# smf_messages

subject: Re: ????? party overloading - analysis and exploitation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8095.msg207053#msg207053 date=1506703659]<br />This is quite interesting in Crystal, because these are located very near the end of WRAM, thus near the beginning of Echo RAM. At the beginning of Echo RAM is the stack, which could allow for another ACE method ! My next goal is to research ACE on Crystal using this.<br />[/quote]<br /><br />Wow that&#039;s pretty cool. :) Good luck with your research!


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Str8rush
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hmm, for some reason it did not work... I set everything up properly:<br />Pidgey Level 94 with 233 HP (Max)<br />Parasect<br />Graveler<br />Tentacool<br />Kangaskan,<br /><br />Missigno (52) in the First Slot of my current Box,<br /><br />TM01<br />8F<br />Lemonade *20 for Fire<br />X Acc * 117<br />Carbos * 209<br />PokÃ©ball *199<br />Fresh Water * 201<br /><br />I used 8F in my Bag and nothing happend. When I checked Missignoâ€˜s Status in the box, it was still shown as a 99/Normal PokÃ©mon... any ideas?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah. I haven&#039;t checked your code, though altering the stored type byte doesn&#039;t change the types shown on the summary screen, and only changes the type effectiveness/type the game thinks the PokÃ©mon is in Generation II (which is possibly not shown on the Generation II game either). For that reason it&#039;s possible the code still worked.<br /><br />If not however, make sure your Pidgey also has 233 current HP (rather than max HP though 233 current and max HP still works) if it doesn&#039;t.


subject: Re: Curious about cloning
poster_name: xylo
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=xtreme713ify link=topic=8082.msg207018#msg207018 date=1506576487]<br />Damn that sucks. They&#039;ve been cracking down on this s**t since 3rd gen, but now it&#039;s getting ridiculous.<br />[/quote]<br /><br />I&#039;ll do some testing on cloning soon, and yeah it&#039;s getting really stupid


subject: Re: Having trouble turning PokÃ©mon shiny using ACE in Yellow
poster_name: Snorlax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=8040.msg206374#msg206374 date=1502104272]<br />[quote author=Lumi link=topic=8040.msg206371#msg206371 date=1502054523]<br />I&#039;m having some trouble trying to turn PokÃ©mon shiny using ACE in the Virtual Console version of Yellow and would appreciate any help you can give.<br /><br />Up until the point of trying to turn a PokÃ©mon shiny I&#039;ve been following this guide: [url=https://www.reddit.com/r/pokemon/comments/5q8zlg/getting_gen_1_mew_in_yellow_guide_does_not_work/]https://www.reddit.com/r/pokemon/comments/5q8zlg/getting_gen_1_mew_in_yellow_guide_does_not_work/[/url]<br /><br />It&#039;s been working well and I&#039;m able to use the codes mentioned in that guide (which takes its information from this site), but I&#039;ve hit a wall trying to turn my Mew shiny. I&#039;ve tried several codes that are floating around and none of them worked.<br /><br />Thankfully the codes didn&#039;t wipe my save but I&#039;ve run out of things to try. I did try the search function to look through the forums but didn&#039;t find anything specifically about turning PokÃ©mon shiny. I know the DV&#039;s need to be 10 for Attack, Special and Speed, as well as 2, 3, 6, 7, 10, 11, 14 or 15 for Defense for a PokÃ©mon to be shiny after being transferred to Sun or Moon, I just have no idea how to accomplish that. Any help would be greatly appreciated.<br /><br />I&#039;m using the English version of PokÃ©mon Yellow on Virtual Console.<br /><br />I have the &#039;ws# #m#&#039; item and the following 11 PokÃ©mon set up in my box: 233 HP Seel ,Parasect, Growlithe, Magikarp, Psyduck, Flareon, Tentacool, Female Nidoran, and three other PokÃ©mon.<br />[/quote]<br /><br />Hi Lumi,<br /><br />I think for editing I personally recommend setting up the reusable RAM writer (pseudo-GameShark). This way you can write any address to RAM, WRAM you want.<br /><br />The reusable RAM writer is as such from item 3:<br /><br />Lemonade x(xx)<br />Carbos x(yy)<br />X Accuracy x(zz)<br />PokÃ© Ball x119<br />Carbos x211<br />Lemonade x0<br />X Accuracy x35 (x34 in Yellow)<br />PokÃ© Ball x34<br />HP Up x34<br />HP Up x34<br />TM01 x0<br /><br />The Lemonade (xx) represents the value. The Carbos (yy) is the first byte of the address, and the X Accuracy (zz) is the second byte of the address. Many addresses can be found [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map]here[/url] and [url=https://github.com/pret/pokered/blob/master/wram.asm]here[/url]. When you use this code, the quantities of xx, yy and zz reset back to 0 (or 256), allowing you to make any edit you want again and again.<br /><br />For making a PokÃ©mon Shiny, as you said originally it was supposed to be 10 in Speed, Defense, Special and 2, 3, 6, 7, 10, 11, 14 or 15 in Attack. PokÃ©mon Bank changed it for unknown reasons to be 10 in Speed, Attack, Special and 2, 3, 6, 7, 10, 11, 14 or 15 in Defense.<br /><br />The addresses in question are two of the DV bytes. Attack/Defense IV and Speed/Special IV. For PokÃ©mon 1 these are D186 and D187 respectively, which in Yellow are -1 of the original (as is the case with many memory addresses in Yellow), so are D185 and D186.<br /><br />Now, the values we need are represented by one nybble (digit) of the byte; upper-most nybble first, and are AF (Attack=10 [A], Defense=15 [F]) and&nbsp; AA (Speed=10 [A], Special=10 [A]).<br /><br />This means the first edit we need to do is Lemonade x 175 [AF], Carbos x 209 [D1], X Accuracy x 133 [85], which will apply the Attack/Defense DVs to party PokÃ©mon 1.<br /><br />The second edit we need to do is Lemonade x 170 [AA], Carbos x 209 [D1], X Accuracy x 134 [86], which will apply the Speed/Special DVs the party PokÃ©mon 1.<br /><br />If you ever want to convert hexadecimal into decimal yourself, Windows Calculator on programmer mode is a great tool.<br /><br />I don&#039;t know if PokÃ©mon Bank &#039;fixed&#039; the DV thing and Bulbapedia doesn&#039;t say it has, but in case it did the bytes would instead be FA and AA, which would be Lemonade x 250 [FA], Carbos x 209 [D1], X Accuracy x 133 [85] and Lemonade x 170 [AA], Carbos x 209 [D1], X Accuracy x 134 [86].<br /><br />I hope this helps and good luck! :)<br />[/quote]<br /><br />Hi Torchickens. I&#039;m playing the Italian version of Pokemon yellow, and I&#039;m trying to make my Pokemon shiny too, but without success. I set up my inventory as you suggested, putting in the current box the Pokemon shown in Lumi&#039;s post, but using ws m only changes the names of the first three items to glitchy symbols. Am I missing anything? I also tried other setups I found around the web, but most of them are outdated, as Game Freak recently changed the way of determining shininess of the Pokemon transferred from rby, reverting to the original 15/10/10/10 dv spread. <br />I&#039;ve really run out of ideas, so any help would be greatly appreciated :)<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Str8rush
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Str8rush
icon: xx
body:
  Ok, I tried it again and at least the Shiny Code worked and the move â€žTM21â€œ is in the 3rd slot which would be Sacred Fire. <br />For whatever reason the Missigno is now displayed in the TimeCapsule as Rhydon being Shiny and having Sacred fire as 3rd move :D<br /><br /><br />Edit: What confuses me the most is that in the one list linked in a post above HoOh is listed as the PokÃ©mon with the code FA (250, which would be equal to HoOhs Dex number), but on Bulbapedias Index list HoOh is listed as Missigno 52 ( https://bulbapedia.bulbagarden.net/wiki/List_of_PokÃ©mon_by_index_number_(Generation_I) )<br />After catching a Missigno 52 with the Ditto Glitch, a HoOh was shown in the TimeCapsule. Which value is now the correct one?<br /><br />Edit 2: The Missigno I caught was on Level 7 originally, and this â€žrhydonâ€œ now is on Level 8, and I donâ€™t know what I could have done to do so :D<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Most likely your first Missingno morphed into a Rhydon which is a common glitch see https://bulbapedia.bulbagarden.net/wiki/Rhydon_glitch for more info.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207051#msg207051 date=1506694948]<br />The first party address that the code starts to run is at FA98 (DA98). This is the second byte of the Attack stat experience of PokÃ©mon 3 (the slide PokÃ©mon).<br /><br />Following this is Defense, Speed, Special stat experience as well as DVs, PPs, happiness, PokÃ©rus, level, status, stats. You can probably predict whether the PokÃ©mon will work by looking at the stats but I don&#039;t know the details sadly.[/quote]<br />Since most of them are naturally hidden (statXP, happiness, etc.) prediction would be difficult I guess. At least statXP and happiness should be fixed at the start though, but I guess trial and error is good enough for now.<br /><br />[quote]Since your slide PokÃ©mon no longer works it&#039;s possible the problem could be due to one of the above variables changing, such as happiness increasing to a &#039;bad&#039; opcode; the solution being to increase or decrease the happiness until it works. Another cause could be if you made your slide PokÃ©mon gain some experience.<br />[/quote]<br /><br />Thing is, it does still work for the shinify-Code for example, at least somewhat.<br />My sprite is vanishing and there&#039;s menu-lag (no freeze), but for whatever reason it doesn&#039;t turn the first mon shiny.<br />Also tried with a different slide-mon and same result, but box-names should be correct (checked multiple times).<br /><br /><br />Thanks for you time.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Str8rush
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Str8rush
icon: xx
body:
  Yup, that was the case. I put it into the daycare and got it back, it was a Missigno afterwards. By entering the TimeCapsule, it was shown as a shiny HoOh with Sacred Fire on Slot 3, with Fire/Flying Type. As I tried to trade there still was the Message that there seems to be something wrong with that PokÃ©mon... <br /><br />Edit: I re-read the topic in the forum where I first read about all this, the author of this thread stated that he was able to trade his generated Ho-Oh to his Silver but not his Lugia. Could this be a thing perhaps, as I am trying it with a Ho-Oh to a Gold Version?


subject: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystal_
icon: xx
body:
  [u][b]OVERVIEW / EXPLANATION[/b][/u] (for requirements and steps see the third post in this thread)<br /><br />Step by step video (with updated and organized information in comparison to the third post): https://www.youtube.com/watch?v=b2tVVeZ7Th4<br /><br />I&#039;ve tested this in an english Silver ROM and spanish Gold ROM and given that the essential elements and key memory addresses were the same in both games, I assumed that it would also be the same in all other localizations. However, futher testing, and of course, a lot of polishing, would be required. The english versions don&#039;t need ACE since we already have coin case, so the goal was to find a method compatible with all other localizations.<br /><br />First we need a 0xFF Pokemon in order to be able to draw Pokemon beyond the sixth slot. I&#039;m not going to get into the details of how to achieve it.<br /><br />When the 30th Pokemon is withdrawn to the party, it corrupts addresses between DF9A and DFB9. In particular, when the Pokemon&#039;s data is being copied from SRAM to those WRAM addresses, the stack pointer is at DFB3, and the 3rd and 4th PP slots of the Pokemon are copied to DFB3 and DFB4, respectively. Returning from the memory copy routine will bring the game to whatever stack pointer was spelled out by those two PP fields. Using PP ups, we can come up with any given address that we want, for example one that points to somewhere in the box names buffer.<br /><br />Of course, after doing this, the stack is absolutely destroyed and there are no realistic hope of restoring it to anything playable. We can still do something though. We can hack ourselves a TM into the medicine bag pocket in SRAM that we can utilize later. This may look way too complicated but it doesn&#039;t necessarily have to be. First of all, SRAM bank 1 is already opened right now. We only have to overwrite A420 (medicine pocket item 1) with the id of the desired TM and fix the checksum at AD69-AD6A. If we set a fixed item #1 as an initial requirement (e.g. a Berry), we can calculate the necessary checksum shift. If the id&#039;s are relatively close, we might even be able to skip checking the checksum&#039;s high byte to simplify the needed script and hope the low byte doesn&#039;t overflow (literally anything we do will change the checksum upon saving anyway, so we can just try again until it works). Finally, we can trigger a safe reset or freeze, and upon restarting the game, we will have our TM in the medicine pocket. Note that the SRAM addresses mentioned here refer to spanish Gold/Silver; they may be different in other localizations.<br /><br />Now it&#039;s supposed to be similar to coin case ACE in concept. We find a TM that jumps to a suitable place in WRAM (I think ACE with TM33 transferred from Red/Blue has been done already), and when we have it, we create some bootstrap code that for example redirects execution to box names or PC items.<br /><br />These are the TM pointers in spanish G/S:<br /><br />[code]14FE - TM01<br />15CD<br />CA31<br />77F6<br />EAAF - TM04_X<br />D14F<br />02FA<br />FED0<br />C4B1<br />6E1E<br />9921 - TM10<br />CBD1<br />21A6<br />7857<br />5ECD<br />FA0F<br />D114<br />FA47<br />D119<br />03FE<br />20CA - TM20<br />FA6A<br />D002<br />01FE<br />20CA<br />FA6A<br />D002<br />214F<br />6C73<br />FE2A - TM28_X<br />28FF<br />B90F - TM30<br />0428<br />2323<br />F418<br />662A<br />116F<br />698A<br />E9D5<br />02FA<br />FED0<br />789F - TM40<br />12CA<br />786A<br />B8E0<br />FF21<br />46D0<br />4E23<br />5623<br />5E23<br />21CB<br />10CB - TM50[/code]<br /><br />Again, this obviously needs a lot of polishing and coming up with bootstrap codes yet, as well as adapting it to each other localization, each of which may have different SRAM addresses and different wrong pocket TM pointers, as well as a different set of assembly instructions that can be spelled out with box names. So far I haven&#039;t bothered to check beyond the english and spanish versions, but the 3rd and 4th move PP of the 30th Pokemon being written to the stack pointer (DFB3-DFB4) matched in both versions, so I assume it would also be the same in the other localizations. The other factors don&#039;t seem essential unless we&#039;re really unlucky with TM pointers.


subject: Re: ????? party overloading - analysis and exploitation
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Result so far : [img]http://puu.sh/xM3dM/a7a3096fb9.gif[/img].<br /><br />Problem is, it&#039;s almost not doable without directly editing memory.<br /><br />Here&#039;s the current method :<br />- Have a PokÃ©mon with 49152~49407 (00C000~00C0FF) experience<br />- Have a PokÃ©mon which redirects (exact requirements to be defined)<br />- Have a way to fix the stack (run a &quot;add sp, $16&quot; or equivalent somewhere before returning)<br /><br />Have 7 PokÃ©mon in your party.<br />Withdraw 9 PokÃ©mon.<br />Withdraw the &quot;redirect&quot; PokÃ©mon.<br />Withdraw 3 PokÃ©mon. The last two will be permanently lost.<br />The withdraws up to this point don&#039;t have to be consecutive, just keep track of how many withdraws you did.<br />Withdraw the &quot;C0 experience&quot; PokÃ©mon. The game will execute code starting at C000, which is an unused byte in the &quot;redirect&quot; PokÃ©mon, thus exec will slide to C001, which is the &quot;redirect&quot; PokÃ©mon&#039;s current HP.<br /><br />The way I did it was by pure hex editing, so I didn&#039;t work out any &quot;legit&quot; setup yet.<br /><br />@C001 : C3 75 DB (jp DB75 ; wBoxNames)<br />@DB75 : 3E 42 D7 CD 47 58 3E 11 C3 00 01<br /><br />ld a, $42 ; BANK(Credits)<br />rst $10 ; Bankswitch<br />call $5847 ; Credits<br />ld a, $11<br />jp $0100<br /><br />For a more &quot;conventional&quot; ACE, you&#039;d need to add $16 to sp before returning ; this can be done using &quot;add sp, $16&quot;, &quot;ld hl, sp+$16&quot; then &quot;ld sp, hl&quot;, or doing &quot;pop&quot;s 11 times.<br />This is because the last withdrawing overwrites 32 bytes of the stack, including a return address (which is exactly what grants ACE), but also a lot of other data. Fortunately &quot;fixing&quot; the stack this way simply sets us back at the main menu of Bill&#039;s PC.<br /><br />Now, for the downsides...<br />This truly destroys the player&#039;s party. In my case I had mons with unterminated names which prevented the party from being fixed (damn !), but I believe this could be fixed by using PokÃ©mon with $50&#039;s in their data.<br />The &quot;redirect&quot; PokÃ©mon must be withdrawn again after a reset. Sadly, its data isn&#039;t saved by the game. This could probably be fixed by having the corrupted return target somewhere different than C000.<br />The party overloading will corrupt your PokÃ©dex, Unown Dex, roamer PokÃ©mon data, <br /><br /><br />But hey, it&#039;s still ACE ! It requires a ?????, though.<br /><br />Luv ya, Gamefreak ! &lt;3<br /><br /><br /><br />My notes :<br />In its current form, this is Crystal-only. Only tested in an US version, but porting it to EU versions should be doable still.<br />The initial exec can be done anywhere, in theory. The high byte is highly manipulable (I assumed any value could be reached), but the low byte is most probably 0, or 1. That&#039;s indeed a restriction.<br />I just read Crystal_&#039;s post, which suggests instead applying a change to the save file to give a TM. Maybe that ?


subject: Re: Having trouble turning PokÃ©mon shiny using ACE in Yellow
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Non english versions have a different memory layout, so the codes need to be adjusted a bit, and so does the setup of which pokemon need to be in the box too I think


subject: Re: Having trouble turning PokÃ©mon shiny using ACE in Yellow
poster_name: Snorlax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for answering jfb. I was suspecting something like that. Sadly, I&#039;m totally clueless about how to make the necessary adjustments, so I definitely need some extra help ^^


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Found a Silver version exclusive one!<br /><br />Phanpy code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0?&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: Having trouble turning PokÃ©mon shiny using ACE in Yellow
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Over the last monthes, we&#039;ve been explaining the same things about how to design your own 8F code, and how to adapt it to a european non-english game. Not more than a few days ago, I&#039;ve been talking about adapting codes to european games in the [url=http://forums.glitchcity.info/index.php?topic=6638.msg207013#msg207013]main thread[/url] and a while back there has been posts on [url=http://forums.glitchcity.info/index.php?topic=6638.msg200686.html#msg200686]a shinyzer code[/url] with european adaptation included, and there has been a lot of similar questions that has been answered by people here.<br /><br />I truely believe one of the points of this board is to help people with their glitch troubles. If you have any issue with your codes, I&#039;ll be glad and happy to provide any help I can (and even in Italian, since I speak it - contact me via PM if needed). But it&#039;s also true to say that we would be more efficient if people could try to find answers by carefully reading similar threads before asking the same things :) and in the same way, if you go into the effort of learning how 8F works, how to deal with RAM, how to deal with opcodes, which truely is not difficult, it could be a great help for you people, as you would be able to fix 90 % of your issues alone and you wouldn&#039;t have to wait for people to answer your posts!&nbsp; ;D


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Porygon2 code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0.&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Scizor code<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0&#039;r&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Skarmory code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0[i]MN[/i]&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Mantine code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0[i]PK[/i]&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  Just an update to say the polishing is half done. Here&#039;s a half-hacked result (where data was memory edited where it was supposed to be, instead of properly setting up a PokÃ©mon, etc.), in which the payload successfully edited the save file to add a TM25 there :<br />[img]http://puu.sh/xMejG/9bcca1f2b4.png[/img]


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Politoed code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0z&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Spinarak code: <br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0g&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br /><br />Ledyba code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0e&#039;v9<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  what letters in the box code are the address and the value it changes i want to use it like a memory editor


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Mankey code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0y&#039;vA<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Meowth code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0u&#039;vA<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Vulpix code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0f&#039;vA<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=L is Real link=topic=8093.msg207078#msg207078 date=1506742112]<br />Where are you finding these? And do you happen to know the codes for the dogs and Ho-oh/Lugia?<br />[/quote]<br /><br />Me actually doing the codes :v)


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: L is Real
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SpunkyBandy link=topic=8093.msg207081#msg207081 date=1506742585]<br />[quote author=L is Real link=topic=8093.msg207078#msg207078 date=1506742112]<br />Where are you finding these? And do you happen to know the codes for the dogs and Ho-oh/Lugia?<br />[/quote]<br /><br />Me actually doing the codes :v)<br />[/quote]<br /><br />I see. Well thank you, keep up the good work.


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  how do you change what memory addresses it changes and what value it changes a box name memory editor would be useful


subject: Changing your G/S Trainer ID using the most annoying ACE method EVER
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Hello everyone,<br /><br />In [url=http://forums.glitchcity.info/index.php?topic=8091.0]this thread[/url], asphere asked for assistance regarding using Silver ACE to change its Trainer ID to 13579. I&#039;ve decided to help him and we&#039;ve been talking by PM about the best method he could use to reach his goal, and I felt interesting to post the results of this discussion here... for science!<br /><br />As you all know, 2G has a lot of different ACE methods. Since asphere plays an italian game, Coin Case ACE was therefore excluded. As of now, Glitch PokÃ©dex ACE, Bad Clone ACE and Move 0x00 ACE have not been validated in european games, so I decided to put them aside also. Thanks to the work of the very talented Crystal_ and IssoTM, we now know yet another ACE method, Withdraw Smash ACE, which works in european games, but of course, it wasn&#039;t the case back then. <br /><br />So that leaves only one ACE method, the horrible and very painful TM Code Execution, which by chance, happens to be a little bit less a pain in the ass in G/S games, since unlike in Crystal, you can technically do it without using another game if you&#039;re willing to do an insane amount of battles (and use the Bad Clone Trick). Since asphere mentions he has a Yellow, we will avoid any complications by designing a method that uses Item ACE in Yellow (in this case ws*lâ€™||lm|| since he already knew how to do it, although I must insist that 4F is a better shot) to generate a proper TM ACE in Silver.<br /><br />The process I wrote in this occasion starts from scratch. The point of it is not to be the most efficient way to do it, but to the most newbie-friendly possible. I chose not to use MissingNo. in any ways because it may be tricky in some localizations (but it can be used to get the ws*lâ€™||lm||) but rather I will use ACE to generate the proper amount of every item I need for the glitch. [b]This step-by-step whole process basically allows a player which has nothing more than a Yellow game, a Silver game, the ws*lâ€™||lm|| item and some TMs to change its trainer ID[/b].<br /><br />As you will read, the result is an incredibly complex process (although by testing it I must say it&#039;s really not that long to do) that doesn&#039;t seem to make any sense and it&#039;s probably the most stupid thing you will read today... but it absolutely works. I&#039;m not expecting anyone else to do such a thing, and I&#039;m posting it &quot;for the record&quot;. Asphere is doing it right now, and he&#039;s happy, because he will have his wanted ID of 13579... even if I have no idea why would someone want to do that! <br /><br />Oh, and I&#039;m pretty sure ISSOtm would want me to say that this process won&#039;t work with classic VBA, because of Echo RAM.<br /><br />Before starting, you will need in Yellow:<br />- 2 different Tangela with 233 HP currently, and all the following PokÃ©mon (1 of each): Nidoking, Metapod, Spectrum, Flareon, Parasect, Kadabra, Tentacool, Grimer.<br />- The ws*lâ€™||lm|| item.<br />- The following TMs (at least 1 of each): TM01, TM14, TM50, TM11, TM34 and TM18.<br />- Some other things that can be easily bought ingame.<br />In Silver, you will need:<br />- The following TMs: TM10 x1, TM18 x3, TM23 x53, TM25 x1, TM42 x1. All those can be bought ingame (money or casino chips) except for TM23 that you get from Jasmine. Unfortunately you will have to clone it.<br />- Some other things that can be easily bought ingame.<br /><br />[u]STEP I: PREPARE POKEMON MODIFICATION IN YELLOW[/u]<br /><br />Place the following PokÃ©mon, in that order, in PC Box 1 and make sure this box is active (no extra PokÃ©mon!).<br />Tangela (with 233 current HPs)<br />Nidoking<br />Metapod<br />Spectrum<br />Flareon<br />Parasect<br />Kadabra<br />Tentacool<br />Grimer<br />Any PokÃ©mon<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />Carbos x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have Carbos x0 instead of x1. Click on it and toss precisely 38 Carbos. You should now have x218 Carbos, represented by a glitch number. Store them in the PC.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />X Accuracy x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have X Accuracy x0 instead of x1. Click on it and toss precisely 80 X Accuracy. You should now have x176 X Accuracy, represented by a glitch number. Store them in the PC.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />Any Item x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have Any Item x0 instead of x1. Click on it and toss precisely 99 of it, then toss 29 of it. You should now have x128 of this item, represented by a glitch number. Store them in the PC.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />TM34 x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have TM34 x0 instead of x1. Click on it and toss precisely 95 TM34. You should now have x161 TM34, represented by a glitch number. Store them in the PC.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />TM18 x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have TM18 x0 instead of x1. Click on it and toss precisely 55 TM18. You should now have x201 TM18, represented by a glitch number. Store them in the PC.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />TM14 x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have TM14 x0 instead of x1. Click on it and toss precisely 99 TM14, then toss again 99 of it, and then toss 24 of it. You should now have x34 TM14. Store them in the PC.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />TM50 x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have TM50 x0 instead of x1. Click on it and toss precisely 99 TM50, then toss again 99 of it, and then toss 21 of it. You should now have x37 TM50. Store them in the PC.<br /><br />Buy 3 Full Heal, and place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />TM11 x1<br />PokÃ© Ball x45<br />Full Heal x3<br />TM01 x1<br />Revive x3<br /><br />Use the ws*lâ€™||lm|| item three times in a row. You should now have TM11 x4 instead of x1. Store them in the PC, and toss all 3 Full Heal.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />Lemonade x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br /><br />Use the ws*lâ€™||lm|| item. You should now have Lemonade x0 instead of x1. Toss 99 Lemonade, then toss 35 Lemonade. You now have Lemonade x122, represented by a glitch number. Go to the PC, store 99 Lemonade and withdraw them back. Now, you will have two stacks of Lemonade, the first being x99, and the second being x23. Toss 98 Lemonade from the 99 pack. From now on, you can switch items to arrange your pack, but it is very important that you NEVER switch both Lemonade together, as it would combine them.<br /><br />Place the following items, in that order, in your pack.<br />ws*lâ€™||lm||<br />Lemonade x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br />Lemonade x23<br /><br />Use the ws*lâ€™||lm|| item. You should now have Lemonade x0 instead of x1 as second item. Toss 61 Lemonade so this stack is now Lemonade x195.<br /><br />Place the following items, in that order, in your pack. Remember not to switch both Lemonade together.<br />ws*lâ€™||lm||<br />Water Stone x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x1<br />Lemonade x195<br />Lemonade x23<br /><br />Use the ws*lâ€™||lm|| item. You should now have Water Stone x0 instead of x1. Toss 2 of them, then store 99 of them, and withdraw them back. Now, you will have two stacks of Water Stone, the first being x99, and the second being x155, represented by a glitch number. Toss 93 Water Stone from the stack of Water Stone x155 (it now should be x62), and 94 Water Stone from the stack of Water Stone x99 (it now should be x5). As for Lemonade, it is very important that you NEVER switch both Water Stone together, as it would combine them.<br /><br />[u]STEP II: MODIFY THE 2 POKEMON[/u]<br /><br />While keeping the PokÃ©mon in your PC Box, place the following items, in that order, in your pack. Once again make sure you never switch both stack of Water Stone or both stack of Lemonade together.<br />ws*lâ€™||lm||<br />Any Item x128<br />Lemonade x195<br />Carbos x218<br />X Accuracy x176<br />Water Stone x5<br />Lemonade x23<br />Water Stone x62<br />TM14 x34<br />TM50 x37<br />TM11 x4<br />TM34 x161<br />TM18 x201<br /><br />Use ws*lâ€™||lm||. Nothing will seem to occur.<br /><br />Immediately go the PC and withdraw Tangela. THIS POKEMON MUST NEVER, EVER, BE IN A BATTLE AGAIN (nor receive an EV-changing item). Send it to the Silver game, and make sure it holds a Machine Part. Clone it with the item, and take the two Machine Part. Then, go back to your Yellow game.<br /><br />Place another Tangela with 233 HP at the first position of the active PC Box 1, then go back to your pack, and toss 61 of the &quot;Any Item&quot; so you now have 67. The, use ws*lâ€™||lm||. Immediately withdraw Tangela and send it to the silver game. This time, this Tangela should be holding a SecretPotion, and once again clone it with the item, and take the two SecretPotion.<br /><br />The Yellow part (and the most annoying part) of the glitch is finished.<br /><br />[u]STEP III: INFINITE PC ITEMS TRICK AND ITEM GENERATION[/u]<br /><br />Now in the silver game, place both Machine Part and both SecretPotion in the last position of your Rare Items, just like in this screenshot: <br />[img]http://www.prama-initiative.com/OAC/AAIDPCALPDPBDSEDMI.png[/img]<br /><br />Place a Tangela at the second position of your party, but remember to never make it to fight or give it an EV-changing item.<br /><br />In the PC, place the following items, in that order.<br />Fresh Water x42<br />PokÃ© Ball x38<br />TM23 x53<br />TM10 x(any quantity)<br />TM25 x1<br />TM18 x3<br />PP Up x1<br />Any item x(any quantity)<br />Any item x(any quantity)<br />TM42 x1<br /><br />In your pack, make sure to have ABSOLUTELY NOTHING in your Balls pocket (if so, toss them or store them after the TM42). Now, go to the Rare Items pocket, switch both Machine Part. Normally, you should now see an Iron and a Apricorn in the pack. Switch the first SecretPotion with the Apricorn. Switch the second SecretPotion with the Apricorn again. Both should now be at last position of your pack. Now switch both SecretPotion.<br /><br />Go in the Balls pocket of your pack, you should be able to go down, beyond the CANCEL button. If you keep going down, you will now see your PC items! Go the the TM25 and use it. You should now have x0 TM42. Use again TM25, and you should now have x255 TM42.<br /><br />Go in the PC, and arrange your items this way.<br />Fresh Water x42<br />PokÃ© Ball x38<br />TM23 x53<br />TM10 x(any quantity)<br />TM25 x1<br />TM18 x3<br />TM42 x255<br />Any item x(any quantity)<br />Any item x(any quantity)<br />PP Up x1<br /><br />Leave the PC and go back to your item pack, in the Balls Pocket, and slide down until finding the PC items. Use TM25. You should now have x0 PP Up. Use again TM25, and you should now have x255 PP Up.<br /><br />[u]STEP IV: CHANGING THE ID TO 13579 [/u]<br /><br />From the PC, toss 93 TM42 so you now have x162, represented by a glitch number. Toss also 99 PP Up, then again toss 99 PP Up, so you now have x57. Also toss all Fresh water, all PokÃ© Ball, and all TM23.<br /><br />Still in the PC, withdraw 46 PP Up, so you now have x11 in the PC. Then don&#039;t withdraw anything else in your pack as it may break the glitch, but while using the PC, arrange the remaining items this way.<br />PP Up x11<br />TM42 x162<br />TM18 x3<br />TM10 x(any quantity)<br />TM25 x1<br />You can place any other items in any quantity after the TM25.<br /><br />Go back to your pack, in the Balls Pocket, and slide down until finding the PC items. Use TM25. Your ID starts changing, but still not is the wanted one.<br /><br />Go back inside the PC and store 42 of the PP Up you still have. The quantity of stored PP Up shall now be x53. Now, toss 1 TM42.<br /><br />Go back to your pack, in the Balls Pocket, and slide down until finding the PC items. Use TM25. You now have your wanted ID. Congratulations!


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Teddiursa code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0&#039;d&#039;v2<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystal_
icon: xx
body:
  [size=12pt][b]REQUIREMENTS AND STEPS for [u]spanish[/u], [u]italian[/u], [u]french[/u] and [u]german[/u] Gold/Silver[/b][/size] - Work in progress<br /><br />Emulators: Working on BGB, not working on VBA.[b] For the 3DS Virtual Console, you also must follow the additional points colored in [color=red]red[/color]; if you are not playing on the 3DS VC, ignore (skip) them[/b]. Not tested on any other emulator.<br /><br />[b]Follow also the requirements and steps in [color=blue]blue [/color]if you want a &quot;memory editor&quot; setup for TM17. If you just want to obtain TM17, ignore (skip) them.[/b]<br /><br />[b][u]Initial requirements - Obtaining TM17, executing from D8C0 with TM17[color=blue], D8C0 payload[/color][/u][/b]<br /><br />- The first item of the items pocket of the bag must be Berry (any quantity)<br />- The second item of the items pocket of the bag must have a quantity of 36 (any item). You will lose 35 of them.<br />[color=blue]- As the third item of the items pocket of the bag, Potion x1. As the fifth item, Ylw Apricorn x1. Fourth item can be any item and items below the fifth are irrelevant.[/color]<br />- Box 3 and Box 4 must be renamed as show in [url=https://i.imgur.com/2stA9Ll.png]this (spanish/italian)[/url] or [url=https://i.imgur.com/6s8wLqj.png]this (french)[/url] or [url=https://puu.sh/xNC8L/828a997d4d.png]this (german)[/url] image. [color=red]For 3DSVC, replace the last [i]Ae[/i] with [i]K4[/i], regardless of the language.[/color]<br />- A specific PC item list* (items beyond the last one don&#039;t matter)<br />- [color=blue]As the first party Pokemon, a level 2 Pokemon with no status, no pokerus, with current HP and HP between 13-14, and all other stats between 6-7.[/color]<br />- [color=blue]As the second party Pokemon, a Quagsire holding TM02 with Return as the first move.[/color]<br />- [color=red]As the third party Pokemon, a Quagsire holding HP Up with Sleep Talk as the first move.[/color]<br />- As the sixth party Pokemon, a bad clone (Pokemon 0x00).<br />- All your party Pokemon should be Pokemon that you don&#039;t care about. They will be in risk.<br />- A box (any) with 20 Pokemon that you don&#039;t care about. These Pokemon will be gone forever. In this box, the 20th (last) Pokemon must have a third move with 16/16 PP and a fourth move with 24/24 PP. These correspond to a 10 PP move and 15 PP move, both with 3 PP Ups applied, respectively.<br />- A box (any) with only 4 Pokemon that you don&#039;t care about. These Pokemon will be gone forever.<br />- ...<br /><br />*PC Item list:<br />[color=red]Any item - any amount[/color]<br />Antidote x4<br />Fresh water x32<br />Parlyz Heal x34<br />Awakening x1<br />Potion x1<br />Dire Hit x35<br />Everstone x1<br />Pokeball x1<br />TM08 (Rock Smash) x1<br /><br />[b][u]Steps - Obtaining TM17, executing from D8C0 with TM17[color=blue], D8C0 payload[/color][/u][/b]<br />- Switch to the box with 4 Pokemon.<br />- Select the Move PkMn w/o mail option, and move the first Pokemon of the box with 4 Pokemon to the bottom of your party.<br />- Withdraw all Pokemon from the box with originally 4 and now 3 Pokemon.<br />- Withdraw all Pokemon from the box with 20 Pokemon.<br />- When you withdraw the last Pokemon, the game will reset in weird colors, but you will have TM17 as the first item in the items pocket. Restart the game a game to restore the normal colors. Important: Do not toss, sell, give or deposit the newly obtained TM17. You can however do anything you want with a TM17 that has been obtained through regular gameplay and is therefore stored in the TM/HM pocket of the bag.<br />[color=blue]- Execute the following steps depending on your version of the game:<br />&nbsp; * Spanish/Italian:<br />&nbsp; &nbsp; Â· In the item&#039;s pocket of the bag, swap TM17 x1 (first item) with Ylw Apricorn x1 (fifth item).<br />&nbsp; &nbsp; Â· Rename boxes 1 to 5, as shown in [url=https://i.imgur.com/d2NxTmo.png]this[/url] image.<br />&nbsp; * French:<br />&nbsp; * German:<br />&nbsp; &nbsp; Â· In the items pocket of the bag, swap TM17 x1 (first item) with Ylw Apricorn x1 (fifth item).<br />&nbsp; &nbsp; Â· Rename boxes 1 to 5, as shown in [url=https://i.imgur.com/pVrkyX4.png]this[/url] image.<br />- Rename box 7 accordingly (...).<br />- Important: every time that you want to use TM17, your first five items in the items pocket of the bag, the first and second party Pokemon, and the name for boxes 1-5, must be exactly like they are now.<br />[/color]<br />[i]If you can&#039;t understand the sections below, chances are you only care about the above.[/i]<br /><br />[b][u]Code - Obtaining TM17[/u][/b]<br /><br />[b]BOX NAMES (SPANISH/ITALIAN): D8D0[/b]<br />nop | ld d, b ; box 2 terminator<br />or $a4<br />and $a4<br />push af<br />pop hl<br />or $d0<br />ld d, b ; 0x50<br />and $d0<br />call nc, $a480<br />ld d, b ; 0x50<br /><br />[b]BOX NAMES (FRENCH): D8D0[/b]<br />nop | ld d, b ; box 2 terminator<br />or $a4<br />and $a4<br />push af<br />pop hl<br />or $f1<br />ld d, b ; 0x50<br />and $d8<br />cp $fe<br />call c, $a480<br />ld d, b ; 0x50<br /><br />[b]BOX NAMES (GERMAN): D8D0[/b]<br />nop | ld d, b ; box 2 terminator<br />or $a4<br />and $a4<br />push af<br />and $80<br />or $50 ; 0x50<br />pop hl<br />call nz, $a480<br />ld d, b ; 0x50<br /><br />[b]PC ITEMS (ALL FOUR LANGUAGES): A480 (entry point A481)[/b]<br />db $09<br />inc b<br />ld l, $20<br />dec c<br />ld [hli], a<br />inc c<br />ld bc, 0112<br />inc l<br />inc hl<br />ld [hl], b<br />ld bc, 0105<br />rst $00<br />db $01<br /><br />[b][u]Code -&nbsp; Executing from D8C0 with TM17[/u][/b]<br /><br />[b]PARTY POKEMON #2 (ALL FOUR LANGUAGES): DA5A[/b]<br />jp $d8c0<br /><br />[b][u][color=blue]Code -&nbsp; D8C0 payload[/color][/u][/b]<br /><br />[color=blue][b]BOX NAMES (SPANISH/ITALIAN): D8C0 (box 1, char 2)[/b]<br />ld a, [$f8f5]<br />push af<br />ld a, [$f8f6]<br />ld d, b<br />pop hl<br />add h<br />push af<br />ld a, [$f8f7]<br />push af<br />pop hl<br />ld d, b<br />ld a, [$f8f8]<br />add h<br />push af<br />ld a, [$f8f9]<br />ld d, b<br />push af<br />ld a, [$f8fa]<br />pop hl<br />add h<br />pop hl<br />bit 2, b<br />pop de<br />and a<br />call $f5b8<br />ret<br />ld d, b<br /><br />[color=blue][b]BOX NAMES (GERMAN): D8C0 (box 1, char 2)[/b]<br />ld a, [$f8f5]<br />push af<br />ld a, [$f8f6]<br />ld d, b<br />pop hl<br />add h<br />push af<br />ld a, [$f8f7]<br />push af<br />pop hl<br />ld d, b<br />ld a, [$f8f8]<br />add h<br />push af<br />ld a, [$f8f9]<br />ld d, b<br />push af<br />ld a, [$f8fa]<br />pop hl<br />add h<br />pop hl<br />pop bc<br />ld d, b<br />and a<br />jp $f5b8<br />ld d, b<br /><br />[b]ITEMS POCKET (SPANISH/ITALIAN): F5B8 (item 1)[/b]<br />ld e, h<br />ld bc, ?<br />ld [de], a<br />ld bc, ?<br />ret nc<br />ld bc, ?[/color]


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: theSLAYER
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: theSLAYER
icon: xx
body:
  [quote author=ISSOtm link=topic=8086.msg206974#msg206974 date=1506292153]<br />The Johto Guard Glitch cannot be used to smuggle mail into Gen I. (Below is a detailed explanation using the disassembly, but I didn&#039;t test it in-game)<br /><br /><br />The function that checks for Gen I compatibility is called SpecialTimeCapsuleCompatibility (https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2054-L2133).<br />It&#039;s basically composed of three loops which check one part of the compatibility each.<br />The first loop parses species, and this is how it returns : [url=https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2066]until it encounters a $FF species[/url].<br />The [url=https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2075]second[/url] and [url=https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2093]third[/url] loop instead use the counter counting the number of PokÃ©mon in the party.<br /><br />Thus, only the PokÃ©mon species check is affected by the Johto Guard Trick. Quite a shame, but oh well.<br /><br /><br />As for the Mystery Gift trigger being tied to Kurt, [url=https://github.com/pret/pokecrystal/search?p=1&amp;q=EVENT_RECEIVED_BALLS_FROM_KURT&amp;type=&amp;utf8=%E2%9C%93]a quick search about the flag[/url] turns up that for some reason it&#039;s also used by a bunch of other triggers. So I believe something else is going on there, probably that this flag is used as a temporary by different scripts ?<br />I don&#039;t really know what&#039;s going on there, but here are the elements I found :<br />- The delivery guy is [url=https://github.com/pret/pokecrystal/blob/700321a7fb2d6c852ffc91cc0b8867526cb76813/maps/PokeCenter2F.asm#L1052]directly tied[/url] to the mystery gift flag. (I don&#039;t know how for sure)<br />- When the delivery guy appears, [url=https://github.com/pret/pokecrystal/blob/700321a7fb2d6c852ffc91cc0b8867526cb76813/maps/PokeCenter2F.asm#L55]he sets Kurt&#039;s flag again[/url].<br />[/quote]<br /><br />What if it&#039;s a (FF) holding item number (FF)?<br />Species FF cancels remaining species check,<br />so I figured Item FF might cancel remaining item check.<br /><br />edit: nvm, I just understood that the remaining loops doesn&#039;t actually check the items, but goes by the amount of pokemon in party.


