# smf_messages

subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Right, the last few days i have been working on the pong game. After a few small problems I finally got to a point where my game does not crash when I execute the program&nbsp; :P. However its not exaclty the pong as it is in the video. There are 2 things not quite right.<br /><br />The first thing is the screen color. Its not black. Its more vertical lines of grey and white. Something like this:<br />(its worth noting that I am trying this on vitual console.)<br /><br />[IMG]http://i63.tinypic.com/4ictcm.png[/img]<br /><br />The second this is the game over... better yet, there is no game over. When the ball hits the bottom of the screen the ball just dissapears. However the sound of the ball bouncing still plays. Then after a while the ball comes back up from the bottom of the screen into play till I miss it with the pad and it goes under the screen again. So I took a closer look at the code. The &quot;game-over&quot; subroutine starts at $D918. But there are no jumps to that adress (neither relative nor absolute). My guess is thats a small mistake in the code? The following lines a from the code. I think this is where its supposed to jump to $D918 instead of $D976.<br /><br />[code]<br />cp&nbsp;  a,$11<br />jp&nbsp;  z,D976_UpdateBallPosition ; If Y=$11 (DEC 17), the lower part of the screen, it&#039;s game over<br />[/code]<br />


subject: I'm making a PokÃ©mon Blue hack/bootleg
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t have a title, but it will be like a bootleg, like for example, pressing B makes weird text, and sprites are sometimes messed up in varying degrees. Here&#039;s a few screenshots: http://imgur.com/a/WdxNa<br /><br />Anyway, I need a few things:<br /><br />- Does anybody know what controls whether an item list is selectable or not?<br />- Can somebody give me a patch in which holding select ends the current textbox, ?<br /><br />


subject: Brock Through Walls, Pidgey method HP
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was doing some experimentation with the [url=http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Red/Blue/Glitched_No_Save_Corruption/Route]any% no save corruption route[/url] in Pokemon Blue, and after getting frustrated trying to get a Pidgey to 15 HP, I decided to just wing it and try with 13 HP. It worked! I got all the way to Saffron with no issues.<br /><br />I don&#039;t know what all this means for the HP requirements, but I don&#039;t think 15 is as rigid a requirement as it seems.<br /><br />I did this on the 3DS VC version. I&#039;ll give it a shot on BGB tonight with different RAM values to see what happens.


subject: Re: Brock Through Walls, Pidgey method HP
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Try reproducing this with another save file. My guess is that the game luckily found some matching data that was not related to your Pidgey, but I can be wrong.


subject: Re: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Beware not to mistake the Game Boy&#039;s sprites with the game&#039;s logical sprites. Usually one game sprite represents four Game Boy sprites.


subject: Re: Brock Through Walls, Pidgey method HP
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  I was able to reproduce it in BGB. My Bulbasaur was level 7, had 14/24 HP, and had 13/12/11/16 stats.<br /><br />I used the RAM editor to try every value of HP from 0 to 19 on my Pidgey. <br /><br />If my Pidgey had 6, 8, 10, 13, 15, or 17 HP, I managed to Brock Through Walls all the way to Saffron just fine with no trouble.<br /><br />If it had 4 or 16 HP, I was able to Brock Through Walls to Saffron, but I couldn&#039;t open the menu or talk to anyone once I got to Saffron Center. I [i]could[/i] access the PC in the Saffron Center, and from there I could change boxes and reset to get rid of the effect.<br /><br />If it had 18 or 19 HP, it filled the RAM with garbage and crashed.<br /><br />If it had any other value, it didn&#039;t allow enough freedom of movement to get to Saffron City.<br /><br />This will need some additional verification, but from the looks of it there are at least 6 values of HP you can use for the Pidgey BTW method, not just one.


subject: Re: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7521.msg200746#msg200746 date=1468455361]<br />Beware not to mistake the Game Boy&#039;s sprites with the game&#039;s logical sprites. Usually one game sprite represents four Game Boy sprites.<br />[/quote]<br />According to what I see in the OAM (in the video I have given)<br />Usually the last four sprites is the top left gameboy sprite, and seems to be always the same. I&#039;m not sure about the use of that, maybe to prevent too much sprites from appearing<br />But when you and many thing disappear, I noticed that last 4 sprites were replaced.<br />That&#039;s something?


subject: Re: Brock Through Walls, Pidgey method HP
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Speaking of speed runs, this one looks interesting: http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Yellow/151_Pok%C3%A9mon/Textbox_Underflow_Route


subject: Re: Brock Through Walls, Pidgey method HP
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7535.msg200749#msg200749 date=1468466374]<br />Speaking of speed runs, this one looks interesting: http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Yellow/151_Pok%C3%A9mon/Textbox_Underflow_Route<br />[/quote]Very interesting xD 


subject: Park Ball odd effect Gold/Silver
poster_name: bestgoldglitche
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m not entirely sure what&#039;s going on with this glitch, it doesn&#039;t seem to harmful or anything, but I couldn&#039;t find any information on it.&nbsp; What I did is use the Park Ball in Pokemon Gold outside of a bug catching contest, on a gameboy, not an emulator.<br /><br />Using the Park Ball seems to have corrupted the graphics momentarily, but when the Pokemon breaks free, or the battle ends or something, the graphics go back to normal.&nbsp; For a moment it looks pretty glitchy, but it&#039;s only a flash.<br /><br />How I got the Park Ball in the first place:<br />https://www.youtube.com/watch?v=SpfgOVfGVTo<br /><br />I altered the PC items a bit:<br />One extra Fresh Water (this makes it so you change the hold item of your first party Pokemon instead of index number)<br />Replace HM07 with SQUIRTBOTTLE<br /><br />Once you use the glitch a couple times, go throw a park ball in a wild battle, the screen should freak out a little, and then it goes back to normal.<br /><br />My question for all of you who could / would try this on an emulator is what&#039;s actually happening, and if it&#039;s anything of note?


subject: Re: Park Ball odd effect Gold/Silver
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=bestgoldglitche link=topic=7536.msg200751#msg200751 date=1468481446]<br />I&#039;m not entirely sure what&#039;s going on with this glitch, it doesn&#039;t seem to harmful or anything, but I couldn&#039;t find any information on it.&nbsp; What I did is use the Park Ball in Pokemon Gold outside of a bug catching contest, on a gameboy, not an emulator.<br /><br />Using the Park Ball seems to have corrupted the graphics momentarily, but when the Pokemon breaks free, or the battle ends or something, the graphics go back to normal.&nbsp; For a moment it looks pretty glitchy, but it&#039;s only a flash.<br /><br />How I got the Park Ball in the first place:<br />https://www.youtube.com/watch?v=SpfgOVfGVTo<br /><br />I altered the PC items a bit:<br />One extra Fresh Water (this makes it so you change the hold item of your first party Pokemon instead of index number)<br />Replace HM07 with SQUIRTBOTTLE<br /><br />Once you use the glitch a couple times, go throw a park ball in a wild battle, the screen should freak out a little, and then it goes back to normal.<br /><br />My question for all of you who could / would try this on an emulator is what&#039;s actually happening, and if it&#039;s anything of note?<br />[/quote]<br />Did you used the wrong video?<br />It didn&#039;t explain how&#039;d you get the park ball<br />But anyway...<br />I&#039;ll have to make a guess since I do not play GS<br />On no picture or whatever, I&#039;ll have to guess that it&#039;ll keep corrupting the graphics addresses with some values until it find the value of &quot;Pokemon break free&quot;<br />But if a Pokemon never break free, the address of &quot;Pokemon break free&quot; will never be executed, thus the corruption keeps on going<br />But when it break free, the address with be called, thus ending the corruption<br />Purely my guess since we do not know anything about what happened<br />And I don&#039;t think console and emulator will differ


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  Here&#039;s one that gives you 1 of every TM in your PC box. Just make sure you&#039;re OK losing everything in your Item PC, because it overwrites all the items.<br />[list type=decimal]<br />[li]8F[/li]<br />[li](any item)[/li]<br />[li]X Accuracy x58[/li]<br />[li]Carbos x213[/li]<br />[li]Awakening x50[/li]<br />[li]Super Potion x6[/li]<br />[li]TM01 x121[/li]<br />[li]Water Stone x120[/li]<br />[li]Water Stone x175[/li]<br />[li]Fresh Water x4[/li]<br />[li]Ice Heal x32[/li]<br />[li]TM47 x34[/li]<br />[li]Max Revive x255[/li]<br />[li]Potion x201[/li]<br />[/list]<br /><br />[code]WRA1:d322 2e 3a&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,3a<br />WRA1:d324 26 d5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  h,d5&nbsp; &nbsp; ; Initiates HL to point to the Item PC<br />WRA1:d326 0e 32&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  c,32&nbsp; &nbsp; ; 50 Decimal, works as a counter and as a Item PC Number<br />WRA1:d328 13&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; de&nbsp; &nbsp; &nbsp; ; padding<br />WRA1:d329 06 c9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,c9&nbsp; &nbsp; ; TM01<br />WRA1:d32b 79&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  a,c&nbsp; &nbsp;  ; Loads 50 into A register<br />WRA1:d32c 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ldi&nbsp; (hl),a&nbsp; ; First iteration, tells PC it has 50 items; after that, loads 1 into each Item Quantity address<br />WRA1:d32d 78&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  a,b&nbsp; &nbsp;  ; Load TM value into A...<br />WRA1:d32e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ldi&nbsp; (hl),a&nbsp; ; ...then put that TM in the PC<br />WRA1:d32f af&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  xor&nbsp; a<br />WRA1:d330 3c&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; a&nbsp; &nbsp; &nbsp;  ; A = 1<br />WRA1:d331 04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; b&nbsp; &nbsp; &nbsp;  ; Next TM<br />WRA1:d332 0d&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  dec&nbsp; c<br />WRA1:d333 20 f7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jr&nbsp;  nz,d32c ; Loop until C = 0<br />WRA1:d335 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ldi&nbsp; (hl),a&nbsp; ; Final item&#039;s quantity<br />WRA1:d336 36 ff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  (hl),ff ; End of Item PC list<br />WRA1:d338 14&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; d&nbsp; &nbsp; &nbsp;  ; padding<br />WRA1:d339 c9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret [/code]


subject: Re: Park Ball odd effect Gold/Silver
poster_name: bestgoldglitche
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=7536.msg200752#msg200752 date=1468491842]<br />Did you used the wrong video?<br />It didn&#039;t explain how&#039;d you get the park ball<br />[/quote]<br />No, I just altered the items as I described and it gives you the park ball as a hold item of your first pokemon


subject: Need some help on 4 4
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Can someone tell me what&#039;s the effect of its sprite deconpression (aside from crashing)<br />Also, where does it its cry point to?<br />I know, I know it&#039;s invalid, but where exactly it&#039;s invalid cry point to?<br />I&#039;m so lost on discovering 4 4


subject: Re: Need some help on 4 4
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, the game gets messed up because its sprite size is too big. 256*256, infact. The game draws too many bytes and ends up overflowing. 4 4&#039;s &quot;cry&quot; is really an effect due to the game jumping to 0x019A for somereason. This subroutine does some stuff with Pikachu&#039;s cry, leading to weird grinding noises. 4 4&#039;s actual cry is a move sound, I forgot which one, maybe Earthquake.


subject: Re: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m on a plane, so I occupied myself by struggling to type an understandable passage. Please don&#039;t mind if you don&#039;t understand all, it&#039;s my fault.<br /><br />OAM doesn&#039;t have enough space to handle 11 GB sprites (44 game sprites) So the 11th sprite overflowed to the address after the last address of OAM (supposingly&nbsp; $c3a0)<br />And $c3a0 is where tilemap starts.<br />And basically it&#039;s recreating another OAM in the tilemap.<br /><br />My theory is that there&#039;s actually a square outline of address with $a0 covering the tilemap.<br />That&#039;s because it need to make the sprites $a0 once you walked away and the sprite is off screen<br />If not, sprite will &quot;appear&quot; and still be loaded offscreen. In theory (yes theory), there&#039;s 255(256) sprite (including glitched). But since if you never seen that sprite AFTER the whole OAM is unloaded (all filled with A0 00 00 00) (example of this will be after rebooting the gameboy, resetting the game) , it wouldn&#039;t really be ever be loaded (changed from $a0)<br />But once you seen 10+ sprite, this glitch will happen.<br />So (without actually testing and just randomly guessing a answer that seems fit) developer added a extra $a0 outline.<br />That follows you as you walk.<br />Once it fully covers a sprite, the sprite will be A0 00 00 00&#039;d<br /><br />There&#039;s a reason why I guessed this<br />Since the screen is corrupted every 4 bytes, with 1 of the a0&#039;s on the edge of screen and another 1 almost on the edge, but one byte space<br />So I think that there&#039;s extra 2 bytes off screen<br />Then somehow come up with this<br /><br />Anyway, it should be wrong, <br />so just ignore that<br />So... a quote from _Crystal: &quot;If there are 11 sprites, hOAMBufferOffset is going to end up becoming $b0 given that PrepareOAMData is taking care of what would be a total of 44 objects ($00 to $af).&quot;<br />So it ended up the corruption starting at $c3b0 and ending at $c4b0! <br />And there we have 2 OAM:<br />1 from $c2a0 to $c3a0<br />2 from $c3b0 to $c4b0<br />And actually, you can see it isn&#039;t really that game breaking!<br />Because menu data starts at $CC24, and it&#039;s very very far away, it won&#039;t do anything to harm your game :0<br />So the end there&#039;s nothing to really investigate on about :9<br /><br />Don&#039;t understand?<br />Basically the OAM is full, so the extra 11th sprite is overflowed to another place that stores tile data (map), and since OAM have unused bytes (blank space), they are make of A0,00,00 and 00, so when the 11th Sprite is overflowed and also &quot;make&quot; another OAM in the tile data, the &quot;a&quot;s are A0<br />,00,00 and more 00. So that&#039;s why you only see an &quot;a&quot; every four block/byte :3<br /><br />Still don&#039;t understand?<br />Well, in short, there is blank, unused sprites to fill up the &quot;cache&quot; that store sprites<br />There&#039;s 11 Sprite on screen, a single &quot;cache&quot; cannot store all so it replaced the next &quot;cache&quot; that was supposed to store another thing to the kind of &quot;cache&quot; that store sprites which is called OAM.<br /><br />If you still ask &quot;what am I talking about&quot;, you have no hope<br />


subject: Re: Highest possible DV values for Gen 1 games
poster_name: suloku
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: suloku
icon: xx
body:
  This is very interesting. Today I&#039;ve actually wondered how Gen 1 and 2 randomness works.<br /><br />EDIT: removed my previous dumb post made before actually reading the full information.<br /><br />About the in-game trade, it would be simple to test: play a while, make some wild battles and save before trading in emulator and make a savestate. Trade the pokemon and check the DVs. Then load the savestate and shutdowon emulator and start over, and trade again and check the DVs. If there&#039;s some random number generator involved that should produce different DVs.<br /><br /><br />I wonder how PRNG works in GSC... I&#039;m curious to see if the RNG algorythm was used for the distribution machines at PNYC (or the celebi tour for example). These had random DVs (shiny locked apparently, which might make it more difficult...).<br /><br />Maybe the ID# was used as seed? There&#039;s a savegame with many celebis (around 12) from those machines, and some are from the same machine and very close to each other (in fact there are 2 that are sequential). How cool would it be to find the algorythm used&nbsp; and essentially be able to code a Celebi machine? I guess I&#039;m dreaming too high though, but maybe they really did use the same algorythm as in GSC. And now I&#039;m wondering about the red gyarados. If the attack is random in GSC, that would mean the RNG function is in the game, running until it hits a shiny DV combination, which might have been how these machines worked... for shiny lock may be the same but just skipping shiny DV combinations...


subject: Re: Need some help on 4 4
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7538.msg200759#msg200759 date=1468562274]<br />4 4&#039;s &quot;cry&quot; is really an effect due to the game jumping to 0x019A for somereason.<br />[/quote]<br /><br />This is something I didn&#039;t know, yet it is every important.<br /><br />After hacking the game to jump to address $0135 from an RST vector (change bytes at $0038 to C3 35 01), not too far away from $019A, the &quot;true cry&quot; happens exactly how it did in my video. Similar effects happen when jumping to other nearby locations. So, somehow, one of the invalid sound banks causes jumps to this part of memory.<br /><br />If I had a way of determining which sound bank it was (and why invalid sound banks tend to crash), I could then use my &quot;SRAM corruption emulator&quot; to find the conditions necessary to reproduce the effect. Obviously nobody knows if the effect was actually caused by corrupting sound bank data, because 4 4&#039;s effects also partially depend on location. But still, it&#039;s worth a shot.<br /><br />4 4&#039;s actual cry is one of the sound channels of the move Surf. [url=https://youtu.be/_0czHNnhUVs?t=2m55s]https://youtu.be/_0czHNnhUVs?t=2m55s[/url]<br />This cry is not related in any way to the effects caused by decompressing 4 4&#039;s sprite. The &quot;true cry&quot; is just a reference to a similar glitch, &quot;Missingno.&#039;s true cry&quot;. They are both caused by corrupting sound-related RAM addresses. [url=https://youtu.be/X71p0sKAaFw]https://youtu.be/X71p0sKAaFw[/url]


subject: Re: G/S/C glitch discussion
poster_name: bestgoldglitche
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: bestgoldglitche
icon: clip
body:
  Hey guys, I started playing around with the glitch moves, index numbers 252, 253, 254, 255 and found some strange results... I got the moves via the coin case glitch, I&#039;ve got a video on teaching moves here:<br />https://www.youtube.com/watch?v=KdpbBYio-T0<br />Here&#039;s what I found:<br /><br />The names of the moves change seemingly at random depending on the other moves that I&#039;ve already taught to the pokemon, so I&#039;ll refer to them by index.<br /><br />move 252 : FC <br />The first time I opened up the battle screen and hit fight it worked fine, when I used it it said: &quot;But nothing happened&quot;, the game crashed, and reloaded in a glitch dimension that I havent seen before.&nbsp; After that, the game crashed every time I opened the fight menu, so I had to use the coin case to delete the move.<br /><br />move 253 : FD<br />At this point I had 253, 254, and 255 learned, so this might be caused by some combination of the three, but opening the fight menu required that I press A to read through the rest of the name of 253, then trying to scroll down to another move froze the game.&nbsp; The second time, the screen loaded without me pressing A.&nbsp; And scrolling down caused the screen to flash gibberish and go white...&nbsp; When set as the first move: opening the fight menu caused lots of gibberish to flash on screen and then crash white<br /><br />move 254 : FE<br />Scrolling to this one made the screen flash, and my gameboy died at the same, not sure if it was a reset.&nbsp; Tried it again, that one just makes the screen go black. When set as the first move: opening the fight menu cashed the game with a blank black screen.<br /><br />move 255 : FF<br />Scrolled to it, screen went black, then flashed white, then black, and the gameboy died again.&nbsp; Try again, and again it when black.&nbsp; When set as the first move: opening the fight menu cashed the game <br /><br />Oh and I almost forgot:<br />move 0 : 00<br />Unfortunately it acts a lot like the rest, just resets the game in the cool glitch dimension<br /><br />Turns out these dont do much, but I thought I&#039;d document them here<br /><br />


subject: Re: How to fix dry PC underflow
poster_name: Dante
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dante
icon: xx
body:
  [quote author=Torchickens link=topic=7520.msg200646#msg200646 date=1467121350]<br />Dante, I worked on a code for this in French, Spanish, German and Italian Red.<br /><br />Lemonsucco x50<br />Carburante x213<br />Precisione X x63<br />Pietraidrica x4<br />Precisione X x164<br />Repellente x255<br />PokÃ© Ball x115<br />MT04 x1<br /><br />[code]<br />ld a,32<br />ld h,D5<br />ld l,3F<br />ldi (hl),a<br />inc b<br />ld l,A4<br />ld e,FF<br />inc b<br />ld (hl),e<br />ret<br />[/code]<br /><br />[code]3E 32 26 D5 2E 3F 22 04 2E A4 1E FF 04 73 C9[/code]<br /><br />The code sets the number of PC items to 50 and adds an FF byte in item 51&#039;s slot. Hope this works out for you! :)<br />[/quote]<br />Finally I was able to try this out, but it didn&#039;t worked ):<br /><br /><br />EDIT:<br />Eventually I swapped TM04 for TM01 and it worked :)


subject: Re: Need some help on 4 4
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7538.msg200762#msg200762 date=1468566834]<br />[quote author=drc link=topic=7538.msg200759#msg200759 date=1468562274]<br />4 4&#039;s &quot;cry&quot; is really an effect due to the game jumping to 0x019A for somereason.<br />[/quote]<br /><br />This is something I didn&#039;t know, yet it is every important.<br /><br />After hacking the game to jump to address $0135 from an RST vector (change bytes at $0038 to C3 35 01), not too far away from $019A, the &quot;true cry&quot; happens exactly how it did in my video. Similar effects happen when jumping to other nearby locations. So, somehow, one of the invalid sound banks causes jumps to this part of memory.<br /><br />If I had a way of determining which sound bank it was (and why invalid sound banks tend to crash), I could then use my &quot;SRAM corruption emulator&quot; to find the conditions necessary to reproduce the effect. Obviously nobody knows if the effect was actually caused by corrupting sound bank data, because 4 4&#039;s effects also partially depend on location. But still, it&#039;s worth a shot.<br /><br />4 4&#039;s actual cry is one of the sound channels of the move Surf. [url=https://youtu.be/_0czHNnhUVs?t=2m55s]https://youtu.be/_0czHNnhUVs?t=2m55s[/url]<br />This cry is not related in any way to the effects caused by decompressing 4 4&#039;s sprite. The &quot;true cry&quot; is just a reference to a similar glitch, &quot;Missingno.&#039;s true cry&quot;. They are both caused by corrupting sound-related RAM addresses. [url=https://youtu.be/X71p0sKAaFw]https://youtu.be/X71p0sKAaFw[/url]<br />[/quote] I see... So every glitch Pokemon that uses a invalid sound bank might have a chance to jump to a part of memory...<br />If you could really find out what sound bank that was, maybe the &quot;true cry&quot; could be reproduced! Amazing~<br />But does this mean different invalid sound bank can have a chance to jump to different part of memory?<br /><br /><br /><br /><br />[s]ACE through invalid sound bank maybe?[/s]


subject: Re: How to fix dry PC underflow
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yep, there was a mistranslation from hex to items, so the code would fail to properly terminate. TM04 had to be swapped with a TM01. Also, TM01&#039;s quantity doesn&#039;t matter ^^


subject: Re: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  First, you swapped Game sprites and GB sprites. 1 Game sprite uses 4 GB sprites. The GB can display 40 sprites, with their data being taken from a memory area known as the OAM (refer to [url=http://gbdev.gg8.se/wiki/articles/Video_Display#VRAM_Sprite_Attribute_Table_.28OAM.29]this[/url]). Accessing the OAM is quite a pain, so the game writes some GB sprite data to a buffer in RAM, which I&#039;ll refer to as the Pseudo-OAM, then uses a feature known as DMA transfer to commit data to the actual OAM.<br /><br />Still according to the same page, vertical values &gt;= 160 ($A0) are out of bounds and thus won&#039;t be displayed. So, to hide a sprite, the game places it out of bounds.<br /><br />However, GB sprites are 8x8, and that&#039;s really small ! So, the programmers decided that, for the overworld, sprites would be grouped in 2x2 squares (16x16 pixels). Thus, they created a buffer I&#039;ll refer to as Game OAM, which holds data for the 16x16 pseudo-sprites (plus some metadata like movement).<br /><br />The usual cycle works like so :<br />[list type=decimal]<br />[li]Run overworld code that will edit Game OAM[/li]<br />[li]&quot;Decompress&quot; each Game sprite into four sprites, and write them to the Pseudo-OAM[/li]<br />[li]Use a DMA transfer to commit that to the actual OAM[/li]<br />[li]The GB&#039;s video driver takes care of the rest[/li]<br />[/list]<br />What happens here is that 11 Game Sprites are loaded, so when the game tries to clean their Pseudo-Sprites, it cleans data that is located right past the Pseudo-OAM. Tiles being corrupted in a one-per-four pattern comes from GB sprite structure being 4 bytes long. The game simply alters what it believes to be vertical positions to $A0.<br /><br /><br />Keep in mind, BGB / VBA cannot display you the Game OAM nor the Pseudo-OAM because they are game-specific, they can only display you the OAM, the real one.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg200768#msg200768 date=1468595844]<br />The Potion x201 can be swapped with a TM01 x[any qty]... supposing you have one :D<br />[/quote]<br /><br />Yeah, but I figured I&#039;d be likely to have potions on hand anyways in normal gameplay. I&#039;m working on a speedrun route where the final goal is to have all the TMs, and the route centers around getting this inventory and using 8F.


subject: Re: Pokemon Red/Blue Oak's lab sprite glitch
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7521.msg200769#msg200769 date=1468596493]<br />First, you swapped Game sprites and GB sprites. 1 Game sprite uses 4 GB sprites. The GB can display 40 sprites, with their data being taken from a memory area known as the OAM (refer to [url=http://gbdev.gg8.se/wiki/articles/Video_Display#VRAM_Sprite_Attribute_Table_.28OAM.29]this[/url]). Accessing the OAM is quite a pain, so the game writes some GB sprite data to a buffer in RAM, which I&#039;ll refer to as the Pseudo-OAM, then uses a feature known as DMA transfer to commit data to the actual OAM.<br /><br />Still according to the same page, vertical values &gt;= 160 ($A0) are out of bounds and thus won&#039;t be displayed. So, to hide a sprite, the game places it out of bounds.<br /><br />However, GB sprites are 8x8, and that&#039;s really small ! So, the programmers decided that, for the overworld, sprites would be grouped in 2x2 squares (16x16 pixels). Thus, they created a buffer I&#039;ll refer to as Game OAM, which holds data for the 16x16 pseudo-sprites (plus some metadata like movement).<br /><br />The usual cycle works like so :<br />[list type=decimal]<br />[li]Run overworld code that will edit Game OAM[/li]<br />[li]&quot;Decompress&quot; each Game sprite into four sprites, and write them to the Pseudo-OAM[/li]<br />[li]Use a DMA transfer to commit that to the actual OAM[/li]<br />[li]The GB&#039;s video driver takes care of the rest[/li]<br />[/list]<br />What happens here is that 11 Game Sprites are loaded, so when the game tries to clean their Pseudo-Sprites, it cleans data that is located right past the Pseudo-OAM. Tiles being corrupted in a one-per-four pattern comes from GB sprite structure being 4 bytes long. The game simply alters what it believes to be vertical positions to $A0.<br /><br /><br />Keep in mind, BGB / VBA cannot display you the Game OAM nor the Pseudo-OAM because they are game-specific, they can only display you the OAM, the real one.<br />[/quote] oh I see... Thank you!


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I accidentally found the answer while investigating the behavior of glitch sound banks.<br /><br />It is known that encountering unstable Missingno. on Yellow will corrupt sound-related RAM. The &quot;(Enemy) learned&quot;/&quot;(Enemy) is trying to learn&quot; effect occurs if the current sound bank at $C0EF gets corrupted to the value 0x01. Being more exact, the effect activates when the game tries to play any sound from this invalid sound bank.<br /><br />Sound banks are essentially ROM banks. Before playing a sound, the game switches to the appropriate ROM bank to play the sound from there. Every sound bank has its own handler - a piece of code which tells the game how to actually play the sounds. The game runs through a long list of comparisons to see which bank is currently loaded and execute the correct handler.<br /><br />Because the programmers never accounted for sound banks other than 0x02, 0x08, 0x0F or 0x20, the game will jump to $6BD4 every time a sound is played from a bank other than 0x02, 0x08 or 0x0F:<br /><br />[tt][i]; check if current bank is 02[/i]<br />&nbsp; &nbsp; cp $2<br />&nbsp; &nbsp; jr nz, .checkForBank08<br />&nbsp; &nbsp; [i](...)[/i]<br />.checkForBank08<br />[i]; check if current bank is 08[/i]<br />&nbsp; &nbsp; cp $8<br />&nbsp; &nbsp; jr nz, .checkForBank1F<br />&nbsp; &nbsp; [i](...)[/i]<br />.checkForBank1F<br />[i]; check if current bank is 1F[/i]<br />&nbsp; &nbsp; cp $1F<br />&nbsp; &nbsp; jr nz, .bank20<br />&nbsp; &nbsp; [i](...)[/i]<br />[b][i]; if we got here, the current bank must be 20... right?[/i]<br />.bank20[/b]<br />&nbsp; &nbsp; [b]ld a, b<br />&nbsp; &nbsp; call Handler_6BD4[/b][/tt]<br /><br />This causes the game to execute code at $6BD4 every time a sound from an invalid sound bank is played.<br />What is at this address? It depends on the loaded ROM bank, which depends on the loaded sound bank. It just so happens $6BD4 at ROM bank 0x01 will land in the middle of the [i]LearnMove[/i] subroutine:<br /><br />[tt]LearnMove:<br />&nbsp; &nbsp; call SaveScreenTilesToBuffer1<br />&nbsp; &nbsp; ld a, [wWhichPokemon]<br />&nbsp; &nbsp; ld hl, wPartyMonNicks<br />&nbsp; &nbsp; call GetPartyMonName<br />[b][i]; 6BD4 is here[/i][/b]<br />&nbsp; &nbsp; ld hl, wcd6d<br />&nbsp; &nbsp; ld de, wLearnMoveMonName<br />&nbsp; &nbsp; ld bc, NAME_LENGTH<br />&nbsp; &nbsp; call CopyData<br />&nbsp; &nbsp; [i](...)[/i][/tt]<br /><br />And suddenly, the game will attempt to teach a move!<br /><br />The move name will depend on the last string loaded into memory, which can be an item (MISSINGNO. learned POTION), a move (MISSINGNO. learned HYPER BEAM), a Pokemon (MISSINGNO. learned CHARIZARD), player&#039;s name or rival&#039;s name (MISSINGNO. learned ASSFART).<br /><br />The Pokemon that the move is taught to depends on the wWhichPokemon address ($CF91). The subroutine which calculates poison damage in the overworld (which runs every 4 steps) changes this address, and sets it to the last Pokemon it considered. So, most likely, if you don&#039;t go out of your way to manipulate this value, the game will actually attempt to teach a move to the last Pokemon in the player&#039;s party.<br /><br />Which textbox is displayed depends on whether the player&#039;s last party Pokemon already has 4 moves (&quot;trying to learn&quot; text) or has less than 4 moves (&quot;learned&quot; text).<br /><br />Trying to click through the textbox will play a sound, which will trigger another textbox, since the invalid sound bank is still loaded. This causes the game to fall into an infinite loop. After clicking through a lot of textboxes, the stack will eventually overflow, and the game will crash.


subject: Re: Need some help on 4 4
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Glitch sound banks cause jumps to $6BD4 every time a sound is played (more information: http://forums.glitchcity.info/index.php/topic,7518.msg200772.html#msg200772)<br />I checked all possible sound banks to see what code they execute.<br /><br />We see all kinds of common effects:<br />[list][li]0x01 - &quot;learned&quot;/&quot;trying to learn&quot; effect[/li]<br />[li]0x03, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0D, 0x10, 0x12-0x1E, 0x21, 0x22, 0x24-0x3F - game crashes[/li]<br />[li]0x05 - the game falls into an infinite loop and softlocks[/li]<br />[li]0x0E - returns gracefully or gives an unknown opcode, depending on which sound is played[/li]<br />[li]0x02, 0x04, 0x08, 0x0F, 0x23 - returns gracefully[/li][/list]<br /><br />Sound banks repeat every 0x40 entries (so banks 0x01, 0x41, 0x81 and 0xC1 are identical).<br />So, what else can we do with them?<br /><br />0x11 delays a few frames by executing lots of halt instructions, then writes 0x2E to $C4C1 and then returns. $C4C1 is one of the tiles in the tilemap. So, this sound bank actually has visible effects - we can see the tile change for a few frames:<br /><br />[img]https://aww.moe/3dn5ol.png[/img]<br /><br />0x04 corrupts the value of address $DFE1, depending on which sound is played, and then returns without crashing. I&#039;m not sure what this address does.<br /><br />0x40 causes the game to jump to $E137, which is in the middle of sprite data. This area of memory is hard to control in real time, but it could be manipulated during a TAS to gain arbitrary code execution. Assuming we can get a Missingno. encounter with sound bank 0x40 early on, it could be an interesting and viable strategy in no save corruption any% TASes.<br /><br />Unfortunately, I don&#039;t see anything that would be the cause of 4 4&#039;s true cry.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aldrasio link=topic=6638.msg200770#msg200770 date=1468597340]<br />[quote author=ISSOtm link=topic=6638.msg200768#msg200768 date=1468595844]<br />The Potion x201 can be swapped with a TM01 x[any qty]... supposing you have one :D<br />[/quote]<br /><br />Yeah, but I figured I&#039;d be likely to have potions on hand anyways in normal gameplay. I&#039;m working on a speedrun route where the final goal is to have all the TMs, and the route centers around getting this inventory and using 8F.<br />[/quote]<br /><br />When I code 8F payloads I generally optimize them (adding junk code) to prevent requiring invalid items, multiple key items, multiple stacks of the same item, TMs, etc, where possible. Just so the itemlist is easier to obtain..


subject: Hey.
poster_name: Dandaman955
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dandaman955
icon: xx
body:
  Could&#039;ve sworn I had joined here years ago.<br /><br />Anyway, hello. My name&#039;s Dan, and I&#039;m more of a Mega Drive hacker/homebrewer than a Pokemon hacker (at least for the earlier generations, anyway.). Chances are, there might be some of you that recognise me from YouTube or maybe even the Sonic scene, if any of you go there. I&#039;ve been a Pokemon fan for ages now (I have been floating around various sites years ago, like PokeCommunity, HallofOrigin and Skeetendo (I think it&#039;s called?)), and I&#039;ve been meaning to get into Game Boy programming, an opportunity to get back into the Pokemon scene now that I&#039;ve heard there&#039;s some disassemblies released for Pokemon R/B. This is probably one of the more technical forums, and who doesn&#039;t love glitches? 


subject: Re: Need some help on 4 4
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7538.msg200773#msg200773 date=1468610034]<br />0x04 corrupts the value of address $DFE1, depending on which sound is played, and then returns without crashing. I&#039;m not sure what this address does.<br /><br />0x40 causes the game to jump to $E137, which is in the middle of sprite data. This area of memory is hard to control in real time, but it could be manipulated during a TAS to gain arbitrary code execution. Assuming we can get a Missingno. encounter with sound bank 0x40 early on, it could be an interesting and viable strategy in no save corruption any% TASes.<br />[/quote]<br />DFE1 seems to be part of the stack.<br />[quote author=PokÃ©red]<br />SECTION &quot;Stack&quot;, WRAMX[$dfff], BANK[1]<br />wStack:: ; dfff<br />	ds -$100<br />[/quote]<br /><br />For people wondering what $E137 could be (it is mentioned nowhere in the PokÃ©red disassembly), it is almost exactly the same as $C137 (it always hold the same value).<br />So $E137 is a sprite #3&#039;s animation counter. Good luck on manipulating this one (and sprite #4&#039;s, too !) data ^^<br />Although, if we can force this sound bank and reliably have the correct data, well... guess what !<br /><br />(I agree with TheZZAZZGlitch in doubting it would give faster any% TASes, but who knows ?)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=6638.msg200774#msg200774 date=1468611897]<br />[quote author=Aldrasio link=topic=6638.msg200770#msg200770 date=1468597340]<br />[quote author=ISSOtm link=topic=6638.msg200768#msg200768 date=1468595844]<br />The Potion x201 can be swapped with a TM01 x[any qty]... supposing you have one :D<br />[/quote]<br /><br />Yeah, but I figured I&#039;d be likely to have potions on hand anyways in normal gameplay. I&#039;m working on a speedrun route where the final goal is to have all the TMs, and the route centers around getting this inventory and using 8F.<br />[/quote]<br /><br />When I code 8F payloads I generally optimize them (adding junk code) to prevent requiring invalid items, multiple key items, multiple stacks of the same item, TMs, etc, where possible. Just so the itemlist is easier to obtain..<br />[/quote]<br />I know, and in [url=http://prama-initiative.com/8F/beta/]my old GBZ80 compiler[/url], I was planning to add such a feature... but I kinda dropped its development, so oh well.


subject: Re: Genesis and bullshit
poster_name: Dandaman955
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I dunno if you still need it or not, but the debug version of Regen (0.972D) has a real-time RAM viewer. Much faster than Exodus, so if you can spare accuracy in some parts, run Regen for practicality&#039;s sake.


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7518.msg200772#msg200772 date=1468605852]<br />I accidentally found the answer while investigating the behavior of glitch sound banks.<br /><br />It is known that encountering unstable Missingno. on Yellow will corrupt sound-related RAM. The &quot;(Enemy) learned&quot;/&quot;(Enemy) is trying to learn&quot; effect occurs if the current sound bank at $C0EF gets corrupted to the value 0x01. Being more exact, the effect activates when the game tries to play any sound from this invalid sound bank.<br /><br />Sound banks are essentially ROM banks. Before playing a sound, the game switches to the appropriate ROM bank to play the sound from there. Every sound bank has its own handler - a piece of code which tells the game how to actually play the sounds. The game runs through a long list of comparisons to see which bank is currently loaded and execute the correct handler.<br /><br />Because the programmers never accounted for sound banks other than 0x02, 0x08, 0x0F or 0x20, the game will jump to $6BD4 every time a sound is played from a bank other than 0x02, 0x08 or 0x0F:<br /><br />[tt][i]; check if current bank is 02[/i]<br />&nbsp; &nbsp; cp $2<br />&nbsp; &nbsp; jr nz, .checkForBank08<br />&nbsp; &nbsp; [i](...)[/i]<br />.checkForBank08<br />[i]; check if current bank is 08[/i]<br />&nbsp; &nbsp; cp $8<br />&nbsp; &nbsp; jr nz, .checkForBank1F<br />&nbsp; &nbsp; [i](...)[/i]<br />.checkForBank1F<br />[i]; check if current bank is 1F[/i]<br />&nbsp; &nbsp; cp $1F<br />&nbsp; &nbsp; jr nz, .bank20<br />&nbsp; &nbsp; [i](...)[/i]<br />[b][i]; if we got here, the current bank must be 20... right?[/i]<br />.bank20[/b]<br />&nbsp; &nbsp; [b]ld a, b<br />&nbsp; &nbsp; call Handler_6BD4[/b][/tt]<br /><br />This causes the game to execute code at $6BD4 every time a sound from an invalid sound bank is played.<br />What is at this address? It depends on the loaded ROM bank, which depends on the loaded sound bank. It just so happens $6BD4 at ROM bank 0x01 will land in the middle of the [i]LearnMove[/i] subroutine:<br /><br />[tt]LearnMove:<br />&nbsp; &nbsp; call SaveScreenTilesToBuffer1<br />&nbsp; &nbsp; ld a, [wWhichPokemon]<br />&nbsp; &nbsp; ld hl, wPartyMonNicks<br />&nbsp; &nbsp; call GetPartyMonName<br />[b][i]; 6BD4 is here[/i][/b]<br />&nbsp; &nbsp; ld hl, wcd6d<br />&nbsp; &nbsp; ld de, wLearnMoveMonName<br />&nbsp; &nbsp; ld bc, NAME_LENGTH<br />&nbsp; &nbsp; call CopyData<br />&nbsp; &nbsp; [i](...)[/i][/tt]<br /><br />And suddenly, the game will attempt to teach a move!<br /><br />The move name will depend on the last string loaded into memory, which can be an item (MISSINGNO. learned POTION), a move (MISSINGNO. learned HYPER BEAM), a Pokemon (MISSINGNO. learned CHARIZARD), player&#039;s name or rival&#039;s name (MISSINGNO. learned ASSFART).<br /><br />The Pokemon that the move is taught to depends on the wWhichPokemon address ($CF91). The subroutine which calculates poison damage in the overworld (which runs every 4 steps) changes this address, and sets it to the last Pokemon it considered. So, most likely, if you don&#039;t go out of your way to manipulate this value, the game will actually attempt to teach a move to the last Pokemon in the player&#039;s party.<br /><br />Which textbox is displayed depends on whether the player&#039;s last party Pokemon already has 4 moves (&quot;trying to learn&quot; text) or has less than 4 moves (&quot;learned&quot; text).<br /><br />Trying to click through the textbox will play a sound, which will trigger another textbox, since the invalid sound bank is still loaded. This causes the game to fall into an infinite loop. After clicking through a lot of textboxes, the stack will eventually overflow, and the game will crash.<br />[/quote] Nice~


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  TheZZAZZGlitch, did you investigate what code other banks yield ? Otherwise, it might be cool to write a tool that looks through ROM to find whether or not we get cool instructions... and, hopefully, a jp / call somewhere in RAM ?


subject: Re: Need some help on 4 4
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheUnReturned
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7538.msg200773#msg200773 date=1468610034]<br />Glitch sound banks cause jumps to $6BD4 every time a sound is played (more information: http://forums.glitchcity.info/index.php/topic,7518.msg200772.html#msg200772)<br />I checked all possible sound banks to see what code they execute.<br /><br />We see all kinds of common effects:<br />[list][li]0x01 - &quot;learned&quot;/&quot;trying to learn&quot; effect[/li]<br />[li]0x03, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0D, 0x10, 0x12-0x1E, 0x21, 0x22, 0x24-0x3F - game crashes[/li]<br />[li]0x05 - the game falls into an infinite loop and softlocks[/li]<br />[li]0x0E - returns gracefully or gives an unknown opcode, depending on which sound is played[/li]<br />[li]0x02, 0x04, 0x08, 0x0F, 0x23 - returns gracefully[/li][/list]<br /><br />Sound banks repeat every 0x40 entries (so banks 0x01, 0x41, 0x81 and 0xC1 are identical).<br />So, what else can we do with them?<br /><br />0x11 delays a few frames by executing lots of halt instructions, then writes 0x2E to $C4C1 and then returns. $C4C1 is one of the tiles in the tilemap. So, this sound bank actually has visible effects - we can see the tile change for a few frames:<br /><br />[img]https://aww.moe/3dn5ol.png[/img]<br /><br />0x04 corrupts the value of address $DFE1, depending on which sound is played, and then returns without crashing. I&#039;m not sure what this address does.<br /><br />0x40 causes the game to jump to $E137, which is in the middle of sprite data. This area of memory is hard to control in real time, but it could be manipulated during a TAS to gain arbitrary code execution. Assuming we can get a Missingno. encounter with sound bank 0x40 early on, it could be an interesting and viable strategy in no save corruption any% TASes.<br /><br />Unfortunately, I don&#039;t see anything that would be the cause of 4 4&#039;s true cry.<br />[/quote]<br />It&#039;s actually a very early ACE, but we do need to know how can it work...<br /><br />Also, 4 4 does corrupt sound banks too, and since 4 4 sprite is much more bigger (256 X 256 in theory) and unstable (player location might affect the sprite/effect, but how is unknown), it&#039;s kinda hard to figure it out.<br /><br />Any thing on how much impact does 4 4&#039;s corruption does?<br /><br /><br />EDIT: What if the invalid sound bank were loaded before encountering 4 4 makes it don&#039;t crash?<br />Also is there any difference if you used the gameshark code &quot;encounter any Pokemon&quot;?


