# smf_messages

subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  According to the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold_and_Silver:RAM_map#Pokemon_1_Settings]RAM map from Data Crystal[/url] it&#039;s Attack/Defense then speed/special.<br />Since speed EV is stored before special EV I would assume it&#039;s the same for IVs (so speed is the first byte, special the second).


subject: Re: PokÃ©mon glitch 'haxxed' moments
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=7655.msg207309#msg207309 date=1508431656]<br />Was doing pomeg glitch on hardware for the first time. I used Mudkip as my second fainted pokemon, and on this particular day, I had my headphones plugged in at max volume. Everything was going great until I viewed Mudkip&#039;s stats, in which the game decided to softlock and [b]blare[/b] glitch sounds in my ears.<br /><br />Ouch.<br />[/quote]That&#039;s called the &quot;GBA Crash sound&quot;, more commonly known as &quot;OH SHIT I FUCK UP: The Sound&quot;.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207370#msg207370 date=1508711936]<br /><br />[quote]With enough examples I could reverse engineer the pokemon formula and the DV formula, but this seems to be different (not targeting the first pokemon in the party, and changing the code for box 1 as opposed to box 2).[/quote]<br />Targeting the fourth move of PokÃ©mon 5 is simply because we can reach it directly with available characters. Therefore Box 1 can be used to get the ID for the desired move. The code of Box 2 then writes it.<br />[/quote]<br /><br />Oh, so you simply can&#039;t target pokemon 1?<br />And if we&#039;re using the FMK setup now, how do you convert old codes like this to work with that set up?<br />[quote]Box 1:&nbsp; A&nbsp; p&nbsp; 0&nbsp; k &#039;v&nbsp; A&nbsp; 5&nbsp; 5<br />Box 2:&nbsp; Ã© &#039;m&nbsp; 2&nbsp; p&nbsp; p&nbsp; 0&nbsp; 5&nbsp; 5<br />Box 3:&nbsp; Ã©&nbsp; A&nbsp; 4&nbsp; p &#039;v&nbsp; 7 &#039;v &#039;d<br />Box 4:&nbsp; Ã©&nbsp; â™‚&nbsp; 2&nbsp; p&nbsp; Ã©&nbsp; D&nbsp; 9 &#039;l<br />Box 5: &#039;l&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5<br />Box 6:&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; A &#039;l&nbsp; x &#039;d&nbsp; 5<br />[/quote]<br />Cause when I used a code that needed FMK&#039;s code (The give all TMs code), I ended up renaming all my boxes after so I could go back to using the other codes I&#039;d been using.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  (Apologies for late reply)<br /><br />If you wish to convert the code to work with the TM 25 setup, then this should work:<br /><br />Box 1: Ap0k&#039;vA55<br />Box 2: Ã©&#039;m2pp055<br />Box 3: Ã©A4p&#039;v7&#039;v&#039;d<br />Box 4: Ã©(male)2pÃ©D95<br />Box 5: p&#039;d555555<br /><br />If you&#039;re meaning to use this with coin case, then it should already work as is, provided you executed the one-off code prior.<br /><br />[quote author=Dragon Arbock link=topic=6716.msg207373#msg207373 date=1508714672]<br />Oh, so you simply can&#039;t target pokemon 1?<br />[/quote]<br /><br />Nope (at least not with moveset data). Pokemon 1&#039;s lower byte is not able to be represented with characters. However, some code developers have written self-modifying box name codes as a workaround. Still, it&#039;s much easier to just use addresses that can be represented as is, so we target pokemon 5, move 4, as both the high byte and low byte are able to be represented with [b]4[/b] and [b](male)[/b] respectively.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: clip
body:
  I wanted to know if I could use it with FMK&#039;s code, or if I have to erase FMK&#039;s code to use the shiny code. Because that sounds tedious and defeats the purpose.<br /><br />Also, don&#039;t know if anyone needs this, but I went ahead and made a quick reference for the codes for every move;<br />https://pastebin.com/XSth40BV<br /><br />And proof, used it to get an Extremespeed Dratini.<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207375#msg207375 date=1508725333]<br />I wanted to know if I could use it with FMK&#039;s code, or if I have to erase FMK&#039;s code to use the shiny code. Because that sounds tedious and defeats the purpose.<br /><br />Also, don&#039;t know if anyone needs this, but I went ahead and made a quick reference for the codes for every move;<br />https://pastebin.com/XSth40BV<br /><br />And proof, used it to get an Extremespeed Dratini.<br />[/quote]<br /><br />Yeah, you can probably use your code along with FMK&#039;s one-off code. I haven&#039;t tried it for myself, but I don&#039;t see any reason why it wouldn&#039;t work.<br /><br />Thanks for the reference!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: xx
body:
  &#039;welcome.<br /><br />And well, I trial and errored my way into what I wanted to know.<br />I took a shiny code, and cut off the bottom three Box names so it looks like this;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp0Ã©5&nbsp; &nbsp; &nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; <br />55Ã©A4ppp<br />Then the rest was taken up by 5s and FMK&#039;s code at the bottom. It turned my Ditto shiny, but still corrupted box 3&#039;s name. But I&#039;m assuming (cause I don&#039;t know), the last relevant bit of code is Ã©A4p, then the rest was terminating code?<br />I actually tried it the first time without 55Ã©A4ppp (so only 4 Box names) and that didn&#039;t change the special and speed, so that&#039;s why I&#039;m guessing.<br /><br />Edit;<br />Seems like it. Shortened the modify pokemon code down to work as such<br />[quote]<br />Box 1:&nbsp; A&nbsp; p&nbsp; 0&nbsp; k &#039;v&nbsp; A&nbsp; 5&nbsp; 5<br />Box 2:&nbsp; Ã© &#039;m&nbsp; 2&nbsp; p [x&nbsp; x&nbsp; x&nbsp; x]<br />Box 3:&nbsp; Ã©&nbsp; A&nbsp; 4&nbsp; p &#039;5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp;  <br />[filler 5s]<br />[box 13 and 14 unchanged from FMK&#039;s]<br />[/quote]


subject: Where to start for understanding exactly how glitches work programming-wise?
poster_name: vhs
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: vhs
icon: xx
body:
  Hiya. I&#039;m completely and totally a new person to this forum, and honest to god I don&#039;t quite know where else to look for this, but I&#039;d like to find out where I can learn exactly how gen-1 glitches work in terms of things like hexadecimals and how people can abuse them to achieve different things. I&#039;ve been interested in glitches for R/B/Y for a long portion of my life and I wish to understand more, however I&#039;ve reached the hurdle of actually understanding the programming of the game itself.<br />If there&#039;s a post that explains all of this that I&#039;ve overlooked, my sincere apologies. Thank you for your time.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: FMK
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207377#msg207377 date=1508731071]<br />&#039;welcome.<br /><br />And well, I trial and errored my way into what I wanted to know.<br />I took a shiny code, and cut off the bottom three Box names so it looks like this;<br />Ap0&#039;d&#039;vR55<br />Ã©&#039;m2pp0Ã©5&nbsp; &nbsp; &nbsp;  <br />Ã©A4p0&#039;d&#039;vQ<br />Ã©?2p0k55&nbsp; &nbsp; &nbsp; &nbsp; <br />55Ã©A4ppp<br />Then the rest was taken up by 5s and FMK&#039;s code at the bottom. It turned my Ditto shiny, but still corrupted box 3&#039;s name. But I&#039;m assuming (cause I don&#039;t know), the last relevant bit of code is Ã©A4p, then the rest was terminating code?<br />I actually tried it the first time without 55Ã©A4ppp (so only 4 Box names) and that didn&#039;t change the special and speed, so that&#039;s why I&#039;m guessing.<br />[/quote]<br /><br />That&#039;s correct, yeah.<br /><br />As a general rule of thumb, Ã©*2 (Where * can be anything) will usually mean box names are being modified. Ã©A* (Where * can, again, be anything; But most of the time is 4) is also, usually, the target of the prior name change.<br /><br />So in this case, [i]Ã©&#039;m2[/i] of Box 2 is changing the [i]Ã©A4[/i]&#039;s A of Box 3, and [i]Ã©?2[/i] of Box 4 is changing the [i]Ã©A4[/i]&#039;s A of Box 5. (While the modified Ã©A4&#039;s are changing values elsewhere, of course)<br /><br /><br />As an additional rule of thumb, for codes not designed with my one-off code in mind, if you ignore all the 5&#039;s in Box names, once you see [i]p &#039;v 7 &#039;v &#039;d Ã© * 2 p Ã© D 9 &#039;l &#039;l A &#039;l x &#039;d[/i] (Where * can be anything), that&#039;s where you can usually stop inputting the written box names, and just use 5&#039;s, if you&#039;ve already used my one-off code.<br /><br />But to confirm, yes, all Coin Case codes work after using my one-off code without modification, even if they weren&#039;t specifically made for it.<br /><br /><br />On a related note, to modify a TM25 code to work with Coin Case (If you&#039;ve used my one-off code), it&#039;s as simple as replacing the final [i]&#039;d[/i] of a code with a 5.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: xx
body:
  Alright thanks, I&#039;ll try to keep that in mind when adapting things to fit with your code.<br />(Been wondering too, is there any place we should be compiling all this information in a more organized manner?)<br /><br />Also completely frivolous, but I saw someone did this in gen 1 and I was wondering if it would work here- can I modify a pokemon&#039;s type? If I wanted to make a pokemon with one type a secondary dragon type, how would I go about doing that- and would it remain if I put it in a PC? Cause if not, probably not worth the trouble.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207375#msg207375 date=1508725333]<br />I wanted to know if I could use it with FMK&#039;s code, or if I have to erase FMK&#039;s code to use the shiny code. Because that sounds tedious and defeats the purpose.<br /><br />Also, don&#039;t know if anyone needs this, but I went ahead and made a quick reference for the codes for every move;<br />https://pastebin.com/XSth40BV<br /><br />And proof, used it to get an Extremespeed Dratini.<br />[/quote]<br /><br />Great work.&nbsp; :)<br /><br />[quote author=Dragon Arbock link=topic=6716.msg207380#msg207380 date=1508740863]<br />Also completely frivolous, but I saw someone did this in gen 1 and I was wondering if it would work here- can I modify a pokemon&#039;s type? If I wanted to make a pokemon with one type a secondary dragon type, how would I go about doing that- and would it remain if I put it in a PC? Cause if not, probably not worth the trouble.<br />[/quote]<br /><br />Don&#039;t think it&#039;s possible [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold_and_Silver:RAM_map#Pokemon_1_Settings]Doesn&#039;t look like typing is stored seperately for each single PokÃ©mon.[/url]


subject: Re: Where to start for understanding exactly how glitches work programming-wise?
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hi!<br /><br />If you&#039;re looking for gen 1 glitch information, most of it can be found [url=http://forums.glitchcity.info/index.php?board=107.0]here[/url] at the Gen 1 glitch discussion child board. Most posts here are well explained in technological terms.<br /><br />If you have a question, feel free to ask!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207357#msg207357 date=1508678472]<br />Here&#039;s a quick-and-dirty TM 25 Ball Pocket code that I made to teach Ice Beam to Pokemon 5. Due to character limitations, I was restricted to the fourth move, so make sure Pokemon 5 has at least 3 moves before using.<br /><br />Box 1: Ap0?&#039;vm55<br />Box 2: Ã©(male)4p&#039;d555<br /><br />Here&#039;s the same code, but for use with the Coin Case (ensure to use FMK&#039;s one-off code)<br />Box 1: Ap0?&#039;vm55<br />Box 2: Ã©(male)455555<br />Box 3+ :55555555<br />Box 13: Leave Unchanged (FMK&#039;s Code)<br />Box 14: Leave Unchanged (FMK&#039;s Code)<br /><br />I have not tested the Coin Case version (I prefer to use TM 25), but it should work as described. If it doesn&#039;t, please let me know.<br />[/quote]<br /><br />Thanks it worked. Though I used your code first before I read spamviech&#039;s post so I ended up teaching my Jolteon Ice Beam instead of Thunderbolt, but I quickly fixed that haha. <br /><br />The only other moves I was interested in was Double-Edge and Rock slide, but seeing as Dragon Arbock has post codes for all moves I&#039;ll guess I&#039;ll follow that. 


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  So I used the Hidden Power Water code for Jolteon and I noticed his HP wasn&#039;t maxed, so I Rare Candy it to level 50 just to check its DVs and the Hp DV was 7, but it&#039;s other DVs was 14/13/15/15/15, so that would be right for the Hidden Power, but does anyone know why the HP wasn&#039;t maxed out? Torchickens max DV and Hidden Power Bug codes have worked perfect for me so far, so I don&#039;t know if it&#039;s a error with this particular code or if it&#039;s me being a dumbass again.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: xx
body:
  [quote author=Nostalgia link=topic=8111.msg207385#msg207385 date=1508760221]<br />So I used the Hidden Power Water code for Jolteon and I noticed his HP wasn&#039;t maxed, so I Rare Candy it to level 50 just to check its DVs and the Hp DV was 7, but it&#039;s other DVs was 14/13/15/15/15, so that would be right for the Hidden Power, but does anyone know why the HP wasn&#039;t maxed out? Torchickens max DV and Hidden Power Bug codes have worked perfect for me so far, so I don&#039;t know if it&#039;s a error with this particular code or if it&#039;s me being a dumbass again.<br />[/quote]<br /><br />[url=https://bulbapedia.bulbagarden.net/wiki/Individual_values#Generation_I_and_II]HP is calculated separately based off the other DVs.[/url] The code modifies attack and defense, and special and speed. I don&#039;t think we can directly modify that because of it, but maybe there&#039;s a better attack/defense spread that would give better HP at the cost of a point or two in attack/defense?<br />(knowing that modern hidden power is based on a pattern of evens an odds and not the exact numbers themselves though, there might not be).


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  I thought because Hidden Power is only based on the Attack, Defense, Special and Speed stats - that it doesn&#039;t matter what the HP value is. I used the Hidden Power Bug code for my Scizor and although I didn&#039;t check its DVs in detail, it had maximum HP at level 5 which suggests its DVs were probably 15/13/13/15/15, while my Jolteon didn&#039;t and that&#039;s why I checked it in detail. I don&#039;t care much about a bad HP DV for Jolteon, its a frail Pokemon regardless, but I&#039;m just wondering about the details in the code and if I made the error, because Torchickens designed the codes to give the maximum possible DVs for each Hidden Power, so I&#039;m curious. 


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=8111.msg207388#msg207388 date=1508780187]<br />I thought because Hidden Power is only based on the Attack, Defense, Special and Speed stats - that it doesn&#039;t matter what the HP value is. I used the Hidden Power Bug code for my Scizor and although I didn&#039;t check its DVs in detail, it had maximum HP at level 5 which suggests its DV&#039;s were probably 15/13/13/15/15, while my Jolteon didn&#039;t and that&#039;s why I checked it in detail. I don&#039;t care much about a bad HP for Jolteon, its a frail Pokemon regardless, but I&#039;m just wondering about the details in the code and if I made the error, because Torchickens designed the codes to give the maximum possible DVs for each Hidden Power, so I&#039;m curious.<br />[/quote]<br /><br />Hidden power is only based on atk, def, spd, and special, because those are the only 4 that exist. HP isn&#039;t a DV, it&#039;s a stat calculated based on the other 4. And as far as I understand, the max value it can have is 7 because hidden power water requires an Even attack IV, and having an Even attack means you miss out on 8 points of the max HP stat.


subject: Re: Where to start for understanding exactly how glitches work programming-wise?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I think the first thing you need to understand the internal of glitches - any generation included - is coding. Have solid programming knowledge. This way - even not looking at the game&#039;s code ! - you can get a grasp of how &quot;things work&quot;. Then, though things were programmed so this happens, what would happen if *this* happened instead ? (To put it differently, there are many different ways to have an given action trigger another, but they have different effects when unintended situations are encountered.) That&#039;s what you need to understand to get &quot;how glitches work programming-wise&quot;.<br /><br />To be fair, when I started, I had no idea how the Game Boy worked. I researched how WTW worked by poking around memory, not even code.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah, that makes sense. So would Hidden Power Grass or Hidden Power Ice give a better HP stat? Supposedly HP Water is the best option for Jolteon in gen II, but Grass and Ice are still viable and are run on it in every after generation after II.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Here are the hidden power equations:<br /><br />TypeId: 4 Ã— (atkIv modulo 4) + (defIv modulo 4)<br /><br />Damage: (5 * (specIv=&gt;8 + 2speedIv=&gt;8 + 4defIv=&gt;8 + atkIv=&gt;8 ) + (specIv modulo 4))/2 + 31 <br /><br />XIv=&gt;8 is either 0 or 1 depending on if the specified IV is greater than or equal to 8<br /><br />[quote author=Nostalgia link=topic=8111.msg207391#msg207391 date=1508782004]<br />Ah, that makes sense. So would Hidden Power Grass or Hidden Power Ice give a better HP stat? Supposedly HP Water is the best option for Jolteon in gen II, but Grass and Ice are still viable and are run on it in every after generation after II.<br />[/quote]<br /><br />From what i&#039;m gathering from Bulbapedia, Hidden power is completely seperate from the HP stat.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=8111.msg207389#msg207389 date=1508780458]<br /> And as far as I understand, the max value it can have is 7 because hidden power water requires an Even attack IV, and having an Even attack means you miss out on 8 points of the max HP stat.<br />[/quote]<br /><br />Then Grass would be 7 too I guess as it requires a 14 Attack stat which is even, and Ice should be normal because it requires a 15 attack stat.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=8111.msg207392#msg207392 date=1508782114]<br /><br />From what i&#039;m gathering from Bulbapedia, Hidden power is completely seperate from the HP stat.<br />[/quote]<br /><br />In gen 2, Hidden Power, and the HP stat are both calculated from the other 4 DVs, so they do loosely have something to do with eachother.<br /><br />And yes, Ice would give you 15 in HP. Grass would only give you 3.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=8111.msg207394#msg207394 date=1508784500]<br />[quote author=Couldntthinkofaname link=topic=8111.msg207392#msg207392 date=1508782114]<br /><br />From what i&#039;m gathering from Bulbapedia, Hidden power is completely seperate from the HP stat.<br />[/quote]<br /><br />In gen 2, Hidden Power, and the HP stat are both calculated from the other 4 DVs, so they do loosely have something to do with eachother.<br /><br />And yes, Ice would give you 15 in HP. Grass would only give you 3.<br />[/quote]<br /><br />Thanks for the info.<br /><br />I looked on bulbapedia and couldn&#039;t find where HP was calculated, can you point me in the direction of this information?


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Dragon Arbock
icon: xx
body:
  [quote]The HP IV is calculated by taking the least significant bit (the final binary digit) of the Attack, Defense, Speed, and Special IVs, then creating a binary string by placing them in that order. As such, a PokÃ©mon with an odd-number Attack IV has 8 added to its HP IV, an odd-number Defense IV has 4 added, an odd-number Speed IV has 2 added, and an odd-number Special IV has 1 added.[/quote]<br />https://bulbapedia.bulbagarden.net/wiki/Individual_values#Generation_I_and_II<br /><br />Not so much of a calculation, more of a &#039;if odd, add x, if even, add zero&#039;.


subject: Any FR/LG item duplication glitch?
poster_name: TheAngryrRampardos
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Just wondering if there&#039;s any of the sort from maximizing rare candies to tms that could be accomplished in the Gen remakes?


subject: Re: Any FR/LG item duplication glitch?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I&#039;m not sure, sorry.<br /><br />However, I know that in PokÃ©mon Emerald there is a way to duplicate items in the bag or storage PC via [url=http://glitchcity.info/wiki/Pomeg_data_corruption_glitch]Pomeg data corruption glitch[/url], as demonstrated by TheZZAZZGlitch [url=http://OH8apzY9r0c]here[/url]. If you have PokÃ©mon Emerald you can do that (and if necessary if you have a Link Cable you should be able to trade the item as a hold item from FireRed/LeafGreen to Emerald).<br /><br />The Pomeg data corruption glitch can be executed on FireRed/LeafGreen too; if a PokÃ©mon with negative HP is traded over from Emerald. In order to do that, you need to have it so your PokÃ©mon is at an adequate level to drop 2 points instead of 1 (otherwise the best you can do is faint the PokÃ©mon). I don&#039;t know the specifics regarding the minimum level you need, but if you have a Level 50 PokÃ©mon it should gain 2 HP points after using a HP Up. Afterwards, if the PokÃ©mon&#039;s maximum HP is odd (e.g. Banette) you can have that PokÃ©mon use Curse twice to get 1 HP, otherwise you can get the PokÃ©mon poisoned in Petalburg Woods and walk around until its HP reaches 1.<br /><br />After reaching 1 HP use that Pomeg Berry to get 65535 HP (or 65534 HP, which is apparently due to another bug) after which you can trade the PokÃ©mon over to FireRed/LeafGreen and perform the usual Pomeg corruption glitch effects.<br /><br />https://www.youtube.com/watch?v=RIrfohYVWoQ<br /><br />Hope this helps. :)


subject: Re: Any FR/LG item duplication glitch?
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not in FR/LG, but in Emerald it&#039;s really easy to clone items in the Battle Frontier. Just as simple as cloning in the gen II games really. Sucks you have to wait until post-game to access the Frontier, but then it&#039;s really easy to clone TM&#039;s, Vitamins, Master Balls etc. 


subject: Re: Any FR/LG item duplication glitch?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Ah yes. ^^<br /><br />I think with Battle Tower cloning it can be slower for mass duplication but you get the advantage of it working all the time where with Pomeg glitch the chances can be slim. I recommend the Battle Tower cloning as Nostalgia describes personally.<br /><br />That also makes me remember that if you can get a fast cloning glitch PokÃ©mon with Pomeg glitch you have a quicker way of cloning on both Emerald and FireRed, but it can be a pain to get one.<br /><br />These are the IDs from [url=https://pastebin.com/2kJpBQCr]Metarkrai&#039;s any PokÃ©mon/item/move Pastebin[/url]:<br /><br />(Emer Fr : 0x2890, Emer Us : 0x288A, Emer Spa : 0x2890, Emer Ita : 0x2718, Emer Ger : 0x2891, Emer Jap : 0x2660, FrLg FR : 0x320B, FrLg US : 0x3200, FrLg Spa : 0x3210, FrLg Ita : 0x320A, FrLg Ger : 0x320F, FrLg Jap : 0x4F90 )


subject: Re: Any FR/LG item duplication glitch?
poster_name: TheAngryrRampardos
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow this is all really confusing &amp; complicated but right now I&#039;ll go with the pomeg glitch cause I ain&#039;t spend 50 to 100 dollars for an GameShark. :P


subject: Re: Any FR/LG item duplication glitch?
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Only the Pomeg glitch is complicated. The Battle Frontier cloning glitch is incredibly simple and there are many videos showing you how easy it is to do, like this one: https://www.youtube.com/watch?v=nhRScYEKY1s&amp;t=11s


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=FMK link=topic=6716.msg207379#msg207379 date=1508740404]<br />As a general rule of thumb, Ã©*2 (Where * can be anything) will usually mean box names are being modified. Ã©A* (Where * can, again, be anything; But most of the time is 4) is also, usually, the target of the prior name change.<br />[/quote]<br /><br />Just for reference I have a small list of directly reachable box name characters. [s]Since it could become confusing with later used codes I left out terminator characters, since I don&#039;t know how they are handeled.[/s] Terminator characters (normally 0x50 or 80 in decimal (LD D,B) are written after the [b]|[/b] character).<br />To use it load the desired value into register A using XOR A (p), SUB (&#039;v), OR (0) and AND (?) instructions and then use [b]Ã©*2[/b] where you replace [b]*[/b] with the desired character in the list below.<br />Places with [b]_[/b] are not directly reachable.<br /><br />[code]<br />Box 1($D8BF to $D8C7): _ _ _ _ _ _ _ _|_<br />Box 2($D8C8 to $D8D0): _ _ _ _ _ _ _ _|&#039;d<br />Box 3($D8D1 to $D8D9):&#039;l&#039;m&#039;r&#039;s&#039;t&#039;v _ _|_<br />Box 4($D8DA to $D8E2): _ _ _ _ _ _ _Pk|Mn<br />Box 5($D8E3 to $D8EB): - _ _ ? ! . &amp; Ã©|_<br />Box 6($D8EC to $D8F4): _ _ _ â™‚ _ Ã— _ /|,<br />Box 7($D8F5 to $D8FD): â™€ 0 1 2 3 4 5 6|7<br />Box 8($D8FE to $D906): 8 9 _ _ _ _ _ _|_<br />Box 9($D907 to $D90F): _ _ _ _ _ _ _ _|_<br />Box10($D910 to $D918): _ _ _ _ _ _ _ _|_<br />Box11($D919 to $D921): _ _ _ _ _ _ _ _|_<br />Box12($D922 to $D92A): _ _ _ _ _ _ _ _|_<br />Box13($D92B to $D933): _ _ _ _ _ _ _ _|_<br />Box14($D934 to $D93C): _ _ _ _ _ _ _ _|_<br />[/code]<br /><br /><br />Edit:<br />Something else I found after poking around a bit:<br />[quote author=Torchickens link=topic=6716.msg203426#msg203426 date=1482106350]<br />Though Coin Case gives you a corrupted stack and the game would glitch dimension/freeze after ret, you can solve the issue by using the following edits as part of a footer in your code.<br /><br />[code]<br />xor a<br />ld (ff83),a<br />pop de<br />pop de<br />inc sp<br />pop de<br />or a<br />ret nc<br />[/code]<br /><br />(Found from deconstructing the box name code [url=http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Gold/Silver/Any%25_Guide]here[/url]).<br /><br />There is one catch and something you need to know:<br /><br />inc sp (hex:33) cannot normally be represented by box characters. However, you can get the ID for inc sp with the following: xor a;&nbsp; sub fd; sub d0 and then use ld (xxyy),a to self-modify your code to add an inc sp.<br /><br />This method also has a bad side effect of slowing menus down to an extreme, but after closing the menu if you hold down A and tap down you will be able to move the cursor to SAVE, mash A to save the game and reset the game to bring things back to normal.<br />[/quote]<br />If you check the box name code on the [url=http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Gold/Silver/Any%25_Guide]speedrun page[/url] you may notice a version for less laggy credits. The only difference is Ã©ZÃ— (LD [f199], A; A is still at value 0).<br />If you incorporate this in your code the menu lag is no longer present. Only thing which might require a reset is that the player character is still invisible.<br /><br />To include this into FMK&#039;s one-off code it would then look like this:<br />[code]Box 1 : Ap0w&#039;vA55&nbsp; &nbsp; (XOR A; OR b6; SUB 0x80)<br />Box 2 : Ã©&#039;m2p&#039;v7&#039;v&#039;d (LD [d2f8], A; XOR A; SUB fd; SUB d0)<br />Box 3 : Ã©A355555&nbsp; &nbsp;  (LD [80f9], A)<br />Box 4+: 55555555&nbsp; &nbsp;  (Safe filler code)<br />Box 13: ppÃ©D9Ã©ZÃ—&nbsp; &nbsp;  (XOR A; XOR A; LD [83ff], A; LD [f199], A)<br />Box 14: &#039;l&#039;lA&#039;lx&#039;d55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)[/code]<br />Usage stays the same as before.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207403#msg207403 date=1508839752]<br />[quote author=FMK link=topic=6716.msg207379#msg207379 date=1508740404]<br />If you check the box name code on the [url=http://wiki.pokemonspeedruns.com/index.php?title=Pok%C3%A9mon_Gold/Silver/Any%25_Guide]speedrun page[/url] you may notice a version for less laggy credits. The only difference is Ã©ZÃ— (LD [f199], A; A is still at value 0).<br />If you incorporate this in your code the menu lag is no longer present. Only thing which might require a reset is that the player character is still invisible.<br /><br />To include this into FMK&#039;s one-off code it would then look like this:<br />[code]Box 1 : Ap0w&#039;vA55&nbsp; &nbsp; (XOR A; OR b6; SUB 0x80)<br />Box 2 : Ã©&#039;m2p&#039;v7&#039;v&#039;d (LD [d2f8], A; XOR A; SUB fd; SUB d0)<br />Box 3 : Ã©A355555&nbsp; &nbsp;  (LD [80f9], A)<br />Box 4+: 55555555&nbsp; &nbsp;  (Safe filler code)<br />Box 13: ppÃ©D9Ã©ZÃ—&nbsp; &nbsp;  (XOR A; XOR A; LD [83ff], A; LD [f199], A)<br />Box 14: &#039;l&#039;lA&#039;lx&#039;d55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)[/code]<br />Usage stays the same as before.<br />[/quote]<br />[/quote]<br />Ah that&#039;s great. I wasn&#039;t aware of that. Thanks! :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misdreavus
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is there a code to change the stat experience of one of my PokÃ©mon&#039;s stats to a number of my choice (not max)?<br /><br />Also, how exactly do I use this to change my Trainer ID and name to something custom?&nbsp; In particular, I want to change my name to TRAINER and change my ID to 05375 and 36437 and so I can re-nickname some PokÃ©mon from in-game trades.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  From the initial post:<br />[quote]CHANGE THE PLAYER&#039;S NAME<br /><br />With this setup, you can change your name to the nickname of your first Pokemon. Using 8F will copy one letter from your first Pokemon&#039;s nickname to your player name. Use 8F (length of the name+1) times to copy all the name characters.<br />Warning: This code is self modifying, it will increase quantities of items #3 and #5 every use - remember to set those quantities back to 181 and 88 if you want to reset this. Also use carefully, as there&#039;s no memory protection implemented and you may cause save corruption if you&#039;re not careful.<br /><br />Video: http://www.youtube.com/watch?v=Sw0h7ImFsAs#t=918s<br /><br />ITEM LIST (starting from the first slot):<br />* Any item<br />* 8F<br />TM50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x181<br />TM10&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x64<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x88<br />TM09&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x46<br />Calcium&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x52<br />X Accuracy&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x35<br />Full Heal&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x201[/quote]<br /><br />To change your ID you don&#039;t even need ACE since it&#039;s directly accessable in underflow. It&#039;s the 9th item count and 10th item type in underflow.<br />If you start counting from your first item it should be entry 30 (count) and 31 (type).


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Misdreavus link=topic=6638.msg207405#msg207405 date=1508853776]<br />Is there a code to change the stat experience of one of my PokÃ©mon&#039;s stats to a number of my choice (not max)?<br /><br />Also, how exactly do I use this to change my Trainer ID and name to something custom?&nbsp; In particular, I want to change my name to TRAINER and change my ID to 05375 and 36437 and so I can re-nickname some PokÃ©mon from in-game trades.<br />[/quote]<br /><br />Which stat experience would you like to change?<br /><br />Here&#039;s one for HP EV:<br /><br />Lemonade&nbsp; x??<br />Thunderstone x124<br />TM 09&nbsp; &nbsp; &nbsp; x34<br />Poke Ball&nbsp; x119<br />TM 01&nbsp; &nbsp;  xAny<br /><br />Replace [b]??[/b] with the desired value.<br /><br />Replace Thunderstone x124 with Thunderstone x126 for attack EV.<br /><br />Thundersatone x128 for Defense EV<br /><br />Thunderstone x130 for Speed EV<br /><br />Thunderstone x132 for Special EV


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Say, does anyone know how to enable walk through walls in gen 2? Or know what adress to edit for it?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Skeef link=topic=6716.msg207408#msg207408 date=1508873183]<br />Say, does anyone know how to enable walk through walls in gen 2? Or know what adress to edit for it?<br />[/quote]<br /><br />Unfortunatly, there doesn&#039;t appear to be an in-game address that disables collisions.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  If you change addresses CEA3-CEA6 to 08 (or apparently all values 08-0E), it will allow you to walk through almost any wall. However these addresses will be reset after taking a step, so if you want to do this with arbitrary code execution it must be done with something like many uses of wrong pocket TM/HM code execution (as Coin Case requires moving in a specific pattern), or [url=https://www.youtube.com/watch?v=1w2iQdAHPh4]&quot;real time arbitrary code execution&quot;[/url].


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207410#msg207410 date=1508880609]<br />If you change addresses CEA3-CEA6 to 08 (or apparently all values 08-0E), it will allow you to walk through almost any wall. However these addresses will be reset after taking a step, so if you want to do this with arbitrary code execution it must be done with something like many uses of wrong pocket TM/HM code execution (as Coin Case requires moving in a specific pattern), or [url=https://www.youtube.com/watch?v=1w2iQdAHPh4]&quot;real time arbitrary code execution&quot;[/url].<br />[/quote]<br /><br /><br />Usually when I try writing to the OAM DMA, the game ends up crashing.<br /><br />Maybe i&#039;m missing something.<br /><br />EDIT: Just tried it again, worked fine. Can&#039;t recall what I did wrong initially.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207410#msg207410 date=1508880609]<br />If you change addresses CEA3-CEA6 to 08 (or apparently all values 08-0E), it will allow you to walk through almost any wall.<br />[/quote]<br /><br />I usually set those addresses to [tt]00[/tt] out of habit and it works but I&#039;m not sure of how exactly different are the various values.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Here&#039;s a new code:<br /><br />All encountered Pokemon are shiny:<br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p0-Ã©K955<br />Box 3: p02Ã©L9p&#039;d<br />Box 4: (Doesn&#039;t Matter)<br />Box 5: p0Ã©Ã©(male)&#039;dyy<br />Box 6: p0kÃ©0&#039;dp&#039;d<br /><br />After executing, just walk around in the grass. Any Pokemon you encounter will be shiny!<br /><br />Please note this does affect trainer Pokemon as well, meaning any trainer you encounter will have a full shiny team. Also, note that the only way to disable this code is by resetting the game.<br /><br />As of right now, this is TM 25 only. I have yet to port this for coin case.<br /><br />Enjoy!


subject: Re: Any FR/LG item duplication glitch?
poster_name: TheAngryrRampardos
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=8120.msg207402#msg207402 date=1508829362]<br />Only the Pomeg glitch is complicated. The Battle Frontier cloning glitch is incredibly simple and there are many videos showing you how easy it is to do, like this one: https://www.youtube.com/watch?v=nhRScYEKY1s&amp;t=11s<br />[/quote]<br />Well look&#039;s like i&#039;m gonna have to get my hands on a copy pf emerald then.<br />:P


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207413#msg207413 date=1508892983]<br />Here&#039;s a new code:<br /><br />All encountered Pokemon are shiny:<br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p0-Ã©K955<br />Box 3: p02Ã©L9p&#039;d<br />Box 4: (Doesn&#039;t Matter)<br />Box 5: p0Ã©Ã©(male)&#039;dyy<br />Box 6: p0kÃ©0&#039;dp&#039;d<br /><br />After executing, just walk around in the grass. Any Pokemon you encounter will be shiny!<br /><br />Please note this does affect trainer Pokemon as well, meaning any trainer you encounter will have a full shiny team. Also, note that the only way to disable this code is by resetting the game.<br /><br />As of right now, this is TM 25 only. I have yet to port this for coin case.<br /><br />Enjoy!<br />[/quote]<br /><br />Oh, this sounds cool. If this is possible, is it possible to use a code to alter the species of wild pokemon? I know with 8F you could.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207415#msg207415 date=1508906350]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207413#msg207413 date=1508892983]<br />Here&#039;s a new code:<br /><br />All encountered Pokemon are shiny:<br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p0-Ã©K955<br />Box 3: p02Ã©L9p&#039;d<br />Box 4: (Doesn&#039;t Matter)<br />Box 5: p0Ã©Ã©(male)&#039;dyy<br />Box 6: p0kÃ©0&#039;dp&#039;d<br /><br />After executing, just walk around in the grass. Any Pokemon you encounter will be shiny!<br /><br />Please note this does affect trainer Pokemon as well, meaning any trainer you encounter will have a full shiny team. Also, note that the only way to disable this code is by resetting the game.<br /><br />As of right now, this is TM 25 only. I have yet to port this for coin case.<br /><br />Enjoy!<br />[/quote]<br /><br />Oh, this sounds cool. If this is possible, is it possible to use a code to alter the species of wild pokemon? I know with 8F you could.<br />[/quote]<br /><br />Yes, and I will work on it as soon as I get home.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207411#msg207411 date=1508887785]<br />[quote author=Torchickens link=topic=6716.msg207410#msg207410 date=1508880609]<br />If you change addresses CEA3-CEA6 to 08 (or apparently all values 08-0E), it will allow you to walk through almost any wall. However these addresses will be reset after taking a step, so if you want to do this with arbitrary code execution it must be done with something like many uses of wrong pocket TM/HM code execution (as Coin Case requires moving in a specific pattern), or [url=https://www.youtube.com/watch?v=1w2iQdAHPh4]&quot;real time arbitrary code execution&quot;[/url].<br />[/quote]<br /><br /><br />Usually when I try writing to the OAM DMA, the game ends up crashing.<br /><br />Maybe i&#039;m missing something.<br /><br />EDIT: Just tried it again, worked fine. Can&#039;t recall what I did wrong initially.<br />[/quote]<br />Since the OAM DMA routine is ran on every frame, you must overwrite the terminating RET last. Maybe that&#039;s what was going awry.


subject: Re: Any FR/LG item duplication glitch?
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  Well that&#039;s a good decision because it&#039;s the best 3rd gen game out there. Lots of fun and the Battle Frontier gives the game loads of replay value, much more then any other 3rd gen game. I have 200+ hours on my Emerald file because I put a lot of time into the Battle Frontier and managed to get 5 out of the 7 Gold Symbols. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  Took a lot longer than expected, but here it is!<br /><br />All wild Pokemon are &lt;inset [b]x[/b] pokemon here&gt;:<br />Box 1: Ap&#039;v8Ã©&#039;m25<br />Box 2: p0(male)55555<br />Box 3: &#039;v&#039;vÃ©52p0&#039;m<br />Box 4: Ã©J9p0(female)55<br />Box 5: Ã©K9p0255<br />Box 6: Ã©L9p&#039;d555<br />Box 7: p0[b]?[/b]yyÃ©Ã©&#039;d<br />Box 8: p&#039;dyyyyyy<br /><br />Replace [b]?[/b] with the SpeciesID.<br /><br />Now, obviously not every Pokemon is going to be able to be represented with valid characters. If you would like this code to work with a specific Pokemon, just let me know and i&#039;ll be happy to make an adaption.<br /><br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  That&#039;s amazing, what level are the Pokemon? The same level as the Pokemon on the route that are replaced? And you said to get encounters back to normal you just reset the game? Also does a Celebi you catch with this glitch have its start moves of Leech Seed, Heal Bell, Confusion and Recover?<br /><br />As for suggestions for other Pokemon - maybe the baby Pokemon (Cleffa, Igglybuff, Magby, Elekid, Pichu) as these Pokes are annoying to breed for because for whatever reason its takes ages for the daycare to produce a egg I&#039;m finding in the VC versions, others have reported this too, you get there eventually, but it sometimes takes A LOT of biking just for them to produce one egg.<br /><br />Also the legendary beasts would be useful too. :) Currently I have Suicune, but it&#039;s annoying trying to rely on luck finding the others especially when you don&#039;t have their Pokedex entries. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207420#msg207420 date=1508954835]<br />That&#039;s amazing, what level are the Pokemon? The same level as the Pokemon on the route that are replaced? And you said to get encounters back to normal you just reset the game? Also does a Celebi you catch with this glitch have its start moves of Leech Seed, Heal Bell, Confusion and Recover?<br /><br />As for suggestions for other Pokemon - maybe the baby Pokemon (Cleffa, Igglybuff, Magby, Elekid, Pichu) as these Pokes are annoying to breed for because for whatever reason its takes ages for the daycare to produce a egg I&#039;m finding in the VC games, others have reported this too, you get there eventually, but it sometimes takes A LOT of biking just for them to produce one egg.<br /><br />Also the legendary beasts would be useful too. :) Currently I have Suicune, but it&#039;s annoying trying to rely on luck finding the others especially when you don&#039;t have their Pokedex entries. <br />[/quote]<br /><br />Thank you!<br /><br />Regarding the levels, they are based on the route you used this exploit in. Regarding the moves, the Celebi I tried this with used Confusion and Heal Bell agianst me, but I only had time to test out 3 attacks (it used heal bell twice).<br /><br />As for the other Pokemon you mentioned, I will make them as soon as I return to my computer. :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s really nice of you to do. I was gonna mess around with it when I have time, but&nbsp; if you can, you should probably make it compatible with pokemon that don&#039;t match existing single characters (like Sneasel is &#039;t&#039;v8).