subject: Brock Through Walls not working...or at least, barely
poster_name: Gummysaur
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Gummysaur
icon: question
body:
  Hi, I&#039;m very new, just joined to ask this question!<br /><br />So some backstory: I&#039;ve been having a good time playing Pokemon Gold on VC, but after raising a Growlithe the whole game, I only recently realized that you need to beat the Johto E4 and make it to Kanto before you can get a Fire Stone!! I didn&#039;t want to wait that long, so I decided I would make it to Celadon in my Pokemon Blue game, buy the Fire Stone, trade the Growlithe over, evolve it, and trade it back. Very convoluted, but it would work. Instead of playing through the game like a normal person I decided to utilize Brock Through Walls to make it to Celadon. Fire Stones are quite cheap so I figured I could just go over there, buy a Fire Stone, and be done with it in under half an hour.<br /><br />It took a lot of tries, but I finally managed to get a Level 8 Bulbasaur with 16 Spc and a Level 4 Pidgey with 15/18 HP. The Bulbasaur has 26/27 HP, and its PP is all over the place, but I figured the Bulbasaur + Pidgey would be enough and I didn&#039;t need to worry about PP. Good news: The glitch technically works. I can move wherever I want.<br /><br />Bad news: For some reason, the menu will not stop popping up if I stop moving for even a moment. Even worse, every step downwards is a battle; the game often just endlessly opens up my menu, or forces me in some other direction. I can move upwards or to the right just fine, but the game seems to hate moving the player down. I&#039;ve tried canceling the menus, but they&#039;re endless. I&#039;ve tried sitting back and seeing where the game will take me, but that ends up crashing the game or ending the glitch. Through a lot of finagling I can make it to Cerulean City, but sometimes the glitch just ends there for what seems like no reason; I haven&#039;t entered any doors or anything. As such, I can&#039;t walk over the Saffron gate and over to Celadon. This is especially frustrating because I don&#039;t know the path to Celadon by heart, so needing to be constantly moving in an upwards or right direction when there&#039;s doors and out-of-bounds areas everywhere can get annoying.<br /><br />Does anyone know what&#039;s happening that makes the glitch so frustrating to work with? Is it because my Pidgey has a total HP of 18? I&#039;d really like to figure this out because I already wasted 2 hours just trying to evolve my Growlithe that isn&#039;t even in this game :(


subject: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: FMK
icon: xx
body:
  As most know, using Coin Case ACE is a bit impractical -- you gotta walk a specific way, listen to specific cries, and even when everything is done right, you need to save and reset after a single use. Which is all fine and dandy for R&amp;D, but is quite a pain for practical use.<br /><br />To that end, for updating ACE for 2017, it&#039;s time to give the Coin Case the IE (Sorry, &#039;Edge&#039;) treatment -- using it to access a better ACE.<br /><br />Prerequisites:<br />Coin Case (... Duh)<br />A low level slide Pokemon in slot 3 (Gift Pokemon Tyrogue, if you&#039;re far enough to get it, seems to reliably work too)<br />Quagsire in slot 4 Holding TM02, with Return (TM27) as Move 1<br />At least one Ball<br />Bellsprout registered in Pokedex<br /><br />Step 1) Name Pokemon Storage Boxes the following<br />[code=Ball Slot 1 is TM25]Box 1:&nbsp;  A&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; .&nbsp; 9<br />Box 2:&nbsp;  Ã©&nbsp; 7 &#039;t&nbsp; p&nbsp; Ã©&nbsp; Z&nbsp; (mult) &#039;l<br />Box 3:&nbsp; &#039;l &#039;l &#039;l&nbsp; x &#039;d[/code]<br /><br />Step 2) Enter Cherrygrove Mart<br />Step 3) Exit Cherrygrove Mart and take exactly four steps to the right (You should be lined up with the right-most tree between the Mart and Center)<br />Step 4) Listen to Bellsprouts cry<br />Step 5) Open inventory, swap to Key Items pocket (If already there, swap to Balls/TMs and then back to Key Items)<br />Step 6) Use Coin Case, confirm that Ball 1 is TM25<br />Step 7) Save and Reset<br />Step 8) Move your slide Pokemon to slot 2<br />Step 9) Move Quagsire to slot 3<br />Step 10) Congratulations, you never need to use the Coin Case ever again.<br /><br /><br />Now, let&#039;s get rid of that pesky slide Pokemon.<br /><br />Step 1) Name Pokemon Storage Boxes the following<br />[code=Pokemon 3, jp $d8c0]Box 1:&nbsp;  A&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 0&nbsp; 5&nbsp; 5<br />Box 2:&nbsp;  Ã©&nbsp; (&nbsp; 4&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 3<br />Box 3:&nbsp;  Ã©&nbsp; )&nbsp; 4&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; 5<br />Box 4:&nbsp;  Ã©&nbsp; :&nbsp; 4&nbsp; x &#039;d[/code]<br /><br />Step 2) Use TM25<br />Step 3) Swap Quagsire to slot 2<br />Step 4) Congratulations, all ACE is now dependent on a single Pokemon being in the right spot. (Make sure to never gain EXP/EVs with the Quagsire.)<br /><br />[b]NOTE: In order to make codes made for the Coin Case compatible with TM25, when you see [i]pÃ©D9[/i], replace it with [i]x&#039;d[/i] and stop inputting any code beyond that. If there isn&#039;t one, it probably uses the &#039;Required&#039; code of mine, which means just add [i]x&#039;d[/i] at the end. Alternatively, if you&#039;ve used my &#039;Required&#039; code from the other topic, TM25 codes can be used with the Coin Case by just removing the ending [i]x&#039;d[/i] for codes.[/b]<br /><br /><br />[size=24pt]TM25 CODES[/size]<br /><br />[code=Pokemon 3 Modifier - Radio Reader]Box 1:&nbsp;  A&nbsp; p &#039;v&nbsp; D&nbsp; Ã©&nbsp; ?&nbsp; 2&nbsp; 5<br />Box 2:&nbsp;  Ã©&nbsp; 0&nbsp; 2&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5<br />Box 3:&nbsp;  p&nbsp; 0&nbsp; f &#039;v&nbsp; A&nbsp; Ã©&nbsp; â™‚&nbsp; 2<br />Box 4:&nbsp;  5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5<br />Box 5:&nbsp;  5&nbsp; 5&nbsp; 4&nbsp; A &#039;v&nbsp; 5&nbsp; 5&nbsp; 5<br />Box 6:&nbsp; &#039;v&nbsp; 9&nbsp; Ã©&nbsp; A &#039;v&nbsp; Ã©&nbsp; K&nbsp; 4<br />Box 7:&nbsp;  Ã©&nbsp; A &#039;v&nbsp; x &#039;d[/code]<br /><br />Explanation: This sets Pokemon 3 in your party (Both Values) to PokeRadio&#039;s value +1 (As well as the Radio itself). By default, the radio can only go from $0 to $50 for values, and increases/decreases by 2 each time you change it. However, if it&#039;s an odd value it can go below 0 (aka, wrap around to 255) and, more importantly, you can just use TM25 a few times to get to any in-between values.<br /><br />Known Drawbacks: Won&#039;t register in Pokedex, name remains that of original Pokemon.<br /><br /><br />[code=Pokemon 3 Modifier - Radio Reader (Egg Mode)]Box 1:&nbsp;  A&nbsp; p &#039;v&nbsp; D&nbsp; Ã©&nbsp; ?&nbsp; 2&nbsp; 5<br />Box 2:&nbsp;  Ã©&nbsp; 2&nbsp; 2&nbsp; Ã©&nbsp; â™‚&nbsp; 2&nbsp; 5&nbsp; 5<br />Box 3:&nbsp;  p&nbsp; 0&nbsp; f &#039;v&nbsp; A&nbsp; Ã©&nbsp; 9&nbsp; 2<br />Box 4:&nbsp;  p&nbsp; 0&nbsp; b &#039;v&nbsp; a&nbsp; Ã©&nbsp; f&nbsp; 4<br />Box 5:&nbsp;  5&nbsp; 5&nbsp; 4&nbsp; A &#039;v&nbsp; 5&nbsp; 5&nbsp; 5<br />Box 6:&nbsp; &#039;v&nbsp; 9&nbsp; Ã©&nbsp; A &#039;v&nbsp; Ã©&nbsp; K&nbsp; 4<br />Box 7:&nbsp;  5&nbsp; 5&nbsp; Ã©&nbsp; A&nbsp; 4&nbsp; p&nbsp; 0&nbsp; 7<br />Box 8:&nbsp;  Ã©&nbsp; A&nbsp; 4&nbsp; x &#039;d[/code]<br /><br />Same thing, but forces the Pokemon to be an Egg with between 1-255 steps to hatch, countering both drawbacks. Also shows what value you&#039;re to by changing your second Pokemon&#039;s current HP, since it can be a bit hard to tell on the Radio screen (.. Though there&#039;s a funny story behind the real reason it exists).<br /><br /><br />[code=Pokemon 3: Experience and Nature Modifier (Replace ? with a to y)]Box A:&nbsp;  5&nbsp; p&nbsp; 0&nbsp; M &#039;v&nbsp; A&nbsp; 5&nbsp; 5<br />Box B:&nbsp;  Ã©&nbsp; S&nbsp; 4&nbsp; p&nbsp; Ã©&nbsp; T&nbsp; 4&nbsp; 5<br />Box C:&nbsp;  0&nbsp; ?&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5 (After inputting once, can just do 0? rather than 0?555555)<br />Box D:&nbsp; &#039;v&nbsp; 2&nbsp; Ã©&nbsp; U&nbsp; 4&nbsp; x &#039;d[/code]<br /><br />For PokeTransporter, assuming it remains the same as RBY. Sets you to just a bit less than 800,000 EXP, which is level 85-99, depending on growth.<br /><br />[code]Nature:&nbsp;  -Atk,&nbsp; &nbsp;  -Def,&nbsp; &nbsp; &nbsp; -Spe,&nbsp; &nbsp; &nbsp; -SpA,&nbsp; &nbsp; &nbsp; -SpD<br />+Atk: a-Hardy ; b-Lonely; c-Brave&nbsp; ; d-Adamant; e-Naughty<br />+Def: f-Bold&nbsp; ; g-Docile; h-Relaxed; i-Impish ; j-Lax&nbsp; &nbsp; <br />+Spe: k-Timid ; l-Hasty ; m-Serious; n-Jolly&nbsp; ; o-Naive&nbsp; <br />+SpA: p-Modest; q-Mild&nbsp; ; r-Quiet&nbsp; ; s-Bashful; t-Rash&nbsp;  <br />+SpD: u-Calm&nbsp; ; v-Gentle; w-Sassy&nbsp; ; x-Careful; y-Quirky [/code]<br /><br /><br />[code=Mass Clone Current Box to Box 1]Box 1:&nbsp;  A&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 7&nbsp; 5&nbsp; 5<br />Box 2:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5<br />Box 3:&nbsp;  Ã©&nbsp; A&nbsp; 2&nbsp; x &#039;d[/code]<br /><br />Pretty self-explanatory, &quot;clones&quot; your currently selected box to box 1 -- overwriting anything there, obviously. Much faster than save cloning, and very convenient for when PokeTransporter is updated.<br /><br /><br />[code=Pokemon 3: Shiny, Female (For some Gender Ratios, anyways)]Box A*:&nbsp;  p&nbsp; 0&nbsp; 4 &#039;v &#039;d&nbsp; Ã©&nbsp; ]&nbsp; 4<br />Box B :&nbsp;  p&nbsp; 0&nbsp; k&nbsp; Ã©&nbsp; a&nbsp; 4&nbsp; 5&nbsp; 5[/code]<br /><br /><br />[code=Pokemon 3: Shiny, Male]Box A*:&nbsp;  p&nbsp; 0&nbsp; 4&nbsp; Ã©&nbsp; ]&nbsp; 4&nbsp; 5&nbsp; 5<br />Box B :&nbsp;  p&nbsp; 0&nbsp; k&nbsp; Ã©&nbsp; a&nbsp; 4&nbsp; 5&nbsp; 5[/code]<br /><br />Self-explanatory.<br />* Any Box except Box 1.<br /><br /><br />[code=&quot;Instant&quot; Text (Lasts Until Reset)]Box A:&nbsp;  5&nbsp; p&nbsp; Ã©&nbsp; Z &#039;l&nbsp; 5&nbsp; 5&nbsp; 5[/code]<br /><br />Side Note: Labeled with numbers means the code absolutely requires the specific box, labeled with letters means there&#039;s no location-specific code and it can be placed sequentially starting with any box. Just remember to remove [i]x&#039;d[/i] from the end of all names except the last one if you&#039;re going to use multiple together.<br /><br /><br />[size=12pt]Hex Editor (This Ones a Doozy)[/size]<br />01) Name Boxes<br />[code]Box 01:&nbsp;  5&nbsp; 4 &#039;m&nbsp; 2 &#039;v&nbsp; 9&nbsp; 5&nbsp; 5<br />Box 02 can be left alone for the moment.<br />Box 03:&nbsp;  Ã©&nbsp; -&nbsp; 2&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; x &#039;d<br />Bpx 04:&nbsp;  5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5<br /><br />Box 05:&nbsp;  4&nbsp; ?&nbsp; ? &#039;v&nbsp; A&nbsp; ?&nbsp; 4&nbsp; ? <br />Box 06:&nbsp; &#039;v&nbsp; A&nbsp; ?&nbsp; ?&nbsp; ?&nbsp; ?&nbsp; E&nbsp; ? <br />Box 07:&nbsp;  ?&nbsp; ? &#039;v&nbsp; A&nbsp; ?&nbsp; 4&nbsp; ?&nbsp; ? <br />Box 08:&nbsp;  A&nbsp; ?&nbsp; ?&nbsp; ?&nbsp; ?&nbsp; F&nbsp; ?&nbsp; p&nbsp; <br />Box 09:&nbsp;  A&nbsp; 4&nbsp; ?&nbsp; ? &#039;v&nbsp; A&nbsp; ?&nbsp; 4 <br />Box 10:&nbsp;  ? &#039;v&nbsp; A&nbsp; ?&nbsp; ?&nbsp; ?&nbsp; ?&nbsp; q <br />Box 11:&nbsp;  x &#039;d[/code]<br /><br />02) Rename Box(es) and Use TM25 as noted in the following steps, don&#039;t touch any other box names:<br /><br />[code][Box 5 Naming]<br />03) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 3&nbsp; &nbsp; : Use TM25 Once<br />04) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; &nbsp; : Use TM25 Once<br />05) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Twice<br />06) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; ! &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Once<br />07) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />08) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 4&nbsp; &nbsp; : Use TM25 Once<br />09) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; &nbsp; : Use TM25 Once<br /><br />[Box 6 Naming]<br />10) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Twice<br />11) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; H &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Four Times<br />12) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />13) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; ! &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Once<br />14) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; 4&nbsp; 5&nbsp; 5&nbsp; &nbsp; : Use TM25 Once<br /><br />[Box 7 Naming]<br />15) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 1&nbsp; &nbsp; : Use TM25 Once<br />16) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; &nbsp; : Use TM25 Once<br />17) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Twice<br />18) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; â™‚ &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Once<br />19) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />20) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 2&nbsp; &nbsp; : Use TM25 Once<br />21) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; &nbsp; : Use TM25 Once<br />22) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;v&nbsp; 5&nbsp; 5&nbsp; &nbsp; : Use TM25 Once<br /><br />[Box 8 Naming]<br />23) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />24) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; H &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Once<br />25) Box 03:&nbsp;  Ã©&nbsp; 9&nbsp; 3&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; x &#039;d&nbsp; &nbsp; : Use TM25 Three Times (!! NOTE: Says Box 3, Not 2)<br />26) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />27) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; â™‚ &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Once<br />28) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />29) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; 0&nbsp; 5&nbsp; 5&nbsp; &nbsp; : Use TM25 Once<br /><br />[Box 9 Naming]<br />30) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Twice<br />31) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; â™€&nbsp; &nbsp; : Use TM25 Once<br />32) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; &nbsp; : Use TM25 Once<br />33) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Twice<br />34) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;d &#039;v&nbsp; J&nbsp; &nbsp; : Use TM25 Once<br />35) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />36) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; z &#039;v&nbsp; 0&nbsp; &nbsp; : Use TM25 Once<br /><br />[Box 10 Naming]<br />37) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; &nbsp; : Use TM25 Once<br />38) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Twice<br />39) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; H &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Four Times<br />40) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; x &#039;d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Use TM25 Once<br />41) Box 02:&nbsp;  Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; 0&nbsp; 1 &#039;v&nbsp; A&nbsp; &nbsp; : Use TM25 Once<br /><br />42) Box 01: HHLLAA55<br />43) Box 02: 55555555<br />44) Box 03: 55555555[/code]<br /><br />Congratulations, assuming you&#039;ve done everything right, Boxes 5 to 11 contain the Hex Editor code and are ready for use.<br />A somewhat simple way to see if everything is right, there should be no ?&#039;s anywhere in Box 5 to 11&#039;s name.<br /><br /><br /><br />How To Use:<br />A through P represent 0 through F<br />(A=0, B=1, C=2, D=3, E=4, F=5, G=6, H=7, I=8, J=9, K=0xA, L=0xB, M=0xC, N=0xD, O=0xE, P=0xF)<br />HH is the value you want H to be<br />LL is the value you want L to be<br />AA is the value you want write to HL<br /><br />So say you want to write $FF to $D573, you&#039;d make Box 1 be NFHDPP55.


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: windylacine
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: windylacine
icon: xx
body:
  Found a Code for Suicune while messing around:<br /><br />Box 1: Ap0k&#039;vA55<br />[b]Box 2: Ã©&#039;m2p0,&#039;v9[/b]<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Looking into modifying the 2nd Box name for the other two legendary beasts hopefully.<br /><br />there&#039;s four more codes for Mascot birds and Larvitar line.<br /><br />Ho-oh code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2pp045<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Lugia code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2pp035<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Tyranitar code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2pp025<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Pupitar code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2pp015<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Larvitar code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2pp005<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Entei code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0,0<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5<br /><br />Raikou code:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2p0/<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D9&#039;l<br />Box 5: &#039;l5555555<br />Box 6: 555A&#039;lx&#039;d5


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you want an alternate ACE method for non-English versions, you could just underflow the bag with Key Items glitch to be able to create any item possible, including TM25 and others. I don&#039;t have a setup that works on any arbitrary save, but you can use [url=https://www.twitch.tv/videos/170906630?t=49m22s]this video[/url] as a reference. 


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: forsyz
icon: xx
body:
  [quote author=FMK link=topic=8100.msg207089#msg207089 date=1506797769]<br />As most know, using Coin Case ACE is a bit impractical -- you gotta walk a specific way, listen to specific cries, and even when everything is done right, you need to save and reset after a single use. Which is all fine and dandy for R&amp;D, but is quite a pain for practical use.<br /><br />To that end, for updating ACE for 2017, it&#039;s time to give the Coin Case the IE (Sorry, &#039;Edge&#039;) treatment -- using it to access a better ACE.<br /><br />Prerequisites:<br />Coin Case (... Duh)<br />A low level slide Pokemon in slot 3 (Gift Pokemon Tyrogue, if you&#039;re far enough to get it, seems to reliably work too)<br />Quagsire in slot 4 Holding TM02, with Return (TM27) as Move 1<br />At least one Ball<br />Bellsprout registered in Pokedex<br />&#039;Menu Account&#039; set to Off in Options (Not required, but useful)<br /><br />Step 1) Name Pokemon Storage Boxes the following<br /><br />[size=12pt]Ball Slot 1 is TM25:[/size]<br />Box 1: Ap0&#039;v&#039;v855<br />Box 2: Ã©7&#039;tp&#039;v7&#039;v&#039;d<br />Box 3: Ã©?2pÃ©D95<br />Box 4: 55555555<br />Box 5: 5&#039;l&#039;lA&#039;lx&#039;d<br /><br />Step 2) Enter Cherrygrove Mart<br />Step 3) Exit Cherrygrove Mart and take exactly four steps to the right (You should be lined up with the right-most tree between the Mart and Center)<br />Step 4) Listen to Bellsprouts cry<br />Step 5) Open inventory, swap to Key Items pocket (If already there, swap to Balls/TMs and then back to Key Items)<br />Step 6) Use Coin Case, confirm that Ball 1 is TM25<br />Step 7) Save and Reset<br />Step 8) Move your slide Pokemon to slot 2<br />Step 9) Move Quagsire to slot 3<br />Step 10) Congratulations, you never need to use the Coin Case ever again.<br /><br /><br />Now, let&#039;s get rid of that pesky slide Pokemon.<br /><br />Step 1) Name Pokemon Storage Boxes the following<br /><br />[size=12pt]Pokemon 3, jp $d8c0:[/size]<br />Box 1: Ap0z&#039;v055<br />Box 2: Ã©(4p0z&#039;v3<br />Box 3: Ã©)40&#039;v&#039;v85<br />Box 4: Ã©:4x&#039;d<br /><br />Step 2) Use TM25<br />Step 3) Swap Quagsire to slot 2<br />Step 4) Congratulations, all ACE is now dependent on a single Pokemon being in the right spot. (Make sure to never gain EXP/EVs with the Quagsire.)<br /><br />[b]NOTE: In order to make codes made for the Coin Case compatible with TM25, when you see [i]pÃ©D9[/i], replace it with [i]x&#039;d[/i] and stop inputting any code beyond that. If there isn&#039;t one, it probably uses the &#039;Required&#039; code of mine, which means just add [i]x&#039;d[/i] at the end. Alternatively, if you&#039;ve used my &#039;Required&#039; code from the other topic, TM25 codes can be used with the Coin Case by just removing the ending [i]x&#039;d[/i] for codes.[/b]<br /><br /><br />[size=24pt]TM25 CODES[/size]<br />[size=12pt]Pokemon 3 Modifier - Radio Reader:[/size]<br />Box 1: Ap&#039;vDÃ©?25<br />Box 2: Ã©0255555<br />Box 3: p0f&#039;vAÃ©â™‚2<br />Box 4: 55555555<br />Box 5: 554A&#039;v555<br />Box 6: &#039;v9Ã©A&#039;vÃ©K4<br />Box 7: Ã©A&#039;vx&#039;d<br /><br />Explanation: This sets Pokemon 3 in your party (Both Values) to PokeRadio&#039;s value +1 (As well as the Radio itself). By default, the radio can only go from $0 to $50 for values, and increases/decreases by 2 each time you change it. However, if it&#039;s an odd value it can go below 0 (aka, wrap around to 255) and, more importantly, you can just use TM25 a few times to get to any in-between values.<br /><br />Known Drawbacks: Won&#039;t register in Pokedex, name remains that of original Pokemon.<br /><br />[size=12pt]Pokemon 3 Modifier - Radio Reader (Egg Mode):[/size]<br />Box 1: Ap&#039;vDÃ©?25<br />Box 2: Ã©22Ã©â™‚255<br />Box 3: p0f&#039;vAÃ©92<br />Box 4: p0b&#039;vaÃ©f4<br />Box 5: 554A&#039;v555<br />Box 6: &#039;v9Ã©A&#039;vÃ©K4<br />Box 7: 55Ã©A4p07<br />Box 8: Ã©A4x&#039;d<br /><br />Same thing, but forces the Pokemon to be an Egg with between 1-100 steps to hatch, countering both drawbacks. Also shows what value you&#039;re to by changing your second Pokemon&#039;s current HP, since it can be a bit hard to tell on the Radio screen (.. Though there&#039;s a funny story behind the real reason it exists).<br /><br />[size=12pt]Pokemon 3: Experience and Nature Modifier (Replace ? with a to y):[/size]<br />Box A: 5p0M&#039;vA55<br />Box B: Ã©S4pÃ©T45<br />Box C: 0?555555 (After inputting once, can just do 0? rather than 0?555555)<br />Box D: &#039;v2Ã©U4x&#039;d<br /><br />For PokeTransporter, assuming it remains the same as RBY. Sets you to just a bit less than 800,000 EXP, which is level 85-99, depending on growth.<br /><br />[code]Nature:&nbsp;  -Atk,&nbsp; &nbsp;  -Def,&nbsp; &nbsp; &nbsp; -Spe,&nbsp; &nbsp; &nbsp; -SpA,&nbsp; &nbsp; &nbsp; -SpD<br />+Atk: a-Hardy ; b-Lonely; c-Brave&nbsp; ; d-Adamant; e-Naughty<br />+Def: f-Bold&nbsp; ; g-Docile; h-Relaxed; i-Impish ; j-Lax&nbsp; &nbsp; <br />+Spe: k-Timid ; l-Hasty ; m-Serious; n-Jolly&nbsp; ; o-Naive&nbsp; <br />+SpA: p-Modest; q-Mild&nbsp; ; r-Quiet&nbsp; ; s-Bashful; t-Rash&nbsp;  <br />+SpD: u-Calm&nbsp; ; v-Gentle; w-Sassy&nbsp; ; x-Careful; y-Quirky [/code]<br /><br />[size=12pt]Mass Clone Current Box to Box 1:[/size]<br />Box 1: Ap0z&#039;v755<br />Box 2: Ã©&#039;m2p5555<br />Box 3: Ã©A2x&#039;d<br /><br />Pretty self-explanatory, &quot;clones&quot; your currently selected box to box 1 -- overwriting anything there, obviously. Much faster than save cloning, and very convenient for when PokeTransporter is updated.<br /><br />[size=12pt]Pokemon 3: Shiny, Female (For some Gender Ratios, anyways):[/size]<br />Box A*: p04&#039;v&#039;dÃ©]4<br />Box B: p0kÃ©a455<br /><br />[size=12pt]Pokemon 3: Shiny, Male:[/size]<br />Box A*: p04Ã©]455<br />Box B: p0kÃ©a455<br /><br />Self-explanatory.<br />* Any Box except Box 1.<br /><br />[size=12pt]Instant Text (Lasts Until Reset):[/size]<br />Box A: 5pÃ©Z&#039;l555<br /><br /><br />Side Note: Labeled with numbers means the code absolutely requires the specific box, labeled with letters means there&#039;s no location-specific code and it can be placed sequentially starting with any box. Just remember to remove [i]x&#039;d[/i] from the end of all names except the last one if you&#039;re going to use multiple together.<br />[/quote]<br /><br />tried it with the memory editor using pc box item codes and that doesn&#039;t work what items do i need to change to make it work


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207092#msg207092 date=1506816873]<br />[quote author=FMK link=topic=8100.msg207089#msg207089 date=1506797769]...[/quote]<br /><br />tried it with the memory editor using pc box item codes and that doesn&#039;t work what items do i need to change to make it work<br />[/quote]<br /><br />What are you trying to do with [i]which[/i] code, exactly?


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: forsyz
icon: xx
body:
  https://www.youtube.com/watch?v=ffZjCabeNr4 would be cool if you could make a memory editor like this one using box names


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Somebody named DragonArbock finished a list of codes for every PokÃ©mon.<br /><br />You can find it here:<br /><br />https://pastebin.com/F93hVh7w


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: FMK
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207094#msg207094 date=1506837851]<br />https://www.youtube.com/watch?v=ffZjCabeNr4 would be cool if you could make a memory editor like this one using box names<br />[/quote]<br /><br />Ask, and ye shall receive. Though it&#039;s a rather... brute force way to do it. Also makes viewing boxes 5 and below a mess, but shouldn&#039;t cause any issues.<br /><br />[s]Disclaimer: I haven&#039;t fully tested the steps, but it should all work.[/s] Should work now, tested.<br /><br />01) Name Boxes<br />[code]Box 01: 54&#039;m2&#039;v955<br />Box 02 can be untouched for the moment.<br />Box 03: Ã©-2555x&#039;d<br />Bpx 04: 55555555<br /><br />Box 05: 4??&#039;vA?4? <br />Box 06: &#039;vA????E? <br />Box 07: ??&#039;vA?4?? <br />Box 08: A????F?p&nbsp; <br />Box 09: A4??&#039;vA?4 <br />Box 10: ?&#039;vA????q <br />Box 11: x&#039;d[/code]<br /><br />02) Rename Box(es) and Use TM25 as noted in the following steps, don&#039;t touch any other box names:<br /><br />[code][Box 5 Naming]<br />03) Box 02: Ã©&#039;m2p0z&#039;v3&nbsp; : Use TM25 Once<br />04) Box 02: Ã©&#039;m2p0&#039;v&#039;v8 : Use TM25 Once<br />05) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Twice<br />06) Box 02: Ã©&#039;m2p0!&#039;vA&nbsp; : Use TM25 Once<br />07) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />08) Box 02: Ã©&#039;m2p0z&#039;v4&nbsp; : Use TM25 Once<br />09) Box 02: Ã©&#039;m2p0&#039;v&#039;v8 : Use TM25 Once<br /><br />[Box 6 Naming]<br />10) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Twice<br />11) Box 02: Ã©&#039;m2p0H&#039;vA&nbsp; : Use TM25 Four Times<br />12) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />13) Box 02: Ã©&#039;m2p0!&#039;vA&nbsp; : Use TM25 Once<br />14) Box 02: Ã©&#039;m2p0455&nbsp;  : Use TM25 Once<br /><br />[Box 7 Naming]<br />15) Box 02: Ã©&#039;m2p0z&#039;v1&nbsp; : Use TM25 Once<br />16) Box 02: Ã©&#039;m2p0&#039;v&#039;v8 : Use TM25 Once<br />17) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Twice<br />18) Box 02: Ã©&#039;m2p0â™‚&#039;vA&nbsp; : Use TM25 Once<br />19) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />20) Box 02: Ã©&#039;m2p0z&#039;v2&nbsp; : Use TM25 Once<br />21) Box 02: Ã©&#039;m2p0&#039;v&#039;v8 : Use TM25 Once<br />22) Box 02: Ã©&#039;m2p0&#039;v55&nbsp; : Use TM25 Once<br /><br />[Box 8 Naming]<br />23) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />24) Box 02: Ã©&#039;m2p0H&#039;vA&nbsp; : Use TM25 Once<br />25) Box 03: Ã©93555x&#039;d&nbsp;  : Use TM25 Three Times (!! NOTE: Says Box 3, Not 2)<br />26) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />27) Box 02: Ã©&#039;m2p0â™‚&#039;vA&nbsp; : Use TM25 Once<br />28) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />29) Box 02: Ã©&#039;m2p0055&nbsp;  : Use TM25 Once<br /><br />[Box 9 Naming]<br />30) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Twice<br />31) Box 02: Ã©&#039;m2p0z&#039;vâ™€&nbsp; : Use TM25 Once<br />32) Box 02: Ã©&#039;m2p0&#039;v&#039;v8 : Use TM25 Once<br />33) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Twice<br />34) Box 02: Ã©&#039;m2p0&#039;d&#039;vJ : Use TM25 Once<br />35) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />36) Box 02: Ã©&#039;m2p0z&#039;v0&nbsp; : Use TM25 Once<br /><br />[Box 10 Naming]<br />37) Box 02: Ã©&#039;m2p0&#039;v&#039;v8 : Use TM25 Once<br />38) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Twice<br />39) Box 02: Ã©&#039;m2p0H&#039;vA&nbsp; : Use TM25 Four Times<br />40) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />41) Box 02: Ã©&#039;m2p01&#039;vA&nbsp; : Use TM25 Once<br /><br />42) Box 01: HHLLAA55<br />43) Box 02: 55555555<br />44) Box 03: 55555555[/code]<br /><br />Congratulations, assuming you&#039;ve done everything right, Boxes 5 to 11 contain the Hex Editor code and are ready for use.<br />A somewhat simple way to see if everything is right, there should be no ?&#039;s anywhere in Box 5 to 11&#039;s name.<br /><br /><br /><br />How To Use:<br />A through P represent 0 through F<br />(A=0, B=1, C=2, D=3, E=4, F=5, G=6, H=7, I=8, J=9, K=0xA, L=0xB, M=0xC, N=0xD, O=0xE, P=0xF)<br />HH is the value you want H to be<br />LL is the value you want L to be<br />AA is the value you want write to HL<br /><br />So say you want to write $FF to $D573, you&#039;d make Box 1 be NFHDPP55.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Looking at [url=http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Crystal/Any%25_Guide#The_journey_to_3_Itemfinders]this[/url], the whole process to achieve ACE looks a bit too complicated. My own method requires to discard nearly 30 Pokemon though, so whatever. The attempt to obtain TM17 using box names ACE was a disaster anyway, I&#039;m going to see if I can make it work reasonably with PC items.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: Caveat
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This is more of a &quot;because you can&quot; thing in the English versions, since the easiest way to get an ????? (FF) is through ACE already.<br /><br />In other languages, though, this could be very useful! Although, the destroyed stack might make it impossible to continue playing...


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Caveat link=topic=8097.msg207099#msg207099 date=1506855404]<br />Although, the destroyed stack might make it impossible to continue playing...<br />[/quote]<br /><br />We were aware of this, so we proceeded differently. We use this ACE method to edit the save file to give ourselves a TM17 in the items pocket, which can trigger ACE more reliably. Then, just reseting the game restores everything to normal, except for the convenient save file hack.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The known methods for ACE as far as I know are:<br />- Bug-Catching Contest ACE, only working in japanese games<br />- Coin Case ACE, only working in English games<br />- TM33/25 ACE, working in all games and that in G/S, could theorically be achieved without the help of any other game, although it would be hard. In Crystal though, requires a second game at least.<br />- Bad Clone name ACE, not currently tested in non-english games (although should work) and not super hard to perform, but Crystal only.<br />- Move 00 Type ACE, not currently tested in non-english games (although should work) nor in english Crystal, but this move can only be obtained by using a 1G game or maybe using the Bad Clone Trick? Research to be done.<br />- Glitch PokÃ©dex Mode ACE, whose proof of concept exists only in Crystal to my knowledge, but has never been fully setup (probably something that someone should work on)<br /><br />So yeah in any ways, even though Move 00 and Glitch PokÃ©dex are not fully exploited, the development of a more friendly ACE method especially in G/S would be great.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  I would like to bring up a small adjustment : the PokÃ©mon&#039;s fourth move PP can be 24 (16 PP + 3 PP Up).<br /><br />For instance, this Pidgey works.<br />[img]http://puu.sh/xNphc/db9c007eaa.png[/img]<br /><br />This Pidgey can be found in the save file I attached, which works for the purpose of obtaining TM17 (but not afterwards), just as a proof that the payload to obtain it works.<br /><br /><br />Big shoutouts to Crystal_ because it took some effort to make a viable setup.


subject: Re: Brock Through Walls not working...or at least, barely
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Keep holding B. That should solve the whole problem.<br />This is an issue inherent to Brock Through Walls. It&#039;s a bit technical, but the game is constantly trying to force some inputs, but as long as you hold a button you&#039;re preventing this from happening. Holding B does nothing yet still prevents the input forcing.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207100#msg207100 date=1506855898]<br />can&#039;t get shiny male pokemon to work my boxs are like this http://prntscr.com/grv7hp<br />[/quote]<br /><br />Rename Box1 to 55555555 -- While some of the codes can go anywhere, TM25 still executes code starting at Letter 2 of Box1, meaning if you don&#039;t buffer it with a safe letter (IE: 5) issues can and will occur.


subject: Re: Brock Through Walls not working...or at least, barely
poster_name: Gummysaur
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh wow, it&#039;s that simple? That&#039;s simultaneously a relief but also kind of embarrassing ^^u<br /><br />Thank you very much, my Growlithe is now an Arcanine and is no longer dying to everything! I picked up a Reflect and Submission TM on the way as well :D


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Crystal_ link=topic=8097.msg207097#msg207097 date=1506850009]<br />Looking at [url=http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Crystal/Any%25_Guide#The_journey_to_3_Itemfinders]this[/url], the whole process to achieve ACE looks a bit too complicated. My own method requires to discard nearly 30 Pokemon though, so whatever. The attempt to obtain TM17 using box names ACE was a disaster anyway, I&#039;m going to see if I can make it work reasonably with PC items.<br />[/quote]<br /><br />The complications exist because of some additional conditions in Crystal. Firstly, the 0x00 item (?) has a description which crashes the game, which requires item swaps to avoid the game printing the item description. As such, underflowing the Key Items Pocket also requires additional steps to prevent the cursor viewing a 0x00 item. In Gold/Silver, the 0x00 item is completely safe so we only need 2 Key Items to generate, and by swapping both, depositing both of them in the PC, and swapping two 0x00 items, we can underflow our inventory to 254 items (as 255 forces the cursor to the top of the menu).<br /><br />The additional complications to achieve ACE are because we don&#039;t have a bootstrap PokÃ©mon to use in the (old) Crystal Any% speedrun. You could easily just generate a TM25 by depositing 216 of an item, which you can find an item with a quantity greater than 216 by scrolling down to the PC Items portion of the underflowed bag, and as there are no quantities in the Key Items pocket, the quantities of PC items will represent items.<br /><br />Also, it&#039;s worth mentioning that the setup to create the 3 Itemfinders is slightly outdated; a much safer and easier setup exists which was used for the video I linked earlier.<br /><br />Also, the 3DSVC emulator does not allow execution of SRAM for whatever reason (even when enabled), so calling box names in SRAM would definitely not work. I don&#039;t think a bootstrap with PC items would work well; you have plenty enough resources with the characters provided with box names that they&#039;re much easier to work with anyway.


subject: RNG Manipulation for TID on Virtual Console
poster_name: Link_enfant
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Link_enfant
icon: xx
body:
  Hello everyone from the Glitch City Labs!<br /><br />Just to be sure, am I posting this topic in the right place? I wasn&#039;t sure if RNG manipulation can actually be considered as glitch related.<br /><br />I&#039;ve recently bought Gold &amp; Silver on 3DS and for various reasons, I want to get a specific trainer ID number in Silver : [b]23592[/b]<br />From what I&#039;ve found after some research, it looks like RNG manipulation for a certain ID in Gold versions has been used a lot by speedrunners of the game.<br />There are guides and videos for this, the problem is that they don&#039;t apply well in my case: I&#039;m playing on VC and not the original cartridge which seemingly makes things different, I&#039;m on French Silver version instead of English Gold, and of course I&#039;m looking for a completely different ID.<br /><br />From what I&#039;ve seen, that manipulation is not the hardest at all and only EonTimer is needed.<br />My problem is that I lack the necessary informations regarding the target frame, and the possible timing changes due to the game being played on VC.<br /><br />By any chance, does anyone have some knowledge on Gen II RNG mechanisms and could be of any help to get what I&#039;m looking for? :)


subject: Re: RNG Manipulation for TID on Virtual Console
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Unfortunately, creating manipulations are not a linear process. It usually requires running a bot to test permutations of inputs until the correct ID is produced. There isn&#039;t a mathematical formula to determine what inputs to press because of how the RNG is based on a hardware divider, causing RNG to differ vastly with each code branch.<br /><br />As we don&#039;t know the exact differences that cause different RNG for 3DSVC, we cannot create any manipulations easily. Any manipulations you want will have to be done by hand.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Another update : the box names are actually version-dependent, due to charset differences.<br />Crysta_ and I worked out setups for all four localizations, see below for your language.<br /><br />Names for the [u]Spanish and Italian[/u] versions :<br />[img]https://i.imgur.com/2stA9Ll.png[/img]<br />[code]<br />nop | ld d, b ; box 2 terminator<br />or $a4<br />and $a4<br />push af<br />pop hl<br />or $d0<br />ld d, b ; 0x50<br />and $d0<br />call nc, A480<br />ld d, b ; 0x50<br />[/code]<br /><br />Names for the [u]French[/u] version :<br />[img]http://puu.sh/xNBNP/40dfab6a3d.png[/img]<br />[code]<br />ld d,b<br />or $A4<br />and $A4<br />push af<br />pop hl<br />; $A4<br />or $F1<br />; $F5<br />ld d,b<br />; $F5<br />and $D8<br />; $D0<br />cp $FE ; To set the carry<br />call c, A480<br />ld d,b<br />[/code]<br /><br />Names for the [u]German[/u] version :<br />[img]http://puu.sh/xNC8L/828a997d4d.png[/img]<br />[code]<br />ld d,b<br />or $A4<br />and $A4<br />push af<br />and $80<br />or $50<br />pop hl<br />call nz, A480<br />ld d,b<br />[/code]