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7518.msg200780#msg200780 date=1468626944]<br />TheZZAZZGlitch, did you investigate what code other banks yield ? Otherwise, it might be cool to write a tool that looks through ROM to find whether or not we get cool instructions... and, hopefully, a jp / call somewhere in RAM ?<br />[/quote]<br />Sadly, most invalid banks tend to crash, so don&#039;t expect too much from it. :P


subject: Re: Hey.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey !<br /><br />You want technical ? Here, you got four people who love technicals :<br />-&gt; TheZZAZZGlitch (*cough cough*pannenkoek2012*cough cough*)<br />-&gt; Crystal_ (and his long, technically-detailed YouTube videos)<br />-&gt; Hacky (he find lovely stuff, and explains it in elegant manners)<br />-&gt; Torchickens (to a lesser extent, but still.)<br /><br />Oh, and, if you&#039;re willing to get into GB programming, I&#039;m writing [url=http://glitchcity.info/wiki/index.php/GB_Programming]a wiki article[/url] on just that. As of now, it is a WIP, but that covers some basics.


subject: Re: Genesis and bullshit
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ll look into Regen, Exodus has no Nemesis compression support (needed for 3/4 of Genesis games)<br />


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=7518.msg200782#msg200782 date=1468627537]<br />[quote author=ISSOtm link=topic=7518.msg200780#msg200780 date=1468626944]<br />TheZZAZZGlitch, did you investigate what code other banks yield ? Otherwise, it might be cool to write a tool that looks through ROM to find whether or not we get cool instructions... and, hopefully, a jp / call somewhere in RAM ?<br />[/quote]<br />Sadly, most invalid banks tend to crash, so don&#039;t expect too much from it. :P<br />[/quote]<br />A crash can come from a jump in RAM. Use 8F without setting it u^, and you&#039;re likely to crash ;)


subject: Re: Glitch-Inspired Music
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Dropped ~$150 on a replacement for the jack -- it&#039;s a little spotty and requires cord manipulation for stereo output. I can endure arthritic pain and temporary hand paralysis, however. After all, what small community WOULDN&#039;T enjoy all 10 (11 if you count the minor edit in #7 that will be listed as an alt. track) tracks?<br /><br />I am committed to this.<br /><br />Original post will be updated with news, pop in from time to time.<br />(The main page won&#039;t update on edits... dammit...)


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7518.msg200785#msg200785 date=1468630806]<br />[quote author=TheUnReturned link=topic=7518.msg200782#msg200782 date=1468627537]<br />[quote author=ISSOtm link=topic=7518.msg200780#msg200780 date=1468626944]<br />TheZZAZZGlitch, did you investigate what code other banks yield ? Otherwise, it might be cool to write a tool that looks through ROM to find whether or not we get cool instructions... and, hopefully, a jp / call somewhere in RAM ?<br />[/quote]<br />Sadly, most invalid banks tend to crash, so don&#039;t expect too much from it. :P<br />[/quote]<br />A crash can come from a jump in RAM. Use 8F without setting it u^, and you&#039;re likely to crash ;)<br />[/quote] b-but invalid sound banks are quite hard to manipulate ._.<br />


subject: Re: Glitch-Inspired Music
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=7519.msg200787#msg200787 date=1468632012]<br />Do a music on 4 4 please :3:<br />[/quote]<br />Already done. Off the top of my head, I can&#039;t remember which track it was, but there&#039;s one there based on it. :P


subject: Categorization
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  I have several additions that could be made for the Wiki&#039;s tag system. I have several new sorting criteria in mind:<br /><br />By difficulty to perform<br />By usefulness<br />By possibility of manipulation<br />By address range (the most used/called/affected area of RAM)<br />By type (Graphical, mechanical, auditory, SRAM, mixture)<br />By severity (How much it can fuck things up)<br />By hardware (Console only, Emulator only, both)<br /><br />These would probably help A LOT with searching, as I&#039;ve needed many of these (even the by address range one, believe it or not!)<br />


subject: Re: Glitch-Inspired Music
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7519.msg200790#msg200790 date=1468636345]<br />[quote author=TheUnReturned link=topic=7519.msg200787#msg200787 date=1468632012]<br />Do a music on 4 4 please :3:<br />[/quote]<br />Already done. Off the top of my head, I can&#039;t remember which track it was, but there&#039;s one there based on it. :P<br />[/quote]<br />More suggestion:<br />zzazz<br />TMTRAINER effect<br />Invalid sound bank (srsly)


subject: Re: Hey.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7539.msg200783#msg200783 date=1468627713]<br />Hey !<br /><br />You want technical ? Here, you got four people who love technicals :<br />-&gt; TheZZAZZGlitch (*cough cough*pannenkoek2012*cough cough*)<br />-&gt; Crystal_ (and his long, technically-detailed YouTube videos)<br />-&gt; Hacky (he find lovely stuff, and explains it in elegant manners)<br />-&gt; Torchickens (to a lesser extent, but still.)<br /><br />Oh, and, if you&#039;re willing to get into GB programming, I&#039;m writing [url=http://glitchcity.info/wiki/index.php/GB_Programming]a wiki article[/url] on just that. As of now, it is a WIP, but that covers some basics.<br />[/quote] you forgot yourself :P


subject: Never wrote an introduction so I wrote one here
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  *ahem* oh hey *ahem* I&#039;m sick<br /><br />Basically messing around with glitches for 3 years and never get serious in finding anything.<br />I liked to come up with the most absurd explaination and ideas that nobody could understand, but thank you for all people for not complaining :P<br /><br />I live in Hong Kong, don&#039;t blame me for using wrong words grammar etc<br /><br />Never touched on GSC, only RBY<br /><br />Joined for a time already but didn&#039;t actually did anything until recently.<br /><br />Hello!


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  [quote author=drc link=topic=6638.msg200789#msg200789 date=1468635695]<br />Speaking of which does anybody know how to check if address YYZZ is XX, and what the output will be<br />[/quote]<br /><br />You could load that value into the quantity of the second item using the following inventory:<br /><br />8F<br />(quantifiable item, e.g. Ice Heal)<br />Poke Ball x 43<br />Awakening x YY<br />Repel x ZZ<br />Max Ether x 26<br />Burn Heal x 119<br />TM01 x any<br /><br />[code]<br />04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc b<br />2b&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dec hl<br />0e YY&nbsp; &nbsp; &nbsp;  ld c, YY<br />1e ZZ&nbsp; &nbsp; &nbsp;  ld e, ZZ<br />51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld d, c<br />1a&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld a, [de]<br />0c&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inc c<br />77&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld [hl], a<br />C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ret[/code]<br /><br />I haven&#039;t tested it yet, but I [i]think[/i] that would work.<br /><br />EDIT: Minor adjustment, decrementing HL is way more efficient than loading the value in directly


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  Does anyone have a list of the trainer fly Pokemon Yellow only trainers? I have read some things online in the past but can&#039;t find links now. I am fully aware of this: http://puu.sh/257S which covers most of the trainers in the game, but Pokemon Yellow has a good few exclusive trainers and different gym leader teams which will produce different Pokemon with the trainer fly/mew glitch, and I wondered if anyone had a list. 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=6638.msg200793#msg200793 date=1468640941]<br />On an other hand, is it possible to switch to invalid sound bank using 8F?<br />[/quote]<br />That&#039;d just require writing to C0EF and C0F0.<br />This should work :<br />&nbsp; &nbsp; Lemonade x[sound bank]<br />&nbsp; &nbsp; Carbos x 192<br />&nbsp; &nbsp; X Accuracy x239<br />&nbsp; &nbsp; Water Stone x119<br />&nbsp; &nbsp; TM01 x[any qty] OR PokÃ© Ball x201


subject: Re: Need some help on 4 4
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It has chances to be huge. The game won&#039;t be running normally after, that I can almost guarantee.


subject: Re: Categorization
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was thinking about making a topic that would give my opinon about Gen 1&#039;s glitches in terms of usage and difficulty / ridiculousness to perform.<br />Now I&#039;m motivated to do it, heh :P


subject: Gen 1 glitches : usefulness &amp; difficulties
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  This purely my opinons, but I&#039;m open to suggestions.<br /><br />[table]<br />[tr]<br />[td][b]Glitch[/b][/td][td][b]Usefulness[/b][/td][td][b]Performing difficulty[/b][/td][td][b]Red&#039;s rant[/b][/td]<br />[/tr]<br />[tr]<br />[td]8F, ws m[/td][td]OVER 9000[/td][td]Long but fine.[/td][td]&quot;Kinda makes me godlike. Huh.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Amazing Man[/td][td]As much as a broken pencil.[/td][td]Popping a text box.[/td][td]&quot;Are these guys being clowns to ATTRACT attention ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Brock Through Walls[/td][td]Nice speedrun thingy.[/td][td]Okay in length.[/td][td]&quot;That guy must have been [i]very[/i] confused. I wonder what would happen if I talked to him from above.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Cable Club escape[/td][td]Useful at times.[/td][td]May be lengthy.[/td][td]&quot;Maybe this is punishment for being rude ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Cloning[/td][td]Always nice.[/td][td]Just at that right time...[/td][td]&quot;Do I need to be QPU aligned to perform this ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Coastal Flooding[/td][td]Truly Useless.[/td][td]Mere seconds.[/td][td]&quot;The tides in this area are impressive.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Cooltrainer[/td][td]Very useful. Very.[/td][td]Thank Game Frack&#039;s awful programming for the setup length of this one.[/td][td]&quot;I feel like I&#039;m doing genetical experimentations. Do bioethics exist in this world ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Cycling Road without a bike[/td][td]Meh.[/td][td]Meh.[/td][td]&quot;I don&#039;t know what bothers me the most, the guy letting me pass, or a Bicycle spawning under me when I don&#039;t have one ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Dokokashira[/td][td]EPIC 8)[/td][td]As fast as snapping [s]Blue&#039;s neck[/s] two fingers.[/td][td]&quot;What on earth was in THAT parcel ???&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Expanded item pack[/td][td]OVER 8000 (but under 9000)[/td][td]Correct, unless playing US Yellow :P[/td][td]&quot;I found my bag was bigger on the inside.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Experience underflow[/td][td]Mostly useful when beginning the game.[/td][td]Easy peasy lemon squeezie.[/td][td]&quot;Kinda rebalances super-low-level PokÃ©mon.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]F9 box-set[/td][td]Nice, but with some side effects.[/td][td]Ewww.[/td][td]&quot;Okay, considering what just happened, walking through walls seems almost normal.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Focus Energy glitch[/td][td]Super useless[/td][td]Isn&#039;t it better to actually [i]avoid[/i] it ?[/td][td]&quot;I guess that PokÃ©mon focus energy, but out of battle ? That sucks, tho.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Fossil conversion[/td][td]Just useful.[/td][td]Having the correct XP can be long.[/td][td]&quot;That scientist guy truly is a genius.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Glitch City RAM Manipulation[/td][td]Can be used in stead of Missingno to trigger an Expanded Item Pack.[/td][td]It&#039;s quite a long walk.[/td][td]&quot;Walking this much in a garbled landscape then cutting a tree affected my storage PC ? This world sure is strange...&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Old man trick[/td][td]May justify crappy names (I said &quot;may&quot; !)[/td][td]Just flyin&#039;.[/td][td]&quot;I hated my parents for naming me &quot;D A / â™€ D A MN&quot;, but now I love them.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Pikachu ACE[/td][td]Between 8000 and 9000[/td][td]Quite complicated, and dude can Pikachu not be in love.[/td][td]&quot;Didn&#039;t expect him to be [i]that[/i] powerful.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Q Trick[/td][td]&quot;Amalgamates&quot;, anyone ?[/td][td]Just short.[/td][td]&quot;I wonder if Alphys&#039; True Lab could be in that mansion.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Stoneless Evolution[/td][td]Spares money.[/td][td]Easy ![/td][td]&quot;Is this a kind of symbiosis between PokÃ©mon ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Trainer-Fly[/td][td]Back to our roots.[/td][td]Hope you didn&#039;t smash all of them long-range guys.[/td][td]&quot;Because of all its randomness, I wonder why Twitch Plays PokÃ©mon never got this one.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]ZZAZZ Glitch[/td][td]Not quite useful, but still fun.[/td][td]Just get that Ditto ![/td][td]&quot;How did that clone of me change my name and PokÃ©mons ????&quot;[/td]<br />[/tr]<br />[/table]


subject: Re: Need some help on 4 4
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7538.msg200801#msg200801 date=1468668178]<br />It has chances to be huge. The game won&#039;t be running normally after, that I can almost guarantee.<br />[/quote] Party Pokemon corrupted<br />Corrupted map<br />Corrupted tiles<br />And not corrupted sounds, of course


subject: Re: Gen 1 glitches : usefulness &amp; difficulties
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7542.msg200803#msg200803 date=1468671454]<br />This purely my opinons, but I&#039;m open to suggestions.<br /><br />[table]<br />[tr]<br />[td][b]Glitch[/b][/td][td][b]Usefulness[/b][/td][td][b]Performing difficulty[/b][/td][td][b]Red&#039;s rant[/b][/td]<br />[/tr]<br />[tr]<br />[td]8F, ws m[/td][td]OVER 9000[/td][td]Long but fine.[/td][td]&quot;Kinda makes me godlike. Huh.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Brock Through Walls[/td][td]Nice speedrun thingy.[/td][td]Okay in length.[/td][td]&quot;That guy must have been [i]very[/i] confused. I wonder what would happen if I talked to him from above.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Cloning[/td][td]Always nice.[/td][td]Just at that right time...[/td][td]&quot;Do I need to be QPU aligned to perform this ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Cooltrainer[/td][td]Very useful. Very.[/td][td]Thank Game Frack&#039;s awful programming.[/td][td]&quot;I feel like I&#039;m doing genetical experimentations. Does bioethics exist in this world ?&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Dokokashira[/td][td]EPIC 8)[/td][td]As fast as snapping [s]Blue&#039;s neck[/s] two fingers.[/td][td]&quot;What on earth was in THAT parcel ???&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Expanded item pack[/td][td]OVER 8000 (but under 9000)[/td][td]Correct, unless playing US Yellow :P[/td][td]&quot;I found my bag was bigger on the inside.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]F9 box-set[/td][td]Nice, but with some side effects.[/td][td]Ewww.[/td][td]&quot;Okay, considering what just happened, walking through walls seems almost normal.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Fossil conversion[/td][td]Just useful.[/td][td]Having the correct XP can be long.[/td][td]&quot;That scientist guy truly is a genius.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Old man trick[/td][td]May justify crappy names (I said &quot;may&quot; !)[/td][td]Just flyin&#039;.[/td][td]&quot;I hated my parents for naming me &quot;D A / â™€ D A MN&quot;, but now I love them.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Pikachu ACE[/td][td]Between 8000 and 9000[/td][td]Quite complicated, and dude can Pikachu not be in love.[/td][td]&quot;Didn&#039;t expect him to be [i]that[/i] powerful.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Q Trick[/td][td]&quot;Amalgamates&quot;, anyone ?[/td][td]Just short.[/td][td]&quot;I wonder if Alphys&#039; True Lab could be in that mansion.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]Trainer-Fly[/td][td]Back to our roots.[/td][td]Hope you didn&#039;t smash all of them long-range guys.[/td][td]&quot;Because of all its randomness, I wonder why Twitch Plays PokÃ©mon never got this one.&quot;[/td]<br />[/tr]<br />[tr]<br />[td]ZZAZZ Glitch[/td][td]Not quite useful, but still fun.[/td][td]Just get that Ditto ![/td][td]&quot;How did that clone of me change my name and PokÃ©mons ????&quot;[/td]<br />[/tr]<br />[/table]<br />[/quote] if we figure out the exact mechanics of invalid sound bank maybe we can have fun with it by jumping from codes to codes &#128527;


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7518.msg200800#msg200800 date=1468668143]<br />Depends on what their 6BD4 do ;)<br />[/quote]Do a documentary on the possibility of what it could do ;^)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg200799#msg200799 date=1468668101]<br />[quote author=TheUnReturned link=topic=6638.msg200793#msg200793 date=1468640941]<br />On an other hand, is it possible to switch to invalid sound bank using 8F?<br />[/quote]<br />That&#039;d just require writing to C0EF and C0F0.<br />This should work :<br />&nbsp; &nbsp; Lemonade x[sound bank]<br />&nbsp; &nbsp; Carbos x 192<br />&nbsp; &nbsp; X Accuracy x239<br />&nbsp; &nbsp; Water Stone x119<br />&nbsp; &nbsp; TM01 x[any qty] OR PokÃ© Ball x201<br />[/quote] what could possibly happen if we use this code before enountering 4 4?<br />Hell if we know


subject: Re: Need some help on 4 4
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7538.msg200773#msg200773 date=1468610034]<br />Glitch sound banks cause jumps to $6BD4 every time a sound is played (more information: http://forums.glitchcity.info/index.php/topic,7518.msg200772.html#msg200772)<br />I checked all possible sound banks to see what code they execute.<br /><br />We see all kinds of common effects:<br />[list][li]0x01 - &quot;learned&quot;/&quot;trying to learn&quot; effect[/li]<br />[li]0x03, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0D, 0x10, 0x12-0x1E, 0x21, 0x22, 0x24-0x3F - game crashes[/li]<br />[li]0x05 - the game falls into an infinite loop and softlocks[/li]<br />[li]0x0E - returns gracefully or gives an unknown opcode, depending on which sound is played[/li]<br />[li]0x02, 0x04, 0x08, 0x0F, 0x23 - returns gracefully[/li][/list]<br /><br />Sound banks repeat every 0x40 entries (so banks 0x01, 0x41, 0x81 and 0xC1 are identical).<br />So, what else can we do with them?<br /><br />0x11 delays a few frames by executing lots of halt instructions, then writes 0x2E to $C4C1 and then returns. $C4C1 is one of the tiles in the tilemap. So, this sound bank actually has visible effects - we can see the tile change for a few frames:<br /><br />[img]https://aww.moe/3dn5ol.png[/img]<br /><br />0x04 corrupts the value of address $DFE1, depending on which sound is played, and then returns without crashing. I&#039;m not sure what this address does.<br /><br />0x40 causes the game to jump to $E137, which is in the middle of sprite data. This area of memory is hard to control in real time, but it could be manipulated during a TAS to gain arbitrary code execution. Assuming we can get a Missingno. encounter with sound bank 0x40 early on, it could be an interesting and viable strategy in no save corruption any% TASes.<br /><br />Unfortunately, I don&#039;t see anything that would be the cause of 4 4&#039;s true cry.<br />[/quote]<br /><br />Cool. Can you do one for Pokemon Red/Blue as well?


subject: Re: Genesis and bullshit
poster_name: Dandaman955
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nemesis Compression is a software thing, so it should work on any emulator that can read 68K instructions properly. Even if it didn&#039;t, it should definitely work on Exodus, because the guy who cracked the compression (Nemesis) wrote the emulator.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=6638.msg200807#msg200807 date=1468673486]<br />[quote author=ISSOtm link=topic=6638.msg200799#msg200799 date=1468668101]<br />[quote author=TheUnReturned link=topic=6638.msg200793#msg200793 date=1468640941]<br />On an other hand, is it possible to switch to invalid sound bank using 8F?<br />[/quote]<br />That&#039;d just require writing to C0EF and C0F0.<br />This should work :<br />&nbsp; &nbsp; Lemonade x[sound bank]<br />&nbsp; &nbsp; Carbos x 192<br />&nbsp; &nbsp; X Accuracy x239<br />&nbsp; &nbsp; Water Stone x119<br />&nbsp; &nbsp; TM01 x[any qty] OR PokÃ© Ball x201<br />[/quote] what could possibly happen if we use this code before enountering 4 4?<br />Hell if we know<br />[/quote]<br /><br />absolutely nothing, encountering 4 4 would modify it.


subject: Re: Hey.
poster_name: joonas2345
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7539.msg200783#msg200783 date=1468627713]<br />--<br />Oh, and, if you&#039;re willing to get into GB programming, I&#039;m writing [url=http://glitchcity.info/wiki/index.php/GB_Programming]a wiki article[/url] on just that. As of now, it is a WIP, but that covers some basics.<br />[/quote]<br />That wiki page is really cool. Keep up the good work!


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg200799#msg200799 date=1468668101]C0EF and C0F0.<br />[/quote]<br /><br />Actually, you just need to mod C0EF.


subject: Re: Never wrote an introduction so I wrote one here
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi fellow Hongkonger! I thought I was the only Pokemon glitcher around here! Now I can&#039;t claim I know the most about Pokemon glitches in the city. :P


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Technically you can use no-clip items (like JACK) to fly from [i]any[/i] trainers, so you only need to know the early game ones.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What is C0F0, then ?<br /><br />New code :<br />&nbsp; &nbsp; Lemonade x[sound bank]<br />&nbsp; &nbsp; Carbos x 192<br />&nbsp; &nbsp; X Accuracy x239<br />&nbsp; &nbsp; Water Stone x201<br />(unsure, but should be okay)


subject: Re: Categorization
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7540.msg200802#msg200802 date=1468668664]<br />I was thinking about making a topic that would give my opinon about Gen 1&#039;s glitches in terms of usage and difficulty / ridiculousness to perform.<br />Now I&#039;m motivated to do it, heh :P<br />[/quote]<br />I&#039;m glad I could help :P


subject: Re: Hey.
poster_name: Dandaman955
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7539.msg200783#msg200783 date=1468627713]<br />Hey !<br /><br />You want technical ? Here, you got four people who love technicals :<br />-&gt; TheZZAZZGlitch (*cough cough*pannenkoek2012*cough cough*)<br />-&gt; Crystal_ (and his long, technically-detailed YouTube videos)<br />-&gt; Hacky (he find lovely stuff, and explains it in elegant manners)<br />-&gt; Torchickens (to a lesser extent, but still.)<br /><br />Oh, and, if you&#039;re willing to get into GB programming, I&#039;m writing [url=http://glitchcity.info/wiki/index.php/GB_Programming]a wiki article[/url] on just that. As of now, it is a WIP, but that covers some basics.<br />[/quote]<br /><br />Wait, TheZZAZZGlitch and pannenkoek2012 are the same person?<br /><br />Anyway, thanks for the welcome! Had a quick skim through that wiki article and the language itself seems quite similar to Z80 assembly, so hopefully it should ring a bit familiar when I read through it.<br /><br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: NieDzejkob
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was trying to setup the bootstrap party for 8F, and each I found in this post has some flaws. Kangaskhan is tedious to catch and specific stats are difficult to obtain. Because of that, I wrote one that uses only pokemons which are already available when you can obtain 8F (with the celadon looping map/item counter underflow method at least):<br /><br />6 Pokemons:<br />1. Onix<br />2. Jolteon w/ 233 current HP<br />3. Pidgey<br />4. Pidgey<br />5. Tentacool (if you want, you can use mew glitch with clefairy lass in Mt. Moon - near the route 3 exit)<br />6. Parasect/Psyduck<br /><br />Code:<br />[tt]<br />D163&nbsp; 06 22&nbsp; LD B, $22<br />D165&nbsp; 68&nbsp; &nbsp;  LD L, B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; HL = D122<br />D166&nbsp; 24&nbsp; &nbsp;  INC H&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; HL = D222<br />D167&nbsp; 24&nbsp; &nbsp;  INC H&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; HL = D322<br />D168&nbsp; 18 2E&nbsp; JR D198 (parasect)<br />D169&nbsp; 18 2F&nbsp; JR D199 (psyduck)<br /><br />D198&nbsp; 00&nbsp; &nbsp;  NOP<br />D199&nbsp; E9&nbsp; &nbsp;  JP (HL)<br />[/tt]<br /><br />Also, you can use male nidoran in slot 6 and have 233 HP on Onix, but it is only 5% on blue.<br /><br />PS. Now I have an idea on how to make it use only one pidgey, but Pidgeys are easy to catch and using Catch &#039;em all will screw up any bootstrap which isn&#039;t 6 pokemon.


subject: Re: Hey.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dandaman955 link=topic=7539.msg200822#msg200822 date=1468691634]<br />[quote author=ISSOtm link=topic=7539.msg200783#msg200783 date=1468627713]<br />Hey !<br /><br />You want technical ? Here, you got four people who love technicals :<br />-&gt; TheZZAZZGlitch (*cough cough*pannenkoek2012*cough cough*)<br />-&gt; Crystal_ (and his long, technically-detailed YouTube videos)<br />-&gt; Hacky (he find lovely stuff, and explains it in elegant manners)<br />-&gt; Torchickens (to a lesser extent, but still.)<br /><br />Oh, and, if you&#039;re willing to get into GB programming, I&#039;m writing [url=http://glitchcity.info/wiki/index.php/GB_Programming]a wiki article[/url] on just that. As of now, it is a WIP, but that covers some basics.<br />[/quote]<br /><br />Wait, TheZZAZZGlitch and pannenkoek2012 are the same person?<br /><br />Anyway, thanks for the welcome! Had a quick skim through that wiki article and the language itself seems quite similar to Z80 assembly, so hopefully it should ring a bit familiar when I read through it.<br />[/quote]<br />No, they are different persons xD (afaik) I was just referring to the &quot;PokÃ©mon Red in 69 A presses video by TZG :D<br /><br />The GB&#039;s language is dubbed the GBZ80, I guess you&#039;ll see why :P<br />This tutorial heavily relies on the tutorial I learned Z80 with (on TI-8x+ calcs), but I haven&#039;t written the gb-specific parts yet.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Seems quite legit. According to Bulbapedia (and with some extremely rough approximations), 233 HP could be achieved near level 90 (level 99 always has more than 233 max HP).<br />Pidgey could be caught by Trainer-Fly, and Arbok is obtainable through Trainer-Fly. The post you have looked at must have been quite old.


subject: Project GStart
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: clip
body:
  I&#039;m currently working on making IPS patches for specific glitch pokemon/trainers to REPLACE the normal starters. That&#039;s right. REPLACING the starters with unobtainables and trainers. (This will not interfere with my music.) I&#039;m testing set [FB,FC,FD] (ZZaZZ indexes) as of posting. :P<br /><br />This is pretty much for obtaining otherwise unobtainable (the ones we still can&#039;t get, even with encounters) glitch pokemon / getting trainer indexes as Pokemon.<br /><br />EDIT: First 3 down. IPS later.<br />[youtube]https://www.youtube.com/watch?v=K1DGZQQNx9Y[/youtube]<br /><br />EDIT 2: IPS is attached.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  No, I am referring to the different trainers in Pokemon Yellow that will yield different Pokemon when used with the mew glitch. The link I posted above is a great guide and covers MOST of the trainers found, but not all of them as Yellow has exclusive trainers and teams not found in Red/Blue. For example, Lt. Surge&#039;s level 28 Raichu in Yellow will produce a different Pokemon then his level 24 Raichu in Red/Blue and I&#039;m trying to find out all the little differences as everyone as all the info on this with regards to Red/Blue, but not Yellow.


subject: Making sense of the arbitrary code execution glitch
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi, I am new to glitches. I have read several posts but still have a hard time understanding this glitch. Any help is much appreciated.<br /><br />On one of the posts, it is stated that I can use Gameshark code with this method.<br /><br />[quote]The following item list will work the same way a game-altering device does.<br /><br />8F<br /><br />Any item x Any qty<br /><br />X Accuracy x(b2)<br /><br />Carbon x(b3)<br /><br />Max Revive x(b1)<br /><br />PokÃ© Ball x201<br /><br />To obtain the 201 PokÃ© Balls stack, have PokÃ© Balls x73 in the sixth item pack slot, then encounter / capture MissingNo or &#039;M. It will be a stack of 201 PokÃ© Balls. It is also possible to use the Non-key items duplication code.<br /><br />This code aims to write code like the Gameshark code &quot;01(b1)(b2)(b3)&quot;.<br /><br />For example, the code 010138CD, which allows to walk through walls, can be transcripted into the following :<br /><br />X Accuracy x(b2)<br /><br />Carbon x(b3)<br /><br />Max Revive x(b1)<br /><br />PokÃ© Ball x201[/quote]<br /><br />I notice that many Gameshark codes contain letters. How can I make an item list to accommodate that? Please help. Thank you very much in advance.


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The gameshark codes are written in hexadecimal forms, and what you are looking for is a decimal form.<br />I could tell you :<br />* either you learn what hexadecimal is, and I could recommend you the introduction of [http://glitchcity.info/wiki/index.php/GB_Programming#A_new_world this wiki article]. The rest of it, even though it is a WIP, can help you understand ACE a bit.<br />* or, you can just be lazy and use a [http://www.binaryhexconverter.com/hex-to-decimal-converter converter]. Do your choice !


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Skeef
icon: xx
body:
  Actually, Pidgey can have as little as 190 hp at lvl 100. HP does have IV&#039;s in gen 1 and 2 games. They just depend on if the other stats have even or odd IV. Thats why HP IV&#039;s arnt on the ram map.<br /><br />Odd attack IV = +8 hp IV<br />Odd defence IV = +4 hp IV<br />Odd speed IV = +2 hp IV<br />Odd special IV = +1 hp IV<br /><br />So if all are odd the HP IV would be 15.<br /><br />Edit: Or did you mean Jolteon always has atleast 233 HP at lvl 99? 


subject: Gameshark code limit
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello, I am new to Gameshark code. Any help is much appreciated.<br /><br />I wonder how stat modifier works. For example:<br /><br />[quote]Special Modifier <br />01??C0DA <br />01??C1DA [/quote]<br /><br />What do I change for each line? Let&#039;s say I want to change the special of my pokemon to 999, what value do I need to have? Please help. Thank you very much in advance.


subject: A glitchy journey.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  The main plot is &quot;what would Red think if he was completing US PokÃ©mon Red while glitching it&quot;. I won&#039;t be going with every glitch in the game, that&#039;d get boring pretty quickly.<br /><br />Enjoy, or don&#039;t.<br />~~ISSOtm<br /><br /><br />===================================================heya=================<br /><br />[b][url=https://youtu.be/o-oNV9qBaU8]Music ?[/url][/b]<br /><br />Red felt bored. Pallet Town was a small town, and, aside from both houses and the Lab, it felt empty. Red was feeling bored. He decided that would be good to check out the grass north of the village. Mom (did she have a name ?) always forbid him to go near them, but he felt that was the last thing to do here before dying from nothingness.<br />He wanted to see Prof Oak first to tell him he went on a journey, so his mom would not worry for long when she would notice he was gone.<br />But Oak wasn&#039;t in his Lab. In his stead was Blue, who told him his grandpa was outside.<br />But that wouldn&#039;t stop Red from going to the Forbidden Grass. But when he stepped into it, Oak stopped him. Red was sure he would get the usual lecture, but after telling him that PokÃ©mon lived in the grass, Oak asked him to follow him.<br />To Red&#039;s surprise, they went into the Lab, and Oak told Red he could get one of the three PokÃ©mon that were on the desk. Blue seemed jealous about it, but stayed apparently calm and waited for his turn to come.<br /><br />[b][url=https://youtu.be/h66gq40szjk]Music ![/url][/b]<br /><br />Red decided to pick Charmander, since he was Red, too. He felt the pun was bad, but anyways. Blue chose Squirtle, maybe for the same reason.<br />When Red thought it was time to go on his journey, Blue challenged him into a battle ! Red decided he was annoying, and had Charmander repeatedly smash a Tail Whip-ing Squirtle until loss of consciousness.<br />He then exited the Lab, and headed north towards Route 1. It felt pretty awkward to see the whole landscape - and even Pallet Town ! - turn green when he exited Pallet Town, but meh. Things were like that, he thought.<br /><br />Arriving at Viridian City, he found there was nothing to do there, and headed north.<br />Or would he, but he was stopped by a man lying down, that seemingly hadn&#039;t had his coffee and blocked his way. Ah well.<br />He went to the shop to buy some [s]teargas sprays[/s] coffee and finally advance, and instead recieved a Parcel that had to be delivered to Oak. A bit frustrated, Red went back to Pallet Town anyways.<br />As he gave Oak his parcel, Blue arrived. Oak told them he bestowed them with the mission of filling an encyclopedia (a &quot;PokÃ©dex&quot; ?) about PokÃ©mon. Blue told Oak to leave it all to him, and Red felt like too lazy to fill it.<br />Blue immediatly left the lab, and Red did the same shortly after.<br /><br />Red rolled back to Viridian, where the old man seemed to have had his coffee. It was time for Red to head to Pewter City, but that implied to go through Viridian Forest, as none of his PokÃ©mon knew Cut.<br />He wanted to do this quick, so he avoided Trainer battles, and Route 2&#039;s tall grass as much as possible. He engaged a Weedle that left his Charmander low in HP and poisoned, but it would be too long to go back to Viridian, he thought. He was nearing the forest&#039;s exit, but a Trainer was standing near the exit... eye contact was impossible to avoid ! Red grumbled and walked towards the Bug Catcher.<br />Unfortunately, as Red walked in front of the Trainer, he tripped on a Potion that was lying down there, and stumbled on a [s]hooked[/s] sleeping Metapod, which engaged the battle. However, the wild PokÃ©mon kept using Harden, and Red was watching poison slowly weakening Charmander... he was about to lose ! He tried to run away from the battle, but failed.<br />Eventually, Charmander fainted. Red was left with no other choice but to run to the Viridian PokÃ©mon Center. However, the Trainer noticed him.<br />&quot;Hey ! We have to battle !&quot;<br />&quot;Guy, my only PokÃ©mon is KO, I have to get him healed back !&quot;<br />&quot;But... but... don&#039;t you know ? I noticed you ! They say strange things happen if we don&#039;t battle ! Please, even if you directly lose...&quot;<br />&quot;No, get off ! I just lost one battle, and I won&#039;t lose another !&quot;<br />And then Red ran away, though he picked up the Potion that he had tripped on.<br /><br />Luckily, he was back at Viridian City, but while running, some money left his pockets. Half his money, actually. That didn&#039;t seem that bad, but heh, tough luck. He thought of going west instead of north this time, and quickly stumbled into his rival, who challenged him. The battle was a piece of cake, mostly because Red&#039;s PokÃ©mon wasn&#039;t poisoned and because Red had a Potion this time. After being defeated, Blue gave him some fundings, and left.<br />At that moment, Red thought again of Professor Oak, Pallet Town, his home, and... wait, his mom ??? She would probably be dead worried about him by now !<br />Red rushed to Pallet Town, back home, only to find her mother being calm, composed, and comprehensive with him. He felt quite relieved, but also weirded out by her not being worried at all.<br />While he was in Pallet Town, why not paying a visit to Prof Oak ? That old guy could maybe be tricked into giving him some Potions, or stuff like that... that sounded interesting.<br />Oak was reading something on his computer when Red arrived. He requested his attention, and Oak gave him a large smile, and gave Red a seat.<br />He asked Red why he came to visit him, as he had only one entry in his PokÃ©dex - Charmander&#039;s. Red replied he wanted some information about PokÃ©mon. Oak replied he was far from knowing everything, but he could tell Red some stuff.<br />&quot;PokÃ©mon usually live in tall grass, but some - a few, actually - stand in particular places, maybe waiting for battle.&quot; He couldn&#039;t tell Red much more than that about PokÃ©mon encounters.<br />Red decided to take Charmander out o his PokÃ© Ball, as he felt it was wiggling a bit. The PokÃ©mon seemed to be willing to walk for a bit.<br />He explained Red the concept of &quot;types&quot;, and the of &quot;levels&quot;. He explained that no PokÃ©mon with levels 1 or 0 had ever been witnessed. It seemed normal for level 0, but Oak was wondering why no level 1 PokÃ©mon had ever existed. Maybe they did, but never showed up. But why ?<br />Oak then showed him some pictures of PokÃ©mon. Rhydon, Kangaskhan, Nidoranâ™‚, Clefairy, Spearow, Voltorb, Nidoking, Slowbro, Ivysaur, Exeggutor... He also explained some details about them, like their power, size, and loads of trivia.<br />Red was getting bored of the old guy&#039;s talk, and told him he had to leave home. Oak smiled warmly, and also gave Red 5 PokÃ© Balls. These weren&#039;t Potions, but that was better than nothing, Red thought.<br /><br />He headed back to Viridian City, and to the Mart. He thought it would be a nice idea to build a team like Blue did, and so spent all his money on PokÃ© Balls, plus two Potions. He then went again to Viridian Forest, but he decided to stop by the tall grass in front of the entrance. He first found a level 3 Rattata, and decided some XP would be worth it. However, the Rattata wasn&#039;t killed in two shots, but was left with only a few HP. Red throwed a PokÃ© Ball... that unfortunately missed. The second try succeeded, though. He then found a level 3 Pidgey, and decided to smash it for fun. He used Charmander&#039;s GROWL 6 times, because the Pidgey has reduced Charmander&#039;s accuracy pretty low, and was pecking him a lot. Despite all the sand he had in his eyes, Charmander finally defeated the Pidgey, and in doing so, levelled up. Red decided it was enough, and gave both PokÃ©mon a well-deserved Potion. Red then Saved his progress in order not to lose his Rattata.<br />Red then proceeded to the entrance to Viridian Forest, then entered the forest itself. However, his START menu popped up as soon as he entered the forest. He was surprised, because he didn&#039;t touch the START command at all, but he thought it maybe malfunctioned a bit. But, he was even more surprised when, upon closing it, he was attacked by a wild level 1 Nidoking. Considering what Oak told him earlier, this looked so surreal ! He had, right before his eyes, a live level 1 PokÃ©mon ! Oak would maybe believe him if he told about it, but the true proof would be to capture said PokÃ©mon ! Blue then sent out Rattata to lower Nidoking&#039;s HP. This proved to be long and difficult, but the sixteenth PokÃ© Ball did the job. He was so happy !<br /><br />Back at Pallet Town, the boy rammed in the door, making Oak jump to the ceiling. Red told him, completely out of breath, that he had caught a level 1 PokÃ©mon. Oak thought the boy was pulling a prank on him, so he laughed. But when Red gave him the PokÃ© Ball, the scientist&#039;s curiosity was piqued anyways, so he opened the status viewer, only to find Red was right ! The scientist marvelled at the STATS screen, then asked Red if he could borrow that PokÃ©mon for a while. He replied that was possible, but he wanted to stay around. Oak agreed, took the PokÃ©mon out of his Ball, and asked Red if they could ask the Nidoking to stay still while he examined it. Red did just that, then Oak began measuring the PokÃ©mon, his weight, and taking notes about various details of the intrigued Nidoking. While doing so, the scientist congratulated Red for finding such a rare PokÃ©mon at such a rare level. He also explained that Nidokings usually aren&#039;t found at such low levels, but this one wanted to really stand out. While listening, Red wandered around the lab for a bit, then sat before the PC, and saw Oak&#039;s mailbox. One mail was open : it was a PokÃ©mon League broadcast, and a post-scriptum was added for Prof. Oak. to join them. The mail was left unreplied.<br />Red thought of the prestigious PokÃ©mon League, and dreamt of being the League Champion. Hey, why not ? This could prove to be fun.<br />Once Oak had finished with Nidoking, Red sent him back to his PokÃ© Ball, and asked Oak about the PokÃ©mon League. Oak replied him that the League&#039;s goal is to provide talented Trainers tough challenges. The goal is to beat the Elite Four, then the PokÃ©mon Champion. Once the Champion is defeated, the winning Trainer becomes the next Champion. Sometimes, Elite Four Trainers resign, but that and the Champion changing happen rarely.<br />To prevent everyone from challenging the Elite Four, Trainers aren&#039;t allowed to pass Route 22 unless they earn the eight Gym Badges. Each badge had to be obtained by defeating the corresponding Gym Champion&#039;s team.<br />an order of badges was established, as some Gym Leaders have weaker teams than others.<br />Oak noticed Red&#039;s interest in his speech, and smiled kindly :<br />&quot;I see the League gets more of your attention than my research !&quot; He laughed a bit. &quot;You see, kid, I&#039;m getting myself wholeheartedly into PokÃ©mon research. You prefer PokÃ©mon training and battling. I&#039;d love you to be as interested in research you are in training. But, I still think you can help us researchers... and I&#039;m pretty sure there is a way we can help you. Maybe you will discover more than Kanto ! Who knows.&quot;<br />Oak then took the notes he had taken when inspecting Nidoking, and pinned some text he had circled multiple times : his XP was way higher than expected, to a point where the STATS screen glitched one digit out. He wondered what would happen if the PokÃ©mon would gain some XP.<br />The scientist also gave Red his computer&#039;s IP address, so that Red could contact him through any PokÃ©mon Center PC instead of travelling back to Pallet Town each time he discovered something. Red thanked the old man, put Nidoking&#039;s PokÃ© Ball in his belt, and left Pallet Town.<br /><br />Red decided to continue towards Pewter City. But this time, he would battle the Bug Catcher !<br />On his way there, Red wanted to experiment with Nidoking. He wanted him to encounter a low-level PokÃ©mon in order to be able to beat him, and so kept Charmander in front of the party until a level 3 Rattata was found. He then switched to Nidoking, and luckily scored enough critical hits to KO Rattata alone. The EXP gain was shared between both PokÃ©mon, which Red didn&#039;t expect, but Charmander and Nidoking gained about 20 EXP points each. But, when Red thought it was time to go on another battle, he was very surprised to see Nidoking going straight to level 100 ! His stats seemed to be high enough to match some level-100 stuff, which really impressed Red. This time, he contacted Oak through his PC, and the scientist laughed when Red told him about his experience :<br />&quot;Well, kid, you seem to be the gift that keeps on givin&#039; ! Though, remember Nidoking&#039;s XP was very hig, so I&#039;m not that surprised. But you sure managed to get a 100-level PokÃ©mon right off the bat ! I guess becoming a League Champion will be a way easier task for you. See you sometime later !&quot;<br /><br />Red entered the forest - for the third time. No bizarre encounter this time, but it was time for some Charmander action ! The PokÃ©mon was quite happy to take a walk outside of its PokÃ© Ball, and Red doubted he didn&#039;t do some kind of exercise while in his PokÃ© Ball. This PokÃ©mon was truly energetic.<br />The three Trainers went down with difficulties, but it was easier after Charmander&#039;s level up. Now was that famous Bug Catcher&#039;s turn !<br />Red realized he hadn&#039;t saved for a while, so he popped his START menu. It was completely normal, so Red Saved his progress before resuming walking.<br />Red felt motivated when he approached him, but when Red got into his line of sight, the Trainer didn&#039;t budge. Red was shocked, but turned towards the Trainer, and asked him why he wouldn&#039;t battle. The Trainer replied :<br />&quot;Well, uh, it kinda feels like... well, look, but I have a very strong feeling that you&#039;ve battled me... and it is against the Legaue&#039;s rules to rematch with someone.&quot;<br />&quot;Wait, do you realize we never battled ? You told me we had to, or strange things would happen. I ran away just after, remember ?&quot;<br />&quot;Yes I do... but it feels like you beat me. I can&#039;t tell you more, sorry. It just feels like that... and I can&#039;t battle you twice.&quot;<br />&quot;Why ? Otherwise, strange stuff blah blah blah ?&quot;<br />&quot;...&quot;<br />&quot;Aw, c&#039;mon. I guess... something strange happened right as I entered the forest after I had ran away from here...&quot;<br />And so did the Bug Catcher learn about Nidoking&#039;s encounter.<br />&quot;Well... that sure seems strange. But hey, don&#039;t do too much of that stuff, okay ? I fear it could have gone worse.&quot;<br />&quot;Nah, don&#039;t worry too much. I believe nothing can be that bad. Take care of yourself !&quot;<br /><br />And so Red reached Pewter City.<br /><br /><br />~~~~<br />Whew, this took me a whole afternoon to write ! Now is very late (or quite early in the morning, I guess ? :P), so I&#039;ll be sleeping.<br />Yeah, both musics are Earthbound OST, but I&#039;m too tired to look deeper into my music files, but I guess this will work. I have plenty of other OSTs, but they don&#039;t fit in this context ^^ <br />(Expect some Undertale action :P)<br /><br />Hopefully I can write &quot;Episode 2&quot; tomorrow.<br />See ya !<br /><br />~<br />Now is tomorrow, I&#039;ve read the episode again and modified it slightly. Hope it&#039;s better !