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207421#msg207421 date=1508955427]<br />Thank you!<br /><br />Regarding the levels, they are based on the route you used this exploit in. Regarding the moves, the Celebi I tried this with used Confusion and Heal Bell agianst me, but I only had time to test out 3 attacks (it used heal bell twice).<br /><br />As for the other Pokemon you mentioned, I will make them as soon as I return to my computer. :)<br />[/quote]<br /><br />This seems the best way to get Celebi with it&#039;s start moves then. Other methods to obtain Celebi then have to do another glitch to teach it&#039;s start moves which takes a longer time. The only other way to get a Celebi with its start moves using one method is using the bad clone method to get a Celebi at level 0 then give it a Rare Candy to level 1 and it will learn it&#039;s start moves, but the bad clone method is more complicated, risky and time consuming, so your discovery is definitely the best method. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207422#msg207422 date=1508956493]<br />That&#039;s really nice of you to do. I was gonna mess around with it when I have time, but&nbsp; if you can, you should probably make it compatible with pokemon that don&#039;t match existing single characters (like Sneasel is &#039;t&#039;v8).<br />[/quote]<br /><br />Thanks!<br /><br />In box 7 I left room for a [b]&#039;v[/b] and another value to do just that. I left it out of the code for use with the likes of Celebi.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  This would be a good video idea to make along with the all encountered Pokemon are shiny code you discovered, Torchickens I hope you&#039;re reading this. <br /><br />Anyway I&#039;m still curious about some of the other factors with this. Like, if you set all the wild encounters to Celebi, catch the Celebi and save, how does the encounters go back to normal upon resetting if you just saved with that code in place? The one thing I wouldn&#039;t want to happen with a glitch like this would be to permanently mess up the code of the wild encounters.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207425#msg207425 date=1508959867]<br />This would be a good video idea to make along with the all encountered Pokemon are shiny code you discovered, Torchickens I hope you&#039;re reading this. <br /><br />Anyway I&#039;m still curious about some of the other factors with this. Like, if you set all the wild encounters to Celebi, catch the Celebi and save, how does the encounters go back to normal upon resetting if you just saved with that code in place? The one thing I wouldn&#039;t want to happen with a glitch like this would be to permanently mess up the code of the wild encounters.<br />[/quote]<br /><br />I can make a video of it, provided I can figure out how lol<br /><br />As to how the code resets upon saving/resetting, the game simply fixes the DMA OAM routine upon startup.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Okay I understand. <br /><br />But maybe Torchickens or Crystal_ might, they have both have made plenty of Coin Case videos in the past but this is something new to showcase and many people would find it useful.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Glad to hear!<br /><br />I&#039;ll combine this with my shiny code, [s]and hopefully add a PokÃ¨rus code as well.[/s]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Speaking of videos, is it possible to use this code but with PP Ups instead? https://www.youtube.com/watch?v=CiDi5nb-uoc I just want to know if there is a easier way to get PP Ups instead of the slow cloning method.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207426#msg207426 date=1508960591]<br />I can make a video of it, provided I can figure out how lol<br />[/quote]<br /><br />BGB lets you capture both video and audio! :) 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=SatoMew link=topic=6716.msg207430#msg207430 date=1508964902]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207426#msg207426 date=1508960591]<br />I can make a video of it, provided I can figure out how lol<br />[/quote]<br /><br />BGB lets you capture both video and audio! :) <br />[/quote]<br />Wondrous! I&#039;ll have it made sometime today/tommorow.<br /><br />I can&#039;t say it will be Torchickens or Crystal_ quality though


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207429#msg207429 date=1508963500]<br />Speaking of videos, is it possible to use this code but with PP Ups instead? https://www.youtube.com/watch?v=CiDi5nb-uoc I just want to know if there is a easier way to get PP Ups instead of the slow cloning method.<br />[/quote]<br /><br />This should give you 255 of the first item in your item pack.<br /><br />Box1: A p 0 9 Ã© z &#039;t x<br />Box2: &#039;d<br /><br />[quote author=Nostalgia link=topic=6716.msg207423#msg207423 date=1508957731]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207421#msg207421 date=1508955427]<br />Thank you!<br /><br />Regarding the levels, they are based on the route you used this exploit in. Regarding the moves, the Celebi I tried this with used Confusion and Heal Bell agianst me, but I only had time to test out 3 attacks (it used heal bell twice).<br /><br />As for the other Pokemon you mentioned, I will make them as soon as I return to my computer. :)<br />[/quote]<br /><br />This seems the best way to get Celebi with it&#039;s start moves then. Other methods to obtain Celebi then have to do another glitch to teach it&#039;s start moves which takes a longer time. The only other way to get a Celebi with its start moves using one method is using the bad clone method to get a Celebi at level 0 then give it a Rare Candy to level 1 and it will learn it&#039;s start moves, but the bad clone method is more complicated, risky and time consuming, so your discovery is definitely the best method.<br />[/quote]<br /><br />You could run TM25 in a more 8F way. Setting up the item pack. This is a gen 2 version of the change any byte in ram code. The box code above can help you get items over 99.<br /><br />Any &lt;- I actually have TM25 here :D<br />Any<br />Fresh Water - ld l <br />Full Heal - ld h xx<br />PP Up - ld a xx<br />Focus Band x201 - ld (hl) a / Ret<br /><br />So 44 Fresh Water and 218 Full Heal would point to your fist party pokÃ©mon. With PP Up quantity determining the move learned. Jumping to item 3 requires a slide pokÃ©mon and Quagsire with music mail and Attract as move 1.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: clip
body:
  I&#039;ve successfully combined my two prior codes! Here&#039;s the outcome:<br /><br />All encountered Pokemon are &lt;insert [b]x[/b] Pokemon here&gt; [b]and[/b] shiny:<br />Box 1:&nbsp; Ap&#039;v8Ã©&#039;m25<br />Box 2:&nbsp; p0(male)55555<br />Box 3:&nbsp; &#039;vAÃ©52p0&#039;m<br />Box 4:&nbsp; Ã©J9p0(female)55<br />Box 5:&nbsp; Ã©K9p0255<br />Box 6:&nbsp; Ã©L9p&#039;d555<br />Box 7:&nbsp; p0[b]?[/b]yyÃ©A&#039;d<br />Box 8:&nbsp; p0Ã©Ã©(female)&#039;dyy<br />Box 9:&nbsp; p0kÃ©0&#039;dp&#039;d<br /><br />Replace [b]?[/b] with the species index<br /><br />To access species indexes that are lower than $7f, than replace Box 7 with:<br /><br />Box 7: p0[b]?[/b]&#039;v(space)Ã©A&#039;d<br /><br />Then replace [b]?[/b] with SpeciesIndex + $7f<br /><br />Due to the way the game generates wild Pokemon, [b]most[/b] Pokemon obtained this way are 100% legitimate. This means they will probably be able to be moved to PokÃ©bank when such services become available. There might still be OT issues with Mew, but these can easily be resolved with an OT editor, and I can make one if needs be.<br /><br />Nintendo&#039;s going to have a real headache on their hands :) 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Skeef link=topic=6716.msg207432#msg207432 date=1508969425]<br />This should give you 255 of the first item in your item pack.<br /><br />Box1: A p 0 9 Ã© z &#039;t x<br />Box2: &#039;d<br />[/quote]<br /><br />Is this a TM25 method? Because I&#039;m only using the Coin Case for now.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Is your shiny and wild encounter modifier code TM 25? Cause I can&#039;t get it to work with coin case.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207436#msg207436 date=1508983787]<br />Is your shiny and wild encounter modifier code TM 25? Cause I can&#039;t get it to work with coin case.<br />[/quote]<br /><br />Yep. TM 25 only for the time being, an unfortunately, it&#039;s likely to stay that way.<br /><br />My code needs to load $xx into $d0ed, but the problem is $ed isn&#039;t character-representable. To compensate, my code double self-mods in order to load $ed into it&#039;s necessary location. That, and the code used to derail OAM DMA, takes up 6 boxes. Since box 7 is the only box that allows self-modding on all character slots, the code must start there. Adding the coin-case setup would take up box 7, the only box I can use.<br /><br />Sorry. :(<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah, disappointing.. don&#039;t know if it&#039;s worth the trouble to update my setup to 25 or not.. and then the other codes I use would need to be updated too.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  I personally recommend TM 25 ACE, there&#039;s no hassle to fix the stack and you don&#039;t need to walk in a certain manner or listen to specific cry.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  None of that really bothers me. The most tedious part has to be done either way (typing in the code). I could see the advantages though, either way I&#039;ll probably be forced into using it as support for coin case wavers.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misdreavus
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6638.msg207406#msg207406 date=1508858058]<br />From the initial post:<br />[quote]CHANGE THE PLAYER&#039;S NAME<br /><br />With this setup, you can change your name to the nickname of your first Pokemon. Using 8F will copy one letter from your first Pokemon&#039;s nickname to your player name. Use 8F (length of the name+1) times to copy all the name characters.<br />Warning: This code is self modifying, it will increase quantities of items #3 and #5 every use - remember to set those quantities back to 181 and 88 if you want to reset this. Also use carefully, as there&#039;s no memory protection implemented and you may cause save corruption if you&#039;re not careful.<br /><br />Video: http://www.youtube.com/watch?v=Sw0h7ImFsAs#t=918s<br /><br />ITEM LIST (starting from the first slot):<br />* Any item<br />* 8F<br />TM50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x181<br />TM10&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x64<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x88<br />TM09&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x46<br />Calcium&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x52<br />X Accuracy&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x35<br />Full Heal&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x201[/quote]<br /><br />To change your ID you don&#039;t even need ACE since it&#039;s directly accessable in underflow. It&#039;s the 9th item count and 10th item type in underflow.<br />If you start counting from your first item it should be entry 30 (count) and 31 (type).<br />[/quote]Thanks.&nbsp; So If I want to temporarily set my name to TRAINER, I&#039;d use 8F with this item setup 8 times, and when I want my name to revert to normal, I&#039;d simply toss 8 quantities each of TM50 and TM34?<br /><br />[quote author=Couldntthinkofaname link=topic=6638.msg207407#msg207407 date=1508858214]<br />[quote author=Misdreavus link=topic=6638.msg207405#msg207405 date=1508853776]<br />Is there a code to change the stat experience of one of my PokÃ©mon&#039;s stats to a number of my choice (not max)?<br /><br />Also, how exactly do I use this to change my Trainer ID and name to something custom?&nbsp; In particular, I want to change my name to TRAINER and change my ID to 05375 and 36437 and so I can re-nickname some PokÃ©mon from in-game trades.<br />[/quote]<br /><br />Which stat experience would you like to change?<br /><br />Here&#039;s one for HP EV:<br /><br />Lemonade&nbsp; x??<br />Thunderstone x124<br />TM 09&nbsp; &nbsp; &nbsp; x34<br />Poke Ball&nbsp; x119<br />TM 01&nbsp; &nbsp;  xAny<br /><br />Replace [b]??[/b] with the desired value.<br /><br />Replace Thunderstone x124 with Thunderstone x126 for attack EV.<br /><br />Thundersatone x128 for Defense EV<br /><br />Thunderstone x130 for Speed EV<br /><br />Thunderstone x132 for Special EV<br />[/quote]Thanks.&nbsp; Pardon my ignorance, but is there some type of conversion between the actual decimal EV number I want (say 40000) and the number of Lemonades?&nbsp; I&#039;m guessing I don&#039;t actually need 40000 Lemonades. (or if that&#039;s even possible).


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Misdreavus link=topic=6638.msg207441#msg207441 date=1509004136]<br />[quote author=spamviech link=topic=6638.msg207406#msg207406 date=1508858058]<br />From the initial post:<br />[quote]CHANGE THE PLAYER&#039;S NAME<br /><br />With this setup, you can change your name to the nickname of your first Pokemon. Using 8F will copy one letter from your first Pokemon&#039;s nickname to your player name. Use 8F (length of the name+1) times to copy all the name characters.<br />Warning: This code is self modifying, it will increase quantities of items #3 and #5 every use - remember to set those quantities back to 181 and 88 if you want to reset this. Also use carefully, as there&#039;s no memory protection implemented and you may cause save corruption if you&#039;re not careful.<br /><br />Video: http://www.youtube.com/watch?v=Sw0h7ImFsAs#t=918s<br /><br />ITEM LIST (starting from the first slot):<br />* Any item<br />* 8F<br />TM50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x181<br />TM10&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x64<br />TM34&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x88<br />TM09&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x46<br />Calcium&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x52<br />X Accuracy&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  x35<br />Full Heal&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x201[/quote]<br /><br />To change your ID you don&#039;t even need ACE since it&#039;s directly accessable in underflow. It&#039;s the 9th item count and 10th item type in underflow.<br />If you start counting from your first item it should be entry 30 (count) and 31 (type).<br />[/quote]Thanks.&nbsp; So If I want to temporarily set my name to TRAINER, I&#039;d use 8F with this item setup 8 times, and when I want my name to revert to normal, I&#039;d simply toss 8 quantities each of TM50 and TM34?<br />[/quote]<br /><br />Seems right.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Misdreavus link=topic=6638.msg207441#msg207441 date=1509004136]<br />Thanks.&nbsp; Pardon my ignorance, but is there some type of conversion between the actual decimal EV number I want (say 40000) and the number of Lemonades?&nbsp; I&#039;m guessing I don&#039;t actually need 40000 Lemonades. (or if that&#039;s even possible).<br />[/quote]<br /><br />Actually,I sent you the wrong code by mistake. Sorry, here&#039;s the new code:<br /><br />Hp EV:<br />Lemonade&nbsp;  x??<br />Thunderstone x124<br />TM 09&nbsp; &nbsp;  x34<br />Awakening&nbsp;  x??<br />Poke Ball&nbsp; &nbsp;  x121<br />Burn Heal&nbsp; &nbsp; x119<br />TM 01&nbsp; &nbsp; &nbsp; xAny<br /><br />(My original code only allowed for both bytes to be changed to the same value)<br /><br />To do the conversions, first convert the desired value into hex. In 40000, that would be $9C40. Then take the high byte ($9c), convert it to decimal (156), and have that value be the lemonade quantity. Do the same with the low byte, and put the result into the Awakening quantity.<br /><br />So HP EV 40000 would be:<br />Lemonade&nbsp; &nbsp; x156<br />Thunderstone&nbsp; &nbsp; x124<br />TM 09&nbsp; &nbsp; &nbsp;  x34<br />Awakening&nbsp; &nbsp;  x64<br />Poke Ball&nbsp; &nbsp;  x121<br />Burn Heal&nbsp; &nbsp;  x119<br />TM 01&nbsp; &nbsp; &nbsp; &nbsp; xAny<br />


subject: Custom Trainer ID Question
poster_name: Regiultima
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  After successfully getting myself a shiny Mew from Pokemon Yellow, I decided I want to farm high IV Dittos from Yellow until I get some good ones.&nbsp; However, in the process of getting a shiny Mew I changed my ID to the GF ID.&nbsp; I would like to change it to 00115 and by following the guide linked below.&nbsp; However, I came across an issue.<br /><br />Guide: https://www.reddit.com/r/pokemon/comments/5q8zlg/getting_gen_1_mew_in_yellow_guide_does_not_work/<br /><br />I started by taking 00115 and converting it to hexidecimal: 0073<br />Then I split the four digit Hexadecimal into two sets of two numbers: 00 and 73<br />When I went to convert those back into decimal, that&#039;s where the issue sprung up.&nbsp; 00 in decimal is still 0.&nbsp; I can&#039;t have 0 lemonades in my bag and still have it be my third item in my inventory.&nbsp; Do I just move all the other items up a slot?&nbsp; What is the solution so I can get the ID I desire?&nbsp; Thank you for your help.<br /><br />Additional Info:<br />-I am using an English US version of Pokemon Yellow<br />-My bootstrapping party consists of:<br />[list]<br />[li]Seel with 233 HP<br />Parasect<br />Growlithe<br />Magikarp<br />Psyduck<br />Flareon<br />Tentacool<br />Female Nidoran<br />Three other Pokemon[/li]<br />[li][/li]<br />[/list]<br />-The item code I&#039;ve been using is:<br />[list]<br />[li]Any item<br />WS M<br />Lemonade x(xx)<br />Repel x(yy)<br />Carbos x211<br />X Accuracy x88<br />Water Stone x115<br />TM01 x1[/li]<br />[li][/li]<br />[/list]


subject: Re: Custom Trainer ID Question
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Ninja&#039;d by Couldntthinkofaname.<br /><br />But yeah. If you modify your code to this, the first ID will be reduced by 1, allowing you to get the 00 73 combination. :)<br /><br />Any item<br />WS M<br />Lemonade x01<br />Repel x115<br />Carbos x211<br />X Accuracy x88<br />[b]Soda Pop x 4[/b]<br />Water Stone x115<br />TM01 x1<br /><br />The Soda Pop x4 can be anywhere after Lemonade x01 but before Water Stone x115.<br /><br />Another solution is to use an expanded items pack to find a Lemonade x0 and dig it up from the x-coordinate byte. After swapping the X Special x1 in place, make a few steps back and move here, where you should find a Lemonade x0.<br /><br />[img]https://i.imgur.com/nU0UmdV.png[/img]<br /><br />However be very careful not to press A on lag/unterminated name glitch items or the game will freeze and you could lose your save file, and also be very careful not to swap one stack of Lemonades with another stack of Lemonades, or the game will attempt to merge them and you won&#039;t get your Lemonade x0 stack.<br /><br />Hope this helps!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for your work Couldntthinkofaname. :)<br /><br />That wild PokÃ©mon modifier and wild PokÃ©mon are Shiny code looks awesome.<br /><br />May make a video of it like Nostalgia suggested, and if you make one too I&#039;ll add a link to it in my video description.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207449#msg207449 date=1509035314]<br />Thanks for your work Couldntthinkofaname. :)<br /><br />That wild PokÃ©mon modifier and wild PokÃ©mon are Shiny code looks awesome.<br /><br />May make a video of it like Nostalgia suggested, and if you make one too I&#039;ll add a link to it in my video description.<br />[/quote]<br />Thanks agian!<br /><br />I already have the AVI and WAV ready, but I can&#039;t combine them yet, i&#039;ve been scrambling for a video editor that can do this to no avial. <br /><br />Any suggestions?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207450#msg207450 date=1509035467]<br />[quote author=Torchickens link=topic=6716.msg207449#msg207449 date=1509035314]<br />Thanks for your work Couldntthinkofaname. :)<br /><br />That wild PokÃ©mon modifier and wild PokÃ©mon are Shiny code looks awesome.<br /><br />May make a video of it like Nostalgia suggested, and if you make one too I&#039;ll add a link to it in my video description.<br />[/quote]<br />Thanks agian!<br /><br />I already have the AVI and WAV ready, but I can&#039;t combine them yet, i&#039;ve been scrambling for a video editor that can do this to no avial. <br /><br />Any suggestions?<br />[/quote]<br /><br />You&#039;re welcome.<br /><br />I&#039;m unsure as I usually use Bandicam with Stereo Mix to record the audio at the same time (or VBA&#039;s built-in recorder however it probably won&#039;t emulate the OAM DMA exploit correctly) without having to combine video and audio.<br /><br />I think FFMPEG can do that though (according to https://stackoverflow.com/questions/11779490/how-to-add-a-new-audio-not-mixing-into-a-video-using-ffmpeg), use cd [add path here] on Command Prompt to set the current directory.<br /><br />Windows Movie Maker can do it too but I&#039;m unsure how that would affect the quality.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  [quote author=Dragon Arbock link=topic=6716.msg207440#msg207440 date=1508992344]<br />None of that really bothers me. The most tedious part has to be done either way (typing in the code). I could see the advantages though, either way I&#039;ll probably be forced into using it as support for coin case wavers.<br />[/quote]<br />TM25 is also much more convenient when developing code, since you don&#039;t have to fix the stack - which also requires SMC&#039;ing an `inc sp` in. Thus more boxes can be used, leading to more powerful codes.<br /><br />Speaking of fixing the stack, I wonder why this wouldn&#039;t work :<br />[code]<br />xor a<br />ld [$F199], a ; Menu lag-less<br />add sp, $FF ; dec sp<br />pop de ; Incurs an additional pop<br />pop de<br />pop de<br />pop de<br />or a<br />ret nc<br />[/code]<br />instead of the classic<br />[code]<br />xor a<br />ld [$F199],a<br />pop de<br />pop de<br />inc sp<br />pop de<br />or a<br />ret nc<br />[/code]<br />(Note : if for some reason &quot;add sp, $FF&quot; is infeasible, &quot;ld hl, sp+$FF&quot; followed by &quot;ld sp, hl&quot; should be possible)<br /><br />The point of this setup is that it still fixes the stack, but doesn&#039;t require SMC anymore. So it could be moved to a later box ?


subject: Re: Obtaining Arceus via the Void Glitch
poster_name: Gravedigger
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Spicr link=topic=7770.msg206748#msg206748 date=1504970731]<br />Is retire the only currently known way to trigger a cript on a map at will? The great marsh retire option doesn&#039;t do anything on other maps aside from warping you back to the great marsh building, and both the underground and union room menus don&#039;t seem accessible because of the error message when you leave the area with walk through walls. You can&#039;t interact with followers either because as soon as you leave their intended map they disappear. Is there a way to load NPCs or objects onto a map they don&#039;t belong on in the void, so that talking to them would trigger other scripts on that map?<br />[/quote]<br /><br />you can however use RETIRE to get a follower in Amity square and leave to get a corrupted partner, but we haven&#039;t gone any further with it except for glitchbattles atm. Also the npc follower&#039;s sprite dissapears, and unless you battle or talk to water or so you wouldn&#039;t even notice they were there. If there were a way to get their sprites to appear it&#039;d be interesting though. (with some side effects such as all fainted pokes) 


subject: Re: GlitchDex: International glitch PokÃ©mon?
poster_name: hpokÃ©_coloradohugge
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: hpokÃ©_coloradohugge
icon: xx
body:
  [quote author=Torchickens link=topic=8068.msg207332#msg207332 date=1508548168]<br />I have also opened up a request article. Feel free to add requests here, that way me (or another user) can add select glitch PokÃ©mon you want:<br />http://glitchcity.info/wiki/User:Torchickens/Glitch_Pok%C3%A9mon_article_requests<br />[/quote]<br /><br />I&#039;m going to add to the request page entries for all International Glitch PokÃ©mon exept Italian Yellow (That is currently the only Regional Gen1 Game i haven&#039;t looked through all of them on yet.<br /><br />Edit/Update: Aaaaaand I&#039;m done with that.<br /><br />Edit/Update Nr.2: I Went ahead and finished what i started and added pages for Italian Yellow aswell.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Over 99 glitch blocks for items:<br />They don&#039;t seem to change based on location or anything it seems.<br /><br />[IMG]http://i63.tinypic.com/k2e4z.png[/img]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=ISSOtm link=topic=6716.msg207453#msg207453 date=1509038134]<br />[quote author=Dragon Arbock link=topic=6716.msg207440#msg207440 date=1508992344]<br />None of that really bothers me. The most tedious part has to be done either way (typing in the code). I could see the advantages though, either way I&#039;ll probably be forced into using it as support for coin case wavers.<br />[/quote]<br />TM25 is also much more convenient when developing code, since you don&#039;t have to fix the stack - which also requires SMC&#039;ing an `inc sp` in. Thus more boxes can be used, leading to more powerful codes.<br /><br />Speaking of fixing the stack, I wonder why this wouldn&#039;t work :<br />[code]<br />xor a<br />ld [$F199], a ; Menu lag-less<br />add sp, $FF ; dec sp<br />pop de ; Incurs an additional pop<br />pop de<br />pop de<br />pop de<br />or a<br />ret nc<br />[/code]<br />instead of the classic<br />[code]<br />xor a<br />ld [$F199],a<br />pop de<br />pop de<br />inc sp<br />pop de<br />or a<br />ret nc<br />[/code]<br />(Note : if for some reason &quot;add sp, $FF&quot; is infeasible, &quot;ld hl, sp+$FF&quot; followed by &quot;ld sp, hl&quot; should be possible)<br /><br />The point of this setup is that it still fixes the stack, but doesn&#039;t require SMC anymore. So it could be moved to a later box ?<br />[/quote]<br /><br />Aren&#039;t you forgetting a (LD [$83ff], A)?<br />Never tried without it, but I thought this one was necessary.<br /><br />Edit:<br />Just tried a do-nothing-then-return-to-game code and it worked:<br />[code]Box 1: ppÃ©D9Ã©ZÃ—&nbsp; &nbsp;  (XOR A; XOR A; LD [83ff], A; LD [f199], A)<br />Box 2: .9&#039;l&#039;l&#039;l&#039;lx&#039;d (ADD SP, ff; POP DE; POP DE; POP DE; POP DE; OR A; RET NC)[/code]<br />Should work as a footer in any box for Coin Case ACE (fill out the space before with 5s).<br /><br />Always viewed the stack-pointer as a &quot;don&#039;t touch&quot; object so my knowledge in this regard is very limited. Great job finding this.<br /><br />EditÂ²:<br />Turns out (LD [$83ff], A) isn&#039;t only not required, but removing it also removes the part that turns the player character invisible.<br />Using these as the final 2 box names works without problems (at least nothing obvious).&nbsp;  :)<br />[code]Box n-1: pppppÃ©ZÃ—&nbsp; &nbsp; &nbsp;  (XOR A; LD [f199], A)<br />Box n&nbsp; : .9&#039;l&#039;l&#039;l&#039;lx&#039;d&nbsp; (ADD SP, ff; POP DE; POP DE; POP DE; POP DE; OR A; RET NC)[/code]


subject: Glitch memes
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  MEMES... THE GENES OF THE SOUL...<br /><br />so yeah post your good/shitty Pokemon-glitch-related memes here<br />no judge<br />[s][size=2pt]we will totally judge you[/size][/s]<br /><br />i&#039;ll go first


subject: Re: GlitchDex: International glitch PokÃ©mon?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wow! Thank you very much hpokÃ©_coloradohugge! :) That&#039;s awesome.<br /><br />This will certainly save a lot of time.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Skeef link=topic=6716.msg207457#msg207457 date=1509053150]<br />Over 99 glitch blocks for items:<br />They don&#039;t seem to change based on location or anything it seems.<br /><br />[IMG]http://i63.tinypic.com/k2e4z.png[/img]<br />[/quote]<br /><br />These glitch tiles stay the same across locations because this the default VRAM for the bag. Once an item exceeds a quantity of x99 , the higher section of the quantity is displayed with tiles of the current VRAM, starting at VRAM tile $00


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the testing, spamviech ! Hopefully this will make Coin Case a bit easier to work with.<br /><br />As for sp, remember that every time you push and pop, you&#039;re modifying sp :p<br />One pop implying incrementing sp twice, and one push decrementing it twice. This new approach basically decrements once and pops 4 times instead of incrementing and pop-ing 3 times.<br /><br />By the way, the write to $F199 instead of $FF83 (not the other way around, I guarantee) was because of an above post suggesting the use of F199 instead to avoid the menu lag. I didn&#039;t test this, so I didn&#039;t know what the side-effects were. Anyways, thank you for making this small adjustment !


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Dragon Arbock
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Caved, got TM 25. Lots and lots of wild shiny Sneasel.<br />Now the question is how to change my existing codes into TM 25 format? Otherwise just stick with coin case for them, I guess.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6716.msg207462#msg207462 date=1509078942]<br />Thanks for the testing, spamviech ! Hopefully this will make Coin Case a bit easier to work with.<br /><br />As for sp, remember that every time you push and pop, you&#039;re modifying sp :p<br />One pop implying incrementing sp twice, and one push decrementing it twice. This new approach basically decrements once and pops 4 times instead of incrementing and pop-ing 3 times.[/quote]<br /><br />Knew that one already (kind of), that&#039;s why I didn&#039;t really touch these instructions as well (aside from &quot;you need this as a footer&quot;).<br /><br />[quote]By the way, the write to $F199 instead of $FF83 (not the other way around, I guarantee) was because of an above post suggesting the use of F199 instead to avoid the menu lag. I didn&#039;t test this, so I didn&#039;t know what the side-effects were. Anyways, thank you for making this small adjustment !<br />[/quote]<br />Think that was my post, but I only added it there. Didn&#039;t know you can completely replace it.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So I haven&#039;t had a chance to test yet, but are both the wild encounter any Pokemon and shiny encounter any Pokemon TM25 only codes, or is it just the shiny encounter one? If it&#039;s both then I&#039;ll have to cave in and get TM25 too like Dragon Arbock lol. <br /><br />And great video Torchickens, though I wish you showed the caught Celebi&#039;s moves to show the start moves. :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  They look like TM25 codes (no bunch of [b]&#039;l[/b] at the end).<br /><br />[quote author=Couldntthinkofaname link=topic=6716.msg207433#msg207433 date=1508974366]<br />I&#039;ve successfully combined my two prior codes! Here&#039;s the outcome:<br /><br />All encountered Pokemon are &lt;insert [b]x[/b] Pokemon here&gt; [b]and[/b] shiny:<br />Box 1:&nbsp; Ap&#039;v8Ã©&#039;m25<br />Box 2:&nbsp; p0(male)55555<br />Box 3:&nbsp; &#039;vAÃ©52p0&#039;m<br />Box 4:&nbsp; Ã©J9p0(female)55<br />Box 5:&nbsp; Ã©K9p0255<br />Box 6:&nbsp; Ã©L9p&#039;d555<br />Box 7:&nbsp; p0[b]?[/b]yyÃ©A&#039;d<br />Box 8:&nbsp; p0Ã©Ã©(female)&#039;dyy<br />Box 9:&nbsp; p0kÃ©0&#039;dp&#039;d<br /><br />Replace [b]?[/b] with the species index<br /><br />To access species indexes that are lower than $7f, than replace Box 7 with:<br /><br />Box 7: p0[b]?[/b]&#039;v(space)Ã©A&#039;d<br /><br />Then replace [b]?[/b] with SpeciesIndex + $7f<br /><br />Due to the way the game generates wild Pokemon, [b]most[/b] Pokemon obtained this way are 100% legitimate. This means they will probably be able to be moved to PokÃ©bank when such services become available. There might still be OT issues with Mew, but these can easily be resolved with an OT editor, and I can make one if needs be.<br /><br />Nintendo&#039;s going to have a real headache on their hands :)<br />[/quote]<br /><br />For Coin Case, this adaptation should work:<br />Edit: [s]Need to take a closer look at this. There appears to be sth. else going on compare to usual.[/s]<br />EditÂ²: Still don&#039;t know how this OAM DMA loop thingy works, but at least this code does:<br />[code]<br />Box 1:&nbsp; Ap&#039;v8Ã©&#039;m25<br />Box 2:&nbsp; pÃ©Z(mult)0(male).9<br />Box 3:&nbsp; &#039;v&#039;vÃ©52p0&#039;m<br />Box 4:&nbsp; Ã©J9p0(female)&#039;l&#039;l<br />Box 5:&nbsp; Ã©K9p02&#039;l&#039;l<br />Box 6:&nbsp; Ã©L9p&#039;d555<br />Box 7:&nbsp; p0?yyÃ©Ã©&#039;d<br />Box 8:&nbsp; p0Ã©Ã©(female)&#039;dyy<br />Box 9:&nbsp; p0kÃ©0&#039;dp&#039;d[/code]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207466#msg207466 date=1509099630]<br />For Coin Case, this adaptation should work:<br />[code]Box 1:&nbsp; Ap&#039;v8Ã©&#039;m25<br />Box 2:&nbsp; p0(male)55555<br />Box 3:&nbsp; &#039;vAÃ©52p0&#039;m<br />Box 4:&nbsp; Ã©J9p0(female)55<br />Box 5:&nbsp; Ã©K9p0255<br />Box 6:&nbsp; Ã©L9p&#039;d555<br />Box 7:&nbsp; p0[b]?[/b]yyÃ©A&#039;d<br />Box 8:&nbsp; p0Ã©Ã©(female)&#039;dyy<br />Box 9:&nbsp; p0kÃ©0&#039;d55<br />Box10: pppppÃ©ZÃ— (Ã— is the multiplication character)<br />Box11: .9&#039;l&#039;l&#039;l&#039;lx&#039;d[/code]<br />[/quote]<br /><br />Nice work! I&#039;ll add this to my video when I release it.<br /><br />Edit: Make sure to replace [b]55[/b] with [b]yy[/b], enabling interrupts during a Pokemon encounter crashes the game.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks, will test later. Though I&#039;ll probably only get Celebi with this method. More challenging to get the rest the normal way, even though 1% and 5% Pokemon are so annoying to find sometimes. Currently post Elite Four searching for Furret and Pikachu on Routes 1 and 2. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Insta-Death exploit<br /><br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p0(female)Ã©K955<br />Box 3: p02Ã©L955<br />Box 4: pÃ©12p&#039;d55<br />Box 5-6: (Doesn&#039;t Matter)<br />Box 7: pÃ©A&#039;lÃ©9&#039;dy<br />Box 8: p&#039;dyyyyyy<br /><br />After using, all trainer/wild Pokemon will immediately faint on the first turn (move,item,etc.), and any Pokemon the trainer sends out afterwards will immediately faint upon being sent out.<br /><br />Insta-death exploit (Coin case version, thanks ISSOtm and spamveich!)<br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p0(female)Ã©K955<br />Box 3: p02Ã©L955<br />Box 4: pÃ©125555<br />Box 5: pppppÃ©Z(mult)<br />Box 6: .9&#039;l&#039;l&#039;l&#039;lp&#039;d<br />Box 7: pÃ©A&#039;lÃ©9&#039;dy<br />Box 8: p&#039;dyyyyyy