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=windylacine link=topic=8100.msg207112#msg207112 date=1506892129]<br />@FMK<br /><br />is there a code to turn Pokemon Shiny regardless of gender?<br />[/quote]<br /><br />Both codes work for any gender, it&#039;s just that since the Attack IV both determines shininess and gender, what gender they end up as after turning them shiny is what the Male/Female is for.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I made a list of the new box name characters, and their respective opcodes and hex values, for EU versions of Gold/Silver: https://pastebin.com/dW4dPyGp<br /><br />Spanish and Italian have the holy grail of opcodes, adding 18 new opcodes. French has approximately the same usefulness of box name characters as English version. German is hit the hardest, as there is no opcode to arbitrarily add or subtract, forcing the creative use of &quot;or x&quot; and &quot;and x&quot; to get specific values.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Thanks lucky!<br /><br />@Crystal_, ISSOtm: Great work, I&#039;m looking forward to giving this a go one day.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: theSLAYER
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: theSLAYER
icon: clip
body:
  Hey FMK,<br />The initial steps gave me TM25 in my ball pocket successfully.<br />However when I do the second part, it throws me an invalid opcode error (on bgb)<br /><br />Third spot slide Pokemon is definitely at a low enough level (which is why I was able to get TM25 in wrong pocket),<br />and my TM02 Holding Return Quagsire is at Slot 4 when I &quot;used&quot; TM25.


subject: Re: ACE in G/S via stack corruption (compatible with non-EN versions, apparently)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As luckytyphlosion pointed out above (but somehow we completely missed it until yesterday night), the above trick will not work on VC.<br />(Because for some reason, it appears that trying to execute from *unlocked* SRAM still returns FFs, leading to 0039 crashes)<br /><br />Crystal_ worked out a fix, though :<br />- Replace the &quot;Ae&quot; in box names with &quot;4A&quot;.<br />- Have a Quagsire holding HP Up with Sleep Talk as its first move (this should be the second Quagsire in the party).<br />- Keep the same item setup in the PC, but put an extra [Any item] x[Any qty] before everything else.<br /><br />Explanation :<br />- &quot;4A&quot; redirects execution to the 3rd Party PokÃ©mon&#039;s data.<br />- Quagsire w/ HP Up &amp; Sleep Talk redirects to PC Item 2 qty (unlike the &quot;Ae&quot; method which goes to item 1 qty).<br />- We mostly rejoin the non-VC route. Good thing it emulates Echo RAM, otherwise German and French VC would be in big trouble.<br /><br /><br /><br />[img]http://puu.sh/xO4Ab/a3b7159786.png[/img]


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: forsyz
icon: xx
body:
  hex editor doesn&#039;t work did all the steps correctly and theres still question marks and it crashes my game when i try to use it&nbsp; this was the code it wrote&nbsp; FA C0 D8 D6 80 67 FA BF D8 D6 80 07 07 07 07 84 67 FA C2 D8 D6 80 6F FA CB D8 D6 80 E6 07 07 07 07 E6 6F 50 F6 FA E6 C4 D8 80 E6 67 50 C3 D8 80 E6 07 07 07 07 50 77 D0 50 F7 F7 50 00 00 00 81 8E 97 F7 F8 50 00 00 00 81 8E 97 F7 F9 50


subject: Re: RNG Manipulation for TID on Virtual Console
poster_name: Link_enfant
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the quick reply.<br />I&#039;ll see if I can get some results by doing some tests on both VC and VBA or other emulators.<br />If RNG manipulation isn&#039;t a viable solution in my case, I&#039;ll eventually use ACE to modify my TID later in the game.


subject: Re: RNG Manipulation for TID on Virtual Console
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Link_enfant link=topic=8101.msg207121#msg207121 date=1506945872]<br />Thanks for the quick reply.<br />I&#039;ll see if I can get some results by doing some tests on both VC and VBA or other emulators.<br />If RNG manipulation isn&#039;t a viable solution in my case, I&#039;ll eventually use ACE to modify my TID later in the game.<br />[/quote]<br /><br />I&#039;m unexperienced with this but if I remember rightly VBA isn&#039;t an accurate emulator for RNG manipulation in the Game Boy games, and BGB only recently updated to fix it after the speedrunning community addressed it.<br /><br />So for RNG manipulation tests you should use [url=http://bgb.bircd.org/#downloads]BGB[/url] (maybe a few others emulate it correctly but I don&#039;t know of any that do so it&#039;s safest to use the latest version of BGB). You&#039;ll also need the CGB Bootstrap ROM or it won&#039;t work correctly.<br /><br />When you have it right click, select Options&gt;System and make sure the settings are like this:<br /><br />(I don&#039;t know if you need both bootroms, probably not, but it may be safe to make sure)<br />[img]https://i.imgur.com/Rpe60i6.png[/img]<br /><br />From the videos I&#039;ve seen it has you holding down specific buttons/resetting (to get the Game Boy screen to appear, potentially having input there as well which can change the palette) at certain times after resetting the game with a cleared save file and depending on what you press at specific times you can manipulate the right ID.<br /><br />This is an example of a manip for Blue that gives you the Trainer ID 32862:<br />https://www.youtube.com/watch?v=XgycGIg0VHw<br /><br />It looks like the process could be really tedious though, so I don&#039;t know if I&#039;d recommend it through trial and error alone. There are 65535 possible Trainer ID values (although I don&#039;t know if all are used; some DVs are actually unused for certain wild Generation I battles for instance) and finding the right manip could take a very long time.<br /><br />For that reason maybe luckytyphlosion or another knowledgeable person in the speedrunning community like Dabomstew could help you in relation to bots and successfully finding a manip.<br /><br />However I don&#039;t know how doing it on 3DS Virtual Console would go and luckytyphlosion hinted that a manipulation on Game Boy Color may not work on 3DS Virtual Console, so if you find a manip on emulator it may not be enough sadly. Unless you want to settle for BGB/Game Boy Color it may not be a good idea as luckytyphlosion said they don&#039;t know what causes the different RNG in Virtual Console.<br /><br />Best of luck! and hope someone else with more insight into this can help you in putting together the manip. :)


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Can anyone confirm that Sonic Boom in the Western releases still uses Gust&#039;s animation?<br /><br />[quote author=ajxpk link=topic=8086.msg207034#msg207034 date=1506635980]<br />My favorite is [url=http://dogasu.bulbagarden.net/features/pokemon_in_1996/corocoro_comics/05_may_1996/page060-061_mew.png]this one[/url]. ([url=http://dogasu.bulbagarden.net/features/pokemon_in_1996.html]Source[/url])<br />IMO an interesting coincidence that the name of the first Mew Screenshot ever shown has the OT Name ã‚²ãƒ¼ãƒ•ãƒª.<br />The same name you can find as default name in Pocket Monsters Blue.<br />[/quote]<br /><br />I think they gave Mew that OT to clarify that it was a special gift from Game Freak (ã‚²ãƒ¼ãƒ•ãƒª is short for ã‚²ãƒ¼ãƒ ãƒ•ãƒªãƒ¼ã‚¯), especially since it was the first distribution of Mew and the first ever in PokÃ©mon. The initial event was held on April 15, 1996, less than two months after Red and Green were released. Were there any pre-announcement rumors about Mew&#039;s existence among Japanese fans at that point in time?


subject: Perfect Hidden Power Pokemon
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
   So with the generation II games as I&#039;m sure many of you are aware, you can any Pokemon shiny with just the manipulation of their DV&#039;s and the coin case, but using the same method you could also get perfect Hidden Power for certain Pokemon too as Hidden Power&#039;s strength and type is determined by a Pokemon&#039;s DV&#039;s. <br /><br />Getting a max strength Hidden Power is nice, but sadly because Hidden Power is only determined by DV&#039;s in generation II and the formula completely changes in the later generations, it&#039;s probably the reason why no one cares about getting perfect Hidden Powers for pokes in generation II. But if you want to play competitive generation II games - having a perfect Hidden Power on your Pokemon is a good thing to have. <br /><br />So I was wondering to those who know the coding better then me, what would I need to do to get a Pokemon with 15/13/13/15/15 stats which corresponds to a max power Hidden Power Bug? Which is useful for Thick Club Marowak, Scizor and Forretress among other things (and especially useful for Scizor and Forrettress in this generation as they learn no other bug moves).<br /><br />http://www.psypokes.com/gsc/dvguide.php There is a list here of DV combinations for perfect Hidden Power&#039;s if anyone else is curious and if anyone else wants to post codes to get pokes with perfect Hidden Powers in another type (Ice, Grass, Water are other competitively useful Hidden Power types..).


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: SpunkyBandy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=8093.msg207095#msg207095 date=1506843704]<br />Somebody named DragonArbock finished a list of codes for every PokÃ©mon.<br /><br />You can find it here:<br /><br />https://pastebin.com/F93hVh7w<br />[/quote]<br /><br />Torchickens, thank you so much for the codes! And thank you too DragonArbok for this!


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SpunkyBandy link=topic=8093.msg207125#msg207125 date=1506975021]<br />[quote author=Torchickens link=topic=8093.msg207095#msg207095 date=1506843704]<br />Somebody named DragonArbock finished a list of codes for every PokÃ©mon.<br /><br />You can find it here:<br /><br />https://pastebin.com/F93hVh7w<br />[/quote]<br /><br />Torchickens, thank you so much for the codes! And thank you too DragonArbok for this!<br />[/quote]<br /><br />You&#039;re very welcome! DragonArbock did most of this though (except for Celebi, Mew and a few others which were written by myself). Glad our codes came in useful. :)


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: windylacine
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey, have you come up with a code for set third pokemon&#039;s level? I want to reset hatched pokemon&#039;s level to 0 just to gain their default moves.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: FMK
icon: xx
body:
  [quote author=theSLAYER link=topic=8100.msg207118#msg207118 date=1506932061]<br />Hey FMK,<br />The initial steps gave me TM25 in my ball pocket successfully.<br />However when I do the second part, it throws me an invalid opcode error (on bgb)<br /><br />Third spot slide Pokemon is definitely at a low enough level (which is why I was able to get TM25 in wrong pocket),<br />and my TM02 Holding Return Quagsire is at Slot 4 when I &quot;used&quot; TM25.<br />[/quote]<br /><br />[quote]Step 8) Move your slide Pokemon to slot 2<br />Step 9) Move Quagsire to slot 3[/quote]<br /><br />Seems like you missed those steps, since it&#039;s trying to execute the TrainerID of Pokemon 3 as an OpCode, which it shouldn&#039;t reach if Quagsire is in slot 3.<br /><br />[quote author=forsyz link=topic=8100.msg207120#msg207120 date=1506934798]<br />hex editor doesn&#039;t work did all the steps correctly and theres still question marks and it crashes my game when i try to use it&nbsp; this was the code it wrote&nbsp; FA C0 D8 D6 80 67 FA BF D8 D6 80 07 07 07 07 84 67 FA C2 D8 D6 80 6F FA CB D8 D6 80 E6 07 07 07 07 E6 6F 50 F6 FA E6 C4 D8 80 E6 67 50 C3 D8 80 E6 07 07 07 07 50 77 D0 50 F7 F7 50 00 00 00 81 8E 97 F7 F8 50 00 00 00 81 8E 97 F7 F9 50<br />[/quote]<br /><br />.. Off by one errors are the worst.<br /><br />Up to step 22 of my instructions are correct, so assuming you saved after inputting everything...<br /><br />Rename Box 1, 2, 3, 8, 9, 10, and 11 so they match what they were for step 1.<br /><br />Rename Box 3 to Ã©72555x&#039;d<br />23) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />24) Box 02: Ã©&#039;m2p0H&#039;vA&nbsp; : Use TM25 Once<br />25) Box 03: Ã©93555x&#039;d&nbsp;  : Use TM25 Three Times (!! NOTE: Says Box 3, Not 2)<br /><br />Continue from Step 26 of the original, and that should fix everything.<br /><br />[quote author=windylacine link=topic=8100.msg207127#msg207127 date=1506990516]<br />Hey, have you come up with a code for set third pokemon&#039;s level? I want to reset hatched pokemon&#039;s level to 0 just to gain their default moves.<br />[/quote]<br /><br />For the EXP and Nature Modifier code, change the M for Box A to an A, and make the ? be A as well. That will set its experience to 0. After that, you just need to deposit it into the PC and withdraw it for it to update its level.<br /><br />Alternatively:<br />Box A: 5pej4x&#039;d<br /><br />Sets their level to 0 but doesn&#039;t affect their EXP, so having them gain any EXP will cause them to level from 0 back to whatever level they were before.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=FMK link=topic=8100.msg207128#msg207128 date=1506992077]<br />[quote author=theSLAYER link=topic=8100.msg207118#msg207118 date=1506932061]<br />Hey FMK,<br />The initial steps gave me TM25 in my ball pocket successfully.<br />However when I do the second part, it throws me an invalid opcode error (on bgb)<br /><br />Third spot slide Pokemon is definitely at a low enough level (which is why I was able to get TM25 in wrong pocket),<br />and my TM02 Holding Return Quagsire is at Slot 4 when I &quot;used&quot; TM25.<br />[/quote]<br /><br />[quote]Step 8) Move your slide Pokemon to slot 2<br />Step 9) Move Quagsire to slot 3[/quote]<br /><br />Seems like you missed those steps, since it&#039;s trying to execute the TrainerID of Pokemon 3 as an OpCode, which it shouldn&#039;t reach if Quagsire is in slot 3.<br /><br />[quote author=forsyz link=topic=8100.msg207120#msg207120 date=1506934798]<br />hex editor doesn&#039;t work did all the steps correctly and theres still question marks and it crashes my game when i try to use it&nbsp; this was the code it wrote&nbsp; FA C0 D8 D6 80 67 FA BF D8 D6 80 07 07 07 07 84 67 FA C2 D8 D6 80 6F FA CB D8 D6 80 E6 07 07 07 07 E6 6F 50 F6 FA E6 C4 D8 80 E6 67 50 C3 D8 80 E6 07 07 07 07 50 77 D0 50 F7 F7 50 00 00 00 81 8E 97 F7 F8 50 00 00 00 81 8E 97 F7 F9 50<br />[/quote]<br /><br />.. Off by one errors are the worst.<br /><br />Up to step 22 of my instructions are correct, so assuming you saved after inputting everything...<br /><br />Rename Box 1, 2, 3, 8, 9, 10, and 11 so they match what they were for step 1.<br /><br />Rename Box 3 to Ã©72555x&#039;d<br />23) Box 02: Ã©&#039;m2px&#039;d&nbsp; &nbsp; : Use TM25 Once<br />24) Box 02: Ã©&#039;m2p0H&#039;vA&nbsp; : Use TM25 Once<br />25) Box 03: Ã©93555x&#039;d&nbsp;  : Use TM25 Three Times (!! NOTE: Says Box 3, Not 2)<br /><br />Continue from Step 26 of the original, and that should fix everything.<br /><br />[quote author=windylacine link=topic=8100.msg207127#msg207127 date=1506990516]<br />Hey, have you come up with a code for set third pokemon&#039;s level? I want to reset hatched pokemon&#039;s level to 0 just to gain their default moves.<br />[/quote]<br /><br />For the EXP and Nature Modifier code, change the M for Box A to an A, and make the ? be A as well. That will set its experience to 0. After that, you just need to deposit it into the PC and withdraw it for it to update its level.<br /><br />Alternatively:<br />Box A: 5pej4x&#039;d<br /><br />Sets their level to 0 but doesn&#039;t affect their EXP, so having them gain any EXP will cause them to level from 0 back to whatever level they were before.<br />[/quote]<br /><br />also why do you name box 2 Box 02: Ã©&#039;m2px&#039;d55 in step one if your just going to name it something different in step two then use tm25


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207129#msg207129 date=1506994362]<br />[quote author=FMK link=topic=8100.msg207128#msg207128 date=1506992077]...[/quote]<br /><br />also why do you name box 2 Box 02: Ã©&#039;m2px&#039;d55 in step one if your just going to name it something different in step two then use tm25<br />[/quote]<br /><br />It&#039;s an artifact of figuring out the order of operations to my byte writer, I just forgot to remove it. Also, found one other mistake now that I got around to testing it.<br /><br />Step 34 should be Box 02: Ã©&#039;m2p0&#039;d&#039;vJ : Use TM25 Once<br />(It was Ã©&#039;m2p0!&#039;vA before, which is 0x20 off of the correct value.)


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: L is Real
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=8093.msg207126#msg207126 date=1506977079]<br />You&#039;re very welcome! DragonArbock did most of this though (except for Celebi, Mew and a few others which were written by myself). Glad our codes came in useful. :)<br />[/quote]<br /><br />Very useful in fact. Now the otherwise unobtainable Event movesets can be played with on cartridge (or VC). For example, Belly Drum Wooper.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: windylacine
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: windylacine
icon: xx
body:
  [quote author=FMK link=topic=8100.msg207128#msg207128 date=1506992077]<br />[quote author=windylacine link=topic=8100.msg207127#msg207127 date=1506990516]<br />Hey, have you come up with a code for set third pokemon&#039;s level? I want to reset hatched pokemon&#039;s level to 0 just to gain their default moves.<br />[/quote]<br /><br />For the EXP and Nature Modifier code, change the M for Box A to an A, and make the ? be A as well. That will set its experience to 0. After that, you just need to deposit it into the PC and withdraw it for it to update its level.<br /><br />Alternatively:<br />Box A: 5pej4x&#039;d<br /><br />Sets their level to 0 but doesn&#039;t affect their EXP, so having them gain any EXP will cause them to level from 0 back to whatever level they were before.<br />[/quote]<br /><br />Oddly, When I set the box names following your instructions, It bought its level down to 5, even with alternative way, it bought it down to 3 rather than resetting to 0 level.<br /><br />I was trying to reset hatched Celebi&#039;s level for their default moves which were 1 level ups only. :S<br /><br />EDIT: It worked!


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  hex editor still doesn&#039;t work after following your steps there are still question marks in box 8 to box 10s name


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207133#msg207133 date=1507001562]<br />hex editor still doesn&#039;t work after following your steps there are still question marks in box 8 to box 10s name<br />[/quote]<br />Where does the first question mark in Box 8 appear at/What is Box 8&#039;s name?


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=FMK link=topic=8100.msg207134#msg207134 date=1507003949]<br />[quote author=forsyz link=topic=8100.msg207133#msg207133 date=1507001562]<br />hex editor still doesn&#039;t work after following your steps there are still question marks in box 8 to box 10s name<br />[/quote]<br />Where does the first question mark in Box 8 appear at/What is Box 8&#039;s name?<br />[/quote]<br />After AH


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207135#msg207135 date=1507004335]<br />[quote author=FMK link=topic=8100.msg207134#msg207134 date=1507003949]<br />[quote author=forsyz link=topic=8100.msg207133#msg207133 date=1507001562]<br />hex editor still doesn&#039;t work after following your steps there are still question marks in box 8 to box 10s name<br />[/quote]<br />Where does the first question mark in Box 8 appear at/What is Box 8&#039;s name?<br />[/quote]<br />After AH<br />[/quote]<br />So Box 8&#039;s name is AH???F?p or..? Are any letters for Box 9 or Box 10 modified at all compared to Step 1? If not, seems like you messed up on Step 25. 


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=FMK link=topic=8100.msg207136#msg207136 date=1507005430]<br />[quote author=forsyz link=topic=8100.msg207135#msg207135 date=1507004335]<br />[quote author=FMK link=topic=8100.msg207134#msg207134 date=1507003949]<br />[quote author=forsyz link=topic=8100.msg207133#msg207133 date=1507001562]<br />hex editor still doesn&#039;t work after following your steps there are still question marks in box 8 to box 10s name<br />[/quote]<br />Where does the first question mark in Box 8 appear at/What is Box 8&#039;s name?<br />[/quote]<br />After AH<br />[/quote]<br />So Box 8&#039;s name is AH???F?p or..? Are any letters for Box 9 or Box 10 modified at all compared to Step 1? If not, seems like you messed up on Step 25.<br />[/quote]<br /><br />yes none of the question marks from box 8 to 10 were changed


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: FMK
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207137#msg207137 date=1507007430]<br />[quote author=FMK link=topic=8100.msg207136#msg207136 date=1507005430]<br />[quote author=forsyz link=topic=8100.msg207135#msg207135 date=1507004335]<br />[quote author=FMK link=topic=8100.msg207134#msg207134 date=1507003949]<br />[quote author=forsyz link=topic=8100.msg207133#msg207133 date=1507001562]<br />hex editor still doesn&#039;t work after following your steps there are still question marks in box 8 to box 10s name<br />[/quote]<br />Where does the first question mark in Box 8 appear at/What is Box 8&#039;s name?<br />[/quote]<br />After AH<br />[/quote]<br />So Box 8&#039;s name is AH???F?p or..? Are any letters for Box 9 or Box 10 modified at all compared to Step 1? If not, seems like you messed up on Step 25.<br />[/quote]<br /><br />yes none of the question marks from box 8 to 10 were changed<br />[/quote]<br /><br />Then yeah, you didn&#039;t name Box 3 correctly for Step 25. That&#039;s all there is to it.<br /><br />... Or your Box 1 name is wrong, that&#039;s also possible.


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: forsyz
icon: xx
body:
  [quote author=ISSOtm link=topic=8086.msg206974#msg206974 date=1506292153]<br />The Johto Guard Glitch cannot be used to smuggle mail into Gen I. (Below is a detailed explanation using the disassembly, but I didn&#039;t test it in-game)<br /><br /><br />The function that checks for Gen I compatibility is called SpecialTimeCapsuleCompatibility (https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2054-L2133).<br />It&#039;s basically composed of three loops which check one part of the compatibility each.<br />The first loop parses species, and this is how it returns : [url=https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2066]until it encounters a $FF species[/url].&nbsp; <br />The [url=https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2075]second[/url] and [url=https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/link.asm#L2093]third[/url] loop instead use the counter counting the number of PokÃ©mon in the party.<br /><br />Thus, only the PokÃ©mon species check is affected by the Johto Guard Trick. Quite a shame, but oh well.<br /><br /><br />As for the Mystery Gift trigger being tied to Kurt, [url=https://github.com/pret/pokecrystal/search?p=1&amp;q=EVENT_RECEIVED_BALLS_FROM_KURT&amp;type=&amp;utf8=%E2%9C%93]a quick search about the flag[/url] turns up that for some reason it&#039;s also used by a bunch of other triggers. So I believe something else is going on there, probably that this flag is used as a temporary by different scripts ?<br />I don&#039;t really know what&#039;s going on there, but here are the elements I found :<br />- The delivery guy is [url=https://github.com/pret/pokecrystal/blob/700321a7fb2d6c852ffc91cc0b8867526cb76813/maps/PokeCenter2F.asm#L1052]directly tied[/url] to the mystery gift flag. (I don&#039;t know how for sure)<br />- When the delivery guy appears, [url=https://github.com/pret/pokecrystal/blob/700321a7fb2d6c852ffc91cc0b8867526cb76813/maps/PokeCenter2F.asm#L55]he sets Kurt&#039;s flag again[/url].<br />[/quote]<br /><br />You could use real time ace to modify the code so it does


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What do you mean by &quot;so it does&quot; ?<br />Also ACE cannot modify code. That had been brought up before, but it&#039;s all the NOPE.


subject: Crystal: Unused party sanitisation function
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was looking in pokecrystal for something unrelated and [url=https://github.com/pret/pokecrystal/blob/master/unknown/013a47.asm]this caught my eye[/url].<br /><br />As the filename would have you expect, it&#039;s in EN Crystal at [tt]$13A47 (4:7A47)[/tt]. (It&#039;s in JP Crystal at [tt]$13BB3 (4:7BB3)[/tt]). That&#039;s near the end of the bank, located after some Bug-Catching Contest-related stuff, and before a function that uses a lookup table to find square roots. It appears to not be in G/S (and given that it calls a function in a bank related to mobile code, that&#039;s not unexpected).<br /><br />It is completely unreferenced and unused in at least JP and EN Crystal.<br /><br />Here&#039;s what it does:<br /><br />[list]<br />[li]If the number of PokÃ©mon in the party is over 6, set it to 6[/li]<br />[li]The party species bytes are checked. If a byte is an invalid species ([tt]$00, $FC, $FE, $FF[/tt]), change that species byte and the first species byte of that PokÃ©mon structure to Smeargle ([tt]$EB[/tt]).[/li]<br />[li]For all PokÃ©mon in the party: [list]<br />[li]If the second species byte in the PokÃ©mon structure is invalid ([tt]$FD[/tt] (Egg) is also considered invalid here), change it to Smeargle.[/li]<br />[li]If the PokÃ©mon&#039;s level is below 2, set it to 2; if it is over 100, set it to 100. Recalculate the PokÃ©mon&#039;s stats, no matter whether or not the level was modified.[/li]<br />[li]If the PokÃ©mon&#039;s nickname is unterminated after 6 bytes, terminate it by setting the 6th byte to [tt]$50[/tt]; if the nickname has any invalid characters (defined here as anything that is [b]not[/b] [tt]$00, $05 - $13, $19 - $1C, $26 - $34, $3A - $3E, $40 - $48, $60 - $FF[/tt]; a function in a bank related to mobile functionality is called to do this), set it to the PokÃ©mon species name (if the PokÃ©mon is an Egg, then set it to [tt]&quot;ã‚¿ãƒžã‚´&quot;[/tt] ([i]&quot;Tamago&quot;/Egg[/i]) followed by [tt]50 50 50[/tt] instead)[/li]<br />[li]If the PokÃ©mon&#039;s Original Trainer name is unterminated after 6 bytes, terminate it by setting the 6th byte to [tt]$50[/tt]; if it has any invalid characters, set it to the player&#039;s name[/li]<br />[li]If the PokÃ©mon has an invalid move in slot 1 ([tt]$00, $FC, $FD, $FE, $FF[/tt]), replace it with Pound. If there is an invalid move in slot 2, 3, or 4, delete all moves starting from that slot(!!!).[/li]<br />[/list][/li]<br />[/list]<br /><br />Note that this code is only half localised in non-JP - it assumes nicknames and OT names are 6 bytes long, the list of characters considered valid assumes a Japanese game, and if an Egg&#039;s nickname contains invalid characters, it gets set to &quot;ã‚¿ãƒžã‚´&quot;; however, when removing a PokÃ©mon&#039;s nickname, or changing its OT name, it copies the correct number of bytes for the localisation.<br /><br />Given that this calls a function in a mobile-related bank, this function may have been intended to have been used to force the legitimacy of party PokÃ©mon when using mobile-related features. Of course, it may have just been debug code.


subject: Re: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  All my attempts to adapt the memory editor code to the french version have been in vain. There&#039;s always a missing instruction or some other kind of inconvenient on whichever I try. Granted, maybe I&#039;ve just had a bad day, but I&#039;ve been stuck for a while...<br /><br />Anyway, the idea is to load [i]x[/i] into [i]yz[/i], where x is [$f8f9] + [$f8fa], y is [$f8f5] + [$f8f6], and z is [$f8f7] + [$f8f8]. These addresses belong to box 7&#039;s name, so they can easily be manipulated and each sum can yield any given value. I thought they were the most convenient since you can&#039;t access the low $f9xx addresses with box name characters. Achieving this with mostly box names would be ideal, because with only PC items it&#039;s a [url=https://pastebin.com/in4MS7zW]complete abomination[/url]. It was relatively easy in all non-french european versions, but the lack of available instructions in the french version isn&#039;t helping.<br /><br />Maybe someone with more patience than me wants to pick this up? Post #3 of this thread has the documentation of everything done so far.


subject: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: Lory94
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m able to perform Celebi Glitch in the emulator but now, I own the VC of PokÃ©mon Silver and I&#039;m curious if is possible to perform this glitch here.<br /><br />Thanks.


subject: Re: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  VC is approximately as accurate as VBA is. So as long as you don&#039;t need exact emulation to run it (or SRAM execution) you&#039;ll be fine.


subject: Re: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [size=14pt][b]Memory Editor using French Box Names (does not require items in Item Pocket)[/b][/size]<br /><br />Special thanks to gifvex for contributing some ideas to the box names.<br /> <br />[b]Preparation for TM09[/b]<br /><br />Set Box 1&#039;s Name:<br />	A p u&#039; 9 Ã© G â™€ n&#039;<br />Use TM17 with Quagsire holding TM02<br />Give Quagsire the newly generated TM09 in the TM Pocket<br /><br />[b]Using the memory editor[/b]<br /><br />Set Box 2-8&#039;s names:<br />[code]	p u&#039; t&#039; Ã© 3 2 u&#039; 6<br />	Ã© &#039;s 2 u&#039; 5 Ã© 1 2<br />	2 0 m&#039; m&#039; &#039;s 1 2 â™€<br />	Ã— Ã© â™€ 2 &#039;s 1 2 â™€<br />	Ã— Ã© / 2 &#039;s 1 2 Ã©<br />	A n&#039; G G G m&#039; u&#039; A<br />	u&#039; A n&#039;[/code]<br /><br />Box 1 is used to store the destination address + value to write.<br /><br />Don&#039;t write to $d8f6/$f8f6 (has the return opcode for box names)<br /><br />[b]Raw Source Code (to copy into BGB debugger)[/b]<br /><br />[code]	xor a<br />	sbc $dd<br />	ld [$f8f9], a<br />	sbc $fc<br />	ld d, b<br />	<br />	ld [$f8dc], a<br />	sbc $fb<br />	ld [$f8f7], a<br />	ld d, b<br />	<br />	ld hl, sp+$f6<br />	db $d8, $d8<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f5], a<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f4], a<br />	call c, $f8f7<br />	db $ea, $50, $80<br /><br />	reti<br />	db $86<br />	add [hl]<br />	db $86<br />	ret c<br />	sbc $80<br />	ld d, b<br /><br />	sbc $80<br />	reti<br />	ld d, b[/code]<br /><br />[b]Source code after self-modifying writes[/b]<br />[code]	xor a<br />	sbc $dd<br />	ld [$f8f9], a<br />	sbc $fc<br />	ld d, b<br />	<br />	ld [$f8dc], a<br />	sbc $fb<br />	ld [$f8f7], a<br />	ld d, b<br />	<br />	ld hl, sp+$f6<br />	ld h, $d8	<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f5], a<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f4], a<br />	call c, $f8f7<br />	db $ea, $50, $80<br /><br />	reti<br />	ld a, [hli]<br />	add [hl]<br />	inc hl<br />	ret c<br />	sbc $80<br />	ld d, b<br /><br />	sbc $80<br />	reti<br />	ld d, b[/code]<br /><br />I might try to optimize box names for the memory editor for other language versions.


subject: Re: Crystal: Unused party sanitisation function
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Interesting find. Mayhaps it was debug code for the PCC&#039;s Trade Corner since the attendant does inform the player that either [url=https://github.com/pret/pokecrystal/blob/700321a7fb2d6c852ffc91cc0b8867526cb76813/maps/GoldenrodPokeCenter1F.asm#L251-L268]they only have 1 PokÃ©mon in the party or that they are trying to send an Egg or abnormal PokÃ©mon[/url].


subject: Re: Crystal: Unused party sanitisation function
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Pretty sure it is debug code now.<br /><br />I searched for other places where the string validity check function is called.<br /><br />It&#039;s called in three places. One of those seems to be unused, and all incorporate parts of the checks detailed in the OP.<br /><br />The unused occurrence and first used occurrence are in Battle Tower code, [url=https://github.com/pret/pokecrystal/blob/217b7b8d9ba0d243ccbd9d4ae0a5b3ac7ab856e8/misc/battle_tower_5c.asm#L281-L508]sanitising Battle Tower PokÃ©mon after they are read[/url]. (The unused occurrence seems to have just been dummied out, as it is directly after the used code ends.)<br /><br />This code sanitises PokÃ©mon nicknames, replaces any OT name with bad characters with &quot;CHRIS&quot; (only one terminator this time), makes sure all nicknames and the OT name are terminated, and [url=https://github.com/pret/pokecrystal/blob/1de1bdbce73672dfa9cc3ddfce528dcb07ec253b/misc/mobile_5c.asm#L221-L261]sanitises invalid moves[/url] in the same way as detailed in the OP (except here, move [tt]$00[/tt] is never considered invalid).<br /><br />The unused half of this function replaces invalid PokÃ©mon species ([tt]$FD[/tt] being considered invalid) with Smeargle ([tt]$EB[/tt]). Instead of a simple greater-than-or-equal check, it checks for equality against each invalid species value in turn. PokÃ©mon levels are also checked, but the maximum level instead of being hardcoded is taken from SRAM at [tt]5:B2FB[/tt].<br /><br />The last occurrence is inside [url=https://github.com/pret/pokecrystal/blob/17448c51a51bb3ddd20b0349ae274980638b0980/misc/mobile_46.asm#L7445-L7580]mobile-related code.[/url] Every single string (nickname, OT, mail, mail author) is checked for invalid bytes and termination (where the terminator is [tt]$4E[/tt] for some reason) within the correct length, by bankswitched calls. If one of these checks fails, the offending string is replaced with a default string by a bankswitched call.<br /><br />Here&#039;s a list of default strings used:<br />OT name, mail author: &quot;ã‚¯ã‚Šã‚¹&quot; [i]Chris[/i] followed by two terminators<br />PokÃ©mon nickname: &quot;?????&quot; [b][i]unterminated[/i][/b](!!!)<br />Mail text: &quot;ã“ã‚“ã«ã¡ã¯&quot; [i]&quot;Konnichiwa&quot; Hello[/i] followed by one terminator<br /><br />The default strings are terminated by [tt]$50[/tt] as usual.<br /><br />After checking the strings, an &quot;item&quot; at [tt]$C60E[/tt] is checked, if it&#039;s [tt]$FF[/tt] it gets replaced by [tt]$00[/tt]. Finally, the exact same level checks as in the OP are performed.<br />


subject: Re: Crystal: Unused party sanitisation function
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=8103.msg207148#msg207148 date=1507084375]The unused occurrence and first used occurrence are in Battle Tower code, [url=https://github.com/pret/pokecrystal/blob/217b7b8d9ba0d243ccbd9d4ae0a5b3ac7ab856e8/misc/battle_tower_5c.asm#L281-L508]sanitising Battle Tower PokÃ©mon after they are read[/url]. (The unused occurrence seems to have just been dummied out, as it is directly after the used code ends.)<br /><br />This code sanitises PokÃ©mon nicknames, replaces any OT name with bad characters with &quot;CHRIS&quot; (only one terminator this time), makes sure all nicknames and the OT name are terminated, and [url=https://github.com/pret/pokecrystal/blob/1de1bdbce73672dfa9cc3ddfce528dcb07ec253b/misc/mobile_5c.asm#L221-L261]sanitises invalid moves[/url] in the same way as detailed in the OP (except here, move [tt]$00[/tt] is never considered invalid).<br /><br />The unused half of this function replaces invalid PokÃ©mon species ([tt]$FD[/tt] being considered invalid) with Smeargle ([tt]$EB[/tt]). Instead of a simple greater-than-or-equal check, it checks for equality against each invalid species value in turn. PokÃ©mon levels are also checked, but the maximum level instead of being hardcoded is taken from SRAM at [tt]5:B2FB[/tt].[/quote]<br /><br />Both of these checks are applied to Battle Tower opponents in the Japanese version. 5:B2FB is the chosen level of the Battle Tower challenge. Oddly, move sets are sanitized twice using slightly different criteria, the difference being that [tt]ValidateBTParty[/tt] checks if the first move slot is empty and fills it with Pound if it is, while [tt]CheckBTMonMovesForErrors[/tt], called from [tt]ReadBTTrainerParty[/tt], erases any moves following an invalid or empty second or third slot. The cumulative effect seems to be identical to the unused move check in bank 4.<br /><br />It seems Game Freak relied solely on this client-side validation at first; the [url=http://pokemon.s20.xrea.com/historia-single.html#2001]PokÃ©mon Battle Historia reports[/url] that PokÃ©mon with illegal move sets were found in level 100 Battle Rooms in February 2001, until some server-side checks were introduced in early March. But even in late 2002, [url=http://www2u.biglobe.ne.jp/~kakeru/pokemon2/nikki2/tower_09.htm]Kakeru complained[/url] of encountering Blastoise which knew both Counter and Mirror Coat (it can learn Mirror Coat as an Egg move, and Counter using the Generation I TM, but a PokÃ©mon with Mirror Coat canâ€™t be traded through the Time Capsule).<br /><br />[quote author=Wack0 link=topic=8103.msg207148#msg207148 date=1507084375]The last occurrence is inside [url=https://github.com/pret/pokecrystal/blob/17448c51a51bb3ddd20b0349ae274980638b0980/misc/mobile_46.asm#L7445-L7580]mobile-related code.[/url] Every single string (nickname, OT, mail, mail author) is checked for invalid bytes and termination (where the terminator is [tt]$4E[/tt] for some reason) within the correct length, by bankswitched calls. If one of these checks fails, the offending string is replaced with a default string by a bankswitched call.[/quote]<br /><br />I think this one is for PokÃ©mon received from the Trade Corner.


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8086.msg207140#msg207140 date=1507028967]<br />What do you mean by &quot;so it does&quot; ?<br />Also ACE cannot modify code. That had been brought up before, but it&#039;s all the NOPE.<br />[/quote]<br />It can if its in the ram.


subject: Re: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=luckytyphlosion link=topic=8097.msg207146#msg207146 date=1507078257]<br />[size=14pt][b]Memory Editor using French Box Names (does not require items in Item Pocket)[/b][/size]<br /><br />Special thanks to gifvex for contributing some ideas to the box names.<br /> <br />[b]Preparation for TM09[/b]<br /><br />Set Box 1&#039;s Name:<br />	A p u&#039; 9 Ã© G â™€ n&#039;<br />Use TM17 with Quagsire holding TM02<br />Give Quagsire the newly generated TM09 in the TM Pocket<br /><br />[b]Using the memory editor[/b]<br /><br />Set Box 2-8&#039;s names:<br />[code]	p u&#039; t&#039; Ã© 3 2 u&#039; 6<br />	Ã© &#039;s 2 u&#039; 5 Ã© 1 2<br />	2 0 m&#039; m&#039; &#039;s 1 2 â™€<br />	Ã— Ã© â™€ 2 &#039;s 1 2 â™€<br />	Ã— Ã© / 2 &#039;s 1 2 Ã©<br />	A n&#039; G G G m&#039; u&#039; A<br />	u&#039; A n&#039;[/code]<br /><br />Box 1 is used to store the destination address + value to write.<br /><br />Don&#039;t write to $d8f6/$f8f6 (has the return opcode for box names)<br /><br />[b]Raw Source Code (to copy into BGB debugger)[/b]<br /><br />[code]	xor a<br />	sbc $dd<br />	ld [$f8f9], a<br />	sbc $fc<br />	ld d, b<br />	<br />	ld [$f8dc], a<br />	sbc $fb<br />	ld [$f8f7], a<br />	ld d, b<br />	<br />	ld hl, sp+$f6<br />	db $d8, $d8<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f5], a<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f4], a<br />	call c, $f8f7<br />	db $ea, $50, $80<br /><br />	reti<br />	db $86<br />	add [hl]<br />	db $86<br />	ret c<br />	sbc $80<br />	ld d, b<br /><br />	sbc $80<br />	reti<br />	ld d, b[/code]<br /><br />[b]Source code after self-modifying writes[/b]<br />[code]	xor a<br />	sbc $dd<br />	ld [$f8f9], a<br />	sbc $fc<br />	ld d, b<br />	<br />	ld [$f8dc], a<br />	sbc $fb<br />	ld [$f8f7], a<br />	ld d, b<br />	<br />	ld hl, sp+$f6<br />	ld h, $d8	<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f5], a<br />	call c, $f8f7<br />	push af<br />	ld d, b<br />	<br />	pop af<br />	ld [$f8f4], a<br />	call c, $f8f7<br />	db $ea, $50, $80<br /><br />	reti<br />	ld a, [hli]<br />	add [hl]<br />	inc hl<br />	ret c<br />	sbc $80<br />	ld d, b<br /><br />	sbc $80<br />	reti<br />	ld d, b[/code]<br /><br />I might try to optimize box names for the memory editor for other language versions.<br />[/quote]<br /><br />will you do one for english versions to it would be easier then getting all those items and using tm25 a bunch of times to use fmks hex editor


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8086.msg207150#msg207150 date=1507096469]<br />[quote author=ISSOtm link=topic=8086.msg207140#msg207140 date=1507028967]<br />What do you mean by &quot;so it does&quot; ?<br />Also ACE cannot modify code. That had been brought up before, but it&#039;s all the NOPE.<br />[/quote]<br />It can if its in the ram. And your using crystal_ real time ace to have the code changed in the ram.<br />[/quote]


subject: Friend Ball glitch
poster_name: SnorlaxMonster
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Someone on Twitter pointed out to me a [url=https://github.com/pret/pokecrystal/blob/217b7b8d9ba0d243ccbd9d4ae0a5b3ac7ab856e8/items/item_effects.asm#L637]bug documented in the Crystal disassembly[/url] that I had not heard of before involving the Friend Ball.<br /><br />Apparently, when a PokÃ©mon is caught in a Friend Ball and sent to the PC, the game overwrites the friendship of the first PokÃ©mon in the box, rather than the friendship of the caught PokÃ©mon.<br /><br />Is this something that was known (outside of the disassembly)? It sounds like another one of the Apricorn Balls has a bug in Generation II.


subject: Re: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I would not say that, Parzival. VC emulation is lame indeed but it&#039;s not comparable to classical VBA as, at least, glitches based on the Echo RAM can be used in VC games (TM ACE). Actually, ACE is easier with VC since it doesn&#039;t read invalid opcodes.<br /><br />Anyway, even though there&#039;s no report of some trying too, there is no apparent reason why Bad Clone-related glitches would not work in VC games :)


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So err, I&#039;m not sure it hasn&#039;t been said before but both the &quot;Access PC items from the balls pocket&quot; glitch and the subsequent TM Code Execution work in VC games.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Theres an easier box name hex editor here but it uses the french version would you be able to make an easier one for the english version of the game based on this https://forums.glitchcity.info/index.php?topic=8097.15


subject: Re: Friend Ball glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This apparently doesn&#039;t work in french Crystal, as I was unable to notice a change in my first PokÃ©mon&#039;s happiness.