subject: Re: A glitchy journey.
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7547.msg200836#msg200836 date=1468720025]<br />The main plot is &quot;what would Red think if he was completing US PokÃ©mon Red while glitching it&quot;. I won&#039;t be going with every glitch in the game, that&#039;d get boring pretty quickly.<br /><br />Enjoy, or don&#039;t.<br />~~ISSOtm<br /><br /><br />===================================================heya=================<br /><br />[b][url=https://youtu.be/o-oNV9qBaU8]Music ?[/url][/b]<br /><br />Red felt bored. Pallet Town was a small town, and, aside from both houses and the Lab, it felt empty. Red was feeling bored. He decided that would be good to check out the grass north of the village. Mom (did she have a name ?) always forbid him to go near them, but he felt that was the last thing to do here before dying from nothingness.<br />He wanted to see Prof Oak first to tell him he went on a journey, so his mom would not worry for long when she would notice he was gone.<br />But Oak wasn&#039;t in his Lab. In his stead was Blue, who told him his grandpa was outside.<br />But that wouldn&#039;t stop Red from going to the Forbidden Grass. But when he stepped into it, Oak stopped him. Red was sure he would get the usual lecture, but after telling him that PokÃ©mon lived in the grass, Oak told him to follow him.<br />To Red&#039;s surprise, he went into the Lab, and told him he could get a PokÃ©mon. Blue seemed jealous about it, but stayed apparently calm and waited for his turn to come.<br /><br />[b][url=https://youtu.be/h66gq40szjk]Music ![/url][/b]<br /><br />Red decided to pick Charmander, since he was Red, too. He felt the pun was bad, but anyways. Blue chose Squirtle.<br />When Red thought it was time to go on his journey, Blue challenged him into a battle ! Red decided he was annoying, and had Charmander repeatedly smash a Tail Whip-ing Squirtle until loss of consciousness.<br />He then exited the Lab, and headed north towards Route 1. It felt pretty awkward to see the whole landscape - and even Pallet Town ! - turn green when he exited Pallet Town, but meh. Things were like that, he thought.<br /><br />Arriving at Viridian City, he found there was nothing to do there, and headed north.<br />Or would he, but he was stopped by a man lying down, that seemingly hadn&#039;t had his coffee and blocked his way. Ah well.<br />He went to the shop to buy some [s]teargas sprays[/s] coffee and finally advance, and instead recieved a Parcel that had to be delivered to Oak. A bit frustrated, Red went back to Pallet Town anyways.<br />As he gave Oak his parcel, Blue arrived. Oak told them he bestowed them with the mission of filling an encyclopedia (a &quot;PokÃ©dex&quot; ?) about PokÃ©mon. Blue told Oak to leave it all to him, and Red felt like too lazy to fill it.<br /><br />Red rolled back to Viridian, where the old man seemed to have had his coffee. It was time for Red to head to Pewter City, but that implied to go through Viridian Forest, as none of his PokÃ©mon knew Cut.<br />He wanted to do this quick, so he avoided Trainer battles, and Route 2&#039;s tall grass as much as possible. He engaged a Weedle that left his Charmander low in HP and poisoned, but it would be too long to go back to Viridian, he thought. He was nearing the forest&#039;s exit, but a Trainer was standing near the exit... eye contact was impossible to avoid ! Red grumbled and walked towards the Bug Catcher.<br />Unfortunately, as Red walked in front of the Trainer, he tripped on a Potion that was lying down there, and stumbled on sleeping Metapod, which engaged the battle. However, the wild PokÃ©mon kept using Harden, and Red was watching poison slowly weakening Charmander... he was about to lose !<br />Eventually, Charmander fainted. Red was left with no other choice but to run to the Viridian PokÃ©mon Center. However, the Trainer noticed him.<br />&quot;Hey ! We have to battle !&quot;<br />&quot;Guy, my only PokÃ©mon is KO, I have to get him healed back !&quot;<br />&quot;But... but... don&#039;t you know ? I noticed you ! They say strange things happen if we don&#039;t battle ! Please, even if you directly lose...&quot;<br />&quot;No, get off ! I just lost one battle, and I won&#039;t lose another !&quot;<br />And then Red ran away, though he picked up the Potion that he had tripped on.<br /><br />Luckily, he was back at Viridian City, but while running, some money left his pockets. Half his money, actually. That didn&#039;t seem that bad. He thought of going west instead of north this time, and quickly stumbled into his rival, who challenged him. The rival was a piece&nbsp; of cake, mostly because Red&#039;s PokÃ©mon wasn&#039;t poisoned and because Red had a Potion this time. The Rival gave him some fundings, and left.<br />At that moment, Red thought again of Professor Oak, Pallet Town, his home, and... wait, his mom ??? She would probably be dead worried about him by now !<br />Red rushed to Pallet Town, back home, only to find her mother being calm, composed, and comprehensive with him. He felt quite relieved, but also weirded out by her not being worried at all.<br />While he was in Pallet Town, why not paying a visit to Prof Oak ? That old guy could maybe be tricked into giving him some Potions, or stuff like that... that sounded interesting.<br />Oak was reading something on his computer when Red arrived. He requested his attention, and Oak gave him a large smile, and gave Red a seat.<br />He asked Red why he came to visit him, as he had only one entry in his PokÃ©dex - Charmander&#039;s. Red replied he wanted some information about PokÃ©mon. Oak replied he was far from knowing everything, but he could tell Red some stuff.<br />&quot;PokÃ©mon usually live in tall grass, but some - a few, actually - stand in particular places, maybe waiting for battle.&quot; He couldn&#039;t tell Red much more than that about PokÃ©mon encounters.<br />Red decided to take Charmander out o his PokÃ© Ball, as he felt it was wiggling a bit. The PokÃ©mon seemed to be willing to walk for a bit.<br />He explained Red the concept of &quot;types&quot;, and the of &quot;levels&quot;. He explained that no PokÃ©mon with levels 1 or 0 had ever been witnessed. It seemed normal for level 0, but Oak was wondering why no level 1 PokÃ©mon had ever existed. Maybe they did, but never showed up. But why ?<br />Oak then showed him some pictures of PokÃ©mon. Rhydon, Kangaskhan, Nidoranâ™‚, Clefairy, Spearow, Voltorb, Nidoking, Slowbro, Ivysaur, Exeggutor... He also explained some details about them, like their power, size, and loads of trivia.<br />Red was getting bored of the old guy&#039;s talk, and told him he had to leave home. Oak smiled warmly, and also gave Red 5 PokÃ© Balls. These weren&#039;t Potions, but that was better than nothing, Red thought.<br /><br />He headed back to Viridian City, and to the Mart. He thought it would be a nice idea to build a team like Blue did, and so spent all his money on PokÃ© Balls, plus two Potions. He then went again to Viridian Forest, but he decided to stop by the tall grass in front of the entrance. He first found a level 3 Rattata, and decided some XP would be worth it. However, the Rattata wasn&#039;t killed in two shots, but was left with only a few HP. Red throwed a PokÃ© Ball... that unfortunately missed. The second try succeeded, though. He then found a level 3 Pidgey, and decided to smash it for fun. He used Charmander&#039;s GROWL 6 times, because the Pidgey has reduced Charmander&#039;s accuracy pretty low, and was pecking him a lot. Despite all the sand he had in his eyes, Charmander finally defeated the Pidgey, and in doing so, levelled up. Red decided it was enough, and gave both PokÃ©mon a well-deserved Potion. Red then Saved his progress in order not to lose his Rattata.<br />Red then proceeded to the entrance to Viridian Forest, then entered the forest itself. However, his START menu popped up as soon as he entered the forest. He was surprised, because he didn&#039;t touch the START command at all, but he thought it maybe malfunctioned a bit. But, he was even more surprised when, upon closing it, he was attacked by a wild level 1 Nidoking. Considering what Oak told him earlier, this looked so surreal ! He had, right before his eyes, a live level 1 PokÃ©mon ! Oak would maybe believe him if he told about it, but the true proof would be to capture said PokÃ©mon ! Blue then sent out Rattata to lower Nidoking&#039;s HP. This proved to be long and difficult, but the sixteenth PokÃ© Ball did the job. He was so happy !<br /><br />Back at Pallet Town, the boy rammed in the door, making Oak jump to the ceiling. Red told him, completely out of breath, that he had caught a level 1 PokÃ©mon. Oak thought the boy was pulling a prank on him, so he laughed. But when Red gave him the PokÃ© Ball, the scientist&#039;s curiosity was piqued anyways, so he opened the status viewer, only to find Red was right ! The scientist marvelled at the STATS screen, then asked Red if he could borrow that PokÃ©mon for a while. He replied that was possible, but he wanted to stay around. Oak agreed, took the PokÃ©mon out of his Ball, and asked Red if they could ask the Nidoking to stay still while he examined it. Red did just that, then Oak began measuring the PokÃ©mon, his weight, and taking notes about various details of the intrigued Nidoking. While doing so, the scientist congratulated Red for finding such a rare PokÃ©mon at such a rare level. He also explained that Nidokings usually aren&#039;t found at such low levels, but this one wanted to really stand out. While listening, Red wandered around the lab for a bit, then sat before the PC, and saw Oak&#039;s mailbox. One mail was open : it was a PokÃ©mon League broadcast, and a post-scriptum was added for Prof. Oak. to join them. The mail was left unreplied.<br />Red thought of the prestigious PokÃ©mon League, and dreamt of being the League Champion. Hey, why not ? This could prove to be fun.<br />Once Oak had finished with Nidoking, Red sent him back to his PokÃ© Ball, and asked Oak about the PokÃ©mon League. Oak replied him that the League&#039;s goal is to provide talented Trainers tough challenges. The goal is to beat the Elite Four, then the PokÃ©mon Champion. Once the Champion is defeated, the winning Trainer becomes the next Champion. Sometimes, Elite Four Trainers resign, but that and the Champion changing happen rarely.<br />To prevent everyone from challenging the Elite Four, Trainers aren&#039;t allowed to pass Route 22 unless they earn the eight Gym Badges. Each badge had to be obtained by defeating the corresponding Gym Champion&#039;s team.<br />an order of badges was established, as some Gym Leaders have weaker teams than others.<br />Oak noticed Red&#039;s interest in his speech, and smiled kindly :<br />&quot;I see the League gets more of your attention than my research !&quot; He laughed a bit. &quot;You see, kid, I&#039;m getting myself wholeheartedly into PokÃ©mon research. You prefer PokÃ©mon training and battling. I&#039;d love you to be as interested in research you are in training. But, I still think you can help us researchers... and I&#039;m pretty sure there is a way we can help you. Maybe you will discover more than Kanto ! Who knows.&quot;<br />Oak then took the notes he had taken when inspecting Nidoking, and pinned some text he had circled multiple times : his XP was way higher than expected, to a point where the STATS screen glitched one digit out. He wondered what would happen if the PokÃ©mon would gain some XP.<br />The scientist also gave Red his computer&#039;s IP address, so that Red could contact him through any PokÃ©mon Center PC instead of travelling back to Pallet Town each time he discovered something. Red thanked the old man, put Nidoking&#039;s PokÃ© Ball in his belt, and left Pallet Town.<br /><br />Red decided to continue towards Pewter City. But this time, he would battle the Bug Catcher !<br />On his way there, Red wanted to experiment with Nidoking. He wanted him to encounter a low-level PokÃ©mon in order to be able to beat him, and so kept Charmander in front of the party until a level 3 Rattata was found. He then switched to Nidoking, and luckily scored enough critical hits to KO Rattata alone. The EXP gain was shared between both PokÃ©mon, which Red didn&#039;t expect, but Charmander and Nidoking gained about 20 EXP points each. But, when Red thought it was time to go on another battle, he was very surprised to see Nidoking going straight to level 100 ! His stats seemed to be high enough to match some level-100 stuff, which really impressed Red. This time, he contacted Oak through his PC, and the scientist laughed when Red told him about his experience :<br />&quot;Well, kid, you seem to be the gift that keeps on givin&#039; ! Though, remember Nidoking&#039;s XP was very hig, so I&#039;m not that surprised. But you sure managed to get a 100-level PokÃ©mon right off the bat ! I guess becoming a League Champion will be a way easier task for you. See you sometime later !&quot;<br /><br />Red entered the forest - for the third time. No bizarre encounter this time, but it was time for some Charmander action ! The PokÃ©mon was quite happy to take a walk outside of its PokÃ© Ball, and Red doubted he didn&#039;t do some kind of exercise while in his PokÃ© Ball. This PokÃ©mon was truly energetic.<br />The three Trainers went down with difficulties, but it was easier after Charmander&#039;s level up. Now was that famous Bug Catcher&#039;s turn !<br />Red realized he hadn&#039;t saved for a while, so he popped his START menu. It was completely normal, so Red Saved his progress before resuming walking.<br />Red felt motivated when he approached him, but when Red got into his line of sight, the Trainer didn&#039;t budge. Red was shocked, but turned towards the Trainer, and asked him why he wouldn&#039;t battle. The Trainer replied :<br />&quot;Well, uh, it kinda feels like... well, look, but I have a very strong feeling that you&#039;ve battled me... and it is against the Legaue&#039;s rules to rematch with someone.&quot;<br />&quot;Wait, do you realize we never battled ? You told me we had to, or strange things would happen. I ran away just after, remember ?&quot;<br />&quot;Yes I do... but it feels like you beat me. I can&#039;t tell you more, sorry. It just feels like that... and I can&#039;t battle you twice.&quot;<br />&quot;Why ? Otherwise, strange stuff blah blah blah ?&quot;<br />&quot;...&quot;<br />&quot;Aw, c&#039;mon. I guess... something strange happened right as I entered the forest after I had ran away from here...&quot;<br />And so did the Bug Catcher learn about Nidoking&#039;s encounter.<br />&quot;Well... that sure seems strange. But hey, don&#039;t do too much of that stuff, okay ? I fear it could have gone worse.&quot;<br />&quot;Nah, don&#039;t worry too much. I believe nothing can be that bad. Take care of yourself !&quot;<br /><br />And so Red reached Pewter City.<br /><br /><br />~~~~<br />Whew, this took me a whole afternoon to write ! Now is very late (or quite early in the morning, I guess ? :P), so I&#039;ll be sleeping.<br />Yeah, both musics are Earthbound OST, but I&#039;m too tired to look deeper into my music files, but I guess this will work. I have plenty of other OSTs, but they don&#039;t fit in this context ^^ <br />(Expect some Undertale action :P)<br /><br />Hopefully I can write &quot;Episode 2&quot; tomorrow.<br />See ya !<br />[/quote]<br />Publish a book


subject: Re: Never wrote an introduction so I wrote one here
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7541.msg200814#msg200814 date=1468682016]<br />Hi fellow Hongkonger! I thought I was the only Pokemon glitcher around here! Now I can&#039;t claim I know the most about Pokemon glitches in the city. :P<br />[/quote]<br />Wow you live in Hong Kong too? Nice :P


subject: Re: Need some help on 4 4
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7538.msg200809#msg200809 date=1468675214]<br />[quote author=TheZZAZZGlitch link=topic=7538.msg200773#msg200773 date=1468610034]<br />Glitch sound banks cause jumps to $6BD4 every time a sound is played (more information: http://forums.glitchcity.info/index.php/topic,7518.msg200772.html#msg200772)<br />I checked all possible sound banks to see what code they execute.<br /><br />We see all kinds of common effects:<br />[list][li]0x01 - &quot;learned&quot;/&quot;trying to learn&quot; effect[/li]<br />[li]0x03, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0D, 0x10, 0x12-0x1E, 0x21, 0x22, 0x24-0x3F - game crashes[/li]<br />[li]0x05 - the game falls into an infinite loop and softlocks[/li]<br />[li]0x0E - returns gracefully or gives an unknown opcode, depending on which sound is played[/li]<br />[li]0x02, 0x04, 0x08, 0x0F, 0x23 - returns gracefully[/li][/list]<br /><br />Sound banks repeat every 0x40 entries (so banks 0x01, 0x41, 0x81 and 0xC1 are identical).<br />So, what else can we do with them?<br /><br />0x11 delays a few frames by executing lots of halt instructions, then writes 0x2E to $C4C1 and then returns. $C4C1 is one of the tiles in the tilemap. So, this sound bank actually has visible effects - we can see the tile change for a few frames:<br /><br />[img]https://aww.moe/3dn5ol.png[/img]<br /><br />0x04 corrupts the value of address $DFE1, depending on which sound is played, and then returns without crashing. I&#039;m not sure what this address does.<br /><br />0x40 causes the game to jump to $E137, which is in the middle of sprite data. This area of memory is hard to control in real time, but it could be manipulated during a TAS to gain arbitrary code execution. Assuming we can get a Missingno. encounter with sound bank 0x40 early on, it could be an interesting and viable strategy in no save corruption any% TASes.<br /><br />Unfortunately, I don&#039;t see anything that would be the cause of 4 4&#039;s true cry.<br />[/quote]<br /><br />Cool. Can you do one for Pokemon Red/Blue as well?<br />[/quote]<br />You&#039;ll have to find out what glitch Pokemon uses glitch sound bank...


subject: Re: Gameshark code limit
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=iamnguyen link=topic=7545.msg200834#msg200834 date=1468714665]<br />Hello, I am new to Gameshark code. Any help is much appreciated.<br /><br />I wonder how stat modifier works. For example:<br /><br />[quote]Special Modifier <br />01??C0DA <br />01??C1DA [/quote]<br /><br />What do I change for each line? Let&#039;s say I want to change the special of my pokemon to 999, what value do I need to have? Please help. Thank you very much in advance.<br />[/quote]<br />First of all, it&#039;ll be actually 01??C1DA + 01??C2DA<br />This is used to change the special of the third Pokemon.<br />If I remembered correctly, the final special will be the sum of the both ??<br />Example: 01[b]FF[/b]C1DA + 01[b]02[/b]C2DA <br />Then the third Pokemon&#039;s special will be FF(255) + 02(2) = 257 special<br />The whole hex-to-number can be viewed here:<br />http://forum.renoise.com/uploads/post-1028-0-62901100-1416239611.png<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  [quote author=Skeef link=topic=6638.msg200833#msg200833 date=1468712816]<br />Actually, Pidgey can have as little as 190 hp at lvl 100. HP does have IV&#039;s in gen 1 and 2 games.<br />[/quote]<br /><br />Yeah, with min IVs and no StatXP Pidgey will be stuck at 190 at the worst case. Also, if you use 10 HP UPs on Pidgey, it&#039;ll only bring it to 230 HP. It&#039;d need another 3642 StatXP HP points, or 15 Chansey fights at minimum, to bring it up to 233.<br /><br />That said I&#039;m not a big fan of using Jolteon simply because you can&#039;t underflow him to 100 like you can with Pidgey. I&#039;m looking at some other Pokemon in the Medium Slow group to see if I can use one of them for a new bootstrap that can be set up relatively easily using the any% item underflow route.<br /><br />EDIT: So I came up with a similar team that could be used for bootstrapping:<br />6 Pokemon:<br />[list][li]Nidoran-F[/li]<br />[li]Pidgey[/li]<br />[li]Pidgey[/li]<br />[li]Parasect[/li]<br />[li]Onix[/li]<br />[li]Rhydon[/li]<br />[/list]<br /><br />[code]WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 01 ff 0f&nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  bc,0fff<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl[/code]<br /><br />This is slightly different because the program counter doesn&#039;t JR past the FF marker at the end of the list; instead, it just rolls past it using a 16-bit load.<br /><br />For the Nidoran, you can use trainer-fly to get one at level 1 and then EXP underflow it to 100. There&#039;s a Youngster before the entrance of Mt Moon that has a Spearow and nothing else (He&#039;s the male trainer between 2 ledges; he can only be approached by jumping over a ledge). Trainer-fly before going to see the Youngster, Growl at his Spearow 6 times before defeating it (or being defeated by it), then go back to the trainer-fly location and capture your Nidoran. Underflow it to level 100, use 1 or 2 HP UPs, and it&#039;ll have more than 233 HP.<br /><br />Parasect can be obtained through trainer-fly as well. The first trainer in Blaine&#039;s gym has a Pokemon that corresponds to Parasect, so just lose to him to get one. You may need to use some item underflow trickery to get here if you don&#039;t have a Secret Key.<br /><br />The Onix can be replaced with a Pidgey, which would jump to the 4th item in your list instead of the 3rd; Pidgey might be faster to obtain than Onix.<br /><br />As for Rhydon, you can use the Old Man glitch to catch an &#039;M off the coast of Cinnabar. The first time you catch an &#039;M, it gets added to your Pokedex. After it plays the Pokedex entry, &#039;M magically becomes Rhydon.


subject: Re: Gen 1 glitches : usefulness &amp; difficulties
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=https://youtu.be/C3vzQsq5fE0?t=35m10s]Talked to Old Man[/url]<br />[url=https://www.youtube.com/watch?v=l6Ug3nczMNQ]Then a whole hour and more of searching for Missingno.[/url]<br />[url=https://www.youtube.com/watch?v=sVbEc2ra7Mk]Then another hour of searching for another Missingno., creating a stack of 255x Ultra Balls[/url]<br />[url=https://www.youtube.com/watch?v=BBWdTNQ40Vs]Underflowing our bag[/url]<br />[url=https://www.youtube.com/watch?v=Jw7SOKgm9rs]Warpping to HoF, Glitch City and checking corrupted HoF entry[/url]<br />[url=https://www.youtube.com/watch?v=54LYetvo2o0]First crash (pressed A on a long-name item) and second crash (again, but in anarchy, with hooked Metapod)[/url]<br />[url=https://www.youtube.com/watch?v=udG3MOPaTD0]First attempt to get RIVAL&#039;s. Failed because of long-name item blocks[/url]<br />[url=https://www.youtube.com/watch?v=Pk4aPG2aMws]Moving and buying items to clear the long-name item block,[/url]<br />[url=https://www.youtube.com/watch?v=m223I0M0mKs]then perform another underflow. Successfully getting JOHN.[/url]<br />[url=https://www.youtube.com/watch?v=kAOr91YUtSU]Flying away from a biker on cycling road.[/url]<br />[url=https://www.youtube.com/watch?v=pHfznmxxGVg]And we got a Slowbro out of that.[/url]<br /><br /><br />


subject: Re: Gen 1 glitches : usefulness &amp; difficulties
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7542.msg200843#msg200843 date=1468734884]<br />[url=https://youtu.be/C3vzQsq5fE0?t=35m10s]Talked to Old Man[/url]<br />[url=https://www.youtube.com/watch?v=l6Ug3nczMNQ]Then a whole hour and more of searching for Missingno.[/url]<br />[url=https://www.youtube.com/watch?v=sVbEc2ra7Mk]Then another hour of searching for another Missingno., creating a stack of 255x Ultra Balls[/url]<br />[url=https://www.youtube.com/watch?v=BBWdTNQ40Vs]Underflowing our bag[/url]<br />[url=https://www.youtube.com/watch?v=Jw7SOKgm9rs]Warpping to HoF, Glitch City and checking corrupted HoF entry[/url]<br />[url=https://www.youtube.com/watch?v=54LYetvo2o0]First crash (pressed A on a long-name item) and second crash (again, but in anarchy, with hooked Metapod)[/url]<br />[url=https://www.youtube.com/watch?v=udG3MOPaTD0]First attempt to get RIVAL&#039;s. Failed because of long-name item blocks[/url]<br />[url=https://www.youtube.com/watch?v=Pk4aPG2aMws]Moving and buying items to clear the long-name item block,[/url]<br />[url=https://www.youtube.com/watch?v=m223I0M0mKs]then perform another underflow. Successfully getting JOHN.[/url]<br />[url=https://www.youtube.com/watch?v=kAOr91YUtSU]Flying away from a biker on cycling road.[/url]<br />[url=https://www.youtube.com/watch?v=pHfznmxxGVg]And we got a Slowbro out of that.[/url]<br />[/quote] so many links xD


subject: Re: Gameshark code limit
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=iamnguyen link=topic=7545.msg200842#msg200842 date=1468733233]<br />Thank you for your response, but does that mean the limit will be 510, not 999?<br />[/quote] sadly, I think that&#039;s the case.


subject: Re: Gameshark code limit
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nope.<br /><br />Take the value you want to get, let&#039;s say 456, divide it by 256, and only take the whole part (this is &quot;integer division&quot;):<br />456 div 256 = 1<br />Then take the original value again, divide it by 256 and take the remainder (this is &quot;modulo&quot;):<br />456 mod 256 = 200<br />Convert the results into hex:<br />01 C8<br />And finally, replace the ?? spots in the GameShark codes:<br />0101C0DA <br />01C8C1DA<br />If it works incorrectly, try putting the bytes in a reverse order (Gen I is very inconsistent with its endianness, the least significant byte sometimes goes first, sometimes goes last).<br />Although I&#039;m not sure where you got the codes in the first place, they point to the second PC Pokemon&#039;s moves.<br /><br />Alternatively, you can just convert the target value into hex and split it every two numbers, adding a leading zero if necessary:<br />456 = 0x1C8 = 0x01C8<br />So the values are: 01, C8<br /><br />Without entering any math details, the first number is the &quot;multiples of 256&quot;, and the second is added to the first number. So with 01 C8:<br />1 * 256 + 0xC8 = 256 + 200 = 456


subject: Re: Gameshark code limit
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you, the famed TheZZAZZGlitch. This makes perfect sense. I&#039;m trying to use Gameshark codes through arbitrary code execution (I know this is lame, I&#039;m really a beginner).


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: NieDzejkob
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aldrasio link=topic=6638.msg200841#msg200841 date=1468730207]<br />For the Nidoran, you can use trainer-fly to get one at level 1 and then EXP underflow it to 100.<br />[/quote]<br /><br />Never thought about it. I always got my money to ??28?? by selling Ultra Balls from brightness slot and spammed rare candies obtained that way.<br /><br />Also, how do you know which trainers result in the pokemon you want in Trainer-Fly? I found http://puu.sh/257S but it is terrible. Mostly because you can&#039;t search on images automatically.


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  I explain shortly here how to go from a memory address to a gameshark code then to an 8F inventory: http://forums.glitchcity.info/index.php/topic,6638.msg199419.html#msg199419<br /><br />The RAM Map I refer to is [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map]this one[/url], and the big list is [url=http://glitchcity.info/wiki/index.php/The_Big_HEX_List]this one[/url].<br /><br />Oh, and don&#039;t hesitate to use windows&#039; calculator for translations, too.


subject: Re: Gameshark code
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Carl Miller
icon: xx
body:
  999 is 3E7 in hex, so I believe the variables would be E7 and 03, respectively. Do, however, double-check or more before taking it into production.<br /><br />Also, don&#039;t post the same thing multiple times in different boards.


subject: Re: Gameshark code
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Every gameshark code induces a modification of the value (which is an hexadecimal number going from 00 to FF) of a given address. In the code &quot;01??C0DA&quot;, the value of RAM address $DAC0 becomes &quot;??&quot;.<br /><br />Translated into decimal, FF is 255. As you can see, one RAM address is not enough to deal with a stat. We need to combine two RAM addresses, so the values can go up to FFFF (65535 in decimal - but of course the game will not allow you to go that far).<br /><br />Anyway, a stat of dec:999 can be translated to hex:03E7. That means the first gameshark code should then be 0103C0DA and the second one 01E7C1DA.<br /><br />To translate decimal into hexadecimal, don&#039;t hesitate to use Windows&#039; calculator.


subject: Re: Emulating the Mobile Adapter GB
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7509.msg200525#msg200525 date=1465883166]<br />I think the next step will be to set up a server that can run a fully functioning Trade Corner, and write a client that can connect to that server or make direct â€œcallsâ€ to other clients. Thereâ€™s still the matter of getting PokÃ©mon Crystalâ€™s PokÃ©mon News, Battle Tower, and Mobile Stadium features running, and after that, it might be interesting to get a couple of the other Mobile Adapter GB compatible games working. Eventually, it would be fun to build a ROM hack of the English version of PokÃ©mon Crystal that restores all of its mobile functionality.<br />[/quote]<br /><br />I&#039;d love to help you on this. I am a Gen 2 romhacker. A small community for the online capabilities of Pokemon Crystal. Real neat. I PM&#039;d you my Skype.&nbsp; :)


subject: Re: Gameshark code
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Carl Miller link=topic=7546.msg200850#msg200850 date=1468745148]<br />999 is 3E7 in hex, so I believe the variables would be E7 and 03, respectively. Do, however, double-check or more before taking it into production.<br /><br />Also, don&#039;t post the same thing multiple times in different boards.<br />[/quote]<br />Be careful, stats in RBY are big-endian. Sounds weird, I know, but it&#039;s that way.


subject: Re: Gen 1 glitches : usefulness &amp; difficulties
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7542.msg200843#msg200843 date=1468734884]<br />[url=https://youtu.be/C3vzQsq5fE0?t=35m10s]Talked to Old Man[/url]<br />[url=https://www.youtube.com/watch?v=l6Ug3nczMNQ]Then a whole hour and more of searching for Missingno.[/url]<br />[url=https://www.youtube.com/watch?v=sVbEc2ra7Mk]Then another hour of searching for another Missingno., creating a stack of 255x Ultra Balls[/url]<br />[url=https://www.youtube.com/watch?v=BBWdTNQ40Vs]Underflowing our bag[/url]<br />[url=https://www.youtube.com/watch?v=Jw7SOKgm9rs]Warpping to HoF, Glitch City and checking corrupted HoF entry[/url]<br />[url=https://www.youtube.com/watch?v=54LYetvo2o0]First crash (pressed A on a long-name item) and second crash (again, but in anarchy, with hooked Metapod)[/url]<br />[url=https://www.youtube.com/watch?v=udG3MOPaTD0]First attempt to get RIVAL&#039;s. Failed because of long-name item blocks[/url]<br />[url=https://www.youtube.com/watch?v=Pk4aPG2aMws]Moving and buying items to clear the long-name item block,[/url]<br />[url=https://www.youtube.com/watch?v=m223I0M0mKs]then perform another underflow. Successfully getting JOHN.[/url]<br />[url=https://www.youtube.com/watch?v=kAOr91YUtSU]Flying away from a biker on cycling road.[/url]<br />[url=https://www.youtube.com/watch?v=pHfznmxxGVg]And we got a Slowbro out of that.[/url]<br />[/quote]<br />Man, TPP must have been higher than usual (which is already way too high)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, we usually use that. You can&#039;t search for images, but the same PokÃ©mon tends to appear multiple times in an area, so...<br />And if you find better, let us know !


subject: Re: A glitchy journey.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  Nah, I&#039;m not like it. But could you please not quote my post ? It&#039;s already quite big without duplicating it...<br /><br /><br />*-_+&#039;Â²\,:Â°|_Â§&quot;+&lt;#&gt; [size=2pt]this is the best separator I&#039;ve ever written.[/size]<br /><br />I promised you some Undertale action, so... heh :P<br />Anyways, Episode 2 is writing on.<br />Enjoy, or blap.<br />~~ISSOtm<br /><br />==========================hOI!!!!!=========<br /><br />[url=https://youtu.be/9vUwXhaJ1x0?]Muse-ic ~[/url]<br /><br />Pewter was gray. I mean, literally gray. Red once again experienced colour changes when he entered Pewter City. Well, the Champion of this area was Rock-type, so the color was kinda legit.<br />Red wanted to have Charmander train some more, so he deposited Nidoking and Rattata into his PC and headed for the Gym. He battled the first Trainer of the gym with some difficulties, but eventually made his way out of it in one piece.<br />He then headed back for the PokÃ©mon Center to heal his Charmander, then went for the PC to get Nidoking back, realizing beating Rock-type with fire-type didn&#039;t sound too good. The &quot;Out of order&quot; sign surprised him. He asked Nurse Joy about that, and she explained that sadly, the communication with Bill&#039;s server at Cerulean City was cut. He would have to go there to use a PC, since Viridian&#039;s and the League&#039;s connections depended on Pewter&#039;s. She told Red that someone would probably have to warn Cerulean City about that, since Bill couldn&#039;t monitor the entirety of the network alone. Red was disappointed for Nidoking, but hoped he and Rattata arrived properly to Bill&#039;s server.<br />Red went to the Gym, ready for a Champion takedown. His Geodude wasn&#039;t a big deal, but his Onix forced Red to use several Potions... until a critical hit finished Charmander off. Brock grinned : &quot;Well, kid, looks like you can&#039;t even beat the first Gym !&quot; Red gave Brock half of his money, and left to the PokÃ©mon Center. After Charmander was healed, Red headed for the eastern exit of the city, towards Cerulean City. &quot;Brock taunted me ? I will wipe his mocking smile off his face with some level 100 thrashes !&quot; Red decided to save his progress before heading there, and then walked east.<br /><br />[url=https://youtu.be/dXJWj-0fUqI]Miyu Zic[/url]<br /><br />However, a Youngster stopped him, and told him Brock was looking for challengers. Red explained that he already tried and failed, but the Youngster didn&#039;t change his mind. Red smashed his fist against his hip in his anger - &quot;Is this guy deaf ??&quot;, he thought -, which accidentally triggered his START menu. Red tried to move the cursor to QUIT to resume his conversation, but was surprised to note that it was frozen on the already selected option : SAVE. He lifted one eyebrow, then his shoulders, and hit the validation button. After all, why not. If he &quot;accidentally&quot; smashed that Youngster&#039;s stupid face, he could always roll back to this point.<br />Some words later, Red effectively punched the Youngster, who gave Red an over-angered look. At this moment, Red felt a battle was about to begin, but not with PokÃ©mon. Red hadn&#039;t ever been good at battling with his fists, so he chose to reset. When he started over, the Youngster told Red to follow him to the Gym. Red accepted, but... the Youngster was off. He walked through stuff, and talked to Red while standing inside of a girl... Red was even more surprised when the Youngster teleported in front of him and went back to where he was. Red came back to the eastern exit, and... the Youngster had disappeared. Red quickly realized he could now walk to Cerulean ! The Youngster sure did strange things, but that didn&#039;t matter for the delighted Red, who made short work of Route 3&#039;s Bug Catchers.<br />When our adventurers reached Mt. Moon, they healed at the PokÃ©mon Center, and Saved there.<br /><br />(Imagine some Rocket bashing here)<br /><br />Red finally exited Mt. Moon, having smashed a couple of Trainers and Rockets he had crossed, plus he had gotten [size=4pt]our lord and savior[/size] a Helix Fossil. He watched the Fossil&#039;s description a couple times, influenced by a powerful but anarchic force. He bumped in a few walls before realizing what he was doing and going east.<br />Red finally reached Cerulean City ! He went to the PokÃ©mon Center, only to discover this PC also was out of order. Nurse Joy explained that Bill&#039;s server was unreachable for the moment, but nobody from the PokÃ©mon Center could reach him, as there were six Trainers on the Nugget Bridge that held a contest, and they didn&#039;t let any non-Trainer pass. She asked Red if he could talk to Bill, and he answered he would. He was beginning to panic for the sake of his Nidoking, but Nurse Joy told him there had never been a problem with Bill&#039;s system, and his PokÃ©mon probably were fine.<br />Red calmed down, and walked to the &quot;Nugget Bridge&quot; ; however, before he could reach it, he stumbled into Blue, who apparently saw Bill and his collection of PokÃ©mon. He didn&#039;t seem to know anything about the PC outage, but challenged Red into a battle. Red won by combining the newly-learnt Ember with some Potions, but showed interest for Blue&#039;s Abra. After winning, he asked him where he found that oddity, and Blue pointed him some grass on his right. He warned him about a Trainer that would challenge him as soon as he would see Red. Blue told him that this Trainer gave him some difficulties, then gave Red some money for his victory, and left.<br />After a trip to the PokÃ©mon Center, Red proceeded to fight the five Nugget Trainers. When he finally reached the end of the bridge, he recieved a Nugget. Made of gold Red thought about how much he could sell this. But the generous donator asked him if he wanted to join Team Rocket. Remembering their aggressive grunts in Mt. Moon, Red refused. The Rocket insisted, and finally gave up arguing and sent out his PokÃ©mon.<br />One Rocket defeat later, Red began heading towards Bill&#039;s Cottage. He felt he had to hurry, so he tried to sneak around Trainers as much as possible.<br /><br />[url=https://youtu.be/xLsuam9o9BA]Yumsic[/url]<br /><br />Red finally arrived at the Sea Cottage. When he entered, he was surprised to see Bill wasn&#039;t there. In his stead was a PokÃ©mon, who welcomed him :<br />&quot;Hiya ! I&#039;m a PokÃ©mon !&quot;<br />Red raised one eyebrow, feeling something was off, but he could put his finger quite on it.<br />&quot;...No I&#039;m not !&quot;<br />&quot;Aw, right ! I remember now, PokÃ©mon don&#039;t talk ! You got me good !<br />... but then... What ARE you, exactly ??&quot;<br />&quot;Call me Bill ! I&#039;m a true blue PokÃ©maniac !&quot;<br />Red still felt something was off, and now he knew what. Maybe that was a bit too creepy for him.<br />&quot;Hey ! What&#039;s with that skeptical look ? I&#039;m not joshing you, I screwed up an experiment and got combined with a PokÃ©mon! So, how about it? Help me out there!&quot;<br />Red wasn&#039;t sure if he was saying true, but heh, if it was, the poor guy must be quite embarrassed now. He replied he would.<br />&quot;Bill&quot; told him to go to his PC, and to run the &quot;Cell Separation Program&quot; when he entered what he described as a &quot;teleporter&quot;.<br />Red nodded, manipulated the knobs&#039;n&#039;stuff the computer told him to, and finally Bill came out of the other cell.<br />Seeing him, Red&#039;s mind clicked :<br />&quot;Wait, YOU are the PC system maintainer !&quot;<br />&quot;Yes I am !&nbsp; I must thank you for what you did. Here, I got a ticket for the SS.Anne, it&#039;s a boat docked in Vermilion. I hate the kind of guys there, so I didn&#039;t want to go anyways. Take it as a token of my gratitude.&quot;<br />&quot;Oh, thanks, but I&#039;m not into that kind of thing either.&quot;<br />&quot;Well, as a Trainer, you could, as the captain is a Cut master. Maybe that&#039;d be cool for you, but meh, I can&#039;t tell you much about this. I&#039;m more into PokÃ©mon collections than battles.&quot;<br />&quot;I still like you, you&#039;re a nice guy. Oh, and, may I ask you for a little service ?&quot;<br />&quot;Sure, what is it ?&quot;<br />&quot;Uh, it looks like the connection with your server is broken, and so the PC storage system is down. Could you fix that ?&quot;<br />&quot;Oh man, I didn&#039;t even notice ! The server program must have frozen when I messed up the experiment. Don&#039;t worry, PokÃ©mon are kept safely even when the program is shut down.&quot;<br />&quot;Ah, I hope my PokÃ©mon made the way in here...&quot;<br />&quot;Don&#039;t-cha worry, I built the system to be fail-proof. Y&#039;see, the transferring PCs don&#039;t erase PokÃ©mon unless they are sure that it arrived well at the other end. No one ever had to complain about anything else than outages.&quot;<br />Red took an inner note about what would happen if he cut the communication at a precise time. Sounded like cloning, but he stayed silent about that.<br />He thanked Bill, and left back to Cerulean. He stopped by the PokÃ©mon Center to retrieve his Nidoking and heal Charmander. Then, he went to the nearby Gym to beat some PokÃ©mon up. Charmander took a Cloyster down quite easily, since his Trainer kept using Withdraw. Red asked him, after-battle, why he did so. He was answered it was a Water-Type move that was Super Effective against Chamander... except it didn&#039;t deal any damage. It felt dumb in retrospective, but the Trainer didn&#039;t think about that in the moment. Red took the easy win, and went on forward to Misty.<br /><br />[url=https://youtu.be/MpALEsA6mV4]CLICK TAHT LINK RITE NAO !!!!1[/url]<br /><br />One badge later, Red remembered about Brock, and felt anger coming back to him. He backtracked towards Mt. Moon, but soon realized ledges were in his way ! Because there was no going back, Red thought he might just take the other way around : SURFing to Pallet Town. He should have borrowed a map from Daisy (Blue&#039;s sister), but meh. (He didn&#039;t know crabs about geographics, so he thought his plan was doable).<br />Red asked a police officier for directions, who told him he could go either east to Lavender, or south to Vermilion. He joked that &quot;even if these both required CUT, now you could go right through this house !&quot;<br />Red learnt this house was robbed by Team Rocket, who dug a big hole in the back wall. This was his &quot;CUT-less&quot; way of advancing ! So he entered the house, and exited to the back yard. A Rocket was standing there as a &quot;passerby&quot;. Red didn&#039;t believe him, so a battle started.<br />After some deserved Chamander training, the Rocket left, and Red proceeded south. The guard blocked his way to Saffron City (&quot;what a dumbass !&quot;), so he has to enter the underground tunnel, though he saw people dropped some items on the floor. He took them (&quot;Meh, at least they&#039;ll be of some use to someone&quot;), and exited to Vermilion City. He remembered the SS Anne was there, and in it a guy that mastered CUT. As he had earned the possibility to use CUT, this would prove useful.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aldrasio link=topic=6638.msg200841#msg200841 date=1468730207]<br /><br />Parasect can be obtained through trainer-fly as well. The first trainer in Blaine&#039;s gym has a Pokemon that corresponds to Parasect, so just lose to him to get one. You may need to use some item underflow trickery to get here if you don&#039;t have a Secret Key.<br /><br />The Onix can be replaced with a Pidgey, which would jump to the 4th item in your list instead of the 3rd; Pidgey might be faster to obtain than Onix.<br /><br />As for Rhydon, you can use the Old Man glitch to catch an &#039;M off the coast of Cinnabar. The first time you catch an &#039;M, it gets added to your Pokedex. After it plays the Pokedex entry, &#039;M magically becomes Rhydon.<br />[/quote]<br /><br />Paras evolves at lvl 24, might be simpler to just lvl it up instead of going to cinebar gym.<br />And wouln&#039;t any missingno turn into Rhydon when you box it? Since &#039;M evolves into Kangashkan its not alot more efficient.<br />Missingno is easy to trainer fly since just talking to most ingame trade NPC&#039;s turns the resulting pokÃ©mon into one. &lt;- multiply rare candy&#039;s at the same time and you can easily lvl Paras to 24.<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not all Missingno become Rhydons. Only the one that triggers the PokÃ©dex entry.<br /><br />Also, European versions have more trouble getting a Missingno, since it automatically crashes the game when encountered. Since we have to Cooltrainer him, we need a Ditto, and for that :<br />* either we obtain it legit east of Fuchsia City, which implies going to the Cycling Road which implies getting the PokÃ© Flute ;<br />* or we Trainer-Fly the bottom-left Channeler in Sabrina&#039;s Gym, which implies getting Cut and beating Silph Co. (unless we find a way to remove the corresponding Rocket using TFly object removal manipulation).<br /><br />The best solution I can see is the first one. 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  Yep, forgot about that one. Is it that Snorlax that is removed ? Or the other ?<br /><br />Also, here are replacements for Rhydon.<br />Cubone :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 11 ff 0f&nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  de,0fff<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br /><br />Voltorb :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 06 ff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld b, ff<br />WRA1:d16b 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  rrca<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br /><br />Gengar :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 0e ff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld c, ff<br />WRA1:d16b 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  rrca<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br /><br />Gyarados :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 16 ff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld d, ff<br />WRA1:d16b 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  rrca<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br /><br />Chansey :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 28 ff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jr z, d16a ; never occurs because inc h resets this flag<br />WRA1:d16b 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  rrca<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br /><br />Either Drowzee or hex:38 Missingno will work (if the carry flag is unset, it will be Missingno, otherwise Drowzee)<br /><br />Drowzee / Missingno :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 30/38 ff&nbsp; &nbsp; &nbsp; &nbsp;  jr nc/c, ff ; Drowzee/Missingno<br />WRA1:d16b 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  rrca<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br /><br />hex:3E Missingno :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 3e ff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld a, ff<br />WRA1:d16b 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  rrca<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br /><br />Other PokÃ©mon work, but they are all glitch PokÃ©mon, so I didn&#039;t mention them.<br /><br />Cubone is Trainer-Flyable in Routes 6, 9, 24, 25, and in Mt. Moon as well as the Rock Tunnel.<br />Voltorb seems not to be obtained through TFly, but maybe by Ditto tricing.<br />Gengar is Trainer-Flyable in from Brock, and also in Routes 3, 24 and 25.<br />Gyarados can be TFlyed in Routes 9, 13 and Mt. Moon.<br />Chansey can be TFlyed in Routes 8, 13 and Erika&#039;s Gym as well as Lavender Town.<br />Drowzee can be TFlyed in Routes 11, 12, and 14.<br /><br />I may have missed some TFly spots, but I can guarantee that Voltorb cannot be obtained.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can remove both of them with the glitch. I Don&#039;t think you can remove the rocket infront of sabrina&#039;s gym with the glitch tho. You could use the safari zone walk through wall glitch to walk through him, but thats alot of work.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  [quote author=NieDzejkob link=topic=6638.msg200848#msg200848 date=1468744974]<br />[quote author=Aldrasio link=topic=6638.msg200841#msg200841 date=1468730207]<br />For the Nidoran, you can use trainer-fly to get one at level 1 and then EXP underflow it to 100.<br />[/quote]<br />Also, how do you know which trainers result in the pokemon you want in Trainer-Fly? I found http://puu.sh/257S but it is terrible. Mostly because you can&#039;t search on images automatically.<br />[/quote]<br /><br />That&#039;s actually exactly what I used, lol. I had [url=http://bulbapedia.bulbagarden.net/wiki/List_of_Pok%C3%A9mon_by_index_number_(Generation_I)]this list[/url] open, and for higher-valued indices I looked in places where you&#039;d find higher-level trainers. I also zoomed the image out and kinda scanned for the Pokemon I was looking for. Took a while, but I found what I was looking for.<br /><br />[quote author=ISSOtm link=topic=6638.msg200860#msg200860 date=1468758919]<br />Either Drowzee or hex:38 Missingno will work (if the carry flag is unset, it will be Missingno, otherwise Drowzee)<br /><br />Drowzee / Missingno :<br />[code]<br />WRA1:d163 06 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  b,0f<br />WRA1:d165 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d166 24&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  inc&nbsp; h<br />WRA1:d167 2e 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  l,22<br />WRA1:d169 30/38 ff&nbsp; &nbsp; &nbsp; &nbsp;  jr nc/c, ff ; Drowzee/Missingno<br />WRA1:d16b 0f&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  rrca<br />WRA1:d16c 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />WRA1:d16d e9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  jp&nbsp;  hl<br />[/code]<br />[/quote]<br /><br />I just checked, all flags are unset once you jump to the items with 8F. It&#039;d have to be Missingno(38).