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207449#msg207449 date=1509035314]<br />May make a video of it like Nostalgia suggested, and if you make one too I&#039;ll add a link to it in my video description.<br />[/quote]<br /><br />Torchickens, could you also link to it using [url=https://support.google.com/youtube/answer/6140493]cards[/url]? :) They appear on the top-right side of the video player and automatically hide under a circular [b]i[/b] button.<br /><br />[quote author=Couldntthinkofaname link=topic=6716.msg207450#msg207450 date=1509035467]<br />I already have the AVI and WAV ready, but I can&#039;t combine them yet, i&#039;ve been scrambling for a video editor that can do this to no avial. <br /><br />Any suggestions?<br />[/quote]<br /><br />[code]ffmpeg -i &quot;/path/to/my-awesome-video.avi&quot; -i &quot;/path/to/its-dope-audio.wav&quot; -c copy &quot;/path/to/yay-we-have-sound-now.avi&quot;[/code]<br /><br /> :P 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [url=https://youtu.be/UNWtJBOzR6M]Video is finally up.[/url] [i]Curse ye slow internet speeds[/i]<br /><br />I might make more videos for codes like Insta-Death exploit and some other codes i&#039;ve written.<br /><br />Like I mentioned earlier, definitely not Torchickens or Crystal_ quality.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=FMK link=topic=6716.msg206982#msg206982 date=1506371666]Player Sprite Modifier - Permanent (Old Man; Change &#039;s and A to different values for different results, can replace the 55 for Box 1 with &#039;v(Another Letter) too, if desired value is unobtainable):<br />[code]<br />Box 1: Ap0&#039;s&#039;vA55 (XOR A; OR d4; SUB 0x80)<br />Box 2: Ã©9&#039;l55555&nbsp; (LD [ffd1], A)<br />[/code]<br />[/quote]<br /><br />Just tried out the code above (with slight adjustment for use with TM25 in balls pocket) on VC (english) and the results are quite interesting:<br />Moving up/down turns you into a male rocket moving sideways (random if left or right) while moving left/right turn you into one of the girls (think the sister from the one who gives you the squirtle bottle has the same model) looking down.<br />Getting on the bike doesn&#039;t change your model, but you still move faster.<br /><br />Might try a few more numbers, but so far most restulted in glitchy graphics for the player character.<br />Just a note: the above code also looked glitchy while in the upper level of the pokÃ©mon center, so the sprite might be dependent on the map you&#039;re currently on. I was in Goldenrod City for reference.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=8100.msg207473#msg207473 date=1509169709]<br />How do you convert these codes into tm 17 ones<br />[/quote]<br /><br />Most of these codes were already made for wrong pocket TM execution.<br /><br />Most of the time, just put [b]p&#039;d[/b] at the end of the main code.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207471#msg207471 date=1509153540]<br />[url=https://youtu.be/UNWtJBOzR6M]Video is finally up.[/url] [i]Curse ye slow internet speeds[/i]<br />[/quote]<br /><br />My recommendation is to convert to WebM before uploading.<br /><br />[url=https://trac.ffmpeg.org/wiki/Encode/VP8]https://trac.ffmpeg.org/wiki/Encode/VP8[/url]<br /><br />[url=https://trac.ffmpeg.org/wiki/Encode/VP9]https://trac.ffmpeg.org/wiki/Encode/VP9[/url]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=6716.msg207475#msg207475 date=1509209354]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207471#msg207471 date=1509153540]<br />[url=https://youtu.be/UNWtJBOzR6M]Video is finally up.[/url] [i]Curse ye slow internet speeds[/i]<br />[/quote]<br /><br />My recommendation is to convert to WebM before uploading.<br /><br />[url=https://trac.ffmpeg.org/wiki/Encode/VP8]https://trac.ffmpeg.org/wiki/Encode/VP8[/url]<br /><br />[url=https://trac.ffmpeg.org/wiki/Encode/VP9]https://trac.ffmpeg.org/wiki/Encode/VP9[/url]<br />[/quote]<br /><br />FFMPEG returns errors when converting BGB videos into WebM.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207476#msg207476 date=1509236369]<br />FFMPEG returns errors when converting BGB videos into WebM.<br />[/quote]<br /><br />That&#039;s strange! :( What is ffmpeg&#039;s output?<br /><br />What I usually do after merging the AVI and WAV is encode the video to WebM with VP9 on Constant Quality mode. The following snippet is the command I recall using for that process:<br /><br />[code]ffmpeg -i &quot;/path/to/video.avi&quot; -c:v libvpx-vp9 -crf 0 -b:v 0 -c:a libopus -pix_fmt yuv420p &quot;/path/to/video.webm&quot;[/code]


subject: Re: Debug menus in Japanese Crystal
poster_name: Jsierra008
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7407.msg199618#msg199618 date=1453097963]<br />[quote author=Wack0 link=topic=7407.msg199609#msg199609 date=1452961232]Any chance of making Game Genie codes to get this working? (Game Genie on GB/C are for ROM patches, right?)[/quote]<br />Yes, but it only accepts three codes at a time, and GBC-only cartridges like PokÃ©mon Crystal wonâ€™t even fit in the cartridge slot :P<br /><br />[i]Patch function calls for GS Ball option:[/i]<br />9D2-088-801<br />AD2-108-4C1<br /><br />[/quote]<br /><br />This Game Genie code don works for this rom<br /><br />https://edgeemu.net/details-36729.htm<br /><br />what rom you have used for a working GS Ball code ?<br /><br />Thanks a lot


subject: Re: Debug menus in Japanese Crystal
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Jsierra008 link=topic=7407.msg207478#msg207478 date=1509239982]<br />This Game Genie code don works for this rom<br /><br />[url=https://edgeemu.net/details-36729.htm]https://edgeemu.net/details-36729.htm[/url]<br /><br />what rom you have used for a working GS Ball code ?<br /><br />Thanks a lot<br />[/quote]<br /><br />Hey, Jsierra008. You need to patch a legit ROM with the patch attached [url=https://forums.glitchcity.info/index.php?topic=7407.msg199854#msg199854]here[/url] to make the Game Genie codes usable. Alternatively, for the GS Ball, you just have to trigger the event without patching anything ([url=https://forums.glitchcity.info/index.php?topic=7407.msg199619#msg199619]link[/url]).<br /><br />Hope this helps! :) 


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=8100.msg207474#msg207474 date=1509194540]<br />[quote author=forsyz link=topic=8100.msg207473#msg207473 date=1509169709]<br />How do you convert these codes into tm 17 ones<br />[/quote]<br /><br />Most of these codes were already made for wrong pocket TM execution.<br /><br />Most of the time, just put [b]p&#039;d[/b] at the end of the main code.<br />[/quote] Tired that but it doesn&#039;t work nothing happens


subject: Re: Debug menus in Japanese Crystal
poster_name: Jsierra008
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7407.msg207479#msg207479 date=1509240396]<br />[quote author=Jsierra008 link=topic=7407.msg207478#msg207478 date=1509239982]<br />This Game Genie code don works for this rom<br /><br />[url=https://edgeemu.net/details-36729.htm]https://edgeemu.net/details-36729.htm[/url]<br /><br />what rom you have used for a working GS Ball code ?<br /><br />Thanks a lot<br />[/quote]<br /><br />Hey, Jsierra008. You need to patch a legit ROM with the patch attached [url=https://forums.glitchcity.info/index.php?topic=7407.msg199854#msg199854]here[/url] to make the Game Genie codes usable. Alternatively, for the GS Ball, you just have to trigger the event without patching anything ([url=https://forums.glitchcity.info/index.php?topic=7407.msg199619#msg199619]link[/url]).<br /><br />Hope this helps! :)<br />[/quote]<br /><br />Thanks for answer but i wana patch the GS Ball event only, the manually have any chance with manually edit ?<br /><br />Or Game Genie without add debug menu ?


subject: Re: Debug menus in Japanese Crystal
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Jsierra008 link=topic=7407.msg207482#msg207482 date=1509241221]<br />Thanks for answer but i wana patch the GS Ball event only, the manually have any chance with manually edit ?<br /><br />Or Game Genie without add debug menu ?<br />[/quote]<br /><br />If you want to receive the GS Ball in the PCC, either change address [tt]0xA000[/tt] accordingly as per my post or use GameShark code [tt]010B00A0[/tt].


subject: Re: Debug menus in Japanese Crystal
poster_name: Jsierra008
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7407.msg207483#msg207483 date=1509241643]<br /><br />If you want to receive the GS Ball in the PCC, either change address [tt]0xA000[/tt] accordingly as per my post or use GameShark code [tt]010B00A0[/tt].<br />[/quote]<br /><br />yes but i want to make a ips patch for a later work with the GS Ball event enabled, something like the western patch


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=6716.msg207481#msg207481 date=1509240636]<br />how do you convert tm 27 and coincase codes to tm 17 codes<br />[/quote]<br /><br />There&#039;s no singular answer for that, it&#039;s entirely dependant on the code.<br /><br />TM 17 are already TM 25 codes, no conversion is required.<br /><br />[b]Most[/b], coin case codes can be converted by simply tacking [b]p&#039;d[/b] at the end of the main code. FMK&#039;s one-off code is not necessary for Wrong pocket TM codes.<br /><br />If you are having difficulties coverting a specific code, just let me know.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misdreavus
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  A few beginner&#039;s questions:<br /><br />1. Do the items listed in the codes here need to be the only items in my pack, or can I have more items after them?&nbsp; If 8F is not specifically listed as an item in the code, where do I position it in my pack?<br /><br />2. In order to use the codes, I set up my party as listed in the &quot;Bootstrapping&quot; section, set up my item pack as listed in the particular code, use 8F once, and then I&#039;m finished (unless otherwise specified)?<br /><br />3. Is this (http://forums.glitchcity.info/index.php?topic=6638.msg199859;topicseen#msg199859) the best code for max DVs [i]and[/i] stat experience in the English versions?&nbsp; Am I correct in understanding that I use 8F, toss an X Accuracy, and repeat until my X Accuracy count is 167?<br /><br />4. How easy is it to corrupt my save file using 8F and these codes?&nbsp; The first post says that the &quot;change your name&quot; code can do that if not careful; when using it, what should I make sure that I do or avoid doing in order to keep my save intact?<br /><br />Thanks!


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  1. You can have any items in your bag, all that matters is that item 3 onwards are the items specified (some setups require specific item 1 and/or 2 as well, but that&#039;s always specified then.)<br />Thus, you can have items after the code items.<br />Furthermore, 8F can be anywhere. For convenience reasons, usually people put 8F in the first slot, and something handy in the second one (such as Master Balls :p).<br />When 8F is not indicated in the list, though, this usually means that the list starts from item 3 (ie. you should have two item slots filled before putting the items in the list)<br /><br />2. Yes. All that matters is that the requirements are met the instant you select &quot;USE&quot; on 8F. Once done, you can store, release, catch PokÃ©mon, toss items, whatever you want.<br /><br />3. It&#039;s the simplest that can be done, I&#039;d say, so yes it&#039;s the best. And yes, you are correct.<br /><br />4. Corrupting your save file is definitely possible, though quite unlikely. Well, actually it depends.<br />I&#039;ll begin with a method to make it almost impossible to corrupt your save : 1. View a PokÃ©mon&#039;s STATS screen. 2. Do NOT save. 3. Use 8F. 4. You can save now (which I&#039;d recommend to do anyways to overwrite any data that could be corrupted, [b]EXCEPT[/b] if your name was corrupted).<br />Then, if you screw up [b]very badly[/b], I&#039;d say you have less than a 1/1024 chance to corrupt your save file. And only if you screw up very badly, which is impossible with most setups, and quite unlikely with the rest).<br />tl;dr : Yeah, you can screw up. It&#039;s quite a low chance, BUT :<br />- You make it higher by saving before using 8F<br />- You make it WAY lower by viewing a PokÃ©mon&#039;s stats before using 8F<br />(The last one that occurred overriding the effect of the previous one)<br /><br /><br />Explanation :<br />Save data is stored in a memory location known as SRAM (Save RAM). SRAM can be &quot;locked&quot; or &quot;unlocked&quot;. If it&#039;s locked, notably, you cannot write to it. Unlocking is done by writing one of 16 values (out of 256 possible ones) in a region of memory that spans 1/256 of the total address space. So in theory you&#039;d have a 1/4096 chance to unlock SRAM (more on that below if you&#039;re interested).<br />Then, even if you unlock SRAM, things aren&#039;t still done yet ; SRAM has banks (for different technical reasons), 4 banks in RBY. Bank 0 is used for Hall of Fame data and sprite decompression. Bank 1 stores your &quot;main&quot; save. Banks 2 and 3 contain the inactive PokÃ©mon boxes. Corrupting banks 1, 2 or 3 will corrupt your save.<br />PokÃ©mon sprites are stored compressed to fit in the cartridge&#039;s ROM. However, they need to be decompressed before being displayed, which is a memory-intensive process. Due to lack of memory in the Game Boy, the developers chose to use SRAM (it&#039;s still RAM before being Save RAM :p) to do that.<br />Saving the game will prompt it to switch SRAM banks to bank 1, meaning that if SRAM is unlocked, your save data will be directly exposed. Bad thing.<br />Viewing a PokÃ©mon&#039;s stats makes the game decompress a sprite, thus switch to SRAM bank 0. This is an extra layer of &quot;protection&quot; : to corrupt save data, you&#039;d have to first unlock SRAM AND switch to bank 1, 2 or 3.<br /><br />That&#039;s the theory. However, some crap emulators (I&#039;m looking at you, VBA and VC) don&#039;t emulate SRAM locking, and it appears that you can corrupt save data much easily on these pieces of sh*t.<br /><br /><br />About unlocking SRAM -&gt; That 1/4096 chance to unlock SRAM would be if you had a random pointer and a random value, and hit an instruction that accidentally caused a write to that pointer. However, randomness isn&#039;t a viable option to model this. Actually, there are a few more options than just writing that value, such as &quot;incrementing&quot; a value ending is $X9. I don&#039;t really feel like calculating the actual odds, so I&#039;d say that the actual probability can be reasonably considered to be less than 1/1024. And, as I said, that would be if you screwed up [i]huge time[/i].


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207466#msg207466 date=1509099630]<br /><br />For Coin Case, this adaptation should work:<br />[code]Box 1:&nbsp; Ap&#039;v8Ã©&#039;m25<br />Box 2:&nbsp; p0(male)55555<br />Box 3:&nbsp; &#039;vAÃ©52p0&#039;m<br />Box 4:&nbsp; Ã©J9p0(female)55<br />Box 5:&nbsp; Ã©K9p0255<br />Box 6:&nbsp; Ã©L9p&#039;d555<br />Box 7:&nbsp; p0[b]?[/b]yyÃ©A&#039;d<br />Box 8:&nbsp; p0Ã©Ã©(female)&#039;dyy<br />Box 9:&nbsp; p0kÃ©0&#039;dyy<br />Box10:&nbsp; pppppÃ©ZÃ— (Ã— is the multiplication character)<br />Box11:&nbsp; .9&#039;l&#039;l&#039;l&#039;lx&#039;d[/code]<br />[/quote]<br /><br />Couldn&#039;t get this to work, getting sent into the glitch dimension. All box names are correct. I just want the wild Celebi code, I&#039;m not interested in Shiny, and I don&#039;t know if this was the coin case adaption of the wild and shiny encounter or just the wild encounter. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207488#msg207488 date=1509281790]<br />[quote author=spamviech link=topic=6716.msg207466#msg207466 date=1509099630]<br /><br />For Coin Case, this adaptation should work:<br />[code]Box 1:&nbsp; Ap&#039;v8Ã©&#039;m25<br />Box 2:&nbsp; p0(male)55555<br />Box 3:&nbsp; &#039;vAÃ©52p0&#039;m<br />Box 4:&nbsp; Ã©J9p0(female)55<br />Box 5:&nbsp; Ã©K9p0255<br />Box 6:&nbsp; Ã©L9p&#039;d555<br />Box 7:&nbsp; p0[b]?[/b]yyÃ©A&#039;d<br />Box 8:&nbsp; p0Ã©Ã©(female)&#039;dyy<br />Box 9:&nbsp; p0kÃ©0&#039;dyy<br />Box10:&nbsp; pppppÃ©ZÃ— (Ã— is the multiplication character)<br />Box11:&nbsp; .9&#039;l&#039;l&#039;l&#039;lx&#039;d[/code]<br />[/quote]<br /><br />Couldn&#039;t get this to work, getting sent into the glitch dimension. All box names are correct. I just want the wild Celebi code, I&#039;m not interested in Shiny, and I don&#039;t know if this was the coin case adaption of the wild and shiny encounter or just the wild encounter.<br />[/quote]<br /><br />Spamviech made an error with the adaption. The code has two portions, the entry point and the OAM DMA loop. Fixing the stack on the OAM DMA loop causes the stack pointer to go in the wrong position, causing a game crash.<br /><br />[S]I [b]might[/b] be able to make a fix soon, but the amount of SMC may cause conflict [/s]<br /><br />[S]The entry point and the stack repair combined is 7 boxes. Box 7 is the only box I can use for SMC, which is required to load the species index into $d0ed<br /><br />Sorry, TM 25 only.[/s]<br /><br />Spamviech made a fix :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207489#msg207489 date=1509282106]<br />Spamviech made an error with the adaption. The code has two portions, the entry point and the OAM DMA loop. Fixing the stack on the OAM DMA loop causes the stack pointer to go in the wrong position, causing a game crash.<br /><br />I [b]might[/b] be able to make a fix soon, but the amount of SMC may cause conflict.<br />[/quote]<br /><br />Yea, noticed that myself. Didn&#039;t look too closely when I wrote this.<br />Also, this is a code for a shiny encounter.<br /><br />For just encounter manipulation with Coin Case use this Code (this time even tested&nbsp; :-[):<br />[code]<br />Box 1: Ap&#039;v8Ã©&#039;m25<br />Box 2: pÃ©Z(mult)0(male).9<br />Box 3: &#039;v&#039;vÃ©52p0&#039;m<br />Box 4: Ã©J9p0(female)&#039;l&#039;l<br />Box 5: Ã©K9p02&#039;l&#039;l<br />Box 6: Ã©L9p&#039;d555<br />Box 7: p0?yyÃ©Ã©&#039;d<br />Box 8: p&#039;dyyyyyy[/code]<br />You still need to replace ? in Box7-name with your preferred species. For Celebi this would be 5.<br /><br />Edit:<br />Here for the shiny encounter. Also this time tested&nbsp; :-[.<br />[code]<br />Box 1:&nbsp; Ap&#039;v8Ã©&#039;m25<br />Box 2:&nbsp; pÃ©Z(mult)0(male).9<br />Box 3:&nbsp; &#039;v&#039;vÃ©52p0&#039;m<br />Box 4:&nbsp; Ã©J9p0(female)&#039;l&#039;l<br />Box 5:&nbsp; Ã©K9p02&#039;l&#039;l<br />Box 6:&nbsp; Ã©L9p&#039;d555<br />Box 7:&nbsp; p0?yyÃ©Ã©&#039;d<br />Box 8:&nbsp; p0Ã©Ã©(female)&#039;dyy<br />Box 9:&nbsp; p0kÃ©0&#039;dp&#039;d[/code]<br /><br />Still don&#039;t know how this OAM DMA loop thingy works, but at least this code does.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Nostalgia
icon: xx
body:
  [img]http://i.picresize.com/images/2017/10/29/jUn1l.jpg[/img]<br />[img]http://i.picresize.com/images/2017/10/29/o71qX.jpg[/img]<br /><br />So it worked, many thanks. Also wanted to take pictures to show that this is the best method to obtain Celebi now, no need for eggs or a changing another Pokemon into Celebi. This method is quicker, registers in Pokedex and Celebi comes with its start moves. :)<br /><br />I have almost finished the game now, 16 Badges and 209 Pokedex, but I want to complete the Pokedex before I beat Red and I&#039;ve obtained every single in-game Pokemon except Entei and Raikou now, so all I need now is them, the R/B/Y and Silver exclusives which I can get from box names. <br /><br />Edit: very strange, but performing this glitch made the Mystery gift option appear at the title screen when I never spoke to the girl in Goldenrod dept store. It also changed my text speed to medium, when I had it on fast before. o.o


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Congratulations.&nbsp; ;D<br /><br />I cheated a bit with Happiness evolutions (they are a pain in Gen2; did that enough as a kid) and with Evolution Stones, but aside from that had a blast with glitchless gameplay.<br /><br />Glitched stuff is great as well, but that&#039;s for another copy.&nbsp; 8)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207496#msg207496 date=1509286746]<br />Congratulations.&nbsp; ;D<br /><br />I cheated a bit with Happiness evolutions (they are a pain in Gen2; did that enough as a kid) and with Evolution Stones, but aside from that had a blast with glitchless gameplay.<br /><br />Glitched stuff is great as well, but that&#039;s for another copy.&nbsp; 8)<br />[/quote]<br /><br />Well to complete the Pokedex you have to use glitches anyway - so you might as well go all out, G/S certainly gives you the options to unlike Crystal where it&#039;s much harder. I completed Crystal earlier this year with 251 Pokedex on cartridge, which involved lots of trading between my Red and Gold cartridges to get the exclusives and performing the Celebi glitch on my gold cartridge and trading it over. But in G/S, you can simply use the Coin Case to obtain those annoying version exclusive Pokemon and sell unlimited Rare Candies to buy a load of Vitamins to evolve those Happiness evolution Pokemon faster, also use those Rare Candies to level up those Pokemon needed for the Pokedex faster, but I never use Rare Candies on my in-game team because that&#039;s boring. So the Coin Case just makes some of the tedious stuff easier and quicker. So when I&#039;m finished this Gold file, it will probably come in at around 30 hours less then my Crystal file, because as mentioned it&#039;s much faster to do stuff in G/S, and in Crystal I did end up training my team to level 70 and did several Battle Tower runs. I&#039;m not trying to finish the game really fast, but after countless gen II files over the years, it&#039;s interesting to see how fast I can finish everything now. Gen II is my favourite Pokemon gen easily. <br /><br />Also finished a 151 Yellow run earlier this year on cartridge, so after I&#039;ve finished VC Gold I might move on to VC Yellow and do the same thing. I juut love the old Pokemon games. I&#039;ve only owned a 3DS for a month and all I&#039;ve played is VC Gold. Will have to get into the newer Pokemon games eventually, but I&#039;m seriously out of the loop on things - as the last newest gen Pokemon game I played was Pokemon White and I have no knowledge on the any of the new Pokemon from gen 6 and gen 7.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207472#msg207472 date=1509160939]<br />[quote author=FMK link=topic=6716.msg206982#msg206982 date=1506371666]Player Sprite Modifier - Permanent (Old Man; Change &#039;s and A to different values for different results, can replace the 55 for Box 1 with &#039;v(Another Letter) too, if desired value is unobtainable):<br />[code]<br />Box 1: Ap0&#039;s&#039;vA55 (XOR A; OR d4; SUB 0x80)<br />Box 2: Ã©9&#039;l55555&nbsp; (LD [ffd1], A)<br />[/code]<br />[/quote]<br /><br />Just tried out the code above (with slight adjustment for use with TM25 in balls pocket) on VC (english) and the results are quite interesting:<br />Moving up/down turns you into a male rocket moving sideways (random if left or right) while moving left/right turn you into one of the girls (think the sister from the one who gives you the squirtle bottle has the same model) looking down.<br />Getting on the bike doesn&#039;t change your model, but you still move faster.<br /><br />Might try a few more numbers, but so far most restulted in glitchy graphics for the player character.<br />Just a note: the above code also looked glitchy while in the upper level of the pokÃ©mon center, so the sprite might be dependent on the map you&#039;re currently on. I was in Goldenrod City for reference.<br />[/quote]<br /><br />Tried a few more numbers. Setting it to 0 (as well as flying anywhere) resets it to the usual player charater. Bike graphics work as well.<br /><br />First interesting Number I found was 0xc (12 in decimal). Turns you into Nurse Joy in PokÃ©mon Center, Old Man in Goldenrod City, Gym Leader in Gyms, etc.<br />Surfing is interesting in the regard that you [s]become Jesus[/s] keep your sprite and just walk on water.<br />[code]<br />Box 1: Ap0m&#039;va55 (XOR A; OR d4; SUB 0x80)<br />Box 2: Ã©9&#039;l55555&nbsp; (LD [ffd1], A)<br />[/code]<br />It appears that every 12th number results in a &quot;complete transformation&quot; with every fourth not looking glitchy but only replacing one direction (left/right, up, down) so you get a different sprite depending on your movement.<br /><br />[quote author=Nostalgia link=topic=6716.msg207497#msg207497 date=1509287922]<br />[quote author=spamviech link=topic=6716.msg207496#msg207496 date=1509286746]<br />Congratulations.&nbsp; ;D<br /><br />I cheated a bit with Happiness evolutions (they are a pain in Gen2; did that enough as a kid) and with Evolution Stones, but aside from that had a blast with glitchless gameplay.<br /><br />Glitched stuff is great as well, but that&#039;s for another copy.&nbsp; 8)<br />[/quote]<br /><br />Well to complete the Pokedex you have to use glitches anyway - so you might as well go all out, G/S certainly gives you the options to unlike Crystal where it&#039;s much harder.<br />[/quote]<br /><br />When I have to glitch I don&#039;t hold back as well, but in general I try to avoid glitching as much as possible.<br />Unless it&#039;s a save file dedicated to glitching/cheating/whatever is availabe in the specific game. Then I won&#039;t hold back.&nbsp; ;D


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207497#msg207497 date=1509287922]<br />I&#039;m not trying to finish the game really fast, but after countless gen II files over the years, it&#039;s interesting to see how fast I can finish everything now. Gen II is my favourite Pokemon gen easily. <br /><br />I juut love the old Pokemon games. I&#039;ve only owned a 3DS for a month and all I&#039;ve played is VC Gold. Will have to get into the newer Pokemon games eventually, but I&#039;m seriously out of the loop on things - as the last newest gen Pokemon game I played was Pokemon White and I have no knowledge on the any of the new Pokemon from gen 6 and gen 7.<br />[/quote]<br /><br />The classic-era PokÃ©mon games were all directed by Tajiri, except for Crystal, which was directed by Masuda as per [url=https://bulbapedia.bulbagarden.net/wiki/Staff_of_PokÃ©mon_Crystal]the Japanese version credits[/url] and according to himself.<br /><br />[url=https://www.gamefreak.co.jp/blog/dir/?p=177]https://www.gamefreak.co.jp/blog/dir/?p=177[/url]<br /><br />[quote author=&quot;Junichi Masuda&quot;]<br />ã“ã®è¾ºã‚Šã‹ã‚‰æœ¬æ ¼çš„ã«ãƒ‡ã‚£ãƒ¬ã‚¯ã‚¿ãƒ¼æ¥­ã«ãªã‚Šä½œæ›²ãŒæ¿€æ¸›ã—ã¾ã™ã€‚<br />[/quote]<br /><br />[url=https://www.gamefreak.co.jp/blog/dir_english/?p=143]https://www.gamefreak.co.jp/blog/dir_english/?p=143[/url]<br /><br />[quote author=&quot;Junichi Masuda&quot;]<br />Around this time, my main task changed to the director work. Therefore, the number of the composed music had drastically decreased.<br />[/quote]<br /><br />Masuda also [url=https://www.wired.co.uk/article/pokemon-interview]didn&#039;t originally work on Gold and Silver[/url] despite [url=https://bulbapedia.bulbagarden.net/wiki/Staff_of_PokÃ©mon_Gold_and_Silver]being listed as the game&#039;s subdirector[/url].<br /><br />Tajiri&#039;s roles switched from director to executive director and executive producer, and he has alternated between the two ever since Ruby and Sapphire. This may explain the perception that the modern games are &quot;different&quot; and why so many of us are attached to the old games even if we like the new ones, too! :) 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207495#msg207495 date=1509286355]<br />Edit: very strange, but performing this glitch made the Mystery gift option appear at the title screen when I never spoke to the girl in Goldenrod dept store. It also changed my text speed to medium, when I had it on fast before. o.o<br />[/quote]<br /><br />So any idea why this happened when I performed the wild encounter code?<br /><br />[quote author=Couldntthinkofaname link=topic=6716.msg207498#msg207498 date=1509288281]<br />I myself have ordered Pomemon Gold, can&#039;t wait to try this stuff on hardware!<br />[/quote]<br /><br />Gold is the better choice of the two, better version exclusives (the only version exclusive Silver has better is Skarmory imo, the rest are better in Gold) and Gold has better sprites too.<br /><br />[quote author=SatoMew link=topic=6716.msg207500#msg207500 date=1509291169]<br />Tajiri&#039;s roles switched from director to executive director and executive producer, and he has alternated between the two ever since Ruby and Sapphire. This may explain the perception that the modern games are &quot;different&quot; and why so many of us are attached to the old games even if we like the new ones, too! :)<br />[/quote]<br /><br />Interesting. Though I am fond of the gen 3 games too. I realised this year after replaying Emerald that it is a very good game and the battle Frontier gave the game a lot of life and replay value (wow it makes me realise now I&#039;ve played a lot of Pokemon this year, Yellow/Crystal/Emerald and now VC gold). I guess for me it&#039;s the Pokemon games that have been released on the Gameboy I have the most attachment too and I&#039;ve played so many times. And now I&#039;ve finally got a DS after all these years it&#039;s been around, I have a lot Pokemon games to catch up on.&nbsp; 


subject: Re: Debug menus in Japanese Crystal
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Jsierra008 link=topic=7407.msg207484#msg207484 date=1509242398]<br />yes but i want to make a ips patch for a later work with the GS Ball event enabled, something like the western patch<br />[/quote]<br /><br />Oh, my apologies, I misunderstood your question. From what I understand, the Game Genie codes HÃ¡Äky provided in that post are for patching that specific debug menu&#039;s entries so that they point to the addresses of the final release ROM instead.<br /><br />According to [url=https://gamehacking.org/system/gbc]this[/url],<br /><br />[tt]9D2-088-801[/tt]:<br /><br />[code]<br />size: 8 Bit<br />address: 0x7208<br />compare: 0xDA<br />value: 0x9D<br />[/code]<br /><br />[tt]AD2-108-4C1[/tt]:<br /><br />[code]<br />size: 8 Bit<br />address: 0x7210<br />compare: 0xEA<br />value: 0xAD<br />[/code]<br /><br />You probably need to analyze the code of the triggers in the PCC and the Trade Corner attendant&#039;s script in order to achieve your goal. The Japanese version&#039;s event code shouldn&#039;t be too different from [url=https://github.com/pret/pokecrystal/blob/700321a7fb2d6c852ffc91cc0b8867526cb76813/maps/GoldenrodPokeCenter1F.asm#L18-L80]the English version&#039;s[/url].


subject: Re: Debug menus in Japanese Crystal
poster_name: Jsierra008
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Jsierra008
icon: xx
body:
  [quote author=SatoMew link=topic=7407.msg207502#msg207502 date=1509294340]<br /><br />Oh, my apologies, I misunderstood your question. From what I understand, the Game Genie codes HÃ¡Äky provided in that post are for patching that specific debug menu&#039;s entries so that they point to the addresses of the final release ROM instead.<br /><br />According to [url=https://gamehacking.org/system/gbc]this[/url],<br /><br />[tt]9D2-088-801[/tt]:<br /><br />[code]<br />size: 8 Bit<br />address: 0x7208<br />compare: 0xDA<br />value: 0x9D<br />[/code]<br /><br />[tt]AD2-108-4C1[/tt]:<br /><br />[code]<br />size: 8 Bit<br />address: 0x7210<br />compare: 0xEA<br />value: 0xAD<br />[/code]<br /><br />You probably need to analyze the code of the triggers in the PCC and the Trade Corner attendant&#039;s script in order to achieve your goal. The Japanese version&#039;s event code shouldn&#039;t be too different from [url=https://github.com/pret/pokecrystal/blob/700321a7fb2d6c852ffc91cc0b8867526cb76813/maps/GoldenrodPokeCenter1F.asm#L18-L80]the English version&#039;s[/url].<br />[/quote]<br /><br />Thanks, but the HÃ¡Äky&#039;s GG Codes don&#039;t work with my untouched or patched rom, maybe its for other source rom<br /><br />Or need a button to enable it ?, enabling it on bgb don&#039;t marks &quot;P&quot;(Patched) code or autocall the event, same in vba 1.8


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: xylo
poster_ip: ***.***.***.***
icon: xx
body:
  Bit of a minor glitch, but you can make a PokÃ©mon have a glitched name (?) via the Cascade glitch. See the video below;<br /><br />[url=https://www.youtube.com/watch?v=B-FoJsOiPRY]https://www.youtube.com/watch?v=B-FoJsOiPRY[/url]<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207501#msg207501 date=1509291757]<br />[quote author=Nostalgia link=topic=6716.msg207495#msg207495 date=1509286355]<br />Edit: very strange, but performing this glitch made the Mystery gift option appear at the title screen when I never spoke to the girl in Goldenrod dept store. It also changed my text speed to medium, when I had it on fast before. o.o<br />[/quote]<br />So any idea why this happened when I performed the wild encounter code?<br />[/quote]<br /><br />That&#039;s very odd. Say, did you happen to change Box 7&#039;s name anytime after using the code (during the same boot of the game)? If so, it is likely the OAM DMA changed an address somewhere.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  anyway we could do a catch a trainers pokemon code the problem is it needs to be activated in battle or it causes the battle to glitch.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207505#msg207505 date=1509317693]<br />That&#039;s very odd. Say, did you happen to change Box 7&#039;s name anytime after using the code (during the same boot of the game)? If so, it is likely the OAM DMA changed an address somewhere.<br />[/quote]<br /><br />I must of done before I got Celebi as I was getting the wrong poke (first Kingdra then a wild egg lol) and having to change BOX7&#039;s name and I&#039;m sure I didn&#039;t reset. 


subject: Re: Emulating the Mobile Adapter GB
poster_name: wintiger0222
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: wintiger0222
icon: xx
body:
  [img]https://imgur.com/3tJAhBt.png[/img]<br />Well, I think there is no advancing at here, well.(Well, I think advance is not proper word, well)<br /><br />I&#039;m translating crystal into korean, and in the same time I tried to fix mobile functions.<br />(This is why there are no english at image)<br />Many Mobile Functions are worked well, and somethings are not.<br /><br />I wrote some things ,with very very poor english grammer, that I have figured out.<br /><br />mobile_5b.asm/Function16c000<br />Mobile protcol test when boot the game.<br /><br />mobile_46.asm/Function11ac3e<br />Select Wanted pokemon at Pokecom mobile trade.(is this right name?)<br />Attached screen shot is works of this function.<br />Saddly, because of japanese name length limit, this cause crash.<br />To make this work You should change 	&quot;ld a, $6&quot; into &quot;ld a, $B&quot; (part of &quot;.asm_11b2e7 &quot;) and erase first &quot;call Placestring&quot; at &quot;Function11b242&quot; , then this would works at english version.<br /><br />It looks like return the value that which pokemon chosen.<br /><br />mobile_40.asm/Function101231<br />Mobile Trade by Dialing<br /><br />This seems works perfectly even if using english version.<br />(I tested this with Hacky&#039;s python script)<br /><br />mobile_40.asm/Function101225<br />Mobile Battle by Dialing<br /><br />This also seems works, but I coulden&#039;t test this.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=6716.msg207506#msg207506 date=1509342249]<br />anyway we could do a catch a trainers pokemon code the problem is it needs to be activated in battle or it causes the battle to glitch.<br />[/quote]<br /><br />Nope. Already tried. Results in glitch battle. Catching the trainers Pokemon ends up turning it into an ????? anyway.&nbsp; :(


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t entirely know how this works, technically... How is the invalid data loaded and why does this corrupt so much memory?


subject: Coin Case Glitch in other languages
poster_name: Kami
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello! I hope this question doesn&#039;t exist already.<br />I am about to buy the Silver Virtual Console version on my 3ds.<br />I really want to buy it in german (I have the option to buy it in other languages aswell!)<br />And I want to know it the coin case glitch works on a non-english version of the game too. I just want to get a shiny ditto through this<br />(I don&#039;t have 2 3ds devices to perform the other trick)<br />If yes, does it work different than in the english versions? <br /><br />If no, could I just buy the english version of the game on my german 3ds device to make it work?


subject: Re: Coin Case Glitch in other languages
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If i&#039;m not mistaken, the coin case was properly translated in all languages outside english, meaning the glitch is english only. Sorry.&nbsp; :(


subject: Re: Coin Case Glitch in other languages
poster_name: Kami
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=8124.msg207512#msg207512 date=1509376500]<br />If i&#039;m not mistaken, the coin case was properly translated in all languages outside english, meaning the glitch is english only. Sorry.&nbsp; :(<br />[/quote]<br /><br />Okay, but would it work if I buy the english version of silver on my german 3ds?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Finished the Pokedex now but ended up with seen 252, caught 251. I think that might be due to wild encounter code and encountering a wild egg before I encountered Celebi, though that was a error with spamviech&#039;s codes at the time. :P Not fussed though, as Torchickens shows you can fill the Pokedex to 256 in G/S if you really want to: https://www.youtube.com/watch?v=JQq5BkSO3wI&amp;safe=active<br /><br />Just need to fight Red now and I&#039;ll be finished, but will do a tiny bit of training first, not because I need to but because my Houndoom hasn&#039;t even learnt Crunch yet which is annoying, so it seems I&#039;ll be getting my team all to level 52, beat Red and I&#039;ll be done with under 40 hours of playtime. 


subject: Re: Coin Case Glitch in other languages
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Works without problems.<br />Not sure how transfering to PokÃ©mon Bank works (not possible so far), but it wasn&#039;t a problem for Gen1 VC variants.<br /><br />You could try [url=http://forums.glitchcity.info/index.php?topic=8109.0]this guide[/url], but ACE using box names is at least very difficult with the german charset (can&#039;t input most codes).


subject: Re: Coin Case Glitch in other languages
poster_name: Kami
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=8124.msg207515#msg207515 date=1509377948]<br />Works without problems.<br />Not sure how transfering to PokÃ©mon Bank works (not possible so far), but it wasn&#039;t a problem for Gen1 VC variants.<br /><br />You could try [url=http://forums.glitchcity.info/index.php?topic=8109.0]this guide[/url], but ACE using box names is at least very difficult with the german charset (can&#039;t input most codes).<br />[/quote]<br /><br />Thanks! So just to make sure: if I buy the english version, it will work without problems?