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8086.msg207150#msg207150 date=1507096469]<br />[quote author=ISSOtm link=topic=8086.msg207140#msg207140 date=1507028967]<br />What do you mean by &quot;so it does&quot; ?<br />Also ACE cannot modify code. That had been brought up before, but it&#039;s all the NOPE.<br />[/quote]<br />It can if its in the ram.<br />[/quote]<br />None of the game&#039;s code is in RAM, except for a small routine that does nothing but wait. So, still, nope.


subject: Re: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I would actually say that. The VC&#039;s emulation is indeed at the same level as VBA - even VBA does things the VC cannot be bothered to do.<br />Then, remember that the VC is just an emulator. Saying &quot;VC ignores invalid opcodes so it&#039;s easier for ACE&quot; doesn&#039;t make sense. Imagine Nintendo ported VBA to 3DS, added Echo RAM, and used that as the VC. It would still be a crappy emulator.<br />Point is, since it&#039;s an official Nintendo emulator, everybody seems to think the everything happening under the VC has an &quot;official behavior&quot; seal.<br />I very strongly disagree with this.


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8086.msg207159#msg207159 date=1507115825]<br />[quote author=forsyz link=topic=8086.msg207150#msg207150 date=1507096469]<br />[quote author=ISSOtm link=topic=8086.msg207140#msg207140 date=1507028967]<br />What do you mean by &quot;so it does&quot; ?<br />Also ACE cannot modify code. That had been brought up before, but it&#039;s all the NOPE.<br />[/quote]<br />It can if its in the ram.<br />[/quote]<br />None of the game&#039;s code is in RAM, except for a small routine that does nothing but wait. So, still, nope.<br />[/quote]<br />this isn&#039;t glitching but what happens if you try to trade a pokemon with mail if you hack the rom to do it and do a link trade in an emulator


subject: Re: Friend Ball glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The bug still is in the source of French PokÃ©mon Crystal, though ; the offending write is in the ROM at 3:6B39. (The SRAM addresses are all exactly the same)


subject: Re: Friend Ball glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Actually the glitch doesn&#039;t even work in english games.<br /><br />Yes, the first PokÃ©mon of the active box will receive hex:C8 as happiness, but that&#039;s normal since that PokÃ©mon will be the one you caught.


subject: Re: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=8104.msg207160#msg207160 date=1507116118]<br />Point is, since it&#039;s an official Nintendo emulator, everybody seems to think the everything happening under the VC has an &quot;official behavior&quot; seal.<br />I very strongly disagree with this.<br />[/quote]<br /><br />Exactly, any bugs specific to the Virtual Console are mostly a side effect of how Nintendo decided to program the emulator. Unless the behaviors are related to the patches they made such as the move animations affecting the battle HUD differently from the Game Boy releases, they&#039;re nothing more than unintentional outcomes.


subject: Re: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  My point wasn&#039;t exactly to say that VC is a better or worst emulator than VBA is, and when I say &quot;actually, ACE is easier with VC since it doesn&#039;t read invalid opcodes&quot;, this is not pointing an argument in favor of VC but rather a side remark regarding the fact that it is compatible with Echo RAM-based glitches. It makes exactly the sense that it makes: it is indeed easier to do ACE using VC, and still that is because VC is crappy.<br /><br />The sentence as Parzival said it tended to say that VBA and VC had the same issues, so I just pointed out that although both are lame, they don&#039;t have the same issues.&nbsp; That&#039;s it! I&#039;m not familiar with glitches that cannot be done in VC because of its issues (if there are none, VC would be, &quot;PokÃ©mon glitchwise speaking&quot;, a better shot) but I can testify that unlike with VBA, Echo RAM-based glitches works with VC.


subject: Re: Crystal: Unused party sanitisation function
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=8103.msg207148#msg207148 date=1507084375]<br />This code sanitises PokÃ©mon nicknames, replaces any OT name with bad characters with &quot;CHRIS&quot; (only one terminator this time), makes sure all nicknames and the OT name are terminated, and [url=https://github.com/pret/pokecrystal/blob/1de1bdbce73672dfa9cc3ddfce528dcb07ec253b/misc/mobile_5c.asm#L221-L261]sanitises invalid moves[/url] in the same way as detailed in the OP (except here, move [tt]$00[/tt] is never considered invalid).<br />[/quote]<br /><br />If it corresponds to &quot;CHRIS&quot; in English Crystal, then the localizers assumed the OT was male as the default name for both male and female players in Japanese Crystal is ã€Œã‚¯ãƒªã‚¹ã€, which in English Crystal is rendered as &quot;CHRIS&quot; for boys and &quot;KRIS&quot; for girls. The game assigns these to the player when they provide a blank string on the name input screen of the new game tutorial.<br /><br />[quote author=Wack0 link=topic=8103.msg207148#msg207148 date=1507084375]<br />Here&#039;s a list of default strings used:<br />OT name, mail author: &quot;ã‚¯ã‚Šã‚¹&quot; [i]Chris[/i] followed by two terminators<br />PokÃ©mon nickname: &quot;?????&quot; [b][i]unterminated[/i][/b](!!!)<br />Mail text: &quot;ã“ã‚“ã«ã¡ã¯&quot; [i]&quot;Konnichiwa&quot; Hello[/i] followed by one terminator<br />[/quote]<br /><br />Wait, does the game really spell out ã€Œã‚¯ã‚Šã‚¹ã€? That&#039;s an awkward combination of hiragana and katakana. And oops for not terminating that ã€Œï¼Ÿï¼Ÿï¼Ÿï¼Ÿï¼Ÿã€ :P 


subject: Re: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh, my reply was to show my agreement with ISSOtm in that specific point, but I agree with you too, Krys3000! :) 


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  On the topic of changing your ID but in the English version (I thought I would ask in here instead of create a new thread...) what&#039;s the earliest you can perform it with the coin case? I assume by the time you are at Goldenrod so you can have a Quagsire with Return? Because changing your ID with box names surely makes it faster then the older method which required specific items in the PC, some of which you couldn&#039;t get until later in the game.<br /><br />And a Quagsire can be required by Goldenrod by levelling up a wooper instead of waiting to get Surf and clearing the 4th gym to catch one.&nbsp; <br /><br />Please correct me if I&#039;m wrong, I&#039;m interested in changing my ID on English Gold for VC at the earliest opportunity possible in game.


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=asphere link=topic=8091.msg207010#msg207010 date=1506502493]<br />Hello, i decide to open a post for my request becouse in others topics there are too many request per person.<br />Well as the title say i need to know how i can change ID NUMBER in pokemo silver VC italian version. I think there are some people that know or can create a way for achive it. I pray this people to help me becouse i unfortunatelly don&#039;t know how glitchs here work. If someone work on this project for me i can support him, just contact me. Anyway i say Thanks in advance to this comunity which always tends to help people like me.<br />I&#039;ll Wait some news.<br />Cya and good game!<br />[/quote]<br /><br />Hi I&#039;ve yet to do this in the Italian version but will see if I can look into it for you.<br /><br />Let me know of the ID number you want, and I&#039;ll try and put together what to do.<br /><br />[quote author=Nostalgia link=topic=8091.msg207168#msg207168 date=1507130896]<br />On the topic of changing your ID but in the English version (I thought I would ask in here instead of create a new thread...) what&#039;s the earliest you can perform it with the coin case? I assume by the time you are at Goldenrod so you can have a Quagsire with Return? Because changing your ID with box names surely makes it faster then the older method which required specific items in the PC, some of which you couldn&#039;t get until later in the game.<br /><br />And a Quagsire can be required by Goldenrod by levelling up a wooper instead of waiting to get Surf and clearing the 4th gym to catch one.&nbsp; <br /><br />Please correct me if I&#039;m wrong, I&#039;m interested in changing my ID on English Gold for VC at the earliest opportunity possible in game.<br />[/quote]<br /><br />That&#039;s right. You&#039;ve also got to be able to get to Goldenrod because the Coin Case is in the underground.<br /><br />Technically if one of your PokÃ©mon doesn&#039;t have max happiness for the Return TM then you can use another TM (such as TM04, which can be found on Route 35 at the south when you get to the tall grass), but this would mean all the existing codes that use TM02 would have to be rewritten to begin at another box letter. (Notice the TM02 codes always begin with &quot;A&quot; because TM02 means the code starts at box name 1 character 2 and the first character of the first box name doesn&#039;t matter).<br /><br />For TM04 it means the code would start at box 1 character 4 instead (D8C2), and because many of the box names are programmed to modify other characters at a specific place in the boxes it may not be as simple as shifting the code two more spaces forward &quot;AAA(code)&quot;<br /><br />You can also use Wooper instead of Quagsire but its possible Wooper may not always make the jump to box names because instruction C2 (jp nz,$xxyy) will fail if the z flag is set, so it may be best to always use Quagsire. Additionally it must be night time for Wooper to appear (at Johto Route 32).<br /><br />Tell me which ID you need and I can try and make a code for TM04 if you don&#039;t have the max happiness if you like. :)


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Understood. I believe the Pokemon does not need max happiness to get the Return TM, just a raised good happiness, unless they have changed it. If I speedrun to Goldenrod with my starter it should have enough happiness for the TM I think. But I will go with the ID 56665. Thanks for the help Torchickens. :)


subject: Re: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Great stuff. Definitely much better than what I came up with! The setup for other language version isn&#039;t too bad although taking away the necessity to care about the bag items could be convenient.


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  You&#039;re welcome. :)<br /><br />Oh OK, that&#039;s good then. ^^ I just checked and it requires 150/255 happiness, so yep it may have enough by that point.<br /><br />Good luck!


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well I&#039;ve got to Goldenrod (yes that was quick..) and I&#039;ve got the Coin Case, Quagsire TM02 and TM04. Little under two hours playtime. Unfortunately I cannot get the Return TM as it&#039;s not the right day of the week, but good reason to try this TM04 method then! 


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Wait a moment, sorry.&nbsp; :( I made a mistake and you still need the Return TM as Return is the D8 in D8XX (box names). The only other move 1 here that would (at least reliably) work for box names is Future Sight (F8) because F8XX is effectively the same as D8XX, but Quagsire cannot learn Future Sight.<br /><br />The TM04 would be possible only both with Quagsire holding it and Return as the first move (requiring getting the Return TM).<br /><br />So it looks like waiting until Sunday is required (or possibly resetting the clock, see [url=http://www.filb.de/pwf/]here[/url]) for the Return TM, unless the TM is traded over (outside of getting it with another ACE but that&#039;s what we&#039;re trying to do with Coin Case in the first place).<br /><br />Congratulations on getting to Goldenrod, Quagsire and TM02, TM04 in under two hours though! :)


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well seeing as I will need Return and I have TM02 already, I will go with this method seeing as it seems more simple (from how you describe it) then the TM04 method.<br /><br />I just read that the clock reset trick for Gold and Silver apparently still works in VC, so I might try that tomorrow and reset the time to Sunday. If not, I&#039;ll just wait until Sunday. So many thanks if you can tell me what box names I will need to change my ID to 56665. :)<br /><br />Yeah it would of been quicker if Wooper wasn&#039;t such a hassle to train, with it&#039;s 15 base Speed it&#039;s cripplingly slow to the point all the AI Pokemon outspeed it - and with it&#039;s base 25 Special Attack it&#039;s Water Gun hurts very little haha. 


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Nostalgia link=topic=8091.msg207176#msg207176 date=1507149825]<br />Well seeing as I will need Return and I have TM02 already, I will go with this method seeing as it seems more simple (from how you describe it) then the TM04 method.<br /><br />I just read that the clock reset trick for Gold and Silver apparently still works in VC, so I might try that tomorrow and reset the time to Sunday. If not, I&#039;ll just wait until Sunday. So many thanks if you can tell me what box names I will need to change my ID to 56665. :)<br /><br />Yeah it would of been quicker if Wooper wasn&#039;t such a hassle to train, with it&#039;s 15 base Speed it&#039;s cripplingly slow to the point all the AI Pokemon outspeed it - and with it&#039;s base 25 Special Attack it&#039;s Water Gun hurts very little haha. <br />[/quote]<br /><br />OK good luck! :)<br /><br />Ouch, that sounds painful :/, lol. Glad you were able to train it without too many problems.<br /><br />I&#039;ve come up with a box name method that will give you 56665. Hope this works out for you.<br /><br />First use the one-off code by FMK:<br /><br />(REQUIRED) One-off code so all future codes don&#039;t need the &#039;return to game&#039; code:<br />Box 1 : Ap0w&#039;vA55 (XOR A; OR b6; SUB 0x80)<br />Box 2 : Ã©&#039;m2p&#039;v7&#039;v&#039;d (LD [d2f8], A; XOR A; SUB fd; SUB d0)<br />Box 3 : Ã©A355555 (LD [80f9], A)<br />Box 4+: 55555555 (Safe filler code)<br />Box 13: 5555pÃ©D9 (XOR A; LD [83ff], A)<br />Box 14: &#039;l&#039;lA&#039;lx&#039;d55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)<br /><br />Next use this code:<br /><br />Note: Multiplication x is the small x on the uppercase section.<br /><br />Box 1: Ap&#039;v&#039;dÃ©&#039;s25<br />Box 2: &#039;v9Ã©(multiplication x)2p0&#039;v<br />Box 3: &#039;v3Ã©A4p0?<br />Box 4: &#039;vN555555<br />Box 5: 55555555<br />Box 6: 5555Ã©A45<br />Box 7: &#039;v9Ã©A5555<br />Box 8+:55555555<br />Box 13: Unchanged from before after using one-off code<br />Box 14: Unchanged from before after using one-off code


subject: Re: Crystal: Unused party sanitisation function
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=8103.msg207166#msg207166 date=1507128615]Wait, does the game really spell out ã€Œã‚¯ã‚Šã‚¹ã€? That&#039;s an awkward combination of hiragana and katakana. And oops for not terminating that ã€Œï¼Ÿï¼Ÿï¼Ÿï¼Ÿï¼Ÿã€ :P[/quote]<br /><br />The Generation I and II games use the same character ($D8) for ãƒª and ã‚Š (likewise with $CD for ãƒ˜ and ã¸); the disassemblies treat it as the hiragana by default.


subject: Re: Friend Ball glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes !<br /><br /><br /><br /><br /><br /><br />...<br />If you had no PokÃ©mon in your current box prior to catching the PokÃ©mon !


subject: Re: Is possible to perform Celebi glitch in Italian VC on PokÃ©mon Silver?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh, yeah sure &#039;bout VC and VBA not being exactly the same. I hate them both with burning passion, though :D<br />Also VC works right enough that it doesn&#039;t break any glitches afaik (the worst that could happen, I think, was if a glitch ran code from SRAM). As far as the other side is concerned, SatoMew pretty much nailed the point : they are emulation errors.


subject: Re: Crystal: Unused party sanitisation function
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=8103.msg207178#msg207178 date=1507154655]<br />The Generation I and II games use the same character ($D8) for ãƒª and ã‚Š (likewise with $CD for ãƒ˜ and ã¸); the disassemblies treat it as the hiragana by default.<br />[/quote]<br /><br />Oh, right. Thanks, HÃ¡Äky! ^^


subject: Re: Friend Ball glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No, the PokÃ©mon always gets on top and receive the happiness boost. There doesn&#039;t seem to be any glitch here, or I don&#039;t get what we&#039;re talking about&nbsp; :P


subject: Re: Friend Ball glitch
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In Generation II, the PokÃ©mon Storage System always puts new PokÃ©mon at the top (slot 1) and moves the PokÃ©mon already on that slot to slot 2 and so forth (maximum of 30 slots per Box in Japanese versions, 20 in Western and Korean versions).<br /><br />Video: [url=https://tknk.io/7QML]https://tknk.io/7QML[/url]<br /><br />As to friendship, I&#039;m not seeing any bug either (I used the latest PKHeX to check my Japanese Crystal save file). A PokÃ©mon caught with a Friend Ball will have a friendship value of 200 after being sent to the Box and the PokÃ©mon previously in slot 1 will keep its current friendship value when moved to slot 2.


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=8091.msg207174#msg207174 date=1507141850]<br />Well I&#039;ve got to Goldenrod (yes that was quick..) and I&#039;ve got the Coin Case, Quagsire TM02 and TM04. Little under two hours playtime. Unfortunately I cannot get the Return TM as it&#039;s not the right day of the week, but good reason to try this TM04 method then!<br />[/quote] you can change the time in gold and sliver and use that to get a bunch of hair cuts


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  So I did both steps (took awhile to get a working slide Pokemon) and it changed the ID of the first Pokemon in my party to 56665, but the rest of the Pokemon still have the old ID and the trainer ID did not update. <br /><br />I&#039;m guessing because the code is the same as the one in your Mew video to change the one Mew to get the 22796 trainer ID, but I&#039;m looking to permantely change the ID of the player character. <br /><br />Edit: swapping any Pokemon to the first Pokemon in the party and using the coin case changes that Pokemon&#039;s ID to 56665, but the player&#039;s trainer ID remains unchanged meaning the Pokemon won&#039;t obey.


subject: Re: Friend Ball glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks SatoMew! Do you have any idea why do japanese can store 10 more PokÃ©mon per box?<br /><br />Anyway, maybe someone can correct the disassembly then. Someone probably was under the impression that a caught PokÃ©mon goes in the last slot and thought this function was glitched.


subject: Re: We should reproduce this on real game cartridges
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  So this is just if someone wish to perform TM-based ACE in G/S without requiring another game to link with.<br /><br />In G/S, we use TM25 instead of TM33. It has the advantage to execute code from YOUR party and not the enemy&#039;s party (which made mandatory to have another game). We already knew that Machine Part and SecretPotions that were mandatory for the expanded balls pocket could be obtained through the Bad Clone Glitch, but because you would need a PokÃ©mon with exactly 195 (modulo 256) Def EV and 6102 Speed EV, most people continued using a 1G game in order to use 8F/4F/wslm to modify a PokÃ©mon this way and send it to 2G.<br /><br />Someone had to make the calculations, so here it is. Pick an untrained PokÃ©mon and make it win against 16 Raticate, 60 Tentacool, 1 Nidorina, 2 Rattata and 2 Smeargle. Theoretically you would now have the correct EVs and thus, you wouldn&#039;t require any trade with a 1G game.


subject: Re: Friend Ball glitch
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8105.msg207187#msg207187 date=1507195927]<br />Thanks SatoMew! Do you have any idea why do japanese can store 10 more PokÃ©mon per box?<br />[/quote]<br /><br />I don&#039;t know why it was changed but, in Generations I and II:[list]<br />	[li]Japanese versions have 30 slots per Box (8 Boxes in RGBY, 9 in GSC)[/li]<br />	[li]Western versions have 20 slots per Box (12 Boxes in RBY, 14 in GSC)[/li]<br />	[li]the PokÃ©mon Storage System in both Japanese and Western Generation I can store up to 240 PokÃ©mon[/li]<br />	[li]the Western Generation II system is able to store 10 more PokÃ©mon than the Japanese system (280 vs. 270)[/li]<br />	[li]Korean Gold and Silver are forks of the English versions and did not change the amount of Boxes and distribution of slots per Box[/li]<br />[/list]Generation III was the first to not have these differences between regional releases.


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Nostalgia link=topic=8091.msg207185#msg207185 date=1507193420]<br />So I did both steps (took awhile to get a working slide Pokemon) and it changed the ID of the first Pokemon in my party to 56665, but the rest of the Pokemon still have the old ID and the trainer ID did not update. <br /><br />I&#039;m guessing because the code is the same as the one in your Mew video to change the one Mew to get the 22796 trainer ID, but I&#039;m looking to permantely change the ID of the player character. <br /><br />Edit: swapping any Pokemon to the first Pokemon in the party and using the coin case changes that Pokemon&#039;s ID to 56665, but the player&#039;s trainer ID remains unchanged meaning the Pokemon won&#039;t obey.<br />[/quote]<br /><br />I see. That&#039;s right, that code was a modified version of the GF Mew Trainer ID code.<br /><br />These codes will change your Trainer ID (modification of addresses d1a1, d1a2) to 56665. To confirm this you can check the Trainer card.<br /><br />Box 1: Ap0bÃ©&#039;s25<br />Box 2: &#039;v9Ã©(multiplication x)2p0&#039;v<br />Box 3: &#039;v3Ã©A(multiplication x)p0?<br />Box 4: &#039;vN555555<br />Box 5: 55555555<br />Box 6: 5555Ã©A(multiplication x)5<br />Box 7+:55555555<br />Box 13: Unchanged from before after using one-off code<br />Box 14: Unchanged from before after using one-off code<br /><br />Please note this will not change the ID of existing PokÃ©mon. For that you&#039;ll have to use the other code that changes the ID of PokÃ©mon 1.<br /><br />Sorry about that, I thought you meant the ID of just PokÃ©mon.<br /><br />Hope this helps. :)


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Many thanks Torchickens it worked. :) Now any Pokemon I catch has that ID. I&#039;ll be keeping that slide Pokemon to use for future Coin Case glitches. It took over 10 attempts to get a working slide Pokemon, every other time it failed and I got sent in the glitch dimension lol.


subject: Re: CHANGE ID NUMBER IN POKEMON SILVER VC ITALIAN VERSION
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Nostalgia link=topic=8091.msg207191#msg207191 date=1507216758]<br />Many thanks Torchickens it worked. :) Now any Pokemon I catch has that ID. I&#039;ll be keeping that slide Pokemon to use for future Coin Case glitches. It took over 10 attempts to get a working slide Pokemon, every other time it failed and I got sent in the glitch dimension lol.<br />[/quote]<br /><br />You&#039;re very welcome! :) Glad it worked.<br /><br />Make sure not to walk around with the slide PokÃ©mon too much and store it in the PC when you&#039;re not using it because if it gains a bad happiness value (in addition to stat experience from training it) it can cause the glitch to no longer work. It&#039;s also safe to give it the nickname &quot;SLIDE&quot; so you don&#039;t forgot what it is.


subject: ACE g/s virtual console command help
poster_name: TheNuclearGamerr
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ok first off let me say I â¤ï¸ this site. Such a vast depository of helpful info. Now my question as stated has to do with ACE command examination. More specifically I have been able to use pc items and a quagsire with protein and return as his first move to make a memory editor. A common thing I think among ACE users. Now I know changing box 9&#039;s name to !/ points to the first pokemon in my party. I would like to know is there any way to alter its moves to make them something else. For example chancey is my lead pokemon, and I&#039;d like to change its 1st move to present. Is there a way to do this using the setup I have?&nbsp; <br /><br />TL;DR what&#039;s the box 9 name code to alter the first move slot of the first pokemon in my party. 


subject: Fully unlocked map/content starting from a brand new savefile
poster_name: RashFaustinho
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: RashFaustinho
icon: xx
body:
  For Pokemon Red and Blue (US Version)<br /><br />Hi!<br />Pokemon Glitches are wonderful, and it&#039;s really interesting to see them.<br />However, there is a major problem, or at least i have one: A lot of the glitches require you to actually play the game, or at least beat the majority of it.<br />Now, I know this sounds foregone, but this is actually a big deal for whoever starts a new game from scratch, and doesn&#039;t want to waste time with a game he has already beaten thousands of times.<br /><br />Let&#039;s think to the most famous glitch: Missingno. Before encountering him, you have to reach Cinnabar Island. That place is actually really close to end-game.<br /><br />Now I know that today&#039;s emulators can import savegames, and you can witness a lot of the glitches pretty quickly, and that&#039;s what i&#039;ve done in the past. But I was wondering... Considering the stunning amount of glitches and ACE exploits this game has, isn&#039;t there a way to glitch your way throught it, and get access to most of the content without actually playing it?<br /><br />We witnessed people reaching the Hall of Fame just right from the start of the game,. That&#039;s impressive, but this doesn&#039;t give you a proper Pokemon party, doesn&#039;t unlock all cities and ends with an overflowed item inventory, so really the whole thing is just for looking at the credits, but it&#039;s far from being in a playable state.<br /><br />So, here there are my questions:<br />Starting from a brand-new savefile, what are the quickest ways to:<br /><br />[b]1) The first and most important: Get a Pokemon with Fly (or an item that allows you to do that) and get access to all cities on the fly board (without visiting them first)[/b]<br />Is that even possible? Basically, what i&#039;m asking is the quickest way to unlock the whole map and being able to free-roam it.<br /><br />[b]2) Getting an item or any other glitch that allows one to skip trainer battles.[/b]<br />We&#039;re in a brand new savefile, that means, the map is crowded with people that wants to fight you. That&#039;s a huge problem, and you&#039;re likely to be interrupted pretty often because of long-rage trainers.<br />Brock Through Walls sounds nice but can&#039;t be carried forever, or inside places like gyms for example.<br /><br />[b]3) Getting 8F and the required party for bootstrap code[/b]<br />8F can really come in handy as cheating tool to do... well... pretty much everything. It gives you access to all of the items and you can get all the Pokemons in short time.<br /><br />With these 3 steps satisfied, I think that most of the game&#039;s content can be accessed.<br /><br />Do you think is it possible to do all that in a short amount of time?<br /><br />Save corruption glitches are allowed, but after abusing them, there has to be a way to revert the side-effects of the corruption (like the massive pokemon party) otherwise the game will be unplayable.


subject: Re: Fully unlocked map/content starting from a brand new savefile
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  [quote author=RashFaustinho link=topic=8108.msg207194#msg207194 date=1507298158]<br /><br /><br />Let&#039;s think to the most famous glitch: Missingno. Before encountering him, you have to reach Cinnabar Island. That place is actually really close to end-game.<br />[/quote]<br /><br />You can encounter Missingno much earlier then Cinnabar. Also reaching Cinnabar is not &#039;&#039;really close to end-game&#039;&#039;, all you need to get to Cinnabar is Surf. So you can either speedrun through the game until you get to Fuchsia city and get surf from the Safari Zone and beat Koga, or you can do the brock through walls glitch and get to the Safari Zone straight away and beat Koga and Surf to Cinnabar. 


subject: Re: Fully unlocked map/content starting from a brand new savefile
poster_name: RashFaustinho
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: RashFaustinho
icon: xx
body:
  [quote author=Nostalgia link=topic=8108.msg207195#msg207195 date=1507298806]<br />[quote author=RashFaustinho link=topic=8108.msg207194#msg207194 date=1507298158]<br /><br /><br />Let&#039;s think to the most famous glitch: Missingno. Before encountering him, you have to reach Cinnabar Island. That place is actually really close to end-game.<br />[/quote]<br /><br />You can encounter Missingno much earlier then Cinnabar. Also reaching Cinnabar is not &#039;&#039;really close to end-game&#039;&#039;, all you need to get to Cinnabar is Surf. So you can either speedrun through the game until you get to Fuchsia city and get surf from the Safari Zone and beat Koga, or you can do the brock through walls glitch and get to the Safari Zone straight away and beat Koga and Surf to Cinnabar.<br />[/quote]<br /><br />Missingno was more an example. The point is being able to access to most of the game&#039;s pokemons &amp; maps in a short amount of time. I was wondering if it&#039;s even possible.<br /><br />Also, while the Brock Through Walls is a reasonable way to get to Cinnabar Island quickly, beating 4 gym trainers and getting to Koga just for surf is not. Wasn&#039;t there a glitch item that acted like a surf-board? Wouldn&#039;t it be better to get that one?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I haven&#039;t seen this documented elsewhere, so I&#039;m just gonna leave this here...<br /><br />Button Values:<br />[code]Buttons:<br />a == $01<br />b == $02<br />up == $40<br />left == $20<br />Right == $10<br />down == $80<br />SELECT == $04<br />START == $08[/code]<br /><br />The joypad subroutine is at $3FFA. Call it to add joypad functionality to your code.


subject: Re: Friend Ball glitch
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Japanese nicknames (both trainer and Pokemon) are much shorter, so they&#039;re able to put more Pokemon into a box.<br /><br />Gen 3 has enough RAM space to store all storage boxes anyway so box sizes can stay the same for all versions.


subject: Obtaining TM17 ACE in EU versions of G/S
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  gifvex and I have made a setup to get a TM17 in the Balls Pocket with minimal requirements. There might be some unclear steps in the guide (which is why it is still a preliminary), but it describes everything required from start to finish. It would be greatly appreciated if people could try the guide out for themselves and point out any uncertainties or confusing parts of the guide.<br /><br />[b]The guide: [url=https://pastebin.com/cYE5zcPt]Link[/url].[/b]


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: Zowayix001
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Zowayix001
icon: xx
body:
  [quote author=ISSOtm link=topic=8086.msg207159#msg207159 date=1507115825]<br />[quote author=forsyz link=topic=8086.msg207150#msg207150 date=1507096469]<br />[quote author=ISSOtm link=topic=8086.msg207140#msg207140 date=1507028967]<br />What do you mean by &quot;so it does&quot; ?<br />Also ACE cannot modify code. That had been brought up before, but it&#039;s all the NOPE.<br />[/quote]<br />It can if its in the ram.<br />[/quote]<br />None of the game&#039;s code is in RAM, except for a small routine that does nothing but wait. So, still, nope.<br />[/quote]<br />You can&#039;t modify the code directly in-place, but you can write a copy of the code that&#039;s exactly identical to the Time Capsule guard code except with the Mail check left out, run that, and then jump to wherever the code flow normally goes after passing the guard. Something like this:<br /><br />Normal:<br />- Program counter points to location #1.<br />- Talk to Time Capsule attendant, game runs guard code.<br />- After the guard passes, program counter is pointing to location #2.<br />- The player is allowed inside the Time Capsule.<br /><br />ACE:<br />- Program counter points to location #1.<br />- Use Coin Case, running code that&#039;s identical to talking to the Time Capsule attendant and the guard code, except with the Mail check missing.<br />- Manually jump to location #2.<br />- The player is allowed inside the Time Capsule.


subject: Re: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: Zowayix001
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What&#039;s preventing this from working in Japanese GSC? Does the bad clone glitch/cloning glitch not work there or something?


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Thanks for the guide, it&#039;s really interesting! I made a method of my own (although for TM25) recently which involved a PokÃ©mon with Clamp and another with Low Kick, ending up in getting 4 items compatible with getting the expanded balls pocket (2 Machine Part and 2 SecretPotions) but that&#039;s an cool alternative that doesn&#039;t use it. Good job with this one!<br /><br />I&#039;m not familiar with TM17, where does it executes from? We usually reroot TM25 into PC items (using a trained PokÃ©mon in party slot 2 as I&#039;ve setup in another thread), so using the expanded balls pocket make sense then because it allows a quick item cloning.<br /><br />PS: I also feel like it should be noted that there is a way to convert pseudo-Bad Clones (those who can be male and lvl &gt; 0) into real Bad Clones using the traditional Bad Clone Trick (that relies on unterminated name corruption).


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  TM17 executes from $FA47, which is equivalent to an unused portion of memory of Party Mon 1 in party struct. The only bytes before the 2nd PokÃ©mon are the Level, Status, HP, Max HP, Attack, Defense, Speed, Special Attack and Special Defense. By catching a low-leveled PokÃ©mon, we can ensure the PC will never change state as opposed to using TM25 which runs through DVs (and thus has a higher chance of not executing the code correctly).<br /><br />Crystal_ was the one to originally switch to TM17, and I followed suite after reading his ACE method.<br /><br />Also, unterminated name exploits do not work in Gold/Silver as upon reading a $00 character, the game immediately stops printing text. This was changed in Crystal which is why it works in that game.


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Thanks about unterminated names, I wasn&#039;t sure about this.<br /><br />However, you don&#039;t need to run through DVs with TM25 because as far as I know, it starts reading EVs of PokÃ©mon 2. Theoretically, battling 16 Raticate, 60 Tentacool, 1 Nidorina, 2 Rattata and 2 Smeargle gives the PokÃ©mon the correct EV, so it jumps directly to PC items.<br /><br />So if I understand correctly your method, the reading would slide to PokÃ©mon 2 provided that lvl and stat values are not breaking it? And then what are the addresses that you would use to jump to somewhere else and where to? I don&#039;t have fully in mind what Crystal_ ended with while working on stack corruption.<br /><br />I&#039;m not trying to annoy you lucky, sorry. Your method is truely cool! I&#039;m just, for personal use in my current game, weighing pros and cons regarding the benefits of not getting the expanded balls pocket that would be beneficial if your ace ends up in PC items anyway, and keeping in mind that with the &#039;getting a bad clone part&#039; you have done the most difficult part of having that expanded pocket :)


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8109.msg207204#msg207204 date=1507409469]<br />So if I understand correctly your method, the reading would slide to PokÃ©mon 2 provided that lvl and stat values are not breaking it? And then what are the addresses that you would use to jump to somewhere else and where to? I don&#039;t have fully in mind what Crystal_ ended with while working on stack corruption.<br />[/quote]<br /><br />You&#039;d use the Quagisre holding TM02 and Return as the first move, as usual.<br /><br />[quote author=Krys3000 link=topic=8109.msg207204#msg207204 date=1507409469]<br />I&#039;m not trying to annoy you lucky, sorry. Your method is truely cool!<br />[/quote]<br /><br />gifvex was the one that did most of the work for this version of the setup. My original idea was to do a different method to obtain 2 Itemfinders, underflow the Key Items Pocket and create a TM17 in the Player PC&#039;s item using quantity deposits. Then, use that TM17 to create a TM17 in the Items Pocket, and patch the Key Items pocket. gifvex did a lot of the work finding less destructive setups, and obtaining two Key Items with any possible TID/DV combination using Move Pkmn W/O mail swaps (which exhibit odd behaviour with a party greater than 7).<br /><br />[quote author=Krys3000 link=topic=8109.msg207204#msg207204 date=1507409469]<br />I&#039;m just, for personal use in my current game, weighing pros and cons regarding the benefits of not getting the expanded balls pocket...<br />[/quote]<br /><br />The method uses item/quantity shifts in order to convert the value of the Cancel button into a quantity, modifying the quantity to equal the ID of TM17, then doing another shift to convert the quantity into an item. The setup does not actually underflow either the Key Items pocket or the Balls pocket, so it should be perfectly safe to use (again, credits to gifvex for finding this setup).


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Yeah well, since I don&#039;t play english games at all I&#039;m not familiar with that Quagsire stuff that was used mainly with Coin Case so far and always forget about it. I get now that the idea would be to jump to box names then, and not use PC Items. In this case indeed underflowing the Balls pocket is not a necessity and avoiding it is cool :)<br /><br />Still, wouldn&#039;t it be an improvement if we could come up with another set of PokÃ©mon to face for your second PokÃ©mon, in order&nbsp; that TM25 jumps directly to box names? I understand having a low-level PokÃ©mon makes TM17 reliable in most cases but it is still assuming that everything goes right, where TM25 used with the correct EVs is a direct jump. Unless we can configure the couple &quot;Max HP + Attack stat&quot; of PokÃ©mon 1 for a jump when TM17 is used. In that case, it would be easy for this PokÃ©mon to have a &#039;good&#039; level, no status and no current HP.<br />


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You could use the current TM17 setup to hack in the necessary opcodes into stat exp to jump directly to box codes, then use TM25. If you wanted to use TM17 but only with one PokÃ©mon, you could change $DA47 and $DA48 to a negative jr into stat exp, then at stat exp have the jump to box names.


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hmm, I see, thanks. I may try to figure out a couple of PokÃ©mon (or a single PokÃ©mon) to ensure that using TM17 ends up in a guaranteed good jump to box names these next days. As well as attempt to reroot TM25 to box names instead of PC items, so both TMs would be equivalent.<br /><br />I&#039;m guessing there&#039;s a way to get TM25 the way you generated TM17?


subject: Re: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: Crystal_
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I just haven&#039;t looked into making it compatible with the japanese version, but as far as I know, most memory addresses and some aspects of the engine are different, so this method would probably require a complete rework.


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  So, I&#039;ve been digging a bit more today. I didn&#039;t do the full method, but tested the trick to get TMs in Balls Pocket, and it works very well! Once again, Kudos for that because it&#039;s a real improvement from the standard method, if we use box names.<br /><br />If you use this to get TM25 and have your second PokÃ©mon beat the following PokÃ©mon:<br />3 WOBBUFFET + 15 DIGLETT + 1 SENTRET + 1 PINECO + 3 VENOMOTH + 2 PONYTA<br />Then using TM25 executes from Box name 9. I picked 9 because it&#039;s the box that requires the less PokÃ©mon to fight, but another box can be used if you&#039;re willing to train more.<br /><br />I have to say I&#039;m a bit less hyped about TM17. $FA47 and $FA48 are indeed not a problem, but then, I couldn&#039;t find any way to use the first PokÃ©mon to jump to box names directly, or relative jump to the standard Quagsire in slot 2. Level cannot be used because of status, status cannot be used because it&#039;s too complicated, HP cannot be used because if would required too much max HP, max HP and stat values cannot be used because of their first byte being hard to control. Therefore the only way to use this TM is indeed catch a low-level PokÃ©mon and pray for it slides to PokÃ©mon 2 without messing anything.<br /><br />It&#039;s everyone choice to make, but to be honest I&#039;m not a huge fan of setups in which &#039;everything will go right except something goes wrong&#039;. In my opinion, the use of the &quot;gifvex-luckytyphlosion method&quot;, but with TM25 (and a trained PokÃ©mon), is currently the best method to perform ACE in european G/S.