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I used the same method for my overly long post. I searched for PokÃ©mons around the world (while having the image zoomed, of course :P), and wrote my results.


subject: Re: A glitchy journey.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  My biggest problem so far is to find music that corresponds to the atmosphere I want a passage to have, but it also has to be the correct length.<br />An upcoming problem will be to keep the story interesting while still sticking to the glitching part of the &quot;plot&quot;. It&#039;s a nice challenge, though ^^


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg200858#msg200858 date=1468758663]<br />Also, European versions have more trouble getting a Missingno, since it automatically crashes the game when encountered.<br />[/quote]<br /><br />To be perfectly correct, you should have said &quot;Non-english european R/B versions have more trouble getting a non-Ghost/Fossil MissingNo. by either Ditto or Old Man glitch&quot; [img]http://forum.saintseiyapedia.com/Smileys/custom/aloy.jpg[/img]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  Came up with another script: Change the background music.<br />[list]<br />[li]8F[/li]<br />[li](any item)[/li]<br />[li]Awakening x (sound bank)[/li]<br />[li]Lemonade x (song index)[/li]<br />[li]TM05 x 161[/li]<br />[li]HP UP x 201[/li]<br />[/list]<br /><br />[code]WRA1:d322 0e xx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  c,xx&nbsp; &nbsp; ; xx for sound bank<br />WRA1:d324 3e yy&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  a,yy&nbsp; &nbsp; ; yy for music index number<br />WRA1:d326 cd a1 23&nbsp; &nbsp; &nbsp; &nbsp;  call 23a1&nbsp; &nbsp; ; PlayMusic function<br />WRA1:d329 c9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ret[/code]<br /><br />And I couldn&#039;t find a list of song indices anywhere from googling, so here&#039;s one I made from the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red_and_Blue:ROM_map]ROM map[/url] on Datacrystal a while ago:<br /><br />Bank 02 (2):<br />[list][li]BA (186): Pallet Town[/li]<br />[li]BD (189): Pokemon center[/li]<br />[li]C0 (192): Gym theme[/li]<br />[li]C3 (195): Viridian city[/li]<br />[li]C7 (199): Fuschia city[/li]<br />[li]CA (202): Celadon city[/li]<br />[li]CD (205): Cinnibar island[/li]<br />[li]D0 (208): Vermillion city[/li]<br />[li]D4 (212): Lavender Town[/li]<br />[li]D8 (216): S.S. Anne[/li]<br />[li]DB (219): Follow Oak[/li]<br />[li]DE (222): Gary fucking Oak[/li]<br />[li]E1 (225): Follow someone[/li]<br />[li]E5 (229): Safari Zone/evolution[/li]<br />[li]E8 (232): Pokemon healed[/li]<br />[li]EB (235): Route 1[/li]<br />[li]EF (239): Welcome to the world of Pokemon[/li]<br />[li]F3 (243): Route 4[/li][/list]<br />Bank 08 (8):<br />[list][li]EA (234): Gym battle[/li]<br />[li]ED (237): Trainer battle[/li]<br />[li]F0 (240): Wild battle[/li]<br />[li]F3 (243): Final battle[/li]<br />[li]F6 (246): Trainer defeated[/li]<br />[li]F9 (249): Wild defeated[/li]<br />[li]FC (252): Gym leader defeated[/li][/list]<br />Bank 1F (31):<br />[list][li]C3 (195): Title screen[/li]<br />[li]C7 (199): Credits[/li]<br />[li]CA (202): Hall of Fame[/li]<br />[li]CD (205): Oak&#039;s lab[/li]<br />[li]D0 (208): Jigglypuff&#039;s song[/li]<br />[li]D2 (210): Bike riding[/li]<br />[li]D6 (214): Surfing[/li]<br />[li]D9 (217): Casino[/li]<br />[li]DC (220): Intro battle[/li]<br />[li]E0 (224): Rocket Hideout[/li]<br />[li]E4 (228): Viridian Forest[/li]<br />[li]E8 (232): Cave music[/li]<br />[li]EC (236): Cinnabar mansion[/li]<br />[li]F0 (240): Pokemon Tower[/li]<br />[li]F3 (243): Silph Co[/li]<br />[li]F6 (246): Meet bad trainer[/li]<br />[li]F9 (249): Meet girl trainer[/li]<br />[li]FC (252): Meet boy trainer[/li][/list]<br /><br />So, if for example you wanted to play the SS Anne music, you&#039;d need 2 Awakenings and 216 Lemonades. If you wanted to play the Pokemon Tower music, you&#039;d need 31 Awakenings and 240 Lemonades.<br /><br />Something to note, if you use anything from Bank 02 or Bank 1F in battle, it&#039;ll mess with the other battle sound effects. If you use anything from Bank 08 on the overworld, it&#039;ll also mess with other sound effects.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=6638.msg200867#msg200867 date=1468776608]<br />[quote author=ISSOtm link=topic=6638.msg200858#msg200858 date=1468758663]<br />Also, European versions have more trouble getting a Missingno, since it automatically crashes the game when encountered.<br />[/quote]<br /><br />To be perfectly correct, you should have said &quot;Non-english european R/B versions have more trouble getting a non-Ghost/Fossil MissingNo. by either Ditto or Old Man glitch&quot; [img]http://forum.saintseiyapedia.com/Smileys/custom/aloy.jpg[/img]<br />[/quote]<br /><br />Tru, My english european red cartidge has no problems with missingno. Nor does my english virtual console. (wich im pretty sure is availible worldwide)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Also, my French Rouge (Red) 3DS VC has trouble with Missingno. It crashed on me with a single &quot;beep&quot; when I believe it tried to load its sprite.


subject: Re: Gameshark code
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I kinda think Game Freak programmed the first generation like it would be a crappy game that would never go out of Japan, since it is very poorly programmed (look at the Swift accuracy glitches ! Or the Sabrina Win&amp;Lose Glitch in JP R/G !). So it got coded quite poorly.<br /><br />At least we still find more glitches, even in 2k16 ! :P


subject: Re: Gameshark code
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7546.msg200873#msg200873 date=1468807906]<br />I kinda think Game Freak programmed the first generation like it would be a crappy game that would never go out of Japan, since it is very poorly programmed (look at the Swift accuracy glitches ! Or the Sabrina Win&amp;Lose Glitch in JP R/G !). So it got coded quite poorly.<br /><br />At least we still find more glitches, even in 2k16 ! :P<br />[/quote]<br />Honestly, there&#039;s more glitch then pokemons<br />And it&#039;s more fun on finding glitch then capturing Pokemon<br />But we&#039;ll have to thank game freak for that, or else we all might have forgotten Pokemon gen1/2


subject: Re: Gameshark code
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]And it&#039;s more fun on finding glitch then capturing Pokemon[/quote]<br /><br />This made me laugh a lot because honestly it&#039;s totally true


subject: Re: Gameshark code
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Simply, totally, frantically true. Is is always awesome to find glitches. It is even better when they are good glitches (like ACE, or stuff).


subject: Re: Gameshark code
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve played Gen I Pokemon games multiple times. I still have to do a glitchless playthrough.<br />Glitching is just a lot more fun that the game itself. In fact, I consider Gen I to be one of the worst games in the series, gameplaywise.


subject: Re: Gameshark code
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7546.msg200877#msg200877 date=1468843870]<br />I consider Gen I to be one of the worst games in the series, gameplaywise.<br />[/quote]<br /><br />You may be on to something there. I never finished a glitchless playthrough of a Yellow cart I have. I think I last saved in the Rocket Hideout.


subject: Re: Gameshark code
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, I don&#039;t know guys. I really enjoyed the game when I was 10 years old, it was all new and stuff. I had no idea about glitches by then.<br /><br />Of course nowadays it would be refered as a poor game, especially compared to the other games in the series. But it was Game Boy back then.


subject: Invalid sound banks examination
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  I wrote a bot that runs through a given ROM and tries to find how the corresponding sound bank would behave.<br />Here is the bot&#039;s source (in C) : http://pastebin.com/DzFuWzz9<br />Here is the report for PokÃ©mon Yellow : http://pastebin.com/RpEDNEyX<br /><br />Obviously, it is extremely bulky, and is often wrong when the bank doesn&#039;t immediately crash, but at least it helps.<br /><br />PokÃ©mon Yellow results :<br />[table]<br />[tr]<br />[td][b]Bank #[/td][td][b]Effect / Commentary[/b][/td]<br />[/tr]<br />[tr]<br />[td]00 / 01[/td][td]TheZZAZZGlitch pointed out : it tries to learn an invalid move forever.[/td]<br />[/tr]<br />[tr]<br />[td]03[/td][td]Crashes (STOP).[/td]<br />[/tr]<br />[tr]<br />[td]04[/td][td]Crashes (invalid opcode F4).[/td]<br />[/tr]<br />[tr]<br />[td]05[/td][td]To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]06[/td][td]NOP slides into VRAM. High chances to crash.[/td]<br />[/tr]<br />[tr]<br />[td]07[/td][td]NOP slides into VRAM. High chances to crash.[/td]<br />[/tr]<br />[tr]<br />[td]09[/td][td]Does a bunch of stuff. Should be investigated.[/td]<br />[/tr]<br />[tr]<br />[td]0A[/td][td]To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]0B[/td][td]Writes ((a OR h + c) XOR $FF) to hl + 1, then returns. (UNSURE)[/td]<br />[/tr]<br />[tr]<br />[td]0C[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]0D[/td][td]If the Z flag is set, returns. Otherwise crashes (rst 18h).[/td]<br />[/tr]<br />[tr]<br />[td]0E[/td][td]Maybe returns, otherwise crashes (invalid opcode D3). (To investigate)[/td]<br />[/tr]<br />[tr]<br />[td]0F[/td][td]Returns nicely.[/td]<br />[/tr]<br />[tr]<br />[td]10[/td][td]NOP slides into VRAM. High chances to crash.[/td]<br />[/tr]<br />[tr]<br />[td]11[/td][td]Does some memory writes, HALTs a lot, returns if D72C bit 4 is nonzero, otherwise does stuff that should be investigated.[/td]<br />[/tr]<br />[tr]<br />[td]12[/td][td]NOP slides into VRAM. High chances to crash.[/td]<br />[/tr]<br />[tr]<br />[td]13[/td][td]Crashes (rst 30h).[/td]<br />[/tr]<br />[tr]<br />[td]14 to 18[/td][td]NOP slides into VRAM. High chances to crash.[/td]<br />[/tr]<br />[tr]<br />[td]19[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]1A[/td][td]To investigate, but does a bunch of lds.[/td]<br />[/tr]<br />[tr]<br />[td]1B[/td][td]Decrements sp, does a bunch of stuff, to investigate.[/td]<br />[/tr]<br />[tr]<br />[td]1C[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]1D[/td][td]NOP slides into VRAM. High chances to crash.[/td]<br />[/tr]<br />[tr]<br />[td]1E[/td][td]To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]21 and 22[/td][td]NOP slide to VRAM. High chances of crashing.[/td]<br />[/tr]<br />[tr]<br />[td]23[/td][td]Runs a RRA, sends that value to FF3F (some sound thing), then returns if that RRA was nonzero (I guess it is ?).[/td]<br />[/tr]<br />[tr]<br />[td]24[/td][td]NOP slides into VRAM. High chances to crash.[/td]<br />[/tr]<br />[tr]<br />[td]25[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]26[/td][td]Crashes (rst 20h).[/td]<br />[/tr]<br />[tr]<br />[td]27[/td][td]Crashes (invalid opcode F4).[/td]<br />[/tr]<br />[tr]<br />[td]28 to 2A[/td][td]Crash (rst 20h).[/td]<br />[/tr]<br />[tr]<br />[td]2B[/td][td]Crashes (invalid opcode F4).[/td]<br />[/tr]<br />[tr]<br />[td]2C[/td][td]Crashes (rst 20h).[/td]<br />[/tr]<br />[tr]<br />[td]2D[/td][td]Does a lot of stuff (including adding $A8 to SP), then possibly slides into VRAM. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]2E[/td][td]Crashes (invalid opcode F4).[/td]<br />[/tr]<br />[tr]<br />[td]2F[/td][td][s]Sexually harasses[/s] a memory address (writes the same value to it 200+ times in a row), writes loads of stuff to some I/O ports, then calls 3082. Should be investigated.[/td]<br />[/tr]<br />[tr]<br />[td]30[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]31[/td][td]Does a RRCA, and returns if that is nonzero. If it is, add 0F to SP, and returns if the RRCA + b is nonzero. Otherwise crashes (invalid opcode FC).[/td]<br />[/tr]<br />[tr]<br />[td]32[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]33[/td][td]Crashes (invalid opcode FC).[/td]<br />[/tr]<br />[tr]<br />[td]34[/td][td]NOP slides into VRAM. High chances of crashing.[/td]<br />[/tr]<br />[tr]<br />[td]35[/td][td]Crashes (rst 28h).[/td]<br />[/tr]<br />[tr]<br />[td]36 to 38[/td][td]Crash (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]39[/td][td]Crashes (invalid opcode FC).[/td]<br />[/tr]<br />[tr]<br />[td]3A and 3B[/td][td]NOP slide into VRAM. High chances of crashing.[/td]<br />[/tr]<br />[tr]<br />[td]3C[/td][td]ret nc, otherwise crashes.[/td]<br />[/tr]<br />[tr]<br />[td]3D[/td][td]NOP slides into VRAM. High chances of crashing.[/td]<br />[/tr]<br />[tr]<br />[td]3E[/td][td]To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]3F[/td][td]Crashes (invalid opcode FC)[/td]<br />[/tr]<br />[tr]<br />[td]40 to 7F[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[/table]<br /><br />To summarize, here are the banks that do not crash or NOP slide :<br />00/01, 05, 09, 0B, 0D, 0E, 0F, 11, 1A, 1B, 1E, 23, 2D, 2F, 31, 3C and 3E.<br /><br />Here are the banks that should be investigated :<br />05, 09, 0B, 0E, 11, 1A, 1B, 23, 2D, 2F, and 3E.


subject: Re: The &quot;(Enemy) learned â•Ÿ&quot; effect.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, sorry for double-posting, but meh.<br /><br />[quote author=TheUnReturned link=topic=7518.msg200806#msg200806 date=1468673390]<br />[quote author=ISSOtm link=topic=7518.msg200800#msg200800 date=1468668143]<br />Depends on what their 6BD4 do ;)<br />[/quote]Do a documentary on the possibility of what it could do ;^)<br />[/quote]<br />I wrote the bot I mentioned earlier, and ran it on an US PokÃ©mon Yellow Rom.<br />I created a topic specifically about glitch sound banks [url=http://forums.glitchcity.info/index.php/topic,7548.msg200880.html#msg200880]here[/url].


subject: Re: Gameshark code
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you very much for all of your help. Glitches add a whole new dimension to the game. Discovering this community is the reason I&#039;m replaying PokÃ©mon. I just found out that arbitrary code execution can do the same thing as Gameshark codes and I&#039;m eagerly learning how to perform it.


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you so much!!! I was about to make a post asking how all three are related. I would like ask if the GS codes are multi lines, can I execute each line with 8F separately? Can I combine all lines in an item list?


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You can execute each code separately. But you could also create an 8F code which will execute all of them at the same time. This might be a little tricky if you&#039;re not used with opcodes yet, but don&#039;t hesitate to ask here for help.


subject: Was it worth me getting PKMN Green for its broken-ness? How broken is it really?
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not sure which board this goes on, feel free to move.<br /><br />I recently ordered Pokemon Green since it was cheap and I heard it was the most broken game.<br /><br />Is it true? Is it worth it?


subject: Re: Was it worth me getting PKMN Green for its broken-ness? How broken is it really?
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve never really heard much about PokÃ©mon Green&#039;s glitchiness outside of [url=http://forums.glitchcity.info/index.php/topic,6837.0.html]this[/url], which is the most comprehensive glitch I&#039;ve seen from it.<br /><br />Hell, anytime Green comes up, it&#039;s usually about how astoundingly shitty its sprites look.<br /><br />But in general if you can glitch the absolute hell out of something, it&#039;s worth it.<br /><br />[size=2pt]I still want a Superman Ball.[/size]


subject: Re: Was it worth me getting PKMN Green for its broken-ness? How broken is it really?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I can tell you something like :<br />If you lose against Sabrina, then come back to her Gym, as soon as you hit the front carpet, she talks to you and give you the badge. Neato !


subject: Re: Was it worth me getting PKMN Green for its broken-ness? How broken is it really?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=ravioli link=topic=7549.msg200885#msg200885 date=1468870474]<br />Not sure which board this goes on, feel free to move.<br /><br />I recently ordered Pokemon Green since it was cheap and I heard it was the most broken game.<br /><br />Is it true? Is it worth it?<br />[/quote]<br /><br />This is the right board. :)<br /><br />Yes, PokÃ©mon Red/Green are among the most glitchy games. They introduced the select glitch, of which there are two types; item pack Select glitches and special menu Select glitches.<br /><br />In the item pack Select glitches you press Select on an item in the items menu (or PC items), exit with B, B; enter battle and then either open the PokÃ©mon menu or moves menu. From there you can swap invalid options (for example; if we pressed Select on item 7 and swapped the option on the PokÃ©mon menu, you would be swapping PokÃ©mon 7). Swapping invalid options has the ability to cause glitchy effects.<br /><br />In PokÃ©mon Green v1.0; you are able to perform a Select glitch directly from within a battle by pressing Select on an item in the items menu in the battle and exiting with B. The later v1.1/&quot;Rev A&quot; edition, as well as Japanese Blue patched this so that you have to use the items menu from outside of battle first.<br /><br />In the special menu Select glitches; you are able to swap the entries within a lift, or the badge describer&#039;s list of badges. I&#039;m unsure of the mechanics behind how these work; however it is possible to corrupt data including your PokÃ©mon, name and items. But if I recall correctly, even if you perform the same actions you may not be able to receive the corruption for unknown reasons.<br /><br />[youtube]https://www.youtube.com/watch?v=fMf7_85ifc8[/youtube]<br /><br />Other glitches that cannot be found in the English versions of PokÃ©mon Red/Blue/Yellow include:<br /><br />1) [url=http://forums.glitchcity.info/index.php/topic,7522.0.html]Swift effect glitch[/url]; RGBY JP - Recently documented by IceFlame; Swift may miss due to a bug. The 100%/high accuracy effect exists, but only for PokÃ©mon under a Substitute.<br />2) [url=https://www.youtube.com/watch?v=EF3RlidjDJk]Saffron Gym glitch[/url]; RG - When you lose against Sabrina in Saffron Gym, you will receive post battle text when you return and will obtain the badge without having to defeat her.<br />3) [url=https://www.youtube.com/watch?v=rbJCEt6HKhM]Empty PokÃ©mon menu[/url]; RGB - Using the Potion in your PC at the beginning of the game, you can open the PokÃ©mon menu without any PokÃ©mon. This brings up a menu with nothing on the &quot;ã©ã®ãƒã‚±ãƒ¢ãƒ³ã«ã€€ã¤ã‹ã„ã¾ã™ã‹ï¼Ÿ&quot; screen except the text box and a black cursor pointing to nothing.<br />4) [url=https://www.youtube.com/watch?v=OS-v0tGk90g]Prevented progress glitch[/url]; RGB and Yellow (localizations (via SRAM glitch) and possibly the original Japanese Yellow games) - A glitch in which obtaining two PokÃ©mon in the PokÃ©dex before delivering Oak&#039;s Parcel makes talking to Professor Oak rate your PokÃ©dex and prevent you from delivering the parcel.<br />5) [url=https://www.youtube.com/watch?v=THTEoXhPFRk]Broken hidden items glitch[/url]; RG - Certain hidden items have the wrong Itemfinder coordinates or cannot be found with the Itemfinder. The bit marking an obtained mismatching hidden item is hidden item bit 255; which is bit 7 of $D68E (altered when handing over a fossil); hence the action of handing over a fossil can restore a hidden item. Hidden items that can be obtained more than once with this method include Nuggets, Rare Candies, a Calcium and an Ultra Ball.<br />6) [url=https://www.youtube.com/watch?v=x-ukmMmRZ7c]Surf from a cliff glitch[/url]; RG - You can Surf directly from the &#039;north edge&#039; tile of raised ground/cliff and skip the boulder puzzle in Seafoam Islands.<br />7) Seafoam Islands text box glitches ([url=https://www.youtube.com/watch?v=Zk-H6-jVY90]1[/url], [url=https://www.youtube.com/watch?v=7Jzrt0d--EU]2[/url]); RGB - There are two hidden text boxes in Seafoam Islands that have effects including slowing down menus+resetting the game (Red/Green) and freezing the game/bringing up a text box with &quot;...&quot; (Japanese Blue).<br />8) [url=https://www.youtube.com/watch?v=FnCTzpgozTU]Old man demonstration glitch[/url]; RGB - A glitch where if you have a full box of PokÃ©mon; you can&#039;t have the old man catch a PokÃ©mon (the game will become stuck on an infinite loop where the PokÃ© Ball is selected) because the game will say the box is full. However, somebody commented that the &#039;old man not catching still exists&#039;&nbsp; (they mentioned PokÃ©mon Yellow) so this makes me wonder if it actually works too on a Yellow/non-Japanese glitch.<br />9) [url=https://www.youtube.com/watch?v=_dJlvgPRkvA]Magikarp salesman glitch[/url]; RGB - A glitch where if you try to buy the Magikarp from the salesman in Route 3 PokÃ©mon Center with a full party and a full box, you will not get the Magikarp but 500 PokÃ©dollars will still be taken off you (so it is like the Magikarp salesman steals money from you).<br /><br />Various glitch items, things, PokÃ©mon are also different to those in the English versions. For example; Gold Badge (hex:6A) can bring up a PokÃ© Mart in Red/Green, like the Yami Shop/Strange Mart glitch (a glitch where if you try to sell a &#039;long name glitch item&#039; with stored screen data with a $50 byte you may corrupt a PokÃ© Mart). There is a glitch PokÃ©mon in Japanese Blue which is actually number 152 (	ã‚¢ãƒŽ ï¾ž; hex CC) and can be registered as a selectable PokÃ©mon in the PokÃ©dex as such.<br /><br />Additionally, some Super Glitch moves have a battle end effect (for unknown reasons) if you bring up the move, exit and use an item to make a turn (like what you would do to escape a ZZAZZ glitch battle). I do not know why this is and if it happens in any English/non-Japanese versions.<br /><br />Hope this helps for experimenting!


subject: Re: Invalid sound banks examination
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  I know this is double-posting, but I felt it was justified.<br /><br />TheZZAZZGlitch found that invalid sound banks jumped to 0x6BD4.<br />After struggling a bit with the Red ROM, I found that invalid sound banks jump at 0x58EA.<br />That jump occurs at 0x2408 in the ROM (the bytes there are CD EA 58), and the code doesn&#039;t check for the correct bank either. So, I ran the same bot as previously, only I edited the offset.<br /><br />[table]<br />[tr]<br />[td][b]Bank #[/b][/td][td][b]Effect[/b][/td]<br />[/tr]<br />[tr]<br />[td]00/01[/td][td]Jumps in the middle of some code. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]03[/td][td]Crashes (rst 08h).[/td]<br />[/tr]<br />[tr]<br />[td]04[/td][td]Crashes (STOP).[/td]<br />[/tr]<br />[tr]<br />[td]05[/td][td]Crashes (invalid opcode FC).[/td]<br />[/tr]<br />[tr]<br />[td]06[/td][td]Jumps in the middle of some code. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]07[/td][td]Loads hl into sp, then jumps to 3C49. This has few chances of going well, but should be investigated anyways.[/td]<br />[/tr]<br />[tr]<br />[td]09[/td][td]Writes C to (hl), loads h into d, XOR d, then calls (nc) 187C. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]0A[/td][td]Tries to decrement $1CXX (XX being the ID of the sound), the does stuff. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]0B[/td][td]Crashes (invalid opcode FC)[/td]<br />[/tr]<br />[tr]<br />[td]0C[/td][td]Crashes (invalid opcode ED)[/td]<br />[/tr]<br />[tr]<br />[td]0D[/td][td]Does stuff, should be investigated.[/td]<br />[/tr]<br />[tr]<br />[td]0E[/td][td]Crashes (STOP).[/td]<br />[/tr]<br />[tr]<br />[td]0F[/td][td]Calls 3C49. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]10[/td][td]Calls 10:5807. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]11[/td][td]To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]12[/td][td]Calls 103E. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]13[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]14[/td][td]Seems to jump in the audio caller. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]15[/td][td]Loads $24D6 into hl, then returns.[/td]<br />[/tr]<br />[tr]<br />[td]16[/td][td]Crashes (invalid opcode ED).[/td]<br />[/tr]<br />[tr]<br />[td]17[/td][td]Messes with the registers, then calls 31CC. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]18[/td][td]Crashes (rst 10h).[/td]<br />[/tr]<br />[tr]<br />[td]19 and 1A[/td][td]Crash (rst 38h).[/td]<br />[/tr]<br />[tr]<br />[td]1B[/td][td]Crashes (invalid opcode FC).[/td]<br />[/tr]<br />[tr]<br />[td]1C[/td][td]Calls 3E6D. To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]1D[/td][td]To investigate.[/td]<br />[/tr]<br />[tr]<br />[td]1E[/td][td]Crashes (STOP).[/td]<br />[/tr]<br />[tr]<br />[td]20 to 22[/td][td]Crash (rst 20h).[/td]<br />[/tr]<br />[tr]<br />[td]23[/td][td]Crashes (invalid opcode E4).[/td]<br />[/tr]<br />[tr]<br />[td]24 to 27[/td][td]Crash (rst 20h).[/td]<br />[/tr]<br />[tr]<br />[td]28[/td][td]Crashes (invalid opcode F4).[/td]<br />[/tr]<br />[tr]<br />[td]29[/td][td]Crashes (rst 20h).[/td]<br />[/tr]<br />[tr]<br />[td]2A[/td][td]NOP slides into VRAM. High chances of crashing.[/td]<br />[/tr]<br />[tr]<br />[td]2B[/td][td]Crashes (rst 30h).[/td]<br />[/tr]<br />[tr]<br />[td]2C to 3F[/td][td]NOP slides into VRAM. High chances of crashing.[/td]<br />[/tr]<br />[tr]<br />[td]40 to 7F[/td][td]Crashes (rst 38h).[/td]<br />[/tr]<br />[/table]<br /><br />Here are the non-crashing / NOP sliding banks in Red (unconfirmed for Blue, though) :<br />00/01, 06, 07, 09, 0A, 0D, 0F, 10, 11, 12, 14, 17, and 1C.<br />All of these should also be investigated for their effects, but there possibly is a chance that we will find ACE. Maybe.


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I notice that your profile picture is a Lugia. Did you add it to a generation 1 game through a glitch? I went through the RAM map but I could not find any byte I can manipulate to add a new Pokemon to the Pokedex.


subject: Re: Was it worth me getting PKMN Green for its broken-ness? How broken is it really?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Green cannot do Yellow-exclusive glitches, but, aside from localizations errors (such as the Evolving Raichu), there are no glitches exclusive to non-RG games


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That was my guess. The Pokemon data must be stored in ROM and cannot be modified. But then again, nothing is impossible. I wonder if anyone has found anything to manipulate ROM...


subject: (Extremely) minor update on arbitrary code execution
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I tried adding a second type to a Pokemon with only one type and the screen went completely dark. My game was not erased. After rebooting, everything seemed to return to normal.<br /><br />GS code: 01089CDA<br /><br />Item list:<br />Great Ball x1<br />8F<br />Lemonade x08 (08)<br />X Accuracy x156 (9C)<br />Carbos x218 (DA)<br />PokÃ© Ball x119<br />Fresh Water x201<br /><br />Does anyone know if it&#039;s possible to add a second type to a Pokemon?


subject: Re: (Extremely) minor update on arbitrary code execution
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Update: You can add a 2nd type, though it won&#039;t show in the description, it will be in effect. I tried it out with Ghost type.


subject: Re: (Extremely) minor update on arbitrary code execution
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That was already known (a single-type PokÃ©mon is a double-type PokÃ©mon with the same type twice, and the new type is never shown in the profile). But it&#039;s nice to see you experimenting things&nbsp; :P


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s not a &#039;montage&#039; actually. I implanted Lugia&#039;s sprite in my 1G game using VBA&#039;s memory editor :)


subject: Re: Making sense of the arbitrary code execution glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nah, I just created a dmp file with the RAM values from $8FF0 onwards (current sprite of a stat page) on a 2G game and loaded it into a 1G game. It was just to take a nice screenshot :p 


subject: (Unlikely) New Find in Save abuse/corruption glitch
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah.. maybe everyone knows it already.<br />I was having fun with pokemon yellow&#039;s save abuse (well. not that fun) https://www.youtube.com/watch?v=kFJFWlnsJWo<br />Then.. I accidentally clicked upward, and to find there&#039;s also pokemon UPWARDS! <br />wtf<br />Full video here: https://www.youtube.com/watch?v=rlRH_UNlEJA<br />The things that surprised me most, is the missingno. ,&nbsp; 4 4 , and the later messy sound.<br />More here: https://www.youtube.com/watch?v=6r1V6VNRd8I<br />But don&#039;t watch if you don&#039;t wanna hurt your ears...<br /><br />I.. seriously don&#039;t know what&#039;s happening


subject: Re: (Unlikely) New Find in Save abuse/corruption glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You know, when you tap up in your PokÃ©mon screen, it places your cursor at the last PokÃ©mon in your party. Because this glitch essentially gives you 255 PokÃ©mon, welp, tapping up once is the same as tapping down 255 times :)


subject: Re: Invalid sound banks examination
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7548.msg200880#msg200880 date=1468852198]<br />[table][tr][td]2F[/td][td][s]Sexually harasses[/s] a memory address (writes the same value to it 200+ times in a row), writes loads of stuff to some I/O ports, then calls 3082. Should be investigated.<br />[/quote] ok[/td][/tr][/table]


subject: Re: (Unlikely) New Find in Save abuse/corruption glitch
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheUnReturned
icon: xx
body:
  [quote author=ISSOtm link=topic=7551.msg200904#msg200904 date=1468928998]<br />You know, when you tap up in your PokÃ©mon screen, it places your cursor at the last PokÃ©mon in your party. Because this glitch essentially gives you 255 PokÃ©mon, welp, tapping up once is the same as tapping down 255 times :)<br />[/quote] https://youtu.be/vDpB_qLRblA proved it myself :)<br />And, there however something special:<br />A pokemon that can actually be used: L1 Q (at 2:48)<br />Which is around 2 more down taps after the crashing pkmn<br />But why<br />is there 4(A) 4 and missingno here?<br />I don&#039;t understand<br />Maybe I can create a list of pkmn in the pkmn menu<br />But why would it be important<br />even if I do it, I&#039;ll prob die from the cancer sounds ._.<br />


subject: Re: Was it worth me getting PKMN Green for its broken-ness? How broken is it really?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  There is another Japanese version &#039;natural glitch&#039; I forgot to mention:<br /><br />Card Key exploits (RGB JP) - Where you turn at the same time as opening a Card Key door. This allows you to change other blocks than the door&#039;s block/&#039;destroy things&#039; on the map.<br /><br />[youtube]https://www.youtube.com/watch?v=UPdAKHN0RIQ[/youtube]<br /><br />[quote author=ISSOtm link=topic=7549.msg200893#msg200893 date=1468890279]<br />Green cannot do Yellow-exclusive glitches, but, aside from localizations errors (such as the Evolving Raichu), there are no glitches exclusive to non-RG games<br />[/quote]<br /><br />Not sure if this counts but don&#039;t forget the coast glitch (used for old man trick) cannot be performed in Japanese versions, nor can the [url=https://www.youtube.com/watch?v=2jI9LeehZ8E]grass surfing encounter glitch[/url] from Spanish and Italian versions (unless you somehow ported the glitch). However there probably aren&#039;t many glitches exclusive to non Japanese versions that don&#039;t require another glitch. Of the ones that do require another glitch, these may include [url=https://www.youtube.com/watch?v=Wz8MH9cfusQ]infinite encounter chain Trainer-escape glitch[/url] (depending on whether the items for it exist in Japanese versions) and perhaps Pikachu off-screen glitch arbitrary code execution (however; if there are any accessible glitch signs for it in the Japanese versions that execute code from memory it may exist there).


subject: Re: Invalid sound banks examination
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s unfinished, though, as my bot was tood dumb to properly analyze code.<br />If you look at its source, you will notice it always follows conditional branches, even when they cannot be met.<br />Example, taken from the Red file :<br />[code]<br />ROM09:58EC		xor d		AA<br />ROM09:58ED		call nc, $187C		D4 7C 18<br />Jumping to 187C.<br />ROM09:187C		add a, $CD		C6 CD<br />[/code]<br />This call always occurs (due to the xor resetting the c flag)<br />[code]<br />ROM09:187E		xor a		AF<br />ROM09:187F		jr nz, 79		20 79<br />Jumping to FA.<br />ROM09:18FA		xor a		AF<br />[/code]<br />Because xor a always sets the z flag, this jump never occurs. The bot followed it, though.<br /><br />Also, I forgot to mention Red&#039;s file : http://pastebin.com/n0Yn0PtX


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Great research IceFlame! I&#039;ve finished testing this on my physical Japanese PokÃ©mon Yellow cartridge and made a video of the results.<br /><br />[youtube]https://www.youtube.com/watch?v=C6Hkos4vdsU[/youtube]<br /><br />[quote author=IceFlame link=topic=7522.msg200677#msg200677 date=1467390129]<br />User 80C doesn&#039;t actually say it was an English cartridge, though on an English forum, I&#039;d think that was the case unless otherwise specified.<br />[/quote]<br /><br />I think 80C possibly likes to play the Japanese games, as they found an Articuno binoculars glitch on Japanese Green and shared it with me, although I don&#039;t know if they were playing a Japanese game at the time.<br /><br />[quote author=IceFlame link=topic=7522.msg200677#msg200677 date=1467390129]<br />(Blizzard effect information)<br />[/quote]<br /><br />That&#039;s right. I was also the person who added the information about Blizzard on to TCRF, but I haven&#039;t looked around the code in a disassembler to confirm it.<br /><br />[quote author=IceFlame link=topic=7522.msg200677#msg200677 date=1467390129]<br />Also, we were talking about in-game move descriptions earlier. According to Bulbapedia, the Stadium description for Mega Punch says it&#039;s &quot;highly accurate&quot;. This doesn&#039;t really inspire confidence in the descriptions (unless Mega Punch actually does have a different accuracy in Stadium?)<br />http://bulbapedia.bulbagarden.net/wiki/Mega_Punch<br />[/quote]<br /><br />That seems unusual given the accuracy is 85% in the core games. I tried it in Stadium and the move missed the second time, although I don&#039;t know if the accuracy was changed. IIMarckus may be able to help because he has done work on analyzing PokÃ©mon Stadium.<br /><br />For reference, according to [url=http://www.gamefaqs.com/n64/198312-pokemon-stadium/faqs/7216]this guide[/url], there are other descriptions for moves that claim them to be highly accurate. These had 255/256 accuracy in the core games and include:<br /><br />Dizzy Punch<br />[quote]A Normal-type attack. The punch is relatively strong and highly accurate.[/quote]<br /><br />Night Shade<br />[quote]A Ghost-type attack.<br />Highly accurate, it inflicts damage regardless of the target&#039;s type.[/quote]<br /><br />Spike Cannon<br />[quote]A physical attack consisting of two to five consecutive hits.<br />Highly accurate.[/quote]<br /><br />Surf<br />[quote]A Water-type attack. The power of this technique is strong and highly accurate.[/quote]


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: froggy25
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: froggy25
icon: xx
body:
  [quote author=Torchickens link=topic=7522.msg200913#msg200913 date=1468945554]That seems unusual given the accuracy is 85% in the core games. I tried it in Stadium and the move missed the second time, although I don&#039;t know if the accuracy was changed. IIMarckus may be able to help because he has done work on analyzing PokÃ©mon Stadium.[/quote]<br />[url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Stadium:ROM_map#Moves_data]The moves accuracy were not changed[/url], aside from the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Stadium:ROM_map#Move_Accuracy_check]1/256 fix[/url] which made nearly every move slightly more accurate than on cartridge as a side effect of the fix.<br /><br />Swift effect skips every Accuracy check in international PokÃ©mon Stadium.<br /><br />[quote author=IceFlame link=topic=7522.msg200651#msg200651 date=1467131523]I know that VBA is not the most accurate.[/quote]<br />Yup, it has a lot of issues (most of these are explained on the GB test ROMs page on gbdev), it&#039;s best to not use that emulator.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the information froggy25! Do you know if there are any differences battle mechanics-wise between the original Japanese PokÃ©mon Stadium and/or Pocket Monsters Stadium 2 and the international release?


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: froggy25
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I haven&#039;t worked at all on the Japanese PokÃ©mon Stadium yet, I&#039;ll have to take a look at this once I finally submit an initial commit to pokestadium on github ::)


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=froggy25 link=topic=7522.msg200916#msg200916 date=1468953398]<br />I haven&#039;t worked at all on the Japanese PokÃ©mon Stadium yet, I&#039;ll have to take a look at this once I finally submit an initial commit to pokestadium on github ::)<br />[/quote]<br /><br />All right, thanks. :) Sorry if I sounded rude asking in any way.


subject: Re: Invalid sound banks examination
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Lots of NOP sleds, huh? Reminds me of when I made the memcpy function (between-pointer copy) slide into the beginning of the ROM... you&#039;d load a savestate, do, well, anything besides moving within the area, and the ROM would suddenly restart... and restart when the copyright screen tries to disappear (so infinitely) as execution jumped back to $B4, and hit my 37-byte NOP sled, sliding to boot code. And then call memcpy for the battle cutscene, jumping back to $B4, the sled. :P


subject: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: xoftware.org
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey all! <br /><br />I recently just found GDQ on YouTube, and I felt inspired to pull out the gameboy (er, emulator) again and boot it up! Is there common knowledge or a guide on how to walk through walls to the entrance of Indigo Plateau/Victory Road? I&#039;m asking because I know how to find it consistently, in case people didn&#039;t know it was possible. (I know some people have had trouble with it without all 8 of the badges.)<br /><br />[b]As far as I can tell, you don&#039;t need any particular badges to do so.[/b] (I&#039;m already recording a run that includes this, so I&#039;d love to help out and post a video or wiki.)<br /><br />Thanks! Keep up the great work!


subject: Re: Invalid sound banks examination
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Here, I believe it&#039;s just that developers that padded ROM banks with zeroes.<br /><br />For both Yellow and Red, there is a final, large group of banks that all crash with rst 38h. For these, I believe that the developers filled unused ROM banks with FFs. Just like they did for the rst vectors. Boy, what a pack of dummies... even I fitted a FillMemory function in there, so... meh. Game Freak + 1st Gen = (crappy code)^n, with n steadily increasing over time.


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  For the Walk though Walls glitch itself, the [http://glithchcity.info/wiki/Walk_through_walls wiki page] is plentiful on methods. As for the particular Indigo Plateau thing, I&#039;m going to quote [http://tasvideos.org/4416S.html the currently published TAS commentary].<br />[quote author=MrWint]<br />Route 23<br /><br />&nbsp; &nbsp; All overworld maps (cities and routes) are connected at their edges, so you can traverse the world without loading zones. The connection between Route 22 and Route 23 is special though, since it is the only one that can&#039;t be used legitimately (you need to go through the gate house), even though it works and is defined in a perfectly valid way. This allowed the current publication to skip two of the badge checks, and allows this run to skip all eight badges. The tileset used in the two routes is different, which not only creates visual glitches when crossing maps, it also confuses the game about where to place the player in the map, putting it at the coordinates of the warp with the ID of the last used warp. By entering and exiting the house in Pewter city, this ID is set to 4, which allows us to skip all guards checking for badges.<br />[/quote]<br />I can&#039;t tell much more :P. Also, I&#039;ve not verified this, and am too lazy to switch OSes to do so. If it doesn&#039;t work, come back complaining here, and we&#039;ll deal with it.


subject: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: cheesy
body:
  This is pretty much a needed features list for the DS family. :P<br />If you would like to see native multi-ROM emulators with stock SD loading support on your DS Lite, you could say that.<br />(BTW, DS/DSi flashcarts can do that specific example with ease.)