subject: Re: Coin Case Glitch in other languages
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Kami link=topic=8124.msg207516#msg207516 date=1509378050]<br />[quote author=spamviech link=topic=8124.msg207515#msg207515 date=1509377948]<br />Works without problems.<br />Not sure how transfering to PokÃ©mon Bank works (not possible so far), but it wasn&#039;t a problem for Gen1 VC variants.<br /><br />You could try [url=http://forums.glitchcity.info/index.php?topic=8109.0]this guide[/url], but ACE using box names is at least very difficult with the german charset (can&#039;t input most codes).<br />[/quote]<br /><br />Thanks! So just to make sure: if I buy the english version, it will work without problems?<br />[/quote]<br /><br />Yep. The english version was translated incorrectly, and as such the glitch works fine.<br /><br />Not sure about the German version. Most sources say english only.<br /><br />Although, if you don&#039;t want to buy the english version, you could try TM 17 in the balls pocket as opposed to coin case. Spamveich linked a guide on how to do so in his reply.


subject: Re: Coin Case Glitch in other languages
poster_name: Kami
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=8124.msg207518#msg207518 date=1509378961]<br />[quote author=Kami link=topic=8124.msg207516#msg207516 date=1509378050]<br />[quote author=spamviech link=topic=8124.msg207515#msg207515 date=1509377948]<br />Works without problems.<br />Not sure how transfering to PokÃ©mon Bank works (not possible so far), but it wasn&#039;t a problem for Gen1 VC variants.<br /><br />You could try [url=http://forums.glitchcity.info/index.php?topic=8109.0]this guide[/url], but ACE using box names is at least very difficult with the german charset (can&#039;t input most codes).<br />[/quote]<br /><br />Thanks! So just to make sure: if I buy the english version, it will work without problems?<br />[/quote]<br /><br />Yep. The english version was translated incorrectly, and as such the glitch works fine.<br /><br />Not sure about the German version. Most sources say english only.<br /><br />Although, if you don&#039;t want to buy the english version, you could try TM 17 in the balls pocket as opposed to coin case. Spamveich linked a guide on how to do so in his reply.<br />[/quote]<br /><br />Okay, that&#039;s all I needed to know. Thanks!<br />I am just fine starting my adventure in english!