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  On a side note, if you&#039;re not in a hurry to do this trick early in the game, you can use instead of Bellsprout a setup based on a PokÃ©mon with Seismic Toss (Machop for example, the move must be in slot 1) which would be really easier to perform.<br /><br />Just put the glitch PokÃ©mon 000 in front of 5 other useless PokÃ©mon (or clones) in your team, move the PokÃ©mon with Seismic Toss at first slot, give the glitch PokÃ©mon to the Daycare lady and store/withdraw the PokÃ©mon with Seismic Toss which now has Mystery Egg attached. Then clone this PokÃ©mon and take both eggs.


subject: Re: ACE in G/S via stack corruption (compatible with all european versions and VC)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix001 link=topic=8097.msg207201#msg207201 date=1507406232]<br />What&#039;s preventing this from working in Japanese GSC? Does the bad clone glitch/cloning glitch not work there or something?<br />[/quote]<br /><br />The addresses are different. Some can be deducted by extrapolating the difference between addresses (this is how I figured the way to do [url=https://forums.glitchcity.info/index.php?topic=7051.0]this[/url] in the Japanese versions, for example, by guessing that the Japanese address was the English address minus [tt]0xD[/tt] or close because the difference between English addresses [tt]0xCEA3-0xCEA6[/tt], which are manipulated to trigger the &quot;walk through walls&quot; behavior, and the Japanese addresses is exactly [tt]0xC[/tt], so why not?) but others are in completely distinct locations and thus require a deeper understanding of how the code is structured on the Japanese ROMs.


subject: Need help with padding an 8F script
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So last week I made an item script that could grant you any Pokemon you desire by the amount of times you pressed right.<br /><br />For example, if you wanted Mew, you would press:<br />RIGHT x21<br />SELECT - exit<br /><br />Here&#039;s The code, commented to the best of my ability:<br />[code]<br />dec a ;-padding-<br />ld c,d ; c = $00<br />start:<br /> call $3ffa ; calls joypad subroutine<br /> ldh a,($b2) ; Grab most recently released button<br /> cp $10 ; If that button is right...<br /> jr z,righthandler ; ...then go to righthandler<br /> cp $20 ; If that button is left...<br /> jr z,lefthandler ;...then go to lefthandler<br /> ldh a,($f8) ; Get current held button<br /> cp $04 ; If that button is select...<br /> jr z,end ; Go to the end<br /> jr start ; Keep listening for inputs<br />righthandler:<br /> inc c ; Every time right is pressed, increment c<br /> jr start ; Keep listening for inputs<br />lefthandler:<br /> dec c ; Every time left is pressed, decrement c<br /> jr start ; Keep listening for inputs<br />end:<br /> ld b,c ; B = C, B is used as the Species Index<br /> ld c,$32 ;c + $32(50) , C is used as level.<br /> call $3e48 ; Calls pokemon recieve subroutine<br /> ret ; &quot;It&#039;&#039;s first grade, Spongebob!&quot;<br />[/code]<br /><br />The code works perfectly fine as written, the only problem is I&#039;ve been attempting to add padding (useless filler to prevent glitch items) to the code, but I can&#039;t seem to figure out how I would go about padding this script. Every time I add padding to fix one problem, another arises, and it&#039;s frustrating because I want to finish this soon.<br /><br />Any and all help is appreciated. 


subject: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Quirky Flower Chicken â¤âœ¿
icon: xx
body:
  [color=purple]I created these for the Quagsire holding a TM02 with Return as first move setup for arbitrary code execution in English Gold/Silver. :) Let me know if you have any difficulties with them and I&#039;ll try to help.<br /><br />[u][b]Change PokÃ©mon 1 codes:[/b][/u]<br /><br />PokÃ©rus:<br /><br />Ap0&#039;d&#039;vK55<br />Ã©&#039;m2p0955<br />Ã©A455555<br />55555555<br />5555555p<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Shiny:<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp045<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Max DVs:<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0955<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Dark max Hidden Power:<br />Atk Def 15 15<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp095<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Dragon max Hidden Power:<br />Atk Def 15 14<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp085<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Ice max Hidden Power:<br />Atk Def 15 13<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp075<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Psychic max Hidden Power:<br />Atk Def 15 12<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp065<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Electric max Hidden Power:<br />Atk Def 14 15<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp0(male)5<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Grass max Hidden Power:<br />Atk Def 14 14<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0Ã©&#039;v6<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Water max Hidden Power:<br />Atk Def 14 13<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0Ã©&#039;v7<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Fire max Hidden Power:<br />Atk Def 14 12<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0Ã©&#039;v8<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Steel max Hidden Power:<br />Atk Def 13 15<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0&#039;v&#039;v1<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br /><br />Ghost max Hidden Power:<br />Atk Def 13 14<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0&#039;v&#039;v2<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br /><br />Bug max Hidden Power:<br />Atk Def 13 13<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0&#039;v&#039;v3<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Rock max Hidden Power:<br />Atk Def 13 12<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0&#039;v&#039;v4<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Ground max Hidden Power:<br />Atk Def 12 15<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0z&#039;vÃ©<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Poison max Hidden Power:<br />Atk Def 12 14<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0u&#039;v?<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br /><br />Flying max Hidden Power:<br />Atk Def 12 13<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0u&#039;v!<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Fighting max Hidden Power:<br />Atk Def 12 12<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0u&#039;v.<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />[u][b]Change PokÃ©mon 5 codes:[/b][/u]<br /><br />First use:<br /><br />[REQUIRED code by FMK] One-off code so all future codes don&#039;t need the &#039;return to game&#039; code:<br />Box 1 : Ap0w&#039;vA55&nbsp; &nbsp; (XOR A; OR b6; SUB 0x80)<br />Box 2 : Ã©&#039;m2p&#039;v7&#039;v&#039;d (LD [d2f8], A; XOR A; SUB fd; SUB d0)<br />Box 3 : Ã©A355555&nbsp; &nbsp;  (LD [80f9], A)<br />Box 4+: 55555555&nbsp; &nbsp;  (Safe filler code)<br />Box 13: 5555pÃ©D9&nbsp; &nbsp;  (XOR A; LD [83ff], A)<br />Box 14: &#039;l&#039;lA&#039;lx&#039;d55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)<br /><br />Next you can use:<br /><br />Max out stat experience, give experience for Level 100 after battle:<br /><br />The old code had an error.<br /><br />I made a new code that will modify PokÃ©mon 5&#039;s experience.<br /><br /><br />Box 1: Ap0x&#039;v955&nbsp; (multiply small x from the uppercase field only)<br />Box 2: e&#039;m2p0955<br />Box 3: Ã©A455555<br />Box 4-Box 12 (or possibly just box up to all of box 6 in your case): 55555555<br /><br />Spamviech has also offered an alternative solution.<br /><br />[quote author=spamviech link=topic=8111.msg207578#msg207578 date=1509669700]<br />Just tried this code (well, a variant for usage with wrong pocket TM execution) and the experience is not granted.<br />Reason is probably that the [b].[/b] character is not 0xf2, but instead 0xe8 (different dot character, only looks the same). Therefore, instead of maximizing Exp gained we are corrupting the SpDef stat of PokÃ©mon 4 (harmless; can be fixed by depositing and re-withdrawing).<br /><br />Adjusted version that should work; TM variant:<br />[code]<br />Box 1: Ap0(mult)&#039;v955<br />Box 2: Ã©3209Ã©14<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©7455<br />Box 6: Ã©84Ã©0455<br />Box 7: Ã©â™€4Ã©Ã©4x&#039;d<br />[/code]<br />Coin Case Variant (untested):<br />[code]<br />Box 1: Ap0(mult)&#039;v955<br />Box 2: Ã©3209Ã©14<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©74&#039;l&#039;l<br />Box 6: Ã©84Ã©04&#039;l&#039;l<br />Box 7: Ã©â™€4Ã©Ã©455<br />Box 8: pÃ©Z(mult)x&#039;d<br />[/code]<br />[/quote]<br />[color=purple]<br />[u][b]All TMs/HMs:[/b][/u]<br /><br />Requires above one-off code:<br /><br />Box 1: Ap&#039;vCÃ©225<br />Box 2: &#039;vj&#039;vuÃ©125<br />Box 3: &#039;v.Ã©52p&#039;v9<br />Box 4: Ã©42pÃ©625<br />Box 5: &#039;vuÃ©82&#039;v 5 (there is a space after the &#039;v and before the 5)<br />Box 6: Ã©72&#039;v:Ã©92<br />Box 7: 09â™€5â™€555<br />Box 8-12: 55555555<br />Box 13, 14: Same as before, don&#039;t change them.<br /><br />February 6, 2019: Updated all TMs/HMs code to give quantities of 255. âœ¿ [/color]


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey Torchickens, nice codes!<br /><br />I was wondering: technically, if we use TM25/17 to execute code from box names in european games, these codes would work exactly the same way, right?


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Krys3000 link=topic=8111.msg207216#msg207216 date=1507482386]<br />Hey Torchickens, nice codes!<br /><br />I was wondering: technically, if we use TM25/17 to execute code from box names in european games, these codes would work exactly the same way, right?<br />[/quote]<br /><br />Thanks Krys! :)<br /><br />I&#039;m unsure, however most of them should work if the jump is to PC box name 1 character 2 as the addresses are unchanged between different language versions, and if all the characters can be input regardless of version. I tested D5B7 (the number of items address) for instance and it was unchanged on the French version.<br /><br />However even if all the addresses are the same the all TM/HMs code may not work. This is because a call to ByteFill (314C) is involved, which may be at a different pointer in other languages (including at least French).


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Very useful post, as I was interested in the hidden powers. Great job.<br /><br />Though I was having some trouble with my last code (in the PM I sent you) and I wasn&#039;t sure if it was the slide pokemon or Quagsire. Can it ever be a issue with the Quagsire or does the code only check that the Quagsire is holding TM02 and has Return has the first move and no other factors of the Quagsire matter? And the amount of pokemon in a box doesn&#039;t change anything?<br /><br />Just have no idea why it didn&#039;t work as it seemed I had tried everything.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Nostalgia link=topic=8111.msg207218#msg207218 date=1507487716]<br />Very useful post, as I was interested in the hidden powers. Great job.<br /><br />Though I was having some trouble with my last code (in the PM I sent you) and I wasn&#039;t sure if it was the slide pokemon or Quagsire. Can it ever be a issue with the Quagsire or does the code only check that the Quagsire is holding TM02 and has Return has the first move and no other factors of the Quagsire matter? And the amount of pokemon in a box doesn&#039;t change anything?<br /><br />Just have no idea why it didn&#039;t work as it seemed I had tried everything.<br />[/quote]<br /><br />Thanks Nostalgia. :)<br /><br />That&#039;s right. Other than the slide PokÃ©mon, the game will only read the species, held item and move 1 of the Quagsire which in this case is a jump to the box names, so it&#039;s likely something went wrong with your slide PokÃ©mon. The number of PokÃ©mon in a box doesn&#039;t matter as well. It may help therefore to just catch a new one if the box names are fine.<br /><br />Sorry for the late response.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  As far as I know, addresses are the same in english and other european games, but you&#039;re right, the differences in characters could be a problem that would require some adaptation.<br /><br />That being said, the easiest way to jump to box names using TM25 is through box 9, so I&#039;m guessing using the code starting from this box should do the trick. I have no clue about the call issue in french games, maybe ISSOtm can answer that because he&#039;s more into game functions than I am.<br /><br />EDIT: According to ISSOtm, pointers are indeed very different in other languages (315E in french, 313F in italian, 313E in spanish, 3179 in german). So, that means these codes have to be remade for each european games?


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: luckytyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The problem with using doing a setup with deposits/withdraws/daycare takebacks is that it&#039;s potentially dependent on not having $FF in DVs or TID. This is dependent on the setup used, but it can create some compatibility issues between saves. The setup posted has been tested to work with $FF in TID, and $FF not in TID.


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I see!<br /><br />Do you have some elements about what I&#039;ve been saying about TM17 in the first of my two recent posts? I may miss something as I&#039;m still new to this.<br /><br />Anyway, there&#039;s a lot of very useful informations, methods, regarding different ACE techniques with different setups and different vectors for codes in a lot of different thread in this sub-board so far. It may be a bit messy for newcomers, so I feel, if it&#039;s fine to everyone, that it could help to compile all data in a &#039;guide thread&#039; asap. I can work on it and you guys could complete it if something&#039;s missing :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Storyreader21
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey, I have a question. I&#039;ve seen coin case codes for getting shiny pokemon with an attack DV of 14 which is male, and a level 98 pokemon with perfect dvs, but is there one for getting shiny pokemon with an attack dv of 2 (thus female), and a code for getting to level 98 without effecting DVs (this is so I can get my Unown to a high level without changing what letter they are.&nbsp; Either with an item list, or box name method, though if a box name then please explain how to set that up cause I&#039;m a bit confused on that method. Thanks.


subject: Re: Need help with padding an 8F script
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Padding is what makes Microsoft and Apple products inferior.<br />Simple answer? Don&#039;t.<br /><br />But if you [i]absolutely[/i] have to, use Gold Teeth, Elixer and Poke Flute, and quantities 40h, 52h, and 49h respectively. These correspond to (in order):<br />[code]ld b,b<br />ld c,c<br />ld d,d[/code]<br />These just waste time. Some emulators may see them as breakpoints, however, so be careful.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is it possible to get the evolutionary stones with the Coin Case? In Gold/Silver you can&#039;t get Water Stones, Fire Stones etc - until after the Elite Four. I&#039;m so used to playing Crystal where you can get them much earlier. Would be helpful to get the stones earlier for team choices and for filling out the Pokedex.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Str8rush link=topic=6638.msg207064#msg207064 date=1506720066]<br />Yup, that was the case. I put it into the daycare and got it back, it was a Missigno afterwards. By entering the TimeCapsule, it was shown as a shiny HoOh with Sacred Fire on Slot 3, with Fire/Flying Type. As I tried to trade there still was the Message that there seems to be something wrong with that PokÃ©mon... <br /><br />Edit: I re-read the topic in the forum where I first read about all this, the author of this thread stated that he was able to trade his generated Ho-Oh to his Silver but not his Lugia. Could this be a thing perhaps, as I am trying it with a Ho-Oh to a Gold Version?<br />[/quote]<br /><br />[quote author=Str8rush link=topic=6638.msg207055#msg207055 date=1506711455]<br />Hmm, for some reason it did not work... I set everything up properly:<br />Pidgey Level 94 with 233 HP (Max)<br />Parasect<br />Graveler<br />Tentacool<br />Kangaskan,<br /><br />Missigno (52) in the First Slot of my current Box,<br /><br />TM01<br />8F<br />Lemonade *20 for Fire<br />X Acc * 117<br />Carbos * 209<br />PokÃ©ball *199<br />Fresh Water * 201<br /><br />I used 8F in my Bag and nothing happend. When I checked Missignoâ€˜s Status in the box, it was still shown as a 99/Normal PokÃ©mon... any ideas?<br />[/quote]<br /><br />Did you manage to get to the bottom of this? I noticed that the code you used for changing the types points to the first PokÃ©mon in your party. That may be the reason the time capsule rejects the missingno. Don&#039;t be fooled about what the status screen says on gen 2 either. Missingno with the wrong types will still show as fire/flying on the gen 2 trade screen.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Torchickens I&#039;ve still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I&#039;m still not getting anything.<br /><br />Are you really sure there&#039;s nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well? <br />I&#039;ve been doing the steps exactly with a few differences in the beginning, namely:<br /><br />[list]<br />[li]Saving outside a grass patch before catching the mon for slot 3 so I can catch a new one if the one in slot 3 fails to work and save having to buy more poke balls<br />[/li][li]Pokemon in slots 2 and 5 are clones of the same mon and they don&#039;t trigger the glitch if put in slot 3<br />[/li][li]Healing the party after catching the mon for slot 3<br />[/li][/list]<br /><br />I&#039;ve double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.&nbsp; :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.<br /><br />Here&#039;s a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png<br />I&#039;ve gone through at least 50+ mons for slot 3 and none of them worked...


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Lost-Paisley link=topic=6716.msg207227#msg207227 date=1507622559]<br />Torchickens I&#039;ve still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I&#039;m still not getting anything.<br /><br />Are you really sure there&#039;s nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well? <br />I&#039;ve been doing the steps exactly with a few differences in the beginning, namely:<br /><br />[list]<br />[li]Saving outside a grass patch before catching the mon for slot 3 so I can catch a new one if the one in slot 3 fails to work and save having to buy more poke balls<br />[/li][li]Pokemon in slots 2 and 5 are clones of the same mon and they don&#039;t trigger the glitch if put in slot 3<br />[/li][li]Healing the party after catching the mon for slot 3<br />[/li][/list]<br /><br />I&#039;ve double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.&nbsp; :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.<br /><br />Here&#039;s a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png<br />I&#039;ve gone through at least 50+ mons for slot 3 and none of them worked...<br />[/quote]<br /><br />Torchickens helped me with a code to change my trainer ID, but I can&#039;t get her rare candy video code to work. I assume it was because I needed a new slide pokemon, but like you I used a lot of slide Pokemon and nothing. :/ I was doing your steps too, saving near the grass to get a new slide Pokemon if it didn&#039;t work because it saved a bit of time. I remember in the originals messing around with the Coin Case a few years back, it seemed easier to get a working slide Pokemon then it does in the VC games. Idk why. And older videos on Coin Case glitches suggested a low level female Pokemon tend to work better, I assume it&#039;s because female Pokemon have a worse attack stat and therefore more likely a bad DV spread. I&#039;m not sure if this 100% true, but I have messed around with the Coin Case a lot and it seemed a low level female Pokemon seemed to work better and when I started playing VC Gold and used the Coin Case to change my trainer ID, I used a female level 3 Sentret. <br /><br />Weirdly though, the Sentret stopped working as a slide Pokemon, I assume because of a happiness increase from walking with it, but I fainted it twice to reset it happiness but it still didn&#039;t work. :/<br /><br />


subject: Re: &quot;RESET&quot; option in menu that actually resets the game, what is that
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  For the record, I&#039;ve checked this section of WRAM.<br /><br />Bit 6 of $D72E ($D72D in Yellow, $D733 in european R/B, $D732 in european Yellow) must be full. You can put hex:40 as a value in this address for instance. :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Lost-Paisley link=topic=6716.msg207227#msg207227 date=1507622559]<br />Torchickens I&#039;ve still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I&#039;m still not getting anything.<br /><br />Are you really sure there&#039;s nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well? <br />I&#039;ve been doing the steps exactly with a few differences in the beginning, namely:<br /><br />[list]<br />[li]Saving outside a grass patch before catching the mon for slot 3 so I can catch a new one if the one in slot 3 fails to work and save having to buy more poke balls<br />[/li][li]Pokemon in slots 2 and 5 are clones of the same mon and they don&#039;t trigger the glitch if put in slot 3<br />[/li][li]Healing the party after catching the mon for slot 3<br />[/li][/list]<br /><br />I&#039;ve double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.&nbsp; :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.<br /><br />Here&#039;s a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png<br />I&#039;ve gone through at least 50+ mons for slot 3 and none of them worked...<br />[/quote]<br /><br /><br />Hmm I had a look a few times and found a problem with your box names. It looks like you used a &quot;d&quot; instead of &quot;&#039;d&quot;. If you don&#039;t use the &#039;d the game doesn&#039;t create an inc sp opcode that is responsible for not freezing the game.<br /><br />[img]https://i.imgur.com/VuttHvd.png[/img]<br /><br />Otherwise, I&#039;m afraid I really don&#039;t know sorry. Somebody sent me a message saying they tried over 300 slide PokÃ©mon with no success, which has affected my confidence in the glitch. It would be interesting if the Coin Case glitch does work slightly differently on 3DS Virtual Console, as unlikely as it appears.<br /><br />I&#039;ve just realized something. I wonder if OT names could be a problem (but I can&#039;t find anything that messes with the stack). The name TAYLOR seems to be fine, however. The Trainer ID shouldn&#039;t be a problem because the game doesn&#039;t read DA90, DA91 (it goes to DA98, so only [url=https://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold_and_Silver:RAM_map#Pokemon 3 Settings]PokÃ©mon 3 addresses[/url] beyond that should matter).<br /><br />[quote author=Nostalgia link=topic=6716.msg207228#msg207228 date=1507634227]<br />[quote author=Lost-Paisley link=topic=6716.msg207227#msg207227 date=1507622559]<br />Torchickens I&#039;ve still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I&#039;m still not getting anything.<br /><br />Are you really sure there&#039;s nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well? <br />I&#039;ve been doing the steps exactly with a few differences in the beginning, namely:<br /><br />[list]<br />[li]Saving outside a grass patch before catching the mon for slot 3 so I can catch a new one if the one in slot 3 fails to work and save having to buy more poke balls<br />[/li][li]Pokemon in slots 2 and 5 are clones of the same mon and they don&#039;t trigger the glitch if put in slot 3<br />[/li][li]Healing the party after catching the mon for slot 3<br />[/li][/list]<br /><br />I&#039;ve double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.&nbsp; :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.<br /><br />Here&#039;s a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png<br />I&#039;ve gone through at least 50+ mons for slot 3 and none of them worked...<br />[/quote]<br /><br />Torchickens helped me with a code to change my trainer ID, but I can&#039;t get her rare candy video code to work. I assume it was because I needed a new slide pokemon, but like you I used a lot of slide Pokemon and nothing. :/ I was doing your steps too, saving near the grass to get a new slide Pokemon if it didn&#039;t work because it saved a bit of time. I remember in the originals messing around with the Coin Case a few years back, it seemed easier to get a working slide Pokemon then it does in the VC games. Idk why. And older videos on Coin Case glitches suggested a low level female Pokemon tend to work better, I assume it&#039;s because female Pokemon have a worse attack stat and therefore more likely a bad DV spread. I&#039;m not sure if this 100% true, but I have messed around with the Coin Case a lot and it seemed a low level female Pokemon seemed to work better and when I started playing VC Gold and used the Coin Case to change my trainer ID, I used a female level 3 Sentret. <br /><br />Weirdly though, the Sentret stopped working as a slide Pokemon, I assume because of a happiness increase from walking with it, but I fainted it twice to reset it happiness but it still didn&#039;t work. :/<br /><br /><br />[/quote]<br /><br />Interestingly that&#039;s the same trick somebody tried with over 300 slide PokÃ©mon as well.<br /><br />When I test both box name codes they work perfectly on my side, so the only thing I know might be wrong if the slide PokÃ©mon persistently doesn&#039;t work on 3DS Virtual Console is to make sure you haven&#039;t made a small mistake in the box names (regardless of how small), to [u]switch item pockets[/u] (underlined as it&#039;s easy to forget) before using the Coin Case and after listening to Bellsprout&#039;s cry, and to make the correct movements.<br /><br />If you or Nostalgia have 3DS CFW and still can&#039;t get it to work you can send me your save file if you like and I&#039;ll try to see what&#039;s wrong. :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: jfb1337
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: jfb1337
icon: xx
body:
  I made a simple checksum system to verify that large amounts of data have been entered correctly on hardware:<br /><br />I&#039;m currently using (a version of) it to enter MrCheeze&#039;s virus, but it could be used to verify other things such as offago&#039;s memory editor:<br />[code]<br />Awakening x??&nbsp;  ; length of bytes you want to verify<br />X accuracy x??&nbsp;  ; low byte of address to verify from<br />Calcium x ??&nbsp; &nbsp; &nbsp; ; high byte <br />Lemonade x1&nbsp; &nbsp;  <br />Poke ball x174&nbsp;  <br />HP Up x13&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Fire stone x251 <br />X accuracy x33&nbsp;  <br />Calcium x217&nbsp; &nbsp; <br />Poke ball x119&nbsp;  <br />Calcium x45&nbsp; &nbsp; &nbsp; <br />Poke ball x126&nbsp;  <br />TM38 x40&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Poke ball x119&nbsp; &nbsp; <br />TM01 x any&nbsp; &nbsp; &nbsp;  <br />[/code][code]<br />ld c, ?? <br />ld l, ??<br />ld h, ??<br />ld a, 1<br />inc b <br />.loop<br />xor a,(hl)<br />inc hl <br />dec c<br />jr nz, .loop<br />ld l, $21<br />ld h, $D9 ; hl now points to 1st item quantity<br />inc b <br />ld (hl), a<br />ld l, $2D ; hl now points to .loop (7th item quantity)<br />inc b <br />ld a,(hl)<br />xor a,$28 ; change xor a,(hl) into add a,(hl) and vice-versa<br />inc b <br />ld (hl),a<br />ret<br />[/code]<br />This runs in 2 modes, &quot;add mode&quot; and &quot;xor mode&quot;, changing between them on each run, to make it more foolproof, as it would catch errors that may &quot;cancel each other out&quot; under one mode alone. The result of the checksum is written to the quantity of the first item, which can be compared against what you see in an emulator running the same code.<br /><br />This has NOT been tested. However, following code, which it is based on, has been. This is designed to run through the offago memory editor, from DA00 (where it starts be default). The only differences between the two versions are different addresses, and filler code inserted to avoid glitch items.<br />[code]<br />ld c,??<br />ld hl, ????<br />ld a, 1<br />.loop<br />xor (hl)<br />inc hl<br />dec c<br />jp z .loop<br />ld hl, $D9FF ; or wherever we want to put the output<br />ld (hl), a<br />ld hl, .loop ; DA07<br />ld a, (hl)<br />xor $28; change add a,(hl) to xor a,(hl) and vice-versa<br />ld (hl), a<br />jp $DA80; where the memory editor is stored<br /><br />; compiled: 0E002100C83E00AE230D20FB21FFD9772107DA7EEE2877C380DA<br />[/code]<br /><br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It worked yes! I too had written a d instead of a &#039;d in the box names haha. <br /><br />And I used a freshly hatched Magby as my slide Pokemon, so maybe for those struggling with slide Pokemon try a freshly hatched egg Pokemon.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207232#msg207232 date=1507656370]<br />It worked yes! I too had written a d instead of a &#039;d in the box names haha. <br /><br />And I used a freshly hatched Magby as my slide Pokemon, so maybe for those struggling with slide Pokemon try a freshly hatched egg Pokemon.<br />[/quote]<br /><br />Awesome! Congratulations :D<br /><br />I relate. It&#039;s easily done. Often I make mistakes like this in glitching too, like when recording something I might forget something or mess something up.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207230#msg207230 date=1507645841]<br />Hmm I had a look a few times and found a problem with your box names. [b][u]It looks like you used a &quot;d&quot; instead of &quot;&#039;d&quot;.[/u][/b] If you don&#039;t use the &#039;d the game doesn&#039;t create an inc sp opcode that is responsible for not freezing the game.<br /><br />Otherwise, I&#039;m afraid I really don&#039;t know sorry. Somebody sent me a message saying they tried over 300 slide PokÃ©mon with no success, which has affected my confidence in the glitch. It would be interesting if the Coin Case glitch does work slightly differently on 3DS Virtual Console, as unlikely as it appears.<br /><br />I&#039;ve just realized something. I wonder if OT names could be a problem (but I can&#039;t find anything that messes with the stack). The name TAYLOR seems to be fine, however. The Trainer ID shouldn&#039;t be a problem because the game doesn&#039;t read DA90, DA91 (it goes to DA98, so only [url=https://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold_and_Silver:RAM_map#Pokemon 3 Settings]PokÃ©mon 3 addresses[/url] beyond that should matter).<br /><br />Interestingly that&#039;s the same trick somebody tried with over 300 slide PokÃ©mon as well.<br /><br />When I test both box name codes they work perfectly on my side, so the only thing I know might be wrong if the slide PokÃ©mon persistently doesn&#039;t work on 3DS Virtual Console is to make sure you haven&#039;t made a small mistake in the box names (regardless of how small), to [u]switch item pockets[/u] (underlined as it&#039;s easy to forget) before using the Coin Case and after listening to Bellsprout&#039;s cry, and to make the correct movements.<br /><br />If you or Nostalgia have 3DS CFW and still can&#039;t get it to work you can send me your save file if you like and I&#039;ll try to see what&#039;s wrong. :)<br />[/quote]<br /><br />Wow, I can&#039;t believe I didn&#039;t see that :-[<br /><br />Tried again, and it seemed like it worked but the game froze/crashed to a white screen after I pressed B when it displayed my coins. At least I got somewhere :&#039;D<br /><br />Tired a second time and it worked!!! ;D<br />[img]https://i.imgur.com/tXFUDSJ.png[/img]<br />[sub][sub]That lag tho like wow[/sub][/sub]<br /><br />TAYLOR is one of the names to choose from in the beginning so who knows, it&#039;d be interesting if player names did effect it in some degree.<br /><br /><br />So the box names are corrupted like you said, but if I wanted to do this again with another mon I don&#039;t have to rename them right? And there&#039;s no harm to any mons in the boxes either?<br /><br />[quote author=Nostalgia link=topic=6716.msg207228#msg207228 date=1507634227]<br />Weirdly though, the Sentret stopped working as a slide Pokemon, I assume because of a happiness increase from walking with it, but I fainted it twice to reset it happiness but it still didn&#039;t work. :/<br />[/quote]<br />Happiness can effect the glitch?&nbsp; :???:


subject: Re: Need help with padding an 8F script
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  [quote author=Parzival link=topic=8110.msg207224#msg207224 date=1507509844]<br />Padding is what makes Microsoft and Apple products inferior.<br />Simple answer? Don&#039;t.<br />[/quote]<br />Problem is, padding is almost always required when writing 8F setups - quantities are free, items aren&#039;t.<br />Also, performance is way not an issue here.<br /><br />[quote author=Couldntthinkofaname link=topic=8110.msg207214#msg207214 date=1507476310]<br />The code works perfectly fine as written, the only problem is I&#039;ve been attempting to add padding (useless filler to prevent glitch items) to the code, but I can&#039;t seem to figure out how I would go about padding this script. Every time I add padding to fix one problem, another arises, and it&#039;s frustrating because I want to finish this soon.<br />[/quote]<br />The biggest issue with padding is that it is very situational. I came up with a very large setup, which thus doesn&#039;t fit in the bag, so it&#039;s split across the bag and the PC.<br /><br />In your bag :<br />[code]<br />8F<br />Any item<br />Antidote x14<br />Great Ball x13<br />Ice Heal x65<br />Parlyz Heal x5<br />Awakening x178<br />Thunderstone x59<br />TM13 x233<br />[/code]<br /><br />In your PC :<br />[code]<br />TM05 x175<br />Fire Stone x12<br />TM42 x87<br />TM03 x55<br />Antidote x5<br />Protein x61<br />Rare Candy x241<br />PokÃ© Ball x37<br />Soda Pop x40<br />Burn Heal x21<br />Calcium x21<br />Moon Stone x32<br />TM30 x7<br />Awakening x100<br />Thunderstone x72<br />Lemonade x233<br />PokÃ© Ball x24<br />TM20 x[Any qty]<br />[/code]<br /><br />Also this setup was pretty neat, since it made me find out 4 different bugs in GBz80 to Items. Always grinding for improvements !<br />(If you want to know, the four bugs were : AND, OR, XOR and CP breaking the label system ; missing &quot;ld a, (FF00+c)&quot; and vice-versa ; incorrect opcode selection for CB instructions ; incorrect jr offset calculation)<br /><br /><br />Source code :<br />[code]<br />; In the bag (loader code)<br /><br />dec bc ; Padding<br />ld c,3<br />dec c ; c = 2<br />dec c ; c = 1<br />ld b, c ; b = 1<br />rrca ; Padding<br />dec b ; b = 0<br /><br />ld c, $B2 ; To be able to use ($FF00+c)<br />ld hl, $D53B<br />jp hl<br /><br /><br />; In the PC (@D53B)<br /><br />start:<br />call $20AF ; DelayFrame<br />inc c ; Padding<br />ld a,(FF00+c)<br />ld d, a<br />swap a<br />dec bc ; Padding<br />dec b<br />inc h ; Padding<br />dec a<br />jr z,start ; If the player released Left, then restart with b decremented once<br />inc b<br />dec h ; Padding<br />dec a<br />jr z,right<br />dec d<br />daa ; Padding<br />dec d<br />ld a, (bc) ; Padding<br />jr nz,start<br /><br />rlca ; Padding<br />ld c,$64<br />ld hl, $3e48 ; GivePokemon<br />jp hl<br /><br />right:<br />inc b<br />jr start<br />[/code]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Lost-Paisley link=topic=6716.msg207234#msg207234 date=1507673792]<br />So the box names are corrupted like you said, but if I wanted to do this again with another mon I don&#039;t have to rename them right? And there&#039;s no harm to any mons in the boxes either?<br />[/quote]<br />I am not sure but it would be best to just redo any corrupted box names. Normally its only 1-2 and the visual corruption from them makes it look like the others are corrupted but really aren&#039;t (just exiting and entering the menu again should let you know if anything is still corrupted) boxes 13-14 however should be kept the same if you are using that method.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Lost-Paisley link=topic=6716.msg207234#msg207234 date=1507673792]<br />Happiness can effect the glitch?&nbsp; :???:<br />[/quote]<br /><br />Yes, Torchickens informed me of that and recommended to not walk too much with your slide Pokemon and put it in the PC when not using it. Though it seems because I had a tiny error with the box names, there was probably nothing wrong with my slide Pokemon but I still ended up releasing it thinking it had become useless, RIP Sentret.<br /><br />But got it working with a freshly hatched Pokemon so all is good. I was just working on my Pokedex and breeding a Magmar to get a Magby and it turned out the Magby worked perfectly as a slide Pokemon, which is great, better then wasting time on Route 29 catching 20 odd Pokemon they may not even work for the glitch. <br />


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: ajxpk
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ajxpk
icon: xx
body:
  Thank you very much @Torchickens! Very simple indeed. <br /><br />@SatoMew: To answer your question, it is difficult to say. But what I do know is that the Mew glitch was discovered very early. Because for the Nintendo Space World 1997 Distribution they made a Flyer where they even mentioned the Glitch. So the glitch must have been well known at this point.<br /><br />[img]https://projectpokemon.org/home/uploads/monthly_2017_09/pokemon-bug-myau.jpg.10833168a3c5a513ead0c1b4f4cec310.jpg[/img]<br /><br />[quote]ã€Œãƒã‚°ã˜ã‚ƒãªã„ï¼æ­£çœŸæ­£éŠ˜æœ¬ç‰©ã®ãƒŸãƒ¥ã‚¦ã‚’ã‚²ãƒƒãƒˆã—ã‚ˆã†ãœï¼ã€[/quote]<br />&quot;This is not a bug! Let&#039;s get Mew genuinely!&quot;<br /><br />I know that ã‚²ãƒ¼ãƒ•ãƒª is the abbreviation for ã‚²ãƒ¼ãƒ ãƒ•ãƒªãƒ¼ã‚¯ of course. <br />The thing about this Mew is that it actually was never distributed from what I heard. Which is hard to confirm since only 20 Mews were distributed in the first Distribution anyway and over 20 years passed. But from what I was told and I believe it&#039;s true, the distributed CoroCoro Mews had the ã‚³ãƒ­ã‚³ãƒ­ OT Name. This I could already confirm for the 2nd and 3rd Distributions. And since the Trainer IDs were incremented (and some numbers are known) we know that over 120 were generated using the same System. And even more outside of the distribution... (for journalism ect.) <br />That&#039;s we know about CoroCoro Mew <br /><br />Now after 20 years the Game Freak Mew was finally distributed so it all came to full circle. I&#039;m just sad that they f*cked up both Name and OT Name and have no idea why the hell they did that. Speaking of glitches in Gen 2...<br />The official VC Mews have 0 padding between actual Name and the Terminator. This can&#039;t be seen in Gen 1 but in Gen 2 the names aren&#039;t getting handed well by the character encoding, since 0x00 isn&#039;t Space, it&#039;s NULL in Gen 1 and in Gen 2 it&#039;s ?. As a result ãƒŸãƒ¥ã‚¦ becomes ãƒŸãƒ¥ã‚¦?? and ã‚²ãƒ¼ãƒ•ãƒª becomes ã‚²ãƒ¼ãƒ•ãƒª?. This is also the case in the English GF Mew counterpart, where it looks even worse since the names are longer. It&#039;s &quot;freaking&quot; weird. <br /><br /><br />[img]https://projectpokemon.org/home/uploads/monthly_2017_09/59c50cc16bc61_VCGen1EventMew-QuestionMarks.png.a57488ae530233839e0fb23ada002eed.png[/img]<br />Isn&#039;t it funny that an official Event PokÃ©mon can look even more glitchy than a glitched one? <br /><br />Tell me what is a bug now GameFreak?!


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Interesting, because it is considered that the discovery of how to get Mew using instant encounter (aka &quot;Mew Glitch&quot;) was made on 2ch by fifth in 2003, hence the first name given to the Ditto Trick, &quot;fifth&#039;s method&quot;. This would mean the glitch was actually known among players and developers as soon as 1997?


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  @ajxpk You&#039;re welcome! :)<br /><br />I don&#039;t think it&#039;s necessarily referring to fifth&#039;s method. Before 2003 the Trainer escape glitch (fifth&#039;s method) wasn&#039;t the only means of obtaining Mew.<br /><br />There was [url=http://glitchcity.info/wiki/Second_type_glitch]a method[/url] that preceded the Trainer-Fly glitch involving the Select glitch and a PokÃ©mon with Water as its second type known in at least 2001 or earlier, so it&#039;s possible that was known in 1997, although I don&#039;t know who discovered it.<br /><br />[quote author=https://www.math.miami.edu/~jam/azure/forum/tuff/ultimatebb.php?ubb=get_topic;f=7;t=001124]<br />Zerot: I think the glitch involved renaming a Magikarp to Myuu or something. I am not sure, however it shouldn&#039;t be too hard to find out.<br /><br />Meowth346: There are too many glitches to get Mew to name, but one involves using the 15th item to change a Pokï¿½mon into Mew (Mew&#039;s hex value is 15), and the name rater can change a Water Type (water&#039;s hex value is 15) Pokï¿½mon into Mew. Etc, etc, etc...<br />[/quote]<br /><br />Furthermore [url=http://glitchcity.info/wiki/Japanese_unterminated_name_glitch_item_instant_encounter_glitch]this[/url] is another popular method for obtaining Mew that may have been known before fifth&#039;s method.<br /><br />https://www.youtube.com/watch?v=k0dj82Gf5tA


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ajxpk link=topic=8086.msg207239#msg207239 date=1507781639]<br />@SatoMew: To answer your question, it is difficult to say. But what I do know is that the Mew glitch was discovered very early. Because for the Nintendo Space World 1997 Distribution they made a Flyer where they even mentioned the Glitch. So the glitch must have been well known at this point.<br /><br />[img]https://projectpokemon.org/home/uploads/monthly_2017_09/pokemon-bug-myau.jpg.10833168a3c5a513ead0c1b4f4cec310.jpg[/img]<br /><br />[quote]ã€Œãƒã‚°ã˜ã‚ƒãªã„ï¼æ­£çœŸæ­£éŠ˜æœ¬ç‰©ã®ãƒŸãƒ¥ã‚¦ã‚’ã‚²ãƒƒãƒˆã—ã‚ˆã†ãœï¼ã€[/quote]<br />&quot;This is not a bug! Let&#039;s get Mew genuinely!&quot;<br /><br />I know that ã‚²ãƒ¼ãƒ•ãƒª is the abbreviation for ã‚²ãƒ¼ãƒ ãƒ•ãƒªãƒ¼ã‚¯ of course. <br />The thing about this Mew is that it actually was never distributed from what I heard. Which is hard to confirm since only 20 Mews were distributed in the first Distribution anyway and over 20 years passed. But from what I was told and I believe it&#039;s true, the distributed CoroCoro Mews had the ã‚³ãƒ­ã‚³ãƒ­ OT Name. This I could already confirm for the 2nd and 3rd Distributions. And since the Trainer IDs were incremented (and some numbers are known) we know that over 120 were generated using the same System. And even more outside of the distribution... (for journalism ect.) <br />That&#039;s we know about CoroCoro Mew <br /><br />Now after 20 years the Game Freak Mew was finally distributed so it all came to full circle. I&#039;m just sad that they f*cked up both Name and OT Name and have no idea why the hell they did that. Speaking of glitches in Gen 2...<br />The official VC Mews have 0 padding between actual Name and the Terminator. This can&#039;t be seen in Gen 1 but in Gen 2 the names aren&#039;t getting handed well by the character encoding, since 0x00 isn&#039;t Space, it&#039;s NULL in Gen 1 and in Gen 2 it&#039;s ?. As a result ãƒŸãƒ¥ã‚¦ becomes ãƒŸãƒ¥ã‚¦?? and ã‚²ãƒ¼ãƒ•ãƒª becomes ã‚²ãƒ¼ãƒ•ãƒª?. This is also the case in the English GF Mew counterpart, where it looks even worse since the names are longer. It&#039;s &quot;freaking&quot; weird. <br /><br /><br />[img]https://projectpokemon.org/home/uploads/monthly_2017_09/59c50cc16bc61_VCGen1EventMew-QuestionMarks.png.a57488ae530233839e0fb23ada002eed.png[/img]<br />Isn&#039;t it funny that an official Event PokÃ©mon can look even more glitchy than a glitched one? <br /><br />Tell me what is a bug now GameFreak?!<br />[/quote]<br /><br />Thank you for your detailed post, it was very informative! :) And you even found a better copy of the flyer, too!<br /><br />I guess the bug in the VC Mew could be a subtle reference, hehe :P 


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks Torchickens, I was suspecting there was a way to smuggle out a Mew from a Select glitch but I wasn&#039;t sure, and didn&#039;t know about this other glitch. This made me realize the Yami Shop glitch works in our games, for some reason I believed it to be a jp-exclusive. Cool!