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  <br /><br />void rendreMenu(Menu* menu) {<br />	SDL_Rect rectDest = TILE(menu-&gt;positionHoriz, menu-&gt;positionVert);<br />	SDL_Rect rectSource = RECT_TILE;<br />	unsigned int compteur = 0;<br />	<br />	ciblerTile(COIN_HAUT_GAUCHE, &amp;rectSource);<br />	SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	<br />	ciblerTile(BORD_HAUT, &amp;rectSource);<br />	while(compteur &lt; menu-&gt;tailleHoriz) {<br />		rectDest.x += LARGEUR_TILE;<br />		compteur++;<br />		SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	}<br />	<br />	rectDest.x += LARGEUR_TILE;<br />	ciblerTile(COIN_HAUT_DROITE, &amp;rectSource);<br />	SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	<br />	for(compteur = 0; compteur &lt; menu-&gt;tailleVert; compteur++) {<br />		rectDest.y += HAUTEUR_TILE;<br />		<br />		rectDest.x = menu-&gt;positionHoriz;<br />		ciblerTile(BORD_GAUCHE, &amp;rectSource);<br />		SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />		<br />		ciblerTile(BORD_DROIT, &amp;rectSource);<br />		rectDest.x += (menu-&gt;tailleHoriz + 1) * LARGEUR_TILE;<br />		SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	}<br />	<br />	rectDest.x = menu-&gt;positionHoriz;<br />	rectDest.y += HAUTEUR_TILE;<br />	ciblerTile(COIN_BAS_GAUCHE, &amp;rectSource);<br />	SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	<br />	ciblerTile(BORD_BAS, &amp;rectSource);<br />	for(compteur = 0; compteur &lt; menu-&gt;tailleHoriz; compteur++) {<br />		rectDest.x += LARGEUR_TILE;<br />		SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	}<br />	<br />	rectDest.x += LARGEUR_TILE;<br />	ciblerTile(COIN_BAS_DROITE, &amp;rectSource);<br />	SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	<br />	ciblerTile(BLANC, &amp;rectSource);<br />	rectDest.x = menu-&gt;positionHoriz + LARGEUR_TILE;<br />	rectDest.y = menu-&gt;positionVert&nbsp; + HAUTEUR_TILE;<br />	rectDest.h = menu-&gt;tailleVert&nbsp; &nbsp; * HAUTEUR_TILE;<br />	rectDest.w = menu-&gt;tailleHoriz&nbsp;  * LARGEUR_TILE;<br />	SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />	<br />	// On va maintenant afficher son texte.<br />	rectDest.h = HAUTEUR_TILE;<br />	rectDest.w = LARGEUR_TILE;<br />	for(compteur = 0; menu-&gt;texte[compteur] != &#039;\0&#039;; ) {<br />		ciblerTile(menu-&gt;texte[compteur], &amp;rectSource);<br />		SDL_RenderCopy(pRendu, imgTiles.texture, &amp;rectSource, &amp;rectDest);<br />		if(++compteur % menu-&gt;tailleHoriz == 0) {<br />			rectDest.y += HAUTEUR_TILE;<br />			rectDest.x = menu-&gt;positionHoriz;<br />		}<br />		rectDest.x += LARGEUR_TILE;<br />	}<br />}<br /><br /><br /><br />Pretty sweet code goin&#039; on. Variable names are in French, though.


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I wish my N3DS could allow instant travel. That&#039;d resolve half of my problems right now. And I got a metric shit ton of them.


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7555.msg200927#msg200927 date=1468978333]<br />I wish my N3DS could allow instant travel. That&#039;d resolve half of my problems right now. And I got a metric s**t ton of them.<br />[/quote]<br />...AAAAAND it&#039;s gone. You completely missed the point. Software-based wants. So, say... better emulation, native save data extraction, NDS ROM support (as long as the ROM was purchased from Nintendo, obviously), 3D support for NDS/NDSi games, etc.


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: xoftware.org
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks! Yeah, that one is using the same technique, except he [MrWint] goes a much more difficult [confusing] route. <br /><br />In terms of wiki documentation, walking through walls to the Indigo Plateau/Victory Road is unique. It can be confusing, in the sense that you can&#039;t see where you&#039;re going. You have to navigate somewhat to completely blindly through a garbled part of the map. If you step on the wrong tile in the endless nomansland, it crashes the game, but on top of that, the way it&#039;s garbled is not always the same, but depends on other factors. Also, according to that link, getting through without particular badges depends on an additional step before the walk through walls glitch. <br /><br />I&#039;d be happy to help out with this exceptional use case, so people who use these guides can understand <br /> 1. that it is possible<br /> 2. plainly, how to do it, which isn&#039;t difficult.<br /><br />By the way, what OS/Emu are you using? I&#039;m just running a minimal Linux/VBAM (command-line.) I love it!


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Couldn&#039;t you just use step-counting a la Tweaking to weave around the triggers and find the Indigo Plateau/Victory Road entrances that way? It&#039;s not like the map bounds change because of an invalid/wrong tileset...<br /><br />...do they? 


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Can we just say &quot;Swift is broken&quot; and move on? This is ridiculous. 17 replies to a thread about a broken Gen 1 move? That&#039;s [b]a lot[/b]of chatter about an unsurprising development. Seriously. I&#039;d expect this for, say, a newly-discovered glitch, but about something we knew about since this place began? MAYBE 6 replies [b]MAXIMUM[/b].


subject: Re: Project GStart
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Generating ROMs for all the indexes currently unobtainable. Anyone wanna see Shorts Kid&#039;s index be all fucked up? I&#039;m gonna burn someone&#039;s fucking house down if his ID doesn&#039;t do something odd...


subject: Re: Invalid sound banks examination
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  [quote author=ISSOtm link=topic=7548.msg200922#msg200922 date=1468975488]<br />Here, I believe it&#039;s just that developers that padded ROM banks with zeroes.<br /><br />For both Yellow and Red, there is a final, large group of banks that all crash with rst 38h. For these, I believe that the developers filled unused ROM banks with FFs. Just like they did for the rst vectors. Boy, what a pack of dummies... even I fitted a FillMemory function in there, so... meh. Game Freak + 1st Gen = (crappy code)^n, with n steadily increasing over time.<br />[/quote]<br /><br />Banks 40-7F aren&#039;t filled with anything, because they don&#039;t exist on the RBY carts. The carts are all 1MB, meaning they only have banks up to 3F. If the MBC&#039;s told to read from a bank that doesn&#039;t exist, it just pulls all 1&#039;s. This isn&#039;t unique to Pokemon, all Gameboy games with a ROM smaller than 2MB do this.<br /><br />Hell, give this a shot on the original Japanese Red/Green carts with banks 20 and up. The same thing will happen, because they&#039;re 512kB carts.<br /><br />The NOP sleds aren&#039;t surprising for the banks above 20 since they generally contain international (non-Japanese) script data and don&#039;t have code.


subject: Re: Invalid sound banks examination
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  My father asked me why I like watching games go down in a hellish firestorm of [s] fuck injection [/s] corruptions so I exposed him to the harmonious noises of textbox $FE on Route &lt;whatever the hell the route Nugget Bridge is on&gt;. Through his car. At 6 AM. On Volume 99. With my amp as a middleman.


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: xoftware.org
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: xoftware.org
icon: xx
body:
  That&#039;s a good question. As far as I can tell, the tileset doesn&#039;t impact the bounds. These bounds, though, can be a little unintuitive and weird, it seems, especially if you&#039;ve never entered to see where the guards stand without any badges.<br /><br />I don&#039;t know if the map is actually straightforward. It seemed like the actual location with the guards was offset to the left of the building, instead of directly behind it. <br /><br />Anyway, how about this. I&#039;ll upload the video to YouTube and post it back here with some basic instructions. Then if I or somebody wants to document it officially in the wiki, somebody can. You all here do a very good job of it.<br /><br />Edit: <br /><br />Oh, and I am not much of an expert on it beyond what I&#039;ve said so far. I just discovered it on my own, and tested it again on a new game.


subject: Re: Invalid sound banks examination
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aldrasio link=topic=7548.msg200936#msg200936 date=1468985005]<br />[quote author=ISSOtm link=topic=7548.msg200922#msg200922 date=1468975488]<br />Here, I believe it&#039;s just that developers that padded ROM banks with zeroes.<br /><br />For both Yellow and Red, there is a final, large group of banks that all crash with rst 38h. For these, I believe that the developers filled unused ROM banks with FFs. Just like they did for the rst vectors. Boy, what a pack of dummies... even I fitted a FillMemory function in there, so... meh. Game Freak + 1st Gen = (crappy code)^n, with n steadily increasing over time.<br />[/quote]<br /><br />Banks 40-7F aren&#039;t filled with anything, because they don&#039;t exist on the RBY carts. The carts are all 1MB, meaning they only have banks up to 3F. If the MBC&#039;s told to read from a bank that doesn&#039;t exist, it just pulls all 1&#039;s. This isn&#039;t unique to Pokemon, all Gameboy games with a ROM smaller than 2MB do this.<br /><br />Hell, give this a shot on the original Japanese Red/Green carts with banks 20 and up. The same thing will happen, because they&#039;re 512kB carts.<br /><br />The NOP sleds aren&#039;t surprising for the banks above 20 since they generally contain international (non-Japanese) script data and don&#039;t have code.<br />[/quote]<br /><br />On several emulators I observed a different behavior; the bank number has its two most significant bits truncated, so switching to bank 0x41 actually loads bank 0x01. I have no idea how the real console should behave. Also, if the virtual console emulator and real console behave differently, we could get some exclusive behavior.<br /><br />If someone has an 8F setup on real hardware/VC, we can try to find out with this item list.<br /><br />[tt]8F<br />(Any)<br />Lemonade&nbsp; &nbsp;  x65<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; x32<br />X Speed&nbsp; &nbsp; &nbsp; x79<br />Ultra Ball&nbsp;  x198<br />Fire Stone&nbsp;  x71<br />Moon Stone&nbsp;  x35<br />Water Stone&nbsp; x201[/tt]<br /><br />[code]ld a,41<br />ld e,20<br />ld b,e<br />ld c,a<br />ld (bc),a<br />add 20<br />ld b,a<br />ld a,(bc)<br />inc hl<br />ldi (hl),a<br />ret[/code]<br /><br />If after executing this code the second item&#039;s quantity changes to 124 - target console/emulator takes bank numbers modulo 0x40.<br />If the second item&#039;s quantity changes to 255 - target console/emulator grabs blank data from nonexistent banks.


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So this isn&#039;t really a forum game, then, but just a discussion on a particular family of consoles.<br /><br />Also I wish my 3DS gave me the ability to kill myself.


subject: MOVED: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=http://forums.glitchcity.info/index.php?board=14.0]Video Games/Glitches Discussion[/url], as it is not a game but theorycrafting about features that the DS/DSi/3DS could have.<br /><br />[iurl]http://forums.glitchcity.info/index.php?topic=7555.0[/iurl]


subject: MOVED: Project GStart
poster_name: Photon-Phoenix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: moved
body:
  This topic has been moved to [url=http://forums.glitchcity.info/index.php?board=76.0]Emulation &amp; ROM Hacking[/url].<br /><br />[iurl]http://forums.glitchcity.info/index.php?topic=7543.0[/iurl]


subject: Verifying console/emulator behavior with 8F
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheZZAZZGlitch
icon: xx
body:
  I planned to do this for a long time. In Gen I, we have a lot of glitches that exploit certain obscure details of the GB hardware or rely on undefined behavior, yet it still isn&#039;t exactly clear what behavior is exhibited by certain emulators and the real console. Thankfully, we have an easy way to execute any code we want with 8F. It&#039;s a good opportunity to test if everything works exactly as we think it works. I welcome everyone with working 8F setups on VC/console/mobile emulators/other devices to run the following 8F scripts and see if we have 100% accuracy for our glitching purposes.<br /><br />If my request gets some interest, this table will be filled with data regarding the most important systems.<br />Also let me know if someone thinks of another relevant test to add.<br /><br />[b]Last updated 2016-07-22[/b]<br /><br />[table]<br />[tr]<br />[td][b]Platform[/b][/td][td][b]UnknownOpcodes[/b][/td][td][b]InvalidBanks[/b][/td][td][b]VRAMAccess[/b][/td][td][b]EchoRAM[/b][/td][td][b]InvalidStop[/b][/td]<br />[/tr]<br /><br />[tr][td][b]Game Boy Color (CGB-001)[sup] [/sup][/b][/td]<br />[td]PASS[sup]4[/sup][/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td][/tr]<br />[tr][td][b]Game Boy Advance SP (AGS-001)[sup] [/sup][/b][/td]<br />[td]PASS[sup]4[/sup][/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td][/tr]<br />[tr][td][b]Game Boy Player[sup] [/sup][/b][/td]<br />[td]PASS[sup]4[/sup][/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td][/tr]<br /><br />[tr][td][b]3DS Virtual Console[sup] [/sup][/b][/td]<br />[td]FAIL[sup]5[/sup][/td]<br />[td]FAIL[sup]6[/sup][/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]FAIL[/td][/tr]<br /><br />[tr][td][b]Stadium 2 GB Tower[sup] [/sup][/b][/td]<br />[td]PASS[sup]7[/sup][/td]<br />[td]PASS[/td]<br />[td]FAIL[sup]8[/sup][/td]<br />[td]FAIL[sup]9[/sup][/td]<br />[td]FAIL[/td][/tr]<br /><br />[tr][td][b]bgb 1.4.1[sup] [/sup][/b][/td]<br />[td]PASS[sup]1[/sup][/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td][/tr]<br />[tr][td][b]VBA-RR v24 svn440[sup] [/sup][/b][/td][td]PASS[sup]2[/sup][/td][td]PASS[/td][td]PASS[/td][td]PASS[/td][td]FAIL[/td][/tr]<br />[tr][td][b]VBA 1.7.2[sup] [/sup][/b][/td][td]PASS[sup]2[/sup][/td][td]FAIL[sup]3[/sup][/td][td]FAIL[/td][td]FAIL[/td][td]FAIL[/td][/tr]<br /><br />[tr][td][b]MyOldBoy v1.1.0[sup] [/sup][/b][/td]<br />[td]FAIL[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]FAIL[/td][/tr]<br /><br />[tr][td][b]LameboyDS v0.12[sup] [/sup][/b][/td]<br />[td]FAIL[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[/td]<br />[td]PASS[sup]10[/sup][/td][/tr]<br /><br />[/table]<br /><br />[sup]1[/sup] - the emulator breaks into a debugger every time an undefined opcode is encountered<br />[sup]2[/sup] - brings up the infamous message &quot;unknown opcode xx at yyyy&quot;<br />[sup]3[/sup] - the result is 127 instead of 124 - this behavior needs to be more thoroughly investigated<br />[sup]4[/sup] - the game hangs without any message<br />[sup]5[/sup] - unknown opcodes are ignored, most likely because of the emulator hooking them to communicate with the hardware<br />[sup]6[/sup] - (probably) always returns 0<br />[sup]7[/sup] - displays a message: &quot;The saved data has been corrupted, so it is impossible to CONTINUE. Please reset the game and choose NEW GAME&quot;, the save is not corrupted though<br />[sup]8[/sup] - (probably) always returns 255 - so VRAM access is enabled not during the [i]V-Blank period[/i], but during the [i]V-Blank interrupt[/i], which changes things dramatically<br />[sup]9[/sup] - some other data seems to be stored in the echo RAM area<br />[sup]10[/sup] - some corrupted stops work, some not - this is to be expected with undefined behavior<br /><br />The tests themselves:<br /><br />[b]UnknownOpcodes[/b]<br /><br />Self-explanatory. This is intended to test whether the target system ignores invalid opcodes, or crashes/halts when they are executed. This behavior could potentially affect any glitches that execute data as code (invalid sound banks, invalid item/move effect pointers).<br /><br />[tt]8F<br />(Any)<br />TM27&nbsp; &nbsp; &nbsp; &nbsp;  x201[/tt]<br /><br />[code]opcode_e3<br />ret[/code]<br /><br />If the game continues running after executing the script - FAIL<br />If the system brings up an error message or the game hangs or crashes - PASS<br /><br />[b]InvalidBanks[/b]<br /><br />This checks how the system handles switching to non-existent ROM banks. This determines the behavior of glitches that cause invalid bank switches - most commonly invalid sound banks or invalid predefined commands.<br /><br />[tt]8F<br />(Any)<br />Lemonade&nbsp; &nbsp;  x65<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; x32<br />X Speed&nbsp; &nbsp; &nbsp; x79<br />Ultra Ball&nbsp;  x198<br />Fire Stone&nbsp;  x71<br />Moon Stone&nbsp;  x35<br />Water Stone&nbsp; x201[/tt]<br /><br />[code]ld a,41<br />ld e,20<br />ld b,e<br />ld c,a<br />ld (bc),a<br />add 20<br />ld b,a<br />ld a,(bc)<br />inc hl<br />ldi (hl),a<br />ret[/code]<br /><br />The third item&#039;s quantity changes to 124 - PASS.<br />Third item&#039;s quantity changes to something other than 124, like 255 or 0 - FAIL.<br />Remember to reset item 3&#039;s quantity if you want to repeat the test.<br /><br />[b]VRAMAccess[/b]<br /><br />VRAM data can only be read or written during V-Blank, H-Blank, or when the LCD screen is turned off. Otherwise, the write operation will be ignored, and all read operations will return FF. This test checks this behavior. Emulation of VRAM inaccessibility is essential for correct behavior of a lot of popular glitches, including Cooltrainer, Super Glitch, Brock Through Walls and any other glitches that attempt to &quot;search through the entire address space&quot;.<br /><br />[tt]8F<br />(Any)<br />Lemonade&nbsp; &nbsp;  xAny<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; x144<br />X Speed&nbsp; &nbsp; &nbsp; x175<br />PP Up&nbsp; &nbsp; &nbsp; &nbsp; x35<br />Moon Stone&nbsp;  x34<br />TM01&nbsp; &nbsp; &nbsp; &nbsp;  xAny[/tt]<br /><br />[code]ld a,??<br />ld e,90<br />ld b,e<br />xor a<br />ld c,a<br />inc hl<br />ld a,(bc)<br />ldi (hl),a<br />ret[/code]<br /><br />Run the script multiple times in a row and observe the quantity of the third item.<br />If it changes seemingly randomly between 255 and any other value - PASS<br />If it never becomes 255, even after trying multiple times - FAIL<br /><br />[b]EchoRAM[/b]<br /><br />Because of how GB&#039;s address line works, RAM addresses $C000~$DDFF are mirrored at $E000~$FDFF. This repeated section of memory is called the echo RAM. Because this feature was hardly used by anyone, several emulators don&#039;t support it. This test is intended to verify whether echo RAM is emulated correctly. Emulation of this feature changes the behavior of glitches that cause extensive memory corruption, like Pokemon beyond the sixth slot, or Dokokashira Door Glitch. Also, Coin Case arbitrary code execution won&#039;t work without echo RAM emulation.<br /><br />[tt]8F<br />(Any)<br />Lemonade&nbsp; &nbsp;  xAny<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; x241<br />X Speed&nbsp; &nbsp; &nbsp; x44<br />Fresh Water&nbsp; x175<br />TM06&nbsp; &nbsp; &nbsp; &nbsp;  x88<br />PP Up&nbsp; &nbsp; &nbsp; &nbsp; x10<br />Water Stone&nbsp; x201[/tt]<br /><br />[code]ld a,00<br />ld e,f1<br />ld b,e<br />inc l<br />inc a<br />xor a<br />adc a,58<br />ld c,a<br />ld a,(bc)<br />ldi (hl),a<br />ret[/code]<br /><br />Run the script and check the quantity of item 3.<br />If it changes to the code of the first letter in the player&#039;s name - PASS<br />If it doesn&#039;t change, or changes to a wrong value, like FF or 00 - FAIL<br /><br />[b]InvalidStop[/b]<br /><br />This is to test how the system reacts to invalid STOP opcodes. This behavior could affect some of the non-ACE Coin Case glitches, along with all glitches that execute data as code (invalid sound banks, invalid item/move effect pointers)<br /><br />[tt]8F<br />(Any)<br />Full Restore x??<br />TM01&nbsp; &nbsp; &nbsp; &nbsp;  xAny[/tt]<br /><br />[code]stop ??<br />ret[/code]<br /><br />Start with an arbitrary amount of Full Restores.<br />Run the 8F script. If the game crashes/halts whenever the script is executed - PASS<br />If not, try running the script with a different amount of Full Restores and repeat the process.<br />If after several tries the game is still running - FAIL.


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t know if there&#039;s a text guide of some sort, but this TAS pretty much shows one of the correct paths to achieve this: [url=https://youtu.be/kCkw2kSzCcE?t=676]https://youtu.be/kCkw2kSzCcE?t=676[/url]<br />The trick is to enter the Indigo Plateau map at a high enough Y coordinate to be above the badge guards, bypassing them completely.


subject: Re: Verifying console/emulator behavior with 8F
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7559.msg200946#msg200946 date=1469001032]<br />I planned to do this for a long time. In Gen I, we have a lot of glitches that exploit certain obscure details of the GB hardware or rely on undefined behavior, yet it still isn&#039;t exactly clear what behavior is exhibited by certain emulators and the real console. Thankfully, we have an easy way to execute any code we want with 8F. It&#039;s a good opportunity to test if everything works exactly as we think it works. I welcome everyone with working 8F setups on VC/console/mobile emulators/other devices to run the following 8F scripts and see if we have 100% accuracy for our glitching purposes.<br /><br />If my request gets some interest, this table will be filled with data regarding the most important systems.<br />Also let me know if someone thinks of another relevant test to add.<br /><br />[table]<br />[tr]<br />[td][b]Platform[/b][/td][td][b]UnknownOpcodes[/b][/td][td][b]InvalidBanks[/b][/td][td][b]VRAMAccess[/b][/td][td][b]EchoRAM[/b][/td][td][b]InvalidStop[/b][/td]<br />[/tr]<br />[tr][td]?[/td][td]?[/td][td]?[/td][td]?[/td][td]?[/td][td]?[/td][/tr]<br />[/table]<br /><br />The tests themselves:<br /><br />[b]UnknownOpcodes[/b]<br /><br />Self-explanatory. This is intended to test whether the target system ignores invalid opcodes, or crashes/halts when they are executed. This behavior could potentially affect any glitches that execute data as code (invalid sound banks, invalid item/move effect pointers).<br /><br />[tt]8F<br />(Any)<br />TM27&nbsp; &nbsp; &nbsp; &nbsp;  x201[/tt]<br /><br />[code]opcode_e3<br />ret[/code]<br /><br />If the game continues running after executing the script - PASS<br />If the system brings up an error message or the game hangs or crashes - FAIL<br /><br />[b]InvalidBanks[/b]<br /><br />This checks how the system handles switching to non-existent ROM banks. This determines the behavior of glitches that cause invalid bank switches - most commonly invalid sound banks or invalid predefined commands.<br /><br />[tt]8F<br />(Any)<br />Lemonade&nbsp; &nbsp;  x65<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; x32<br />X Speed&nbsp; &nbsp; &nbsp; x79<br />Ultra Ball&nbsp;  x198<br />Fire Stone&nbsp;  x71<br />Moon Stone&nbsp;  x35<br />Water Stone&nbsp; x201[/tt]<br /><br />[code]ld a,41<br />ld e,20<br />ld b,e<br />ld c,a<br />ld (bc),a<br />add 20<br />ld b,a<br />ld a,(bc)<br />inc hl<br />ldi (hl),a<br />ret[/code]<br /><br />The third item&#039;s quantity changes to 124 - PASS.<br />Third item&#039;s quantity changes to something other than 124, like 255 or 0 - FAIL.<br />Remember to reset item 3&#039;s quantity if you want to repeat the test.<br /><br />[b]VRAMAccess[/b]<br /><br />VRAM data can only be read or written during V-Blank, H-Blank, or when the LCD screen is turned off. Otherwise, the write operation will be ignored, and all read operations will return FF. This test checks this behavior. Emulation of VRAM inaccessibility is essential for correct behavior of a lot of popular glitches, including Cooltrainer, Super Glitch, Brock Through Walls and any other glitches that attempt to &quot;search through the entire address space&quot;.<br /><br />[tt]8F<br />(Any)<br />Lemonade&nbsp; &nbsp;  xAny<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; x144<br />X Speed&nbsp; &nbsp; &nbsp; x175<br />PP Up&nbsp; &nbsp; &nbsp; &nbsp; x35<br />Moon Stone&nbsp;  x34<br />TM01&nbsp; &nbsp; &nbsp; &nbsp;  xAny[/tt]<br /><br />[code]ld a,??<br />ld e,90<br />ld b,e<br />xor a<br />ld c,a<br />inc hl<br />ld a,(bc)<br />ldi (hl),a<br />ret[/code]<br /><br />Run the script multiple times in a row and observe the quantity of the third item.<br />If it changes seemingly randomly between 255 and any other value - PASS<br />If it never becomes 255, even after trying multiple times - FAIL<br /><br />[b]EchoRAM[/b]<br /><br />Because of how GB&#039;s address line works, RAM addresses $C000~$DDFF are mirrored at $E000~$FDFF. This repeated section of memory is called the echo RAM. Because this feature was hardly used by anyone, several emulators don&#039;t support it. This test is intended to verify whether echo RAM is emulated correctly. Emulation of this feature changes the behavior of glitches that cause extensive memory corruption, like Pokemon beyond the sixth slot, or Dokokashira Door Glitch. Also, Coin Case arbitrary code execution won&#039;t work without echo RAM emulation.<br /><br />[tt]8F<br />(Any)<br />Lemonade&nbsp; &nbsp;  xAny<br />Repel&nbsp; &nbsp; &nbsp; &nbsp; x241<br />X Speed&nbsp; &nbsp; &nbsp; x44<br />Fresh Water&nbsp; x175<br />TM06&nbsp; &nbsp; &nbsp; &nbsp;  x88<br />PP Up&nbsp; &nbsp; &nbsp; &nbsp; x10<br />Water Stone&nbsp; x201[/tt]<br /><br />[code]ld a,00<br />ld e,f1<br />ld b,e<br />inc l<br />inc a<br />xor a<br />adc a,58<br />ld c,a<br />ld a,(bc)<br />ldi (hl),a<br />ret[/code]<br /><br />Run the script and check the quantity of item 3.<br />If it changes to the code of the first letter in the player&#039;s name - PASS<br />If it doesn&#039;t change, or changes to a wrong value, like FF or 00 - FAIL<br /><br />[b]InvalidStop[/b]<br /><br />This is to test how the system reacts to invalid STOP opcodes. This behavior could affect some of the non-ACE Coin Case glitches, along with all glitches that execute data as code (invalid sound banks, invalid item/move effect pointers)<br /><br />[tt]8F<br />(Any)<br />Full Restore x??<br />TM01&nbsp; &nbsp; &nbsp; &nbsp;  xAny[/tt]<br /><br />[code]stop ??<br />ret[/code]<br /><br />Start with an arbitrary amount of Full Restores.<br />Run the 8F script. If the game crashes/halts whenever the script is executed - PASS<br />If not, try running the script with a different amount of Full Restores and repeat the process.<br />If after several tries the game is still running - FAIL.<br />[/quote]<br />Whoa, this could expand our understanding on how different glitches work on console<br />This could open up a loads of possibilities for console-only glitches!<br />Awesome~<br />Keep up the good work :D


subject: Post your screenshots/videos of save abuse glitch here
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheUnReturned
icon: xx
body:
  Save abuse is a fun glitch.<br />Rather then messing with items, I find messing with Pokemon more interesting.<br />They can bring out different stuff...well but not as useful as items which could leads to something useful (beating yellow in 0:00)<br />But here&#039;s something I&#039;ve come across to:<br />https://youtu.be/hOOqITvEdJ0<br />Edit: The whole long nidoqueen&#039;s &quot;true cry&quot;(not) here :&nbsp; https://youtu.be/yopTQTbbPiM<br />What else you came across to before? :P


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The problem with the gaurds is that they trigger their texts (thus, their checks) whenever the player is the same height as them. Basically, if you have to cross that height, you&#039;re screwed. Worse, it means that you&#039;ll lose the NoClip glitch.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You don&#039;t know how much reverse-engineering games can be fun. Also, the better we understand glitches, the better it is.<br />But yeah, I understand why this tread being so active can annoy you... but heh, just bump (constructively) the treads you&#039;d like to come back to life, and it&#039;s all gonna go better !


subject: Re: Verifying console/emulator behavior with 8F
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  None of these tests should have the slightest chance to corrupt save files. There&#039;s still the slight chance we missed something, or an unexpected behavior will occur, but that cannot be foreseen. I&#039;m ready to risk my save file, as far as I&#039;m concerned.<br /><br />I&#039;d also like to point out a useful 8F code for item duplication :<br />[code]<br />8F<br />Item to dupe x1 &lt;-- And I MEAN x1 !<br />PokÃ© Ball x43<br />Revive x4<br />TM01x (any)<br /><br />OR<br />(...)<br />Revive x201<br />[/code]<br />That gives you 0 items of the second slot. Throw away X items, and you end up with 256-X items. This allows<br />1. to get x0 item stacks<br />2. to bypass Missingno item duping (and since I&#039;m using en EU R/B...)<br /><br /><br />I ran the InvalidBanks test on a EU R/B 3DS VC, and I got 0 Lemonades.<br /><br />I tried invalid opcode E4 using TM27 x201, and I got nothing. No crash whatsoever.<br /><br />I also tried :<br />[code]<br />8F<br />Nugget x255 (It was there at the time, meh)<br />Full Restore x3 (in case the opcode is 1 byte long in this emulation)<br />TM01 x01<br />Stuff<br />[/code]<br />And the game just kept running fine !<br />To check whether the opcode was 1 or 2 bytes wide, I used the following setup :<br />[code]<br />8F<br />Revive x4 (shouldn&#039;t matter)<br />Full Restore x1<br />TM27 x201<br />Nugget x255<br />Water Stone x201<br />[/code]<br />Assuming a 1-byte large STOP :<br />[code]<br />stop<br />ld bc, $C9E4<br />ld sp, $22FF<br />ret<br />[/code]<br />This sets SP in ROM, and that has chances to be deadly to the code flow.<br />However, assuming a 2-byte STOP :<br />[code]<br />stop (absorbs the 01)<br />ret<br />(doesn&#039;t matter)<br />[/code]<br />Which returns fine (according to the above).<br />Running 8F had the game continue to run fine. So I assume STOP is 2-bytes wide, unless $22FF is a very lucky stack pointer (*cough cough*).<br /><br />I will be running VRAM and ERAM tests later.


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: froggy25
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7522.msg200934#msg200934 date=1468984617]<br />Can we just say &quot;Swift is broken&quot; and move on? This is ridiculous. 17 replies to a thread about a broken Gen 1 move? That&#039;s [b]a lot[/b]of chatter about an unsurprising development. Seriously. I&#039;d expect this for, say, a newly-discovered glitch, but about something we knew about since this place began? MAYBE 6 replies [b]MAXIMUM[/b].<br />[/quote]<br />Just don&#039;t post and gtfo.


subject: Re: Verifying console/emulator behavior with 8F
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  ...wow.<br /><br />I knew 3DSVC gb emu hooked some invalid opcodes, but ignoring them all? dafuq?<br /><br />now, i wonder if they actually do something or if they just act as nops.


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7554.msg200952#msg200952 date=1469017561]<br />The problem with the gaurds is that they trigger their texts (thus, their checks) whenever the player is the same height as them. Basically, if you have to cross that height, you&#039;re screwed. Worse, it means that you&#039;ll lose the NoClip glitch.<br />[/quote]<br />Forgot to account for both of those. Derp. :P


subject: Re: Verifying console/emulator behavior with 8F
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Reporting for US English VC. Tested the opcode and VRAM codes. After opcode nothing happened. VRAM only went to 255 and 0 favoring 255. I use walking in random areas of celadon if that counts for anything.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yes, and get a glimpse of old-school Magic, before big dumb undercosted creatures with red expansion symbols ruled the world


subject: Re: Verifying console/emulator behavior with 8F
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  A while back, I noticed that echo RAM doesnâ€™t work in GB Tower (in either PokÃ©mon Stadium or Stadium 2). There seemed to be other data at those addresses but I couldnâ€™t tell anything about what it was.<br /><br />I tried running these tests in Stadium 2:<br /><br />UnknownOpcodes: Fail (â€œThe saved data has been corrupted, so it is impossible to CONTINUE. Please reset the game and choose NEW GAME.â€ No, it didnâ€™t actually corrupt my save file.)<br />InvalidBanks: Pass (124)<br />VRAMAccess: ? (always 255)<br />EchoRAM: Fail (30)<br />InvalidStop: Fail


subject: Re: Verifying console/emulator behavior with 8F
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  This was fun to do! I will try to perform these tests on English Stadium 1&#039;s Game Boy Tower soon. I don&#039;t know if I have a DMG anymore, it may be hidden at our old house.<br /><br />When I tried to set up either 8F or ws m in the EU Virtual Console versions, I had my save file destroyed (no message, only the Continue option removed) by accidentally pressing A on an unterminated name glitch item. It also got erased in Yellow when I used ws m in the wrong box by mistake. Both freezes may have been due to a rst $38. On an emulator (VBA v24 svn422), the erased save behaviour doesn&#039;t always occur but I wonder whether it is more likely on the VC versions.<br /><br />Game Boy Color (CGB-001):<br />UnknownOpcodes - Pass (game locks-up, music hangs)<br />InvalidBanks -&nbsp; Pass (item 3&#039;s quantity changes to 124)<br />VRAMAccess - Pass (item 3&#039;s quantity changes to either 0 or 255, seemingly randomly)<br />EchoRAM - Pass (item 3&#039;s quantity changed to 225; the index number for &quot;Pk&quot; (the first character of my name) as expected<br />InvalidStop&nbsp; - Pass (I used item 3 quantities of 255 and 254. The game froze with a black screen, one time it froze without a black screen/hanged on selection and music lingered with one of these quantities, I believe it may have been 254)<br /><br />Game Boy Advance SP (AGS-001):<br />UnknownOpcodes - Pass (game locks-up, music hangs)<br />InvalidBanks - Pass (item 3&#039;s quantity changes to 124)<br />VRAMAccess - Pass (item 3&#039;s quantity changes to either 0 or 255, seemingly randomly)<br />EchoRAM - Pass (item 3&#039;s quantity changed to 225; the index number for &quot;Pk&quot; (the first character of my name) as expected<br />InvalidStop - Pass (I used item 3 quantities of 255 and 254, and the game froze with a black screen and music lingering)<br /><br />Game Boy Player (a GameCube peripheral that can play Game Boy games):<br /><br />UnknownOpcodes - Pass (game locks-up, music hangs)<br />InvalidBanks - Pass (item 3&#039;s quantity changes to 124)<br />VRAMAccess - Pass (item 3&#039;s quantity changes to either 0 or 255, seemingly randomly)<br />EchoRAM. - Pass (item 3&#039;s quantity changed to 225; the index number for &quot;Pk&quot; (the first character of my name) as expected. I thought this would work because [url=https://www.youtube.com/watch?v=SKmcDPtjx1I]giginet&#039;s video[/url] of the dokokashira door glitch uses a Game Boy Player.<br />InvalidStop - Pass (I used item 3 quantities of 255 and 254, and the game would freeze either with a black screen or hang with the music lingering. Is the black screen less likely here? Possibly but it could very well be confirmation bias)


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  <br />Tfw someone asks if you need the number to the suicide hot line because you &quot;joke&quot; about killing yourself all the time.<br />permalinkembedsavereportgive goldreplyshareddit<br />[â€“]chattypenguin 5 points 23 hours ago <br />Tfw your depression comes out in anger and you&#039;re losing everybody you used to love because you are so fucking bitter.<br />permalinkembedsavereportgive goldreplyshareddit<br />[â€“]CoMaestro 4 points 23 hours ago <br />Honestly, that&#039;s just caring about someone else rather than thinking your life is worth less<br />permalinkembedsavereportgive goldreplyshareddit<br />[â€“]PM_ME_YIFF_PICS 3 points 23 hours ago <br />


subject: Re: Verifying console/emulator behavior with 8F
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  Torchickens, for the Invalidstop test, could you please also try with item #3 quantity being 3 ? Because FF causes a rst 38h (which always crashes), and FE uses the following byte as an operand. 3 is inc bc, so it would properly return.<br /><br />Also, gbdev wiki points out the invalid opcodes hang the GB&#039;s CPU when executed, so the emulation crahsing should probabbly marked as PASS, no ?


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰
icon: xx
body:
  [quote author=Zowayix link=topic=7555.msg200941#msg200941 date=1468998408]<br />So this isn&#039;t really a forum game, then, but just a discussion on a particular family of consoles.<br /><br />Also I wish my 3DS gave me the ability to kill myself.<br />[/quote]<br />[quote author=Zowayix link=topic=7555.msg200964#msg200964 date=1469053546]<br />I wish my 3DS could simulate killing myself.<br />[/quote]<br />same<br />[quote author=ISSOtm link=topic=7555.msg200927#msg200927 date=1468978333]<br />I wish my N3DS could allow instant travel. That&#039;d resolve half of my problems right now. And I got a metric shit ton of them.<br />[/quote]<br />also same<br /><br />I wish my N3DSXL would print money, Financial stress is a pain. <br /><br />[quote author=Yeniaul link=topic=7555.msg200957#msg200957 date=1469029176]<br />Again, [b][i]SOFTWARE[/b][/i]-based. That would fall under hardware. &gt;:(<br />[/quote]<br /><br />why would i need anything software based when homebrew is already a thing? Like hell, you can install windows on these things. Think about that yeniaul, I can do my taxes [glow=red,2,300]I[/glow][glow=blue,2,300]N[/glow] [glow=red,2,300]3[/glow][glow=blue,2,300]D[/glow].


subject: Learning to create a homebrew software through ACE
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello,<br /><br />As some of you already knew, I&#039;m new to all this cool stuff. Your help is much appreciated. In the past few days, I learned pretty much everything about manipulating bytes in the RAM map through ACE. But it appears that you can do much more with ACE[url=https://www.youtube.com/watch?v=D3EvpRHL_vk]https://www.youtube.com/watch?v=D3EvpRHL_vk[/url]. I really want to know if I can make new Pokemons or just add more in-game event Pokemons. I can&#039;t bother you guys to guide me through all the steps, but I would very much appreciate it if you can direct me to the resources where I can get more out of ACE. Of course, a true enthusiast should learn computer programming from alpha to omega, but if you can help me quickly get to where I want, that&#039;d be splendid. Thank you very much in advance.