subject: The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  [b]UPDATE: Many extra thanks to Epsilon, spamviech, Evie, Crystal_, ISSOtm and luckytyphlosion for helping, reviewing and contributing to this guide[/b]<br /><br />Hello there! Welcome to the world of PokÃ©mon ACE!<br /><br />Lately, with the release of Gold, Silver and now even Crystal in 3DS&#039;s Virtual Console, there has been a lot of people asking questions about Arbitrary Code Execution (mainly Coin Case), and with this came a lot of new ideas to use it as well as to perform it. Very talented people (luckytyphlosion, gifvex, Crystal_, ISSOtm to mention some...) have restarted working on it especially for G/S non-english adaptation and lately for Crystal. All of this resulted in the information being spread in a lot of different threads, videos, talks on Discord, etc.<br /><br />I felt like it was the time for a collaborative guide that gathers all of the current knowledge on<br />- What are the different ways to make ACE in my language<br />- What can I do with ACE<br />- On the long term, an introduction to opcodes and how to make codes that go beyond basic memory editing (if you want to write this part, please don&#039;t hesitate)<br />In forms of summaries but also by giving the links to the different threads and videos about it.<br /><br />Please don&#039;t hesitate to contribute to this guide, as I don&#039;t know everything about it, especially regarding english games!<br /><br />TABLE OF CONTENT:<br />I. WHAT ARE THE DIFFERENT ACE TECHNIQUES IN G/S/C<br />II. COIN CASE VS. WRONG POCKET TM ACE<br />III. WRONG POCKET TM ACE EXPLAINED<br />	III.1: Obtain a Glitch PokÃ©mon nÂ°000<br />	III.2: Use the Glitch PokÃ©mon nÂ°000 to get Mystery Eggs<br />	III.3: Use Mystery Eggs to get TM17 (G/S) or TM15 (Crystal)<br />	III.4: Prepare the Party setup<br />IV. BAD CLONE ACE EXPLAINED<br />	IV.1: Get any type of Bad Clone (both setups)<br />	IV.2 (A): Crystal_&#039;s setup for ITEMS OR BOX CODES<br />	IV.2 (B): luckytyphlosion&#039;s setup for MAIL CODES<br />V. GLITCH POKEDEX ACE EXPLAINED<br />	V.1: Obtain a Glitch PokÃ©mon nÂ°000<br />	V.2: Use the Glitch PokÃ©mon nÂ°000 to get Mystery Eggs<br />	V.3: Use Mystery Eggs to get the Expanded Balls Pocket<br />	V.4: Prepare the Party setup<br />VI. WRITE AND EXECUTE A CODE, REGARDLESS OF THE METHOD<br />	VI.1: GET TM17 IN THE WRONG POCKET (Box, G/S)<br />	VI.2: GET ANY TM/HM x255 CODE (Box, G/S)<br />	VI.3: INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE (Items, G/S/C)<br />	VI.4: GET ANY ITEM CODE (Items, G/S/C)<br />	VI.5: MEMORY EDITOR CODE, A.K.A. GAMESHARK SIMULATOR (Items or Box, G/S/C)<br />	VI.6: CHANGING ID CODE (Items, G/S/C)<br />	VI.7: MAKE THE SIXTH POKEMON IN PARTY SHINY CODE (Items, G/S/C)<br />	VI.8: GOTTA CATCH &#039;EM ALL CODE (Box, G/S)<br />	VI.9: MORE AND COMPETITIVE CODES (Box)<br />	VI.10: A WORD ON HOW TO WRITE COMPLEX CODES<br />ANNEX 1: GET TM ACE SETUP THROUGH A FIRST-GENERATION GAME<br />	ANNEX 1.1: Gather the needed items<br />	ANNEX 1.2: Create custom jump PokÃ©mon<br />	ANNEX 1.3: Use Mystery Eggs to get TM25<br />ANNEX 2: GET MYSTERY EGGS USING THE MACHOP TECHNIQUE<br />GENERAL CONCLUSION<br />	<br />[u][b]I. WHAT ARE THE DIFFERENT ACE TECHNIQUES IN G/S/C[/b][/u]<br /><br />Much like in first generation games, [b]arbitrary code execution is about to give you the power to modify the RAM in order to make the game do pretty much everything you want[/b], but also, if you feel like it, change the maps, create scripts, and even program another game inside your game.<br /><br />A well-known method to perform ACE in G/S is the [u]Coin Case Glitch[/u]. This very simple glitch is due a mistake done by the english localization team, who forgot in just one occasion to change the end-of-string terminator that was used in japanese games for the actual terminator of english and european games. This mistake is not a part of the original game, and that&#039;s why unfortunately, because the localization team of every other country was more rigorous, this glitch cannot be performed in all other languages. Also, even in english games, the glitch was corrected in Crystal. Lame.<br /><br />So what are the other options to perform ACE, being either in english games or non-english european games? Well, there is, at least, 5 other ACE methods:<br /><br />- The best method, by far, is the [b]TM Wrong Pocket ACE[/b]. which is about having a certain TM in another Pocket than the TM/HM Pocket of the bag and take advantage of it. This method works in all languages and all three games, but it is relatively hard to setup in non-english G/S, as well as in any language Crystal (for which it would require the use of another ACE method BEFORE using this one).<br /><br />- There is also the [u]Bad Clone ACE[/u] which used the properties of a Bad Clone to execute code from box names, much like Coin Case. However, this method uses code from the Mobile GB Adapter and therefore, is a Crystal-only glitch! Although it has been mainly used only as a speedrunning technique for a long time, Crystal_ and luckytyphlosion have made setups to use it during legit gameplay. Nowadays, this can be considered the best method to start ACE (and setup the Wrong Pocket TM) in Crystal.<br /><br />- ACE can also be achieved using [u]Glitch PokÃ©dex Mode[/u]. This method may be done in G/S but I have no clue how to. However, I recently did a setup to use it in Crystal. This method is quite long to setup and has drawbacks, but it also has huge benefits compared to Bad Clone ACE. As a result, if you play Crystal and don&#039;t intend to use Bad Clone ACE to setup Wrong Pocket TM ACE, I recommend to use this method instead.<br /><br />The two last methods are not considered worth it so I&#039;m not going to explain them in details.<br /><br />- [u]Move 0x00 ACE[/u] (also known as &#039;Move 00 Type ACE&#039; or &#039;Type 0xD0 move glitch&#039;) is another method found by luckytyphlosion that involves a Ditto traded from R/B in which he has been taught the infamous Cooltrainer move. It can also be performed with a Bad Clone. Originally made for speedrunning, it was adapted for legit gameplay by Torchickens, and seems to be exclusive to english games.<br />* The method is well explained [url=http://glitchcity.info/wiki/Type_0xD0_move_glitch]here[/url].<br />* You will find more on this glitch in the [url=http://forums.glitchcity.info/index.php?topic=8000.0]official thread[/url] by Torchickens.<br /><br />- The &#039;[u]Withdraw Smash ACE[/u]&#039;, also known as Stack Corruption, is yet another multi-language G/S ACE technique invented by Crystal_ and ISSOtm which also uses a Bad Clone, this time to extend the number of PokÃ©mon in party, and relies on the withdrawal of many PokÃ©mon to corrupt data.<br />* Don&#039;t hesitate to watch [url=https://www.youtube.com/watch?v=b2tVVeZ7Th4]this video[/url] if you want to learn it!<br /><br />[u][b]II. COIN CASE VS. WRONG POCKET TM ACE[/b][/u]<br /><br />NOTE: These methods can be performed on original cartridge as well as Virtual Console (even if it&#039;s a shitty emulator), but if performed on an emulator, you must use one that supports ECHO RAM. VisualBoyAdvance doesn&#039;t (although VBA-RR and VBA-M do). BGB does. BGB loves you. Use BGB.<br /><br />Coin Case Glitch is a ready-to-use ACE technique that has no complicated requirements, and there has been work done to exploit it directly, for example to get Celebi. However, Wrong Pocket TM ACE requires less steps and is easier to handle. Also, it doesn&#039;t corrupt the Stack, which is an annoying side-effect of Coin Case Glitch. Thus, it is a more efficient ACE source than Coin Case... [b]as long as you have the good TM in the wrong Pocket, and that is precisely the catch.[/b]<br /><br />Fortunately, it is possible to use [b]Coin Case glitch to get this TM in that Pocket[/b]! This to say that nowadays, most people prefer to use Coin Case glitch just once, in order to setup Wrong Pocket TM ACE. Whether what you will be one of them or not is up to you, but if you stick with Coin Case, codes that are designed for Wrong Pocket TM won&#039;t work without a prior adaptation step. If you&#039;re playing a non-english game and thus don&#039;t have access to Coin Case, or if you&#039;re playing an english game but for some reason prefer not using Coin Case, you can directly jump to chapter III which explains the Wrong Pocket TM ACE. <br /><br />[u]This is basically how Coin Case works:[/u]<br /><br />1 ) You need what we call a &#039;Slide PokÃ©mon&#039; in slot 3 of the party. Unlike Wrong Pocket TM ACE, for which any lvl2 Sentret without 6 in Sp. Def. would work, the &#039;Slide PokÃ©mon&#039; for Coin Case is less permissive. The perfect PokÃ©mon for this is Rocky, the Onix you can trade for a lvl5 (this is important) Bellsprout in Violet City, or Muscle the Machop traded for a lvl13 Drowzee in Goldenrod Departement Store. If you don&#039;t have access to these trades, then you can use a lvl2 female Hoothoot (Route 29) but this has only 60% chance to work and you have no way to figure out if it will before you try. If it doesn&#039;t, you need to catch another Hoothoot. In all cases the &#039;Slide PokÃ©mon&#039; must never be trained of receive an EV-changing item, as well as never receive significant friendship, and must be fully healed (without status) every time you use the glitch.<br /><br />2 ) You need a Quagsire with some specific requirements in slot 4 of the party. There is two sets of requirements, depending on if you want to write a code from your items, in a similar fashion that what was used in R/B/Y, or from box names. Both methods will be explained in this guide, and codes will be given for both. I actually suggest you prepare two Quagsire so you can use one or the other method at any time.<br />	For item codes, have Quagsire hold a Protein and know SLEEP TALK (TM35, basement of Goldenrod Store, requires Basement Key) as first move.<br />	For box codes, have Quagsire hold TM02 (giveaway at Ilex Forest, or bought at Goldenrod Store) and know RETURN (TM27, giveaway if your first PokÃ©mon is happy at Goldenrod Store) as first move.<br />	<br />NOTE: If you can&#039;t or don&#039;t want to get these TMs, you can use a glitch called the Bad Clone Trick to get them. However, as this glitch is the entry (and hot) point of using Wrong Pocket TM ACE if you don&#039;t use Coin Case, doing it makes the whole Coin Case thing useless because you will now be able to use TM ACE. If you really want to learn about this, continue this guide and you&#039;ll find out how when we&#039;ll come to the part of preparing these Quagsire for Wrong Pocket TM ACE.<br /><br />NOTE: Of course, you can setup only one ACE method for now, as you will learn from this guide how to use it to setup the other method.<br /><br />3 ) Write whatever code you want using the method you chose. You will learn how to do this later in the guide, since it is exactly the same for Coin Case and Wrong Pocket TM ACE.<br /><br />4 ) Enter Cherrygrove City&#039;s PokÃ©mon Mart.<br /><br />5 ) Exit it and take exactly 4 steps to the right.<br /><br />6 ) Open Bellsprout or Machop&#039;s entry in the PokÃ©dex.<br /><br />7 ) Open the bag, switch Pocket at least once, then go to the Key Items Pocket.<br /><br />8 ) Use Coin Case to launch the code.<br /><br />Now before we explain how TM ACE works and how to make codes you will be able to use with one or the other method, here are some ressources you might want to look at:<br />* GCL&#039;s official page about [url=https://glitchcity.info/wiki/Coin_Case_glitch]the Coin Case Glitch[/url] which also gives some troubleshooting.<br />* Technical explanations about this glitch can be found [url=http://forums.glitchcity.info/index.php?topic=6716.0]in this thread[/url]<br />* Crystal_ made [url=https://www.youtube.com/watch?v=PsIb3OZaYAs]this video[/url] illustrating the glitch and explaining how to setup Wrong TM ACE with it.<br /><br />[u][b]III. WRONG POCKET TM ACE EXPLAINED[/b][/u]<br /><br />This technique relies on the fact that a TM or HM that is placed, using some glitch magic, in another Pocket than the TM/HM Pocket will execute code, instead of teaching a move. Unless you use another ACE technique (such as Coin Case ACE in G/S, or Bad Clone ACE in Crystal) to get that TM, you will need to learn how to perform &#039;Item Shifting Glitch&#039;, a glitch allowing to get any item in the Balls Pocket, by following the steps below (official thread [url=http://forums.glitchcity.info/index.php?topic=8154.0]here[/url]). <br /><br />Credits for it essentially goes to Paco81, for the initial discovery of the Bad Clone Trick (and all those who worked to make this glitch better), luckytyphlosion and gifvex (for the discovery of the Item Shifting Glitch) and HÃ¡Äky (for its initial work discovering the Expanded Balls Pocket).<br /><br />NOTE: If playing G/S, you can use &#039;ANNEX 1: GET TM ACE SETUP THROUGH A FIRST-GENERATION GAME (G/S only)&#039; instead of this whole part.<br /><br />You first need to use the Bad Clone Trick in a certain way to get two Mystery Eggs. [b]The most reliable way to do this, that guarantees that it will work[/b], has been invented by luckytyphlosion and gifvex and is described below (original source is [url=https://pastebin.com/cYE5zcPt]this pastebin[/url]). However, there is another method which is described in &#039;ANNEX 2: GET MYSTERY EGGS USING THE MACHOP TECHNIQUE&#039; if you want to use it instead of III.1 and III.2 (then come back to III.3).<br /><br />This particular Bad Clone Trick requires:<br />- One PC box which has 15 random PokÃ©mon currently, but never had 20 PokÃ©mon at one point.<br />- Either the Daycare Man or Lady must not have a PokÃ©mon (Lady is preferred).<br />- At least $200.<br />- A Bellsprout cloned 5 times (so you have 6 of them).<br /><br />	[u]III.1: Obtain a Glitch PokÃ©mon nÂ°000[/u]<br /><br />Go to the Daycare, south of Goldenrod, and clone Bellsprout once again. However this time, the cloning must be performed in the 15 PokÃ©mon aforementioned box and you must have reset your game right after saying &#039;YES&#039; to the question about save replacement. If it worked, the obtained clone will be level 0, won&#039;t have a name (or many &quot;?&quot; as name in Crystal), and its PokÃ©dex ID (in the profile) also is 000; this is what we call a Bad Clone. If you got a normal clone, release it and try again.<br />NOTE: In G/S, any clone without name/level but also without the PokÃ©dex ID 000 won&#039;t work (treat it as a normal clone). However, if you get such clone in Crystal, it is worth noting that you can convert it into a Bad Clone that can be used for this method. To do this, store the Bad Clone in another PC Box and store 5 other PokÃ©mon in that same box. Then, use the withdraw option to display that box. Leave it and use the withdraw option again. All PokÃ©mon are now Kingdra. Withdraw the Bad Clone and you can now use it (in case of trouble with getting the Kingdra, please read [url=http://forums.glitchcity.info/index.php?topic=7062.0]this[/url]).<br /><br />Make a party of the Bad Clone and 5 Bellsprout clones (leaving 1 in the PC).<br /><br />Give the Bad Clone to the Daycare lady and immediately take it back. It will now be a Glitch PokÃ©mon with nÂ°000 and LAST in your party.<br /><br />	[u]III.2: Use the Glitch PokÃ©mon nÂ°000 to get Mystery Eggs[/u]<br />	<br />Open the PC menu and enter the Move Pkmn W/O Mail menu.<br /><br />Move the last Bellsprout clone from the PC to the 2nd slot of the Party. Note that the Bellsprout names will change to [blank] or your Trainer Name. This is a side effect of the setup and does not have any negative effects.<br /><br />Move the first Bellsprout to the third party slot, then move the first Bellsprout in place (Press A when the move cursor is shown).<br /><br />Move the fourth Bellsprout to the first party slot, then move the first Bellsprout in place (Press A when the move cursor is shown).<br /><br />Move the first Bellsprout to the fourth party slot, then move the first Bellsprout in place TWICE.<br /><br />Move the second Bellsprout to the third party slot, then move the first Bellsprout in place TWICE.<br /><br />Exit the Move Pkmn W/O Mail menu and go to the Deposit Menu. Release the first Bellsprout and exit the PC. The first two Bellsprout in the party now have Mystery Egg attached.<br /><br />Take them and give the PokÃ©mon Glitch nÂ°000 to the Daycare Lady.<br /><br />	[u]III.3: Use Mystery Eggs to get TM17 (G/S) or TM15 (Crystal)[/u]<br />	<br />Move the Mystery Eggs in the Key Items Pocket so that they are the last items in the Pocket (do not swap them together).<br />NOTE: For this trick to work, the Key Items Pocket must be full. If you don&#039;t have enough Key Items, you can keep cloning the Bellsprout to get more Eggs in order to fill the Pocket.<br /><br />Have Great Ball x1 and PokÃ© Ball x2 in the Balls Pocket (nothing else).<br /><br />Now, swap the first Mystery Egg with the second Mystery Egg (order is important). A S.S. Ticket will appear.<br /><br />Move to the Balls Pocket. The Great Ball x1 and PokÃ© Ball x2 should have turned into a Master Ball x5 and Ultra Ball x255 respectively (255 is indicated by a [tile]5).<br /><br />Toss 47 (G/S) or 49 (Crystal) Ultra Balls from the Ultra Ball x255 stack.<br /><br />Swap the Master Ball x5 with the Ultra Ball x208 (G/S) or x206 (Crystal).<br /><br />Deposit the Mystery Egg in the Player&#039;s PC.<br /><br />Withdraw the Mystery Egg from the Player&#039;s PC. In the Balls Pocket, the Ultra Ball x208 and Master Ball x5 should now have turned into a TM17 x1 (G/S) or TM15 x1 (Crystal) and PokÃ© Ball x255.<br /><br />Store 255 (all) from the PokÃ© Ball x255 stack in the Player&#039;s PC.<br /><br />	[u]III.4: Prepare the Party setup[/u]<br /><br />Item gathering:<br />- In G/S, get TM02 (giveaway at Ilex Forest, or bought at Goldenrod Store), TM27 (giveaway if your first PokÃ©mon is happy at Goldenrod Store) and TM35 (basement of Goldenrod Store, requires Basement Key).<br />NOTE: You can also use the Bad Clone Trick to get these items. If you know how to do that, the corresponding moves you will need are ZAP CANNON (TM02), ENCORE (TM35) and FRUSTRATION (TM27).<br />- In Crystal, get TM50 (giveaway after the Spearow quest in Route 31), TM27 (giveaway if your first PokÃ©mon is happy at Goldenrod Store), Thick Club (or Miracle Seed) and optionally TM18 (obtained at SlowpokÃ© Well or bought at Celadon Store).<br /><br />Quagsire preparation:<br />Similarly to Coin Case ACE, you need a Quagsire.<br />- In G/S, to execute box codes, get the Quagsire to know RETURN as first move (using TM27), and give it TM02 to hold. To execute item codes, get the Quagsire to know SLEEP TALK as first move (using TM35), and give it a Protein to hold. The Quagsire must be in SECOND position of the party.<br />- In Crystal, to execute box codes, get the Quagsire to know SAFEGUARD as first move (this can only be done through breeding), and give it Miracle Seed (to execute from character 1) or Thick Club (character 2) to hold. To execute item codes, get the Quagsire to know RETURN as first move (using TM27), and give it TM50 to hold. Finally, to execute mail buffer codes, get the Quagsire to know RAIN DANCE as first move (by leveling up to lvl 47 or using TM18), and make sure it doesn&#039;t hold any item. The Quagsire must be in FIRST position of the party.<br />NOTE: I suggest you actually prepare all the Quagsire, and store the ones you don&#039;t use when you don&#039;t.<br /><br />Final jump preparation:<br />- In G/S, you now need a &#039;Slide PokÃ©mon&#039; which will be put at FIRST position of the party (fully healed, without status). Catch either a Bellsprout in Violet City that you raise at lvl5 then trade for Rocky the Onix with the NPC in Violet City, or a Drowzee that you raise at lvl13 then trade for Muscle the Machop with the NPC in Goldenrod Departement Store. This PokÃ©mon must then never win any battle, or you won&#039;t be able to use it anymore.<br />NOTE: Instead, you can catch a lvl2 Sentret in Route 29, and make sure it doesn&#039;t have a 6 in its SP. DEF. stat (if so, catch another - this stat value appears in 31.25% of lvl2 Sentret). This PokÃ©mon must then never win any battle, or you won&#039;t be able to use it anymore.<br />- In Crystal, you now need to use any other ACE method to execute the following item code (starting from item 1):<br />PP Up x252<br />TM42 x18<br />TM27 x3<br />TM10 x(any quantity)<br />Any other items in any quantities can go from here on<br />Once done, toss 29 PP Up and 1 TM42 and execute again. Then toss 28 PP Up and 1 TM42 and execute a third time.<br /><br />With all this done, everytime you use the TM from the Wrong Pocket with the PokÃ©mon in right place, code will be executed!<br /><br />[u][b]IV. BAD CLONE ACE EXPLAINED[/b][/u]<br /><br />If you&#039;re playing Crystal, you will anyway need another ACE method than the one described in section III. to set it up. This method is the most suitable one and can be performed before III. If you&#039;re playing G/S, just jump to section &#039;VI. WRITE AND EXECUTE A CODE, REGARDLESS OF THE METHOD&#039;.<br /><br />There are two different setups available for this ACE method. Crystal_&#039;s one is quick but only works if executing code from ITEMS or BOX NAMES ; luckytyphlosion&#039;s one can be used to execute code from the MAIL BUFFER instead.<br /><br />	[u]IV.1: Get any type of Bad Clone (both setups)[/u]<br /><br />You will need:<br />- One PC box which has 15 random PokÃ©mon currently, but never had 20 PokÃ©mon at one point.<br />- A random PokÃ©mon.<br /><br />Go to the Daycare, south of Goldenrod, and clone the random PokÃ©mon once again. However this time, the cloning must be performed in the 15 PokÃ©mon aforementioned box and you must have reset your game right after saying &#039;YES&#039; to the question about save replacement. If it worked, the obtained clone will have many &quot;?&quot; as name. Here, the level and PokÃ©mon ID are not important. If you got a normal clone, release it and try again.<br /><br />Store the Bad Clone in the PC. The best is not having any other PokÃ©mon in the box, so they don&#039;t get corrupted.<br /><br />	[u]IV.2 (A): Crystal_&#039;s setup for ITEMS OR BOX CODES[/u]<br /><br />[list]<br />[li]Have a Max Elixer or TM21 (FRUSTRATION, giveaway if your first PokÃ©mon is sad at Goldenrod Store), in the bag.[/li]<br />[li]Catch a Quagsire (or evolve any Wooper). This PokÃ©mon must have RETURN as first move (to execute from FIRST STORED ITEM), or must have SAFEGUARD as first move (to execute from respectively from BOX 1 NAME - this can only be taught through breeding!) and a move 10 or less characters long as fourth move. [b]Put it in the first slot of your team[/b].[/li]<br />[li]Catch a Spearow and make it hold TM50 (NIGHTMARE, obtained on Route 31, after completing the mail quest) to execute code from FIRST STORED ITEM or make it hold MIRACLE SEED or THICK CLUB to execute from respectively character 1 or 2 in BOX 1 NAME. This PokÃ©mon must be second in the team.[/li]<br />[/list]<br /><br />The code execution is then performed this way:<br /><br />[list]<br />[li]Save and reset in front of a PokÃ©mon Center.[/li]<br />[li]Enter the Center, go up until reaching the healing machine, go right until hitting the wall, go up to the PC. These steps are very precise, don&#039;t do any other pattern.[/li]<br />[li]Open the bag, place the cursor on the Max Elixer or TM21 but DON&#039;T CLICK ON IT. Leave the bag.[/li]<br />[li]Use the deposit option on Bill&#039;s PC to view Quagsire&#039;s profile. Go to its moves page, then exit Quagsire&#039;s profile and hit down to display Spearow&#039;s sprite. Don&#039;t click on it.[/li]<br />[li]Exit the deposit menu, and use the withdraw option to view the box containing the Bad Clone. You&#039;ll see a bunch of &quot;?&quot; but it will also execute the code![/li]<br />[/list]<br /><br />	[u]IV.2 (B): luckytyphlosion&#039;s setup for MAIL CODES[/u]<br /><br />Here&#039;s a pastebin that roughly explains this setup: https://pastebin.com/DaWmYHLF<br />Please note that you must introduce &quot;4AA&quot; before starting your mail code. Otherwise, s**t will happen. <br /><br />[u][b]V. GLITCH POKEDEX ACE EXPLAINED[/b][/u]<br /><br />Only available in Crystal (so far), this method is not perfect, but once it&#039;s setup the first time, it&#039;s practical. For some reasons, you might not want to setup the Wrong Pocket TM ACE in your Crystal version and if so, I recommend to use this method instead of the Bad Clone ACE, because it allows to execute code from everywhere in the game and not only at a PokÃ©mon Center. If you&#039;re playing G/S, just jump to section &#039;VI. WRITE AND EXECUTE A CODE, REGARDLESS OF THE METHOD&#039;.<br /><br />As with the Wrong Pocket TM ACE, you first need to use the Bad Clone Trick in a certain way to get Mystery Eggs, but this time, you need three of them. [b]The most reliable way to do this, that guarantees that it will work[/b], has been invented by luckytyphlosion and gifvex and is described below (original source is [url=https://pastebin.com/cYE5zcPt]this pastebin[/url]). However, there is another method which is described in &#039;ANNEX 2: GET MYSTERY EGGS USING THE MACHOP TECHNIQUE&#039; if you want to use it instead of V.1 and V.2 (then come back to V.3).<br /><br />This particular Bad Clone Trick requires:<br />- One PC box which has 15 random PokÃ©mon currently, but never had 20 PokÃ©mon at one point.<br />- Either the Daycare Man or Lady must not have a PokÃ©mon (Lady is preferred).<br />- At least $200.<br />- A Bellsprout cloned 5 times (so you have 6 of them).<br /><br />	[u]V.1: Obtain a Glitch PokÃ©mon nÂ°000[/u]<br /><br />Go to the Daycare, south of Goldenrod, and clone Bellsprout once again. However this time, the cloning must be performed in the 15 PokÃ©mon aforementioned box and you must have reset your game right after saying &#039;YES&#039; to the question about save replacement. If it worked, the obtained clone will be level 0, won&#039;t have a name (or many &quot;?&quot; as name in Crystal), and its PokÃ©dex ID (in the profile) also is 000; this is what we call a Bad Clone. If you got a normal clone, release it and try again.<br />NOTE: In G/S, any clone without name/level but also without the PokÃ©dex ID 000 won&#039;t work (treat it as a normal clone). However, if you get such clone in Crystal, it is worth noting that you can convert it into a Bad Clone that can be used for this method. To do this, store the Bad Clone in another PC Box and store 5 other PokÃ©mon in that same box. Then, use the withdraw option to display that box. Leave it and use the withdraw option again. All PokÃ©mon are now Kingdra. Withdraw the Bad Clone and you can now use it (in case of trouble with getting the Kingdra, please read [url=http://forums.glitchcity.info/index.php?topic=7062.0]this[/url]).<br /><br />Make a party of the Bad Clone and 5 Bellsprout clones (leaving 1 in the PC).<br /><br />Give the Bad Clone to the Daycare lady and immediately take it back. It will now be a Glitch PokÃ©mon with nÂ°000 and LAST in your party.<br /><br />	[u]V.2: Use the Glitch PokÃ©mon nÂ°000 to get Mystery Eggs[/u]<br />	<br />Open the PC menu and enter the Move Pkmn W/O Mail menu.<br /><br />Move the last Bellsprout clone from the PC to the 2nd slot of the Party. Note that the Bellsprout names will change to [blank] or your Trainer Name. This is a side effect of the setup and does not have any negative effects.<br /><br />Move the first Bellsprout to the third party slot, then move the first Bellsprout in place (Press A when the move cursor is shown).<br /><br />Move the fourth Bellsprout to the first party slot, then move the first Bellsprout in place (Press A when the move cursor is shown).<br /><br />Move the first Bellsprout to the fourth party slot, then move the first Bellsprout in place TWICE.<br /><br />Move the second Bellsprout to the third party slot, then move the first Bellsprout in place TWICE.<br /><br />Exit the Move Pkmn W/O Mail menu and go to the Deposit Menu. Release the first Bellsprout and exit the PC. The first two Bellsprout in the party now have Mystery Egg attached. Clone one of these Bellsprout in order to have three PokÃ©mon with Mystery Egg attached.<br /><br />Take them and give the PokÃ©mon Glitch nÂ°000 to the Daycare Lady.<br /><br />	[u]V.3: Use Mystery Eggs to get the Expanded Balls Pocket[/u]<br />	<br />The idea here is to perform luckytyphlosion&#039;s Item Shifting Glitch (official thread [url=http://forums.glitchcity.info/index.php?topic=8154.0]here[/url]) in a certain way that I coined &#039;Double Item Shifting Glitch&#039;. The catch here is that you don&#039;t want a specific items in your Balls Pocket, but you want this pocket to get 255 items (&lt;i&gt;Expanded Balls Pocket&lt;/i&gt;) so you can access your stored items (and many other data) from the Balls Pocket. However, in Crystal, item 00 (&quot;?&quot;) freezes the game when you place the cursor on it, so you need to make sure that there won&#039;t be an item 00 before stored items in the Expanded Balls Pocket. This is the way it must be performed:<br />[list]<br />[li]Move the Mystery Eggs in the Key Items Pocket so that they are the last items in the Pocket (do not swap them together).<br />NOTE: For this trick to work, the Key Items Pocket must be full. If you don&#039;t have enough Key Items, you can keep cloning the Bellsprout to get more Eggs in order to fill the Pocket.[/li]<br />[li]Have Ultra Ball x1 followed PokÃ© Ball x2 in the Balls Pocket[/li]<br />[li]Swap the second Mystery Egg with the third (order is important). A S.S. Ticket will appear.[/li]<br />[li]Move to the Balls Pocket. The Ultra Ball x1 and PokÃ© Ball x2 should have turned into a Master Ball x5 and Ultra Ball x255 respectively (255 is indicated by a [tile]5). Swap them.[/li]<br />[li]Fill your Balls Pocket by any mean.[/li]<br />[li]Store the bottom-most Mystery Egg, then take it back.[/li]<br />[li]Do the swap again with the 2 remaining Mystery Egg (first with last).[/li]<br />[li]Store the remaining Mystery Egg, then take it back.[/li]<br />[/list]<br /><br />	[u]V.4: Prepare the Party setup[/u]<br />	<br />Gather the following items and store them in the PC:<br />[list]<br />[li]TM19 x1 (GIGA DRAIN, obtained at the Radio Tower or at Celadon&#039;s store)[/li]<br />[li]TM29 x1 (PSYCHIC, given by some NPC in Saffron City or obtained at Celadon&#039;s Game Corner)[/li]<br />[li]Any item with a quantity of 9[/li]<br />[/list]<br /><br />Now, similarly to Coin Case ACE or Wrong Pocket TM ACE, you need a Quagsire. To execute box codes, get the Quagsire to know SAFEGUARD as first move (this can only be done through breeding), and give it Miracle Seed (to execute from character 1) or Thick Club (character 2) to hold. To execute item codes, get the Quagsire to know RETURN as first move (using TM27), and give it TM50 to hold. Finally, to execute mail buffer codes, get the Quagsire to know RAIN DANCE as first move (by leveling up to lvl 47 or using TM18), and make sure it doesn&#039;t hold any item. The Quagsire must be in SECOND position of the party.<br />NOTE: I suggest you actually prepare all the Quagsire, and store the ones you don&#039;t use when you don&#039;t.<br /><br />Now, similarly to G/S methods, you need a &#039;Slide PokÃ©mon&#039; which will be put at FIRST position of the party (fully healed, without status). Catch either a Bellsprout in Violet City that you raise at lvl5 then trade for Rocky the Onix with the NPC in Violet City, or an Abra that you raise at lvl13 then trade for Muscle the Machop with the NPC in Goldenrod Departement Store. This PokÃ©mon must then never win any battle, or you won&#039;t be able to use it anymore.<br />NOTE: Instead, you can catch a lvl2 Sentret in Route 29, and make sure it doesn&#039;t have a 6 in its SP. DEF. stat (if so, catch another - this stat value appears in 31.25% of lvl2 Sentret). This PokÃ©mon must then never win any battle, or you won&#039;t be able to use it anymore.<br /><br />Finally, open the Balls Pocket and slide down, you will see the PC Items after the CANCEL that follows the last ball (although only the description might show up). Using SELECT, place the x9 item at position 65, the TM19 at position 165, and the TM29 at position 166.<br /><br />With this done, everytime you use the PokÃ©dex, code gets executed!<br /><br />[u][b]VI. WRITE AND EXECUTE A CODE, REGARDLESS OF THE METHOD[/b][/u]<br /><br />At this point, you know how to have your setup ready to execute code and you just need to write it. We will review here some codes, either Item Codes, Box Codes, and possibily Mail Buffer Codes, for use with either Coin Case, Wrong Pocket TM, Bad Clone ACE or Glitch PokÃ©dex, as well as explain how to make some of your own! <br /><br />[u]Once you have finished this section and arrived to the point where you understand how to ACE and what are the registers, please keep in mind that some of the codes you may create, or created by others, modify the de register. This may be an issue if you execute it using the Bad Clone ACE. To avoid this, before ending your code, please set de to 0134.[/u]<br /><br />NOTE: Unfortunately, there is no way to use most, if not all, box codes in German G/S/C as well as in French Crystal.<br /><br />	[u]VI.1: GET TM17 IN THE WRONG POCKET (Box, G/S)[/u]<br />	[i]This code is exclusively for Coin Case ACE.[/i]<br />	<br />NOTE: Of course, this code is destined to Coin Case users willing to have TM17 on the Item Pocket to shift on Wrong Pocket TM ACE (the code is from Crystal_&#039;s video linked in chapter II). It would, of course, be useless to do that with TM ACE, and since it contains a way to fix the Stack, doing it will not work.<br /><br />Make that the first item in your Item Pocket is disposable, as it will be replaced by TM17.<br /><br />Go to Bill&#039;s PC and use the CHANGE BOX option to rename Box 1 to 5 into as follows:<br />Ap0&#039;dÃ©yâ™€Pk (Pk is an available symbol, not &quot;P followed by k&quot;)<br />&#039;v&#039;t&#039;vÃ©Ã©&#039;l2h<br />&#039;d&#039;d2&#039;v9.9&#039;t<br />Ã©?2hhhhh<br />h&#039;mâ™€â™€<br /><br />Follow step 4 to 8 in chapter II while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM02 are placed in the right spots (3 and 4). TM17 will then appear in your Item Pocket.<br /><br />	[u]VI.2: GET ANY TM/HM x255 CODE (Box, G/S)[/u]<br /><br />Go to Bill&#039;s PC and use the CHANGE BOX option to rename Box 1 into Ap09Ã©_â™€&#039;d (english game), Ap09Ã©_â™€Ã¬ (italian and spanish game) or Ap09Ã©_â™€n&#039; (french game) while replacing _ by the character corresponding to the TM in the following table:<br />(space) = TM02<br />A = TM03<br />B = TM04<br />C = TM05<br />D = TM06<br />E = TM07<br />F = TM08<br />G = TM09<br />H = TM10<br />I = TM11<br />J = TM12<br />K = TM13<br />L = TM14<br />M = TM15<br />N = TM16<br />O = TM17<br />P = TM18<br />Q = TM19<br />R = TM20<br />S = TM21<br />T = TM22<br />U = TM23<br />V = TM24<br />W = TM25<br />X = TM26<br />Y = TM27<br />Z = TM28<br />( = TM29<br />) = TM30<br />: = TM31<br />; = TM32<br />[ = TM33<br />] = TM34<br />a = TM35<br />b = TM36<br />c = TM37<br />d = TM38<br />e = TM39<br />f = TM40<br />g = TM41<br />h = TM42<br />i = TM43<br />j = TM44<br />k = TM45<br />l = TM46<br />m = TM47<br />n = TM48<br />o = TM49<br />p = TM50<br />q = HM01<br />r = HM02<br />s = HM03<br />t = HM04<br />u = HM05<br />v = HM06<br />w = HM07<br />NOTE: As of now, to my knowledge there is no equivalent to this for german games.<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM02 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case). The TM/HM x255 will appear in the TM/HM Pocket.<br /><br />	[u]VI.3: INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE (Items, G/S/C)[/u]<br /><br />Use &#039;VI.2: GET ANY TM/HM x255 CODE&#039; to get TM10 and TM23 (TM26 in Cristal), unless you already have them in the necessary quantities below.<br />NOTE: TM10 can be bought.<br /><br />Get (unless you already have), then store the following items in the PC, in that order:<br />Any Item x(any quantity) (nothing in Crystal)<br />Any item x(any quantity) (nothing in Crystal)<br />Fresh Water x44 (x3 in Crystal)<br />PokÃ© Ball x38<br />TM23 (TM26 in Cristal) x52 (to increase) or x53 (to decrease)<br />[ONLY FOR COIN CASE: X Defense x1] (otherwise replace with TM10 x(any quantity))<br />[ONLY FOR COIN CASE: X Speed + x1] (otherwise replace with Any item x(any quantity))<br />[ONLY FOR COIN CASE: TM06 x195 (use VI.2 and VI.3 to get them)] (otherwise replace with Any item x(any quantity))<br />[ONLY FOR COIN CASE: HM03 x18 (use VI.2 and VI.3 to get them)] (otherwise replace with Any item x(any quantity))<br />[ONLY FOR COIN CASE: TM10 x(any quantity)] (otherwise replace with Any item x(any quantity))<br />The item that must change x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />According to the selected method,<br />- Use TM17/TM15 from the Wrong Pocket (Wrong Pocket TM)<br />- Follow step 4 to 8 in chapter II (Coin Case)<br />- Follow the process in chapter IV.2 (Bad Clone ACE)<br />- Open the PokÃ©dex (Glitch PokÃ©dex ACE) <br />While making sure the &#039;Slide PokÃ©mon&#039;/Spearow/the appropriate Quagsire are placed in the right spots (if needed in your method) and the 11th item will get or lose one unit.<br />NOTE: Decreasing the quantity is very useful if the item is x1; this way, using the code twice will set the quantity to x255, and then you can toss as many units as you want to reach the quantity you actually need.<br /><br />	[u]VI.4: GET ANY ITEM CODE (Items, G/S/C)[/u]<br /><br />Use &#039;VI.2: GET ANY TM/HM x255 CODE&#039; to get TM10 and TM23 (TM26 in Cristal), unless you already have them in the necessary quantities below.<br />NOTE: TM10 can be bought.<br /><br />Use this list: https://glitchcity.info/wiki/The_Big_HEX_List to find an item that you have or can easily buy/get and is the closest possible (above or below) of the wanted item in the Item column. Get this selected item.<br /><br />Get (unless you already have), then store the following items in the PC, in that order:<br />Any Item x(any quantity) (nothing in Crystal)<br />Any item x(any quantity) (nothing in Crystal)<br />Fresh Water x43 (x2 in Crystal)<br />PokÃ© Ball x38<br />TM23 (TM26 in Cristal) x52 (if the wanted item is below the selected one) or x53 (if the wanted item is above the selected one)<br />[ONLY FOR COIN CASE: X Defense x1] (otherwise replace with TM10 x(any quantity))<br />[ONLY FOR COIN CASE: X Speed + x1] (otherwise replace with Any item x(any quantity))<br />[ONLY FOR COIN CASE: TM06 x195 (use VI.2 and VI.3 to get them)] (otherwise replace with Any item x(any quantity))<br />[ONLY FOR COIN CASE: HM03 x18 (use VI.2 and VI.3 to get them)] (otherwise replace with Any item x(any quantity))<br />[ONLY FOR COIN CASE: TM10 x(any quantity)] (otherwise replace with Any item x(any quantity))<br />The selected item x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />According to the selected method,<br />- Use TM17/TM15 from the Wrong Pocket (Wrong Pocket TM)<br />- Follow step 4 to 8 in chapter II (Coin Case)<br />- Follow the process in chapter IV.2 (Bad Clone ACE)<br />- Open the PokÃ©dex (Glitch PokÃ©dex ACE) <br />While making sure the &#039;Slide PokÃ©mon&#039;/Spearow/the appropriate Quagsire are placed in the right spots (if needed in your method) and the 11th item will change.<br /><br />	[u]VI.5: MEMORY EDITOR CODE, A.K.A. GAMESHARK SIMULATOR (Items or Box, G/S/C)[/u]<br />	<br />The box version of this code (G/S only) is tricky and described in Crystal_&#039;s videos. First use &#039;VI.2: GET ANY TM/HM x255 CODE&#039; to get TM09 (unless you already have it) and make Quagsire hold it instead of TM02, then [url=https://www.youtube.com/watch?v=PsIb3OZaYAs&amp;t=10m29s]click here[/url] for english games (from 10:29) and [url=https://www.youtube.com/watch?v=b2tVVeZ7Th4&amp;t=9m41s]click here[/url] for non-english games (from 9:41). For the items version of the code, do as follows.<br /><br />If you want to simulate a G/S Gameshark code (which always is 01[color=red]XX[/color][color=green]YY[/color][color=blue]ZZ[/color]):<br />- Use the Windows Calculator to convert XX into Decimal and note the value.<br />- Do the same with YY.<br />- Check in this table http://pastebin.com/raw/arPmsvYu the item that matches ZZ.<br />If you want to edit a WRAM address value instead:<br />- Use one of the two following sources to find the $[color=blue]ZZ[/color][color=green]YY[/color] memory address that contains the data you want to edit. The first one is more convenient and easier to use, but less exhaustive than the second one.<br />* Datacrystal&#039;s G/S RAM MAP: https://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold_and_Silver:RAM_map<br />* PokÃ©mon Gold(/Silver) disassembly project: https://github.com/PikalaxALT/pokegold/blob/master/wram.asm<br />- Determine the [color=red]XX[/color] value you want to put in the address. For example, if the address is the one that controls the quantity of the first item in the Balls Pocket and you want it to be 5, then XX is 5. If the address controls what the first item is and you want it to be a Master Ball, use this table http://pastebin.com/raw/arPmsvYu to see that Master Ball&#039;s hex ID is 01. Therefore XX would be 01.<br />- Use the Windows Calculator to convert XX into Decimal and note the value.<br />- Do the same with YY.<br />- Check in the aforementioned table the item that matches ZZ.<br /><br />Use &#039;VI.2: GET ANY TM/HM x255 CODE&#039; to get TM10 and TM42, unless you already have them in the necessary quantities below. If ZZ matches a TM and you need it, use it also for this TM.<br />NOTE: TM10 can be bought.<br /><br />Use &#039;VI.4: GET ANY ITEM CODE (Items)&#039; to get PP Up, unless you already have one (or more). If ZZ doesn&#039;t match a TM and you need it, use it also for this item.<br /><br />Get (unless you already have), then store the following items in the PC, in that order:<br />Any Item x(any quantity) (nothing in Crystal)<br />Any item x(any quantity) (nothing in Crystal)<br />PP Up x(decimal conversion of [color=red]XX[/color])<br />TM42 x(decimal conversion of [color=green]YY[/color])<br />Item that matches [color=blue]ZZ[/color] x3<br />[ONLY FOR COIN CASE: X Defense x1] (otherwise nothing)<br />[ONLY FOR COIN CASE: X Speed + x1] (otherwise nothing)<br />[ONLY FOR COIN CASE: TM06 x195 (use VI.2 and VI.3 to get them)] (otherwise nothing)<br />[ONLY FOR COIN CASE: HM03 x18 (use VI.2 and VI.3 to get them)] (otherwise nothing)<br />TM10 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />According to the selected method,<br />- Use TM17/TM15 from the Wrong Pocket (Wrong Pocket TM)<br />- Follow step 4 to 8 in chapter II (Coin Case)<br />- Follow the process in chapter IV.2 (Bad Clone ACE)<br />- Open the PokÃ©dex (Glitch PokÃ©dex ACE) <br />While making sure the &#039;Slide PokÃ©mon&#039;/Spearow/the appropriate Quagsire are placed in the right spots (if needed in your method) and the code will get executed.<br /><br />	[u]VI.6: CHANGING ID CODE (Items, G/S/C)[/u]<br />	[i]Particular usage of &#039;VI.5: MEMORY EDITOR CODE, A.K.A. GAMESHARK SIMULATOR (Items or Box)&#039;[/i]<br /><br />Use &#039;VI.2: GET ANY TM/HM x255 CODE&#039; to get TM10, TM42 and TM18 (TM21 in Crystal), unless you already have them in the necessary quantities below.<br />NOTE: TM10 and TM18 can be bought.<br /><br />Use &#039;VI.4: GET ANY ITEM CODE (Items)&#039; to get PP Up, unless you already have one (or more).<br /><br />Using the Windows Calculator, convert the ID you want into hexadecimal (example: 13579 translates into 350B). Then, split this hexadecimal ID number in two parts (example: in this case, you get &#039;35&#039; and &#039;0B&#039;).<br /><br />Use this list: http://pastebin.com/raw/arPmsvYu to find the number from the Decimal column corresponding to the SECOND part of the hexadecimal ID number (read in the Hexadecimal column) (example: in this case, 0B corresponds to 11).<br /><br />Use &#039;VI.3: INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE (Items)&#039; on PP Up to give them the quantity corresponding to this previously obtained number.<br /><br />Get (unless you already have), then store the following items in the PC, in that order:<br />Any Item x(any quantity) (nothing in Cristal)<br />Any item x(any quantity) (nothing in Cristal)<br />PP Up x(the obtained number)<br />TM42 x162 (x124 in Crystal)<br />TM18 (TM21 in Crystal) x3<br />[ONLY FOR COIN CASE: X Defense x1] (otherwise nothing)<br />[ONLY FOR COIN CASE: X Speed + x1] (otherwise nothing)<br />[ONLY FOR COIN CASE: TM06 x195 (use VI.2 and VI.3 to get them)] (otherwise nothing)<br />[ONLY FOR COIN CASE: HM03 x18 (use VI.2 and VI.3 to get them)] (otherwise nothing)<br />TM10 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />According to the selected method,<br />- Use TM17/TM15 from the Wrong Pocket (Wrong Pocket TM)<br />- Follow step 4 to 8 in chapter II (Coin Case)<br />- Follow the process in chapter IV.2 (Bad Clone ACE)<br />- Open the PokÃ©dex (Glitch PokÃ©dex ACE) <br />While making sure the &#039;Slide PokÃ©mon&#039;/Spearow/the appropriate Quagsire are placed in the right spots (if needed in your method).<br /><br />Use this list: http://pastebin.com/raw/arPmsvYu to find the number from the Decimal column corresponding to the FIRST part of the hexadecimal ID number (read in the Hexadecimal column) (example: in this case, 35 corresponds to 53).<br /><br />Use &#039;VI.3: INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE (Items)&#039; on PP Up to give them the quantity corresponding to this previously obtained number.<br /><br />Toss or withdraw 1 TM42, so you now have TM42 x161 (x123 in Crystal) in the PC.<br /><br />According to the selected method,<br />- Use TM17/TM15 from the Wrong Pocket (Wrong Pocket TM)<br />- Follow step 4 to 8 in chapter II (Coin Case)<br />- Follow the process in chapter IV.2 (Bad Clone ACE)<br />- Open the PokÃ©dex (Glitch PokÃ©dex ACE) <br />While making sure the &#039;Slide PokÃ©mon&#039;/Spearow/the appropriate Quagsire are placed in the right spots (if needed in your method).<br /><br />	[u]VI.7: MAKE THE SIXTH POKEMON IN PARTY SHINY CODE (Items, G/S/C)[/u]<br /><br />Use &#039;VI.2: GET ANY TM/HM x255 CODE (Box)&#039; to get TM10 and TM28, unless you already have them in the necessary quantities below.<br /><br />Use &#039;VI.4: GET ANY ITEM CODE (Items)&#039; to get Polkadot Bow and Metal Powder.<br />NOTE: You can also trade respectively Jigglypuff and Ditto from R/B/Y, they will hold these items.<br /><br />Use &#039;VI.3: INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE (Items)&#039; on Polkadot Bow and Metal Powder to give them the quantity of x119 (in Crystal, use it also on X Accuracy to give it a quantity of x228).<br /><br />Get (unless you already have), then store the following items in the PC, in that order:<br />Any Item x(any quantity) (nothing in Crystal)<br />Any item x(any quantity) (nothing in Crystal)<br />X Accuracy x47 (x228 in Crystal)<br />TM28 x62 (TM29 x62 in Crystal)<br />Polkadot Bow x119<br />Metal Powder x119<br />[ONLY FOR COIN CASE: X Defense x1] (otherwise nothing)<br />[ONLY FOR COIN CASE: X Speed + x1] (otherwise nothing)<br />[ONLY FOR COIN CASE: TM06 x195 (use VI.2 and VI.3 to get them)] (otherwise nothing)<br />[ONLY FOR COIN CASE: HM03 x18 (use VI.2 and VI.3 to get them)] (otherwise nothing)<br />TM10 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />According to the selected method,<br />- Use TM17/TM15 from the Wrong Pocket (Wrong Pocket TM)<br />- Follow step 4 to 8 in chapter II (Coin Case)<br />- Follow the process in chapter IV.2 (Bad Clone ACE)<br />- Open the PokÃ©dex (Glitch PokÃ©dex ACE) <br />While making sure the &#039;Slide PokÃ©mon&#039;/Spearow/the appropriate Quagsire are placed in the right spots (if needed in your method) and the sixth PokÃ©mon will be Shiny.<br />	<br />	[u]VI.8: GOTTA CATCH &#039;EM ALL CODE (Box, G/S)[/u]<br />	<br />The standard version of this code is easy and quick to perform:<br />- For English games, [url=http://forums.glitchcity.info/index.php?topic=6716.msg207466#msg207466]see this post[/url] for that gives it for Wrong Pocket TM ACE and Coin Case ACE (a video is also available [url=https://www.youtube.com/watch?v=UNWtJBOzR6M]here[/url]). This code also gives shiny PokÃ©mon.<br />- For italian and spanish games, do the same as English Wrong Pocket TM but replace &#039;v with Â° and &#039;d with Ã¬ in italian and spanish games. This code also gives shiny PokÃ©mon.<br />- For french games, [url=http://forums.glitchcity.info/index.php?topic=6716.msg207649#msg207649]see this post[/url].<br />- There doesn&#039;t seem to be a German adaptation to this so far.<br /><br />NOTE: If you don&#039;t like this code, you can also apply [url=http://forums.glitchcity.info/index.php?topic=6716.msg207651#msg207651]another method[/url] that is significantly longer but uses one code for all PokÃ©mon. This method is explained in Crystal_&#039;s video [url=https://www.youtube.com/watch?v=1w2iQdAHPh4]here[/url].<br /><br />	[u]VI.9: MORE AND COMPETITIVE CODES (Box)[/u]<br /><br />More G/S codes made by the members of GCLF can be found in [url=http://forums.glitchcity.info/index.php?topic=6716.0]this thread[/url]. Don&#039;t hesitate to read it, but pay attention to what they have been designed for (Coin Case, Wrong Pocket TM, or both).<br /><br />[url=http://forums.glitchcity.info/index.php?topic=8100.0]This thread here by FMK[/url] gives more G/S box codes and explain how to convert Coin Case box codes into Wrong Pocket TM box codes. It also gives a slightly different process with TM25 instead.<br /><br />For some G/S competitive battling codes, check [url=http://forums.glitchcity.info/index.php?topic=8111.0]this thread[/url] by Torchickens.<br /><br />	[u]VI.10: A WORD ON HOW TO WRITE COMPLEX CODES[/u]<br /><br />As of now, you know how to create your own code to change a single value in the game&#039;s RAM. That&#039;s very cool, but you might want to do more complex codes that will affect several values at once or create your own scripts. [b]To do that, you&#039;ll need to understand how ACE works.[/b]<br /><br />In G/S, using TM17 in the wrong pocket makes the game read code from address $FA47, which is located in what we call Echo RAM. Starting at $E000, this Echo RAM is a duplicate of WRAM, the memory section going from $C000 to $DFFF which stores the game&#039;s data. $FA47 thus contains exactly the same value than $DA47, the caught data of your current first PokÃ©mon. Registered inside two consecutive addresses ($DA47 and $DA48 in the case of PokÃ©mon 1), caught data is an unused section of the PokÃ©mon&#039;s data, so its value is always 00. If you ever heard about people using TM25 instead, well the concept is the same, but it reads from the Defense EV of the second PokÃ©mon. Finally, using Coin Case is no different, but this time we read data from the third PokÃ©mon!<br /><br />In all these cases, writing useful code from PokÃ©mon data is almost impossible because it would require specific stats, EV, sometimes even IV... so we need to get the hell out of this place to reach another section of WRAM in which we have more control (either items or box names). Now let&#039;s explain the theory with the case of TM17 and let&#039;s take a look at the RAM&#039;s data for party PokÃ©mon 1 and 2 (you can see all of this using [url=https://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Gold_and_Silver:RAM_map]the RAM Map[/url])<br /><br />PokÃ©mon 1<br />($DA2A to $DA46 are all the other datas that are not useful here)<br />$DA47 to $DA48 = Caught Data<br />$DA49 = Level<br />$DA4A to $DA4B = Status<br />$DA4C to $DA4D = HP<br />$DA4E to $DA4F = Max HP<br />$DA50 to $DA51 = Attack<br />$DA52 to $DA53 = Defense<br />$DA54 to $DA55 = Speed<br />$DA56 to $DA57 = Special Defense<br />$DA58 to $DA59 = Special Attack<br />PokÃ©mon 2<br />$DA5A = Species<br />$DA5B = Item Held<br />$DA5C to $DA5F = Moves<br /><br />Every address mentioned here has an hexadecimal value corresponding to the data of your PokÃ©mon (for example, if the attack stat of PokÃ©mon 1 is 21, the value of $DA51 is 15). [b]You must now understand that when the game reads code from a point, it interprets the hexadecimal values into instructions called opcodes[/b]. In the corresponding list we&#039;ve provided before for Hex/Dec/Items correspondance, you also have the opcode for each hex, and you can also find here on [url=http://pastraiser.com/cpu/gameboy/gameboy_opcodes.html]this more complete table[/url]. To take an example, 41 matches the instruction &#039;ld B,C&#039;.<br /><br />I don&#039;t want (and it&#039;s above my knowledge) to explain all opcodes here, but you can actually find a lot of useful ressources on the Internet (I&#039;ll link some later in this guide) but we&#039;re going to review some basics:<br />- [b]nop[/b] (matching hexadecimal 00) means no operation. The game just continues reading. <br />- [b]ld[/b] means load, in the way that a variable is loaded with (&#039;becomes&#039;) a value.<br />- [b]inc[/b] and [b]dec[/b] command to increase or decrease the value of a given variable.<br />- [b]add[/b] and [b]sub[/b] means that a given value is added or substracted to the variable A (always).<br />- [b]jp[/b] is a jump. It allows you to move to a given part of the WRAM, that can be either directly set by the user or contained in a duo of variable, HL.<br />- [b]jr[/b] is also a jump, but a relative one. It jumps at a given distance of the current reading position.<br />- [b]ret[/b] is mainly used, here, to end your code (in fact, it pops the top of the stack to the program counter).<br /><br />At first, we want to jump at $D61B (third stored item) or $D8C0 (box 1 name, character two). In the latter case, that translates to &quot;jp D8C0&quot;. We will then use the instruction coded by hexadecimal C3, which is a jump at the position given by the two following hexadecimals (reversed - to understand why, read Wikipedia&#039;s page about [url=https://en.wikipedia.org/wiki/Endianness]endianness[/url]). That means if the game reads C3 C0 D8, then it will jump at box name 1.<br /><br />We can&#039;t easily control the data we have access to in PokÃ©mon 1 when using TM17, but we could use the species (hex:C3 is Quagsire in the list), held item (hex:C0 is TM02) and first move of PokÃ©mon 2 (hex:D8 is RETURN) because that is not a big requirement. Our best shot is then to make sure PokÃ©mon 1&#039;s data matches &#039;unharmful opcodes&#039; that won&#039;t jump or will only affect variables we don&#039;t care about to so it can &#039;slide&#039; until Quagsire: [b]this is why the first PokÃ©mon is called &#039;Slide PokÃ©mon&#039;.[/b] The same goes for PokÃ©mon 3 with Coin Case, although it reads more ot its data, so the &#039;Slide PokÃ©mon&#039; is less permissive. However, in the case of TM25, we can actually affect the EV of the PokÃ©mon by training it until it reaches these values, so it&#039;s not mandatory to use a &#039;Slide PokÃ©mon&#039; (but then, it&#039;s longer to setup).<br /><br />In Crystal, the process for Wrong Pocket TM is quite the same, but TM15 reads from $DA10, an unused part of the RAM. Using another ACE method, we edit this section to introduce C3 DF FC, which commands a jump to party PokÃ©mon 1 species. With Quagsire, we then write C3 F2 (TM50) D8 (RETURN), C3 75 (Miracle Seed) DB (SAFEGUARD) or C3 00 (no item) F0 (RAIN DANCE) and therefore jump in the appropriate place.<br /><br />Glitch PokÃ©dex ACE method is about changing the PokÃ©dex mode (usually New, Old, A to Z or Zarbi Mode) to glitched mode 09. PokÃ©dex mode is controlled by address $D959 in Crystal, and can be modified to an invalid value (such as 09) using the expanded Balls Pocket obtained through the Double Item Shifting Glitch, because it matches the quantity of item 65. Placing any x9 item at this position will then affect the PokÃ©dex mode. Then, any opening of the PokÃ©dex executes code from $FA20 (a copy of $DA20). This address is linked to game flags, and you can modify it once again by manipulating items 165 and 166. With CT19 x1 and CT29 x1, we write the code D2 01 DD, which translates into &#039;jp NC,$DD01&#039;. This is a conditionnal jump to the first PokÃ©mon of the party, and in this case, the jump will always occur. There goes the &#039;Slide PokÃ©mon&#039; and Quagsire as usual.<br /><br />Let&#039;s finish the Crystal digression with Bad Clone ACE. Bad Clones have no terminated name and once you view them in the PC in Crystal, the reading of their name continues on following memory data. That being said, some characters, named control characters, are used by the game not to write things, but sometimes to execute functions. Character with hex ID 15 is one of them and is used for Mobile Adapter GB. But, because of a programmer mistake, if character 15 is followed by any address containing 00, game executes code from $CD52, the buffer for map data. By following the steps indicated in the guide, you modify this buffer and &#039;write&#039; a ret instruction at $CD74. This ret is not going to stop the code execution, but deviates it (for technical reasons) to whatever address is located right after the 15 00.<br /><br />Now, $D106 controls the current position of the item pointer. Thus, it always contains the hex ID of the item on which the pointer currently is. $D107 contains the bag position of the item that you currently have selected; which means that by viewing Max Elixer (hex ID 15) but not selecting it, you write 15 00, which is then read as part of the Bad Clone&#039;s name, and therefore executes code at $CD52... which jumps back to $D108! This area is yet another buffer, this time containing visualized PokÃ©mon: $D108 is the hex ID of the last viewed PokÃ©mon in the PC, $D10E is the hex ID of the last PokÃ©mon&#039;s displayed profile, $D110 its first move, and $D10F the hex ID of the held item of the last PokÃ©mon viewed by either method. Assuming Quagsire has RETURN and TM50, we order C3 XX XX XX XX XX C3 F2 D8. The three last addresses indeed matches &#039;jp $D8F2&#039; but the first C3 would jump us somewhere else. By viewing Spearow, without opening its profile, we overwrite the first C3 without touching the one at $D10E - and Quagsire&#039;s item doesn&#039;t matter since it is overwritten by Spearow&#039;s TM50.<br /><br />Let&#039;s now focus on G/S and review the gameshark simulation/single-address value changing code (VI.5). Keep in mind what we want to do here is to put BB as the value of address $DDCC. PP Up&#039;s hex ID is 3E, TM42 is EA, and TM10 is C9. Remember that after the address of an item comes the address of its quantity, and only then we can proceed with item 2.<br />[code]$D61B	3E	ld A,XX[/code]<br />As mentioned in the table by the small &#039;2&#039; under this opcode, it takes two bytes: XX will be the value of the following address ($D61C, the quantity of item 3 - in our case, &quot;BB&quot;). This instruction thus says &#039;ld A,BB&#039; and the variable A becomes BB. Therefore, $D61C is not read as an opcode, and we proceed.<br />[code]$D61D	EA	ld XXXX,A (3 octets)	This instruction takes 3 bytes so we need to consider the two following ones.<br />$D61E	&quot;CC&quot;	â†’<br />$D61F	&quot;DD&quot;	â†’ ld (DDCC),A		The parenthesis indicates it&#039;s the value of XXXX that changes. Then, the value of $DDCC becomes A which is now BB!<br />$D620	03	inc BC			Increase the duo of variable b and c. It&#039;s just a placeholder here, we don&#039;t use these variables.[/code]<br />The 4 following items in the code (instructions read from $D621 to $D628) are exclusive to Coin Case. This is because Coin Case has a major drawback compared to Wrong Pocket TM ACE which we mentioned before: it destroys the stack. This set of instructions is meant to fix it, and thus are not used with Wrong Pocket TM ACE. Let&#039;s finish this code:<br />[code]$D629	C9	ret			Code reading ends.[/code]<br /><br />Isn&#039;t that easy? See this other example with the code that changes Stored Item 11 (VI.4). This item&#039;s address is $D62B. You should be able to understand that the code read by the game in this case is 2E 2B 05 26 D6 34 [Coin Case Set] C9.<br />[code]$D61B	2E 		ld l,XX (2 bytes)	<br />$D61C	2B		â†’ ld l,2B		Variable l becomes 2B.<br />$D61D	05		dec b			Variable b is decreased. This is still a placeholder.<br />$D61E	26		ld h,XX (2 bytes)<br />$D61F	D6		â†’ ld h,D6		Variable l becomes D6.<br />$D620	34		inc (hl)		Value of address hl ($D62B) is increased. We&#039;re done!<br />$D621 to $D628					Coin Case set.<br />$D629	C9		ret			Code reading ends.[/code]<br /><br />Writing codes with items is easy in theory because you have access to almost all opcodes. However, it can be a bit unpractical when it comes to gathering items. [b]Writing box codes is of course quicker and easier, but you won&#039;t have access to all opcodes because the first character, the space, has an hex ID of 7F (followed by A, which has an hex ID of 80)[/b]. This is why box codes are longer than item codes, since it requires to spam add and sub to workaround the impossibility to use 2-bytes ld. Also, some characters are exclusive to languages, which means codes have to be translated for each language! It is rather easy in italian and spanish, very difficult in french (because of the lack of sub) and almost impossible in german because it doesn&#039;t even have 3-bytes ld.<br /><br />This guide won&#039;t get into details for box codes, because it would require more lessons on opcodes and how to use flags. If you&#039;re new to this, you can stick to item codes, or ask here for specific help with your codes! We can always go further and ACE can be also used to program something, in the way TheZZAZZGlitch did a Pong game in R/B/Y! Everything cannot be included in this guide, but there is a lot for you to discover. Your very own ACE legend is about to unfold! A world of dreams and adventures with ACE awaits! Let&#039;s go!<br /><br />Useful ressources:<br />* This website&#039;s [url=http://glitchcity.info/wiki/GB_Programming]guide to GB Programming[/url]<br />* A GameBoy opcode summary can be found [url=http://www.devrs.com/gb/files/opcodes.html]here[/url] for basic understanding of what opcodes do.<br />* A more detailed guide with syntax is [url=http://www.z80.info/z80syntx.htm]available on this website[/url].<br /><br />[u][b]ANNEX 1: GET TM ACE SETUP THROUGH A FIRST-GENERATION GAME (G/S only)[/b][/u]<br />	<br />You will need:<br />- A R/B/Y game in which you can perform code execution using either the 8F item, the wsl&#039;m item, or the 4F item (this is NOT a guide to code execution in first generation games, it assumes you already have one of these items and a proper setup to use it. If you don&#039;t know what we&#039;re talking about here, please go back to the normal process).<br />- The following TMs (at least 1 of each): TM01, TM14, TM18, HM03.<br />- At least 1 of each of the following : Thunderstone, Max Revive, X Accuracy, Lemonade, Water Stone, Soda Pop.<br />- 34 Ice Heal stored in the PC.<br />- Some other things that can easily be bought in-game.<br /><br />	[u]ANNEX 1.1: Gather the needed items[/u]<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />Thunderstone x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have Thunderstone x0 instead of x1. Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />Max Revive x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have Max Revive x0 instead of x1. Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />X Accuracy x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have X Accuracy x0 instead of x1. Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />Lemonade x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have Lemonade x0 instead of x1. Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />Water Stone x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have Water Stone x0 instead of x1. Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />Soda Pop x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have Soda Pop x0 instead of x1. Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />HM03 x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have HM03 x0 instead of x1 (but you won&#039;t seen its number). Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />TM18 (TM17 in Yellow) x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have the TM x0 instead of x1. Store them in the PC.<br /><br />Place the following items, in that order, in your pack:<br />8F (4F or wsl&#039;m in Yellow)<br />TM14 x1<br />PokÃ© Ball x45<br />Revive x3<br />TM01 x(any quantity)<br />Any other items in any quantities can go from here on<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item. You should now have TM14 x0 instead of x1. Store them in the PC.<br /><br />	[u]ANNEX 1.2: Create custom jump PokÃ©mon[/u]<br />	<br />Make sure you have at least 2 PokÃ©mon in the active box.<br />NOTE: If you&#039;re playing Yellow, these 2 PokÃ©mon are part of your setup.<br /><br />Withdrawing items from the x0 stacks in your PC, place the following items, in that order, in your pack:<br />Any item x(any quantity)<br />8F (4F or wsl&#039;m in Yellow)<br />Thunderstone x190 in english R/B (x189 in english Yellow, x195 in non-english R/B, x194 in non-english Yellow)<br />TM18 x4<br />Max Revive x69<br />X Accuracy x205 in english R/B (x204 in english Yellow, x210 in non-english R/B, x209 in non-english Yellow)<br />Lemonade x195<br />Water Stone x12<br />TM14 x3<br />Ice Heal x34<br />HM03 x25<br />Soda Pop x119<br />TM01 x(any quantity)<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item.<br /><br />Toss 33 Thunderstone.<br /><br />Toss 33 X Accuracy.<br /><br />Withdraw 165 TM14 from the PC.<br /><br />Toss all HM03 and withdraw 188 HM03 from the PC (it takes time!).<br /><br />Place the following items, in that order, in your pack:<br />Any item x(any quantity)<br />8F (4F or wsl&#039;m in Yellow)<br />Thunderstone x157 in english R/B (x156 in english Yellow, x162 in non-english R/B, x161 in non-english Yellow)<br />TM18 x4<br />Max Revive x69<br />X Accuracy x172 in english R/B (x171 in english Yellow, x177 in non-english R/B, x176 in non-english Yellow)<br />Lemonade x195<br />Water Stone x12<br />TM14 x168<br />Ice Heal x34<br />HM03 x188<br />Soda Pop x119<br />TM01 x(any quantity)<br /><br />Use the 8F (4F or wsl&#039;m in Yellow) item.<br /><br />Withdraw and trade the first two PokÃ©mon in your active box to your G/S game: both will hold a Mystery Egg. They must NEVER win any battle, or you won&#039;t be able to use them anymore.<br /><br />	[u]ANNEX 1.3: Use Mystery Eggs to get TM25[/u]<br /><br />Take both Mystery Eggs and place them in the Key Items Pocket so that they are the last items in the Pocket (do not swap them together).<br />NOTE: For this trick to work, the Key Items Pocket must be full. If you don&#039;t have enough Key Items, you can clone one or both PokÃ©mon before taking the Egg, to get more Eggs in order to fill the Pocket.<br /><br />Now, swap the first Mystery Egg with the second Mystery Egg (order is important). A S.S. Ticket will appear.<br /><br />Move to the Balls Pocket. The Great Ball x1 and PokÃ© Ball x2 should have turned into a Master Ball x5 and Ultra Ball x255 respectively (255 is indicated by a [tile]5).<br /><br />Toss 39 Ultra Balls from the Ultra Ball x255 stack.<br /><br />Swap the Master Ball x5 with the Ultra Ball x216.<br /><br />Deposit the Mystery Egg in the Player&#039;s PC.<br /><br />Withdraw the Mystery Egg from the Player&#039;s PC. In the Balls Pocket, the Ultra Ball x216 and Master Ball x5 should now have turned into a TM25 x1 and PokÃ© Ball x255.<br /><br />Store 255 (all) from the PokÃ© Ball x255 stack in the Player&#039;s PC.<br />	<br />	ANNEX 1.4: Prepare the Party setup<br /><br />Place the PokÃ©mon that was FIRST in the R/B/Y&#039;s PC box at slot 2 of your party everytime you need to execute item codes during &#039;VI. WRITE AND EXECUTE A CODE&#039; (instead of the Quagsire with SLEEP TALK and Protein), and place the PokÃ©mon that was SECOND in the R/B/Y&#039;s PC box at slot 2 of your party everytime you need to execute box codes during &#039;VI. WRITE AND EXECUTE A CODE&#039; (instead of the Quagsire with RETURN and TM02). In both cases, you won&#039;t need any &#039;Slide PokÃ©mon&#039; in slot 1.<br /><br />Use TM25 from the Balls Pocket everytime you need to execute codes during &#039;VI. WRITE AND EXECUTE A CODE&#039; (instead of TM17).<br /><br />[u][b]ANNEX 2: GET MYSTERY EGGS USING THE MACHOP TECHNIQUE[/b][/u]<br /><br />This method will NOT work if your Trainer ID is superior to 65280 or is equal to 255 modulo 256[/b] (which means 511, 767, 1023, etc.). It requires:<br />- A Machop with Seismic Toss as first move (stored in the PC).<br />- 5 clones of a PokÃ©mon obtained by trading with an NPC that has never been trained before. If this is impossible to you, use clones of any caught PokÃ©mon that has never been trained before, but note that there is 3% chance it won&#039;t work.<br />- At least $200.<br /><br />Go to the Daycare, south of Goldenrod, and clone Bellsprout once again. However this time, the cloning must be performed in the 15 PokÃ©mon aforementioned box and you must have reset your game right after saying &#039;YES&#039; to the question about save replacement. If it worked, the obtained clone will be level 0, won&#039;t have a name (or many &quot;?&quot; as name in Crystal), and its PokÃ©dex ID (in the profile) also is 000; this is what we call a Bad Clone. If you got a normal clone, release it and try again.<br />NOTE: In G/S, any clone without name/level but also without the PokÃ©dex ID 000 won&#039;t work (treat it as a normal clone). However, if you get such clone in Crystal, it is worth noting that you can convert it into a Bad Clone that can be used for this method. To do this, store the Bad Clone in another PC Box and store 5 other PokÃ©mon in that same box. Then, use the withdraw option to display that box. Leave it and use the withdraw option again. All PokÃ©mon are now Kingdra. Withdraw the Bad Clone and you can now use it (in case of trouble with getting the Kingdra, please read [url=http://forums.glitchcity.info/index.php?topic=7062.0]this[/url]).<br /><br />Make a party of the Bad Clone and the 5 clones.<br /><br />Give the Bad Clone to the Daycare lady and immediately take it back. It will now be a Glitch PokÃ©mon with nÂ°000.<br /><br />Put the glitch PokÃ©mon nÂ°000 in front at the top of your party, and go to Bill&#039;s PC.<br /><br />Choose &#039;MOVE PKMN W/O MAIL&#039; and it will seem like your party is empty. Thanks to this, you can move the Machop at first slot (therefore you now have 7 PokÃ©mon).<br /><br />Exit the PC and give the glitch PokÃ©mon nÂ°000 to the Daycare lady again. Don&#039;t take it back this time.<br />NOTE: It is also possible to move it at slot 7 instead, and give it to the lady only after finishing this step.<br /><br />Go back to Bill&#039;s PC and store Machop. It will now have a Mystery Egg attached.<br /><br />Before taking the Egg from it, clone this PokÃ©mon once (twice if wanting three Eggs), then take the 2 or 3 Mystery Eggs.<br />NOTE: I recommend you do a backup clone also, in case you need other Eggs.<br /><br />[u][b]GENERAL CONCLUSION[/b][/u]<br /><br />Alright, I&#039;mma stop here with this guide for now. If you&#039;re kinda lost, remember this:<br />[list]<br />[li]If playing English G/S, the best you can do is to use Coin Case ONCE, to get the TM17 in the Wrong Pocket. Then, use this as ACE method.[/li]<br />[li]If playing European Non-English G/S, the best you can do is to follow the Wrong Pocket TM ACE process using the Bellsprout method.[/li]<br />[li]If playing Crystal, the best you can do is to use Bad Clone ACE ONCE, to get and setup the TM15 in the Wrong Pocket. Then, use this as ACE method.[/li][/list]<br /><br />I know I have to add some colours and more BBCodes, but please mention me any improvement, any mistake, any thread that gives more interesting codes, and don&#039;t hesitate to ask questions!