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  [quote author=Torchickens link=topic=8093.msg207095#msg207095 date=1506843704]<br />Somebody named DragonArbock finished a list of codes for every PokÃ©mon.<br /><br />You can find it here:<br /><br />https://pastebin.com/F93hVh7w<br />[/quote]<br /><br />This is useful, but there are some errors. I wanted to get a Skarmory and a Delibird, ended up getting a Houndour and Mantine, which was a time waster and not needed as I&#039;m playing on Gold.<br /><br />But the codes you and SpunkyBanky came up with have worked perfectly fine. <br /><br />Today I&#039;ve got:<br /><br />Mew, Mewtwo, Articuno, Moltres, Zapdos, Bulbasaur, Charmander, Squirtle, Kabuto, Omanyte, Phanpy, Scizor, Porygon2.<br /><br />And now I only need:<br /><br />Gengar, Alakazam, Machamp, Golem, Politoed, Meowth, Ledyba, Vulpix, Totodile, Chikorita, Steelix, Slowking, Skarmory, Delibird, Kingdra, Celebi. <br /><br />Posting so I know how many eggs I need to clone left. Because I cloned my Magby egg to hatch all these Pokemon and Magby has a 6500 steps hatch time, it&#039;s takes a annoying while to hatch these pokes. Maybe I&#039;ll just get a Magikarp egg and clone it so I can get quicker hatches. :&#039;D <br /><br />


subject: Re: PokÃ©mon Gold/Silver Virtual Console glitch confirmation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8086.msg207243#msg207243 date=1507825153]<br />Thanks Torchickens, I was suspecting there was a way to smuggle out a Mew from a Select glitch but I wasn&#039;t sure, and didn&#039;t know about this other glitch. This made me realize the Yami Shop glitch works in our games, for some reason I believed it to be a jp-exclusive. Cool!<br />[/quote]<br /><br />You&#039;re welcome! ^^<br /><br />Yeah, I used to think it was a Japan-only glitch as well until TheZZAZZGlitch made a video of it ([url=https://www.youtube.com/watch?v=StkqT6oK5KI]link[/url]) in the English versions. It&#039;s a great glitch.


subject: Pokemon Force-Encounter address for G/S?
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In Pokemon R/B, there is address $D059, which when set to a non-zero value, forces an encounter with the corresponding species index that the address is set to. Is there a similar address for Gold and Silver?<br /><br />By the way, I keep hearing that you must &quot;fix the stack&quot; when making ACE codes for Gen 2. How does one accomplish this?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Lost-Paisley
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207237#msg207237 date=1507722695]<br />Yes, Torchickens informed me of that and recommended to not walk too much with your slide Pokemon and put it in the PC when not using it.[/quote]<br /><br />I&#039;ll be keeping that in mind~ how many steps does it take for the mon to develop its happiness value? And does it decrease if left in the box?<br /><br />I&#039;m curious, the box codes that let you change one mon to another, if you have an egg that is shiny (let&#039;s say it&#039;s a Wooper for example) and you alter it into a different mon (like Zapdos) via the box codes, would the egg result in a shiny Zapdos?


subject: 4 questions about PokÃ©rus mechanics
poster_name: Mario Rossi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi, folks! Iâ€™m currently seeking help from the best PokÃ©mon experts on the Internet. In fact, Iâ€™m trying to achieve the feat of capturing a PokÃ©mon with PokÃ©rus (in other words, an original PokÃ©rus carrier) in a Ruby cartridge with DEAD BATTERY. According to the pokecrystal disassembly, PokÃ©rus seems to be a â€œflagâ€ that is activated on your PokÃ©mon after you battle a wild one, that is not present on the wild PokÃ©mon itself (contrarily to the popular belief), but is only â€œunlockedâ€ on your PokÃ©mon after you battle it. That means that if you are lucky enough to catch the wild PokÃ©mon who infected your PokÃ©mon at the end of the battle, youâ€™ll end up having a normal PokÃ©mon, without PokÃ©rus, with yourself being the only person to know that it was responsible for having spread it to your party. Itâ€™s obvious that, given these conditions, my feat of capturing an original PokÃ©rus carrier will be impossible to achieve. So, my questions to you are the following:<br />1) Is my feat achievable? I donâ€™t want to lose precious time catching wild PokÃ©mon in groups of 30 (I soft reset when I fill an entire PokÃ©mon box because I have only 50 balls, and my RNG, being my Ruby battery run dry, is broken);<br />2) In general, how the PokÃ©rus mechanics work in Gen 3 (but also in Gen 2, as it is not very clear yet)? Thatâ€™s a major obscure point in the PokÃ©mon community that I think it would be worth to research.<br />3) A strange situation occurred to me in PokÃ©mon Emerald (emulator): I caught a Wurmple with PokÃ©rus (through a Gameshark code) just to observe empirically how the mechanics work in Gen 3, then I put it second in my party behind a Mudkip (no PokÃ©rus). I then battled a Lotad (with codes disabled, this time), which I ended up capturing. I checked my party after the battle and I discovered that Mudkip had contracted PokÃ©rus, but not the newly captured Lotad (in third place in the party), which is weird. In fact, a PokÃ©mon in second place in the party, either spreads the PokÃ©rus, after a battle, to the first AND the third placed PokÃ©mon (even if the PokÃ©mon in third place has been caught in the battle itself), or doesnâ€™t spread it at all, and Iâ€™m sure of this because I observed it empirically. This made me think that Mudkip could have incredibly caught the PokÃ©rus (legitimately) from the Lotad that I had just caught.<br />This could mean that:<br />â€¢	The wild PokÃ©mon which triggers PokÃ©rus in your party is NOT itself a carrier, because Mudkip allegedly contracted it from Lotad, with Lotad itself not being affected;<br />â€¢	The PokÃ©rus mechanics in Gen 2 and Gen 3 are different, because in Gen 2 if a PokÃ©mon of your party already has PokÃ©rus, it will be impossible to contract it de novo after a battle from a wild PokÃ©mon, but it will only be spread through your party from the PokÃ©mon that was already affected instead. This would contradict the fact that even if my Wurmple was already affected and in the party, Mudkip still managed to contract PokÃ©rus de novo from the wild Lotad I ended up capturing;<br />â€¢	I oversaw something during the observation of what was happening (unlikely).<br />4) A noob question: I deposited in the PC my Mudkip a few minutes after it contracted PokÃ©rus and I then saved outside the PokÃ©mon Center. I have never withdrew it from the PC, but one evening, though, I put my Mudkip in the party to rapidly beat the game (just for fun) WITHOUT saving, and in the process I passed midnight (I spent 5 hours playing, from 8 p.m. to 1 a.m.). Having NOT saved the game (I reset the game a few seconds before Hall of Fame), and being thus again placed outside the PokÃ©mon Center with Mudkip in the PC as the last time I saved the game, does it count as a day has passed for Mudkipâ€™s PokÃ©rus counter or not?<br />An answer to these 4 questions will be greatly appreciated. Kind regards and good luck with all of your research!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Lost-Paisley link=topic=6716.msg207247#msg207247 date=1507882774]<br />I&#039;ll be keeping that in mind~ how many steps does it take for the mon to develop its happiness value? And does it decrease if left in the box?<br /><br />I&#039;m curious, the box codes that let you change one mon to another, if you have an egg that is shiny (let&#039;s say it&#039;s a Wooper for example) and you alter it into a different mon (like Zapdos) via the box codes, would the egg result in a shiny Zapdos?<br />[/quote]<br /><br />Happiness won&#039;t decrease if left in the box. And I&#039;m not sure, but I think if the slide Pokemon gets any noticeable happiness increase then it will mess up the code, because the slide Pokemon has to be freshly caught or hatched with no stat experience and happiness is another one of those factors I guess. <br /><br />However, I was using the coin case a lot yesterday with the same slide Pokemon and walking from the PC in Cherrygrove to outside the mart in Cherrygrove for coin cases glitches, when you repeat that enough times you&#039;re certainly walking a good number of steps, but still my slide Pokemon still worked. And today I was using the hatched Togepi as a slide Pokemon as a test and it worked, so I would certainly recommend freshly hatched Pokemon.<br /><br />As for your question, I haven&#039;t messed around with shiny codes yet but if the first code changed the egg to shiny and then you changed the Pokemon species then it should still be shiny as that is determined by the DV&#039;s which are made when you use you shiny code. 


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  Torchickens, do you know how to teach the moves Ice Beam, Flamethrower and Thunderbolt via Coin Case? Felt appropriate to ask in the &#039;&#039;competitive&#039;&#039; thread -&nbsp; and sadly these moves are not available in Gold/Silver, only Crystal version got them through the move tutor. So for someone who has Gold/Silver but can&#039;t trade, Coin Case would be the only way to obtain them. And it&#039;s silly how few Pokemon actually learn them through level up, especially Thunderbolt which I think Pikachu is the only Electric type in the whole game to learn it through level-up.<br /><br />[quote author=Torchickens link=topic=8111.msg207215#msg207215 date=1507481633]<br />Max DVs:<br /><br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0955<br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0955<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br />[/quote]<br /><br />So I had a chance to test this. It changed the DV&#039;s of my Houndour, but it did not max the DV&#039;s. <br /><br />My Houndour level 5 stats after using your code:<br /><br />20 HP<br />11 Attack<br />9 Defense<br />13 Special Attack<br />10 Special Defense<br />12 Speed<br /><br />But a max DV level 5 Houndour would be:<br /><br />21 HP<br />12 Attack<br />9 Defense<br />14 Special Attack<br />11 Special Defense<br />13 Speed<br /><br />So the code changed some DV&#039;s, I know that because it changed it from a female Houndour to a male, but it did not max them.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207249#msg207249 date=1507917503]<br />[quote author=Lost-Paisley link=topic=6716.msg207247#msg207247 date=1507882774]<br />I&#039;ll be keeping that in mind~ how many steps does it take for the mon to develop its happiness value? And does it decrease if left in the box?<br /><br />I&#039;m curious, the box codes that let you change one mon to another, if you have an egg that is shiny (let&#039;s say it&#039;s a Wooper for example) and you alter it into a different mon (like Zapdos) via the box codes, would the egg result in a shiny Zapdos?<br />[/quote]<br /><br />Happiness won&#039;t decrease if left in the box. And I&#039;m not sure, but I think if the slide Pokemon gets any noticeable happiness increase then it will mess up the code, because the slide Pokemon has to be freshly caught or hatched with no stat experience and happiness is another one of those factors I guess. <br /><br />However, I was using the coin case a lot yesterday with the same slide Pokemon and walking from the PC in Cherrygrove to outside the mart in Cherrygrove for coin cases glitches, when you repeat that enough times you&#039;re certainly walking a good number of steps, but still my slide Pokemon still worked. And today I was using the hatched Togepi as a slide Pokemon as a test and it worked, so I would certainly recommend freshly hatched Pokemon.<br /><br />As for your question, I haven&#039;t messed around with shiny codes yet but if the first code changed the egg to shiny and then you changed the Pokemon species then it should still be shiny as that is determined by the DV&#039;s which are made when you use you shiny code.<br />[/quote]<br /> Not quite. Even if your slide&#039;s happiness value increases, it doesn&#039;t matter too much unless it reaches a malicious opcode. What I mean by that is, any opcode that changes code flow (call,ret,jp,jr), any opcode that stops the cpu (stop, and MAYBE halt, I&#039;m not quite sure), any op that messes with the stack (inc sp,push,pop,ld sp,rst,etc.), any invalid ops ($D3,$DB,$DD,$E3,$E4,$EB,$EC,$ED,$F4,$FC,$FD), and &quot;di&quot;.<br /><br />The Happiness value increments upon walking 256 steps, and when freshly caught, has a value of $00. The first &quot;malicious&quot; opcode it encounters first is &quot;stop&quot;, which is hex $10. So, a freshly caught slide pokemon is considered &quot;broken&quot; after 4096 steps. [b]However[/b], you can easily set this value to $11 (ld de,$xxyy) by walking 256 more steps. So if you find that your slide has stopped working, walk 256 more steps and see if that fixes it.<br /><br />Also, it is worth noting that happiness is not the only thing that affects slide pokemon.<br />Here&#039;s a list of all factors that affect slide pokemon:<br /><br />Attack EV<br />Defense Ev<br />Speed EV<br />Special EV<br />Attack/Defense IV<br />Speed/special IV<br />PP of current moveset<br />Happiness/Hatch Time<br />Pokerus<br />Caught Information<br />Level<br />Status<br />Hp<br />Max Hp<br />Attack<br />Defense<br />Speed<br />Special Defense<br />Special Attack - Must correspond to an instruction that is one byte long, otherwise the jump instruction that executes your code will be absorbed!<br /><br /> 


subject: Mystery Gift changing with Coin Case Glitch
poster_name: Marv231
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: question
body:
  I wonder, if itÂ´s possible to change the Item, you get when doing the Mystery Gift Option at the title screen?&nbsp; <br />For Pokemon Gold and Silver on the VGC 


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Apologies for double posting, but I only need Delibird, Steelix and Kingdra left, but the codes are wrong in DragonArbock&#039;s guide and I can&#039;t seem to get the right ones. <br /><br />Others are wrong too, like Scizor is written as: Ã©&#039;m2p0&#039;s5 in Arbock&#039;s guide, but that&#039;s wrong as the correct code is Ã©&#039;m2p0&#039;r&#039;v9 by SpunkyBandy.<br /><br />The majority seem right though, just a few are wrong and I wonder if anyone can help.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  *bump*<br /><br /><br /><br />I can&#039;t answer your question with 100% certainty, but I do feel like this is worth researching<br /><br />My [b]guess[/b] is that achieving pokerus with a dead battery should still be possible. My reason for saying this is that other RNG events, such as mirage island still work perfectly fine on dead battery carts.<br /><br />I&#039;ll look into this and see if I can&#039;t find a better answer.


subject: Re: Pokemon Force-Encounter address for G/S?
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  1. I don&#039;t think there&#039;s any address as all wild encounters are taken directly from ROM, and events that trigger battles also probably do this.<br />2.Simply save and reset the game.<br />(Someone confirm 1)


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Charmy
icon: xx
body:
  What about a code that forces a PokÃ©mon egg to appear in the daycare, as my Ditto doesn&#039;t want to breed with my Pikachu... &#129300;<br />The game does tell me they &quot;show interest&quot; in each other so they can breed


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Then you will get a egg eventually, I&#039;ve had that too and it took ages to produce eggs, I don&#039;t know if this is a VC issue. Never seemed to take this long to generate eggs in the original games. 


subject: Re: Pokemon Force-Encounter address for G/S?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Address [tt]0xD059[/tt] in English Red and Blue corresponds to the [tt]wCurOpponent[/tt] function [url=https://github.com/pret/pokered/blob/5c2419383118280465a89657fed34ed6562f2981/wram.asm#L1666-L1669]on the disassembly[/url]. A quick search for that name doesn&#039;t return an equivalent in the English Crystal disassembly. This doesn&#039;t necessarily mean that it&#039;s not possible, though.


subject: Re: Mystery Gift changing with Coin Case Glitch
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t know enough to help with ACE but the folks at Project PokÃ©mon have been researching where at least certain pieces of save data are stored, including that of Mystery Gift.<br /><br />[url=https://projectpokemon.org/home/forums/topic/41479-pokemon-gen-ii-save-file-records/]https://projectpokemon.org/home/forums/topic/41479-pokemon-gen-ii-save-file-records/[/url]


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  actually i need a code for a togepi because i mindlessly used my togepi egg for celebi... and i can&#039;t seem to find a code for it


subject: Re: Pokemon Force-Encounter address for G/S?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I checked a bit, and there doesn&#039;t seem to be a memory address that does what D059 does.<br />Wild battles are handled by map script, Trainer &amp; scripted battles by directly calling StartBattle.<br /><br />Maybe there&#039;s an entry point, but I doubt it.


subject: Re: Mystery Gift changing with Coin Case Glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  https://github.com/pret/pokecrystal/blob/master/sram.asm#L58<br /><br />Apparently modifying 0:ABE2 is enough to make the mystery gift guy appear.<br />https://github.com/pret/pokecrystal/blob/f0209d6ed6a0cd0e759dff49bdfe4d8171229c29/engine/specials.asm#L318<br />I don&#039;t think the address is checksummed.<br /><br />(There&#039;s also the flag EVENT_RECIEVED_BALLS_FROM_KURT that&#039;s involved, so... maybe it won&#039;t always suffice ?)


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Togepi code would be:<br /><br />Box 2: Ã©&#039;m2pp0p5 <br /><br />All the Pokemon codes are similar, just only the Box 2 code is different. So Togepi would use the same box formula as Celebi&#039;s in the OP, just with a different Box 2 name. <br /><br />That&#039;s from DragonArbock&#039;s guide, so it might not be right, there are a few errors in his guide.


subject: Re: Hints in Gen III Trade Cloning
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  There&#039;s a new report on this, this time with a video proof.<br /><br />https://www.youtube.com/watch?v=vXgAqueHUBk<br /><br />It&#039;s not using the GB Player, but two GBA SP, and it&#039;s been done between an english game and a french game.<br /><br />However the internal battery was not working anymore in one game, which also was the case of the first person claming to success this trick. Apparently when he tried to clone the other way, it didn&#039;t work.


subject: Gbz80: How to generate a random number between $xx and $yy
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m making a small ACE game for Pokemon Red. I want a block to be placed at a random x and y value, and due to screen limitations, the x value must be between $00 and $13 (inclusive) and the y value must be between $00 and $11 (also inclusive)<br /><br />My question is this: Is there any way to make an RNG that is between two different values?


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  Then it&#039;s either one of these 3 things:<br /><br />1) Not following the exact movement steps and pattern <br /><br />2) Having a slide Pokemon that doesn&#039;t work<br /><br />3) A small error in the box code names, even the tiniest error like writing d instead of &#039;d matters and it helps to check the box names multiple times. <br /><br />Those are the only things that would get a black screen and most of the time it&#039;s number 3. I&#039;ve obtained 29 Pokemon with this glitch so it definitely works, you just need to double check everything. <br /><br />


subject: Re: Gbz80: How to generate a random number between $xx and $yy
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  `call Random` each time. Far from perfect due to the way the game&#039;s RNG is implemented, but it should suffice.


subject: Pokemon Green Speedrun Ideas
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I guess you all know TPP. We just started a run of &quot;English&quot; Pokemon Green as a sidegame, with 1 input (A, B, Start, Select and directions) between PBR matches, and devs blocked all Select inputs a while ago, so what we essentially have are single button presses of A, B, Start, Up, Down, Left or Right every ~45 seconds in-game time. Select glitches are out, soft resetting is impossible, trainer-escape is improbable (requires encounter in front of trainer, and only 1 chance per trainer since we can&#039;t reset), cooltrainer is also impossible.<br /><br />With all these restrictions, what&#039;s the fastest (fewest inputs) way to beat the game?


subject: Re: Coin Case Glitch: Hatching Pokemon with Box Code names
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: xx
body:
  [quote author=Nostalgia link=topic=8093.msg207253#msg207253 date=1507984594]<br />Apologies for double posting, but I only need Delibird, Steelix and Kingdra left, but the codes are wrong in DragonArbock&#039;s guide and I can&#039;t seem to get the right ones. <br /><br />Others are wrong too, like Scizor is written as: Ã©&#039;m2p0&#039;s5 in Arbock&#039;s guide, but that&#039;s wrong as the correct code is Ã©&#039;m2p0&#039;r&#039;v9 by SpunkyBandy.<br /><br />The majority seem right though, just a few are wrong and I wonder if anyone can help.<br />[/quote]<br /><br />There is more than one way to write many of these codes. Both Scizor codes are correct, if you&#039;d take the time to understand how they work.<br />I used the direct &#039;s= 212 solution. <br />They used v1-v2 = x;&nbsp; x + 256 = pokemon<br /> &#039;r - 9 (211 - 255) = -44;&nbsp; -44 + 256 = 212<br />Both work.<br /><br />As for the other other codes, I talked to them on youtube, they were not renaming their corrupted boxes after each attempt, and thus were getting the wrong things.<br /><br />Now, I have a question- does anyone know how to modify the shiny code to give an attack stat that allows for female pokemon? As of now, the shiny code only gives males at the 50/50 ratio.<br />(Edit) It also only gives HP dragon, while HP grass would be the better option.


subject: Re: Pokemon Green Speedrun Ideas
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  http://glitchcity.info/wiki/LOL_glitch might not allow for game completion, but it&#039;ll certainly be useful. Only issue is getting the items needed.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Mario Rossi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi! Thanks for the answer. I expected to receive more of them, from a specialized site like this, though. I even PMed Torchickens (administrator) and Metarkrai (PokÃ©mon expert) to know more about it, but without success. I didn&#039;t expect PokÃ©rus mechanics to be such an unknown field to explore, to be honest.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Mario Rossi link=topic=8113.msg207275#msg207275 date=1508238342]<br />Hi! Thanks for the answer. I expected to receive more of them, from a specialized site like this, though. I even PMed Torchickens (administrator) and Metarkrai (PokÃ©mon expert) to know more about it, but without success. I didn&#039;t expect PokÃ©rus mechanics to be such an unknown field to explore, to be honest.<br />[/quote]<br /><br />No problem. <br /><br />As to why you&#039;re not getting many answers, it&#039;s simply that this site is kinda dead. The glitch hunting community is getting smaller and smaller as we speak, sad as it may be.<br /><br />I haven&#039;t had a chance to look further into your question, hopefully I&#039;ll look into it sometime today.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No, it&#039;s not getting smaller and smaller. As strange as it may sound, it&#039;s actually growing.<br /><br />As for Torchickens and Metarkrai, you more or less hit the wrong choices : both of them are currently busy with their lives, and thus not available here.<br /><br />The actual issue, imo, is a kind of fatigue. We&#039;re getting the same questions too often, and... well, every time I see a question on the forums, I feel a kind of laziness.<br /><br />There&#039;s probably also that, though I said the community is a growing, it&#039;s growing too slowly for there to be a &quot;replacement&quot; effect, and many are moving on to other domains.<br /><br /><br /><br />I dunno. The community is certainly not dead, but yeah, less open, I guess.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: JalapenosTurtle
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m running into some trouble with the max stat experience/max experience script:<br /><br />[quote]<br />Max out stat experience, give experience for Level 100 after battle:<br /><br />Box 1: Ap09Ã©â™€45<br />Box 2: Ã©04Ã©1455<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©7455<br />Box 6: Ã©84Ã©.455<br />Box 7+: 55555555<br />Box 13: Unchanged from before<br />Box 14: Unchanged from before<br />[/quote]<br /><br />I didn&#039;t use the required code, but I am running the modified Quagsire setup where you no longer need a slide Pokemon or coin case (opting instead to use TM25 from the ball pocket). My box 7 is &quot;x&#039;d&quot; to terminate the script. When I used TM25 it modified my fifth Pokemon. This wasn&#039;t immediately apparent, but the stats of my fifth Pokemon changed when I deposited and withdrew the Pokemon. This makes sense as the actual stat and the IVs are separate components of the Pokemon data structure. I did not see any change in the experience my Pokemon had, however. Fighting a wild Pokemon did not cause me to automatically level to 100. I&#039;m attempting to figure out what went wrong from the Assembly<br /><br />Box 1: Ap09Ã©â™€45 ( XOR A; OR ff; LD [f5fa], A) <br />Box 2: Ã©04Ã©1455 (LD [f6fa], A; LD [f7fa], A)<br />Box 3: Ã©24Ã©3455 (LD [f8fa], A; LD [f9fa], A)<br />Box 4: Ã©44Ã©5455 (LD [fafa], A; LD [fbfa], A)<br />Box 5: Ã©64Ã©7455 (LD [fcfa], A; LD [fdfa], A)<br />Box 6: Ã©84Ã©.455 (LD [fefa], A; LD [e8fa], A)<br />Box 7: x&#039;d (OR A; RET NC)<br /><br />If I&#039;m understanding the code correctly, you&#039;re getting A=ff, then loading A into the necessary locations to max out the values. All of the bytes for stat experience are right next to the bytes for experience, and there&#039;s a total of 13 (3 for experience, 10 among the stat experience for attack, defense, special, speed, hp). I&#039;m only seeing 11 loads (expected 13), and one of the loads isn&#039;t directly next to the others (LD [e8fa], A). I suspect I&#039;m misunderstanding a critical detail here. Can you help me understand how the script works and why it may not be working for me?


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Mario Rossi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  To be sincere, I have not found many informations on the Internet about PokÃ©rus mechanics other than what is written on Bulbapedia, so I don&#039;t think it is an inflated argument. To me it is, on the contrary, a very underrated field among the PokÃ©mon researchers.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  [quote author=ISSOtm link=topic=8113.msg207277#msg207277 date=1508242071]<br />No, it&#039;s not getting smaller and smaller. As strange as it may sound, it&#039;s actually growing.<br />[/quote]<br /><br />&#039;&#039;Most Online Today: 6. Most Online Ever: 1,488 (December 01, 2013, 01:09:56 am)&#039;&#039;<br /><br />This place is borderline dead and it&#039;s shame because its great learning about Pokemon glitches. But to say this place is growing when it averages 6 people online daily, when at one point this forum had nearly 1500 online, is hilarious.&nbsp; <br /><br />Anyway as for the topic, I&#039;ve never had Pokerus in the generation 3 games, only gen II and it was such long ago that I didn&#039;t even know much about it or the best ways to preserve it. 


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=8113.msg207280#msg207280 date=1508270880]<br />[quote author=ISSOtm link=topic=8113.msg207277#msg207277 date=1508242071]<br />No, it&#039;s not getting smaller and smaller. As strange as it may sound, it&#039;s actually growing.<br />[/quote]<br /><br />&#039;&#039;Most Online Today: 6. Most Online Ever: 1,488 (December 01, 2013, 01:09:56 am)&#039;&#039;<br /><br />This place is borderline dead and it&#039;s shame because its great learning about Pokemon glitches. But to say this place is growing when it averages 6 people online daily, when at one point this forum had nearly 1500 online, is hilarious.&nbsp; <br /><br />Anyway as for the topic, I&#039;ve never had Pokerus in the generation 3 games, only gen II and it was such long ago that I didn&#039;t even know much about it or the best ways to preserve it.<br />[/quote]<br /><br />You&#039;ve got a point there.<br /><br />Unless we do something&nbsp; major, like ACE in gen 4, it doesn&#039;t seem likely this website&#039;s userbase will return.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I think due to a glitch &quot;Who&#039;s Online&quot; currently only shows one guest online, and everyone is stated to have the same IP (172.18.0.1). So in actuality we probably had more than 6 people online that day.<br /><br />I feel to say the site is dead is a misconception with new people occasionally posting to ask questions and things like that.<br /><br />The 1,488 was an outlier as I believe it happened when arbitrary code execution with 8F became popular and usually there are a lot less people online. I&#039;m not sure how many people were online though and a lot of the people who used to go on Glitch City have left.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Hi.<br /><br />The modified addresses are as follows:<br /><br />FAF6, FAF5: HP EV (two bytes)<br />FAF7, FAF8: Attack EV (two bytes)<br />FAF9, FAFA: Defense EV (two bytes)<br />FAFB, FAFC: Speed EV (two bytes)<br />FAFD, FAFE: Special EV (two bytes)<br />FAE8: PokÃ©mon 4 Special Attack byte 1<br /><br />So it looks like I did make a mistake, sorry (with the name Ã©84Ã©.455).&nbsp; :-[<br /><br />The problem seems to lie in there being more than one ID for the &quot;.&quot; character. The hex ID was supposed to be F2 for the code to modify FAF2 (total experience byte 1) to FF (giving it 16711680 more experience, which is recalculated to Level 100), but in actuality you can only enter the E8 &quot;.&quot; (which would modify FAE8).<br /><br />I used the F2 character while testing without double checking if that would appear when entering &quot;.&quot; using the box names.<br /><br />To fix this you can wipe out the old box names with 5s except where your &#039;footer&#039; is, and use this one instead to modify PokÃ©mon 5&#039;s experience:<br /><br />Box 1: Ap0x&#039;v955&nbsp; (multiply small x from the uppercase field only)<br />Box 2: e&#039;m2p0955<br />Box 3: Ã©A455555<br />Box 4-Box 12 (or possibly just box up to all of box 6 in your case): 55555555<br /><br />This should work if your modified setup runs from box 1 character 2 (or box 1 character 1), which it possibly does.<br /><br />Hope this helps.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Mario Rossi link=topic=8113.msg207248#msg207248 date=1507907207]<br />Hi, folks! Iâ€™m currently seeking help from the best PokÃ©mon experts on the Internet. In fact, Iâ€™m trying to achieve the feat of capturing a PokÃ©mon with PokÃ©rus (in other words, an original PokÃ©rus carrier) in a Ruby cartridge with DEAD BATTERY. According to the pokecrystal disassembly, PokÃ©rus seems to be a â€œflagâ€ that is activated on your PokÃ©mon after you battle a wild one, that is not present on the wild PokÃ©mon itself (contrarily to the popular belief), but is only â€œunlockedâ€ on your PokÃ©mon after you battle it. That means that if you are lucky enough to catch the wild PokÃ©mon who infected your PokÃ©mon at the end of the battle, youâ€™ll end up having a normal PokÃ©mon, without PokÃ©rus, with yourself being the only person to know that it was responsible for having spread it to your party. Itâ€™s obvious that, given these conditions, my feat of capturing an original PokÃ©rus carrier will be impossible to achieve. So, my questions to you are the following:<br />1) Is my feat achievable? I donâ€™t want to lose precious time catching wild PokÃ©mon in groups of 30 (I soft reset when I fill an entire PokÃ©mon box because I have only 50 balls, and my RNG, being my Ruby battery run dry, is broken);<br />2) In general, how the PokÃ©rus mechanics work in Gen 3 (but also in Gen 2, as it is not very clear yet)? Thatâ€™s a major obscure point in the PokÃ©mon community that I think it would be worth to research.<br />3) A strange situation occurred to me in PokÃ©mon Emerald (emulator): I caught a Wurmple with PokÃ©rus (through a Gameshark code) just to observe empirically how the mechanics work in Gen 3, then I put it second in my party behind a Mudkip (no PokÃ©rus). I then battled a Lotad (with codes disabled, this time), which I ended up capturing. I checked my party after the battle and I discovered that Mudkip had contracted PokÃ©rus, but not the newly captured Lotad (in third place in the party), which is weird. In fact, a PokÃ©mon in second place in the party, either spreads the PokÃ©rus, after a battle, to the first AND the third placed PokÃ©mon (even if the PokÃ©mon in third place has been caught in the battle itself), or doesnâ€™t spread it at all, and Iâ€™m sure of this because I observed it empirically. This made me think that Mudkip could have incredibly caught the PokÃ©rus (legitimately) from the Lotad that I had just caught.<br />This could mean that:<br />â€¢	The wild PokÃ©mon which triggers PokÃ©rus in your party is NOT itself a carrier, because Mudkip allegedly contracted it from Lotad, with Lotad itself not being affected;<br />â€¢	The PokÃ©rus mechanics in Gen 2 and Gen 3 are different, because in Gen 2 if a PokÃ©mon of your party already has PokÃ©rus, it will be impossible to contract it de novo after a battle from a wild PokÃ©mon, but it will only be spread through your party from the PokÃ©mon that was already affected instead. This would contradict the fact that even if my Wurmple was already affected and in the party, Mudkip still managed to contract PokÃ©rus de novo from the wild Lotad I ended up capturing;<br />â€¢	I oversaw something during the observation of what was happening (unlikely).<br />4) A noob question: I deposited in the PC my Mudkip a few minutes after it contracted PokÃ©rus and I then saved outside the PokÃ©mon Center. I have never withdrew it from the PC, but one evening, though, I put my Mudkip in the party to rapidly beat the game (just for fun) WITHOUT saving, and in the process I passed midnight (I spent 5 hours playing, from 8 p.m. to 1 a.m.). Having NOT saved the game (I reset the game a few seconds before Hall of Fame), and being thus again placed outside the PokÃ©mon Center with Mudkip in the PC as the last time I saved the game, does it count as a day has passed for Mudkipâ€™s PokÃ©rus counter or not?<br />An answer to these 4 questions will be greatly appreciated. Kind regards and good luck with all of your research!<br />[/quote]<br /><br />Hi. I&#039;m unsure how PokÃ©rus works and not sure of the answers to your questions either, sorry. :(<br /><br />I got the impression battling a PokÃ©mon only gives a chance (not 100%) of an existing PokÃ©rus spreading, but I don&#039;t know for sure. I don&#039;t know whether you can get it by catching a PokÃ©mon and how the time works (whether its dependent on the time from the battery for instance) as well.<br /><br />In Generation II PokÃ©rus is stored in a party PokÃ©mon&#039;s data structure. For example address DA46 in Gold/Silver modifies PokÃ©mon 1&#039;s PokÃ©rus flag. I&#039;m unsure if there&#039;s something to indicate PokÃ©rus on a wild PokÃ©mon though.<br /><br />Hope you can find the answers to your questions.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=8111.msg207283#msg207283 date=1508279514]<br />Hi.<br /><br />The modified addresses are as follows:<br /><br />FAF6, FAF5: HP EV (two bytes)<br />FAF7, FAF8: Attack EV (two bytes)<br />FAF9, FAFA: Defense EV (two bytes)<br />FAFB, FAFC: Speed EV (two bytes)<br />FAFD, FAFE: Special EV (two bytes)<br />FAE8: PokÃ©mon 4 Special Attack byte 1<br /><br />So it looks like I did make a mistake, sorry (with the name Ã©84Ã©.455).&nbsp; :-[<br /><br />The problem seems to lie in there being more than one ID for the &quot;.&quot; character. The hex ID was supposed to be F2 for the code to modify FAF2 (total experience byte 1) to FF (giving it 16711680 more experience, which is recalculated to Level 100), but in actuality you can only enter the E8 &quot;.&quot; (which would modify FAE8).<br /><br />I used the F2 character while testing without double checking if that would appear when entering &quot;.&quot; using the box names.<br /><br />To fix this you can wipe out the old box names with 5s except where your &#039;footer&#039; is, and use this one instead to modify PokÃ©mon 5&#039;s experience:<br /><br />Box 1: Ap0x&#039;v955&nbsp; (multiply small x from the uppercase field only)<br />Box 2: e&#039;m2p0955<br />Box 3: Ã©A455555<br />Box 4-Box 12 (or possibly just box up to all of box 6 in your case): 55555555<br /><br />This should work if your modified setup runs from box 1 character 2 (or box 1 character 1), which it possibly does.<br /><br />Hope this helps.<br />[/quote]<br /><br /><br />Pardon my ignorance, but why use filler (5s)?


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s kind of odd how pokerus mechanics haven&#039;t been truly documented anywhere. Has gen 3 been disassembled?


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=8113.msg207282#msg207282 date=1508277196]<br />I think due to a glitch &quot;Who&#039;s Online&quot; currently only shows one guest online, and everyone is stated to have the same IP (172.18.0.1). So in actuality we probably had more than 6 people online that day.<br /><br />I feel to say the site is dead is a misconception with new people occasionally posting to ask questions and things like that.<br />[/quote]<br /><br />Yep, it&#039;s been broken ever since there were significant server changes.<br /><br />I don&#039;t have enough information to assess the current state of the site but I don&#039;t think it&#039;s that inactive right now! :) <br /><br />[quote author=Couldntthinkofaname link=topic=8113.msg207286#msg207286 date=1508282381]<br />Has gen 3 been disassembled?<br />[/quote]<br /><br />It&#039;s getting there, at least.<br /><br />[url=https://github.com/pret/pokeruby]https://github.com/pret/pokeruby[/url]<br /><br />[url=https://github.com/pret/pokeemerald]https://github.com/pret/pokeemerald[/url]<br /><br />There are some early-stage and incomplete projects for a FireRed disassembly as well.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Torchickens, have you had a chance to test your max DV code? I&#039;m not knowledgeable in the code matters but I&#039;m sure there must be slight error somewhere as it doesn&#039;t give max DVs.


subject: Re: 4 questions about PokÃ©rus mechanics
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  I can answer question 4.<br /><br />Since you left your Mudkip in the PC, Pokerus time doesn&#039;t advance anyways, so it shouldn&#039;t count towards the remaining time for Pokerus.<br /><br />EDIT:&nbsp; Whoops my bad just re-read the question. As it stands, it is unlikely that the pokerus timer can stay the same across save files, and as such it shouldn&#039;t count as a day.<br /><br />


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Nostalgia link=topic=8111.msg207288#msg207288 date=1508316788]<br />Torchickens, have you had a chance to test your max DV code? I&#039;m not knowledgeable in the code matters but I&#039;m sure there must be slight error somewhere as it doesn&#039;t give max DVs.<br />[/quote]<br /><br />I tested it and it worked for changing PokÃ©mon 1&#039;s DVs all to 15, so it&#039;s possible you made a slight mistake somewhere. The x in the code here is the normal lower case one (not the multiplication x) and 0 is zero.<br /><br />[quote author=Couldntthinkofaname link=topic=8111.msg207285#msg207285 date=1508282244]<br />Pardon my ignorance, but why use filler (5s)?<br />[/quote]<br /><br />After the code, it will continue to run until it finds a &#039;d (ret nc). The 5s act as a safe ei instruction (enable interrupts) which effectively does nothing relevant here, as interrupts may already be enabled.<br /><br />The code I made is to be used after using FMK&#039;s one-off code, so the code needs to run safely to box 13 and box 14 where the footer code is. However if you use wrong-pocket TM/HM code execution it doesn&#039;t corrupt the stack and you can use a &#039;d directly after (or close-by to) the code.<br /><br />Generally codes which just have 5s until FMK&#039;s box 13 and box 14 names are a little easier to make.<br /><br />Less 5s are required if the code includes a means of bringing control back to the game without the need of FMK&#039;s one-off code, such as the above Shiny PokÃ©mon 1 code. I can make one more like that if you like.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=forsyz link=topic=6716.msg207079#msg207079 date=1506742228]<br />what letters in the box code are the address and the value it changes i want to use it like a memory editor<br />[/quote]<br /><br />Have a look at [url=http://forums.glitchcity.info/index.php?topic=6716.msg203426#msg203426]this post from torchickens[/url]<br />To construct the memory adress using Box names use the [s][url=http://glitchcity.info/wiki/The_Big_HEX_List]big hex list[/url][/s] (doesn&#039;t contain GSC characters) [url=http://pastebin.com/raw/arPmsvYu]linked Pastebin[/url] or sth. similar.<br /><br />[quote author=spamviech link=topic=6716.msg207063#msg207063 date=1506719094]<br />[quote author=Torchickens link=topic=6716.msg207051#msg207051 date=1506694948]<br />The first party address that the code starts to run is at FA98 (DA98). This is the second byte of the Attack stat experience of PokÃ©mon 3 (the slide PokÃ©mon).<br /><br />Following this is Defense, Speed, Special stat experience as well as DVs, PPs, happiness, PokÃ©rus, level, status, stats. You can probably predict whether the PokÃ©mon will work by looking at the stats but I don&#039;t know the details sadly.[/quote]<br />Since most of them are naturally hidden (statXP, happiness, etc.) prediction would be difficult I guess. At least statXP and happiness should be fixed at the start though, but I guess trial and error is good enough for now.<br />[/quote]<br /><br />Was tired of trial and error so I constructed a method to create a working slide-PokÃ©mon. You basically get the right amount of stat-Exp to pass the atk-stat and use jr $1F in the Def-stat to jump right to your fourth PokÃ©mon which should be the well-known Quagsire holding TM02 with Return as its first move.<br /><br />To do this take one newly caught PokÃ©mon and defeat exactly the following PokÃ©mon:<br />[list]<br />[li]1 Magicarp (use [b]Old Rod[/b] anywhere)[/li]<br />[li]7 Geodude (most common [b]Route 46[/b])[/li]<br />[li]10 Sunkern ([b]National Park, day time[/b])[/li]<br />[li]Give [b]2 Iron[/b] to your PokÃ©mon<br />[/list]<br /><br />This leaves your PokÃ©mon at 870 ($0366) Atk stat-Exp and 6175 ($181F) Def stat-Exp (rest is skipped).<br /><br />Starting at the second byte of the Atk stat-Exp this produces the following code:<br />[code]ld h,(hl)<br />jr $1F[/code]<br />Which then continues at PokÃ©mon 4 to jump to wherever you want.<br /><br />Hope this helps anyone having trouble catching a working slide PokÃ©mon. This way, as long as you don&#039;t defeat any PokÃ©mon afterwards (Exp. Share counts) your Slide-PokÃ©mon will continue working, regardless of Happiness, moves, or anything else.<br />Disadvantage obviously is the time it takes to set up, but this could in theory be improved (use always-available PokÃ©mon instead of Sunkern, use PokÃ©mon with higher Stat-Exp/Base stats in defence).<br />You could use 10 Geodude, 1 Magicarp and 2 Irons to achieve the same Def-Stat-Exp (and therefore the same jump), but it would produce a ld (hl), a in the executed Atk-byte so I would advice against it.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow, thanks for this spamviech. :) Yeah, the slide PokÃ©mon has been a problem for lots of people. Will try it out later.<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207291#msg207291 date=1508336468]<br />[quote author=forsyz link=topic=6716.msg207079#msg207079 date=1506742228]<br />what letters in the box code are the address and the value it changes i want to use it like a memory editor<br />[/quote]<br /><br />Have a look at [url=http://forums.glitchcity.info/index.php?topic=6716.msg203426#msg203426]this post from torchickens[/url]<br />To construct the memory adress using Box names use the [s][url=http://glitchcity.info/wiki/The_Big_HEX_List]big hex list[/url][/s] (doesn&#039;t contain GSC characters) [url=http://pastebin.com/raw/arPmsvYu]linked Pastebin[/url] or sth. similar.<br /><br />[quote author=spamviech link=topic=6716.msg207063#msg207063 date=1506719094]<br />[quote author=Torchickens link=topic=6716.msg207051#msg207051 date=1506694948]<br />The first party address that the code starts to run is at FA98 (DA98). This is the second byte of the Attack stat experience of PokÃ©mon 3 (the slide PokÃ©mon).<br /><br />Following this is Defense, Speed, Special stat experience as well as DVs, PPs, happiness, PokÃ©rus, level, status, stats. You can probably predict whether the PokÃ©mon will work by looking at the stats but I don&#039;t know the details sadly.[/quote]<br />Since most of them are naturally hidden (statXP, happiness, etc.) prediction would be difficult I guess. At least statXP and happiness should be fixed at the start though, but I guess trial and error is good enough for now.<br />[/quote]<br /><br />Was tired of trial and error so I constructed a method to create a working slide-PokÃ©mon. You basically get the right amount of stat-Exp to pass the atk-stat and use jr $1F in the Def-stat to jump right to your fourth PokÃ©mon which should be the well-known Quagsire holding TM02 with Return as its first move.<br /><br />To do this take one newly caught PokÃ©mon and defeat exactly the following PokÃ©mon:<br />[list]<br />[li]1 Magicarp (use [b]Old Rod[/b] anywhere)[/li]<br />[li]7 Geodude (most common [b]Route 46[/b])[/li]<br />[li]10 Sunkern ([b]National Park, day time[/b])[/li]<br />[li]Give [b]2 Iron[/b] to your PokÃ©mon<br />[/list]<br /><br />This leaves your PokÃ©mon at 870 ($0366) Atk stat-Exp and 6175 ($181F) Def stat-Exp (rest is skipped).<br /><br />Starting at the second byte of the Atk stat-Exp this produces the following code:<br />[code]ld h,(hl)<br />jr $1F[/code]<br />Which then continues at PokÃ©mon 4 to jump to wherever you want.<br /><br />Hope this helps anyone having trouble catching a working slide PokÃ©mon. This way, as long as you don&#039;t defeat any PokÃ©mon afterwards (Exp. Share counts) your Slide-PokÃ©mon will continue working, regardless of Happiness, moves, or anything else.<br />Disadvantage obviously is the time it takes to set up, but this could in theory be improved (use always-available PokÃ©mon instead of Sunkern, use PokÃ©mon with higher Stat-Exp/Base stats in defence).<br />You could use 10 Geodude, 1 Magicarp and 2 Irons to achieve the same Def-Stat-Exp (and therefore the same jump), but it would produce a ld (hl), a in the executed Atk-byte so I would advice against it.<br />[/quote]<br /><br />I was looking into this aswell coincidently. My conclusion was 3 irons and 7 Exeggcutes.<br /><br />Thats 280 att xp and 8240 def xp. Or $0118 att and $2030 def. Since the first byte of att doesnt matter that makes jr 20<br /><br />4 slowpoke and 2 shuckle should also work.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=8111.msg207290#msg207290 date=1508333477]<br /><br />I tested it and it worked for changing PokÃ©mon 1&#039;s DVs all to 15, so it&#039;s possible you made a slight mistake somewhere. The x in the code here is the normal lower case one (not the multiplication x) and 0 is zero.<br />[/quote]<br /><br />[img]http://i.picresize.com/images/2017/10/18/smfQY.jpg[/img]<br />[img]http://i.picresize.com/images/2017/10/18/He9X.jpg[/img]<br />[img]http://i.picresize.com/images/2017/10/18/4K0yb.jpg[/img]<br /><br />Well I tried again, but it didn&#039;t work. Screenshots with the correct box names and the last screenshot is my current party, the Togepi at the top is a clone of the slide Togepi in slot 3 which I performed the glitch on, but it did not max the DVs as you can see they both have 19HP, max DVs would be 20HP for a level 5 Togepi. I also performed the glitch on the Magikarp at the bottom of the party, but nothing. The glitch is only doing what I reported before - making a slight change to the DVs (turning female Pokemon male, so weirdly only affecting the Attack stat slightly, but not maxing them out) I&#039;m using the DV calculator to determine what the max DVs would be. <br /><br />http://www.psypokes.com/gsc/dv.php