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=7555.msg200970#msg200970 date=1469058676]<br />why would i need anything software based when homebrew is already a thing? Like hell, you can install windows on these things. Think about that yeniaul, I can do my taxes [glow=red,2,300]I[/glow][glow=blue,2,300]N[/glow] [glow=red,2,300]3[/glow][glow=blue,2,300]D[/glow].<br />[/quote]<br />I own an R4. I know. Basically, what homebrew would you like to see become stock?<br /><br />[quote=&quot;vxheaven.net&#039;s Yeniaul&quot;]I&#039;ve thoroughly fucked up at least 30 different installs of MS-DOS on a DSi. Whoops.[/quote]


subject: Re: Verifying console/emulator behavior with 8F
poster_name: naf102
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: naf102
icon: xx
body:
  I tested MyOldBoy (an Android GameBoy emulator):<br /><br />UnknownOpCodes- Pass (game continues to function)<br />InvalidBanks- Pass (Item 3&#039;s (Lemonade) quantity changes to 124)<br />VRAM Access- Pass (Item 3&#039;s quantity (Lemonade) changes to 255)<br />EchoRAM-&nbsp; Pass (Item 3&#039;s quantity changes to 129 (which is 81, which is the letter B and my Trainer&#039;s&nbsp; name is BIG M)<br />InvalidStop-&nbsp; Failure (No matter how many Full Restores I had in inventory (first I tried 97, then 43, then 143 then 267) the game would not stop running)<br /><br />


subject: Re: Verifying console/emulator behavior with 8F
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  LameboyDS:<br />UnknownOpCodes: PASS<br />InvalidBanks: PASS<br />EchoRAM: PASS<br />VRAMAccess: PASS<br />InvalidStop: PASS...? (Some invalid stops work, some don&#039;t. Um...?)<br />Seems to pass with flying colors. The InvalidStop test kinda passed... some worked right, some didn&#039;t. <br />Odd, but okay.


subject: The &quot;Do something to the next poster&quot; game
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  This is basically the &quot;I slap the next poster&quot; thread. Whatever you state you do is added to the line &quot;&lt;insert&gt; to the next poster.&quot; or a variant of this line.<br /><br />I slap the next poster with a whole roll of bologna.


subject: Re: Learning to create a homebrew software through ACE
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you want to learn about Gameboy programming, a good place to start is the [url=http://bgb.bircd.org/pandocs.htm]Pan Docs[/url], which is a complete technical specification of the Gameboy. [url=http://www.pastraiser.com/cpu/gameboy/gameboy_opcodes.html]This page[/url] is also useful, since it shows you which instructions correspond to which hex values. Additionally, there is an impressively complete [url=https://github.com/pret/pokered]disassembly of Pokemon Red version (US)[/url], if you want to take a look at the reverse-engineered assembly code. On Datacrystal, there is a [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red_and_Blue:ROM_map]ROM map[/url] and a [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map]RAM map[/url], both of which are useful for different things. And of course, the original 8F thread is [url=http://forums.glitchcity.info/index.php/topic,6638.0.html]here[/url], with tons of item loadouts you can use. And if you want to code for the Gameboy directly, you can use [url=http://otakunozoku.com/rednex-gameboy-development-system/]Rednex GameBoy Development System[/url].<br /><br />In the video you posted, ZZAZZ used a glitch item that, with his team of Pokemon, put the program counter in his items menu. From there, he used his items menu to write a small snippet of code that would take his X-Y coordinates on the map and write them to another area of memory as one byte. This way, he could write a much longer piece of code than something that would fit in the items menu.<br /><br />And to answer your question, you can use ACE to write data to a save file and edit maps (ZZAZZ did so in [url=https://www.youtube.com/watch?v=Zd2595c_72M]this video[/url]), and you can also edit sprite properties and place interactable Pokemon where they shouldn&#039;t be (both of which were showcased [url=https://youtu.be/mCoQm8bIyyw?t=24m1s]here[/url], to amusing effect).<br /><br />But yeah, Arbitrary Code Execution is just that, arbitrary. You can write a program as large as the Gameboy&#039;s working RAM if you put enough time into it.


subject: Re: Learning to create a homebrew software through ACE
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you very much! Would you please direct me to the post that shows how one can manipulate ROM data? I only know how to manipulate RAM data.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Adamant Nature&nbsp; <br />- Earthquake&nbsp; <br />- Rock Slide&nbsp; <br />- U-turn&nbsp; <br />- Protect


subject: Another Crystal Disassembly?
poster_name: Dandaman955
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Okay, so this is probably the most pointless thread, and I don&#039;t know how to make polls, so with that in mind:<br /><br />I was looking through the current Pokemon Crystal disassembly by (I think?) pret, and I found a lot of it quite hard to read through. No disrespect to the work that was put through, but it was covered in equates and macros, with a lot of files split into sub-files which made following a lot of it difficult. Now in the Sonic scene, there are people who swear by two different types of disassemblies, often disagreeing on which is the best kind, with:-<br /><br />- The up-to-date Git kind, where it is all macroed, equated and has code split into separate files, similar to how the Crystal disassembly is now. I think it&#039;s trying to be similar to how something like C handles it, with the includes and such?<br /><br />- The one that isn&#039;t. Simple. :p<br /><br />I personally believe that you can make a disassembly less cluttered by reducing the amount of equates, macros and file splits and replacing them with comments denoting what the instructions do in the grand scheme of things. Here&#039;s[1] an example of one disassembly I made (That isn&#039;t finished; Some instructions aren&#039;t commented and a lot of data isn&#039;t split into files yet, mainly the large block of data, from byte_100C to loc_6B48, with a few things otherwise. It should give an idea, though.) on the Action Replay ROM. I was thinking of making a disassembly with a similar structure to this one, but I don&#039;t think it&#039;s worth the effort if there isn&#039;t anyone who would actually find a use in it, so what I&#039;m basically asking here is:<br /><br />[b]Would you be interested in/use a disassembly like this?[/b]<br /><br />[1] - [url=https://github.com/Dandaman955/Action-Replay-MD-Disasm/blob/master/Action%20Replay%20(Europe).asm]https://github.com/Dandaman955/Action-Replay-MD-Disasm/blob/master/Action%20Replay%20(Europe).asm[/url]


subject: Re: Verifying console/emulator behavior with 8F
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you for all of your responses! I updated the table with all the information you submitted.<br /><br />I originally didn&#039;t know undefined opcodes actually hang the CPU, I expected something similar to the behavior of 6502, where invalid opcodes actually do something - sometimes useful, sometimes not.<br />Therefore, I will now consider the test to be passed if the game doesn&#039;t keep running after executing an invalid instruction, since that&#039;s the behavior on real hardware. I updated the test accordingly.<br /><br />Already we see that some of the glitches will be version exclusive - most importantly, 3DS VC seems to have pretty inaccurate emulation (although most of this stuff is undefined behavior, so they have the right to format my SD card if I try to do this). Some random facts as of now:<br />- The &quot;MISSINGNO. is trying to learn effect&quot; is 4 times less likely to be seen on 3DS VC.<br />- Coin Case ACE will not work on Stadium 2&#039;s GB Tower.<br />- 3DS VC most likely ignores invalid opcodes, which means that some crashing glitch items could potentially be more useful there.<br /><br />Also, superscript inside tables looks weird.


subject: Re: Verifying console/emulator behavior with 8F
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=7559.msg200980#msg200980 date=1469080423]<br />I originally didn&#039;t know undefined opcodes actually hang the CPU, I expected something similar to the behavior of 6502, where invalid opcodes actually do something - sometimes useful, sometimes not.<br />Therefore, I will now consider the test to be passed if the game doesn&#039;t keep running after executing an invalid instruction, since that&#039;s the behavior on real hardware.[/quote]<br />LameboyDS DID NOT hang with unknown opcodes, it will hop over the instruction and continue. Should probably update that in the table if it&#039;s still labeled PASS. :P whoops<br /><br />And it&#039;s LameboyDS version 0.12 if I remember correctly... pretty good for an infant port, right?


subject: Re: Another Crystal Disassembly?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Definitely. A one-file disassembly is a lot easier to search through when you want to analyze a certain subroutine or check for certain behavior.<br />The current disasms of Pokemon games are formatted like &quot;corporate quality code&quot;, which is good for ROM hacking, but not too good for reversing. A similar thing happened to the pokered disassembly. I circumvented the problem by getting an older version of the repository, where everything was still mostly in one file. But this old version has a lot of stuff undocumented, so later I need to search through the current version anyways.<br /><br />An easy way to get a one-file disasm would be writing a quick script to expand all of the includes. Still, that wouldn&#039;t deal with macros and constants (looking through the code, minding my own business... fuck, what address is wWhichPokemon again? *scroll back to the top*)


subject: Re: Learning to create a homebrew software through ACE
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=iamnguyen link=topic=7562.msg200977#msg200977 date=1469071839]<br />Thank you very much! Would you please direct me to the post that shows how one can manipulate ROM data? I only know how to manipulate RAM data.<br />[/quote]<br /><br />The ROM data cannot be changed, unless you manually edit it with an external tool such as a hex editor (such as the free hex editor HxD) sadly. However, when you force the game to execute code from writable memory (and possibly loop the code) you can effectively create your own &#039;software&#039;.<br /><br />Using the PokÃ©mon Red disassembly/Datacrystal ROM map and the hex editor, you can locate and identify the structure of data and modify it. [url=http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_base_stats_data_structure_in_Generation_I]This[/url] is a well-known structure.<br /><br />Sometimes ROM data is represented as a three byte pointer (e.g. 04:6345) rather than an offset (e.g. 0x12345). Converting from pointer to offset and vice versa is detailed in [url=http://datacrystal.romhacking.net/wiki/Pointer]this article[/url]; or you may use a calculator such as [url=https://mega.nz/#!0kcgyKKC!PJbNuc8ipkof5K0y40jRg3MMWJ725KCazcsfh7MvZ_I]GB-PC[/url].<br /><br />Game Genie codes also serve as temporary patches for the ROM, and can be generated with [url=http://tinyurl.com/ggconv-zip]this tool[/url].<br /><br />I&#039;ve never created my own game with arbitrary code execution before so I don&#039;t know if this is best sadly, but one approach to making one might be to code your game in another language such as C, [url=http://www.loirak.com/gameboy/gbprog.php]compile it[/url] and then work on the ROM you created to execute it with 8F.<br /><br />The PokÃ©mon games have some important routines like CopyData (for copying a given number of bytes from one area in writable memory to another). You can learn how these works by looking them up on the PokÃ©mon Red disassembly and using the &#039;call&#039; (CD yy xx) instruction to activate them.<br /><br />Hope this helps.


subject: Re: Another Crystal Disassembly?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It would also be nice if the same happened for Red and Yellow ; but, one thing at a time, so I heavily say [b][size=18pt]YES[/size][/b] to this one.


subject: Re: Verifying console/emulator behavior with 8F
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  After some item index decrementation (man, I threw that TM06 when I beat Koga a year ago &gt;&lt;), I tested Echo RAM on the Virtual Console, and realized I am on a EU version, so I had to get 5 more TM06. Dumb me.<br />[code]<br />8F<br />Super Ball x?6<br />Lemonade x254<br />Repel x241<br />X Speed x44<br />Fresh Water x175<br />TM06 x93<br />PP Up x10<br />Water Stone x201<br />Stuff<br />[/code]<br />This gave me 136 Lemonades. My trainer&#039;s named ISSOtm, so I guess this is a PASS.<br /><br /><br />I wanted to give a shot to the Gambatte emulator, so I launched BizHawk on a US Red ROM. Here are the results :<br />[list]<br />[li]Invalid opcode E3 : crash. [color=green]PASS[/color][/li]<br />[li]Invalid banks : 124. [color=green]PASS[/color][/li]<br />[li]VRAM Access : Always 255 Lemonades. I guess that [color=green]PASS[/color]es ?[/li]<br />[li]The Echo RAM test yielded 88 ($58) Lemonades, although I know (&#039;cause of Coin Case TASes) Echo RAM is properly emulated in BizHawk ? I must have screwed something somewhere. Anyways, [color=green]PASS[/color][/li]<br />[li]The STOP opcode had the game run fine. It was two bytes large, but didn&#039;t crash. I label this as [color=green]PASS[/color], and I&#039;ll explain why below.[/li]<br />[/list]<br /><br />GBDevWiki&#039;s description of the STOP instruction is<br />&quot; stop&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  10 00&nbsp; &nbsp; &nbsp; &nbsp; ? ---- low power standby mode (VERY low power)&quot;<br />Actually, STOP behaves like a HALT (do nothing until an interrupt occurs), but this actually disables the LCD driver and enters very low power mode.<br />This setup (starting from item #3) should do the job of really testing the opcode :<br />[code]<br />PokÃ© Ball x243<br />Full Restore x255<br />Super Ball x251<br />TM01 x(any)<br /><br />Code :<br />inc b<br />di<br />stop<br />inc bc<br />ei<br />ret<br />[/code]<br />If the game hangs, the opcode is correctly interpreted -&gt; PASS.<br />If the game continues, the opcode isn&#039;t interpreted correctly -&gt; FAIL.<br />If the game crashes (in a rst 38h style), the opcode isn&#039;t the correct length.<br />Try again, this time with only 1 .


subject: Re: Another Crystal Disassembly?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I just realised, compiling the disassembly would produce a symbol or map file, that I know that bgb at least can read to get symbol names (so you can ctrl+g &lt;label&gt; and it&#039;ll jump to the address etc).<br /><br />That could be used instead of having an entirely new disasm.


subject: Re: Learning to create a homebrew software through ACE
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh yeah, another resource I forgot to include: [url=http://glitchcity.info/biglist.htm]The Big List[/url], which shows you what each hex character corresponds to (Moves, items, decimal values, Pokemon, letters) so you can know what hex codes to use. Super helpful for ACE. 


subject: Disabling wild encounters with Select glitch (Red/Green/Blue)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  This is a select glitch I &#039;created&#039; which allows you to disable encounters at will until you perform the select glitch again with the PokÃ©mon you get from the switch, based on the unused &quot;[url=https://tcrf.net/Pok%C3%A9mon_Red_and_Blue/Debug_Functions#Debug_Mode]debug feature[/url]&quot; (which can be enabled in the Japanese versions by setting bit 1 of 0xD6B1 and in the English versions by setting bit 1 of 0xD732).<br /><br />The debug feature allows you to disable wild encounters by holding B, or start a new game without having to name the player and start outside of your house (or the value in D07C according to the PokÃ©mon Red disassembly). Sadly, even if you save and reset with the flag set you won&#039;t be able to skip the new game sequence with this method. (however, outside of glitches you may use the GameShark code 0103B1D6 and you could theoretically force a new game that does have the flag enabled with arbitrary code execution).<br /><br />To activate the select glitch, all you need to do is make the following steps:<br />1) Obtain a PokÃ©mon which has Poison (hex:03) as its type 2 and a move 3 with 35 PP, with no PP Ups used. (or any PP value with bit 0x5 checked).<br />1) Press Select on PC item 33 (or theoretically item 33 in the expanded items pack).<br />2) Exit with B, B, B and enter a battle, or enter the Name Rater&#039;s house/Day Care Center without opening the menu.<br />3) Either open the PokÃ©mon menu during the battle, or by talking to the NPC and press A on the Poison-type PokÃ©mon (this will swap it with PokÃ©mon 33).<br /><br />This glitch will change the value of D6B1 to $03 (bit 0 checked; the play time is being counted and bit 1 checked; the debug feature activated). The 35 PP requirement is to check bit 5 of D6CA so that we do not lose the PokÃ©dex option on the menu.<br /><br />For some unknown reason, this trick resulted in disabling all wild encounters even if you aren&#039;t holding down the B button. However, the battles can be re-enabled by performing the glitch again with the glitch PokÃ©mon you get from the swap.<br /><br />When I performed this glitch, it also enabled the &quot;test battle&quot; (bit 1 of D6B2) flag; which is controlled in this glitch by the catch rate of the PokÃ©mon you switch. When &quot;test battle&quot; is enabled, battles do not show any PP on the fight menu, and all moves will act like Pound. This is used for the [url=http://forums.glitchcity.info/index.php?topic=7012.0]battle test[/url] debugging leftover, in which you obtain a level 20 Rhydon and a battle is initiated against another level 20 Rhydon.


subject: Re: Learning to create a homebrew software through ACE
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aldrasio link=topic=7562.msg200992#msg200992 date=1469134354]<br />Oh yeah, another resource I forgot to include: [url=http://glitchcity.info/biglist.htm]The Big List[/url][/quote]<br />You forgot because it&#039;s been here for so damn long.<br /><br />Torchickens, you forgot memcpy ($B4 onward, R/B/Y), which copies data between pointers. (TheZZAZZGlitch has a video on fucking this up, it&#039;s quite amusing. :P)


subject: Re: Learning to create a homebrew software through ACE
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=iamnguyen link=topic=7562.msg200998#msg200998 date=1469144622]<br />Would you please post that link for me to watch? By the way, thanks a lot, everyone.<br />[/quote]<br />If I can find it on my DSi (what I use to browse the web when my PC shits itself, so for now) I&#039;d be fucking amazed...<br /><br />...although, I might be able to do it, considering I got an AJAX IRC client to work... If not, just search &quot;memcpy TheZZAZZGlitch&quot; on the WyeTubs (YouTube).


subject: Re: Verifying console/emulator behavior with 8F
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I edited my previous post, and I bump here for everyone to notice the bump.<br /><br />I asserted that hte game will hang, although there is a chance my information is not correct. Anyone having a GBC/A could test ? Thanks.


subject: Re: Another Crystal Disassembly?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  I tried generating that file, but I didn&#039;t have rgbasm on my Debian system. When I tried to compile it, it required a package I didn&#039;t have.<br />That package didn&#039;t exist in the official repos, so I looked for an equivalent.<br />When running make on rbgasm, the equivalent produced seveal screens worth of synatx errors.<br /><br />I uninstalled all out of discouragement.<br /><br /><br />If anyone could give me a link to such a .map file, I&#039;d be ready to give them big, big hug. And a truck filled with [s]Mews[/s] chocolate / candies / toffees / sweets.


subject: Re: Emulating the Mobile Adapter GB
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;d be kinda odd if, after this was complete (the server and clients bit), someone ported it to Android or *shudder* iOS. In a way, it would have come full-circle... which is always nice... I guess...


subject: Re: Verifying console/emulator behavior with 8F
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7559.msg201002#msg201002 date=1469149413]<br />I edited my previous post, and I bump here for everyone to notice the bump.<br /><br />I asserted that hte game will hang, although there is a chance my information is not correct. Anyone having a GBC/A could test ? Thanks.<br />[/quote] It might or might not hang... It&#039;s also decided by how well the CPU perform


subject: Re: Learning to create a homebrew software through ACE
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7562.msg201000#msg201000 date=1469147147]<br />HOLY s**t I DID IT.<br /><br />[youtube]youtube.com/watch?v=YP91vWSCCho[/youtube]<br />[/quote] that&#039;s REALLY fucked up xD


subject: Re: Another Crystal Disassembly?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  I have a SYM file for Red/Blue, since I use it in bgb to get symbols for debugging.<br />But it doesn&#039;t seem to be of much help when creating a one-file disasm, using it by itself wouldn&#039;t preserve comments and differences between data and code. But I still included it as an attachment, since it&#039;s useful to have.<br /><br />Instead, I randomly decided to do something stupid:<br /><br />[code]# coding: utf8<br />result = b&#039;&#039;; counter = 0<br />with open(&#039;out.asm&#039;, &#039;rb&#039;) as f:<br />&nbsp; &nbsp; for i in f.readlines():<br />&nbsp; &nbsp; &nbsp; &nbsp; if i[0:9] == b&#039;INCLUDE &quot;&#039;:<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; with open(i[9:-3], &#039;rb&#039;) as g: result += g.read()<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; counter += 1<br />&nbsp; &nbsp; &nbsp; &nbsp; else:<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; result += i<br />with open(&#039;out.asm&#039;, &#039;wb&#039;) as f: f.write(result) <br />print(&quot;Eradicated includes: %i&quot; % counter)<br /># run it multiple times to deal with nested includes[/code]<br /><br />And the result looks surprisingly OK. https://aww.moe/u408xw.asm<br />It still lacks comments with function addresses (this could be done with the SYM file mentioned earlier), and has all the constants and macros (the problem of constants can be fixed by prefixing/suffixing each pointer constant with its effective address; still no idea how to approach the macros, does rgbasm have an command line option to only preprocess macros without compiling?)


subject: Re: Disabling wild encounters with Select glitch (Red/Green/Blue)
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7565.msg200997#msg200997 date=1469143822]<br />Good work! This could be put under the Select glitch page with more work as an example.<br />[/quote]<br /><br />Thanks Yeniaul! :)<br /><br />[quote author=TheUnReturned link=topic=7565.msg201006#msg201006 date=1469165660]<br />I assume this is included to the debug and not &quot;created&quot;... xD<br />[/quote]<br /><br />I&#039;m not sure what you mean but the glitch should activate the debug feature, although it&#039;s interesting that all battles were disabled even without holding down B (is there a way to disable battles without enabling bit 1 of 0xD6B1?).


subject: Re: Learning to create a homebrew software through ACE
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7562.msg200996#msg200996 date=1469143477]<br />[quote author=Aldrasio link=topic=7562.msg200992#msg200992 date=1469134354]<br />Oh yeah, another resource I forgot to include: [url=http://glitchcity.info/biglist.htm]The Big List[/url][/quote]<br />You forgot because it&#039;s been here for so damn long.<br /><br />Torchickens, you forgot memcpy ($B4 onward, R/B/Y), which copies data between pointers. (TheZZAZZGlitch has a video on fucking this up, it&#039;s quite amusing. :P)<br />[/quote]<br /><br />Actually memcpy is CopyData according to the [url=http://forums.glitchcity.info/index.php/topic,7564.msg201008/topicseen.html#msg201008]blue.sym[/url] file TheZZAZZGlitch published and the location of the routine in his video description. We can use that to look up the locations of more routines.<br /><br />I agree, I enjoyed watching that video too. :)


subject: Re: Disabling wild encounters with Select glitch (Red/Green/Blue)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7565.msg201009#msg201009 date=1469184700]<br />I&#039;m not sure what you mean but the glitch should activate the debug feature, although it&#039;s interesting that all battles were disabled even without holding down B (is there a way to disable battles without enabling bit 1 of 0xD6B1?).<br />[/quote]<br />I guess editing the random encounter chances (setting them to 0). But that ain&#039;t be permanent.


subject: Re: Another Crystal Disassembly?
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  [quote author=ISSOtm link=topic=7564.msg201003#msg201003 date=1469149898]<br />I tried generating that file, but I didn&#039;t have rgbasm on my Debian system. When I tried to compile it, it required a package I didn&#039;t have.<br />That package didn&#039;t exist in the official repos, so I looked for an equivalent.<br />When running make on rbgasm, the equivalent produced seveal screens worth of synatx errors.<br /><br />I uninstalled all out of discouragement.<br /><br /><br />If anyone could give me a link to such a .map file, I&#039;d be ready to give them big, big hug. And a truck filled with [s]Mews[/s] chocolate / candies / toffees / sweets.<br />[/quote]<br />Search &quot;rgbasm Debian&quot; and find it on a repo. Look and see if any of the dependency names are links. Download those too, and any dependencies for those you don&#039;t have. Install the .deb files, starting with the lowest level of dependencies. (If rgbasm is the highest, and its dependencies are the next highest, what&#039;s the lowest level?)<br /><br />This sounds and IS tedious, but try having to do this without ANY packages. You&#039;d have to install EVERYTHING. If I can install GNUTools on Damn Small Linux, you can do the above process.<br /><br />I hope you can figure out how to install them, considering all the documentation out there.


subject: Re: Verifying console/emulator behavior with 8F
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=7559.msg201005#msg201005 date=1469165563]<br />[quote author=ISSOtm link=topic=7559.msg201002#msg201002 date=1469149413]<br />I edited my previous post, and I bump here for everyone to notice the bump.<br /><br />I asserted that hte game will hang, although there is a chance my information is not correct. Anyone having a GBC/A could test ? Thanks.<br />[/quote] It might or might not hang... It&#039;s also decided by how well the CPU perform<br />[/quote]<br /><br />Why would that be a factor, though? It matters how it interprets an instruction, which is entirely on how the CPU handles command logic. Performance shouldn&#039;t matter.


subject: Re: Pokemon Crystal RAM map
poster_name: Haxel
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Haxel
icon: xx
body:
  [quote]DD20-DD27 -- Party Pokemon #4 OT name (DE27 is always 50)<br /><br />DD2B-DD32 -- Party Pokemon #5 OT name (DE32 is always 50)<br /><br />DD36-DE3D -- Party Pokemon #6 OT name (DE3D is always 50)<br />[/quote]<br /><br />Party PokÃ©mon #6 OT name from DD36 to DE3D ? I guess that the true values are DE20-DE27 ; DE2B-DE32 ; D336-DE3D no ? (or DD20-DD27 ; DD2B-DD32 ; DD36-DD3D)<br /><br />And it&#039;s the same problem for <br />[quote]DD77-DD79 -- Party Pokemon #4 Experience<br />DD78-DD82 -- Party Pokemon #6 Nickname (DD82 is always 50)[/quote]


subject: Belated hello
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey everyone. So I&#039;m new to the forums, but I&#039;ve got some experience with hacking/breaking the first gen of Pokemon games. <br /><br />When I was in college, for a few months I sorta took up Gameboy programming as a hobby. Then I found the Pokemon Red disassembly on github and used that to do some ROMhacking. But at the time I was more of a lurker, so I didn&#039;t share anything I did anywhere. Then I gradually lost interest, but I still have all the notes and code I made from back then.<br /><br />So now I&#039;m decently familiar with the Gameboy CPU and the structure of Pokemon RBY, and I really enjoy digging into those games, experimenting, figuring out why unintended behavior happens. It amazes me that we can still find new stuff about these games almost 20 years later.


subject: Re: Verifying console/emulator behavior with 8F
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Assuming the CPU&#039;s components aren&#039;t rusted, the instruction always is interpreted the same way.


subject: Re: Belated hello
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Howdy, Aldrasio! Welcome to GCLF.<br /><br />[img]http://images4.wikia.nocookie.net/__cb20120510221731/unanything/images/8/80/Don&#039;t_forget_you&#039;re_here_forever.jpg[/img]<br /><br />[quote author=Aldrasio link=topic=7566.msg201015#msg201015 date=1469202818]<br />It amazes me that we can still find new stuff about these games almost 20 years later.[/quote]<br /><br />QFT.


subject: Re: Belated hello
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  All hail the Legendary 8F and his follower, the Coin Case.<br />If you&#039;re in ACE things, there is 3rd gen ACE currently getting the final polishes, and 4th gen is in the scope.<br /><br />Welcome to GCL ! Because the world isn&#039;t large enough, we need to glitch more out of it.<br />[size=5pt]Warning : excessive glitching may result in corruptions, loss of control, headaches, glitch PokÃ©mon, and other undesirable effects.<br />If troublesome side effects persist, call 36 15 MISSINGNO.<br />Glitch City Corp. is not responsible for any damage caused to your cartridges, brains or PokÃ©mon.[/size]


subject: Re: Emulating the Mobile Adapter GB
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  If I could figure out raw byte manipulation in Python 2 it&#039;d be piss easy to make a program for custom Mobile Adapter GB &quot;trading&quot; generation, down to user-input for the trade specifics.


subject: Re: Belated hello
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7566.msg201018#msg201018 date=1469227441]<br />[size=5pt]Warning : excessive glitching may result in corruptions, loss of control, headaches, glitch PokÃ©mon, and other undesirable effects.<br />If troublesome side effects persist, call 36 15 MISSINGNO.<br />Glitch City Corp. is not responsible for any damage caused to your cartridges, brains or PokÃ©mon.[/size]<br />[/quote]<br /><br />Other than headaches and loss of control (and/or depending what you&#039;re losing control [i]of[/i]), these effects seem pretty desirable to me.


subject: Re: Belated hello
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Loss of control in this case could relate to three things:<br />1. Seizure<br />2. Stroke<br />3. Loss of control over your game


subject: Not related to ping.
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Promise, this topic being created more than a year after my registration isn&#039;t due to ping.<br />(Date Registered:<br />&nbsp; &nbsp; December 30, 2014, 07:41:31 AM)<br /><br />It&#039;s just me being hella lazy and [s]glitching my wast past[/s] completely forgetting introducing myself.<br />(First post ever : http://forums.glitchcity.info/index.php/topic,6675.msg198359.html#msg198359)<br /><br />I began here on the wiki, and half I year after, I posted on the forums for the first time.<br />Those who arpent the forums for a while must know me well glitch-wise, so heh.<br />I&#039;m a 17-year old student in some high math classes, programming his own RPG engine in C.<br />I&#039;ve also coded a few engines, a Flappy Bird, and a Friday 13th finder on TI-83 Plus calcs.<br /><br />Well, now this topic exists. I may have sequence broken it, but isn&#039;t that the spirit ? ;D


subject: Re: Flame War
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  BUMP<br /><br />SINCE THAT WAS WRITTEN IN CAPS LOCK I SUPPOSE IT IS SUITED FOR THIS TOPIC ANYWAYS<br />THIS IS THE LARGEST BUMP I&#039;VE EVER WRITTEN<br /><br />[quote author=ãƒ‰ãƒŠãƒ«ãƒ‰ãƒ»ãƒžã‚¯ãƒ‰ãƒŠãƒ«ãƒ‰ link=topic=4587.msg199582#msg199582 date=1452390458]<br />[quote author=Spoink link=topic=4587.msg199581#msg199581 date=1452377015]<br />Why is the word fuck censored?<br /><br />#probablygonnagetbannedforbypassingthefilters<br />[/quote]<br />[something tells me you don&#039;t know how to play this game]<br /><br /><br />GIT GUD OMFG YOU FUCKNG CASUAL, IF YOU CAN&#039;T L-CANCEL, WAVEDASH, SHINE CANCEL INTO WAVEDASH, AND DI OUT OF COMBOS GO DROWN IN MAPLE SYRUP<br />[/quote]<br />IF YOU CAN&#039;T MANIPULATE OPPOSING AI TO SUICIDE THEMSELVES YOU HAVE TO BE STANGLED BY YOUR OWN GAMECUBE CONTROLLER YOU F**KING, FILTHY, WORTHLESS CASUAL<br /><br /><br />No, I won&#039;t consider starting a new topic.<br /> 8)<br />F**K YEAH.


subject: Re: Belated hello
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=7566.msg201018#msg201018 date=1469227441]<br />All hail the Legendary 8F and his follower, the Coin Case.<br />If you&#039;re in ACE things, there is 3rd gen ACE currently getting the final polishes<br />[/quote]<br /><br />All hail the Legendary Massive Exploit Chain.


subject: Game Genie codes for changing a PokÃ©mon's PokÃ©dex number
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As Crystal_&#039;s Youtube video demonstrates, with ROM hacking, you can change a PokÃ©mon&#039;s PokÃ©dex number to beyond 151 to access them as glitch PokÃ©mon, or access glitch PokÃ©mon families not found in English Red/Blue/Yellow, such as 235 (0xEB), 249 (0xF9):<br /><br />[youtube]https://www.youtube.com/watch?v=oPiPOkbs50s[/youtube]<br /><br />The PokÃ©dex order is stored beginning at 0x41024 in Red/Blue or 0x410B1 in Yellow (both bank 10). The first entry is 0x70 and the second entry is 0x73. This means that Rhydon; the PokÃ©mon with index number 0x01 is 112 (0x70) in the PokÃ©dex and Kangaskhan; the PokÃ©mon with index number 0x02 is 115 (0x73) in the PokÃ©dex.<br /><br />I&#039;ve created Game Genie codes that change Pidgey and Rattata for this per request.<br /><br />Pidgey:<br /><br />Red/Blue: XX0-47A-A2A<br />Yellow: XX0-D4A-A2A<br /><br />Rattata:<br /><br />Red/Blue: XX0-C8A-A26<br />Yellow: XX1-55A-A26<br /><br />Replace XX with the new PokÃ©dex number you want, converted into hexadecimal.<br /><br />Rattata as No. 238 in Red:<br />[img]http://i1271.photobucket.com/albums/jj640/Torchickens/No.%20238.png[/img]<br /><br />Rattata as No. 238 in Yellow:<br />[img]http://i1271.photobucket.com/albums/jj640/Torchickens/No.%20238%20Y.png[/img]


subject: Re: Flame War
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  GO TAKE YOUR CENSORSHIP AND SHOVE IT UP YOUR UGLY DISEASED ROTTING ASSHOLE YOU WORTHLESS EUROPOOR JESUS FUCKING CHRIST


subject: Re: Not related to ping.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Belated welcome ISSOtm. ^_^ That&#039;s neat that you code things on the TI-83 calculators, I think that Sherkel (formally Guy/Tombstoner) also used to be into it.<br /><br />[quote author=ISSOtm link=topic=7567.msg201022#msg201022 date=1469241919]<br />Well, now this topic exists. I may have sequence broken it, but isn&#039;t that the spirit ? ;D<br />[/quote]<br /><br />DÍœÌ§ÍˆÍ•Ì˜Ì³Ì¬Ì¹eÌ¢Í˜Í‡Ì¹Í–Í‰fÍ˜Ì¼Ì™Ì£Í‡iÌ§Ì¡Ì¦Ì¹Ì»Ì±Í–nÍžÌ—Í”ÌÌ™Í‰Ì³iÍÌ·Í•ÌÍŽtÌ·Ì¦Í™Í•ÌœÌÍ”ÌºÌžÌ¥eÍÍ€Í–Ì™lÍ¢ÌºÌ–ÌºÍ‰Ì™yÍœÌ¸ÌµÍ“Ì²Í‰<br />


subject: Any way to disable encounters in any other Pokemon game other than Gen1?
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Title. <br /><br />Just have been wondering if there is a way to disable encounters in any future generations. All I know about that is that in Generation 2 if you don&#039;t have any Pokemon you can skip the battles, but how would you get past the little girl in New Bark Town?<br /><br />


subject: Re: Any way to disable encounters in any other Pokemon game other than Gen1?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=ravioli link=topic=7569.msg201029#msg201029 date=1469308655]<br />Title. <br /><br />Just have been wondering if there is a way to disable encounters in any future generations. All I know about that is that in Generation 2 if you don&#039;t have any Pokemon you can skip the battles, but how would you get past the little girl in New Bark Town?<br />[/quote]<br /><br />Indeed :), with the bad clone glitch or [url=https://www.youtube.com/watch?v=DJ3nK2iQo8c]Coin Case arbitrary code execution[/url], we can obtain a ????? (FF).<br /><br />To obtain a bad clone, I believe you must deposit more PokÃ©mon in a box you have ever used (at least five) and then turn the power off a split second after the Yes/No box disappears (Gold) or the &quot;SAVING... DON&#039;T TURN OFF THE POWER.&quot; after it is fully printed (Crystal). If you are playing on PokÃ©mon Stadium 2&#039;s GB Tower, you can reset the game when it says &quot;Saving...&quot; below the Game Boy screen. Once you have the bad clone (which should be level 0), withdraw it and take it into the Day Care to stabilize it, and if it is a &#039;bad clone&#039; it will become a ????? (00).<br /><br />To convert this glitch PokÃ©mon into a ????? (FF), put it in slot 2 and use move PokÃ©mon w/o mail to put a PokÃ©mon in slot 1 to obtain 7 PokÃ©mon. Take the ????? (00) into Day Care and out again, and you will receive ????? (FF); provided you deposit PokÃ©mon to make room for it.<br /><br />Then, once you have a ????? (FF), faint it, put it to the top of the party and faint all your other PokÃ©mon below it. When you white out your PokÃ©mon will not have been healed and you can disable encounters with the skip battle effect you mentioned. Ideally you can teach one of your party PokÃ©mon Fly so you can travel across Johto and Kanto.<br /><br />[youtube]https://www.youtube.com/watch?v=N4lDt9j4z6E[/youtube]


subject: Re: Swift (Speed Star) in Japanese 1st Gen
poster_name: IceFlame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Torchickens, thanks for testing, and nice video!<br /><br />It was actually the red versions that I analyzed the code: English Red (PokeRed annotated disassembly) compared with Aka (Rev A).<br />After that, I tested with Yellow, mostly for the convenience of using my own saved games. If the results had turned out different from my Red-based predictions, I would have tested Red too.<br /><br />The other moves described as &quot;highly accurate&quot; in Stadium are fair enough, but to write that for a 85% move must be a mistake.<br /><br />[quote=&quot;DoubleATam on Youtube&quot;]how<br />how does one bug an effect to only happen when your foe has a substituteï»¿[/quote]<br />[quote=&quot;The 64th Shadow&quot;]<br />placing one line of code before another.ï»¿[/quote]<br /><br />Pretty much. This seems to be what it&#039;s doing in the code I linked earlier:<br /><br />[code]<br />#Japanese<br />if target has a sub:<br />&nbsp; &nbsp; load the move effect<br />&nbsp; &nbsp; if it&#039;s the Swift Effect:<br />&nbsp; &nbsp; &nbsp; &nbsp; the move hits<br />&nbsp; &nbsp; if it&#039;s the Drain HP Effect:<br />&nbsp; &nbsp; &nbsp; &nbsp; the move misses<br />&nbsp; &nbsp; if it&#039;s the Dream Eater Effect:<br />&nbsp; &nbsp; &nbsp; &nbsp; the move misses<br /><br />#English<br />load the move effect<br />if it&#039;s the Swift Effect:<br />&nbsp; &nbsp; the move hits<br />if target has a sub:<br />&nbsp; &nbsp; #the sub checking routine overwrites the move effect we loaded earlier<br />&nbsp; &nbsp; if it&#039;s the Drain HP Effect:<br />&nbsp; &nbsp; &nbsp; &nbsp; #this cannot happen<br />&nbsp; &nbsp; &nbsp; &nbsp; the move misses<br />&nbsp; &nbsp; if it&#039;s the Dream Eater Effect:<br />&nbsp; &nbsp; &nbsp; &nbsp; #this cannot happen<br />&nbsp; &nbsp; &nbsp; &nbsp; the move misses<br />[/code]<br /><br />I reckon the intention was to have drain moves miss against subs, and Swift always hit. That&#039;s what happens in 2nd Gen. But in Japanese 1st Gen, they seem to have put the Swift check below the sub check by accident. And in English 1st Gen, they tried to fix that by moving the Swift check above the sub check, but didn&#039;t notice they needed to load the move effect again, so drain moves can hit subs in the English versions.


subject: Re: Flame War
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  POKE MANGO IS DANAGGREEROUS FROR YOUR KID<br /><br />WATCH THIS REAL PRANK (GONE SEXUAL):<br /><br />https://www.youtube.com/watch?v=L5mcRv8hqu8<br /><br />AS YOU CAN SEE, POKE MANGO IS A DEFINTETY A DEAF SENTENCE


subject: Re: Game Genie codes for changing a PokÃ©mon's PokÃ©dex number
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You might want to link to this: https://docs.google.com/spreadsheets/d/1v81TksEV2Fi90cz1REr0IrMLlxcC3yCMvRg8KzzV2aQ/edit?usp=drive_web&amp;usp=sheets_home&amp;ths=true


subject: Any way to change bike speed using 8F?
poster_name: naf102
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is there any way to change the Bicycle&#039;s speed to light speed? I know the event flag for bike speed is D700 (using the RAM map). My question is how would I alter this using 8F to edit the address?


subject: Re: The &quot;Do something to the next poster&quot; game
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Idk what that is.<br /><br />Next poster gets on my mixtape featuring DJ Khaled, Jones BBQ Foot Massage and other memes.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m always paranoid so I put the letter a in my CtrlV.<br /><br />https://docs.google.com/spreadsheets/d/1v81TksEV2Fi90cz1REr0IrMLlxcC3yCMvRg8KzzV2aQ/edit?usp=drive_web&amp;usp=sheets_home&amp;ths=true<br /><br />Now is not one of those times.


subject: Re: Invalid sound banks examination
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t get why the developers didn&#039;t hook some common code on an RST vector. In Yellow, the address $3E7E is referenced a lot.


subject: Re: Any way to change bike speed using 8F?
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  D700 is actually the flag for what type of transportation you are on. 2 is surfing, 1 is biking, anything else is walking. Using 8F can make it act like a bike this waybut without the music. Also using it inside still won&#039;t let you bike inside.


subject: 30 July 2016 Server Downtime and Migration
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  The server will be down for the weekend of 30 July 2016, for a server migration. Because my host is going to close down the US data center where the server is being hosted, I am required to migrate to one of their European data centers to keep the server running.<br /><br />[quote]From: hosting-en(at)support.gandi.net<br />To: adrian.malacoda(at)member.fsf.org<br />Subject: [GANDI] Action required on your servers hosted in Baltimore<br />Date: Mon, 11 Jul 2016 09:53:42 -0000<br />Content-Type: text/plain; charset=&quot;utf-8&quot;<br />Content-Transfer-Encoding: 8bit<br /><br />Hello Gandi customer,<br /><br />For several years now we have been proud to maintain a datacenter on the<br />East Coast of the United States for Cloud hosting and other hosting<br />services.<br /><br />So itâ€™s with a heavy heart that we must inform you of our decision to<br />close the US datacenter located in Baltimore (US-BA1) on December 1,<br />2016.<br /><br />The decision was not taken lightly, and we only do so in order to be<br />able to concentrate our efforts and commit more resources to pursuing<br />exciting new hosting infrastructure plans which could not be deployed at<br />the Baltimore location, notably due to compatibility issues.<br /><br />On December 1, 2016 all Gandi Cloud services (servers, disks, snapshots,<br />web accelerators, private networks, IP addresses, etc.) hosted in our<br />Baltimore datacenter will be permanently deleted. The credits that were<br />not consumed, however, will remain available in your account.<br /><br />As such, we are also writing to tell you that we hope that you will take<br />this opportunity to migrate your servers to one of our European data<br />centers: LU-BI1, located in Bissen in Luxembourg or FR-SD2, located in<br />Paris, France.<br /><br />We are acutely aware of the impact this decision might have on your<br />operations and we would like to make it as smooth as possible to migrate<br />your services.<br /><br />To that end, we would like you to have the promo code below for 150,000<br />hosting credits, which will allow you to recreate your servers for free<br />in one of the European datacenters:<br /><br />[****]<br /><br />Please note, however, that this promo code is valid through December<br />31st, 2016.<br /><br />Once youâ€™ve gotten set up in one of European datacenters, we encourage<br />you to follow our detailed migration guide available here:<br /><br />https: //wiki(dot)gandi.net/en/iaas/tutorials/datacenter-migration<br /><br />As indicated in the migration guide, updating your DNS zone file is one<br />of the most important steps in the migration process.<br />- If you use Gandiâ€™s DNS for your domain(s), you can make these updates<br />directly from your resource management page.<br />- If you use another provider, you can use the information provided on<br />the resource management page to make these changes in your DNS<br />providerâ€™s interface<br /><br />And of course if you need additional help, our hosting support agents<br />are ready to help. You can reach them<br /><br />- by email using the contact form here:<br />https:// www(dot)gandi(dot)net/support/contact/mail/<br />- by chat: https:// www(dot)gandi.net/support/livechat<br />- on IRC in the #gandi Freenode channel (irc.freenode.net)<br /><br />Once again, we are sorry for any negative impact our decision to close<br />the Baltimore datacenter may have for you. We hope we can make the<br />transition as smooth as possible, which is why we wanted to give you<br />plenty of time to do it.<br /><br />And finally, of course, all of this is with a view towards devoting more<br />resources to an upcoming hosting infrastructure project we have<br />currently in the works. So stay tuned.<br /><br />Sincerely,<br />Gandi.net[/quote]


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  deb https://deb.nodesource.com/node_5.x jessie main<br />deb-src https://deb.nodesource.com/node_5.x jessie main<br />


subject: Re: 30 July 2016 Server Downtime and Migration
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Abwayax link=topic=7572.msg201042#msg201042 date=1469347735]<br />The server will be down for the weekend of 30 July 2016, for a server migration. Because my host is going to close down the US data center where the server is being hosted, I am required to migrate to one of their European data centers to keep the server running.<br /><br />[quote]From: hosting-en@support.gandi.net<br />To: adrian.malacoda@member.fsf.org<br />Subject: [GANDI] Action required on your servers hosted in Baltimore<br />Date: Mon, 11 Jul 2016 09:53:42 -0000<br />Content-Type: text/plain; charset=&quot;utf-8&quot;<br />Content-Transfer-Encoding: 8bit<br /><br />Hello Gandi customer,<br /><br />For several years now we have been proud to maintain a datacenter on the<br />East Coast of the United States for Cloud hosting and other hosting<br />services.<br /><br />So itâ€™s with a heavy heart that we must inform you of our decision to<br />close the US datacenter located in Baltimore (US-BA1) on December 1,<br />2016.<br /><br />The decision was not taken lightly, and we only do so in order to be<br />able to concentrate our efforts and commit more resources to pursuing<br />exciting new hosting infrastructure plans which could not be deployed at<br />the Baltimore location, notably due to compatibility issues.<br /><br />On December 1, 2016 all Gandi Cloud services (servers, disks, snapshots,<br />web accelerators, private networks, IP addresses, etc.) hosted in our<br />Baltimore datacenter will be permanently deleted. The credits that were<br />not consumed, however, will remain available in your account.<br /><br />As such, we are also writing to tell you that we hope that you will take<br />this opportunity to migrate your servers to one of our European data<br />centers: LU-BI1, located in Bissen in Luxembourg or FR-SD2, located in<br />Paris, France.<br /><br />We are acutely aware of the impact this decision might have on your<br />operations and we would like to make it as smooth as possible to migrate<br />your services.<br /><br />To that end, we would like you to have the promo code below for 150,000<br />hosting credits, which will allow you to recreate your servers for free<br />in one of the European datacenters:<br /><br />[****]<br /><br />Please note, however, that this promo code is valid through December<br />31st, 2016.<br /><br />Once youâ€™ve gotten set up in one of European datacenters, we encourage<br />you to follow our detailed migration guide available here:<br /><br />https://wiki.gandi.net/en/iaas/tutorials/datacenter-migration<br /><br />As indicated in the migration guide, updating your DNS zone file is one<br />of the most important steps in the migration process.<br />- If you use Gandiâ€™s DNS for your domain(s), you can make these updates<br />directly from your resource management page.<br />- If you use another provider, you can use the information provided on<br />the resource management page to make these changes in your DNS<br />providerâ€™s interface<br /><br />And of course if you need additional help, our hosting support agents<br />are ready to help. You can reach them<br /><br />- by email using the contact form here:<br />https://www.gandi.net/support/contact/mail/<br />- by chat: https://www.gandi.net/support/livechat<br />- on IRC in the #gandi Freenode channel (irc.freenode.net)<br /><br />Once again, we are sorry for any negative impact our decision to close<br />the Baltimore datacenter may have for you. We hope we can make the<br />transition as smooth as possible, which is why we wanted to give you<br />plenty of time to do it.<br /><br />And finally, of course, all of this is with a view towards devoting more<br />resources to an upcoming hosting infrastructure project we have<br />currently in the works. So stay tuned.<br /><br />Sincerely,<br />Gandi.net[/quote]<br />[/quote]<br />Could you have a estimate of how long will it be down?


subject: Re: Any way to change bike speed using 8F?
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  In other word, you cannot change the speed.<br /><br /><br /><br /><br /><br /><br />Why don&#039;t you just speed up the game itself?


subject: Re: Invalid sound banks examination
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Gen I programming, man. Gen II uses rst instructions a lot. I guess the devs just did infinitely crappy code &gt;&lt;.<br />This also means the wasted several bytes on bank 0 - the most precious bytes in the entire ROM ! - but heh, they did also waste some RAM bytes while using unimaginable trickery to save others.<br /><br />I don&#039;t think the development of Gen I was taken seriously by the devs. Really.