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Your encounter code seems a little complex, however. It seems to require multiple uses of TM 25. I wrote a wild encounter box name code that only requires one use of of TM 25, and it&#039;s only 9 boxes long. It can be found [url=https://youtu.be/UNWtJBOzR6M]here[/url].<br /><br />And as a plus, the found Pokemon is shiny.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks! I&#039;ll add this code asap, that&#039;s very cool. I also must add this as a more easy-to-handle list http://pastebin.com/raw/arPmsvYu , a way to make guarantee the expanded balls pocket trick and links to code threads from this board. 


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Krys3000 link=topic=8126.msg207521#msg207521 date=1509391132]<br />	[u]IV.1: GET TM17 IN THE WRONG POCKET (Box)[/u]<br />	<br />NOTE: Of course, this code is destined to Coin Case users willing to have TM17 on the Item Pocket to shift on Wrong Pocket TM ACE (the code is from Crystal_&#039;s video linked in chapter II). But it could also be used with Wrong Pocket TM ACE, just for fun.<br /><br />Make that the first item in your Item Pocket is disposable, as it will be replaced by TM17.<br /><br />Go to Bill&#039;s PC and use the CHANGE BOX option to rename Box 1 to 5 into as follows:<br />Ap0&#039;dÃ©yâ™€Pk (Pk is an available symbol, not &quot;P followed by k&quot;)<br />&#039;v&#039;t&#039;vÃ©Ã©&#039;l2h<br />&#039;d&#039;d2&#039;v9.9&#039;t<br />Ã©?2hhhhh<br />h&#039;mâ™€â™€<br />[/quote]<br /><br />Didn&#039;t really check, but doesn&#039;t this code contain a part for fixing the stack from Coin Case?<br />Therefore it will probably crash the game when executed via wrong pocket TM ACE. The same is true vice versa for wrong pocket codes executed via coin case ACE.<br /><br />Oh and btw. all box name codes probably won&#039;t work for german language games since we don&#039;t have the [b]Ã©[/b] character available as an input character (same for [b]&#039;v[/b], but you can work around that one).<br /><br />Anyway, great work on this compilation.&nbsp;  :)<br /><br />[quote author=Krys3000 link=topic=8126.msg207525#msg207525 date=1509395869]<br />Thanks! I&#039;ll add this code asap, that&#039;s very cool. I also must add this as a more easy-to-handle list http://pastebin.com/raw/arPmsvYu , a way to make guarantee the expanded balls pocket trick and links to code threads from this board.<br />[/quote]<br />You need to add Pk- and Mn-Symbols missing in the list (e1 &amp; e2).


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you could make the game corrupt itself with ace that would be cool but there would be a risk of also corrupting your save file


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=forsyz link=topic=6716.msg207527#msg207527 date=1509444554]<br />If you could make the game corrupt itself with ace that would be cool but there would be a risk of also corrupting your save file<br />[/quote]<br /><br />The risk wouldn&#039;t be that great, the game would have to miraculously unlock SRAM before any save corruption would take place.<br /><br />Nothing too terribly intresting would occur, the game would probably Glitch Dimension before anything noticable happened.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well that&#039;s VC Gold 100% completed. Shoutouts to those who helped me with various Coin Case tricks: Torchickens, Dragon Arbock, ISSOtm, SpunkyBandy, spamviech and Couldntthinkofaname.<br /><br />Red fight was super easy, more easier then usual as my Houndoom hard counters Espeon which is Red&#039;s biggest threat. Even though I&#039;ve had countless gen II files over the years, it was fun to play with Pokemon I have never used in a run before like Houndoom and Scizor. It was also great to use perfect Hidden Powers for the first time ever, helped give my Scizor necessary STAB and helped Jolteon with necessary coverage against Rock/Ground Pokemon with Hidden Power Water. Biggest highlight of the fight was My Level 50, 7HP DV, Jolteon surviving a Rain Dance boosted Surf from Red&#039;s Level 77 Blastoise. :L Also my Scizor OHKO&#039;ed Red&#039;s Snorlax with a +6 Hidden Power Bug, but it did crit though. Something also nice with this run is when I caught a Chansey it was holding a Lucky Egg and I don&#039;t think I&#039;ve got one of those before, 1% for Chansey to appear and 8% chance for it to be holding a Lucky Egg. Lucky Egg certainly helped with training during those last few levels. <br /><br />My team and ending stats:<br />[img]http://i.picresize.com/images/2017/10/31/SyriX.jpg[/img]<br />[img]http://i.picresize.com/images/2017/10/31/ZXOM0.jpg[/img]<br /><br />With Yellow, Crystal, Emerald and now VC Gold that&#039;s 4 Pokemon playthroughs I&#039;ve completed this year. Maybe I should play other games now, but Pokemon is just so damn fun. :&#039;D


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nice work!<br /><br /><br />When I get my cart, i&#039;ll probably release a code that grants you any Pokemon you wish with flawless IVs. I don&#039;t know the full extent of IVs effect on stats, but it might be of some use to those who are stuck on Red (or Whitney&#039;s Miltank lol)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207530#msg207530 date=1509451870]<br />Nice work!<br /><br /><br />When I get my cart, i&#039;ll probably release a code that grants you any Pokemon you wish with flawless IVs. I don&#039;t know the full extent of IVs effect on stats, but it might be of some use to those who are stuck on Red (or Whitney&#039;s Miltank lol)<br />[/quote]<br /><br />Thanks. Flawless DV&#039;s helps, but it still takes awhile to max out the stat experience as well. Though if anyone struggles with Whitney&#039;s Miltank or Red, they really are not good players haha, I did struggle when I was like 12, but when you play the games enough you realise the games are really not challenging and it&#039;s very easy to sweep through the game, the fact you can beat Red&#039;s team of level 70 and 80 Pokemon with a team of level 50&#039;s is proof of that.<br /><br />Even if you had a really awful, low-levelled team going against Whitney, you could still buy X items and set up on the Clefairy and then easily defeat the Miltank, that&#039;s provided the RNG doesn&#039;t screw you over with Clefairy&#039;s Metronome. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Here&#039;s the code:<br /><br />All wild Pokemon have perfect IVs:<br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p0(female)Ã©K955<br />Box 3: p02Ã©L9p&#039;d<br />Box 4-6: (Doesn&#039;t matter)<br />Box 7: 09Ã©(female)&#039;dÃ©0&#039;d<br />Box 8: p&#039;dyyyyyy<br /><br />Effects trainer Pokemon as<br />well, so make sure to SAVE/RESET after catching your Pokemon.<br /><br />In coin case, that&#039;s:<br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p0(female)Ã©K955<br />Box 3: p02Ã©L9p5<br />Box 4: Ã©Z(mult).9&#039;l&#039;l&#039;l<br />Box 5: &#039;lp&#039;d55555<br />Box 6: (Doesn&#039;t matter)<br />Box 7: 09Ã©(female)&#039;dÃ©0&#039;d<br />Box 8: p&#039;dyyyyyy<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Nostalgia link=topic=6716.msg207529#msg207529 date=1509451613]<br />Well that&#039;s VC Gold 100% completed. Shoutouts to those who helped me with various Coin Case tricks: Torchickens, Dragon Arbock, ISSOtm, SpunkyBandy, spamviech and Couldntthinkofaname.<br /><br />Red fight was super easy, more easier then usual as my Houndoom hard counters Espeon which is Red&#039;s biggest threat. Even though I&#039;ve had countless gen II files over the years, it was fun to play with Pokemon I have never used in a run before like Houndoom and Scizor. It was also great to use perfect Hidden Powers for the first time ever, helped give my Scizor necessary STAB and helped Jolteon with necessary coverage against Rock/Ground Pokemon with Hidden Power Water. Biggest highlight of the fight was My Level 50, 7HP DV, Jolteon surviving a Rain Dance boosted Surf from Red&#039;s Level 77 Blastoise. :L Also my Scizor OHKO&#039;ed Red&#039;s Snorlax with a +6 Hidden Power Bug, but it did crit though. Something also nice with this run is when I caught a Chansey it was holding a Lucky Egg and I don&#039;t think I&#039;ve got one of those before, 1% for Chansey to appear and 8% chance for it to be holding a Lucky Egg. Lucky Egg certainly helped with training during those last few levels. <br /><br />My team and ending stats:<br />[img]http://i.picresize.com/images/2017/10/31/SyriX.jpg[/img]<br />[img]http://i.picresize.com/images/2017/10/31/ZXOM0.jpg[/img]<br /><br />With Yellow, Crystal, Emerald and now VC Gold that&#039;s 4 Pokemon playthroughs I&#039;ve completed this year. Maybe I should play other games now, but Pokemon is just so damn fun. :&#039;D<br />[/quote]<br /><br />Congratulations Nostalgia! and I&#039;m glad I helped you on your quest. :)<br /><br />I&#039;ve got 251 no glitches (except for Coin Case Mew and Celebi) too, but your play time is a lot faster than mine.


subject: Emerald RNG abuse: RNG method for starter Pokemon.
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  (Apologies for the long title)<br /><br />I&#039;m looking to RNG abuse my starter Pokemon in Emerald (i&#039;m abusing for favorable IVs).<br /><br />Would I simply use RNG method 1 (as for Stationary Pokemon), or is another method needed?<br /><br />Thanks in advance!<br /><br /><br />Edit: It&#039;s worth noting that i&#039;m on emulator.


subject: Re: The Cascade Glitch - Gateway to Gen IV ACE
poster_name: xylo
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=7857.msg207510#msg207510 date=1509368708]<br />I don&#039;t entirely know how this works, technically... How is the invalid data loaded and why does this corrupt so much memory?<br />[/quote]<br /><br />I don&#039;t think anyone knows exactly how it works, not even Cryo. But, as far as I know, it involves the map pointers set by reloading graphics in a certain subchunk and then performing a specific tweak. As for why it corrupts so much, I have no idea.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207533#msg207533 date=1509462745]<br />Congratulations Nostalgia! and I&#039;m glad I helped you on your quest. :)<br /><br />I&#039;ve got 251 no glitches (except for Coin Case Mew and Celebi) too, but your play time is a lot faster than mine.<br />[/quote]<br /><br />Thanks. It was the VC release and your videos that made me want to play gen II again. :) 251 with only using Coin Case for Mew and Celebi and no other glitches is what I did for my Crystal playthrough on Gameboy, by trading over a Mew and Celebi obtained on a Gold cartridge with Coin Case. However on VC Gold, because I had no one to trade with, I needed all the R/B/Y and Silver exclusives and the only way I could get them was with the Coin Case. I also used other glitches such as your DV code, Master Ball and Rare Candy codes to get through the Pokedex quicker, so that makes up for the time. My Crystal file is probably similar in time to yours, I think it was around 60 or 70 hours iirc, but on that file I trained my Pokemon to level 70 and I did (I think) four Battle Tower runs at level 40, 50, 60, 70. <br /><br />I don&#039;t mind using a few extra glitches to make some of the tedious stuff quicker, for example getting a Larvitar and a Dratini all the way up to a Tyranitar and a Dragonite through training or the daycare takes ages and I&#039;ve done it before and I wasn&#039;t particularly looking forward to doing that again. :P<br /><br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207528#msg207528 date=1509445650]<br />[quote author=forsyz link=topic=6716.msg207527#msg207527 date=1509444554]<br />If you could make the game corrupt itself with ace that would be cool but there would be a risk of also corrupting your save file<br />[/quote]<br /><br />The risk wouldn&#039;t be that great, the game would have to miraculously unlock SRAM before any save corruption would take place.<br /><br />Nothing too terribly intresting would occur, the game would probably Glitch Dimension before anything noticable happened.<br />[/quote]<br /><br />Can you unlock SRAM maunually? Wondering if you can use TM25 to edit pokÃ©mon in the box.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207539#msg207539 date=1509486348]<br />SRAM probably can be unlocked manually, but how this would be accomplished is beyond me.<br />[/quote][quote author=Skeef link=topic=6716.msg207537#msg207537 date=1509479087]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207528#msg207528 date=1509445650]<br />[quote author=forsyz link=topic=6716.msg207527#msg207527 date=1509444554]<br />If you could make the game corrupt itself with ace that would be cool but there would be a risk of also corrupting your save file<br />[/quote]<br /><br />The risk wouldn&#039;t be that great, the game would have to miraculously unlock SRAM before any save corruption would take place.<br /><br />Nothing too terribly intresting would occur, the game would probably Glitch Dimension before anything noticable happened.<br />[/quote]<br /><br />Can you unlock SRAM maunually? Wondering if you can use TM25 to edit pokÃ©mon in the box.<br />[/quote]<br />Write 0Ah or anything else ending in A to ROM addresses 0000-1FFF to unlock SRAM.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  To then switch SRAM banks, write the desired number to $4000-$5FFF. (Avoid writing too high values, results will differ based on platform.)<br />The selected SRAM bank will then be available in range A000-BFFF...<br /><br />By the way, to lock SRAM again, write a value that wouldn&#039;t unlock it to the same address range.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Parzival link=topic=6716.msg207540#msg207540 date=1509488156]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207539#msg207539 date=1509486348]<br />SRAM probably can be unlocked manually, but how this would be accomplished is beyond me.<br />[/quote][quote author=Skeef link=topic=6716.msg207537#msg207537 date=1509479087]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207528#msg207528 date=1509445650]<br />[quote author=forsyz link=topic=6716.msg207527#msg207527 date=1509444554]<br />If you could make the game corrupt itself with ace that would be cool but there would be a risk of also corrupting your save file<br />[/quote]<br /><br />The risk wouldn&#039;t be that great, the game would have to miraculously unlock SRAM before any save corruption would take place.<br /><br />Nothing too terribly intresting would occur, the game would probably Glitch Dimension before anything noticable happened.<br />[/quote]<br /><br />Can you unlock SRAM maunually? Wondering if you can use TM25 to edit pokÃ©mon in the box.<br />[/quote]<br />Write 0Ah or anything else ending in A to ROM addresses 0000-1FFF to unlock SRAM.<br />[/quote]<br /><br />Thank you! This should be helpful. I bet something like this would work:<br /><br />[code]<br />Ld hl,0000<br />Ld bc,01ff<br />.loop<br />Ld a,0a<br />ldi (hl),a<br />dec bc<br />ld a,b<br />or c<br />jr nz,.loop<br />...<br />[/code]<br /><br />Although, writing this as a box name code may be difficult. But with enough adjustments and self-modding, I can probably make it work. :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misdreavus
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Misdreavus
icon: xx
body:
  Thanks, @ISSOtm!<br /><br />[quote author=Krys3000 link=topic=6638.msg198625#msg198625 date=1433428887]<br />[quote]I&#039;m currently trying to obtain the 8F Item using invlid encounter flags (because i have no event that takes an item away and I dont feel like playing the main story all over again...).[/quote]<br /><br />Actually you don&#039;t need an event anymore. There is a &quot;dry&quot; variation of the item underflow glitch, for which all you need is a stack of 255 X Special. You can get it with MissingNo. using the glitch of your choice. Moreover, if the invalid encounter flag method works, it means the cooltrainer corruption works for you, so that you can encounter a MissingNo. This invalid encounter flag method is obsolete, you should not use it.<br /><br />The item underflow glitch requires you to have this :<br />[img]http://www.prama-initiative.com/RBJ/iug1.png[/img]<br />French screen, Special + is X Special and the two first item are useless.<br /><br />Toss the two first useless items, you will have this : <br />[img]http://www.prama-initiative.com/RBJ/iug2.png[/img]<br /><br />Toss several 255x of the first item until you only have access to two items. Toss 253 of that first X Special stack and switch item 1 and 2 twice.&nbsp; You should have X Special x0, like this :<br />[img]http://www.prama-initiative.com/RBJ/iug3.png[/img]<br /><br />Item underflow will be active. Now go there (near Celadon) :<br />[img]http://www.prama-initiative.com/RBJ/iug4.png[/img]<br /><br />Toss 255 X Special again, and switch the remaining X Special with the Nugget in 35th position. 5 steps right, 5 steps down, 20 steps right and open the item menu to see 8F, that you can switch to a &quot;normal&quot; place (eg : first place). Fly back to Celadon and buy items to fix the item menu.<br /><br /><br />If you still wanna use the invalid encounter flags, you don&#039;t need to USE the attack to trigger the corruption. Just enter/exit the FIGHT menu until it works. <br /><br />Fact is, cooltrainer corruption doesn&#039;t always work, it depends on the values of some RAM addresses. [url=http://forums.glitchcity.info/index.php/topic,6992.msg198569.html#msg198569]You wil find here[/url] TheZZAZZGlitch&#039;s methods to maximize the chances. I can tell you that the &quot;renaming party + open unused box&quot; method works very well.<br /><br />Good luck !<br />[/quote]I&#039;m trying to use this method but am having some trouble.&nbsp; I&#039;ve never done ACE or item underflow before so please bear with me.<br /><br />I begin with my item pack in its entirety as follows (just as in the pictures):<br /><br />Great Ball x1<br />Parlyz Heal x1<br />X Special x255<br />TM09 x3 (It&#039;s my understanding that this is not necessary but I did it to match the images in the quote)<br /><br />I also start in the proper position to the east of Celadon City.<br /><br />Everything goes according to plan until I&#039;m supposed to swap with the Nugget in the 35th position.&nbsp; While my game lets me scroll past &quot;Cancel,&quot; the items listed there all have no name or quantity, and by the time I push &quot;down&quot; 34 times, my cursor has stopped moving.&nbsp; I never see a Nugget.&nbsp; My game then operates extremely slowly and is unresponsive to some commands.<br /><br />What could I be doing wrong?&nbsp; I&#039;d like to get this method to work since I don&#039;t feel like restarting my file to gain access to an event item.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=6716.msg207540#msg207540 date=1509488156]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207539#msg207539 date=1509486348]<br />SRAM probably can be unlocked manually, but how this would be accomplished is beyond me.<br />[/quote][quote author=Skeef link=topic=6716.msg207537#msg207537 date=1509479087]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207528#msg207528 date=1509445650]<br />[quote author=forsyz link=topic=6716.msg207527#msg207527 date=1509444554]<br />If you could make the game corrupt itself with ace that would be cool but there would be a risk of also corrupting your save file<br />[/quote]<br /><br />The risk wouldn&#039;t be that great, the game would have to miraculously unlock SRAM before any save corruption would take place.<br /><br />Nothing too terribly intresting would occur, the game would probably Glitch Dimension before anything noticable happened.<br />[/quote]<br /><br />Can you unlock SRAM maunually? Wondering if you can use TM25 to edit pokÃ©mon in the box.<br />[/quote]<br />Write 0Ah or anything else ending in A to ROM addresses 0000-1FFF to unlock SRAM.<br />[/quote]<br /><br />I thought ROM was read only.&nbsp; O_o Anyways, I found this online and apparently the memory in range 0000-7FFF is used for both reading from ROM, and for writing to the MBCs Control Registers. So how does that work? Reading it is always ROM and writing to it is always RAM?<br /><br />http://bgb.bircd.org/pandocs.htm#mbc1max2mbyteromandor32kbyteram


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This is called the lagging menu glitch, some glitch items with unterminated names can cause the game to lag. If you notice this, try pressing &quot;a&quot; on the offending item, and see if you can scroll your cursor any further.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=6716.msg207543#msg207543 date=1509517986]<br />I tired this in an emulator but where the pokemon in boxes are stored its still all 0s<br />[/quote]<br /><br />Are you executing this code in a debugger? If so, make sure to execute the code while viewing the bag, pokemon party, etc.<br /><br />SRAM in gen 2 works a lot differently than in gen 1. In my copy of gold, the SRAM immediatly locks itself if unlocked in the overworld.<br /><br />[quote author=Skeef link=topic=6716.msg207545#msg207545 date=1509532146]<br /><br />I thought ROM was read only.&nbsp; O_o Anyways, I found this online and apparently the memory in range 0000-7FFF is used for both reading from ROM, and for writing to the MBCs Control Registers. So how does that work? Reading it is always ROM and writing to it is always RAM?<br /><br />http://bgb.bircd.org/pandocs.htm#mbc1max2mbyteromandor32kbyteram<br />[/quote]<br /><br />That sounds about right. Editing ROM in-game is impossible, so it makes sense than ROM addresses could be used for other parts of RAM when written to. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207542#msg207542 date=1509491703]<br />[quote author=Parzival link=topic=6716.msg207540#msg207540 date=1509488156]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207539#msg207539 date=1509486348]<br />SRAM probably can be unlocked manually, but how this would be accomplished is beyond me.<br />[/quote]<br />(...)<br />Write 0Ah or anything else ending in A to ROM addresses 0000-1FFF to unlock SRAM.<br />[/quote]<br /><br />Thank you! This should be helpful. I bet something like this would work:<br /><br />[code]<br />Ld hl,0000<br />Ld bc,01ff<br />.loop<br />Ld a,0a<br />ldi (hl),a<br />dec bc<br />ld a,b<br />or c<br />jr nz,.loop<br />...<br />[/code]<br /><br />Although, writing this as a box name code may be difficult. But with enough adjustments and self-modding, I can probably make it work. :)<br />[/quote]<br />You don&#039;t have to write to all of these addresses, only to one of them. Same for all other writes.<br />[code]<br />ld a, $0A<br />ld [$0000], a<br />[/code]<br />That&#039;s enough.<br /><br />[quote author=forsyz link=topic=6716.msg207543#msg207543 date=1509517986]<br />I tired this in an emulator but where the pokemon in boxes are stored its still all 0s <br />[/quote]<br />You probably didn&#039;t switch SRAM banks. If SRAM was locked, you&#039;d see $FF, not $00.<br /><br />[quote author=Skeef link=topic=6716.msg207545#msg207545 date=1509532146]<br />[quote author=Parzival link=topic=6716.msg207540#msg207540 date=1509488156]<br />(...)<br />[/quote]<br /><br />I thought ROM was read only.&nbsp; O_o Anyways, I found this online and apparently the memory in range 0000-7FFF is used for both reading from ROM, and for writing to the MBCs Control Registers. So how does that work? Reading it is always ROM and writing to it is always RAM?<br /><br />http://bgb.bircd.org/pandocs.htm#mbc1max2mbyteromandor32kbyteram<br />[/quote]<br />ROM [i]is[/i] read-only. And you aren&#039;t writing to any kind of RAM either. It&#039;s [b]attempting to write[/b] to ROM that triggers the operation.<br />On original hardware, the Game Boy simply forwarded ROM and SRAM read AND write orders to the cartridge ; the MBC chips simply intercepted write orders that targeted some areas of ROM, and processed them as internal commands (switching ROM banks, SRAM banks, unlocking SRAM, etc.)<br /><br />Also, side note, you should refer to [url=http://gbdev.gg8.se/wiki/articles/MBC3]this document[/url] instead. It&#039;s also the Pan Docs, but wikified and corrected. Also the PokÃ©mon games all use MBC3 (except the Japanese games, which use MBC1), which is why this document will be more accurate. Note that the Gen I games don&#039;t have RTC support, so don&#039;t try to use the RTC clock, it&#039;s not there.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I recommend pressing B instead, since popping the USE/TOSS menu on such large-named items will cause memory corruption and potentially crash the game. At worst you&#039;ll close the item menu, and you will have to press B again when trying to re-open the menu. But eventually you&#039;ll get it to work.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Super-sorry for my ignorance on the subject; SRAM is a new concept for me.<br /><br />So, allow me to get this straight, editing box Pomemon is as simple as:<br />1: Unlock SRAM<br />2: Switch into respective bank<br />3: Write<br />4: Relock<br /><br />If so, is there any list I can access for SRAM banks?<br /><br />Thanks in advance! :)<br /><br /><br />Edit: Nevermind, box Pokemon is in SRAM bank 1.<br /><br />I wrote an SRAM hack that turns your first box Pokemon into Celebi. I&#039;ll convert it to a box name code and have it up sometime today.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: ISSOtm
icon: xx
body:
  Relocking is optional, even more so if the game automatically re-locks it in the overworld. I&#039;m not sure about not switching back to the original bank, but I can bet it&#039;s harmless.<br /><br /><br />SRAM &quot;maps&quot; :<br /><br />http://github.com/PikalaxALT/pokegold/blob/master/sram.asm<br />Quite incomplete [last time I checked].<br /><br />http://github.com/pret/pokecrystal/blob/master/sram.asm<br />Should be mostly the same as G/S.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misdreavus
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6638.msg207549#msg207549 date=1509536098]<br />I recommend pressing B instead, since popping the USE/TOSS menu on such large-named items will cause memory corruption and potentially crash the game. At worst you&#039;ll close the item menu, and you will have to press B again when trying to re-open the menu. But eventually you&#039;ll get it to work.<br />[/quote]This worked for me and I successfully got 8F... temporarily.&nbsp; When I Flew back to Celadon and bought items to restore my pack to normal, the newly-purchased items overwrote 8F in my pack, and my pack is then comprised solely of the items that I bought right then.&nbsp; How many items am I supposed to buy?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks for the explanation. It&#039;s all making more sence now. And its working nicely on a rom to. Should make a bootstrap on my silver cart.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Here&#039;s the code:<br /><br />Stored Pokemon 1 is &lt;insert [b]x[/b] Pokemon here&gt;<br />Box 1: ApÃ©&#039;m2Ã©&#039;r2<br />Box 2: Ã©&amp;2&#039;v0555<br />Box 3: Ã©AAp0&#039;d&#039;vQ<br />Box 4: Ã©Ã©2p&#039;v955<br />Box 5: 55555Ã©AA<br />Box 6: 09&#039;vSÃ©525<br />Box 7: p0[b]?[/b][i]55[/i]Ã©An<br />Box 8: Ã©Cnp&#039;d555<br /><br />Replace [b]?[/b] with the Species Index.<br /><br />If you wish to access Species indexes lower than $7f, replace [i]55[/i] with [i]&#039;v(space).[/i] Then, take the desired species id, add $7f, and use that as [b]??[/b]<br /><br />I will release a video of this working as soon as the chance hits me. :)<br /><br />What the code does:<br />Self-mods. A lot.<br />Unlocks SRAM<br />Switches to SRAM bank 1<br />Loads $?? Into $AD6D<br /><br />What the code does [b]not[/b] do:<br />[s]Load $?? Into $AD82, meaning the name on the stats page stays the same[/s] (fixed)<br />Fix SRAM bank (shouldn&#039;t matter)<br />Re-lock SRAM (overworld does this anyway)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=forsyz link=topic=6716.msg207556#msg207556 date=1509569809]<br />To execute ace you have to go into the over world though to get into the bag to use tm 25<br />[/quote]<br /><br />...????<br /><br />Please elaborate.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thats not an issue since you go to your item pack before unlocking SRAM.<br /><br />Also<br /><br />[quote author=Couldntthinkofaname link=topic=6716.msg207555#msg207555 date=1509567189]<br />What the code does:<br />Self-mods. A lot.<br />Unlocks SRAM<br />Switches to SRAM bank 1<br />Loads $?? Into $ADCD<br />[/quote]<br /><br />$ADCD is the third pokÃ©mon first HP EV adress. I hope thats just a typo.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Skeef link=topic=6716.msg207558#msg207558 date=1509573181]<br />Thats not an issue since you go to your item pack before unlocking SRAM.<br /><br />Also<br /><br />[quote author=Couldntthinkofaname link=topic=6716.msg207555#msg207555 date=1509567189]<br />What the code does:<br />Self-mods. A lot.<br />Unlocks SRAM<br />Switches to SRAM bank 1<br />Loads $?? Into $ADCD<br />[/quote]<br /><br />$ADCD is the third pokÃ©mon first HP EV adress. I hope thats just a typo.<br />[/quote]<br /><br />Whoops my bad, thanks for catching that!


subject: Trainer Escape glitch disappearing object questions
poster_name: realsamusaran
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I was messing around in Pokemon Yellow, trying to disappear all the fake item Voltorbs and Electrodes in the Power Plant. It worked for the first attempt, but subsequent attempts all failed.<br /><br />I looked everywhere I&#039;d been for anything that might have gone missing instead, but everything was how it was before doing the glitch. I&#039;d been through all these areas and collected every hidden or visible item, and I&#039;d defeated all but the trainers I was using for the glitch, in order to control for as many variables as I could. I also minimized the number of areas I had to pass through by using the Route 10 Pokemon Center outside Rock Tunnel as my last Pokemon Center so I could warp back there.<br /><br />So I was wondering, how is the missable object to be removed determined by the game? Does anyone have a comprehensive list of which objects can be removed through Trainer Escape and where they&#039;re at? Also, what happens when there aren&#039;t any objects in memory to be removed after finishing the glitch?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: forsyz
icon: xx
body:
  Can&#039;t get it to work the adresss where pc box pokemon are stored is still all 0s when i unlock the sram and switch banks. Also doesn&#039;t the 3ds vc emulator not emulate sram locking if it doesn&#039;t why won&#039;t the memmory editor let me write to the sram.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=forsyz link=topic=6716.msg207562#msg207562 date=1509600759]<br />Can&#039;t get it to work the adresss where pc box pokemon are stored is still all 0s when i unlock the sram and switch banks. Also doesn&#039;t the 3ds vc emulator not emulate sram locking if it doesn&#039;t why won&#039;t the memmory editor let me write to the sram.<br />[/quote]<br /><br />What emulator are you using? This probably wont work on VBA.<br /><br />I&#039;m using BGB and it&#039;s working fine. I&#039;m unsure about VC.


subject: Re: Trainer Escape glitch disappearing object questions
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The game has a list of objects that can be removed for each map. When you enter a new map, the previous list is overwritten with the new one.<br />The glitch occurs because performing the Mew Glitch forces the game to remove an entry not in the list, and as such it will remove the object which has the entry right after the new list ends.<br /><br />To say it differently :<br /><br />You go to one map with three objects, the list becomes :<br />ID A -&gt; Object 3<br />ID B -&gt; Object 1<br />ID C -&gt; Object 4<br />END<br /><br />You then go to one map with only one object :<br />ID D -&gt; Object 8<br />END<br /><br />You go to one map with only one object, and trigger Mew Glitch there.<br />ID E -&gt; Object 5<br />END<br />The game will thus remove the last object loaded in the slot (list length + 1), thus it will remove object 1 in the map with three objects.<br />If the object was already removed, it will still be removed.<br /><br />The point is, what matters are which maps you traverse before activating Mew Glitch, and which map you activate Mew Glitch in. For example, this means that doing the same steps twice will not disappear two objects, but only one (twice, but that doesn&#039;t matter).<br /><br />So far, I don&#039;t think any comprehensive map has been made.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207555#msg207555 date=1509567189]<br />What the code does [b]not[/b] do:<br />Load $?? Into $AD82, meaning the name on the stats page stays the same (AFAIK this affects nothing)<br />[/quote]Writing to only one address instead of two will make the PokÃ©mon an unstable hybrid. You should load to $AD62, because the generated hybrid could then be fixed by depositing it into the Daycare then back.<br /><br />[quote author=forsyz link=topic=6716.msg207562#msg207562 date=1509600759]<br />Can&#039;t get it to work the adresss where pc box pokemon are stored is still all 0s when i unlock the sram and switch banks. Also doesn&#039;t the 3ds vc emulator not emulate sram locking if it doesn&#039;t why won&#039;t the memmory editor let me write to the sram.<br />[/quote]<br />I&#039;m not sure about SRAM locking on VC, tbh, but you should follow the procedure anyways.<br />If you&#039;re getting all zeroes, make sure you do NOT go into the overworld or save in the middle of the procedure. The locking and bankswitching AND access must be done in one go.<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=ISSOtm link=topic=6716.msg207565#msg207565 date=1509619397]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207555#msg207555 date=1509567189]<br />What the code does [b]not[/b] do:<br />Load $?? Into $AD82, meaning the name on the stats page stays the same (AFAIK this affects nothing)<br />[/quote]Writing to only one address instead of two will make the PokÃ©mon an unstable hybrid. You should load to $AD62, because the generated hybrid could then be fixed by depositing it into the daycare and back<br />[/quote]<br /><br />What&#039;s $AD62? Can&#039;t find it on the RAM map.<br /><br />Edit: You&#039;re likely referring to $AD82. Do you mean to load it [b]with[/b] or [b]as opposed to[/b] $AD6D? If it&#039;s the forward, it may not be possible due to the heavy amount of SMC.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  How would you add the sram unlocking and bank switching code to the box name memory editor by crystal_


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: forsyz
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Has any one tested this since the vc emulator does not emulate sram locking so it mean you only need to switch banks?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  @ISSOtm, I believe I have fixed my code to produce a non-glitch hybrid. However, I have little time to test this code. If one could test this for me and ensure the Pokemon produced is stable, that would be wondrous.<br /><br />Edit: Code has been tested, Pokemon is stable :)<br /><br />[quote author=forsyz link=topic=6716.msg207569#msg207569 date=1509626412]<br />Has any one tested this since the vc emulator does not emulate sram locking so it mean you only need to switch banks?<br />[/quote]<br /><br />I only have the emulator and the cartridge version, sorry. :(


subject: Re: Trainer Escape glitch disappearing object questions
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  On the topic of disappearing objects, the most common one among players seems to be the police officer outside of the house where you get the Dig TM in Cerulean City.&nbsp; It&#039;s such a common one because many players perform the Mew Glitch with the Slowpoke trainer above the nugget bridge as seen on many Mew Glitch videos and when they teleport/fly back to Cerulean City that officer is removed in the process. However many players don&#039;t seem to realise that - you can just use the swimmer in Misty&#039;s gym for the Mew Glitch and still get a Mew in Cerulean and avoid having the officer removed.


subject: Re: Trainer Escape glitch disappearing object questions
poster_name: realsamusaran
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: realsamusaran
icon: xx
body:
  I see, that makes sense. I hadn&#039;t considered that it would be trying to remove something that&#039;s already gone, I figured it might just jump to the next one down the list. Thanks for the info.<br /><br />New question then. How would one go about checking maps&#039; lists of missable objects to document how many are on each map? A debugger of some kind?


subject: Nickname outsider PokÃ©mon and Eggs
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wrong pocket HM01 (hex:F3) in many versions of PokÃ©mon Gold allows you to nickname a party PokÃ©mon.<br /><br />Sadly this freezes the game on English, Spanish and Italian versions but works on French, German (although I&#039;m unsure if my ROM is a bad dump, &quot;Gold&quot; with both uppercase &quot;G&quot; and lowercase other characters is a default name) and Korean Gold. In Japanese Gold the wrong pocket HM01 appears to have a different effect and seemingly &#039;nothing happens&#039;.<br /><br />I noticed I was able to use this to nickname an Egg. When the Egg was in the last slot of the party, I was able to nickname it. If I didn&#039;t view the summary of the Egg, its species (Togepi) would be revealed on the nickname screen, while if I viewed its summary beforehand it would be named Oeuf (Egg).<br /><br />[img]https://i.imgur.com/yjv8GZs.png[/img] [img]https://i.imgur.com/StnMVyS.png[/img][img]https://i.imgur.com/R8UmAes.png[/img][img]https://i.imgur.com/uH0Lexp.png[/img]<br /><br />[img]https://i.imgur.com/tazuaC9.png[/img] [img]https://i.imgur.com/StnMVyS.png[/img][img]https://i.imgur.com/FTlW0Np.png[/img]<br /><br />I wonder how this would work in an expanded party? Would you be able to change the nickname of PokÃ©mon beyond slot 6, hence modifying an unrelated memory address? Also this seems to work for nicknaming outsider PokÃ©mon which is really useful alone.