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207292#msg207292 date=1508341443]<br />Wow, thanks for this spamviech. :) Yeah, the slide PokÃ©mon has been a problem for lots of people. Will try it out later.<br />[/quote]<br /><br />Was a problem for me as well, so kind of necessary. Also I somewhat enjoyed poking around here a bit.<br /><br />Another question:<br />in several codes presented [url=http://forums.glitchcity.info/index.php?topic=6716.msg206982#msg206982]here (i.e. the Celebi code)[/url] you change memory at the adress $fa2a, but according to the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold_and_Silver:RAM_map#Party_Pokemon]ram map from data crystal[/url] the species is stored at $da2a.<br />Is there a mismatch, or are the last two bits simply ignored?<br /><br />[quote author=Skeef link=topic=6716.msg207293#msg207293 date=1508347109]I was looking into this aswell coincidently. My conclusion was 3 irons and 7 Exeggcutes.<br /><br />Thats 280 att xp and 8240 def xp. Or $0118 att and $2030 def. Since the first byte of att doesnt matter that makes jr 20<br /><br />4 slowpoke and 2 shuckle should also work.<br />[/quote]<br />Tried that first as well, but was tired of keeping track of two stats so I just fitted the Def-stat and hoped for the best with Atk.&nbsp; ;D<br /><br />7 Exeggcutes sounds like a pain. Isn&#039;t it pure headbutt-encounter?<br />4 Slowpoke and 2 Shuckle sounds doable, but requires Surf to get Slowpoke with &gt;15% probability. Since it&#039;s not too far after Coin Case (story wise) I don&#039;t think it&#039;s a problem.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  So I can simply use whichever I like and achieve the same thing? (don&#039;t want to dive too deep into gameboy specifics)<br />Sounds really useful since [i]da[/i] has no valid character whereas [i]fa[/i] is easily usable with [b]4[/b].<br /><br />Thanks for the reply.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207295#msg207295 date=1508348092]<br />7 Exeggcutes sounds like a pain. Isn&#039;t it pure headbutt-encounter?<br />4 Slowpoke and 2 Shuckle sounds doable, but requires Surf to get Slowpoke with &gt;15% probability. Since it&#039;s not too far after Coin Case (story wise) I don&#039;t think it&#039;s a problem.<br />[/quote]<br /><br />To be honest the whole process sounds like a pain. <br /><br />I don&#039;t know if it&#039;s just me, but every Pokemon I have hatched from a egg has worked as a slide Pokemon and I find the Togepi you get especially useful as you can get it before you get to Goldenrod. So personally, I don&#039;t see the need for this long process to get the ultimate slide Pokemon. My egg-hatched slide Pokemon work perfectly after many many uses of the coin case.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Because it&#039;s consistent and eliminates at least one source of error.<br /><br />Obviously, this is nothing for a speedrun and if you prefer to roll the dice the option is still there.<br />This one is more for us fellows with large streaks of bad (rng-)luck. Like, I prefer doing such a tedious (but guaranteed) process compared to catching a bunch of mons without even the guarantee for it to succed.<br />Ultimately it probably comes down to personal preference which is perfectly fine with me.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207297#msg207297 date=1508349776]<br />So I can simply use whichever I like and achieve the same thing? (don&#039;t want to dive too deep into gameboy specifics)<br />Sounds really useful since [i]da[/i] has no valid character whereas [i]fa[/i] is easily usable with [b]4[/b].<br /><br />Thanks for the reply.<br />[/quote]<br /><br />No problem. Not every address can be represented with Echo Ram though. Thankfully, the main ones (Pokemon data,item data,etc.) are in ECHO Ram somewhere. I have yet to find an echo ram map, however.<br /><br />Someone correct me if i&#039;m wrong, but I believe any address from $d000 - $dfff is in echo ram somewhere.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207300#msg207300 date=1508354005]No problem. Not every address can be represented with Echo Ram though. Thankfully, the main ones (Pokemon data,item data,etc.) are in ECHO Ram somewhere. I have yet to find an echo ram map, however.<br /><br />Someone correct me if i&#039;m wrong, but I believe any address from $d000 - $dfff is in echo ram somewhere.<br />[/quote]<br /><br />Nice, thanks.&nbsp; :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Storyreader21
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Does it matter what level the freshly caught pokemon you defeat the magikarp, geodude, sunkern, and give the iron too is?


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m just wondering, but did you make the game recalculate the stats ? AFAIK that&#039;s doable by both depositing then withdrawing (not sure about Move w/o mail), or leveling up.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207301#msg207301 date=1508355812]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207300#msg207300 date=1508354005]No problem. Not every address can be represented with Echo Ram though. Thankfully, the main ones (Pokemon data,item data,etc.) are in ECHO Ram somewhere. I have yet to find an echo ram map, however.<br /><br />Someone correct me if i&#039;m wrong, but I believe any address from $d000 - $dfff is in echo ram somewhere.<br />[/quote]<br /><br />Nice, thanks.&nbsp; :)<br />[/quote]<br />Echo RAM is a quirk of the GB&#039;s hardware ; tl;dr : WRAM (the RAM mapped to C000-DFFF) is mirrored in range E000-FDFF, meaning accessing FAB0 (both reading and writing) is the same as accessing DAB0 !<br />The downside is that DE00-DFFF can&#039;t be accessed through Echo RAM (FEXX and FFXX are mapped to other things), but that doesn&#039;t really matter most of the time (stack space occupies DFXX, and DEXX isn&#039;t important afaik).<br /><br />Also, VBA doesn&#039;t emulate Echo RAM.<br />VBA sucks.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Storyreader21 link=topic=6716.msg207302#msg207302 date=1508363208]<br />Does it matter what level the freshly caught pokemon you defeat the magikarp, geodude, sunkern, and give the iron too is?<br />[/quote]<br /><br />No, just that it&#039;s stat-Exp is at 0 before the fights (i.e. didn&#039;t win a fight before).<br />I would advice for a level of ~15 or higher so it can solo the fights (don&#039;t know how stat-Exp behaves if you use switch tactics), but ultimately it doesn&#039;t matter. You only need to make sure that it doesn&#039;t have PokÃ©rus, since it doubles aquired stat-Exp and messes up calculations.<br />For reference I used a lvl 13 Miltank.<br />The mentioned PokÃ©mon are quite weak, so anything in that powerlevel should have no problems defeating them.<br /><br />[quote author=ISSOtm link=topic=6716.msg207304#msg207304 date=1508366662]<br />Echo RAM is a quirk of the GB&#039;s hardware ; tl;dr : WRAM (the RAM mapped to C000-DFFF) is mirrored in range E000-FDFF, meaning accessing FAB0 (both reading and writing) is the same as accessing DAB0 !<br />The downside is that DE00-DFFF can&#039;t be accessed through Echo RAM (FEXX and FFXX are mapped to other things), but that doesn&#039;t really matter most of the time (stack space occupies DFXX, and DEXX isn&#039;t important afaik).<br /><br />Also, VBA doesn&#039;t emulate Echo RAM.<br />VBA sucks.<br />[/quote]<br /><br />Yay, tl;dr. Love those.&nbsp; ;D<br />Also nice hardware quirk. As if it was designed with box name ACE in mind.&nbsp; ::)


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  Well it worked from doing that. :) Kinda makes sense because I remember using ws m in Yellow for max DVs and that involved depositing and withdrawing the Pokemon after the code. Though to avoid confusion for others, maybe it should be written in the OP to deposit and withdraw the Pokemon afterwards. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=ISSOtm link=topic=6716.msg207304#msg207304 date=1508366662]<br />VBA sucks.<br />[/quote]<br /><br />I second that.<br /><br />&lt;rant&gt;<br /><br />I used to use VBA for glitch research, and it was a nightmare. [b]Tons[/b] of glitches were Unavailable/Weren&#039;t working properly, including Dokashira door, Coin case,Glitch Dimension, and many others, not to mention the debugger was garbage (you couldn&#039;t write anything in the debugger, you had to write code from the Hex Editor)<br /><br />If your &quot;emulator&quot; cannot accurately emulate the target hardware, then your software should not be considered a true emulator.<br /><br />&lt;/rant&gt;<br /><br />I realize that in posting this I may have derailed the topic, so here&#039;s a code just to be safe:<br /><br />Masterball in ball slot 2:<br />Box 1: Ap&#039;v9Ã©9&#039;t5<br />Box 2: p&#039;d555555<br /><br />This for use with TM25 in the ball slot, not the coin case. Tested and confirmed to work.


subject: Re: PokÃ©mon glitch 'haxxed' moments
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Was doing pomeg glitch on hardware for the first time. I used Mudkip as my second fainted pokemon, and on this particular day, I had my headphones plugged in at max volume. Everything was going great until I viewed Mudkip&#039;s stats, in which the game decided to softlock and [b]blare[/b] glitch sounds in my ears.<br /><br />Ouch.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Storyreader21
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey I just did a coin case glitch for shiny pokemon I got from youtube with the item list: &nbsp;<br /><br />Any x1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />Any x62 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />TM 42 x1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />Any x1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />X Accuracy x63 &nbsp; &nbsp; &nbsp;<br />TM 27 x1 &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;<br />Any x1 &nbsp;<br />Leaf Stone x1&nbsp; &nbsp;<br />Any x1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />Poke Ball x62 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />Sun Stone x1 &nbsp;<br />Any x1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />TM 07 x1 &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;<br />Focus Band x1&nbsp; &nbsp; &nbsp;<br />HM 03 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />Full Heal x18 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />Blu Apricorn x1<br />Any Item x1<br />NeverMeltIce x1<br />Any Item x1 &nbsp; &nbsp;<br />X Defend x1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />Flower Mail x51 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />TM 06 x1&nbsp; &nbsp;<br />Any x1 &nbsp;<br />TM 41 x1 &nbsp;<br /><br />when I did it it turned my female pokemon male, which means the attack dv was high, how can I modify the item list so the attack dv is 2 which makes most pokemon in Gold female, but is still shiny?<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Storyreader21 link=topic=6716.msg207310#msg207310 date=1508436913]<br />Hey I just did a coin case glitch for shiny pokemon I got from youtube with the item list:&nbsp; <br /><br />Any x1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Any x62&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />TM 42 x1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  <br />Any x1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />X Accuracy x63&nbsp; &nbsp; &nbsp; <br />TM 27 x1&nbsp; &nbsp; &nbsp; &nbsp;  <br />Any x1&nbsp; <br />Leaf Stone x1&nbsp;  <br />Any x1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Poke Ball x62&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Sun Stone x1&nbsp; <br />Any x1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />TM 07 x1&nbsp; &nbsp; &nbsp; &nbsp;  <br />Focus Band x1&nbsp; &nbsp;  <br />HM 03&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Full Heal x18&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Blu Apricorn x1<br />Any Item x1<br />NeverMeltIce x1<br />Any Item x1&nbsp; &nbsp; <br />X Defend x1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />Flower Mail x51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br />TM 06 x1&nbsp;  <br />Any x1&nbsp; <br />TM 41 x1&nbsp; <br /><br />when I did it it turned my female pokemon male, which means the attack dv was high, how can I modify the item list so the attack dv is 2 which makes most pokemon in Gold female, but is still shiny?<br />[/quote]<br /><br />Just change TM42 into Super Repel


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: hobgoblinpie
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: hobgoblinpie
icon: xx
body:
  How would one go about modifying the EVs to maximum? Modifying the code for Rare Candies/Masterballs to place HP UP/Protein/Carbos etc. works up until 25600, but since EVs max out at 65535, it&#039;s still off by a way. I know there&#039;s one that exists already, but I think one that doesn&#039;t immediately boost to level 100 would be good too.<br /><br />Also slightly strange, changing the Box 2 code from &#039;p0B&#039;vAÃ©7&#039;t&#039; (255x Master Balls) to &#039;p0&#039;t&#039;vAÃ©7&#039;t&#039; should yield PP Ups, but instead yields Red Aprikorns. Would a code to modify the quantity of an item in say bag slot 1, without modifying the item itself?<br /><br />Appreciate all the work you guys do, it&#039;s really impressive.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=hobgoblinpie link=topic=6716.msg207313#msg207313 date=1508453522]<br />How would one go about modifying the EVs to maximum? Modifying the code for Rare Candies/Masterballs to place HP UP/Protein/Carbos etc. works up until 25600, but since EVs max out at 65535, it&#039;s still off by a way. I know there&#039;s one that exists already, but I think one that doesn&#039;t immediately boost to level 100 would be good too.<br /><br />Also slightly strange, changing the Box 2 code from &#039;p0B&#039;vAÃ©7&#039;t&#039; (255x Master Balls) to &#039;p0&#039;t&#039;vAÃ©7&#039;t&#039; should yield PP Ups, but instead yields Red Aprikorns. Would a code to modify the quantity of an item in say bag slot 1, without modifying the item itself?<br /><br />Appreciate all the work you guys do, it&#039;s really impressive.<br />[/quote]<br /><br />Regarding question 1: <br />Box 1: A09Ã©(female symbol)455<br />Box 2: Ã©04Ã©1455<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©7455<br />Box 6: Ã©84p&#039;d555<br /><br />This is a slightly modified version of Torchicken&#039;s code.<br /><br />Also, this doesn&#039;t work with the coin case, only TM25 in the balls pocket<br /><br />Regarding question 2: Can you please post the entire box code? Box 2 loads register a into $f6af, but register a was defined in box 1.<br /><br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  Finished a code to create a Celebi with its usual egg moves (Leech Seed, Recover, Confusion, Heal Bell).<br />Just to make it easier to get a legal moveset once PokÃ©mon Bank finally comes to Gold/Silver VC.<br /><br />[s]First you need to run FMK&#039;s one-off code (if you haven&#039;t done so already).[/s] (No longer required)<br />[quote author=FMK link=topic=6716.msg206982#msg206982 date=1506371666]<br />[/quote]<br /><br />Afterwards, use the following code [b]twice[/b], which on the second run will change your first PokÃ©mon into Celebi with the moves Leech Seed, Recover, Confusion &amp; Heal Bell.<br />[code]<br /><br />Box 1($D8BF to $D8C7): Ap0b&#039;vA55		(XOR A; OR a1; SUB 80 | A-&gt;21)<br />Box 2($D8C8 to $D8D0): Ã©&#039;l2p0555		(LD [d1f8], A; XOR A; OR fb | A-&gt;fb)<br />Box 3($D8D1 to $D8D9): ^^4~__55			({LD HL, [{2a}fa]}; {LD [HL], A}; {INC HL}; {INC HL} | HL-&gt;fa2a; HL-&gt;fa2c)<br />Box 4($D8DA to $D8E2): 55p0&#039;d&#039;vH~		(XOR A; OR d0; SUB 87; {LD [HL], A} | A-&gt;49)<br />Box 5($D8E3 to $D8EB): _p0/&#039;vK~_		({INC HL}; XOR A; OR f3; SUB 84; {LD [HL], A}; {INC HL} | HL-&gt;fa2d; A-&gt;69; HL-&gt;fa2e)<br />Box 6($D8EC to $D8F4): 55p&#039;vd~5_		(XOR A; SUB a3; {LD [HL], A}; {INC HL} | A-&gt;5d; HL-&gt;fa2f)<br />Box 7($D8F5 to $D8FD): p0X0&#039;d~&#039;vu		(XOR A; OR 97; OR d0; {LD [HL], A}; SUB b4 | A-&gt;d7; A-&gt;23)<br />Box 8($D8FE to $D906): Ã©&#039;t2Ã©&#039;v255		(LD [d5f8], A; LD [d6f8], A)<br />Box 9($D907 to $D90F): Ã©-2Ã©Ã©255			(LD [e3f8], A; LD [eaf8], A)<br />Box10($D910 to $D918): Ã©/2&#039;vmÃ©&#039;s2		(LD [f3f8], A; SUB ac; LD [d4f8], A | A-&gt;77)<br />Box11($D919 to $D921): Ã©(Pk)2Ã©&amp;255		(LD [e1f8], A; LD [e9f8], A)<br />Box12($D922 to $D92A): Ã©Ã—2Ã©425p			(LD [f2f8], A; LD [faf8], A; XOR A | A-&gt;00)<br />Box13($D92B to $D933): Ã©ZÃ—&#039;v&#039;vÃ©&#039;m2		(LD [99f1], A; SUB d6; LD [d2f8], A | A-&gt;2a)<br />Box14($D934 to $D93c): .9&#039;l&#039;l&#039;l&#039;lx&#039;d	(ADD SP, ff; POP DE; POP DE; POP DE; POP DE; OR A; RET NC)<br />[/code]<br />You still need to give it to the day care/hatch the egg to get a &quot;proper&quot; Celebi.<br />Edit: changed to reduce menu-lag on execution and remove&nbsp; requirement for one-off code.<br /><br />[s][b]Note:[/b]<br />Due to space requirements I changed the name of Box 13. You have to [b]change it back[/b] to the one-off code name [b]when using a different code[/b].<br />Also: don&#039;t touch the name of Box 14![/s]<br /><br /><br />Edit:<br />If you use TM25 (or TM17, I&#039;m not discriminating) from the balls pocket use the following code instead:<br />[code]<br />Box 1($D8BF to $D8C7): Ap0b&#039;vA55	(XOR A; OR a1; SUB 80 | A-&gt;21)<br />Box 2($D8C8 to $D8D0): Ã©&#039;l2p0555	(LD [d1f8], A; XOR A; OR fb | A-&gt;fb)<br />Box 3($D8D1 to $D8D9): ^^4~__55		({LD HL, [{2a}fa]}; {LD [HL], A}; {INC HL}; {INC HL} | HL-&gt;fa2a; HL-&gt;fa2c)<br />Box 4($D8DA to $D8E2): 55p0&#039;d&#039;vH~	(XOR A; OR d0; SUB 87; {LD [HL], A} | A-&gt;49)<br />Box 5($D8E3 to $D8EB): _p0/&#039;vK~_	({INC HL}; XOR A; OR f3; SUB 84; {LD [HL], A}; {INC HL} | HL-&gt;fa2d; A-&gt;69; HL-&gt;fa2e)<br />Box 6($D8EC to $D8F4): 55p&#039;vd~5_	(XOR A; SUB a3; {LD [HL], A}; {INC HL} | A-&gt;5d; HL-&gt;fa2f)<br />Box 7($D8F5 to $D8FD): p0X0&#039;d~&#039;vu	(XOR A; OR 97; OR d0; {LD [HL], A}; SUB b4 | A-&gt;d7; A-&gt;23)<br />Box 8($D8FE to $D906): Ã©&#039;t2Ã©&#039;v255	(LD [d5f8], A; LD [d6f8], A)<br />Box 9($D907 to $D90F): Ã©-2Ã©Ã©255		(LD [e3f8], A; LD [eaf8], A)<br />Box10($D910 to $D918): Ã©/2&#039;vmÃ©&#039;s2	(LD [f3f8], A; SUB ac; LD [d4f8], A | A-&gt;77)<br />Box11($D919 to $D921): Ã©(Pk)2Ã©&amp;255	(LD [e1f8], A; LD [e9f8], A)<br />Box12($D922 to $D92A): Ã©Ã—2Ã©425p		(LD [f2f8], A; LD [faf8], A; XOR A | A-&gt;00)<br />Box13($D92B to $D933): &#039;v&#039;vÃ©&#039;m25x&#039;d	(SUB d6; LD [d2f8], A; OR A; RET NC | A-&gt;2a)[/code]<br />Box14 can be left blank/doesn&#039;t matter.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s good stuff, I found this video helpful for getting Celebi&#039;s egg moves though:<br /><br />https://www.youtube.com/watch?v=KdpbBYio-T0


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207315#msg207315 date=1508504675]<br />Finished a code to create a Celebi with its usual egg moves (Leech Seed, Recover, Confusion, Heal Bell).<br />Just to make it easier to get a legal moveset once PokÃ©mon Bank finally comes to Gold/Silver VC.<br /><br />First you need to run FMK&#039;s one-off code (if you haven&#039;t done so already).<br />[quote author=FMK link=topic=6716.msg206982#msg206982 date=1506371666]<br />[code][REQUIRED] One-off code so all future codes don&#039;t need the &#039;return to game&#039; code:<br />Box 1 : Ap0w&#039;vA55&nbsp; &nbsp; (XOR A; OR b6; SUB 0x80)<br />Box 2 : Ã©&#039;m2p&#039;v7&#039;v&#039;d (LD [d2f8], A; XOR A; SUB fd; SUB d0)<br />Box 3 : Ã©A355555&nbsp; &nbsp;  (LD [80f9], A)<br />Box 4+: 55555555&nbsp; &nbsp;  (Safe filler code)<br />Box 13: 5555pÃ©D9&nbsp; &nbsp;  (XOR A; LD [83ff], A)<br />Box 14: &#039;l&#039;lA&#039;lx&#039;d55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)[/code]<br />[/quote]<br /><br />Afterwards, use the following code [b]twice[/b], which on the second run will change your first PokÃ©mon into Celebi with the moves Leech Seed, Recover, Confusion &amp; Heal Bell.<br />[code]<br />Box 1($D8BF to $D8C7): Ap0b&#039;vA55	(XOR A; OR a1; SUB 80 | A-&gt;21)<br />Box 2($D8C8 to $D8D0): Ã©&#039;l2p0555	(LD [d1f8], A; XOR A; OR fb | A-&gt;fb)<br />Box 3($D8D1 to $D8D9): 55455555		({LD HL, [{2a}fa]}; {LD [HL], A}; {INC HL}; {INC HL} | HL-&gt;fa2a; HL-&gt;fa2c)<br />Box 4($D8DA to $D8E2): 55p0&#039;d&#039;vH5	(XOR A; OR d0; SUB 87; {LD [HL], A} | A-&gt;49)<br />Box 5($D8E3 to $D8EB): 5p0/&#039;vK55	({INC HL}; XOR A; OR f3; SUB 84; {LD [HL], A}; {INC HL} | HL-&gt;fa2d; A-&gt;69; HL-&gt;fa2e)<br />Box 6($D8EC to $D8F4): 55p&#039;vd555	(XOR A; SUB a3; {LD [HL], A}; {INC HL} | A-&gt;5d; HL-&gt;fa2f)<br />Box 7($D8F5 to $D8FD): p0X0&#039;d5&#039;vu	(XOR A; OR 97; OR d0; {LD [HL], A}; SUB b4 | A-&gt;d7; A-&gt;23)<br />Box 8($D8FE to $D906): Ã©&#039;t2Ã©&#039;v255	(LD [d5f8], A; LD [d6f8], A)<br />Box 9($D907 to $D90F): Ã©-2Ã©Ã©255		(LD [e3f8], A; LD [eaf8], A)<br />Box10($D910 to $D918): Ã©/2&#039;vmÃ©&#039;s2	(LD [f3f8], A; SUB ac; LD [d4f8], A | A-&gt;77)<br />Box11($D919 to $D921): Ã©(Pk)2Ã©&amp;255	(LD [e1f8], A; LD [e9f8], A | (Pk) is the character spelling Pk)<br />Box12($D922 to $D92A): Ã©Ã—2Ã©425p		(LD [f2f8], A; LD [faf8], A; XOR A | A-&gt;00 | Ã— is the multiplication sign)<br />Box13($D92B to $D933): Ã©D9&#039;v&#039;vÃ©&#039;m2	(LD [83ff], A; SUB d6; LD [d2f8], A | A-&gt;2a)<br />Box14($D934 to $D93c): &#039;l&#039;lÃ¤&#039;lx&#039;d55	(POP DE; POP DE; INC SP; POP DE; OR A; RET NC | LEAVE UNCHANGED!)<br />[/code]<br />You still need to give it to the day care/hatch the egg to get a &quot;proper&quot; Celebi.<br /><br />[b]Note:[/b]<br />Due to space requirements I changed the name of Box 13. You have to [b]change it back[/b] to the one-off code name [b]when using a different code[/b].<br />Also: don&#039;t touch the name of Box 14!<br />[/quote]<br /><br />That&#039;s awesome! Nice work!<br /><br />It&#039;s worth noting that if you use TM 25 in the balls pocket as opposed to the Coin case, it is not required to use FMK&#039;s one-off code. (At least, not for me)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207308#msg207308 date=1508416243]<br />[quote author=ISSOtm link=topic=6716.msg207304#msg207304 date=1508366662]<br />VBA sucks.<br />[/quote]<br /><br />I second that.<br /><br />&lt;rant&gt;<br /><br />I used to use VBA for glitch research, and it was a nightmare. [b]Tons[/b] of glitches were Unavailable/Weren&#039;t working properly, including Dokashira door, Coin case,Glitch Dimension, and many others, not to mention the debugger was garbage (you couldn&#039;t write anything in the debugger, you had to write code from the Hex Editor)<br /><br />If your &quot;emulator&quot; cannot accurately emulate the target hardware, then your software should not be considered a true emulator.<br />[/quote]<br /><br />To add to what was already said, the original VBA was last updated in 2004 so it shouldn&#039;t come off as a surprise that better emulators have come out such as current releases of BGB (first public version was [url=http://bgb.bircd.org/bgb03.zip]0.3[/url] in 2001) and mGBA.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=6716.msg207318#msg207318 date=1508508608]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207308#msg207308 date=1508416243]<br />[quote author=ISSOtm link=topic=6716.msg207304#msg207304 date=1508366662]<br />VBA sucks.<br />[/quote]<br /><br />I second that.<br /><br />&lt;rant&gt;<br /><br />I used to use VBA for glitch research, and it was a nightmare. [b]Tons[/b] of glitches were Unavailable/Weren&#039;t working properly, including Dokashira door, Coin case,Glitch Dimension, and many others, not to mention the debugger was garbage (you couldn&#039;t write anything in the debugger, you had to write code from the Hex Editor)<br /><br />If your &quot;emulator&quot; cannot accurately emulate the target hardware, then your software should not be considered a true emulator.<br />[/quote]<br /><br />To add to what was already said, the original VBA was last updated in 2004 so it shouldn&#039;t come off as a surprise that better emulators have come out such as current releases of BGB (first public version was [url=http://bgb.bircd.org/bgb03.zip]0.3[/url] in 2001) and mGBA.<br />[/quote]<br /><br />BGB is my personal choice and recomendation. Wonderful debugger and accurate emulation.<br /><br />What&#039;s mGBA? Never heard of it prior.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207319#msg207319 date=1508510289]<br />What&#039;s mGBA? Never heard of it prior.<br />[/quote]<br /><br />A modern alternative to VBA, especially since it started as a GBA emulator.<br /><br />[url=https://mgba.io/]https://mgba.io/[/url]<br /><br />The developer plans to rebrand mGBA as medusa in the near future because it will also emulate the DS. There is another new DS emulator as well called [url=http://melonds.kuribo64.net/]melonDS[/url] which supports Wi-Fi.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207316#msg207316 date=1508505757]<br />That&#039;s good stuff, I found this video helpful for getting Celebi&#039;s egg moves though:<br /><br />https://www.youtube.com/watch?v=KdpbBYio-T0<br />[/quote]<br /><br />You can easily create box name code to give it the moves one by one. Goal of this one was to have one do it all code though.<br />Also me confirming if it works like I think it does. :)<br /><br />[quote author=Couldntthinkofaname link=topic=6716.msg207317#msg207317 date=1508508294]<br />It&#039;s worth noting that if you use TM 25 in the balls pocket as opposed to the Coin case, it is not required to use FMK&#039;s one-off code. (At least, not for me)<br />[/quote]<br /><br />You probably don&#039;t need Box14 and the name of Box13 should be changed to this<br />[code]&#039;v&#039;vÃ©&#039;m25x&#039;d[/code]<br />As far as I understood the code is there to recover the stack to a reasonable enough state so you can save &amp; reset.<br /><br />Now I&#039;m not too familiar with the different methods, but as far as I&#039;m aware the stack isn&#039;t corrupted by using TM25 in the balls pocket (I should glitch me one there&nbsp; ;D).<br />Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)<br /><br />Edited my initial post to add this as well.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207321#msg207321 date=1508511952]<br />Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)<br />[/quote]<br /><br />I don&#039;t know precisely where it jumps first. When I get home, I&#039;ll breakpoint some addresses in BGB and see if I can find out what it does when used.<br /><br />My [b]guess[/b] is that when you use TM 25 in the balls pocket, it reads an invalid effect pointer (similar to 8f in R/B) and eventually reaches it&#039;s destination, but AFAIK it doesn&#039;t corrupt the stack.<br /><br />Something worth pointing out is that it eventually leads to Pokemon slot 2, not 3. So if you decide to use this method, move your slide and Quagsire up one slot.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: hobgoblinpie
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207314#msg207314 date=1508458903]<br />[quote author=hobgoblinpie link=topic=6716.msg207313#msg207313 date=1508453522]<br />How would one go about modifying the EVs to maximum? Modifying the code for Rare Candies/Masterballs to place HP UP/Protein/Carbos etc. works up until 25600, but since EVs max out at 65535, it&#039;s still off by a way. I know there&#039;s one that exists already, but I think one that doesn&#039;t immediately boost to level 100 would be good too.<br /><br />Also slightly strange, changing the Box 2 code from &#039;p0B&#039;vAÃ©7&#039;t&#039; (255x Master Balls) to &#039;p0&#039;t&#039;vAÃ©7&#039;t&#039; should yield PP Ups, but instead yields Red Aprikorns. Would a code to modify the quantity of an item in say bag slot 1, without modifying the item itself?<br /><br />Appreciate all the work you guys do, it&#039;s really impressive.<br />[/quote]<br /><br />Regarding question 1: <br />Box 1: A09Ã©(female symbol)455<br />Box 2: Ã©04Ã©1455<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©7455<br />Box 6: Ã©84p&#039;d555<br /><br />This is a slightly modified version of Torchicken&#039;s code.<br /><br />Also, this doesn&#039;t work with the coin case, only TM25 in the balls pocket<br /><br />Regarding question 2: Can you please post the entire box code? Box 2 loads register a into $f6af, but register a was defined in box 1.<br />[/quote]<br /><br />Thanks, I really appreciate it! I modified it slightly so that it works with the Coin Case ACE (Ap09Ã©â™€45), only a minor change but I already have that one set up so it seemed worth doing.<br /><br />In regards to the second point, this is the original code for 255x Master Balls in Ball Slot 1:<br /><br />Ap09Ã©8&#039;t5&nbsp; <br />p0B&#039;vAÃ©7&#039;t <br />p555&#039;v7&#039;v&#039;d<br />Ã©(male)2pÃ©D9&#039;l<br />&#039;l5555555<br />555A&#039;lx&#039;d<br /><br />With the third letter/number in Box 2&#039;s name changing the given item. Most seem to work, given that they are all offset to begin at 0x81, with &#039;v being the last usable character in that block (BF). Rare Candy is indexed 32 positions higher, so requires the letter &#039;a&#039;. PP Up is indexed 30 positions after Rare Candy so should require the character &#039;t, but using &#039;t gives Red Apricon, which is a little strange. <br /><br />Thanks again!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  From my understanding, what the code does is take the character&#039;s hex value, subtract $80, and use the end result as the item.<br /><br />&#039;t ($d5) - ($80) = $55, which should return Red Apricorns.<br /><br />Unfortunately, The hex value of PP Ups ($3e) + ($80) = ($BE), which is not able to be represented as a valid character.<br /><br />If you would like, i can alter the code to produce PP Ups.<br /><br />Edit: Change box 2 to p0&#039;v&#039;vYÃ©7&#039;t <br /><br />Hope this helps!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: hobgoblinpie
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207324#msg207324 date=1508528760]<br />From my understanding, what the code does is take the character&#039;s hex value, subtract $80, and use the end result as the item.<br /><br />&#039;t ($d5) - ($80) = $55, which should return Red Apricorns.<br /><br />Unfortunately, The hex value of PP Ups ($3e) + ($80) = ($BE), which is not able to be represented as a valid character.<br /><br />If you would like, i can alter the code to produce PP Ups.<br /><br />Edit: Change box 2 to p0&#039;v&#039;vYÃ©7&#039;t <br /><br />Hope this helps!<br />[/quote]<br /><br />Thanks man, you&#039;re a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I&#039;m trying to learn. If you don&#039;t mind, could you explain what the changed Box 2 does differently to the previous one?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=hobgoblinpie link=topic=6716.msg207325#msg207325 date=1508530930]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207324#msg207324 date=1508528760]<br />From my understanding, what the code does is take the character&#039;s hex value, subtract $80, and use the end result as the item.<br /><br />&#039;t ($d5) - ($80) = $55, which should return Red Apricorns.<br /><br />Unfortunately, The hex value of PP Ups ($3e) + ($80) = ($BE), which is not able to be represented as a valid character.<br /><br />If you would like, i can alter the code to produce PP Ups.<br /><br />Edit: Change box 2 to p0&#039;v&#039;vYÃ©7&#039;t <br /><br />Hope this helps!<br />[/quote]<br /><br />Thanks man, you&#039;re a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I&#039;m trying to learn. If you don&#039;t mind, could you explain what the changed Box 2 does differently to the previous one?<br />[/quote]<br /><br />Absolutely! The new box 2 code subtracts $D6 with $98 to get $3E, the hex for PP Ups.<br /><br />Make sure to take this into account when adjusting the code for different items.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=hobgoblinpie link=topic=6716.msg207325#msg207325 date=1508530930]<br />Thanks man, you&#039;re a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I&#039;m trying to learn. If you don&#039;t mind, could you explain what the changed Box 2 does differently to the previous one?<br />[/quote]<br /><br />Basically a different calculation. The Ã©7&#039;t part present in both is writing the value currently in register A to the specified location which is the type of the first item (judging from the original&nbsp; code in the balls pocket; you might need to adjust this, too).<br /><br /><br />Now for the calculations itself:<br />[code]p0B&#039;vA (XOR A; OR 81; SUB 80)<br /><br />p0&#039;v&#039;vY (XOR A; OR d6; SUB 98)<br />[/code]<br />All Instructions are evaluated against register A and you can look them up in [url=http://pastebin.com/raw/arPmsvYu]Sanqui&#039;s Pastebin[/url].<br />XOR A (character p) is basically an elaborate way to set register A to the value 0.<br />OR (character 0) takes the next character as argument and with A currently at the value of 0 the argument becomes the new value of A (here: 81 and d6).<br />SUB (character &#039;v) also takes the next character as argument and substracts it from A leaving the result as the new value (here: 01 and be).<br /><br />Unfortunately ADD and XOR with argument are not represantable with characters, so getting some values can be a bit tricky. One trick here is to deliberately underflow in the calculation and use SUB to get to the desired value anyway. This way you can represent the required 01 for the Master Ball also in this way:<br />[code]p&#039;v9 (XOR A; SUB ff)[/code]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207327#msg207327 date=1508533879]<br />[quote author=hobgoblinpie link=topic=6716.msg207325#msg207325 date=1508530930]<br />Thanks man, you&#039;re a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I&#039;m trying to learn. If you don&#039;t mind, could you explain what the changed Box 2 does differently to the previous one?<br />[/quote]<br /><br />Basically a different calculation. The Ã©7&#039;t part present in both is writing the value currently in register A to the specified location which is the type of the first item (judging from the original&nbsp; code in the balls pocket; you might need to adjust this, too).<br /><br /><br />Now for the calculations itself:<br />[code]p0B&#039;vA (XOR A; OR 81; SUB 80)<br /><br />p0&#039;v&#039;vY (XOR A; OR d6; SUB 98)<br />[/code]<br />All Instructions are evaluated against register A and you can look them up in [url=http://pastebin.com/raw/arPmsvYu]Sanqui&#039;s Pastebin[/url].<br />XOR A (character p) is basically an elaborate way to set register A to the value 0.<br />OR (character 0) takes the next character as argument and with A currently at the value of 0 the argument becomes the new value of A (here: 81 and d6).<br />SUB (character &#039;v) also takes the next character as argument and substracts it from A leaving the result as the new value (here: 01 and be).<br /><br />Unfortunately ADD and XOR with argument are not represantable with characters, so getting some values can be a bit tricky. One trick here is to deliberately underflow in the calculation and use SUB to get to the desired value anyway. This way you can represent the required 01 for the Master Ball also in this way:<br />[code]p&#039;v9 (XOR A; SUB ff)[/code]<br />[/quote]<br />^This<br /><br />Integer underflow is your friend


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207322#msg207322 date=1508512634]<br />[quote author=spamviech link=topic=6716.msg207321#msg207321 date=1508511952]<br />Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)<br />[/quote]<br /><br />I don&#039;t know precisely where it jumps first. When I get home, I&#039;ll breakpoint some addresses in BGB and see if I can find out what it does when used.<br /><br />My [b]guess[/b] is that when you use TM 25 in the balls pocket, it reads an invalid effect pointer (similar to 8f in R/B) and eventually reaches it&#039;s destination, but AFAIK it doesn&#039;t corrupt the stack.<br /><br />Something worth pointing out is that it eventually leads to Pokemon slot 2, not 3. So if you decide to use this method, move your slide and Quagsire up one slot.<br />[/quote]<br /><br />Just found [url=http://forums.glitchcity.info/index.php?topic=8100.0]this[/url]. (How could I be so blind&nbsp; :o)<br />Reconstructing from the Slide-Mon requirement removal it start execution at $da9a (Second byte defense EV of the [b]second[/b] Party PokÃ©mon).<br /><br />Switching to TM25 usage now. Soo much easier and without constant resetting.&nbsp; ;D


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: xx
body:
  I asked about this elsewhere, but would you be kind enough to provide a shiny code that results in females? Also maybe a version for both males and females that gives Hidden Power Grass? The existing shiny code is male, HP dragon.<br /><br />Edit;<br />Welp, nobody helped me so I had to figure it out myself just based on patterns .<br />Shiny female code;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0?&#039;vm&nbsp; &nbsp;  [atk 3, defense 10]&nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; [special 10, spd 10]<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br />That one is HP dragon. I&#039;ll edit with HP Grass for both genders later.<br /><br />Edit 2;<br />Shiny Female HP grass spread;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0k&#039;vA&nbsp; &nbsp;  [atk 2, defense 10]&nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; [special 10, spd 10]<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Shiny male HP grass spread;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp0Ã©5&nbsp; &nbsp;  [atk 14, defense 10]&nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; [special 10, spd 10]<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />(haven&#039;t tested the Grass ones, but should work in theory and if psypoke&#039;s HP calculator can be trusted).