subject: Re: Need some help on 4 4
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  After knowing it&#039;s invalid sound bank which makes the game crash, and using gameshark to prevent sound banks from ever changing (thanks to TheZZAZZGlitch for giving me these infos :P), I tried out on VBA, and it worked.<br />And the game seems to be quite &quot;normal&quot; afterwards... or not.<br />Hitting FIGHT give us the infamous unknown oppose<br />POKEMON menu is inaccessible and just soft lock your game<br />Item menu, interestingly, didn&#039;t crapped too much at the beginning. But it just get weirder and weirder<br />And using a unknown random item gives us a Christmas-themed crash even its summer [cituation needed]<br />https://youtu.be/wiqosSUVVf8 It&#039;s the video... <br />Is there any, ANY way to end the battle peacefully?<br />


subject: Why does my trainer-fly keep failing?
poster_name: derula
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: derula
icon: xx
body:
  Hi there,<br /><br />I recently purchased PokeÌmon Red on 3DS VC, and am casually glitching it. I looked everywhere, but couldn&#039;t find any documented source stating what I&#039;m doing wrong, so here&#039;s what I am trying to do:<br />[list type=decimal]<br />[li]Using Brock Through Walls, I find a long-range trainer.[/li]<br />[li]I trainer-fly from them using Abra&#039;s teleport. Last PokeÌcenter is the one outside of Mt. Moon.[/li]<br />[li]I defeat a random trainer between the center and Pewter to restore my start menu.[/li]<br />[li]Using Brock Through Walls again, I enter route 25 to encounter the trainer that will make me get Mew.[/li]<br />[li]I growl 6 times with Pikachu, and then let Slowpoke defeat all my PokeÌmon.[/li]<br />[li]After blacking out, I use Brock Through Walls a third time to get back to the route from which I trainer-flew.[/li]<br />[/list]<br /><br />Expected result:<br />[list]<br />[li]I will encounter a Mew level 1.[/li]<br />[/list]<br /><br />Received result:<br />[list]<br />[li]I encounter an apparently non-glitchy Rival battle. He has 4 PokeÌmon, first is level 26 Grimer. I can&#039;t defeat him.[/li]<br />[/list]<br /><br />I tried trainer-flying from two different trainers (routes 8 and 9); identical result. I tried flashing the start menu or encountering a wild PokeÌmon (not sure when to do that; doing it after the trainer on route 25 will get me a different encounter). I believe I tried it with defeating the Slowpoke and got the same thing.<br /><br />Obviously, I&#039;m doing something wrong. But what? Is it because I&#039;m traveling through Cerulean City, where there is an untriggered rival encounter, and this somehow messes up the sequence? I like to use the bicycle during Brock Through Walls because it messes with the music; could that be the reason?<br /><br />I know this is a really old and well-documented glitch, and you&#039;re probably sick of having to explain it to newbies all the time, but I just didn&#039;t find anything regarding my specific setup... or even a hint of a reason why this rival fight could possibly be triggered. Maybe I just didn&#039;t find the right place to look yet. Either way, I would welcome some pointers :&gt;<br /><br />Thanks for our patience!<br /><br /><br />Edit: I should mention, I trigger Brock Through Walls with Squirtle level 9 (special 16) in slot 1 and Pidgey level 3 at full health (15) in slot 2.


subject: Re: Any way to change bike speed using 8F?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s a misindication on DataCrystal, which is not very clear.<br /><br />If you put 01 in $D700, you will get on the bike - but in fact you&#039;ll see the player walking at the speed of the bike, hence the name in DataCrystal, as long as you don&#039;t refresh the screen (open/closing a menu).


subject: Re: Any way to disable encounters in any other Pokemon game other than Gen1?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Just to mention that Coin Case ACE is an English-only glitch. On other games, you can use the TM Code Execution instead. But the Bad Clone method is very cool :)


subject: Re: Game Genie codes for changing a PokÃ©mon's PokÃ©dex number
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7568.msg201035#msg201035 date=1469315961]<br />You might want to link to this: https://docs.google.com/spreadsheets/d/1v81TksEV2Fi90cz1REr0IrMLlxcC3yCMvRg8KzzV2aQ/edit?usp=drive_web&amp;usp=sheets_home&amp;ths=true<br />[/quote]<br /><br />Thanks drc. :)


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: derula
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=xoftware.org link=topic=7554.msg200932#msg200932 date=1468982975]<br />Thanks! Yeah, that one is using the same technique, except he [MrWint] goes a much more difficult [confusing] route. <br />[/quote]<br /><br />Why do you think the TAS route is difficult? The only thing I messed up trying to replicate that initially is that I forgot to enter the random house before starting the glitch, because I can&#039;t read. Other than that, it&#039;s pretty straightforward. You go down and then up again, then enter a door.


subject: Re: Gen 1: Walk through walls to entrance of Indigo Plateau/Victory Road w/o Badges
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The TAS route uses IV manipulation. The unassisted method requires specific PP (see [url=http://glitchcity.info/wiki/index.php/Brock_Through_Walls]the wiki article[/url]).


subject: Re: Why does my trainer-fly keep failing?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t know the explanation for sure, but I can tell you that the Brock Through Walls overwrites large amounts of RAM, so... maybe that is why the encounter is wrong. But I cannot confirm this.


subject: Re: 30 July 2016 Server Downtime and Migration
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No guarantees, but at least all weekend. There will likely be other server maintenance being performed throughout the week as well


subject: Re: Why does my trainer-fly keep failing?
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Have you given this a shot in an emulator? BGB has a RAM viewer you can use to make sure the right values are in place (I [i]believe[/i] the address you need to look at is CFFD).


subject: Re: Why does my trainer-fly keep failing?
poster_name: vowel
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=derula link=topic=7573.msg201050#msg201050 date=1469373049]I defeat a random trainer between the center and Pewter to restore my start menu.[/quote]Don&#039;t do that&nbsp; ;)


subject: Re: Why does my trainer-fly keep failing?
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=vowel link=topic=7573.msg201060#msg201060 date=1469392133]<br />[quote author=derula link=topic=7573.msg201050#msg201050 date=1469373049]I defeat a random trainer between the center and Pewter to restore my start menu.[/quote]Don&#039;t do that&nbsp; ;)<br />[/quote]<br /><br />No, that&#039;s not the issue. You can do that and still change the Pokemon you&#039;ll encounter in a later battle.


subject: Re: Why does my trainer-fly keep failing?
poster_name: derula
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: derula
icon: xx
body:
  [quote author=ISSOtm link=topic=7573.msg201056#msg201056 date=1469385576]<br />I don&#039;t know the explanation for sure, but I can tell you that the Brock Through Walls overwrites large amounts of RAM, so... maybe that is why the encounter is wrong. But I cannot confirm this.<br />[/quote]<br /><br />Hmm, that might indeed be a problem. Interesting though that I consistently get the same encounter.<br /><br />[quote author=vowel link=topic=7573.msg201060#msg201060 date=1469392133]<br />[quote author=derula link=topic=7573.msg201050#msg201050 date=1469373049]I defeat a random trainer between the center and Pewter to restore my start menu.[/quote]Don&#039;t do that&nbsp; ;)<br />[/quote]<br /><br />Well, I need to do that in order to activate Brock Through Walls again... (can&#039;t talk to NPCs while start menu is inactive) but if that causes it to break anyway, then I guess I would have to find another way.<br /><br />[quote author=Aldrasio link=topic=7573.msg201059#msg201059 date=1469391767]<br />Have you given this a shot in an emulator? BGB has a RAM viewer you can use to make sure the right values are in place (I [i]believe[/i] the address you need to look at is CFFD).<br />[/quote]<br /><br />Ah, I might do that just to verify if Brock Through Walls is what breaks it. Thanks.


subject: Re: Invalid sound banks examination
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7548.msg200937#msg200937 date=1468985524]<br />My father asked me why I like watching games go down in a hellish firestorm of [s] f**k injection [/s] corruptions so I exposed him to the harmonious noises of textbox $FE on Route &lt;whatever the hell the route Nugget Bridge is on&gt;. Through his car. At 6 AM. On Volume 99. With my amp as a middleman.<br />[/quote]<br /><br />THE ABSOLUTE MADMAN.<br />H<br />E<br /><br />A<br />B<br />S<br />O<br />L<br />U<br />T<br />E<br /><br />M<br />A<br />D<br />M<br />A<br />N.


subject: Re: Invalid sound banks examination
poster_name: Flandre Scarlet
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7548.msg200937#msg200937 date=1468985524]<br />My father asked me why I like watching games go down in a hellish firestorm of [s] f**k injection [/s] corruptions so I exposed him to the harmonious noises of textbox $FE on Route &lt;whatever the hell the route Nugget Bridge is on&gt;. Through his car. At 6 AM. On Volume 99. With my amp as a middleman.<br />[/quote]<br />What exactly is this and how would I find/recreate it?


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  <br />I did NOT go to EVO thinking that I was going to die. I was told that it was all treatable and that waiting 1 week to get it out was okay. The results are back and im going to be fine, there is nothing to worry about I am not going to die. Now that EVO is over and customs are dead, I can happily retire and continue my life elsewhere as I recover. Besides, it wouldn&#039;t have made a difference, EVO actually pushed my follow-up appointment one week EARLIER, when i found out I HAD the cancer. So one way or another EVO kept my appointment on the same week.


subject: Re: Flame War
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  THAT&#039;s NOT EVEN A FLAME M8<br /><br />DID YOU WALK INTO THE WRONG THREAD WHILE STONED/HALF-ASLEEP/DRUNK/ALL OF THE ABOVE


subject: Re: 30 July 2016 Server Downtime and Migration
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  I guess now&#039;s the time to say the REPLY menu redirects me to a fountain of broken HTML or the Start New Topic form on my DSi.


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7555.msg201039#msg201039 date=1469323073]<br />I wish I could hold select-B in any console and have the entire game be narrated by Joel.<br />[/quote]<br />Yes.<br />(His first PC ran on WIN2K. That&#039;s... bad. Oh... no...


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  popup opens to a weird porn game<br />about to close, hits select+b<br />joel says &quot;alright, today we&#039;re playing... DANIEL, DID YOU DOWNLOAD BOOBS AGAIN?&quot;


subject: Re: Invalid sound banks examination
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Download TheZZAZZGlitch&#039;s debug Yellow hack, grab the debug item from the PC first thing, play until Nigget Bridge, open the debug menu, go to Miscellaneous&gt;Display area TX, change value to $FE, hit A, grab tissues (for ear blood, duh)


subject: Re: Invalid sound banks examination
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Bert link=topic=7548.msg201063#msg201063 date=1469395949]<br />[quote author=Yeniaul link=topic=7548.msg200937#msg200937 date=1468985524]<br />My father asked me why I like watching games go down in a hellish firestorm of [s] f**k injection [/s] corruptions so I exposed him to the harmonious noises of textbox $FE on Route &lt;whatever the hell the route Nugget Bridge is on&gt;. Through his car. At 6 AM. On Volume 99. With my amp as a middleman.<br />[/quote]<br /><br />THE ABSOLUTE MADMAN.<br />H<br />E<br /><br />A<br />B<br />S<br />O<br />L<br />U<br />T<br />E<br /><br />M<br />A<br />D<br />M<br />A<br />N.<br />[/quote]<br />Well, I certainly try... He deserved it. He flipped my PC&#039;s breaker OFF at the exact moment I was saving. And too early, so it wouldn&#039;t work right.


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  &quot;Dad&#039;s gonna be SO MAD when he finds out.&quot;<br /><br />&quot;Joel! Joel, have you been downloading porn again? I know what you&#039;re doing, Joel!&quot;


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7555.msg201068#msg201068 date=1469402364]<br />[quote author=drc link=topic=7555.msg201039#msg201039 date=1469323073]<br />I wish I could hold select-B in any console and have the entire game be narrated by Joel.<br />[/quote]<br />Yes.<br />(His first PC ran on WIN2K. That&#039;s... bad. Oh... no...<br />[/quote]<br /><br />What&#039;s wrong with win2k? It was a stable OS for its day.


subject: Re: Invalid sound banks examination
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7548.msg201070#msg201070 date=1469406059]<br />Download TheZZAZZGlitch&#039;s debug Yellow hack, grab the debug item from the PC first thing, play until Nigget Bridge, open the debug menu, go to Miscellaneous&gt;Display area TX, change value to $FE, hit A, grab tissues (for ear blood, duh)<br />[/quote]i record videos with sound off, so I&#039;ll never get ear rape BUT I could record the audio :3


subject: Re: Flame War
poster_name: tachi
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  AT LEAST HIS SPAM VIDEO POST WAS AN ACTUAL INSULT TO MY INTELLIGENCE COMPARED TO THE SLIGHTLY NEGATIVE COMPLIMENTS YOU&#039;VE BEEN SHELLING OUT.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  Something occurred to me today: Creating a bootstrapping program that takes input from the Gameboy&#039;s serial port would be both short to write with items and pretty fast to execute, assuming you had something specifically designed for it attached to the serial port. You could probably make a simple datalink device with an Arduino or something. Has anyone tried this?


subject: Re: Why does my trainer-fly keep failing?
poster_name: derula
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7573.msg201076#msg201076 date=1469423946]<br />Did you flash the Start menu before entering the route?<br />[/quote]<br /><br />I did.


subject: Re: Why does my trainer-fly keep failing?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=derula link=topic=7573.msg201062#msg201062 date=1469393929]<br />[quote author=ISSOtm link=topic=7573.msg201056#msg201056 date=1469385576]<br />I don&#039;t know the explanation for sure, but I can tell you that the Brock Through Walls overwrites large amounts of RAM, so... maybe that is why the encounter is wrong. But I cannot confirm this.<br />[/quote]<br /><br />Hmm, that might indeed be a problem. Interesting though that I consistently get the same encounter.<br />[/quote]<br />I am almost certain that Brock Through Walls writes a large portion of ROM (which is constant) to RAM, so this would make sense as for the consistency of your encounters. It&#039;s not the only explanation that satisfies this consistency, though ;)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, but that TAS&#039;s bootstrapper uses the 8 buttons on the Gameboy as 8 bits for input, and it just reads an input each frame. Best you can do with that is 60B/s. With the serial port, if you use the internal clock at its lowest setting you get 1024B/s.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  2:48 is CGOL<br />2:54 is foreshadowing<br /><br />And I know 60(+8 or something idkaidc) digits of pi


subject: Generation 1 immunities
poster_name: iamnguyen
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I notice that non-damaging moves in generation 1 can affect the type that has immunity. For example, tail whip can lower ghost-type&#039;s defense. Confuse ray can cause confusion in psychic type. I have been told that thunder wave cannot affect ground type. I haven&#039;t tested this, but will anyone please explain this exception?


subject: Re: Favorite PokÃ©mon
poster_name: TMTRAINER
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Non-Legendary: Shuckle; both for the meme, it&#039;s uniqueness, and it&#039;s usefulness. Typhlosion is a close second.<br /><br />Legendary: I love the design of Zygarde (specifically what they put out for the Cell, Core, 10%, 50%, and complete forms). Zygarde overtook Lugia for me, but it&#039;s another close call.


subject: Generation I move effects 4A and 4B
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  On The Cutting Room Floor on [url=https://tcrf.net/Pok%C3%A9mon_Red_and_Blue/Unused_Move_Data#Unused Effects]the unused move data sub-page[/url], there are entries on the unused move effect section for move 4A: &quot;10.2% chance of lowering a non-existent glitch stat by 1 stage, which effectively does nothing.&quot; and 4B: &quot;10.2% chance of lowering a non-existent glitch stat by 1 stage, which effectively does nothing.&quot;<br /><br />Is this behaviour due to a glitch or was another stat (such as Special Defense) initially planned in PokÃ©mon RBY?


subject: Re: Generation I move effects 4A and 4B
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s unclear whether this was supposed to be intended behavior or not. Here is a part of the move effect table:<br /><br />[tt]dw PayDayEffect&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; PAY_DAY_EFFECT<br />dw $0000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ; SWIFT_EFFECT<br />[b]dw StatModifierDownEffect&nbsp; &nbsp; ; ATTACK_DOWN_SIDE_EFFECT<br />dw StatModifierDownEffect&nbsp; &nbsp; ; DEFENSE_DOWN_SIDE_EFFECT<br />dw StatModifierDownEffect&nbsp; &nbsp; ; SPEED_DOWN_SIDE_EFFECT<br />dw StatModifierDownEffect&nbsp; &nbsp; ; SPECIAL_DOWN_SIDE_EFFECT<br />dw StatModifierDownEffect&nbsp; &nbsp; ; unused effect (0x48)<br />dw StatModifierDownEffect&nbsp; &nbsp; ; unused effect (0x49)<br />dw StatModifierDownEffect&nbsp; &nbsp; ; unused effect (0x4A)<br />dw StatModifierDownEffect&nbsp; &nbsp; ; unused effect (0x4B)[/b]<br />dw ConfusionSideEffect&nbsp; &nbsp; &nbsp;  ; CONFUSION_SIDE_EFFECT<br />dw TwoToFiveAttacksEffect&nbsp; &nbsp; ; TWINEEDLE_EFFECT<br />dw $0000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ; unused effect[/tt]<br /><br />The pointers for those glitch effects do not come from any out of bounds data - the programmers who created this table explicitly added 8 effects responsible for lowering stats. The remaining two entries in the table ended up as placeholders. So there might have been plans for extra two stats in the game (Special Attack and Special Defense?). However, there are no corresponding unused entries for other stat-related effects (lowering by 2 stages, raising by 1 stage, raising by 2 stages).<br /><br />The actual behavior of the effects looks glitchy because the stat names are taken from an out of bounds location. But in fact, aside from the glitchy message, the subroutines responsible for handling stat changes are properly adapted to work with stat indices from 0 to 7.<br />Interestingly enough, two bytes in RAM located right after the stat changes table are unused, as if there&#039;s actually space reserved for two additional stats. <br /><br />As it stands, all of this could still be accidental. There&#039;s no conclusive proof that the two mysterious unused stats were actually intended to be used.


subject: Re: Generation I move effects 4A and 4B
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I see, interesting. Thanks a lot for the information TheZZAZZGlitch! It would have been nice if Special Attack and Special Defense made it to Generation I, although I wonder if that would end up nerfing PokÃ©mon like Chansey, Gengar.


subject: Re: English R/B/Y equivalent of Dokokashira door glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The reason why DDG exists in JP versions is chance : the poison routine is confused, and, by chance, the memory addresses concerned by door warping data match to PokÃ©mon #Idontknowwhichone &#039;s HP, and by chance this &quot;PokÃ©mon&quot; is poisoned.<br /><br />This &quot;PokÃ©mon&quot; just isn&#039;t poisoned in localizations.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Isaac356
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi,<br /><br />I&#039;m new here having only recently gotten into PokÃ©mon glitching, but like many others I was frustrated with trying to use the giant image to find the PokÃ©mon that I wanted, so I took it upon myself to create this: [url=https://www.exocron.me/tfly]https://www.exocron.me/tfly[/url]<br /><br />Simply choose the PokÃ©mon that you want in the dropdown box and the page will list out all the trainers that you can obtain them from, as well as what PokÃ©mon in their party is the one that yields the necessary special stat, and what route/gym/other place they are located in. It&#039;s currently very ugly (think early alpha) and only gives a general idea of the trainer&#039;s location, but it does work, and since I&#039;ve already found it helpful I figured I&#039;d throw it out there now and improve it over time. I parsed all the necessary data from the PokÃ©mon Red disassembly ([url=https://github.com/pret/pokered]https://github.com/pret/pokered[/url]) and the few trainers that I manually verified were correct, but some data is linked up incorrectly (in particular, the Rival data), which I&#039;ll need to fix up manually over time.<br /><br />In addition, if any web designers that are watching this thread want to fork the project and pretty it up, it would be much appreciated.&nbsp; ;D<br /><br />[quote author=Aldrasio link=topic=6638.msg201083#msg201083 date=1469475294]<br />Something occurred to me today: Creating a bootstrapping program that takes input from the Gameboy&#039;s serial port would be both short to write with items and pretty fast to execute, assuming you had something specifically designed for it attached to the serial port. You could probably make a simple datalink device with an Arduino or something. Has anyone tried this?<br />[/quote]<br /><br />Not exactly the same thing, but very similar, someone buffer overflowed the Cable Club and ran some shellcode that way: [youtube]https://www.youtube.com/watch?v=m3e_SyhE3xc[/youtube]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Welcome Isaac356! This is the wrong topic for your site, but it should come in handy for some people!<br /><br />I noticed on your site it says &quot;undefined&quot; for some PokÃ©mon (e.g. Marowak and B7). I don&#039;t know why that happens


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Isaac356
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=6638.msg201102#msg201102 date=1469676266]<br />I noticed on your site it says &quot;undefined&quot; for some PokÃ©mon (e.g. Marowak and B7). I don&#039;t know why that happens<br />[/quote]<br /><br />There are quite a few trainer party entries that don&#039;t have any actual map objects linked to them (i.e. Professor Oak). In addition, the rival&#039;s entries don&#039;t appear to be linked at all (except for the first one - the level 5 starter - in two different places), but I presume that is because the game handles him differently (doesn&#039;t show up on map after completion; party data depends on starter choice). For Oak and the rival, I&#039;ll be able to designate those separately (they&#039;re labeled in the disassembly, and the rival only shows up in a few places so I can mark those down manually), but for the others, I won&#039;t know if they&#039;re unused data or if Game Freak just pulled some shenanigans (the code is filled with interesting one-off situations that don&#039;t match up to the rest of the game, so it&#039;s possible that the scripts I wrote to parse the data and re-structure it just missed something).<br /><br />TL;DR - Probably glitch trainers or rival. I&#039;m leaving them in for now, but I&#039;ll be sure to make it more clear what&#039;s going on in the future (maybe hide them behind an &quot;Include glitch trainers&quot; checkbox).<br /><br />At some point, I&#039;m hoping to screen shot all the maps, so hopefully by then I&#039;ll notice if the trainer count doesn&#039;t match up.<br /><br />[quote author=drc link=topic=6638.msg201102#msg201102 date=1469676266]<br />Welcome Isaac356! This is the wrong topic for your site, but it should come in handy for some people!<br />[/quote]<br /><br />Yeah, now that I think about it, it probably is. Sorry about that. I was just following the thread since I was starting the arbitrary code execution stuff, and I got too excited about this project.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheZZAZZGlitch
icon: xx
body:
  The same method of arbitrary code execution through the link cable is possible in Gen II. This (similarly to the Gen I version) works by overflowing the trade partner Pokemon list and overwriting a return address on the stack.<br /><br />https://www.youtube.com/watch?v=e8CO_e_rKd8<br /><br />There is also a writeup about the Gen I link cable exploit, so if you want to know exactly how this works, visit: http://vaguilar.js.org/posts/1/<br />The process is pretty much the same for Gen II.


subject: Re: Another Crystal Disassembly?
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Investing a little bit of time in learning how to effectively use tools like git grep and symfiles makes a big difference.


subject: Re: Emulating the Mobile Adapter GB
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7509.msg200525#msg200525 date=1465883166]<br />Itâ€™s been over fifteen years and no one has done this yet?<br />[/quote]<br />No, but itâ€™s about time someone did. Great post.


subject: Re: English R/B/Y equivalent of Dokokashira door glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  There is actually a lot of things you can do with the English DKD, including warping to anywhere. See this thread : http://forums.glitchcity.info/index.php/topic,7398.0.html


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheZZAZZGlitch link=topic=6638.msg201104#msg201104 date=1469688869]There is also a writeup about the Gen I link cable exploit, so if you want to know exactly how this works, visit: http://vaguilar.js.org/posts/1/<br />The process is pretty much the same for Gen II.<br />[/quote]<br /><br />Thanks, this is exactly what I was looking for! I kind of want to use this method to dump or load SRAM data to physical carts. On a DMG I think it would take a bit more than 30 seconds to funnel all of SRAM through the serial port, but I admit I&#039;ve never really coded for serial communication. And hey, if that works, just for lolz I could probably dump the whole ROM through the serial port.


subject: Re: English R/B/Y equivalent of Dokokashira door glitch
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=6661.msg201107#msg201107 date=1469695934]<br />There is actually a lot of things you can do with the English DKD, including warping to anywhere. See this thread : http://forums.glitchcity.info/index.php/topic,7398.0.html<br />[/quote]<br />Yeah, I&#039;ve looked everywhere for the subroutine that sets CC35 to 0, i&#039;ve never found it.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Welcome to the forums Isaac356! :)<br /><br />Thanks for the amazing Trainer-Fly database. Is it all right if I link to it on the wiki sidebar?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Isaac356 link=topic=6638.msg201111#msg201111 date=1469736342]<br />Thanks Torchickens! It would absolutely be all right if you linked it, and that would be awesome!<br />[/quote]<br /><br />All right then, cool! I&#039;ve gone ahead and added it to the sidebar. ^_^


subject: Re: English R/B/Y equivalent of Dokokashira door glitch
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=6661.msg201109#msg201109 date=1469719820]<br />[quote author=Krys3000 link=topic=6661.msg201107#msg201107 date=1469695934]<br />There is actually a lot of things you can do with the English DKD, including warping to anywhere. See this thread : http://forums.glitchcity.info/index.php/topic,7398.0.html<br />[/quote]<br />Yeah, I&#039;ve looked everywhere for the subroutine that sets CC35 to 0, i&#039;ve never found it.<br />[/quote]<br />Try placing a read watchpoint on this address in BGB ?


subject: Re: I wish my &lt;DS/DSi/3DS&gt; could...
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7555.msg200941#msg200941 date=1468998408]<br />So this isn&#039;t really a forum game, then, but just a discussion on a particular family of consoles.<br /><br />Also I wish my 3DS gave me the ability to kill myself.<br />[/quote]<br />Sounds like a misfeature. I would much rather have the ability to kill [i]other[/i] people.


subject: Re: 30 July 2016 Server Downtime and Migration
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7572.msg201116#msg201116 date=1469825537]<br />I&#039;m pretty sure you just leaked your name in that first post.<br />[/quote]<br />AND an email address... not that it matters...


subject: Data injection via Link Cable in Gen 1
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  [url=http://vaguilar.js.org/posts/1/]This project[/url] worked as a proof of concept that you could do ACE using a buffer overflow in R/B. I decided to take that a step further. <br /><br />I designed a payload that allows you to dump an arbitrary amount of data to anywhere in the RAM, and then jump to it. I&#039;m still playing with the possibilities, but the payload wouldn&#039;t need a whole lot of modification to work as an SRAM dumper. The payload is as follows:<br /><br />[code]F3 F0 44 FE 90 38 FA F0 40 E6 7F E0 40 1E 02 16 <br />02 3E 81 E0 02 F0 02 E6 80 20 FA F0 01 15 28 03 <br />4F 18 EE 47 C5 1D 20 E7 0E 80 21 10 C6 2A E2 0C <br />2A A7 0D 0A 20 FA C1 E1 E5 C3 80 FF 3E 81 E0 02 <br />F0 02 E6 80 20 FA F0 01 22 0B 78 B1 20 EE C9 [/code]<br /><br />[code]	di<br />.displayloop<br />	ld a, [$ff44]<br />	cp $90<br />	jr c, .displayloop<br />	ld a, [$ff40]<br />	and $7f<br />	ld [$ff40], a<br />	<br />	ld e, 2<br />.read2bytes<br />	ld d, 2<br />.read<br />	ld a, $81<br />	ld [$ff02], a<br />.waitloop1<br />	ld a, [$ff02]<br />	and $80<br />	jr nz, .waitloop1<br />	ld a, [$ff01]<br />	dec d<br />	jr z, .next<br />	ld c, a<br />	jr .read<br />.next<br />	ld b, a<br />	push bc<br />	dec e<br />	jr nz, .read2bytes<br />	ld c, $80<br />	ld hl, .hramdata&nbsp; &nbsp; &nbsp; ; $C610<br />	ld a, [hli]<br />.loop<br />	ld [c], a<br />	inc c<br />	ld a, [hli]<br />	and a<br />	jr nz, .loop<br />	pop bc<br />	pop hl<br />	push hl<br />	jp $ff80<br /><br />.hramdata<br />	ld a, $81<br />	ld [$ff02], a<br />.waitloop2<br />	ld a, [$ff02]<br />	and $80<br />	jr nz, .waitloop2<br />	ld a, [$ff01]<br />	ld [hli], a<br />	dec bc<br />	ld a, b<br />	or c<br />	jr nz, .hramdata<br />	ret<br />	nop[/code]<br /><br />A little sloppy, but I was going for brevity. The nop at the end is important.<br /><br />The way this payload works is that once the initial buffer overflow is finished, it disables interrupts (since I don&#039;t have control over interrupt vectors) and then disables the screen (seemed like a good idea). Then it takes 2 sets of 2 bytes and pushes them to the stack. The first set of 2 bytes is the starting address for the next wave of data. The second set of 2 bytes is the length of the data. Both sets are little-endian.<br /><br />Once it has those values, it copies everything from &quot;.hramdata&quot; to the nop to HRAM, where OAM code usually sits. Then it jumps to $ff80. Once it&#039;s at $ff80, it can start loading data from the serial port to any part of the RAM (except, in this case, SRAM. SRAM was not enabled as part of the payload). Once it&#039;s reached the end of the final payload, it jumps to the starting address from the beginning of the payload.<br /><br />The main reason I went ahead and coded a different serial data receiver than the one on the cart is because the one on the cart is designed to run alongside the rest of the game, so it&#039;s going to be slower if you want to send a lot of data. With the barebones receiver coded here, you can send arbitrary data over more quickly, although the Gameboy will have no way of responding if anything goes wrong.<br /><br />I haven&#039;t tried this on hardware, and I&#039;m still playing with the possibilities, but as it stands you can load an arbitrarily-sized program into RAM with this method.


subject: Re: Data injection via Link Cable in Gen 1
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  Basically, an interrupt is something that the CPU reacts to something outside of the code it&#039;s currently executing. This causes the program counter to effectively call an interrupt vector (in the home bank at $0040,$0048,$0050,$0058, and $0060). For example, if the Joypad interrupt is enabled, then when any button is pressed the Program Counter will immediately jump to $0060, regardless of what it was doing before (in the case of RBY, this isn&#039;t a huge deal, since the only thing at $0060 is a RETI command). More on interrupts [url=http://bgb.bircd.org/pandocs.htm#interrupts]here.[/url]<br /><br />Disabling interrupts means that the code will execute as written, without anything like that happening. It&#039;s more a precaution than anything.


subject: Re: Data injection via Link Cable in Gen 1
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: TheUnReturned
icon: xx
body:
  It&#039;s a interesting way, but it&#039;ll be quite difficult to set this up...<br /><br /><br /><br /><br /><br /><br /><br /><br />However, could this possibly corrupt the save data by accident?


subject: Re: 30 July 2016 Server Downtime and Migration
poster_name: TheUnReturned
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Today is the day.... Uhh...[quote author=drc link=topic=7572.msg201049#msg201049 date=1469369665]<br />That&#039;s my birthday.<br />[/quote] Happy brithday!


subject: Re: 30 July 2016 Server Downtime and Migration
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=TheUnReturned link=topic=7572.msg201122#msg201122 date=1469847704]<br />Today is the day.... Uhh...[quote author=drc link=topic=7572.msg201049#msg201049 date=1469369665]<br />That&#039;s my birthday.<br />[/quote] Happy brithday!<br />[/quote]<br />Only 11 PM here. Thanks anyway!


subject: Re: Glitch-Inspired Music
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Sorry about not having news, but work&#039;s getting hard. I&#039;m on watch nearly 24/7 at the security firm&#039;s St. Louis client building. They&#039;re paying triple, but it&#039;s still harsh. Sleep, and all.


subject: Re: 30 July 2016 Server Downtime and Migration
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  Either I was reading the Pan Docs for GB/GBC/GBA while the transfer was occuring, or it&#039;s not happened yet, and it&#039;s 00:41 Central, so...


subject: And we're back!
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It took longer than I wanted to, but we are [b]finally back online[/b].<br /><br />Along with the server migration, some infrastructure changes were made which should make the site run better and also make it easier to develop. These were changes I had been wanting to make for a while and figured with the server migration this was a perfect time to leave the legacy infrastructure behind and start anew.<br /><br />[b]Updates made[/b]: <br />- MediaWiki updated to 1.27. This necessitated a lot of changes to some of the extensions and the skin (we really haven&#039;t been doing updates as often as we should...)<br />- SMF updated to 2.0.11. The existing SMF codebase has been wiped, sans themes. Any mods that were installed on the old one will be re-installed, and then integrated into the codebase.<br />- -Dex extension (&quot;Professor Glitch&#039;s Super Awesome Extension&quot;) fixed up so it renders things properly.<br /><br />[b]Technical changes[/b]:<br />- GCL now runs as a self-contained web application inside a Docker container, using php5-fpm + nginx. The front-end webserver runs nginx proxying into this application. All of the code for this application is available on our self-hosted GitLab instance at https://gitlab.monarch-pass.net/glitch-city-laboratories/glitch-city-laboratories.<br />-- Previously the front-end server was an Apache instance which ran GCL and some other sites under mod_php.<br /><br />The other bugs which are known about have still not been fixed yet, but I wanted to get this version of GCL back online before tackling them. This setup allows me to have a development environment where changes can be made and tested before being pushed to production.


subject: Re: And we're back!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Great we&#039;re back! :)<br /><br />I understand you&#039;re busy but have a couple of questions and a suggestion, you know how the GlitchDex and ItemDex have a &quot;([[ItemDex|â†‘ Back to the ItemDex index]].)&quot; option? I modified the pages to have this when the extension wasn&#039;t working and have now made them pages like the other database entries, but the contents pages still say this.<br /><br />1) Will the entries for the names of things on the GlitchDex, AttackDex and ItemDex eventually update or do you have to update them by another means?<br /><br />2) Is it possible to add links and images on the database entries (like RB:191 could link to Trainer escape glitch, or glitch PokÃ©mon front sprites and backsprites)?<br /><br />Suggestion: Can you add a criteria for Time Capsule Exploit/Johto guard glitch learned moves please?<br /><br />Thanks!


subject: Does the Slow Start glitch exist?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  A source (Smogon I believe) claimed that in the Japanese versions of Diamond and Pearl if Regigigas loses its Slow Start ability then the Attack and Speed drops aren&#039;t lost.<br /><br />However, I tried the glitch with a Cherrim with Worry Seed and Regigigas so that Regigigas would be slower if Slow Start was active or faster if Slow Start wasn&#039;t active and it started to outspeed Cherrim after Worry Seed as if the Speed drop was lost.<br /><br />Does the glitch actually exist in Japanese Diamond and Pearl or is there a hidden detail that I&#039;m missing? I would love to check if it&#039;s possible to desync a link battle between Japanese/English Diamond and Pearl if it exists (though it&#039;d probably result in a communication error).<br /><br />Video of Slow Start glitch not working:<br />https://www.youtube.com/watch?v=yySX9Umx44Q&amp;feature=youtu.be - With Regigigas as the leading PokÃ©mon<br />https://www.youtube.com/watch?v=w7rGHQSQSyc&amp;feature=youtu.be - Switching into Regigigas


subject: Re: And we're back!
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Eventually the extension will be dropped and replaced with [url=https://gitlab.monarch-pass.net/glitch-city-laboratories/professor-glitch]something better[/url], but for now I wanted to fix it up so it works properly again. Some of the entries have been hand-converted into proper pages or formatted, and the &quot;back to the index&quot; link confuses the parser into thinking that&#039;s the name of the PokÃ©mon/item/attack since the parser expects the first line to be the name. Removing that [i]should[/i] update the name shown on the index (that&#039;s the intention)... but no guarantees, as the extension is not as &quot;super awesome&quot; as it claims to be!<br /><br />The new extension will use MediaWiki&#039;s template syntax which will more easily allow for things like wikilinks and images. The intention will be to keep the things the extension brings like separation of markup from data, and the ability to sort and (eventually...) filter the index, while being allowed to freely use native wiki code.


subject: Re: Posting really slow?
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t know if it&#039;s my imagination, but the site seems much faster following the migration. Part of that might be due to the new server having increased RAM, but also due to infrastructure changes due to moving from Apache/mod_php to nginx/php-fpm.<br /><br />Let me know if you still experience slowness on the forum (or the wiki for that matter)


subject: Re: Posting really slow?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Abwayax link=topic=7478.msg201136#msg201136 date=1470767861]<br />I don&#039;t know if it&#039;s my imagination, but the site seems much faster following the migration. Part of that might be due to the new server having increased RAM, but also due to infrastructure changes due to moving from Apache/mod_php to nginx/php-fpm.<br /><br />Let me know if you still experience slowness on the forum (or the wiki for that matter)<br />[/quote]<br /><br />I feel the same way too. The forums seem much faster to me now.


subject: Re: And we're back!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Abwayax link=topic=7578.msg201135#msg201135 date=1470767752]<br />Eventually the extension will be dropped and replaced with [url=https://gitlab.monarch-pass.net/glitch-city-laboratories/professor-glitch]something better[/url], but for now I wanted to fix it up so it works properly again. Some of the entries have been hand-converted into proper pages or formatted, and the &quot;back to the index&quot; link confuses the parser into thinking that&#039;s the name of the PokÃ©mon/item/attack since the parser expects the first line to be the name. Removing that [i]should[/i] update the name shown on the index (that&#039;s the intention)... but no guarantees, as the extension is not as &quot;super awesome&quot; as it claims to be!<br /><br />The new extension will use MediaWiki&#039;s template syntax which will more easily allow for things like wikilinks and images. The intention will be to keep the things the extension brings like separation of markup from data, and the ability to sort and (eventually...) filter the index, while being allowed to freely use native wiki code.<br />[/quote]<br />That sounds neat, looking forward to it! :)<br /><br />Yeah, I tried to remove back to index link and replaced the first two lines with &quot;[new line][item name]&quot; but the index is still showing &quot;([[ItemDex|â†‘ Back to the ItemDex index]].) with (0) in the ID field and 0 in the price field for me.


subject: PokÃ©mon Go
poster_name: Mindslash
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Have any of you played PokÃ©mon Go yet? What&#039;s your opinion on it? I&#039;ve heard some bad things about it, but I don&#039;t find it that bad at all...


subject: Re: PokÃ©mon Go
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I haven&#039;t played it, but I&#039;ve heard it&#039;s a very fun little time waster. Or it was, until the FUCKING NORMIES REEEEEEEEEEEE started playing it, according to /vp/. I couldn&#039;t stop laughing when my friend told me Koffing [size=1pt]and presumably Rotom-O and Probopass if they add more[/size] were found in the Holocaust Memorial.<br /><br />Some of the nonoffensive (read: unfunny) locations PokÃ©mon have been found in are cool too. There be Gyarados swimmin&#039; in Niagara Falls, so I hear.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Isaac356
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  We&#039;re back!&nbsp; ;D<br /><br />I spent the last few days experimenting with loading serial data via 8F. I went through a couple of iterations on the shellcode, trying to eliminate key items and glitch items, before I settled for this:<br /><br />[list]<br />[li](any item)[/li]<br />[li]8F[/li]<br />[li]TM43 x33[/li]<br />[li]j. (null) x192[/li]<br />[li]j. (null) x0[/li]<br />[li]TM24 x1[/li]<br />[li]Lemonade x128[/li]<br />[li]TM24 x2[/li]<br />[li]TM40 x2[/li]<br />[li]TM30 x128[/li]<br />[li]Fire Stone x250[/li]<br />[li]TM40 x1[/li]<br />[li]Water Stone x24[/li]<br />[li]TM37 x(any)[/li]<br />[/list]<br /><br />Technically, the nulls could be eliminated, but that would make the code longer and they&#039;re easy enough to obtain.<br /><br />[code]<br />	WRA1:D322 F3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  di&nbsp;  <br />	WRA1:D323 21 00 C0&nbsp; &nbsp; &nbsp; &nbsp;  ld&nbsp;  hl,C000<br />Loop::<br />	WRA1:D326 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />	WRA1:D327 00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  nop&nbsp; <br />	WRA1:D328 E0 01&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  (ff00+01),a<br />	WRA1:D32A 3E 80&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  a,80<br />	WRA1:D32C E0 02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  (ff00+02),a<br />Wait_Serial::<br />	WRA1:D32E F0 02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  a,(ff00+02)<br />	WRA1:D330 E6 80&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and&nbsp; a,80<br />	WRA1:D332 20 FA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jr&nbsp;  nz,Wait_Serial<br />Serial_Received::<br />	WRA1:D334 F0 01&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ld&nbsp;  a,(ff00+01)<br />	WRA1:D336 22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ldi&nbsp; (hl),a<br />	WRA1:D337 18 ED&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jr&nbsp;  Loop<br />[/code]<br /><br />The code will store bytes received from the serial port (in slave mode, because it&#039;s easier for synchronization and we can drive the serial faster than normal) starting at address C000 and never ending...or so it may seem. The nop&#039;s are key here. Originally I limited how many bytes to receive, then jumped directly to address C000, but the resulting code barely fit into the item list. Instead, I opted to allow the serial receive to overwrite the loop code, causing the instructions to be changed. Fortunately, jr 0 (18 00) behaves like a nop, therefore when the writing gets to the address D326, you have to send a 18 over the serial port, then on the next byte send a relative offset. When testing, I used FB to rel-jump to D323, which already contained a non-relative jump instruction to C000, but in reality any valid address in the range could be used.<br /><br />In other words, your serial data sender has to look something like this (in a very Python-esque pseudocode):<br /><br />[code]<br />for byte in program:<br />	send_serial_data(byte)<br /><br />for i in range((0xD323 - 0xC000) - len(program)):<br />	send_serial_data(0)<br /><br />for byte in b&quot;\xC3\x00\xC0\x18\xFB&quot;:<br />	send_serial_data(byte)<br />[/code]


subject: Using 8F to produce music.
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Are there any documentations for this? All I have heard about this is: https://www.youtube.com/watch?v=bP00FPrvPRU from TehFroggest but he hasn&#039;t responded to me on any platform. Anybody know about this?


subject: Genwunners
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
   Are you one? I most certainly am. The first 2 Gens hold a VERY special place in my heart. Any of you play the newer Pokemon games? Or do you just continually re-live nostalgia and play R/B/Y/G and G/S/C romhacks?


subject: Re: Glitch-Inspired Music
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  To celebrate the site being back up I took a day off work, got off my ass, and recorded 2 or 3 more.


subject: Re: Glitch-Inspired Music
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7519.msg201149#msg201149 date=1470802706]<br />To celebrate the site being back up I took a day off work, got off my ass, and recorded 2 or 3 more.<br />[/quote]<br /><br />OT, nice vinesauce logo.


subject: I figured out the cause of my dead Red cart.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Turns out the bank switcher is screwed, and only the first 512kb of the ROM can be accessed.<br /><br />Other carts (Red and Blue) have developed the same issue over time.<br /><br />Have fun screwing about with it in an emulator, just cut a Red or Blue ROM down to the first 512kb!


subject: Re: I figured out the cause of my dead Red cart.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ravioli link=topic=7584.msg201152#msg201152 date=1470841997]<br />How do you even fix the bank switcher?<br />[/quote]<br /><br />Replace the MBC, I guess.


subject: Re: Genwunners
poster_name: Dandaman955
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If I&#039;m completely honest, generation 1 is probably my least favourite generation. I didn&#039;t grow up with them, so I don&#039;t have the nostalgia everyone else has with them. They&#039;re examples of games that haven&#039;t particularly aged well at all, exacerbated by all the bugs and weird design choices made throughout the game. That&#039;s not to say I don&#039;t like the Kanto region itself, however: Pokemon Gold and Fire Red were my first Pokemon games, with Pokemon Gold improving on everything the original did wrong (incidentally my favourite generation) and with Pokemon Fire Red being a remake of Pokemon Red, everything else in that game seems like a step down.


subject: Re: Glitch-Inspired Music
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=drc link=topic=7519.msg201150#msg201150 date=1470810675]<br />OT, nice vinesauce logo.<br />[/quote]<br />Took me an hour to get the uploader to see it as a valid image after corruption.&nbsp; :XD:


subject: Re: Genwunners
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I have a special place in my heart for gens 1 and 2 but I wouldn&#039;t call myself a genwunner. To me that label implies someone who outright rejects the other gens, &quot;there are only 151/251 pokemon&quot; etc. I have a soft spot for 1 and 2 (and even 3 to some extent) but I like all gens.


subject: Re: Genwunners
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  First PKMN game was Yellow. But my favorite (other than Gen1/2) is HGSS. I&#039;ve broken it so many ways by just walking around it&#039;s not funny.


subject: Gengar's Crystal sprite
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  I was on /vp/ in a thread about a PokÃ©mon&#039;s best in-game sprite, and someone pointed out how in one of the .gifs, which was Gengar&#039;s Crystal sprite, his legs disappeared. I&#039;ve never seen this happen ingame; the animation ends when he shakes his legs.<br /><br />There was a short-lived [url=http://www.gamefaqs.com/boards/375087-pokemon-crystal-version/56534000]GameFAQs thread[/url] about this too, which went nowhere.<br /><br />Any idea why his legs don&#039;t vanish like in the .gif?


