue:RAM_map[/url]. It&#039;s for Red and Blue, though, but it works for Yellow because Yellow RAM addresses are exactly 1 less than those in Red/Blue.<br />[/quote]<br />This is only true for addresses past, I think, CF00.