subject: Re: Nickname outsider PokÃ©mon and Eggs
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Neat find!<br /><br />You mentioned something about an expanded party, which I think is a neat concept, but I wrote a box name code that sets $DA22 to $FF, and the game softlocked upon viewing the party. Do you know of any way an expanded party might be possible?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  (Super apologies for double-posting)<br /><br /><br />Stored Pokemon 1 is shiny:<br />Box 1: ApÃ©&#039;m2Ã©&#039;r2<br />Box 2: Ã©&amp;2&#039;v0555<br />Box 3: Ã©AAp0&#039;d&#039;vQ<br />Box 4: Ã©Ã©2p&#039;v955<br />Box 5: 55555Ã©AA<br />Box 6: p0Ã©Ã©Xn55<br />Box 7: p0kÃ©Ynp&#039;d<br /><br /><br />(Coin case version)<br />Box 1: ApÃ©&#039;m2Ã©&#039;r2<br />Box 2: Ã©&amp;2&#039;v0555<br />Box 3: Ã©AAp0&#039;d&#039;vQ<br />Box 4: Ã©Ã©2p&#039;v955<br />Box 5: 55555Ã©AA<br />Box 6: p0Ã©Ã©Xn55<br />Box 7: p0kÃ©Yn55<br />Box 8: pÃ©Z(mult).9&#039;l&#039;l<br />Box 9: &#039;l&#039;lp&#039;d5555


subject: Re: Nickname outsider PokÃ©mon and Eggs
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=8129.msg207574#msg207574 date=1509660028]<br />Neat find!<br /><br />You mentioned something about an expanded party, which I think is a neat concept, but I wrote a box name code that sets $DA22 to $FF, and the game softlocked upon viewing the party. Do you know of any way an expanded party might be possible?<br />[/quote]<br /><br />Thanks!&nbsp; :)<br /><br />That&#039;s right.<br /><br />In Generation I opening the expanded party would work provided the PokÃ©mon above FF have greater than 0 maximum HP (if greater than 0 current HP) due to the game not being able to draw the HP box, and swapping PokÃ©mon in the expanded party is easy.<br /><br />However in PokÃ©mon Gold and Silver not only must PokÃ©mon 1-6 not have 0 maximum HP, but it seems specific memory addresses (described [url=http://forums.glitchcity.info/index.php?topic=7762.msg206752#msg206752]in this thread[/url]) have to be greater than 3 (I don&#039;t know why though) to avoid a freeze upon opening the PokÃ©mon menu.<br /><br />Additionally glitches will occur that make navigating the menu a pain unless you view a PokÃ©mon&#039;s summary and continually scroll down, including possible freezes. These can be seen in [url=https://www.youtube.com/watch?v=hhXJRig_O68]this video[/url] about map distortion; a side effect of opening the party menu with 22-29 PokÃ©mon.<br /><br />Obtaining over 6 PokÃ©mon without arbitrary code execution is possible by moving a ????? 00 or FF to the top of the party and using move PkMn w/o Mail to withdraw a seventh, where from there on you can continue to withdraw more and more PokÃ©mon. However when you withdraw a 30th PokÃ©mon (Gold/Silver) or 21 in Crystal the game will freeze.<br /><br />Maybe you could work around this though, and with arbitrary code execution you can set the number of PokÃ©mon to above 30 or 21.<br /><br />I found out that memory editing using out of bounds PokÃ©mon is indeed possible with HM01, but I don&#039;t know if you can access many useful addresses other than DC57 and DC90 (Day Care species 1 and 2).<br /><br />If you use arbitrary code execution to get more PokÃ©mon however, you can corrupt addresses up to Echo RAM E426 (C426). I found something cool with this when you set the number of PokÃ©mon to 142 (0x8E).<br /><br />[img]https://i.imgur.com/t2GHeQ5.png[/img]<br /><br />Though you can&#039;t notice it with this image, some of these characters are constantly changing and we can corrupt the music by entering random characters like in TheZZAZZGlitch&#039;s debug Yellow corruption &#039;fuzz&#039; feature.


subject: Re: Nickname outsider PokÃ©mon and Eggs
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Regarding the addresses that are required to be greater than $03, maybe something like this could work:<br /><br />[code]<br />ld hl,$DA4F<br />ld bc,$0030<br />ld e,$1D<br />ld a,$04<br />.loop<br />ld (hl),a<br />add hl,bc<br />dec e<br />jr nz,.loop<br />*Rest Of Code*&nbsp; &nbsp;  ; probably change $da22 here<br />[/code]<br /><br />The obvious issue being a box name code that does something similar/same to this may be difficult to make, another being the fact that the menu can still crash if the user is unlucky (The latter issue probably cannot be helped). It is however, an interesting concept, being able to directly edit memory addresses by nicknaming an egg :)<br />


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Torchickens link=topic=8111.msg207215#msg207215 date=1507481633]<br />Max out stat experience, give experience for Level 100 after battle:<br /><br />Box 1: Ap09Ã©â™€45<br />Box 2: Ã©04Ã©1455<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©7455<br />Box 6: Ã©84Ã©.455<br />Box 7+: 55555555<br />Box 13: Unchanged from before<br />Box 14: Unchanged from before<br />[/quote]<br /><br />Just tried this code (well, a variant for usage with wrong pocket TM execution) and the experience is not granted.<br />Reason is probably that the [b].[/b] character is not 0xf2, but instead 0xe8 (different dot character, only looks the same). Therefore, instead of maximizing Exp gained we are corrupting the SpDef stat of PokÃ©mon 4 (harmless; can be fixed by depositing and re-withdrawing).<br /><br />Adjusted version that should work; TM variant:<br />[code]<br />Box 1: Ap0(mult)&#039;v955<br />Box 2: Ã©3209Ã©14<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©7455<br />Box 6: Ã©84Ã©0455<br />Box 7: Ã©â™€4Ã©Ã©4x&#039;d<br />[/code]<br />Coin Case Variant (untested):<br />[code]<br />Box 1: Ap0(mult)&#039;v955<br />Box 2: Ã©3209Ã©14<br />Box 3: Ã©24Ã©3455<br />Box 4: Ã©44Ã©5455<br />Box 5: Ã©64Ã©74&#039;l&#039;l<br />Box 6: Ã©84Ã©04&#039;l&#039;l<br />Box 7: Ã©â™€4Ã©Ã©455<br />Box 8: pÃ©Z(mult)x&#039;d<br />[/code]<br />


subject: Re: Emulating the Mobile Adapter GB
poster_name: wintiger0222
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ravioli link=topic=7509.msg207560#msg207560 date=1509575787]<br />How exactly are you trying to &#039;&#039;fix the mobile functions&#039;&#039;? <br />[/quote]<br /><br />Well, I&#039;m trying to make this stable.<br /><br />[list]<br />[li]Replace PokeCom Center of Goldenrod City.[/li]<br />[li]Enable SRAM Bank 4-7, which related to Mobile GB System.[/li]<br />[li]Insert assembly code, related to mobile.[/li]<br />[li]Figure out the purpose of dummied out mobile function.[/li]<br />[li]Translate.[/li]<br />[/list]<br /><br />This are what I&#039;m doing or done now.<br />However, I&#039;m doing this with making korean fan translation of crystal version, so the &#039;Translation&#039; means korean.<br />But my korean fan translation is based on english version, so it would be able to adapt for english version.<br /><br />[list]<br />[li]Move pointer address which cause glitch(Most thing is player&#039;s name)[/li]<br />[li]Make simulator of Mobile Adapter and private server(if it can)[/li]<br />[li]Write script related to mobile event like GSball event[/li]<br />[li]Apply these to enlgish version, if I have enough time.[/li]<br />[/list]<br /><br />And this is what I&#039;m supposed to do.<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207566#msg207566 date=1509619826]<br />[quote author=ISSOtm link=topic=6716.msg207565#msg207565 date=1509619397]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207555#msg207555 date=1509567189]<br />What the code does [b]not[/b] do:<br />Load $?? Into $AD82, meaning the name on the stats page stays the same (AFAIK this affects nothing)<br />[/quote]Writing to only one address instead of two will make the PokÃ©mon an unstable hybrid. You should load to $AD62, because the generated hybrid could then be fixed by depositing it into the daycare and back<br />[/quote]<br /><br />What&#039;s $AD62? Can&#039;t find it on the RAM map.<br /><br />Edit: You&#039;re likely referring to $AD82. Do you mean to load it [b]with[/b] or [b]as opposed to[/b] $AD6D? If it&#039;s the forward, it may not be possible due to the heavy amount of SMC.<br />[/quote]<br />I was indeed referring to $AD82 ; writing to AD82 only produces a hybrid that can be stabilized, writing to both produce no hybrid.


subject: Re: Some competitive battling box name codes for Coin Case arbitrary code execution
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Yeah, sorry about that. :( I addressed this on a post on page 1 of this thread.<br /><br />Thanks for your fixes though! :) I should have updated my original post so I&#039;ll update it now.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Scotteh
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Scotteh
icon: xx
body:
  It&#039;s not extremely useful, but I made a small modification to one of Couldntthinkofaname&#039;s codes to turn all wild PokÃ©mon Level 100.<br /><br />1: Ap0&#039;mÃ©J95<br />2: p0-Ã©K955<br />3: p02Ã©L9p&#039;d<br />4: (anything)<br />5: p0,&#039;vQÃ©6&#039;d<br />6: p&#039;d<br /><br />Notably, it doesn&#039;t affect the wild PokÃ©mon&#039;s stats, which remain at the normal ones for their old level until caught.<br /><br /><br />EDIT: I came up with a better one which hooks elsewhere, earlier on in the wild PokÃ©mon generation routine. This time the moveset and stats match the level.<br /><br />1: Ap0&#039;mÃ©J95&nbsp; <br />2: p0-Ã©K95p<br />3: 02Ã©L9p0Pk<br />4: &#039;vbÃ©&amp;25p&#039;d<br />5: p0,&#039;vQÃ©6&#039;d<br />6: p&#039;d


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The guide was a bit modified with all the informations that you all gave to me. Many thanks!<br /><br />I would like to understand more about adapting Wrong Pocket TM ACE codes to Coin Case variants, so I can add both for each categories.<br /><br />Of course, I don&#039;t want to link all codes from the main thread but I will add links to some code threads to the guide :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  I have a suggestion to use TM count instead of Box names.<br />First use this box name code ([url=http://forums.glitchcity.info/index.php?topic=6716.msg206997#msg206997]which i ruthlessly stole for Torchickens[/url] before slightly adjusting it) to give you 255 of each TM/HM.<br />[code]<br />1)Ap&#039;vCÃ©025<br />2)&#039;vj&#039;vuÃ©â™€25<br />3)&#039;v.Ã©32p&#039;v9<br />4)Ã©22pÃ©425<br />5)&#039;vuÃ©62&#039;v 5<br />6)&#039;v:Ã©72p09<br />7)55â™€555&#039;s5<br />8)x&#039;d<br />[/code]<br />Coin Case variant (untested):<br />[code]<br />1)Ap&#039;vCÃ©025<br />2)&#039;vj&#039;vuÃ©â™€25<br />3)&#039;v.Ã©32p&#039;v9<br />4)Ã©22pÃ©425<br />5)&#039;vuÃ©62&#039;v 5<br />6)&#039;v:Ã©72p09<br />7)55â™€555&#039;s5<br />8)pppppÃ©ZÃ—<br />9).9&#039;l&#039;l&#039;l&#039;lx&#039;d<br />[/code]<br /><br />Then write your code by depositing to the desired opcode/number (be carefull when tossing above a stack of 255 from pc, since it seems to have the similar effects as in Gen 1).<br />Use this picture from Skeef to make depositing the right number slightly easier.<br />[quote author=Skeef link=topic=6716.msg207457#msg207457 date=1509053150]<br />Over 99 glitch blocks for items:<br />They don&#039;t seem to change based on location or anything it seems.<br /><br />[IMG]http://i63.tinypic.com/k2e4z.png[/img]<br />[/quote]<br /><br />To execute either use a Quagsire holding a Lucky Egg (can be stolen from wild Chanceys, but glitching one is probably easier) with Attract (TM45) as its first move, or use the following box name code and start your code with the item count of TM03.<br />[code]1)A&nbsp; x &#039;m&nbsp; A&nbsp; â™€		OR A; JP NC, [80f5][/code]<br />Coin Case Variant (the new Quagsire won&#039;t work without adjustment of the code, so you have to use this one; untested):<br />[code]<br />1)&nbsp; A&nbsp; p&nbsp; p&nbsp; Ã©&nbsp; Z&nbsp; Ã—&nbsp; .&nbsp; 9		XOR A; LD [f199], A; ADD SP, ff<br />2) &#039;l &#039;l &#039;l &#039;l&nbsp; x &#039;m&nbsp; A&nbsp; â™€		POP DE; POP DE; POP DE; POP DE; OR A; JP NC, [80f5]<br />[/code]<br /><br />Advantage of this method is that you have acces to every Gameboy opcode. Also input of lower numbers is easier.<br /><br />As a proof of concept (still in development, supposed to do more when finished) a code to change species, held item, and moves of the first PokÃ©mon of your current box.<br />You can get the id for species, etc. from the [url=http://glitchcity.info/wiki/The_Big_HEX_List]big HEX list[/url] (be sure to use the Gen2 columns).<br />Fill them in as count for TM17, TM24, TM27, TM30, TM33, TM36.<br />[code]<br />format:	keep/deposit	code<br />TM01	3/252			inc bc/ignored<br />TM02	3/252			inc bc/ignored<br />TM03	62/193			LD A, 0a<br />TM04	10/245			<br />TM05	234/21			LD [ff00], A | A-&gt;0a<br />TM06	255/0			<br />TM07	0/255			<br />TM08	62/193			LD A, 00<br />TM09	0/255			<br />TM10	234/21			LD [ff40], A | A-&gt;00<br />TM11	255/0			<br />TM12	64/191			<br />TM13	33/222			LD HL, 6dad | HL-&gt;ad6d<br />TM14	109/146			<br />TM15	173/82			<br />TM16	62/193			LD A, (species)<br />TM17	(species)/		<br />TM18	34/221			LD [HLI], A<br />TM19	33/222			LD HL, 82ad | HL-&gt;ad82<br />TM20	130/125			<br />TM21	173/82			<br />TM22	34/221			LD [HLI], A<br />TM23	62/193			LD A, (item)<br />TM24	(item)/			<br />TM25	34/221			LD [HLI], A<br />TM26	62/193			LD A, (move1)<br />TM27	(move1)/		<br />TM28	34/221			LD [HLI], A<br />TM29	62/193			LD A, (move2)<br />TM30	(move2)/		<br />TM31	34/221			LD [HLI], A<br />TM32	62/193			LD A, $(move3)<br />TM33	(move3)/		<br />TM34	34/221			LD [HLI], A<br />TM35	62/193			LD A, $(move4)<br />TM36	(move4)/		<br />TM37	34/221			LD [HLI], A<br />TM38	201/54			RET<br />[/code]<br /><br />Since I managed to kill my VC-savegame this is (so far kind of) untested.<br />The parts presented here worked without killing my savegame, but there were some other parts in it which I cut out for this one (such as setting your box PokÃ©mon count to 20).<br />


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Krys3000 link=topic=8126.msg207584#msg207584 date=1509744656]<br />The guide was a bit modified with all the informations that you all gave to me. Many thanks!<br /><br />I would like to understand more about adapting Wrong Pocket TM ACE codes to Coin Case variants, so I can add both for each categories.<br /><br />Of course, I don&#039;t want to link all codes from the main thread but I will add links to some code threads to the guide :)<br />[/quote]<br /><br />Basically with Coin Case arbitrary code execution you have to fix the stack. The stack can be fixed to a degree with the help of two pop des, followed by an inc sp, followed by pop de (in that order. I think the order you do this matters if I remember rightly), and you also should set FF83 (a zero page address) to 0. Only after you do that, you can terminate the code with &quot;or a&quot; (to ensure the carry flag is not set) and a &quot;ret nc&quot;.<br /><br />To avoid a laggy menu you can also set address D199 (or its Echo RAM equivalent F199) to 00. However you don&#039;t need to do this and you can also avoid the lag by setting Menu Account to Off in the options.<br /><br />FMK&#039;s &quot;one-off code&quot; ensures that the last two boxes (box 13 and box 14) have code that will both &#039;fix&#039; the stack and return control to the game, hence you can make simpler codes followed by 5s (filler code) until box 13 and box 14.<br /><br />With wrong pocket TM execution (and glitch PokÃ©dex mode ACE) you don&#039;t have to fix the stack, so you can terminate with the or a and ret nc as usual. Furthermore they can be used anywhere without having to make any overworld movement or listen to Bellsprout/Machop etc.&#039;s cry.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you Torchickens! I should be able to provide equivalents for each code now. If you have any other comment to make to this guide, don&#039;t hesitate to. It&#039;s meant to be the most accurate and user-friendly so it can be visible and a proper introduction to ACE :)


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8126.msg207587#msg207587 date=1509747083]<br />Thank you Torchickens! I should be able to provide equivalents for each code now. If you have any other comment to make to this guide, don&#039;t hesitate to. It&#039;s meant to be the most accurate and user-friendly so it can be visible and a proper introduction to ACE :)<br />[/quote]<br /><br />Pleasure! ^^<br /><br />Good luck and have fun and I&#039;ll keep that in mind!


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Wow, excellent idea spamviech! :D Thank you. :)<br /><br />So you could alternate between the box names Quagsire whenever you want to fill the pockets and the TM/HM pocket Quagsire for anything else up to 55 bytes long.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6716.msg207590#msg207590 date=1509747801]<br />Wow, excellent idea spamviech! :D Thank you. :)<br /><br />So you could alternate between the box names Quagsire whenever you want to fill the pockets and the TM/HM pocket Quagsire for anything else up to 55 bytes long.<br />[/quote]<br /><br />Up to 57 bytes long, but you need to write the hm-quantities e.g. using box names (all available). You can even start with box name code and then jump to TM03 with a final x&#039;mAâ™€.<br /><br />Since withdrawing more than 99 seems to be impossible you need to run the 255-code every time as part of changing code though.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  It&#039;s possible to replace the (not representable by an available character) INC SP with a ADD SP, ff followed by an additional POP DE (as pointed out by ISSOtm [url=http://forums.glitchcity.info/index.php?topic=6716.msg207453#msg207453]here[/url]).<br /><br />[url=http://forums.glitchcity.info/index.php?topic=6716.msg207458#msg207458]It also turns out that you don&#039;t have to set ff83 to 0 when setting f199 to 0.[/url]<br /><br />So the only adjustment you have to make from a wrong-pocket TM code to a Coin Case one is replace the final [b]x&#039;d[/b] with [code]<br />pÃ©ZÃ—.9&#039;l&#039;l&#039;l&#039;lx&#039;d<br />[/code]<br />You have to keep the &quot;pÃ©ZÃ—&quot;, the &quot;.9&quot; and the &quot;x&#039;d&quot; (obviously has to be at the end) together. If you have space problems in my experience it is no problem to space it out in the code (replace some filler 5s).[/code]


subject: Glitch Discovered in Crystal
poster_name: greentyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Did a runthrough of Crystal recently and tested something out of curiosity, with a surprising result.<br /><br />In HGSS, if the player leaves the Dragon&#039;s Den using an Escape Rope before Clair gives them TM59 Dragon Pulse, she will give it to them in the gym instead. It is not possible to use an Escape Rope to exit the Dragon&#039;s Den in Crystal due to Clair approaching the player as soon as they exit the shrine, but it is possible to white out inside the shrine if all the player&#039;s Pokemon faint due to poison damage. This, I did.<br /><br />Upon respawning outside the last Pokemon Centre used, I returned to the Blackthorn Gym where Clair tells the player &quot;You kept me waiting!&quot; and gives them TM24 Dragonbreath.<br /><br />However, when I went into the Dragon&#039;s Den immediately after this to collect the gift Dratini, upon reaching the door of the shrine, Clair approaches the player and gives them TM24, as usual. So, by doing this, I wound up getting two copies.<br /><br />A slightly convoluted process, but one worth doing.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  I like this new medium, Spamveich! <br /><br />I just got my cart yesterday so I probably wont test it out right now, but this seems interesting!<br /><br />The only potential problem I can see arise is that in order to wtite a new code, you must reset each quantity to 255. A workaround I thought of was using &quot;call nc&quot; as opposed to &quot;jp nc&quot;, that way you can execute the x255 TM code immeadiatly after the TM quantity code.


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: drc
icon: xx
body:
  am i banned or something, because none of the links work for me and i&#039;m really itching to get back into glitching.[font=comic sans ms][size=8pt]rhyme intentional[/size][/font]<br /><br />my discord is big man dan#3383 if anybody who is an admin wants to check 


subject: Re: Name Changes
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  old name: drc<br />new name: danny<br /><br />i don&#039;t really go by my actual name anymore, apologies if this is a bit sudden or something. considering i haven&#039;t been here for 4+ months


subject: Re: Glitch Discovered in Crystal
poster_name: Flameduck
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Flameduck
icon: xx
body:
  Mentioned this on Reddit, but this is the result of the Blackthorn Gym TM24 event being based on the &quot;TM24 given&quot; flag not being set at Dragon&#039;s Den, which happens if you have 99 TM24 in your bag. Seems to be a minor oversight of a rare scenario. <br /><br />Surprisingly, unlike other gym leaders in this game but like RBY leaders, Clair has specific messages for if your bag is full (having 99 TM24) both at the Dragon&#039;s Den and at the gym.<br /><br />[s]I&#039;m in the process of recording this Clair scenario now.[/s] <br />EDIT: Here it is: [url=https://www.youtube.com/watch?v=tRxSFHWvDeI]https://www.youtube.com/watch?v=tRxSFHWvDeI[/url]<br />[size=1em]<br />[font=verdana]For other leaders like Falkner, it just gives a message saying &quot;The TM Pocket is full...&quot; after &quot;PLAYER received TM31!&quot;, terminates the conversation, and lets you restart the conversation starting from the badge explanation, and get the TM later like RBY.[/font]<br />[/size]<br />[img]https://web.archive.org/web/20171105011340if_/https://i.imgur.com/uZRb9Ho.png[/img]<br /><br />


subject: Re: Glitch Pikachu cries in Yellow
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie
icon: xx
body:
  *Bumping this to note an observation*<br /><br />Several months ago, I have a clear memory of attempting this to play invalid Pikachu cries from English Yellow on a certain medium; possibly the 3DS Virtual Console version of Yellow, and the static from the Pikachu glitch cries did not play.<br /><br />This makes me wonder whether this occurs on the non-emulated mediums (3DS VC counting as an emulator) and if there are differences on a real Game Boy Advance SP/SNES (Super Game Boy)/GameCube (Game Boy Player), having only tested this on an emulator.<br /><br />I have however encountered glitch Pikachu cries on a physical Game Boy Advance SP, as there is a trick to do it with an Xploder GB (a cheating device by Blaze) that involves pressing A on the title screen and quickly pressing the button on the Xploder to bring up the trainer (technically before the game plays the cry), closing the trainer and spamming A until a glitch cry begins to play.<br /><br />If there are differences between the different platforms I&#039;d love to make a separate video about this, and it also relates to TheZZAZZGlitch&#039;s research recently on 4 4&#039;s &quot;true cry&quot;.


subject: Re: Glitch Discovered in Crystal
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie
icon: xx
body:
  This sounds interesting.<br /><br />Thanks for sharing these finds greentyphlosion and Flameduck! :)<br /><br />This makes me remember something from long ago. I attempted to obtain one of the key items when the key items pocket was full (normally impossible without glitches or a cheating device) and I think it ended up making it impossible to continue the game. However I&#039;ve come to learn its very easy to have a false memory so some of these details may not be accurate, but I believe it happened in the Radio Tower during Team Rocket&#039;s invasion.<br /><br />I think too the problem couldn&#039;t be solved by depositing key items in the PC; the game acted as if it had given me the key item despite a message that the pack was full, though I may be wrong.<br /><br />Today I unfortunately can&#039;t fit in time just yet to get that far in the game without cheats (other than Rare Candies and hacking in key items for PokÃ©mon to hold and take) but would like to try it sometime.


subject: Re: Glitch Discovered in Crystal
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie
icon: xx
body:
  [quote author=Flameduck link=topic=8130.msg207598#msg207598 date=1509843148]<br />EDIT: Here it is: [url=https://www.youtube.com/watch?v=tRxSFHWvDeI]https://www.youtube.com/watch?v=tRxSFHWvDeI[/url]<br />[/quote]<br /><br />Nice video! ^^<br /><br />I feel it&#039;s so surprising, that regardless of the age of these games there are still so many curiosities (even those that aren&#039;t the derivative of an existing glitch) we keep on finding.


subject: Re: Glitch Discovered in Crystal
poster_name: Flameduck
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Flameduck
icon: xx
body:
  Thanks!<br /><br />I also just thought of a reason why the contradictory scenario given by greentyphlosion wasn&#039;t accounted for. In Gold and Silver, Clair&#039;s event happens directly after you get the Dragon Fang. There&#039;s no time to do anything in between getting the Fang and giving the TM, so the Gym check for obtaining the TM shouldn&#039;t contradict anything normally. <br /><br />But in Crystal, the Dragon Shrine was added. Clair gives you the badge inside it, but she gives you the TM when you leave it. The gym check wasn&#039;t changed to account for the new possibility of being able to white out, skipping Clair&#039;s Dragon&#039;s Den TM event, and going to the gym again. The Dragon&#039;s Den TM event still activates since it doesn&#039;t check the TM flag, because you shouldn&#039;t be able to have triggered the flag for the TM before the intended method of getting the TM.<br /><br />tl;dr Seems like an oversight, existing flag check that worked in GS was not changed to account for Crystal&#039;s changes and possible skips<br /><br /><br />EDIT: Also, a call from Professor Elm occurred when I left Dragon&#039;s Den. Maybe whiting out and bypassing the call stops you from getting the Master Ball? <br /><br />Also clarification: you can&#039;t actually use Dig or the Escape Rope in the relevant area of Dragon&#039;s Den (tested in Crystal) to begin with.


subject: Re: Where to start for understanding exactly how glitches work programming-wise?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  Hi vhs. :) That&#039;s OK! I started in a similar position of not knowing much about the game&#039;s code or programming.<br /><br />Related to what ISSOtm said, I personally feel before understanding the Game Boy&#039;s programming (CPU) it&#039;s important to understand the system&#039;s memory structure (which in this case of RBY/GSC is sometimes called the Game Boy bus and is described [url=http://gameboy.mongenel.com/dmg/asmmemmap.html]here[/url]).<br /><br />The region that is at C000-CFFF, D000-DFFF, E000-FDFF (and sometimes A000-BFFF, 8000-9FFF) is usually the region that cheating devices for the Game Boy/Color such as the GameShark will change. For example, you might know of the code 01xx59D0 that allows you to fight any PokÃ©mon in Red/Blue. What this code does is write a value to the banked RAM (also known as WRAM) address D059.<br /><br />What RAM essentially is (although I don&#039;t personally understand electronical side of it, and most of the time you don&#039;t need to) is like you&#039;re making database of many changeable things in run-time (or in the case of SRAM save file data), whether it be how many badges you have, the species of the wild PokÃ©mon in battle, your character&#039;s name, to as intricate as the tile on the screen at specific coordinates. On many occasions changing a RAM address will apply the change in game (although there are exceptions, for debugging the developer&#039;s might store the value there only like scratch paper).<br /><br />I feel a good place to begin is by using a memory editor (or cheating device although the process takes longer) to set up glitches. These glitches could be techniques such as the old man glitch, out of bounds values like glitch items with IDs beyond hexadecimal 53 and so on.<br /><br />When you do this I feel it&#039;s best to familiarize yourself with the hexadecimal number system. Our system, decimal has numbers ranging from 0 to 10. Hexadecimal has values ranging from 0 to 15 before you move on to the next digit, and decimal values 11 to 15 are written in hexadecimal as 0A-0F.<br /><br />When clarifying that a number is in hexadecimal, we give it the prefix 0x or $ (depending on your preference); so 5A could be represented as 0x5A or $5A. The 0x doesn&#039;t mean &quot;zero times&quot;, and I don&#039;t know why they chose it but it&#039;s like that.<br /><br />If you&#039;re using Windows, Windows Calculator on Programmer mode is a great way to convert decimal to hexadecimal.<br /><br />Simply enter a number in the &quot;dec&quot; field and then click on &quot;hex&quot;, and the calculator will convert it for you.<br /><br />[img]https://i.imgur.com/IAPbM8g.png[/img]<br /><br />We also have an article about hexadecimal [url=https://webcache.googleusercontent.com/search?q=cache:d18gJQPQF2UJ:https://glitchcity.info/wiki/Hexadecimal+&amp;cd=3&amp;hl=en&amp;ct=clnk&amp;gl=uk]here[/url] that tells you how to make conversions by hand if you ever need to do that. :)<br /><br />[url=https://webcache.googleusercontent.com/search?q=cache:vHJYEf3CazgJ:https://glitchcity.info/wiki/The_Big_HEX_List+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=uk]This table[/url] known as the Big HEX List documents the hex values you need (for a memory editor such as the emulator BGB&#039;s and Visual Boy Advance (VBA)&#039;s and the xx in a GameShark code) to obtain certain things.<br /><br />For a list of memory addresses or GameShark codes I suggest the following resources:<br /><br />1. [url=https://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map]Datacrystals&#039; PokÃ©mon Red and Blue RAM Map[/url]<br /><br />2. [url=https://github.com/pret/pokered/blob/master/wram.asm]PokÃ©mon Red disassembly WRAM map (more complete)[/url]<br /><br />3. [url=https://webcache.googleusercontent.com/search?q=cache:QGcjCxQ54U0J:https://glitchcity.info/wiki/Pok%25C3%25A9mon_Red,_Blue_and_Yellow_GameShark_codes+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=uk]Our wiki&#039;s GameShark codes archive[/url]<br /><br />If you ever need to convert a GameShark code to a memory address and vice versa, consider a GameShark code as 01xxYYZZ. Address ZZYY should be the memory address for most memory editors. The reason for this is the older GameSharks always work by writing a value to a memory address, and that memory address is stored in the code in a format known as little-endian; meaning the smaller values go first. Hence 01xx59D0 is modifying big-endian D059.<br /><br />If you want to get into testing out a particular glitch quickly on an emulator, I have prepared save files on my Google Sites ([url=https://sites.google.com/site/torchickens2/pokemon-save-files]link[/url]), which you can use by saving them in the same directory as a ROM of the same name (for BGB) or using the import battery file feature from File&gt;Load Game (for VBA).<br /><br />In terms of programming, basically glitch items such as 8F (Red/Blue) and ws m (Yellow) will interpret RAM as programming code (known as arbitrary code execution). ROM is read-only and is often reserved for both code (such as the routine to start a new game), as well as data that shouldn&#039;t be changed during gameplay (like PIDGEY&#039;s species name for instance). Nothing stops the game executing RAM as code (in fact some games intentionally do this; not just HRAM), so using a software vulnerability like an out of bounds glitch item we can execute code from a certain address in RAM.<br /><br />The game reads the hexadecimal bytes and doesn&#039;t consider the nature of what it is (hence a Lemonade for instance is 3E XX), but each hexadecimal value corresponds with an opcode (instruction) or operand (parameter for instruction only if the instruction precedes it). Most opcodes are covered on the Big HEX List linked above, but if you want a plainer version I personally suggest [url=http://iimarckus.org/etc/asmopcodes.txt]IIMarckus&#039; text file[/url].<br /><br />[url=http://marc.rawer.de/Gameboy/Docs/GBCPU_Instr.html]This document[/url] is what helped me in understanding some of the basics in Game Boy programming, and the registers (like memory addresses but used by the hardware for almost every purpose): a, b, c, d, e, h, l, sp.<br /><br />This is an example code:<br /><br />ld a,0x15<br />ld (d059),a<br />ret<br /><br />Here we store the value 0x15 (Mew&#039;s hex ID) into a. a is then moved into d059, and the ret is necessary to terminate the code. This results in us encountering a wild Mew.<br /><br />Hope this helps! If you like I can help you learn more :)<br /><br />Remember though: baby steps. I feel it&#039;s a good approach to take your time and try out things one step at a time, and when you perform a glitch deconstruct it by doing something slightly different to see how it changes things. It was only until a few years ago I started experimenting with the programming side of glitches.


subject: Re: Emulating the Mobile Adapter GB
poster_name: ravioli
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=wintiger0222 link=topic=7509.msg207579#msg207579 date=1509700150]<br />[quote author=ravioli link=topic=7509.msg207560#msg207560 date=1509575787]<br />How exactly are you trying to &#039;&#039;fix the mobile functions&#039;&#039;? <br />[/quote]<br /><br />Well, I&#039;m trying to make this stable.<br /><br />[list]<br />[li]Replace PokeCom Center of Goldenrod City.[/li]<br />[li]Enable SRAM Bank 4-7, which related to Mobile GB System.[/li]<br />[li]Insert assembly code, related to mobile.[/li]<br />[li]Figure out the purpose of dummied out mobile function.[/li]<br />[li]Translate.[/li]<br />[/list]<br /><br />This are what I&#039;m doing or done now.<br />However, I&#039;m doing this with making korean fan translation of crystal version, so the &#039;Translation&#039; means korean.<br />But my korean fan translation is based on english version, so it would be able to adapt for english version.<br /><br />[list]<br />[li]Move pointer address which cause glitch(Most thing is player&#039;s name)[/li]<br />[li]Make simulator of Mobile Adapter and private server(if it can)[/li]<br />[li]Write script related to mobile event like GSball event[/li]<br />[li]Apply these to enlgish version, if I have enough time.[/li]<br />[/list]<br /><br />And this is what I&#039;m supposed to do.<br />[/quote]<br /><br />That sounds awesome! If you want to work with me you can contact me on discord, I would love to help you out<br />https://discord.gg/vHwmNBY


subject: Re: Glitch Discovered in Crystal
poster_name: greentyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hey, thanks for this and posting the video! <br /><br />[quote author=Flameduck link=topic=8130.msg207602#msg207602 date=1509847076]<br /><br />EDIT: Also, a call from Professor Elm occurred when I left Dragon&#039;s Den. Maybe whiting out and bypassing the call stops you from getting the Master Ball? <br /><br />Also clarification: you can&#039;t actually use Dig or the Escape Rope in the relevant area of Dragon&#039;s Den (tested in Crystal) to begin with.<br />[/quote]<br /><br />When I whited out and respawned outside the Blackthorn Pokemon Centre, Elm phoned after I took a step, so it seems that they accounted for you fainting after getting the Rising Badge. Which is entirely possible, of course, as you don&#039;t have to beat any of the Trainers in the Dragon&#039;s Den before taking the quiz.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks!<br /><br />I assume the job is the same with items? I&#039;ll add the variants for each code.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8126.msg207606#msg207606 date=1509883521]<br />Thanks!<br /><br />I assume the job is the same with items? I&#039;ll add the variants for each code.<br />[/quote]<br /><br />With item codes, most developers simply use:<br />[code]<br />Inc sp<br />Ld bc,0134<br />Push bc<br />Jp 12f5<br />[/code]<br /><br />What this effectively does is trick the game into reading the end-terminator $50, which fixes the stack on it&#039;s own.


subject: Re: Coin cACE - Streamlining [UE Version]
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=FMK link=topic=8100.msg207089#msg207089 date=1506797769]<br />Prerequisites:<br />Coin Case (... Duh)<br />A low level slide Pokemon in slot 3 (Gift Pokemon Tyrogue, if you&#039;re far enough to get it, seems to reliably work too)<br />Quagsire in slot 4 Holding TM02, with Return (TM27) as Move 1<br />At least one Ball<br />Bellsprout registered in Pokedex<br />&#039;Menu Account&#039; set to Off in Options (Not required, but useful)<br /><br />Step 1) Name Pokemon Storage Boxes the following<br />[code=Ball Slot 1 is TM25]Box 1:&nbsp;  A&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; 5&nbsp; 5<br />Box 2:&nbsp;  Ã©&nbsp; 7 &#039;t&nbsp; p &#039;v&nbsp; 7 &#039;v &#039;d<br />Box 3:&nbsp;  Ã©&nbsp; ?&nbsp; 2&nbsp; p&nbsp; Ã©&nbsp; D&nbsp; 9&nbsp; 5<br />Box 4:&nbsp;  5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5<br />Box 5:&nbsp;  5 &#039;l &#039;l&nbsp; A &#039;l&nbsp; x &#039;d[/code]<br /><br />Step 2) Enter Cherrygrove Mart<br />Step 3) Exit Cherrygrove Mart and take exactly four steps to the right (You should be lined up with the right-most tree between the Mart and Center)<br />Step 4) Listen to Bellsprouts cry<br />Step 5) Open inventory, swap to Key Items pocket (If already there, swap to Balls/TMs and then back to Key Items)<br />Step 6) Use Coin Case, confirm that Ball 1 is TM25<br />Step 7) Save and Reset<br />Step 8) Move your slide Pokemon to slot 2<br />Step 9) Move Quagsire to slot 3<br />Step 10) Congratulations, you never need to use the Coin Case ever again.<br />[/quote]<br /><br />Shorter code which removes the menu lag:<br />[code=Ball Slot 1 is TM25]Box 1:&nbsp;  A&nbsp; p&nbsp; 0 &#039;v &#039;v&nbsp; 8&nbsp; .&nbsp; 9<br />Box 2:&nbsp;  Ã©&nbsp; 7 &#039;t&nbsp; p&nbsp; Ã©&nbsp; Z&nbsp; (mult) &#039;l<br />Box 3: &#039;l &#039;l &#039;l&nbsp; x &#039;d[/code]


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=danny link=topic=7855.msg207595#msg207595 date=1509838565]<br />am i banned or something, because none of the links work for me and i&#039;m really itching to get back into glitching.[font=comic sans ms][size=8pt]rhyme intentional[/size][/font]<br /><br />my discord is big man dan#3383 if anybody who is an admin wants to check <br />[/quote]If there&#039;s a ban from your IP, it&#039;ll tell you the link&#039;s busted even if you&#039;re not the one that was banned. Got a proxy? VPN? You can find some good free lists for proxies at least...


subject: Re: Nickname outsider PokÃ©mon and Eggs
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  If you were to call the naming script for a nicknamable Mon and can somehow switch the Egg into that mon&#039;s slot it&#039;ll name the egg because of how the script works.


subject: Re: Yeniaul's Discord Server (and rules)
poster_name: Abwayax
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=danny link=topic=7855.msg207595#msg207595 date=1509838565]<br />am i banned or something, because none of the links work for me and i&#039;m really itching to get back into glitching.[font=comic sans ms][size=8pt]rhyme intentional[/size][/font]<br /><br />my discord is big man dan#3383 if anybody who is an admin wants to check <br />[/quote]<br />The new link is [url=http://forums.glitchcity.info/index.php?board=118.0]this[/url]. I&#039;ll edit the OP to add this, however, this thread is considered deprecated and locked.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  I&#039;ve added as an option to item codes, before TM10 (ret) a list of items which matches the opcodes you gave me, Couldntthinkofaname:<br />X Defense x1<br />X Speed + x1<br />TM06 x195<br />HM03 x18<br /><br />Thanks! This makes easier to understand why everyone should focus on TM ACE imo&nbsp; :P<br /><br />Regarding the OAM DMA Hijacking, I&#039;m unsure whether we can replace 2&#039;d with pÃ©ZÃ—.9&#039;l&#039;l&#039;l&#039;lx&#039;d or pÃ©ZÃ—.9&#039;l&#039;l&#039;l&#039;l2&#039;d.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Krys3000 link=topic=8126.msg207613#msg207613 date=1509906851]<br />Regarding the OAM DMA Hijacking, I&#039;m unsure whether we can replace 2&#039;d with pÃ©ZÃ—.9&#039;l&#039;l&#039;l&#039;lx&#039;d or pÃ©ZÃ—.9&#039;l&#039;l&#039;l&#039;l2&#039;d.<br />[/quote]<br /><br />Use the forward code. The latter code is an ld command, which doesn&#039;t affect the carry flag. In order for Ret NC to return, the carry flag must [b]not[/b] be set.<br /><br />Also, the ld command would swallow the [b]&#039;d[/b] by using it as an operand.


subject: Re: Nickname outsider PokÃ©mon and Eggs
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Wow, that&#039;s nice! I remember now Haxel saying that to me when we were working on the best TM for G/S Wrong Pocket TM ACE. Thanks for working on it!


subject: Re: Nickname outsider PokÃ©mon and Eggs
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8129.msg207615#msg207615 date=1509914159]<br />Wow, that&#039;s nice! I remember now Haxel saying that to me when we were working on the best TM for G/S Wrong Pocket TM ACE. Thanks for working on it!<br />[/quote]<br /><br />You&#039;re very welcome! ^^*


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207594#msg207594 date=1509803118]<br />I like this new medium, Spamveich! <br /><br />I just got my cart yesterday so I probably wont test it out right now, but this seems interesting!<br /><br />The only potential problem I can see arise is that in order to wtite a new code, you must reset each quantity to 255. A workaround I thought of was using &quot;call nc&quot; as opposed to &quot;jp nc&quot;, that way you can execute the x255 TM code immeadiatly after the TM quantity code.<br />[/quote]<br /><br />Think it depends on the code. Some you might want to execute multiple times.<br /><br /><br />Another thing I found:<br />using pÃ©Z(mult) instead of pÃ©D9 for Coin Case codes seem to change your options (text speed to mid, battle style to switch, maybe something else I missed).