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207329#msg207329 date=1508537477]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207322#msg207322 date=1508512634]<br />[quote author=spamviech link=topic=6716.msg207321#msg207321 date=1508511952]<br />Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)<br />[/quote]<br /><br />I don&#039;t know precisely where it jumps first. When I get home, I&#039;ll breakpoint some addresses in BGB and see if I can find out what it does when used.<br /><br />My [b]guess[/b] is that when you use TM 25 in the balls pocket, it reads an invalid effect pointer (similar to 8f in R/B) and eventually reaches it&#039;s destination, but AFAIK it doesn&#039;t corrupt the stack.<br /><br />Something worth pointing out is that it eventually leads to Pokemon slot 2, not 3. So if you decide to use this method, move your slide and Quagsire up one slot.<br />[/quote]<br /><br />Just found [url=http://forums.glitchcity.info/index.php?topic=8100.0]this[/url]. (How could I be so blind&nbsp; :o)<br />Reconstructing from the Slide-Mon requirement removal it start execution at $da9a (Second byte defense EV of the [b]second[/b] Party PokÃ©mon).<br /><br />Switching to TM25 usage now. Soo much easier and without constant resetting.&nbsp; ;D<br />[/quote]<br /><br />Indeed it is. Another thing I didn&#039;t like about the coin case is moving in a specific pattern, listing to Machop&#039;s cry, fixing the stack, etc.<br />


subject: Re: GlitchDex: International glitch PokÃ©mon?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Now that the English Generation I GlitchDex articles are done, I&#039;ve added our first non-English GlitchDex article to the wiki. :)<br /><br />http://glitchcity.info/wiki/GlitchDexJP/Y:237<br /><br />I have also opened up a request article. Feel free to add requests here, that way me (or another user) can add select glitch PokÃ©mon you want:<br /><br />http://glitchcity.info/wiki/User:Torchickens/Glitch_Pok%C3%A9mon_article_requests<br /><br />When the English Generation II GlitchDex articles are done I plan on making a few of these articles, although not too many yet as I&#039;d still like to finish the English ItemDex, AttackDex, UnownDex.


subject: Re: Obtaining TM17 ACE in EU versions of G/S
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  Nice work.<br />One thing that would help: The final number of Bellsprout after all the cloning.<br /><br />Edit:<br />Maybe you should also mention getting the 2 PokÃ©balls and 1 Great Ball in the Pre-cloning Setup.<br />I know it&#039;s part of getting TM17, but since this can be seen as one huge task having to buy them half-way through is not ideal.<br /><br />EditÂ²:<br />Bad Clones are aweful (but I knew that already). All I managed to do (aside from normal clones/nothing) is the game telling me I have 17 mons in Box14, but I can&#039;t access any of them (only Cancel Button visible).<br /><br />Anyway, decided to&nbsp; give me the double Mystery Egg using Gen1 ACE and trading. The Setup afterwards worked like a charm.<br />Now I only need to figure out a way to do something with ACE in German Gold. At first glance charset for boxnames looks incredibely useless.&nbsp; :(


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  Next code: Turn PokÃ©mon 1 into an Egg, ready to be hatched (probably 256 steps left):<br />[code]1)55555555<br />2)p0d&#039;vAÃ©!2		XOR A; OR a3; SUB 80; LD [e7f8], A | A-&gt;23<br />3)p0&#039;t&#039;vQÃ©â™‚2		XOR A; OR d5; SUB90; LD [eff8], A | A-&gt;45<br />4)55555555<br />5)p07Ã©Ã©45p		XOR A; OR fd; LD [{23}fa], A; XOR A | A-&gt;fd; A-&gt;0<br />6)&#039;v9Ã©Ã©4x&#039;d		SUB ff; LD [{45}fa], A; OR A; Ret NC | A-&gt;01[/code]<br /><br />This is for use with TM25 in the balls bag. If you want to use Coin Case, use the one-off code from FMK and change the name of Box 6<br />[code]6)&#039;v9Ã©Ã©4555		XOR A; LD [{45}fa], A[/code]<br /><br /><br />And just in case you didn&#039;t know: Shiny Celebi looks awesome in Gen II.&nbsp; ^-^


subject: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  EDIT 1: Wow, you can&#039;t even [b]read[/b] this on mobile! Bear with me here, I&#039;m learning to use the &quot;table&quot; function, hopefully that will clean things up.<br /><br /><br />As box name codes become increasingly popular, it&#039;s become necessary to have the characters and their corresponding hexes documented in location.<br /><br />Unfortunately, The Big HEX Listâ„¢ only documented R/B/Y Characters.<br /><br />So,for the time being, here&#039;s an unofficial G/S/C Character hex list! (Apologies for disorganization)<br /><br /><br />WARNING: INCREDIBLY SLOPPY! What I should&#039;ve done was make this in Notepad, and copy-paste upon completion, but that idea hit me far too late.<br />Char:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Hex:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Dec:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Pokemon:&nbsp; &nbsp; &nbsp; &nbsp; Item:&nbsp; &nbsp; &nbsp;  Op:<br />(Space)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $7f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  127&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Pinsir&nbsp; &nbsp; &nbsp; &nbsp;  Card Key&nbsp; &nbsp;  ld a,a<br />A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $80&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 128&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Tauros&nbsp; &nbsp; &nbsp; &nbsp; Machine Part&nbsp; add a,b<br />B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $81&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 129&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Magikarp&nbsp; &nbsp; Teru-Sama&nbsp; &nbsp;  add a,c<br />C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $82&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 130&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Gyrados&nbsp; &nbsp; &nbsp; &nbsp; Lost Item&nbsp; &nbsp;  add a,d<br />D&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $83&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 131&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Lapras&nbsp; &nbsp; &nbsp; &nbsp;  Stardust&nbsp; &nbsp; &nbsp; &nbsp; add a,e<br />E&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $84&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 132&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Ditto&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  StarPiece&nbsp; &nbsp; &nbsp; add a,h<br />F&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $85&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 133&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Eevee&nbsp; &nbsp; &nbsp;  Basement Key&nbsp;  add a,l<br />G&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $86&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 134&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Vapeoren&nbsp; &nbsp; &nbsp;  Pass&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add a,(hl)<br />H&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $87&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 135&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Jolteon&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Teru-Sama&nbsp; &nbsp; &nbsp; add a,a<br />I&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $88&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 136&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Flareon&nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp; &nbsp; adc a,b<br />J&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $89&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 137&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Porygon&nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp; &nbsp; adc a,c<br />K&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $8a&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  138&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Omanyte&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Charcoal&nbsp; &nbsp; &nbsp;  adc a,d<br />L&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $8b&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  139&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Omastar&nbsp; &nbsp; &nbsp; &nbsp;  Berry Juice&nbsp; &nbsp;  adc a,e<br />M&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $8c&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  140&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Kabuto&nbsp; &nbsp; &nbsp; &nbsp;  Scope lens&nbsp; &nbsp; &nbsp; adc a,h<br />N&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $8d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  141&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Kabutops&nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp;  adc a,l<br />O&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $8e&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  142&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Aerodactyl&nbsp; &nbsp; &nbsp; Teru-Sama&nbsp; &nbsp;  adc a,(hl)<br />P&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $8f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  143&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Snorlax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Metal Coat&nbsp; &nbsp;  adc a,a<br />Q&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $90&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  144&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Articuno&nbsp; &nbsp; &nbsp; &nbsp;  Dragon Fang&nbsp; &nbsp; sub a,b<br />R&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $91&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  145&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Zapdos&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Teru-Sama&nbsp; &nbsp;  sub a,c<br />S&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $92&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  146&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Moltres&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Leftovers&nbsp; &nbsp; &nbsp;  sub a,d<br />T&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $93&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  147&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Dratini&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp;  sub a,e<br />U&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $94&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  148&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Dragonair&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp; sub a,h<br />V&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $95&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  149&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Dragonite&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Teru-Sama&nbsp; &nbsp; sub a,l<br />W&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $96&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  150&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Mewtwo&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  MystryBerry&nbsp; &nbsp; sub a,(hl)<br />X&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $97&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  151&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Mew&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Dragon Scale&nbsp; &nbsp; &nbsp;  sub a,a<br />Y&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $98&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  152&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Chikorita&nbsp; &nbsp; &nbsp; &nbsp;  Berserk Gene&nbsp; &nbsp; &nbsp;  sbc a,b<br />Z&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $99&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  153&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Bayleef&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp; &nbsp; &nbsp;  sbc a,c<br />(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $9a&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  154&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Meganium&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Teru-Sama&nbsp; &nbsp; &nbsp; &nbsp; sbc a,d<br />)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $9b&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 155&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Cyndaquil&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Teru-Sama&nbsp; &nbsp; &nbsp;  sbc a,e<br />:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $9c&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  156&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Quilava&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Sacred Ash&nbsp; &nbsp; &nbsp; &nbsp; sbc a,h<br />;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $9d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 157&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Typhlosion&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Heavy Ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sbc a,l<br />[&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $9e&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 158&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Totodile&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Flower Mail&nbsp; &nbsp; &nbsp; &nbsp; sbc a,(hl)<br />]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $9f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  159&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Croconow&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Level Ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sbc a,a<br />a&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 160&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Feriligator&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Lure ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and b<br />b&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $a1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 161&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Sentret&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Fast Ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  and c<br />c&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 162&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Furret&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and d<br />d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 163&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  HootHoot&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Light Ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and e<br />e&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $a4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  164&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Noctowl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Friend ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and h<br />f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 165&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Lebyda&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Moon ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and l<br />g&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  166&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Ledian&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Love Ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  and (hl)<br />h&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $a7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 167&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Spinark&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Normal Box&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and a<br />i&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 168&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Ariados&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Gorgeous Box&nbsp; &nbsp; &nbsp; &nbsp; xor b<br />j&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $a9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 169&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Crobat&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Sun Stone&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  xor c<br />k&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $aa&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 170&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Chinchou&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Polkadot Bow&nbsp; &nbsp; &nbsp; &nbsp;  xor d<br />l&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ab&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 171&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Lanturn&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Teru-Sama&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor e<br />m&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ac&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 172&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Pichu&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Up-Grade&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor h<br />n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $ad&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  173&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Cleffa&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Berry&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor l<br />o&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $ae&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 174&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IgglyBuff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Gold berry&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  xor (hl)<br />p&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $af&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  175&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Togepi&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Squirtbottle&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor a<br />q&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $b0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  176&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Togepic&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp; &nbsp; &nbsp;  or b<br />r&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $b1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 177&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Natu&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Park ball&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; or c<br />s&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $b2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 178&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Xatu&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Rainbow Wing&nbsp; &nbsp; &nbsp;  or d<br />t&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  $b3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 179&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Mareep&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Teru-Sama&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  or e<br />u&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $b4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 180&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Flaffy&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Brick Piece&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; or h<br />v&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $b5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  181&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Ampharos&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Surf Mail&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  or l<br />w&nbsp; &nbsp; &nbsp; &nbsp;  $b6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  182&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Bellossom&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  LiteBlue Mail&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; or (hl)<br />x&nbsp; &nbsp; &nbsp; &nbsp;  $b7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  183&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Marril&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Portrait Mail&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; or a<br />y&nbsp; &nbsp; &nbsp; &nbsp;  $b8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 184&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Azumarril&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Lovely Mail&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cp b<br />z&nbsp; &nbsp; &nbsp; &nbsp;  $b9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 185&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Sudowoodo&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Eon Mail&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cp c<br />&#039;d&nbsp; &nbsp; &nbsp; &nbsp; $d0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  208&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Steelix&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 17&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ret nc<br />&#039;l&nbsp; &nbsp; &nbsp; &nbsp;  $d1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 209&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Snubbull&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 18&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop de<br />&#039;m&nbsp; &nbsp; &nbsp;  $d2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  210&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Granbull&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 19&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp nc,$xxyy<br />&#039;r&nbsp; &nbsp; &nbsp; &nbsp; $d3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 211&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  QwillFish&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 20&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  invalid op<br />&#039;s&nbsp; &nbsp; &nbsp; &nbsp; $d4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  212&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Scizor&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 21&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call nc,$xxyy<br />&#039;t&nbsp; &nbsp; &nbsp; &nbsp; $d5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  213&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Shuckle&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push de<br />&#039;v&nbsp; &nbsp; &nbsp;  $d6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  214&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Heracross&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 23&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  sub $xx<br />&#039;&nbsp; &nbsp; &nbsp; &nbsp;  $e0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 224&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Octillary&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 32&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld ($ffxx),a<br />PK&nbsp; &nbsp; &nbsp; $e1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 225&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Delibird&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 33&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop hl<br />MN&nbsp; &nbsp;  $e2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  226&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Mantine&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld ($ff00 + c),a<br />-&nbsp; &nbsp; &nbsp; &nbsp; $e3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  227&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Skarmory&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 35&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  invalid op<br />?&nbsp; &nbsp; &nbsp; &nbsp; $e6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 230&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Kingdra&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 38&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  and $xx<br />!&nbsp; &nbsp; &nbsp; &nbsp; $e7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  231&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Phanpy&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 39&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rst 20h<br />.&nbsp; &nbsp; &nbsp; &nbsp; $e8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 232&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Donphan&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 40&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add sp,$xx<br />&amp;&nbsp; &nbsp; &nbsp;  $e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  233&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Porygon2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 41&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp (hl)<br />Ã©&nbsp; &nbsp; &nbsp;  $ea&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  234&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Stantler&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 42&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld ($xxyy),a<br />(male) $ef&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 239&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Elekid&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  TM 47&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rst 28h<br />x(mult) $f1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 241&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Miltank&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TM 49&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  pop af<br />/&nbsp; &nbsp; &nbsp; &nbsp; $f3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 243&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Raikou&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  HM 01&nbsp; &nbsp; &nbsp; &nbsp; di<br />,&nbsp; &nbsp; &nbsp; &nbsp; $f4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 244&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Entei&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  HM 02&nbsp; &nbsp; &nbsp; &nbsp;  invalid op<br />(female) $f5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 245&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Suicune&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HM 03&nbsp; &nbsp; &nbsp; &nbsp; push af<br />0&nbsp; &nbsp; &nbsp; &nbsp; $f6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  246&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Larvitar&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  HM 04&nbsp; &nbsp; &nbsp; &nbsp;  or $xx<br />1&nbsp; &nbsp; &nbsp; &nbsp; $f7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 247&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Pupitar&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HM 05&nbsp; &nbsp; &nbsp; &nbsp; rst 30h<br />2&nbsp; &nbsp; &nbsp; &nbsp; $f8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  248&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Tyranitar&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HM 06&nbsp; &nbsp; &nbsp; &nbsp; ld hl,(sp + $xx)<br />3&nbsp; &nbsp; &nbsp; &nbsp; $f9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  249&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Lugia&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HM 07&nbsp; &nbsp; &nbsp; &nbsp;  ld sp,hl<br />4&nbsp; &nbsp; &nbsp; &nbsp; $fa&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  250&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Ho-oh&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HM 08&nbsp; &nbsp; &nbsp; &nbsp; ld a,($xxyy)<br />5&nbsp; &nbsp; &nbsp; &nbsp; $fb&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 251&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Celebi&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HM 09&nbsp; &nbsp; &nbsp; ei<br />6&nbsp; &nbsp; &nbsp; &nbsp; $fc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  252&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ?????&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  HM 10&nbsp; &nbsp; &nbsp;  invalid op<br />7&nbsp; &nbsp; &nbsp; &nbsp; $fd&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 253&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  Egg&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  HM 11&nbsp; &nbsp; &nbsp; &nbsp; invalid op<br />8&nbsp; &nbsp; &nbsp; &nbsp; $fe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 254&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ?????&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HM 12&nbsp; &nbsp; &nbsp; &nbsp;  cp $xx<br />9&nbsp; &nbsp; &nbsp; &nbsp; $ff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  255&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ?????&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  CANCEL&nbsp; &nbsp; &nbsp;  rst 38h<br /><br />I know it&#039;s sloppy, and i probably made a spelling blunder somewhere, but i hope this useful in some way!<br /><br />Enjoy!


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  HTML tables aren&#039;t optimized for responsive layout so you would need some elaborate CSS to render them differently and in an accessible fashion on mobile devices (see [url=https://css-tricks.com/accessible-simple-responsive-tables/]this CSS-Tricks article[/url] as an example). Also, don&#039;t worry much about older Internet Explorer versions, only IE11 is still supported and matters most at this point in time regardless of what stats you check but, even then, focus on Edge, thus standard HTML and CSS ;) <br /><br />As to character encodings, Bulbapedia has [url=https://bulbapedia.bulbagarden.net/wiki/Character_encoding_in_Generation_I]the Japanese and English ones of the Generation I[/url] [url=https://bulbapedia.bulbagarden.net/wiki/Character_encoding_in_Generation_II]and II games[/url] (also the Korean one for the latter). These should help with generating Box name codes. They also have the PokÃ©mon IDs by generation ([url=https://bulbapedia.bulbagarden.net/wiki/List_of_PokÃ©mon_by_index_number_(Generation_I)]I[/url], [url=https://bulbapedia.bulbagarden.net/wiki/List_of_PokÃ©mon_by_index_number_(Generation_II)]II[/url]) and the item IDs by generation ([url=https://bulbapedia.bulbagarden.net/wiki/List_of_items_by_index_number_(Generation_I)]I[/url], [url=https://bulbapedia.bulbagarden.net/wiki/List_of_items_by_index_number_(Generation_II)]II[/url]).<br /><br />The opcode list comes in handy, thanks! :) 


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=8117.msg207336#msg207336 date=1508606460]<br />HTML tables aren&#039;t optimized for responsive layout so you would need some elaborate CSS to render them differently and in an accessible fashion on mobile devices (see [url=https://css-tricks.com/accessible-simple-responsive-tables/]this CSS-Tricks article[/url] as an example). Also, don&#039;t worry much about older Internet Explorer versions, only IE11 is still supported and matters most at this point in time regardless of what stats you check but, even then, focus on Edge, thus standard HTML and CSS ;) <br /><br />As to character encodings, Bulbapedia has [url=https://bulbapedia.bulbagarden.net/wiki/Character_encoding_in_Generation_I]the Japanese and English ones of the Generation I[/url] [url=https://bulbapedia.bulbagarden.net/wiki/Character_encoding_in_Generation_II]and II games[/url] (also the Korean one for the latter). These should help with generating Box name codes. They also have the PokÃ©mon IDs by generation ([url=https://bulbapedia.bulbagarden.net/wiki/List_of_PokÃ©mon_by_index_number_(Generation_I)]I[/url], [url=https://bulbapedia.bulbagarden.net/wiki/List_of_PokÃ©mon_by_index_number_(Generation_II)]II[/url]) and the item IDs by generation ([url=https://bulbapedia.bulbagarden.net/wiki/List_of_items_by_index_number_(Generation_I)]I[/url], [url=https://bulbapedia.bulbagarden.net/wiki/List_of_items_by_index_number_(Generation_II)]II[/url]).<br /><br />The opcode list comes in handy, thanks! :)<br />[/quote]<br /><br />Thanks for the advice! <br /><br />I found a website that allows creation of a neat, clean ASCII chart. I hope to have it finished sometime today.


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  You might want to include [url=https://pastebin.com/dW4dPyGp]Luckytyphlosion&#039;s list for european languages[/url].<br /><br />Even though it is somewhat incomplete. Like in the German Version it is impossible to input a [b]Ã©[/b] character which basically disables any way to do anything (Mn is the only available LD-instruction that doesn&#039;t write into a Register).<br /><br />Also: I didn&#039;t find a way in english to input a [b]&#039;[/b] character in the english version, but maybe I&#039;m just blind.


subject: English Generation I and II GlitchDex wiki transition complete
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Today all of the articles in the GlitchDex for Generations I and II have been updated and completely re-structured to have proper MediaWiki formatting.<br /><br />In addition, we have included various obscure technical details about these glitch PokÃ©mon for you to enjoy. :)<br /><br />This does not mean the English GlitchDex is entirely complete, as we still have to create a database for glitch palette attribute bytes and input the data, and there are bound to be errors and omissions elsewhere.<br /><br />I will begin work from now on finishing the AttackDex and ItemDex, starting with the ItemDex. As always any help no matter how small is certainly welcome.


subject: Re: English Generation I and II GlitchDex wiki transition complete
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Pardon my misunderstanding, but are you referring to this site or &quot;Phoenix&quot;?<br /><br />And, on that note, what will happen to this place when &quot;Phoenix&quot; is operational (or is it already and I&#039;m simply slow at catching up?)<br /><br />


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you for this. :)<br /><br />Sanqui created a similar table a long time ago.<br /><br />http://pastebin.com/raw/arPmsvYu<br /><br />However it looks like yours avoids the N/A entries, which is good for looking up available opcodes/operands more quickly but not so good if you use a code self-modifying method.<br /><br />I&#039;ll consider porting both for the wiki.


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=spamviech link=topic=8117.msg207338#msg207338 date=1508620120]<br />You might want to include [url=https://pastebin.com/dW4dPyGp]Luckytyphlosion&#039;s list for european languages[/url].<br /><br />Even though it is somewhat incomplete. Like in the German Version it is impossible to input a [b]Ã©[/b] character which basically disables any way to do anything (Mn is the only available LD-instruction that doesn&#039;t write into a Register).<br /><br />Also: I didn&#039;t find a way in english to input a [b]&#039;[/b] character in the english version, but maybe I&#039;m just blind.<br />[/quote]<br /><br />The [b]&#039;[/b] character was just an apostrophe. From my understanding, it is only used to load [b]a[/b] into addresses at $FF00 and above, and I barely noticed it either.<br /><br />[quote author=Torchickens link=topic=8117.msg207341#msg207341 date=1508627007]<br />Thank you for this. :)<br /><br />Sanqui created a similar table a long time ago.<br /><br />http://pastebin.com/raw/arPmsvYu<br /><br />However it looks like yours avoids the N/A entries, which is good for looking up available opcodes/operands more quickly but not so good if you use a code self-modifying method.<br /><br />I&#039;ll consider porting both for the wiki.<br />[/quote]<br /><br />Thank You!<br /><br />I wasn&#039;t aware of Sanqui&#039;s table, his is probably formatted better.


subject: Re: English Generation I and II GlitchDex wiki transition complete
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=8118.msg207340#msg207340 date=1508626092]<br />Pardon my misunderstanding, but are you referring to this site or &quot;Phoenix&quot;?<br /><br />And, on that note, what will happen to this place when &quot;Phoenix&quot; is operational (or is it already and I&#039;m simply slow at catching up?)<br />[/quote]<br /><br />That&#039;s OK.<br /><br />I&#039;m referring to Project Phoenix, which is the project for the website&#039;s wiki but I believe Abwayax&#039;s intention was to merge the site with the wiki, so we have the forums but also information on the wiki that was originally not designed for a wiki (in fact many of the pages like [url=http://glitchcity.info/wiki/Go_past_the_Marowak_ghost_without_a_Silph_Scope]this one[/url] were on the site before we added the wiki). GlitchDex articles used to be generated by an extension that took the information from an existing database (known as Melchior) but we abandoned the idea recently after the extension broke.<br /><br />Before this website became a wiki (prior to 2010) there were three projects, GlitchDex, AttackDex, ItemDex. On the forums various members worked on unofficial projects as well such as DecDex (data for Generation III glitch PokÃ©mon), PhoneDex (data for Generation II contacts), and many others.<br /><br />Project Phoenix is technically operational right now as we have a functionable wiki, except for missing/unconverted project articles (i.e. ItemDex/AttackDex) and there are newly discovered glitches that don&#039;t have articles yet. I also made an unofficial UnownDex article a long time ago, which I&#039;d like to go back to and complete eventually, and added a TrainerDex and TypeDex as I felt they would be worth having.


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You&#039;re welcome. ^^<br /><br />Yes, Sanqui&#039;s table can be found in a link on the [url=http://forums.glitchcity.info/index.php?topic=6716.0]original post[/url] for the main Coin Case arbitrary code execution thread, but it&#039;s easily missable.


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=8117.msg207344#msg207344 date=1508628383]<br />You&#039;re welcome. ^^<br /><br />Yes, Sanqui&#039;s table can be found in a link on the [url=http://forums.glitchcity.info/index.php?topic=6716.0]original post[/url] for the main Coin Case arbitrary code execution thread, but it&#039;s easily missable.<br />[/quote]<br /><br />Thanks for letting me know. :)<br /><br />I was going to make an edit that cleans up the chart a bit, but I got lazy and it didn&#039;t get done. It should be up sometime tomorrow.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207321#msg207321 date=1508511952]<br />You can easily create box name code to give it the moves one by one. Goal of this one was to have one do it all code though.<br />Also me confirming if it works like I think it does. :)<br />[/quote]<br /><br />On the topic of teaching moves, do you know how to teach a Pokemon Ice Beam, Flamethrower or Thunderbolt? I asked this in another thread, but these moves are unobtainable in Gold/Silver - and were only move tutor moves in Crystal. So for a lot of people like me who are playing VC Gold or Silver, with no way to trade, the only way to get them would be through Coin Case.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What I&#039;ve been doing is using ACE to change my pokemon into a pokemon that learns the move, leveling it to the appropriate level, learning the move, then using ACE again to change it back. Obviously this isn&#039;t very efficient, but I&#039;m not capable of working out a code to replace moves myself.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Odd that having a TM in the ball pocket has such... usefull effects ;D But what happens if its in another pocket? Like items or key items?


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=8117.msg207342#msg207342 date=1508627202]<br />[quote author=spamviech link=topic=8117.msg207338#msg207338 date=1508620120]<br />You might want to include [url=https://pastebin.com/dW4dPyGp]Luckytyphlosion&#039;s list for european languages[/url].<br /><br />Even though it is somewhat incomplete. Like in the German Version it is impossible to input a [b]Ã©[/b] character which basically disables any way to do anything (Mn is the only available LD-instruction that doesn&#039;t write into a Register).<br /><br />Also: I didn&#039;t find a way in english to input a [b]&#039;[/b] character in the english version, but maybe I&#039;m just blind.<br />[/quote]<br /><br />The [b]&#039;[/b] character was just an apostrophe. From my understanding, it is only used to load [b]a[/b] into addresses at $FF00 and above, and I barely noticed it either.<br />[/quote]<br /><br />Thing is I don&#039;t see an option to&nbsp; (directly) use it in an Box Name (at least in english VC version). I know it is used in Farfetch&#039;d for example, but you can&#039;t input it yourself.<br />Or I&#039;m really blind and you can tell me where it is on the input character set (like left of Ã© or sth.).


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=8117.msg207352#msg207352 date=1508673157]<br />[quote author=Couldntthinkofaname link=topic=8117.msg207342#msg207342 date=1508627202]<br />[quote author=spamviech link=topic=8117.msg207338#msg207338 date=1508620120]<br />You might want to include [url=https://pastebin.com/dW4dPyGp]Luckytyphlosion&#039;s list for european languages[/url].<br /><br />Even though it is somewhat incomplete. Like in the German Version it is impossible to input a [b]Ã©[/b] character which basically disables any way to do anything (Mn is the only available LD-instruction that doesn&#039;t write into a Register).<br /><br />Also: I didn&#039;t find a way in english to input a [b]&#039;[/b] character in the english version, but maybe I&#039;m just blind.<br />[/quote]<br /><br />The [b]&#039;[/b] character was just an apostrophe. From my understanding, it is only used to load [b]a[/b] into addresses at $FF00 and above, and I barely noticed it either.<br />[/quote]<br /><br />Thing is I don&#039;t see an option to&nbsp; (directly) use it in an Box Name (at least in english VC version). I know it is used in Farfetch&#039;d for example, but you can&#039;t input it yourself.<br />Or I&#039;m really blind and you can tell me where it is on the input character set (like left of Ã© or sth.).<br />[/quote]<br /><br />You know, now that you mention it, [b]I can&#039;t find it either[/b]. Which is odd, I could&#039;ve swore I had saw it earlier.<br /><br />I must&#039;ve been looking at the comma.<br /><br />Maybe the (apostraphe) is language exclusive?


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Probably the same as [b]Ã©[/b] in german versions:<br />Usable in the sence that it can be used when the game talks about PokÃ©mon (for example beginning speach of Prof. Oak), but you can&#039;t input it yourself.


subject: Re: Unofficial G/S/C character hex list! (VERY SLOPPY)
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=8117.msg207354#msg207354 date=1508675441]<br />Probably the same as [b]Ã©[/b] in german versions:<br />Usable in the sence that it can be used when the game talks about PokÃ©mon (for example beginning speach of Prof. Oak), but you can&#039;t input it yourself.<br />[/quote]<br /><br />Ah, I see.<br /><br />I might remove (apostrophe) from the list to avoid confusion.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=8111.msg207330#msg207330 date=1508537517]<br />I asked about this elsewhere, but would you be kind enough to provide a shiny code that results in females? Also maybe a version for both males and females that gives Hidden Power Grass? The existing shiny code is male, HP dragon.<br /><br />Edit;<br />Welp, nobody helped me so I had to figure it out myself just based on patterns .<br />Shiny female code;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0?&#039;vm&nbsp; &nbsp;  [atk 3, defense 10]&nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; [special 10, spd 10]<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br />That one is HP dragon. I&#039;ll edit with HP Grass for both genders later.<br /><br />Edit 2;<br />Shiny Female HP grass spread;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2p0k&#039;vA&nbsp; &nbsp;  [atk 2, defense 10]&nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; [special 10, spd 10]<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />Shiny male HP grass spread;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp0â™‚5&nbsp; &nbsp;  [atk 14, defense 10]&nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; [special 10, spd 10]<br />55Ã©A4ppp<br />&#039;v7&#039;v&#039;dÃ©42p<br />Ã©D9&#039;l&#039;lA&#039;lx<br />&#039;d5555555<br /><br />(haven&#039;t tested the Grass ones, but should work in theory and if psypoke&#039;s HP calculator can be trusted).<br />[/quote]<br /><br />Sorry about that, I was going to help you but got sidetracked.<br /><br />Nice codes!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207349#msg207349 date=1508638952]<br />[quote author=spamviech link=topic=6716.msg207321#msg207321 date=1508511952]<br />You can easily create box name code to give it the moves one by one. Goal of this one was to have one do it all code though.<br />Also me confirming if it works like I think it does. :)<br />[/quote]<br /><br />On the topic of teaching moves, do you know how to teach a Pokemon Ice Beam, Flamethrower or Thunderbolt? I asked this in another thread, but these moves are unobtainable in Gold/Silver - and were only move tutor moves in Crystal. So for a lot of people like me who are playing VC Gold or Silver, with no way to trade, the only way to get them would be through Coin Case.<br />[/quote]<br /><br />Here&#039;s a quick-and-dirty TM 25 Ball Pocket code that I made to teach Ice Beam to Pokemon 5. Due to character limitations, I was restricted to the fourth move, so make sure Pokemon 5 has at least 3 moves before using.<br /><br />Box 1: Ap0?&#039;vm55<br />Box 2: Ã©(male)4p&#039;d555<br /><br />Here&#039;s the same code, but for use with the Coin Case (ensure to use FMK&#039;s one-off code)<br />Box 1: Ap0?&#039;vm55<br />Box 2: Ã©(male)455555<br />Box 3+ :55555555<br />Box 13: Leave Unchanged (FMK&#039;s Code)<br />Box 14: Leave Unchanged (FMK&#039;s Code)<br /><br />I have not tested the Coin Case version (I prefer to use TM 25), but it should work as described. If it doesn&#039;t, please let me know.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Skeef link=topic=8100.msg207351#msg207351 date=1508662861]<br />Odd that having a TM in the ball pocket has such... usefull effects ;D But what happens if its in another pocket? Like items or key items?<br />[/quote]<br /><br />I believe each wrong pocket TM/HMs in the items, key items and balls pocket has the same effect regardless of pocket, so a TM25 would execute FA6A regardless of its pocket as long as it&#039;s outside of the TM/HM pocket, and other wrong pocket TM/HMs will have the same (glitch) effect pointer regardless of which wrong pocket.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  For Flamethrower and Thunderbolt you only need to change Box 1.<br /><br />Flamethrower:<br />[code]Ap0v&#039;vA55	XOR A; OR b5; SUB 80[/code]<br /><br />Thunderbolt:<br />[code]Ap0&#039;t&#039;vA55	XOR A; OR d5; SUB 80[/code]<br /><br />Icebeam:<br />[code]Ap0?&#039;vm55	XOR A; OR e6; SUB ac[/code]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks, I was mostly interested in Thunderbolt for my Jolteon. I&#039;ll test it later. <br /><br />So is it possible to teach any move through these methods, or are there some character limitations for certain moves? <br /><br />Also it&#039;s worth noting that Gold/Silver has some unique event moves for certain Pokemon and I&#039;ve seen some people have expressed interest in obtaining them on their pokes. I&#039;m personally not that interested in event moves, but stuff like Belly Drum Quagsire and Lovely Kiss Snorlax is kinda cool, I guess.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207360#msg207360 date=1508685499]<br />Thanks, I was mostly interested in Thunderbolt for my Jolteon. I&#039;ll test it later. <br /><br />So is it possible to teach any move through these methods, or are there some character limitations for certain moves? <br /><br />Also it&#039;s worth noting that Gold/Silver has some unique event moves for certain Pokemon and I&#039;ve seen some people have expressed interest in obtaining them on their pokes. I&#039;m personally not that interested in event moves, but stuff like Belly Drum Quagsire and Lovely Kiss Snorlax is kinda cool, I guess.<br />[/quote]<br /><br />With enough changes of box 1, it is possible to teach any move, probably even glitch moves, though I haven&#039;t tried this for myself.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: hobgoblinpie
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: hobgoblinpie
icon: xx
body:
  Thanks Couldntthinkofaname and spamviech for explaining it, I really appreciate it. It&#039;s pretty incredible how blown open the games are thanks to a simple lack of valid terminator.<br /><br />Things like Extremespeed Dragonite would be cool, at least until Crystal comes out (even then you&#039;d need two 3DS&#039;s or a friend in order to trade). 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: clip
body:
  So, I decided to make a box code that makes the 5th Pokemon&#039;s 4th move be glitch move $ff<br /><br />Box 1: A09Ã©(male)4p&#039;d<br /><br />The results were interesting to say the least.


subject: Re: The Member's Guide to Topiclessness
poster_name: Missing? NO!
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Anyone here frequent Pokemon Showdown? I&#039;m starting to get back into it as Ultra Sun/Ultra Moon lurk on the horizon.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m not a fan of the TM ace. I&#039;d rather keep using the coin case and changing box 2&#039;s name instead of box 1. And box 1 sounds limited, like you have to change the name more than once to get what you want.<br />But everyone seems to love TM ace so now I&#039;m not gonna have any more coincase formatted codes to work with.<br />(I guess I don&#039;t need move-changing codes in the old format, but it would be easier than changing a pokemon&#039;s species to learn moves).


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207365#msg207365 date=1508703647]<br />I&#039;m not a fan of the TM ace. I&#039;d rather keep using the coin case and changing box 2&#039;s name instead of box 1. And box 1 sounds limited, like you have to change the name more than once to get what you want.<br />But everyone seems to love TM ace so now I&#039;m not gonna have any more coincase formatted codes to work with.<br />(I guess I don&#039;t need move-changing codes in the old format, but it would be easier than changing a pokemon&#039;s species to learn moves).<br />[/quote]<br /><br />I can reformat my code if you would like: (make sure to use FMK&#039;s one off code prior)<br /><br />Pokemon 5 has glitch move $ff in move slot 4:<br />Box 1: A09Ã©(male)455<br />Box 2+: 55555555<br />Box 13: Unchanged from FMK&#039;s code<br />Box 14: Unchanged from FMK&#039;s code<br /><br />I&#039;ll start formatting my codes in both ways for ease of use to both parties<br /><br />If you see a TM 25 code you would like to use, usually reformatting can be done with these steps:<br /><br />1. Use FMK&#039;s one-off code (if you haven&#039;t prior)<br />2. At the end of the code you wish to use, replace the final [b]&#039;d[/b] with [b]5[/b], and fill in the rest of that box name with [b]5[/b]<br />3. Fill in any unused box names with [b]5[/b] (except Box 13 and 14)<br />4. Make sure box 13 and 14 are unchanged from FMK&#039;s one-off code<br /><br />Hope this is useful!&nbsp; :)


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Edited the male hp grass code- accidentally put the code for 14 atk 15 def. Don&#039;t write posts at 4 am.<br />I could make a sheet with codes for any combination of DVs, but I don&#039;t know that anyone needs anything besides max HPs and shiny spreads.<br />Also curious to know whether the game stores the special DV or the Spd DV first. I would have assumed special, but I&#039;ve seen the order or stats listed atk, def, spd, special in that order.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I guess really, if I have a code to work with I just need to figure out what to change to get the move I want. With enough examples I could reverse engineer the pokemon formula and the DV formula, but this seems to be different (not targeting the first pokemon in the party, and changing the code for box 1 as opposed to box 2). I don&#039;t really speak programming, so any drastic change in the format is confusing.<br />As I understood with the other codes, box 1 was basically telling the code what to target, and box 2 was telling it what to change it to, but this is box 1 doing the changing somehow. <br />In Ap0?&#039;vm55, is Ap[xxxx]55 what I am to be changing? I suppose that would make sense since 230 - 172 = 58 (ice beam).<br /><br />From a technical standpoint though, what does FMK&#039;s code do? What&#039;s the advantage to filling the rest of the pc with 5&#039;s then writing that for box 13 and 14 as opposed to using the &#039;return to game&#039; code?<br />(Sorry I&#039;m generally rambling and being confused while understanding stuff only as I start to type).


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207368#msg207368 date=1508706306]<br />I guess really, if I have a code to work with I just need to figure out what to change to get the move I want. With enough examples I could reverse engineer the pokemon formula and the DV formula, but this seems to be different (not targeting the first pokemon in the party, and changing the code for box 1 as opposed to box 2). I don&#039;t really speak programming, so any drastic change in the format is confusing.<br />As I understood with the other codes, box 1 was basically telling the code what to target, and box 2 was telling it what to change it to, but this is box 1 doing the changing somehow. <br />In Ap0?&#039;vm55, is Ap[xxxx]55 what I am to be changing? I suppose that would make sense since 230 - 172 = 58 (ice beam).<br /><br />From a technical standpoint though, what does FMK&#039;s code do? What&#039;s the advantage to filling the rest of the pc with 5&#039;s then writing that for box 13 and 14 as opposed to using the &#039;return to game&#039; code?<br />(Sorry I&#039;m generally rambling and being confused while understanding stuff only as I start to type).<br />[/quote]<br /><br />Here&#039;s a breakdown of Box 1:<br /><br />A ;Useless char that does nothing<br />p ; XOR a, so a = $00<br />0? ; OR $e6, so a = $e6<br />&#039;vm ; SUB $ac so a - $ac = $3a (Ice beam)<br />5; ei, Interupts are already enabled so this does nothing<br />5 ; ei, same deal<br />(end terminator) ; ld d,b<br /><br />And then Box 2 proceeds to load [b]a[/b] into the desired location (In this case, $faef)<br /><br />So if you wanted to make alterations to this code, you would replace [b]?[/b] and [b]m[/b] with two values that you wish to subtract. Essentially, we are taking 2 values that can be represented as valid characters and subtracting them to get a value we would not have been able to type with characters.<br /><br />As for FMK&#039;s code, I&#039;m not sure. It loads different values into [b]a[/b] and then into three different addresses, none of which i know anything about. What i do know is that Box 13 and 14 are required in every use because they repair the stack to a playable state.<br /><br />Hope this helped! 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207369#msg207369 date=1508709223]<br />Here&#039;s a breakdown of Box 1:<br /><br />A ;Useless char that does nothing<br />[/quote]<br /><br />More like an ignored character. With the usual setup (Quagsire holding TM02 with Return as first move) execution starts at the [b]second[/b] character of the first box name.<br />You can literally put whatever character you want here. It&#039;s just A as a default, since that&#039;s where the cursor starts.<br /><br />[quote]<br />[quote author=Dragon Arbock link=topic=6716.msg207368#msg207368 date=1508706306]<br />From a technical standpoint though, what does FMK&#039;s code do? What&#039;s the advantage to filling the rest of the pc with 5&#039;s then writing that for box 13 and 14 as opposed to using the &#039;return to game&#039; code?<br />(Sorry I&#039;m generally rambling and being confused while understanding stuff only as I start to type).<br />[/quote]<br />As for FMK&#039;s code, I&#039;m not sure. It loads different values into [b]a[/b] and then into three different addresses, none of which i know anything about. What i do know is that Box 13 and 14 are required in every use because they repair the stack to a playable state.<br /><br />Hope this helped!<br />[/quote]<br /><br />FMK&#039;s code puts the &#039;return to game&#039; code into Box 13 and 14.<br />Filling the boxes with 5&#039;s just is a save passing code so execution reaches the return to game part.<br />The advantage is you don&#039;t have to engineer it yourself everytime you write a new code since you have to use a character normally not available. And you also have to figure out where to put it.<br />Otherwise part of the code always has to be &quot;put the instruction for INC SP at the right place before it is executed&quot;. Due to limited charset (in most cases) this also restricts your available space to write code to a bit more than 8 box names, part of which is the &#039;return to game&#039; code.<br /><br />Hope this wasn&#039;t too techy.<br /><br /><br />[quote]With enough examples I could reverse engineer the pokemon formula and the DV formula, but this seems to be different (not targeting the first pokemon in the party, and changing the code for box 1 as opposed to box 2).[/quote]<br />Targeting the fourth move of PokÃ©mon 5 is simply because we can reach it directly with available characters. Therefore Box 1 can be used to get the ID for the desired move. The code of Box 2 then writes it.