subject: Re: Gengar's Crystal sprite
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  They probably [b]DO[/b] but are broken by palette or drawing issues.<br />The animation may have even been cut short by the rest of the battle&#039;s animations (enemy animations have a time limit so that you don&#039;t have to press the A button when the &quot;Wild &lt;&gt; appeared!&quot; screen shows before your character throws out the ball, as seen in all games after G/S and Crystal.)<br /><br />C&#039;mon, Bert. Think it through.


subject: Ah, crap...
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: sad
body:
  After the site came back up, I decided to use my DSi XL to put info into a Talk page on the Wiki. However, when I tried to go to the &quot;Error Traps&quot; page, I got a page saying &quot;This URL has redirected to &lt;insert Error Traps page URL here&gt;. Click here to go to it.&quot; I click the link, and it redirects me... to the same page. I don&#039;t know if it&#039;s the DSi Browser (Opera) or the forum or one of the two networks or what, but it&#039;s now a page that redirects to itself on my DSi.


subject: Re: Data injection via Link Cable in Gen 1
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  Hey guys,<br /><br />So I did some tinkering with this during the migration, and I figured out how to transfer save files into Red/Blue using this method.<br /><br />https://www.youtube.com/watch?v=RMfiv63neUo<br /><br />Here&#039;s the assembly that I sent over: http://pastebin.com/KBh9pTJW<br /><br />So you might want to ask, &quot;Hey Aldrasio, if you can use this to upload save files into the game, could you download save files as well?&quot; The answer to that is: Maybe! But probably not. The issue with this method is that the buffer overflow puts you about 1/3 of the way into the game&#039;s event flags. At the beginning of the game, almost all of these are 0, so they don&#039;t affect much and form a nice NOP sled into the code we want to execute. But if you&#039;re trying to send over a more played save file, a lot of those event flags are going to be set. Some of them might form STOP commands or RST vectors, which are a big no-no on RBY. I know for a fact that if you go through Viridian Forest and only fight the Weedle Bug Catcher at the end, one of the event flag bytes will be 0x10, which is the STOP command. If that happens, the game locks up and there&#039;s nothing you can do about it.<br /><br />EDIT: [quote author=TheUnReturned link=topic=7576.msg201121#msg201121 date=1469847117]However, could this possibly corrupt the save data by accident?<br />[/quote]<br /><br />Yes, but only if you write 0x0A to any address in the range $0000-$1FFF. This is how you enable reading/writing to SRAM. If you avoid writing to that address range (and you should, unless you mean it), then the save file should be fine.


subject: Re: Ah, crap...
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Abwayax
icon: xx
body:
  It looks like it is redirecting to itself(?) Maybe the accent mark is breaking something.<br /><br />[code]$ curl -v http://glitchcity.info/wiki/Category:Error_trappers_in_the_PokÃ©mon_games<br />*&nbsp;  Trying 213.167.243.138...<br />* Connected to glitchcity.info (213.167.243.138) port 80 (#0)<br />&gt; GET /wiki/Category:Error_trappers_in_the_PokÃ©mon_games HTTP/1.1<br />&gt; Host: glitchcity.info<br />&gt; User-Agent: curl/7.50.1<br />&gt; Accept: */*<br />&gt; <br />&lt; HTTP/1.1 301 Moved Permanently<br />&lt; Server: nginx/1.6.2<br />&lt; Date: Wed, 10 Aug 2016 23:53:15 GMT<br />&lt; Content-Type: text/html; charset=utf-8<br />&lt; Transfer-Encoding: chunked<br />&lt; Connection: keep-alive<br />&lt; X-Powered-By: PHP/5.6.24-0+deb8u1<br />&lt; X-Content-Type-Options: nosniff<br />&lt; Set-Cookie: PHPSESSID=; path=/; domain=.glitchcity.info<br />&lt; Pragma: no-cache<br />&lt; Vary: Accept-Encoding, Cookie<br />&lt; Expires: Thu, 01 Jan 1970 00:00:00 GMT<br />&lt; Cache-Control: private, must-revalidate, max-age=0<br />&lt; Last-Modified: Wed, 10 Aug 2016 23:53:15 GMT<br />&lt; Location: http://glitchcity.info/wiki/Category:Error_trappers_in_the_Pok%C3%A9mon_games<br />&lt; <br />* Connection #0 to host glitchcity.info left intact<br /><br />$ curl -v http://glitchcity.info/wiki/Category:Error_trappers_in_the_Pok%C3%A9mon_games<br />*&nbsp;  Trying 213.167.243.138...<br />* Connected to glitchcity.info (213.167.243.138) port 80 (#0)<br />&gt; GET /wiki/Category:Error_trappers_in_the_Pok%C3%A9mon_games HTTP/1.1<br />&gt; Host: glitchcity.info<br />&gt; User-Agent: curl/7.50.1<br />&gt; Accept: */*<br />&gt; <br />&lt; HTTP/1.1 301 Moved Permanently<br />&lt; Server: nginx/1.6.2<br />&lt; Date: Wed, 10 Aug 2016 23:53:39 GMT<br />&lt; Content-Type: text/html; charset=utf-8<br />&lt; Transfer-Encoding: chunked<br />&lt; Connection: keep-alive<br />&lt; X-Powered-By: PHP/5.6.24-0+deb8u1<br />&lt; X-Content-Type-Options: nosniff<br />&lt; Set-Cookie: PHPSESSID=; path=/; domain=.glitchcity.info<br />&lt; Pragma: no-cache<br />&lt; Vary: Accept-Encoding, Cookie<br />&lt; Expires: Thu, 01 Jan 1970 00:00:00 GMT<br />&lt; Cache-Control: private, must-revalidate, max-age=0<br />&lt; Last-Modified: Wed, 10 Aug 2016 23:53:39 GMT<br />&lt; Location: http://glitchcity.info/wiki/Category:Error_trappers_in_the_Pok%C3%A9mon_games<br />&lt; <br />* Connection #0 to host glitchcity.info left intact<br />[/code]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  [quote author=Isaac356 link=topic=6638.msg201144#msg201144 date=1470796770]Instead, I opted to allow the serial receive to overwrite the loop code, causing the instructions to be changed. Fortunately, jr 0 (18 00) behaves like a nop, therefore when the writing gets to the address D326, you have to send a 18 over the serial port, then on the next byte send a relative offset. When testing, I used FB to rel-jump to D323, which already contained a non-relative jump instruction to C000, but in reality any valid address in the range could be used.<br />[/quote]<br /><br />Huh, that&#039;s a really interesting approach. I like it. I wouldn&#039;t have thought to do that. I figured the best way to get around the item quantity bottleneck is to just allow a set number of bytes over serial at first, then send an intermediate bootstrapper, then use [i]that[/i] bootstrapper to start receiving the full payload.


subject: Re: Ah, crap...
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Should work now. I had to fix some wonky redirect/proxy rules between the frontend and the application container.


subject: Re: Using 8F to produce music.
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It looks like he didn&#039;t actually use 8F to generate the music, he just used it to redirect the music pointers into an area of RAM where he&#039;d inserted the song.<br /><br />The RBY music format has been touched on [url=http://www.pokecommunity.com/showthread.php?t=194801]here[/url] and there are tools such as [url=http://skeetendo.proboards.com/thread/120]this one[/url] that you can use to import your own songs. It says in the video that he used a save editor, so he may have used those tools and then written it into his game&#039;s SRAM.


subject: Re: Gengar's Crystal sprite
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=IIMarckus link=topic=7585.msg201167#msg201167 date=1470880065]<br />The longer animations are shown on the stats screen.<br />[/quote]<br /><br />Huh. Seems odd they would program it like that, considering how long Jinx&#039;s is. Thanks!<br /><br />Time to put a new battery in my Crystal Version (RIP 2001-2016 ;-;7) and see what other PokÃ©mon do this.


subject: Re: Ah, crap...
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Abwayax link=topic=7586.msg201165#msg201165 date=1470877818]<br />Should work now. I had to fix some wonky redirect/proxy rules between the frontend and the application container.<br />[/quote]<br />It does indeed work now. Thanks!


subject: Re: Gengar's Crystal sprite
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=IIMarckus link=topic=7585.msg201167#msg201167 date=1470880065]<br />The longer animations are shown on the stats screen.<br />[/quote]<br />I was right. 


subject: Re: I figured out the cause of my dead Red cart.
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7584.msg201153#msg201153 date=1470843848]<br />[quote author=ravioli link=topic=7584.msg201152#msg201152 date=1470841997]<br />How do you even fix the bank switcher?<br />[/quote]<br /><br />Replace the MBC, I guess.<br />[/quote]<br />Depends on the reason it stopped. Some just come loose, meaning an impact (&quot;If it stops working, pull the motherboard, take it to somewhere concrete, pick it up six inches and drop it.&quot; -Dell) could reseat it and everything goes back to normal. Sometimes they arc and burn the board, which can be fixed by removing the sealant over the pathway it links to and soldering it directly to the inside of the PCB (a short piece of wire can be used if it&#039;s not long enough!). Other than that, no idea without holding the cart in my hands.


subject: Re: Using 8F to produce music.
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ravioli
icon: xx
body:
  [quote author=Aldrasio link=topic=7582.msg201166#msg201166 date=1470879013]<br />It looks like he didn&#039;t actually use 8F to generate the music, he just used it to redirect the music pointers into an area of RAM where he&#039;d inserted the song.<br /><br />The RBY music format has been touched on [url=http://www.pokecommunity.com/showthread.php?t=194801]here[/url] and there are tools such as [url=http://skeetendo.proboards.com/thread/120]this one[/url] that you can use to import your own songs. It says in the video that he used a save editor, so he may have used those tools and then written it into his game&#039;s SRAM.<br />[/quote]<br /><br />How do you write it into SRAM? I thought it could only be written in RAM? Am I just stupid? I thought that tool only had use for ROMs.<br /><br />This is also from his description.<br /><br />&#039;&#039;Basically, 8F is a glitch item, it jumps PC to WRAM, and you can make ASM routines with items. By doing so, and loading a song into pokemon box 1, and saving, it can be played without any external device&#039;&#039;<br /><br />Is this stuff really not documented?


subject: Re: Using 8F to produce music.
poster_name: naf102
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: naf102
icon: xx
body:
  [quote author=Aldrasio link=topic=7582.msg201166#msg201166 date=1470879013]<br />It looks like he didn&#039;t actually use 8F to generate the music, he just used it to redirect the music pointers into an area of RAM where he&#039;d inserted the song.<br /><br />The RBY music format has been touched on [url=http://www.pokecommunity.com/showthread.php?t=194801]here[/url] and there are tools such as [url=http://skeetendo.proboards.com/thread/120]this one[/url] that you can use to import your own songs. It says in the video that he used a save editor, so he may have used those tools and then written it into his game&#039;s SRAM.<br />[/quote] From what I&#039;m reading in that first link, can&#039;t you theoretically access the music header of an existing song (for example Pallet Town&#039;s music header is 822E-8236) and manually overwrite each byte of RAM that represents a note on the scale with 8F? Then you can edit the loop points and etc. If possible with 8F, I can imagine it taking an exorbitant amount of time.


subject: Re: Using 8F to produce music.
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Aldrasio
icon: xx
body:
  [quote author=naf102 link=topic=7582.msg201174#msg201174 date=1470916183]From what I&#039;m reading in that first link, can&#039;t you theoretically access the music header of an existing song (for example Pallet Town&#039;s music header is 822E-8236) and manually overwrite each byte of RAM that represents a note on the scale with 8F? Then you can edit the loop points and etc. If possible with 8F, I can imagine it taking an exorbitant amount of time.<br />[/quote]<br /><br />No, because that isn&#039;t actually in RAM. It&#039;s in the ROM bank 2, which is read-only.<br /><br />[quote author=ravioli link=topic=7582.msg201172#msg201172 date=1470888172]How do you write it into SRAM? I thought it could only be written in RAM? Am I just stupid? I thought that tool only had use for ROMs.<br /><br />This is also from his description.<br /><br />&#039;&#039;Basically, 8F is a glitch item, it jumps PC to WRAM, and you can make ASM routines with items. By doing so, and loading a song into pokemon box 1, and saving, it can be played without any external device&#039;&#039;<br /><br />Is this stuff really not documented?<br />[/quote]<br /><br />SRAM is a part of the RAM, specifically the part of RAM that contains the save file. He wrote the song over his Pokemon Box 1 data, which was loaded into the game&#039;s WRAM when he loaded his game. Then he used 8F to redirect the music pointers.<br /><br />The reason this isn&#039;t really documented is because it&#039;s a few different tricks combined together. We know that the music pointers are in the RAM range C006-C015 (if you use BGB&#039;s memory viewer, you can see the pointers change in real-time), we know that 8F can be used to write over those music pointers, we know how the music in Pokemon RBY is formatted, and we know that the Pokemon Box 1 data can be overwritten. Putting all that together, you get what was in the video.


subject: Re: Wiki Bug List and Reports
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I reran mediawiki&#039;s maintenance script for rebuilding the search index so now search should work properly.


subject: Re: Using 8F to produce music.
poster_name: naf102
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah, I see now thanks for the clarification. So basically he made the song using a hex editor and inserted the song where Pokemon Box 1 is, then used 8F to access it and play it?


subject: Re: Using 8F to produce music.
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yep, that&#039;s what he did. He could&#039;ve used 8F to write the music into the box 1 data, but it would&#039;ve taken forever.


subject: Re: Using 8F to produce music.
poster_name: naf102
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aldrasio link=topic=7582.msg201178#msg201178 date=1470951494]<br />Yep, that&#039;s what he did. He could&#039;ve used 8F to write the music into the box 1 data, but it would&#039;ve taken forever.<br />[/quote] How could he have done this? I&#039;m interested.


subject: Re: Name Changes
poster_name: Addri Trainer
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Addri Trainer
icon: xx
body:
  Hi, I want to change my name ( Addri Trainer ) to ( LanceAndMissingNo. ) if is possibly , thanks.&nbsp; ;)


subject: Re: Using 8F to produce music.
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=naf102 link=topic=7582.msg201180#msg201180 date=1471001670] How could he have done this? I&#039;m interested.<br />[/quote]<br /><br />Check the [url=http://forums.glitchcity.info/index.php?topic=6638.0]8F sticky[/url], there are a few item loadouts you can use to sequentially write to RAM.


subject: Forum links broken?
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Seems the recent maintenance changed the forum URL format and broke all external links to topics, posts etc?


subject: Re: Forum links broken?
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah I have a ticket for this. That feature relied on a specific Apache feature which isn&#039;t available in our new nginx/fpm setup. We can set up a redirect in nginx to catch those urls and redirect.


subject: Re: I figured out the cause of my dead Red cart.
poster_name: Aldrasio
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It sounds like a pin on either the MBC or the ROM came loose if it&#039;s otherwise working fine. Open your cart up and check either of these connections:<br /><br />[url=http://imgur.com/xCAUPe3][img]http://i.imgur.com/xCAUPe3h.jpg[/img][/url]<br /><br />If that&#039;s the case, it&#039;s easily fixable with a soldering iron.


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  https://cdn.discordapp.com/attachments/184353991029817344/205200589590626304/f22e179f-a204-4f15-b607-9d64329b21d5.jpg


subject: Gen 1 link battle with glitch pokemon help
poster_name: HendraHelix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [color=green] I desperately need to know if I can SAFELY battle my friend via 3ds connection with glitch pokemon in gen 1. I don&#039;t want to damage his game in any way but I want to do a glitch battle to blow his mind<br />If anyone has any information/links/videos to support either side please let me know. <br />Thanks <br />Hendra Helix [/color][/color]


subject: Gen VI Glitch Moves
poster_name: lysandrepk
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: exclamation
body:
  I have found several hundred glitch moves in the Gen VI games, which are accessible via PowerSaves (if you have the device, of course.)<br /><br />These animations range from random things like battle-starting animations, beta move animations &amp; mega/primal evolutions (which turn your PokÃ©mon, for the duration of the contest, into eggs.) <br /><br />Tutorial: You can either go to my pastebin ([url=http://pastebin.com/xjEW2Azw]http://pastebin.com/xjEW2Azw[/url]) or to my YouTube video (excuse my squeaky, unconfident 13 year old voice) ([url=https://www.youtube.com/watch?v=6z_N11D_Ekw]https://www.youtube.com/watch?v=6z_N11D_Ekw[/url])<br /><br />If you find anything cool, make sure to post here! I have currently found TWO interesting ones (of five I&#039;ve tried), one being the Team Aqua battle start animation (which crashed the game) and another being the Draco Meteor animation with the Team Magma boss&#039;s battle animation going on at the exact same time. I can&#039;t remember the numbers for these, so RIP.<br /><br />(I do not know if I discovered these, or if other people have tried this before me, but I found this out by myself)<br /><br />Thanks for reading, and cya!


subject: Re: Gen VI Glitch Moves
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  Have you tried using them in battle?<br /><br />I&#039;ve tried patching memory (using citra + gdbserver + IDAPython scripts) to screw about with the encounter table, mainly to figure out what causes the crash when sending 0xFFFF into battle; but I&#039;ve failed so far. I need to patch the .cxi to add the latest version and try again, as I think the addresses I got won&#039;t work on v1.0.<br /><br />Nice to see there&#039;s more Gen 6 research happening, anyway.


subject: Re: Gen 1 link battle with glitch pokemon help
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [unhelpful]<br /><br />I think the worst that could happen is the games freezing.<br /><br />[/unhelpful]


subject: Re: Gen VI Glitch Moves
poster_name: Bert
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Bert
icon: clip
body:
  [quote author=lysandrepk link=topic=7590.msg201193#msg201193 date=1471179503]<br />mega/primal evolutions (which turn your PokÃ©mon, for the duration of the contest, into eggs.) [/quote]<br /><br />I couldn&#039;t resist.


subject: Re: Gen VI Glitch Moves
poster_name: lysandrepk
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7590.msg201194#msg201194 date=1471194801]<br />Have you tried using them in battle?<br /><br />I&#039;ve tried patching memory (using citra + gdbserver + IDAPython scripts) to screw about with the encounter table, mainly to figure out what causes the crash when sending 0xFFFF into battle; but I&#039;ve failed so far. I need to patch the .cxi to add the latest version and try again, as I think the addresses I got won&#039;t work on v1.0.<br /><br />Nice to see there&#039;s more Gen 6 research happening, anyway.<br />[/quote]<br /><br />They all have 0 PP, no name and no description, one crashed the game when I used it in the battle, and the other 4 just said &#039;this move has no PP left!&#039;


subject: Re: Gen VI Glitch Moves
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=lysandrepk link=topic=7590.msg201197#msg201197 date=1471214988]<br />[quote author=Wack0 link=topic=7590.msg201194#msg201194 date=1471194801]<br />Have you tried using them in battle?<br /><br />I&#039;ve tried patching memory (using citra + gdbserver + IDAPython scripts) to screw about with the encounter table, mainly to figure out what causes the crash when sending 0xFFFF into battle; but I&#039;ve failed so far. I need to patch the .cxi to add the latest version and try again, as I think the addresses I got won&#039;t work on v1.0.<br /><br />Nice to see there&#039;s more Gen 6 research happening, anyway.<br />[/quote]<br /><br />They all have 0 PP, no name and no description, one crashed the game when I used it in the battle, and the other 4 just said &#039;this move has no PP left!&#039;<br />[/quote]<br /><br />Crashed the game how? Freeze or forced back to Home Menu?<br /><br />I guess you tried using PP Ups on them?<br /><br />What move index number crashed the game?


subject: Re: Gen VI Glitch Moves
poster_name: lysandrepk
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7590.msg201199#msg201199 date=1471220677]<br />[quote author=lysandrepk link=topic=7590.msg201197#msg201197 date=1471214988]<br />[quote author=Wack0 link=topic=7590.msg201194#msg201194 date=1471194801]<br />Have you tried using them in battle?<br /><br />I&#039;ve tried patching memory (using citra + gdbserver + IDAPython scripts) to screw about with the encounter table, mainly to figure out what causes the crash when sending 0xFFFF into battle; but I&#039;ve failed so far. I need to patch the .cxi to add the latest version and try again, as I think the addresses I got won&#039;t work on v1.0.<br /><br />Nice to see there&#039;s more Gen 6 research happening, anyway.<br />[/quote]<br /><br />They all have 0 PP, no name and no description, one crashed the game when I used it in the battle, and the other 4 just said &#039;this move has no PP left!&#039;<br />[/quote]<br /><br />Crashed the game how? Freeze or forced back to Home Menu?<br /><br />I guess you tried using PP Ups on them?<br /><br />What move index number crashed the game?<br />[/quote]<br /><br />Forced back to home menu.<br /><br />If you use PP Ups or PP Max, it&#039;ll say that it has no effect.<br /><br />Since I at first didn&#039;t think this was gonna work (I tested them out in battles before contests) I didn&#039;t document index numbers, but for my future research I will :)


subject: Re: R/B/Y HoF
poster_name: lysandrepk
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I have a lvl. 168 Venusaur named cGarypPCRogRog:<br /><br />http://image.prntscr.com/image/87fe224e716e47258e2514d7aa61641b.png<br />[img]http://i.imgur.com/7ecu8Fh.png[/img]<br /><br />Whatever tf this is:<br /><br />http://image.prntscr.com/image/99196edc779e4588a73775ddbfa5748e.png<br />[img]http://i.imgur.com/1muyj3y.png[/img]<br /><br />A level 70 Oddish:<br />http://image.prntscr.com/image/649f410dce5b47dfa8c1f28c32c32f7c.png<br />[img]http://i.imgur.com/DJbBmgs.png[/img]<br /><br />A lvl 150 Bellsprout called xEnemy TrainerIR:<br />http://image.prntscr.com/image/6773408a02af4c9a87f42a07518d472f.png<br />[img]http://i.imgur.com/NfJro8U.png[/img]<br /><br />This.. thing (which seems to be a hybrid of Gengar?)<br />http://image.prntscr.com/image/72435422f30c45cc970aa2d5fdf73958.png<br />[img]http://i.imgur.com/vccTqeF.png[/img]<br /><br />and..<br /><br />this.<br />http://image.prntscr.com/image/73c25f3d35194396b017f778be2a55e6.png<br />[img]http://i.imgur.com/JUQycfD.png[/img]<br /><br />[Edited by Torchickens on August 21, 2016 to reduce the image sizes]


subject: Re: Posting really slow?
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Zowayix
icon: xx
body:
  Yeah, I think it&#039;s working a lot better now. And I&#039;m totally making this post for a meaningful purpose and not just to verify that theory.<br /><br />Edit: Yeah, that was nice and fast.


subject: Re: Gen VI Glitch Moves
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=lysandrepk link=topic=7590.msg201200#msg201200 date=1471258922]<br />Forced back to home menu.<br />[/quote]<br /><br />Given that you&#039;re doing your research on real hardware, I&#039;d go try it again, but with Luma CFW dev-branch running to get an exception handler with register-dumps etc.<br /><br />But I guess your 3DS is running stock, and most likely 11.0, so you&#039;d have to do awkward downgrading.


subject: 8F question.
poster_name: naf102
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: naf102
icon: xx
body:
  What does the items and its quantities represent when creating 8F codes? I know 201 of any item terminates the code but that&#039;s about all I know on the subject. 


subject: Re: R/B/Y HoF
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Charmy
icon: clip
body:
  I remember having PokÃ©mon with &quot;SHREK&quot; in their names... Ehhh the magic of control characters.<br />I also have one named &quot;TM3Ã©&quot;<br />Oh! I forgot about a Seaking hybrid with Slowpoke&#039;s cry.<br />Ok... now the current one:<br /><br />HoF 1:<br />1:<br />Species:A glitchy thingy<br />Notes:Has no sprite and it&#039;s pallette changes white to black and black to navy.<br />Name:?6 &#039;||Wâ—‹geâ– &quot;.IN<br />Level:162 (Hmm... totaly legit)<br />Types:Normal<br />2:<br />Species:Magmar<br />Notes:None<br />Name:<br />â– 26tTP(&nbsp;  MnIN<br />Level:182<br />Types:Fire<br />3:<br />Species:Squirtle<br />Notes: Just like other ones, it has &quot;IN&quot; at the end of it&#039;s name. I see a pattern.<br />Name:2&nbsp; :[b]A[/b]AzPOKÃ¨5&quot; â– IN<br />Level:216<br />Types:Water<br />4:<br />Species:Another glitchy thingy<br />Notes:Just like No.1 but more... Magenta, also, spoopy music.<br />Name:pâ– rqâ– â– v&nbsp; â™€&quot;/IN<br />Level:51<br />Types:<br />Type 1 is IIII&#039; &#039; but type 2 is too big for me to rewrite.<br />5:<br />Species:Charmeleon<br />Notes:Nope<br />Name:â–  â–  ||â– &#039;3â– 6 IN<br />Level:242<br />Types:Fire<br />6:<br />Species:Persian<br />Notes:Long name.<br />Name:<br />&#039;<br />TMGâ– TRAINER<br />X IN<br />Level:180<br />Types:Normal<br /><br />Ok. HoF No.2!<br /><br />1:<br />Species:Seaking<br />Notes:Shortest name (for now), Also:First one to have a name not ending with &quot;IN&quot;.<br />Name:&#039;r.<br />Level:220<br />Types:Water<br />2:<br />Species:Probably Missingno. or something<br />Notes:&quot;&#039;dp&#039; D\P remakes confirmed! (jk)<br />Name:8 &gt;5R&#039;dp&#039;v<br />Level:136<br />Types:Normal\Toolong<br />3:<br />Species:Staryu<br />Notes:Lowest level (for now)!<br />Name:Z â–  o &quot;&nbsp; â– 3IN<br />Level:27<br />Types:Water<br />4:<br />Species:Maybe &quot;4 4&quot;? (hex:BF), but i don&#039;t think so.<br />Notes:First apperance of Japanese stuff! Yaaaaay! I can&#039;t seem to find any Japanese in charmap, so I&#039;ll use something different.<br />Name:â–  [ ã‚¯ TRAINER 7 ]â– IN<br />Level:43<br />Types:Water<br />5:<br />Species:Mew (yaaaay!)<br />Notes:^^<br />Name: V7[b]S[/b].31â– feIN<br />Level:95<br />Types:Psychic<br />6:<br />Species:Victreebel<br />Notes:None<br />Name:â—‹â– â– , 4xXâ– â– 7â– IN<br />Level:154<br />Types:Grass\Poison<br /><br /><br />Aahh couldn&#039;t resist it!<br />HoF3.exe<br />1:<br />Species:Another Possible Missingno.<br />Notes:Nun<br />Name:(Râ– x0â—‹fu7a IN<br />Level:127<br />Types:Normal\uaaaauauaahhh*dies*<br />2:<br />Species:Lapras<br />Notes:I will start deleting this part.<br />Name:<br />â– [b]D[/b] u: [b]H[/b] t #â™‚IN<br />Level:223<br />Types:Water\Ice<br />3:<br />Species:Seapoke (Seaking hybrid with Slowpoke&#039;s cry<br />Name:2Ë…j4,4â—‹â– 8 mIN<br />Level:117<br />Types:Water<br />4:<br />Species:Jynx<br />Name:8[b]H[/b].â– <br /><br />Level:103<br />Types:Ice\Psy<br />5:<br />Species:Moar Glitchy Mess (Poliwrath hybrid)<br />Name:â– â– X6&#039;v9_&#039;râ– GARYWIN<br />Notes:He wants Gary to win.<br />Level:63<br />Types:Water\Fight<br />6:<br />Species:Messingno. (i know, bad pun)<br />Name: _ â– &#039;s-z:TMQâ—‹IN<br />Level:124<br />Types:Normal\Vomit<br />But wait! There&#039;s more!<br />HoF 4:<br />1:<br />Species:The thing that evolves into Q? (hex:FF)<br />Name:x1y&#039;vm89 Éª&#039;r IN<br />Level:255 (Irony)<br />Types:Normal (Myth busted)<br />2:<br />Species:Dugtrio<br />Name:Pâ– <br />Ë…7 &#039;d 96Â·Â·Â· IN<br />Level:223<br />Types:Ground<br />3:<br />Species:Charizard<br />Name:0?&nbsp; ROCKETâ™‚<br />6 â—‹ INl:93<br />Types:Fire\Fly<br />4:<br />Species:Voltorb<br />Name:xâ– # â—‹i&#039;lâ– vâ–  IN<br />Level:206<br />Types:Electric<br />More (maybe) coming soon.<br /><br />â—‹ = Border (ball)<br />â–  = A tile<br />|| = Border (i forgot if it&#039;s vertical of horizontal)<br />â™€ = Female sign<br />â™‚ = Male sign<br />ã‚¯ = The closest thing to one of the unused JP characters i could find.<br />Éª = Same as above.<br /># = I can&#039;t find that JP character.<br />_ = Other border @up6lines<br />Ë… = Downward arrow<br />&gt; = Arrow (active)<br />|&gt; = Arrow (not active)<br /><br />Also, this is my first post here.<br />[glow=lime,2,300]I used CELEBRATE![/glow]<br />And a bonus, i can&#039;t read the rules because ... attachment.<br /><br />Also, if you think &quot;y do u bump&quot;:<br />1:Bumping in sticky&#039;s is allowed (from what i know)<br />2:It&#039;s not me who bumped.


subject: Unused data in ORAS
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Charmy
icon: exclamation
body:
  Hello.<br />First off, i don&#039;t know where to post this, it&#039;s not about glitches so i think it should be here. If I&#039;m wrong then please move this topic.<br />Also, I&#039;m new to this forum (kinda, i have been reading it as a Guest for maybe a year) so please share some respect to new users.<br />I wanted to start a small research about ORAS&#039;s unused data, such as trainer classes, items etc.<br />For now, i want to share info i already have.<br />When i will get access to my stationary PC (where i have all the files) i will start the search.<br /><br />I probably might update Bulbapedia&#039;s page on this because it&#039;s almost empty.<br />So, no more talking, let&#039;s start.<br /><br />[center][b]The &quot;Soar&quot; field move[/b][/center]<br />In the text data of ORAS, (at gametext file 80) there is a line for a field move called Soar. I think that the Eon Flute replaced this very late in the development as it&#039;s the last item to be implemented.<br /><br />[center][b]Unused Items[/b][/center]<br />I also found data about key items from gens 4 and 5, such as the Explorer Kit, Magma Stone,PokÃ©tch Coupons, Xtransceiver...<br />Even the unused ones like Seal Bag.<br />They have a fully functional description, but i don&#039;t know about icons.<br />I think they are for compatibility reasons.<br /><br />[center][b]Unused Trainer Classes[/b][/center]<br />All classes from XY remain in ORAS, some are probably used in the Battle Maison (like Youngster, Lass), some are for compatibly with those games, but some are completly unused.<br />These include XY ones and some new ORAS ones:<br />[u]Team Flare:[/u]<br />They have no data assigned to them besides the names, no model, no special intro/music, nothing.<br />[u]Unused Swimmer/Triathlete Classes:[/u]<br />They have no name, only sprites. They are the ORAS ones.<br />EDIT:Their name is [~###] with ### being a number corresponding to the class index number, however, this string displays as a space bar.<br /><br />[s]That&#039;s all for now, remember that i have no access to my main PC right now, so i can&#039;t research (that&#039;s what i remember).[/s]<br />EDIT: I copied RomFS onto my brother&#039;s laptop so i now can research.<br />I will be doing research on XY as well, but i want to finish ORAS first.


subject: Re: And we're back!
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was looking almost every day to see if the maintenance has finished.<br />However, there&#039;s one problem.<br />The Forum Rules page is dead, and new users will not obey the rules more often, because they can&#039;t access the page.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spectramark
icon: xx
body:
  Found another rather strange and random glitch to have fun with, this time concerning Decamark [b]0x1460[/b].<br /><br />When picking up 0x1460 using the orange cursor in the PC, it creates a wide variety of graphical glitches when switching between PC Boxes, often crashing the game.<br />Sometimes, however, it freezes the music and all other sounds stop playing, but the game can still be controlled. Leaving the area with this frozen music crashes the game though, for some reason...<br /><br />I&#039;ve also found that on rare occasions, the glitchy behaviour extends beyond the PC itself, as shown below:<br /><br />[img]http://imgur.com/O2EaAxg.jpg[/img][img]http://imgur.com/JMgZFgX.jpg[/img]<br /><br />The PC options were there as usual, but I was able to walk around! I could access the PC and move Pokemon around from anywhere in the room. I&#039;ve managed to pull this off twice so far, but both times the music had also frozen, so leaving the room was not an option, as it would crash the game. Due to the random nature of this glitch, activating it without freezing the music would likely be possible.<br />From here, you can do some more things:<br />[list]<br />[li]If you press A on the PC while selecting an option of viewing the PC, then back out again, two PC dialogs will be displayed, overlapping each other and causing some rather strange effects when selecting an option.[/li]<br /><br />[li]Pressing B or selecting &quot;SEE YA!&quot; makes the PC options disappear, but the dialog box remains on the screen. Pressing Start at this point opens up the menu and chops off part of the dialog box.[/li]<br /><br />[li]Interacting with the Pokemon Center Nurse, you can get her to heal your Pokemon while viewing the PC, which surprisingly works exactly as you think it does; the Pokemon are healed and, unfortunately, the game doesn&#039;t screw up.[/li]<br />[/list]<br /><br /><br />This may not be a big breakthrough, but it&#039;s nice to have fun with it :D<br /><br />[b]EDIT:[/b] I have now found that doing this can also corrupt the Pokemon in the PC, turning them into Bad EGGs with seemingly completely random glitch markings and glitch item. Other data regarding what the Pokemon was originally might have also been corrupted, but since I use actual hardware and not an emulator, I couldn&#039;t do much with them.<br />However, some of the glitch items looked different from the standard &quot;?&quot; icon, with one using the &quot;Close Bag&quot; icon and some being completely invisible. If someone could test this out on emulator and identify what the Hex. value of the glitch items are, who knows, one of them might be the elusive glitch item 0xFFFF. Fingers crossed... ;)<br /><br />-----<br /><br />Also, Decamark [b]0x2828[/b] has a glitch sprite seemingly identical to 0x0000&#039;s glitch sprite, but uses the previous sprite&#039;s colour palette instead of just black.<br />0x2828 also causes corruption similar to 0x1460 when its name is viewed using the news reporter, corrupting the player&#039;s Name, Party, Bag, Pokedex, Options, Overworld Sprite, etc. However, the battle sprite isn&#039;t changed so you can battle with the Bad EGGs in your party.<br /><br />This is the sprite of 0x2828 shown after scrolling from a Bad Egg.<br />[img]http://imgur.com/z2FIoBz.jpg[/img]


subject: Unused... thing... in Yellow?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  I was screwing around with Pokemon Blue and Pokemon Yellow and I swapped their save files. I was spawned in a glitch PKMN Center [YELLOW&gt;BLUE]. I used a Walk Through Walls code to exit the building. (Saved, deactivated the cheat, and reloaded before exiting, obviously.) The Old Man battle occured without a hitch the instant I stepped out of the building. (Weird, but okay...). Saved outside in Viridian. Transferred saves back. [BLUE&gt;YELLOW] Reloaded save in original ROM. INSTANTLY this happened.<br /><br />[size=18pt][url=https://youtu.be/tY9XsGnK7s8]YouTube embedding broken, click here to view[/url][/size]<br /><br />Never seen that balloon before, anyone know what this is/is this new?


subject: Re: Gen VI Glitch Moves
poster_name: Yeniaul
poster_ip: ***.***.***.***
modified_name: Yeniaul
icon: xx
body:
  [quote author=lysandrepk link=topic=7590.msg201200#msg201200 date=1471258922]<br />I didn&#039;t document index numbers, but for my future research I will :)<br />[/quote]<br />Couldn&#039;t you just... oh, I don&#039;t know... check the index with a save/hex editor? I assume that&#039;s how the glitch moves were injected in the first place...<br /><br />I know fucking ZERO about this sort of thing (not owning a 3DS/2DS) but if what I know about DS(i) homebrew applies, then it should be trivial to retrieve the index...


subject: Re: Press Ctrl+V or Cmd+V or whatever and post
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  I can&#039;t post, it&#039;s too long (It&#039;s the source to a search-and-destroy web crawler for bad ROMs I&#039;m making)


subject: Re: Unused... thing... in Yellow?
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: IIMarckus
icon: xx
body:
  [url=https://github.com/pret/pokeyellow/blob/master/scripts/billshouse2.asm#L120]Pikachu displays that question mark when visiting Bill for the first time.[/url]


subject: Re: Gen VI Glitch Moves
poster_name: lysandrepk
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Yeniaul link=topic=7590.msg201215#msg201215 date=1471316448]<br />[quote author=lysandrepk link=topic=7590.msg201200#msg201200 date=1471258922]<br />I didn&#039;t document index numbers, but for my future research I will :)<br />[/quote]<br />Couldn&#039;t you just... oh, I don&#039;t know... check the index with a save/hex editor? I assume that&#039;s how the glitch moves were injected in the first place...<br /><br />I know fucking ZERO about this sort of thing (not owning a 3DS/2DS) but if what I know about DS(i) homebrew applies, then it should be trivial to retrieve the index...<br />[/quote]<br /><br />PowerSaves is not a homebrew application, it is a similar device to an Action Replay (in which you input codes to affect your game, instead of editing a save on an SD card), and so I can&#039;t easily get all the numbers.<br /><br />By the way, 900 is mega evolution.


subject: Re: 8F question.
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello naf102,<br /><br />We&#039;ve been explaining this many many times to many many different people ; but it&#039;s fair not to have time to read everything. For that kind of questions, you could have posted in the related thread, which is in the PokÃ©mon Glitch Discussion Stickies child board.<br /><br />Anyway, the last time someone asked, those were the answers: http://forums.glitchcity.info/index.php?topic=7544.0<br /><br />Hope this helps!


subject: Re: Gen VI Glitch Moves
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=lysandrepk link=topic=7590.msg201218#msg201218 date=1471338729]<br />[quote author=Yeniaul link=topic=7590.msg201215#msg201215 date=1471316448]<br />[quote author=lysandrepk link=topic=7590.msg201200#msg201200 date=1471258922]<br />I didn&#039;t document index numbers, but for my future research I will :)<br />[/quote]<br />Couldn&#039;t you just... oh, I don&#039;t know... check the index with a save/hex editor? I assume that&#039;s how the glitch moves were injected in the first place...<br /><br />I know fucking ZERO about this sort of thing (not owning a 3DS/2DS) but if what I know about DS(i) homebrew applies, then it should be trivial to retrieve the index...<br />[/quote]<br /><br />PowerSaves is not a homebrew application, it is a similar device to an Action Replay (in which you input codes to affect your game, instead of editing a save on an SD card), and so I can&#039;t easily get all the numbers.<br /><br />By the way, 900 is mega evolution.<br />[/quote]<br /><br />You have homebrew on your 3DS, go dump the save using a homebrew application.


subject: Re: Unused... thing... in Yellow?
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=IIMarckus link=topic=7594.msg201217#msg201217 date=1471324988]<br />[url=https://github.com/pret/pokeyellow/blob/master/scripts/billshouse2.asm#L120]Pikachu displays that question mark when visiting Bill for the first time.[/url]<br />[/quote]<br />OH YEAH I completely forgot about that! Has anyone gotten this to occur like this, though?


subject: Re: Gen VI Glitch Moves
poster_name: Yeniaul
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7590.msg201220#msg201220 date=1471346205]<br />[quote author=lysandrepk link=topic=7590.msg201218#msg201218 date=1471338729]<br />[quote author=Yeniaul link=topic=7590.msg201215#msg201215 date=1471316448]<br />[quote author=lysandrepk link=topic=7590.msg201200#msg201200 date=1471258922]<br />I didn&#039;t document index numbers, but for my future research I will :)<br />[/quote]<br />Couldn&#039;t you just... oh, I don&#039;t know... check the index with a save/hex editor? I assume that&#039;s how the glitch moves were injected in the first place...<br /><br />I know fucking ZERO about this sort of thing (not owning a 3DS/2DS) but if what I know about DS(i) homebrew applies, then it should be trivial to retrieve the index...<br />[/quote]<br /><br />PowerSaves is not a homebrew application, it is a similar device to an Action Replay (in which you input codes to affect your game, instead of editing a save on an SD card), and so I can&#039;t easily get all the numbers.<br /><br />By the way, 900 is mega evolution.<br />[/quote]<br /><br />You have homebrew on your 3DS, go dump the save using a homebrew application.<br />[/quote]<br />*ding*<br />THANK YOU


subject: Re: Gen VI Glitch Moves
poster_name: lysandrepk
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7590.msg201220#msg201220 date=1471346205]<br />[quote author=lysandrepk link=topic=7590.msg201218#msg201218 date=1471338729]<br />[quote author=Yeniaul link=topic=7590.msg201215#msg201215 date=1471316448]<br />[quote author=lysandrepk link=topic=7590.msg201200#msg201200 date=1471258922]<br />I didn&#039;t document index numbers, but for my future research I will :)<br />[/quote]<br />Couldn&#039;t you just... oh, I don&#039;t know... check the index with a save/hex editor? I assume that&#039;s how the glitch moves were injected in the first place...<br /><br />I know fucking ZERO about this sort of thing (not owning a 3DS/2DS) but if what I know about DS(i) homebrew applies, then it should be trivial to retrieve the index...<br />[/quote]<br /><br />PowerSaves is not a homebrew application, it is a similar device to an Action Replay (in which you input codes to affect your game, instead of editing a save on an SD card), and so I can&#039;t easily get all the numbers.<br /><br />By the way, 900 is mega evolution.<br />[/quote]<br /><br />You have homebrew on your 3DS, go dump the save using a homebrew application.<br />[/quote]<br /><br />Good idea, didn&#039;t think of that lol


subject: Re: Name Changes
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=LanceAndMissingNo. link=topic=3109.msg201181#msg201181 date=1471002858]<br />Hi, I want to change my name ( Addri Trainer ) to ( LanceAndMissingNo. ) if is possibly , thanks.&nbsp; ;)<br />[/quote]<br /><br />Done. :)


subject: Japanese Select Glitch to Gen 2
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ravioli
icon: xx
body:
  Discussion time!<br /><br />As a few of you might already know, if you swap an item with your Pokemon, run immediately, you will be poisoned and be stuck in a loop. Although, when you go to the PKMN center and save and quit every 4 steps to the PC, and withdraw a normal Pokemon, you will get a glitched Pokemon lv. 0 with health 0/0, and an index number of 000. The Pokemon sprite also changes. (Sometimes I get a Rhydon, Charizard, Butterfree, ETC.). If you give this to the daycare man and level him up, he will he will have a glitched moveset (or no moves) and possibly a new sprite and will work as a functioning Pokemon just with glitch moves, cry, EVs, and a glitched sprite.<br /><br />What happens when you transfer this Pokemon to Pokemon G/S/C Japanese? I don&#039;t have a Pokemon Green save file on my PC right now and can&#039;t test it out. Does anybody know what happens?


subject: Re: Posting really slow?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Big thanks to you Abywayax. I hated the slowness of posting (also factor in my lame connection, and bam), so, really big thanks.


subject: Re: Data injection via Link Cable in Gen 1
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Aldrasio link=topic=7576.msg201162#msg201162 date=1470872481]<br />EDIT: [quote author=TheUnReturned link=topic=7576.msg201121#msg201121 date=1469847117]However, could this possibly corrupt the save data by accident?<br />[/quote]<br /><br />Yes, but only if you write 0x0A to any address in the range $0000-$1FFF. This is how you enable reading/writing to SRAM. If you avoid writing to that address range (and you should, unless you mean it), then the save file should be fine.<br />[/quote]<br />Good news, if 0x0A is ever written in that range, writing any other value should lock SRAM again.<br />Usually, the only values used by programs are 0x00 (lock) and 0x0A (unlock), but it looks like non-0x0A locks SRAM. I didn&#039;t test that, though.