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m suprised no one has done this yet:<br /><br />Get all Johto Badges:<br />Box 1: Ap&#039;vEÃ©&#039;m25<br />Box 2: 09555555<br />Box 3: Ã©A(female)p&#039;d555<br /><br />Untested for the time being.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  (Super-Apologies for double-posting again)<br /><br />Using Spamveich&#039;s new medium, I have created a walk-through walls code.<br /><br />First, use Torchicken&#039;s code that grants you x255 of every TM:<br /><br />1)Ap&#039;vCÃ©025<br />2)&#039;vj&#039;vuÃ©â™€25<br />3)&#039;v.Ã©32p&#039;v9<br />4)Ã©22pÃ©425<br />5)&#039;vuÃ©62&#039;v 5<br />6)&#039;v:Ã©72p09<br />7)55â™€555&#039;s5<br />8)x&#039;d<br /><br /><br />Then, spell the following opcodes with TM quantities:<br /><br />Keep/Deposit (starting from TM 01):<br /><br />62/193<br />8/247<br />33/222<br />163/92<br />206/49<br />34/221<br />34/221<br />34/221<br />119/136<br />201/54<br /><br /><br />Finally, use this code:<br /><br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p&#039;vCÃ©K955<br />Box 3: p0(female)Ã©L9p&#039;d<br /><br />(Coin case variant)<br /><br />Box 1: Ap0&#039;mÃ©J95<br />Box 2: p&#039;vCÃ©K955<br />Box 3: p0(female)Ã©L955<br />Box 4: pÃ©Z(mult).9&#039;l&#039;l<br />Box 5: &#039;l&#039;lp&#039;d5555<br /><br />You should be able to walk through almost any wall. Try not to go out of bounds, this will crash the game.


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Alright, all codes (except the first one obviously) are available for both techniques now, and I&#039;ve added links to some threads. I&#039;m going to start writing a quick and basic introduction to opcodes.<br /><br />Of course, I should be writing a french adaptation to box codes for PRAMA, but the absence of ret nc and sub x instructions in french characters is very annoying because to use ret c or sbc x, the code itself must be modified a bit&nbsp; :( 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s all right Couldntthinkofaname. :)<br /><br />We don&#039;t really mind about double-posts here as long as the information adds to the discussion.<br /><br />Thanks for your writing and sharing your new code. ^^*


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Awesome. Thank you! ^_^<br /><br />Yeah I relate to that, self-modifying codes can be a pain sometimes.


subject: Re: Does Abwayax still check on this place?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Jchu link=topic=7960.msg205265#msg205265 date=1495557163]<br />...Also, it seems i can lock this thread now that I know that abs is still going online :P lol, can i?<br />[/quote]<br /><br />Late reply, but of course! :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Skeef link=topic=6716.msg207589#msg207589 date=1509747399]<br />Nice!&nbsp; O_o Never even reaslised that the memory only used the quantities in the TM pocket.<br />[/quote]<br /><br />Same. Found it by accident after realizing almost all my code I was working on had to be self-modified so I was looking for a place which could be accessed without problems and luckily found TM location.&nbsp; ;D<br /><br />[quote author=spamviech link=topic=6716.msg207617#msg207617 date=1509966768]Another thing I found:<br />using pÃ©Z(mult) instead of pÃ©D9 for Coin Case codes seem to change your options (text speed to mid, battle style to switch, maybe something else I missed).<br />[/quote]<br /><br />To add to that:<br />It also enables battle animations. Returning them back (I had fast text speed, no battle animations, battle style set) before saving and resetting causes you to have a laggy menu again.<br /><br /><br /><br />Regarding TM execution, here&#039;s a box name code to start execution from TM01 quantity (if you don&#039;t want to switch Quagsires):<br />[code]<br /><br />1)&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; 5		<br />2)&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; p&nbsp; 0(spc)?&nbsp; 8		XOR A; OR 7f; AND fe | A-&gt;7e (spc means space)<br />3)&nbsp; Ã© &#039;v&nbsp; 2&nbsp; x &#039;m &#039;m&nbsp; â™€			LD [d6f8], A; OR A; JP NC, [{7e}f5]<br />[/code]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207624#msg207624 date=1509999709]<br />To add to that:<br />It also enables battle animations. Returning them back (I had fast text speed, no battle animations, battle style set) before saving and resetting causes you to have a laggy menu again.<br />[/quote]<br /><br />This is due to $D199 being in control of settings. The default settings are $03. When $D199 is set to $00, it returns the settings to default [b]except[/b] &quot;Menu Account&quot;, which is turned off. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=6716.msg207625#msg207625 date=1510004013]<br />[quote author=spamviech link=topic=6716.msg207624#msg207624 date=1509999709]<br />To add to that:<br />It also enables battle animations. Returning them back (I had fast text speed, no battle animations, battle style set) before saving and resetting causes you to have a laggy menu again.<br />[/quote]<br /><br />This is due to $D199 being in control of settings. The default settings are $03. When $D199 is set to $00, it returns the settings to default [b]except[/b] &quot;Menu Account&quot;, which is turned off.<br />[/quote]<br /><br />Oh, right. Missed that. I wonder what values of non-crashing game, but with fast text-speed and non-laggy menu are possible.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207626#msg207626 date=1510017313]<br />[quote author=Couldntthinkofaname link=topic=6716.msg207625#msg207625 date=1510004013]<br />[quote author=spamviech link=topic=6716.msg207624#msg207624 date=1509999709]<br />To add to that:<br />It also enables battle animations. Returning them back (I had fast text speed, no battle animations, battle style set) before saving and resetting causes you to have a laggy menu again.<br />[/quote]<br /><br />This is due to $D199 being in control of settings. The default settings are $03. When $D199 is set to $00, it returns the settings to default [b]except[/b] &quot;Menu Account&quot;, which is turned off.<br />[/quote]<br /><br />Oh, right. Missed that. I wonder what values of non-crashing game, but with fast text-speed and non-laggy menu are possible.<br />[/quote]<br />If you set $D199 to $01, fast text speed will be active and laggy menu will be fixed.<br /><br />To do this, end coin case codes with:<br /><br />p&#039;v9Ã©Z(mult)55<br />.9&#039;l&#039;l&#039;l&#039;lp&#039;d<br />


subject: Re: The dream thread
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I had to join the Pamela Anderson fan club for some reason. Apparently there was such a thing, and eventually Pamela Anderson herself called me and I was like &quot;aaaaagghhh!! I hate phones!!! Why did you do this to me&quot;, because apparently someone gave her my phone number. And then I woke up.<br /><br />My subconscious is fired.


subject: Re: The Member's Guide to Topiclessness
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  I feel this may be sudden news for some but I would like to get something out, and so that people are aware.<br /><br />I&#039;ve mainly moved on from my gender questioning stage in life to identifying as transgender female. Which means although I was born in a male body I identify as a woman.<br /><br />I haven&#039;t begin HRT (hormone replacement therapy; male sex hormones are replaced with estrogen, progesterone) yet, and gender identity counselling will officially start following on from an introductory session in December. It is suggested before this to officially begin identifying as the other gender, which means I may start to wear my feminine clothes in public and explain that I would like to be known as Evie rather than Tom.<br /><br />Before beginning HRT, it could take 1-2 more years or more before I&#039;m prescribed my medication so it may be a while before this happens.<br /><br />I had a chat with a friend and they suggested it would be good to get this out: to let people know and also because it is healthy.<br /><br />Thanks for listening. :)<br /><br />I understand this is a sensitive topic, and for some people it could bring out raw emotion. That&#039;s OK. I suggest if this makes you feel hurtful towards me, please that you let it out in a safe place like at home and not on the Internet. Thank you. :)


subject: Re: The dream thread
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  Interesting Zowie.<br /><br />I relate too, sometimes our subconscious brings up dreams that feel a little weird now and then. I also have a strange habit of dreaming I&#039;m back in school, makes me curious at times.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  Finished my code I was working on.&nbsp; :D<br />This one will fill your current box with 20 PokÃ©mon of your chosing with same Item and Moveset. Be sure to remove any PokÃ©mon you want to keep, since they will get overwritten (mostly).<br /><br />First, use this box name code to give you 255 of every TM/HM:<br />[code]<br />1)Ap&#039;vCÃ©025<br />2)&#039;vj&#039;vuÃ©â™€25<br />3)&#039;v.Ã©32p&#039;v9<br />4)Ã©22pÃ©425<br />5)&#039;vuÃ©62&#039;v 5<br />6)&#039;v:Ã©72p09<br />7)55â™€555&#039;s5<br />8)x&#039;d<br />[/code]<br /><br />Coin Case Variant (untested):<br />[code]<br />1)Ap&#039;vCÃ©025<br />2)&#039;vj&#039;vuÃ©â™€25<br />3)&#039;v.Ã©32p&#039;v9<br />4)Ã©22pÃ©425<br />5)&#039;vuÃ©62&#039;v 5<br />6)&#039;v:Ã©72p09<br />7)55â™€555&#039;s5<br />8)ppp&#039;v9Ã©ZÃ—<br />9).9&#039;l&#039;l&#039;l&#039;lx&#039;d<br />[/code]<br /><br />Then write the code with TM quantities by keeping/depositing (you might need to toss inbetween to make space in the PC):<br />[code]<br />format:	keep/deposit	code<br />TM01	62/193			LD A, 0a<br />TM02	10/245			<br />TM03	234/21			LD [ff00], A | A-&gt;0a<br />TM04	255/0			<br />TM05	0/255			<br />TM06	62/193			LD A, 01<br />TM07	01/254			<br />TM08	234/21			LD [ff40], A | A-&gt;00<br />TM09	255/0			<br />TM10	64/191			<br />TM11	33/222			LD HL, 6cad | HL-&gt;ad6c<br />TM12	108/147			<br />TM13	173/82			<br />TM14	1/254			LD BC, 1a00 | BC-&gt;001a<br />TM15	26/229			<br />TM16	0/255			<br />TM17	62/193			LD A, 14 | A-&gt;14<br />TM18	20/235			<br />TM19	87/168			LD D, A<br />TM20	95/160			LD E, A<br />TM21	34/221			LD [HLI], A<br />TM22	62/193			LD A, (species)<br />TM23	(species)/		<br />TM24	34/221			LD [HLI], A<br />TM25	21/234			DEC D<br />TM26	32/223			JR NZ, fc | (Loop back to last LD [HLI], A)<br />TM27	252/3			<br />TM28	54/201			LD [HL], ff<br />TM29	255/0			<br />TM30	35/220			INC HL<br />TM31	87/168			LD D, A<br />TM32	122/133			LD A, D<br />TM33	34/221			LD [HLI], A<br />TM34	62/193			LD A, (item)<br />TM35	(item)/			<br />TM36	34/221			LD [HLI], A<br />TM37	62/193			LD A, (move1)<br />TM38	(move1)/		<br />TM39	34/221			LD [HLI], A<br />TM40	62/193			LD A, (move2)<br />TM41	(move2)/		<br />TM42	34/221			LD [HLI], A<br />TM43	62/193			LD A, $(move3)<br />TM44	(move3)/		<br />TM45	34/221			LD [HLI], A<br />TM46	62/193			LD A, $(move4)<br />TM47	(move4)/		<br />TM48	34/221			LD [HLI], A<br />TM49	9/246			ADD HL, BC<br />TM50	29/226			DEC E<br />HM01	32/223			JR NZ, eb | (Loop Back to LD A, D)<br />HM02	235/20			<br />HM03	201/54			RET<br />[/code]<br /><br />Now change your box names to the code below and execute via wrong pocket TM execution:<br />[code]<br />1)&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; p&nbsp; 0&nbsp; A &#039;v&nbsp; x		XOR A; OR 80; SUB b7 | A-&gt;c9<br />2)&nbsp; Ã©&nbsp; s&nbsp; â™€&nbsp; p&nbsp; 0&nbsp; Ã© &#039;v&nbsp; 9		LD [b2f5], A; XOR A; OR ea; SUB ff | A-&gt;eb<br />3)&nbsp; Ã©&nbsp; r&nbsp; â™€&nbsp; p&nbsp; 0&nbsp; a &#039;v&nbsp; A		LD [b1f5], A; XOR A; OR a0; SUB 80 | A-&gt; 20<br />4)&nbsp; Ã©&nbsp; q&nbsp; â™€&nbsp; p&nbsp; 0&nbsp; 8&nbsp; ?&nbsp; _		LD [b0f5], A; XOR A; LD OR fe; AND 7f | A-&gt;7e (_ is space)<br />5)&nbsp; Ã©&nbsp; .&nbsp; 2&nbsp; x &#039;m &#039;m&nbsp; â™€			LD [e7f8], A; OR A; JP NC, [{7e}f5]<br />[/code]<br /><br />Coin Case Variant (untested):<br />[code]<br />1)&nbsp; 5&nbsp; 5&nbsp; 5&nbsp; p&nbsp; 0&nbsp; A &#039;v&nbsp; x		XOR A; OR 80; SUB b7 | A-&gt;c9<br />2)&nbsp; Ã©&nbsp; s&nbsp; â™€&nbsp; p&nbsp; 0&nbsp; Ã© &#039;v&nbsp; 9		LD [b2f5], A; XOR A; OR ea; SUB ff | A-&gt;eb<br />3)&nbsp; Ã©&nbsp; r&nbsp; â™€&nbsp; p&nbsp; 0&nbsp; a &#039;v&nbsp; A		LD [b1f5], A; XOR A; OR a0; SUB 80 | A-&gt; 20<br />4)&nbsp; Ã©&nbsp; q&nbsp; â™€&nbsp; p&nbsp; 0&nbsp; 8&nbsp; ?&nbsp; _		LD [b0f5], A; XOR A; LD OR fe; AND 7f | A-&gt;7e (_ is space)<br />5)&nbsp; Ã©&nbsp; 1&nbsp; 2&nbsp; p &#039;v&nbsp;  9&nbsp; . 9		LD [f7f8], A; XOR A; SUB ff; ADD SP, ff | A-&gt;01<br />6)&nbsp; Ã©&nbsp; Z&nbsp; Ã— &#039;l &#039;l &#039;l &#039;l&nbsp; 5		LD [99f1], A; POP DE; POP DE; POP DE; POP DE |&nbsp; (Ã— is mult)<br />7)&nbsp; x &#039;m &#039;m&nbsp; â™€				OR A; JP NC, [{7e}f5]<br />[/code]<br /><br />Execute using the usual Quagsire holding TM02 with Return as first move (start execution from second character of first box name).<br /><br />Level, Nickname, OT, DV, etc. will be the same from the PokÃ©mon who were in the place before (0/empty for a new box).<br />For Celebi with its Level 1 moveset use the following values at their appropriate place:<br /><br />For Celebi use the following Quantities:<br />[code]<br />Species:<br />	Celebi		251/4<br />Item:<br />	Lucky Egg	126/129<br />Moveset Level 1:<br />	Leech Seed	73/182<br />	Recover		105/150<br />	Confusion	93/162<br />	Heal Bell	215/40<br />[/code]<br /><br />Edit: fixed a bug which would shift bytes upon releasing/withdrawing of PokÃ©mon.<br /><br />[quote author=Couldntthinkofaname link=topic=6716.msg207627#msg207627 date=1510018089]<br />If you set $D199 to $01, fast text speed will be active and laggy menu will be fixed.<br /><br />To do this, end coin case codes with:<br /><br />p&#039;v9Ã©Z(mult)55<br />.9&#039;l&#039;l&#039;l&#039;lp&#039;d<br />[/quote]<br /><br />Neat. :)


subject: Re: This place feels dead
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=8077.msg207630#msg207630 date=1510058161]<br />It&#039;s okay GCLF I feel dead too<br />[/quote]<br /><br />(hugs)


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You should probably add the [url=http://glitchcity.info/wiki/GB_Programming]guide to GB Programming[/url]. Helped me a ton when I started messing around with 8F codes.<br /><br />Also, the first avialable character for box names is space which is 0x7f. The corresponding instruction (ld a,a) can only be used as save passing code, but can be useful to reach certain numbers (e.g. using and).<br />Nothing major, but still a slight error. ;)


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=8126.msg207635#msg207635 date=1510060227]<br />I&#039;ve added a quick introduction to opcodes. Don&#039;t hesitate to review it! :)<br />[/quote]<br /><br />You may want to add that &quot;ret&quot; does not necessarily mean the code has ended. &quot;Ret&quot; pops the top of the stack to the pc ([b]P[/b]rogram [b]C[/b]ounter).<br /><br />So...<br /><br />Ld bc,d61a<br />Push bc<br />Ret<br /><br />...is effectively executed as...<br /><br />Jp d61a


subject: Re: The newcomer and experienced user's guide to G/S Arbitrary Code Execution!
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Haha yeah, in fact I said that &#039;I&#039;ll put some ressources about opcodes later in the guide&#039; but then totally forgot to do it&nbsp; ;D<br /><br />I&#039;ve added a few links including this one, and also the space and ret suggestions :) Thanks to both of you!<br /><br /><br />


subject: Re: The Member's Guide to Topiclessness
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Evie âœ¿ link=topic=3088.msg207629#msg207629 date=1510057826]<br />I understand this is a sensitive topic, and for some people it could bring out raw emotion. That&#039;s OK. I suggest if this makes you feel hurtful towards me, please that you let it out in a safe place like at home and not on the Internet. Thank you. :)<br />[/quote]<br /><br />Those who attack the decisions of others under the anonymitity and security of the internet likely lack the courage to do so face-to-face. Take these individuals with a grain of salt, and recall that this is [b]your[/b] decision, and the community is certainly behind you. :)


subject: Re: The Member's Guide to Topiclessness
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  [quote author=Couldntthinkofaname link=topic=3088.msg207639#msg207639 date=1510072677]<br />[quote author=Evie âœ¿ link=topic=3088.msg207629#msg207629 date=1510057826]<br />I understand this is a sensitive topic, and for some people it could bring out raw emotion. That&#039;s OK. I suggest if this makes you feel hurtful towards me, please that you let it out in a safe place like at home and not on the Internet. Thank you. :)<br />[/quote]<br /><br />Those who attack the decisions of others under the anonymitity and security of the internet likely lack the courage to do so face-to-face. Take these individuals with a grain of salt, and recall that this is [b]your[/b] decision, and the community is certainly behind you. :)<br />[/quote]<br /><br />I think so too. Sadly the hard truth is, sometimes people who identify as transgender do face discrimination, especially stereotypically from conservative and/or religious backgrounds. I&#039;m going to be brave though and I&#039;m convinced no matter hard the situation we get used to and face this in time. Many people are thankfully accepting, and others as you say may not dare to say bad things face to face. Thank you for your support Couldntthinkofaname. :)


subject: Re: The Member's Guide to Topiclessness
poster_name: realsamusaran
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m really happy for you Evie! Truthfully I&#039;m a trans woman myself, and normally wouldn&#039;t broadcast that on a forum like this due to fear of how people would react, but I thought I&#039;d mention it here since you decided to come out because I know it can suck to feel like there&#039;s nobody else with similar experiences in these types of small communities.<br /><br />I haven&#039;t been able to start hrt yet either, I&#039;m kind of afraid to because my living situation is not exactly safe or supportive. I don&#039;t really want to talk about that though.<br /><br />Unrelated to any of that, does anyone happen to know what map in PokÃ©mon Yellow has the most missable items on its list? I don&#039;t have an emulator or debugger and wouldn&#039;t know where to start or what values to look for. If I had to guess I would say the Power Plant, but I can&#039;t say for sure, so I thought I&#039;d ask. It&#039;d probably be the same for all the Gen 1 games but I&#039;m not sure about Yellow&#039;s changes.


subject: Re: Name Changes
poster_name: hpokÃ©_coloradohugge
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  old: hpokÃ©_coloradohugge<br />new: coloradohugge<br /><br />Was thinkin&#039; it was time to ditch the name of my favorite Glitch PokÃ©mon in Red/Blue. So i&#039;d rather go with my normal username I have literally everywhere else on internet (with lovercase c and all)


subject: Re: The Member's Guide to Topiclessness
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  It&#039;s good if it makes you feel fine writing this here, Evie. I don&#039;t know you for a long time and I don&#039;t know you IRL, but we&#039;ve been talking a few times (mostly about glitches, but sometimes not - I also recall that you have been checking with me after the terror attack in Paris, which was very nice to you) and even if we didn&#039;t, it would have been the same for me.<br /><br />I remember your old signature, at this time I knew you as Tom and used him/he. Then you changed it and asked for feminine pronouns. From that moment on, I used she/her and Evie. I see no reason why this should be a problem for me, why I wouldn&#039;t want to do that. I naturally switched on these because it&#039;s natural to me to do so, since it is what you feel good with :)<br /><br />I do know however that unfortunately some people won&#039;t be considering this the way I do, even though my country might be one of the less discriminative in the world (mainly because of history background but also because religion takes no part in everyday&#039;s society in France). It would be too easy to say that &#039;you must not take them into consideration&#039; because you probably already know that and it&#039;s not that simple to do, but I think you must do what makes you feel good ;)


subject: GBZ80 - Teleportation
poster_name: Th3B0r3d
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m trying to make item in PokÃ©mon red&nbsp; that after using warps to predefined location. How to do such thing in assembly? (I know how to edit item&#039;s usage but I still need code that will warp you)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [s]The likely issue is that the DMA OMA exploit was executed sometime during that particular boot of the game, and since these opcodes are executed once every frame, you may have overwritten the terminating [b]ret[/b], causing the OMA DMA to crash the game.<br /><br />Simple answer, reboot and try again. If that doesn&#039;t work, please let me know, because that would be rather odd.[/s]<br /><br />Edit: OP deleted his comment, please disregard this.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Thanks for the answer, I realized there was some mistakes, but the good code has the issue too. I correct everything, retest, then if I still have trouble I&#039;ll post again&nbsp; :P<br /><br />EDIT: I localized the issue and don&#039;t have it anymore, but still have trouble translating for some opcodes. At least now I get it, and it may be possible to finish it...


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Somehow, after 9 hours of eating asm, I did it. Many thanks to coffee and spotify!<br /><br />This is the french translation to Couldntthinkofaname&#039;s code to get any PokÃ©mon in the wild. <br />[b]EDIT : It took me 5 codes to tame the beast. Maybe it can be done with 4 codes only, but I would be surprised if it can be done with 3.[/b]<br /><br />_ means space<br />[b](ID)[/b] has to be replaced with the corresponding PokÃ©mon<br /><br />CODE 1<br />Ap0Bu&#039;U__<br />Ã©/2p0Bu&#039;r<br />Ã©,2Ã©02p_<br />0Bu&#039;pÃ©J9p<br />0(male)Ã©K9p02<br />Ã©L9p0[b](ID)[/b]Ã©A<br />pA<br /><br />Commented ASM:<br />[code]<br />WRAM1:D8C0	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8C1	F6 81		OR $81 \\ A=81<br />WRAM1:D8C3	DE 94		SBC $94 \\ A=ED : C=1<br />WRAM1:D9C5	7F		LD A,A<br />WRAM1:D9C6	7F		LD A,A<br />WRAM1:D9C7	50		LD D,B<br /><br />WRAM1:D8C8	EA F3 F8	LD $F8F3,A \\ $(F8F3)=ED<br />WRAM1:D8CB	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8CC	F6 81		OR $81 \\ A=81<br />WRAM1:D8CE	DE B1		SBC $B1 \\ A=D0 : C=1<br />WRAM1:D8D0	50		LD D,B<br /><br />WRAM1:D8D1	EA F4 F8	LD $F8F4,A \\ $(F8F4)=D0<br />WRAM1:D8D4	EA F6 F8	LD $F8F6,A \\ $(F8F6)=D0<br />WRAM1:D8D7	AF		XOR A \\ A=00 : C=0<br />WRAM1:D9D8	7F		LD A,A<br />WRAM1:D8D9	50		LD D,B<br /><br />WRAM1:D8DA	F6 81		OR $81 \\ A=81<br />WRAM1:D8EC	DE AF		SBC $AF \\ A=D2 : C=1<br />WRAM1:D8DE	EA 89 FF	LD $FF89,A \\ $(FF89)=D2<br />WRAM1:D8E1	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E2	50		LD D,B<br /><br />WRAM1:D8E3	F6 EF		OR $EF \\ A=EF<br />WRAM1:D8E5	EA 8A FF	LD $FF8A,A \\ $(FF8A)=EF<br />WRAM1:D8E8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E9	F6 F8		OR $F8 \\ A=F8<br />WRAM1:D8EB	50		LD D,B<br /><br />WRAM1:D8EC	EA 8B FF	LD $FF8B,A \\ $(FF8B)=F8<br />WRAM1:D8EF	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F0	F6 XX		OR $XX \\ A=XX<br />WRAM1:D8F2	EA 80 50	LD $D0ED,A \\ $(D0ED)=XX<br /><br />WRAM1:D8F5	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F6	80		RET NC<br />[/code]<br /><br />CODE 2<br />Ap0Bu&#039;U__<br />Ã©02p0Bu&#039;r<br />Ã©12Ã©32p_<br />0Bu&#039;pÃ©J9p<br />0(male)Ã©K9p02<br />Ã©L9p0[b](ID)[/b]u&#039;_<br />Ã©AApA<br /><br />Commented ASM:<br />[code]<br />WRAM1:D8C0	AF		XOR A&nbsp; \\ A=00 : C=0<br />WRAM1:D8C1	F6 81		OR $81 \\ A=81<br />WRAM1:D8C3	DE 94		SBC $94 \\ A=ED : C=1<br />WRAM1:D9C5	7F		LD A,A<br />WRAM1:D9C6	7F		LD A,A<br />WRAM1:D9C7	50		LD D,B<br /><br />WRAM1:D8C8	EA F6 F8	LD $F8F3,A \\ $(F8F3)=ED<br />WRAM1:D8CB	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8CC	F6 81		OR $81 \\ A=81<br />WRAM1:D8CE	DE B1		SBC $B1 \\ A=D0 : C=1<br />WRAM1:D8D0	50		LD D,B<br /><br />WRAM1:D8D1	EA F7 F8	LD $F8F4,A \\ $(F8F4)=D0<br />WRAM1:D8D4	EA F9 F8	LD $F8F6,A \\ $(F8F6)=D0<br />WRAM1:D8D7	AF		XOR A \\ A=00 : C=0<br />WRAM1:D9D8	7F		LD A,A<br />WRAM1:D8D9	50		LD D,B<br /><br />WRAM1:D8DA	F6 81		OR $81 \\ A=81<br />WRAM1:D8EC	DE AF		SBC $AF \\ A=D2 : C=1<br />WRAM1:D8DE	EA 89 FF	LD $FF89,A \\ $(FF89)=D2<br />WRAM1:D8E1	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E2	50		LD D,B<br /><br />WRAM1:D8E3	F6 EF		OR $EF \\ A=EF<br />WRAM1:D8E5	EA 8A FF	LD $FF8A,A \\ $(FF8A)=EF<br />WRAM1:D8E8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E9	F6 F8		OR $F8 \\ A=F8<br />WRAM1:D8EB	50		LD D,B<br /><br />WRAM1:D8EC	EA 8B FF	LD $FF8B,A \\ $(FF8B)=F8<br />WRAM1:D8EF	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F0	F6 XX		OR $XX \\ A=XX<br />WRAM1:D8F2	DE 7F		SBC $7F \\ A=XX-7F<br />WRAM1:D8F4	50		LD D,B<br /><br />WRAM1:D8F5	EA 80 80	LD $D0ED,A&nbsp; $(D0ED)=XX ; victoire !<br />WRAM1:D8F8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F9	80		RET NC<br />[/code]<br /><br />CODE 3:<br />Ap0Bu&#039;U__<br />Ã©02p0Bu&#039;r<br />Ã©12Ã©32p_<br />0Bu&#039;pÃ©J9p<br />0(male)Ã©K9p02<br />Ã©L9p0zu&#039;(ID)<br />Ã©AApA<br /><br />Commented ASM:<br />[code]<br />WRAM1:D8C0	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8C1	F6 81		OR $81 \\ A=81<br />WRAM1:D8C3	DE 94		SBC $94 \\ A=ED : C=1<br />WRAM1:D9C5	7F		LD A,A<br />WRAM1:D9C6	7F		LD A,A<br />WRAM1:D9C7	50		LD D,B<br /><br />WRAM1:D8C8	EA F6 F8	LD $F8F3,A \\ $(F8F3)=ED<br />WRAM1:D8CB	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8CC	F6 81		OR $81 \\ A=81<br />WRAM1:D8CE	DE B1		SBC $B1 \\ A=D0 : C=1<br />WRAM1:D8D0	50		LD D,B<br /><br />WRAM1:D8D1	EA F7 F8	LD $F8F4,A \\ $(F8F4)=D0<br />WRAM1:D8D4	EA F9 F8	LD $F8F6,A \\ $(F8F6)=D0<br />WRAM1:D8D7	AF		XOR A \\ A=00 : C=0<br />WRAM1:D9D8	7F		LD A,A<br />WRAM1:D8D9	50		LD D,B<br /><br />WRAM1:D8DA	F6 81		OR $81 \\ A=81<br />WRAM1:D8EC	DE AF		SBC $AF \\ A=D2 : C=1<br />WRAM1:D8DE	EA 89 FF	LD $FF89,A \\ $(FF89)=D2<br />WRAM1:D8E1	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E2	50		LD D,B<br /><br />WRAM1:D8E3	F6 EF		OR $EF \\ A=EF<br />WRAM1:D8E5	EA 8A FF	LD $FF8A,A \\ $(FF8A)=EF<br />WRAM1:D8E8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E9	F6 F8		OR $F8 \\ A=F8<br />WRAM1:D8EB	50			LD D,B<br /><br />WRAM1:D8EC	EA 8B FF	LD $FF8B,A =\\ $(FF8B)=F8<br />WRAM1:D8EF	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F0	F6 B9		OR $B9 \\ A=B9<br />WRAM1:D8F2	DE XX		SBC $XX \\ A=B9-XX<br />WRAM1:D8F4	50		LD D,B<br /><br />WRAM1:D8F5	EA 80 80	LD $D0ED,A \\ $(D0ED)=XX ; victoire !<br />WRAM1:D8F8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F9	80		RET NC<br />[/code]<br /><br />CODE 4:<br />Ap0Bu&#039;U__<br />Ã©02p0Bu&#039;r<br />Ã©12Ã©32p_<br />0Bu&#039;pÃ©J9p<br />0(male)Ã©K9p02<br />Ã©L9p0Au&#039;(ID)<br />Ã©AApA<br /><br />Commented ASM:<br />[code]<br />WRAM1:D8C0	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8C1	F6 81		OR $81 \\ A=81<br />WRAM1:D8C3	DE 94		SBC $94 \\ A=ED : C=1<br />WRAM1:D9C5	7F		LD A,A<br />WRAM1:D9C6	7F		LD A,A<br />WRAM1:D9C7	50		LD D,B<br /><br />WRAM1:D8C8	EA F6 F8	LD $F8F3,A \\ $(F8F3)=ED<br />WRAM1:D8CB	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8CC	F6 81		OR $81 \\ A=81<br />WRAM1:D8CE	DE B1		SBC $B1 \\ A=D0 : C=1<br />WRAM1:D8D0	50		LD D,B<br /><br />WRAM1:D8D1	EA F7 F8	LD $F8F4,A \\ $(F8F4)=D0<br />WRAM1:D8D4	EA F9 F8	LD $F8F6,A \\ $(F8F6)=D0<br />WRAM1:D8D7	AF		XOR A \\ A=00 : C=0<br />WRAM1:D9D8	7F		LD A,A<br />WRAM1:D8D9	50		LD D,B<br /><br />WRAM1:D8DA	F6 81		OR $81 \\ A=81<br />WRAM1:D8EC	DE AF		SBC $AF \\ A=D2 : C=1<br />WRAM1:D8DE	EA 89 FF	LD $FF89,A \\ $(FF89)=D2<br />WRAM1:D8E1	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E2	50		LD D,B<br /><br />WRAM1:D8E3	F6 EF		OR $EF \\ A=EF<br />WRAM1:D8E5	EA 8A FF	LD $FF8A,A \\ $(FF8A)=EF<br />WRAM1:D8E8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E9	F6 F8		OR $F8 \\ A=F8<br />WRAM1:D8EB	50		LD D,B<br /><br />WRAM1:D8EC	EA 8B FF	LD $FF8B,A \\ $(FF8B)=F8<br />WRAM1:D8EF	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F0	F6 80		OR $80 \\ A=80<br />WRAM1:D8F2	DE XX		SBC $XX \\ A=80-XX<br />WRAM1:D8F4	50		LD D,B<br /><br />WRAM1:D8F5	EA 80 80	LD $D0ED,A =&gt; $(D0ED)=XX ; victoire !<br />WRAM1:D8F8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F9	80		RET NC<br />[/code]<br /><br />CODE 5:<br />Ap0Bu&#039;U__<br />Ã©02p0Bu&#039;r<br />Ã©12Ã©32p_<br />0Bu&#039;pÃ©J9p<br />0(male)Ã©K9p02<br />Ã©L9p0(male)u&#039;(ID)<br />Ã©AApA<br /><br />Commented ASM:<br />[code]<br />WRAM1:D8C0	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8C1	F6 81		OR $81 \\ A=81<br />WRAM1:D8C3	DE 94		SBC $94 \\ A=ED : C=1<br />WRAM1:D9C5	7F		LD A,A<br />WRAM1:D9C6	7F		LD A,A<br />WRAM1:D9C7	50		LD D,B<br /><br />WRAM1:D8C8	EA F6 F8	LD $F8F3,A \\ $(F8F3)=ED<br />WRAM1:D8CB	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8CC	F6 81		OR $81 \\ A=81<br />WRAM1:D8CE	DE B1		SBC $B1 \\ A=D0 : C=1<br />WRAM1:D8D0	50		LD D,B<br /><br />WRAM1:D8D1	EA F7 F8	LD $F8F4,A \\ $(F8F4)=D0<br />WRAM1:D8D4	EA F9 F8	LD $F8F6,A \\ $(F8F6)=D0<br />WRAM1:D8D7	AF		XOR A \\ A=00 : C=0<br />WRAM1:D9D8	7F		LD A,A<br />WRAM1:D8D9	50		LD D,B<br /><br />WRAM1:D8DA	F6 81		OR $81 \\ A=81<br />WRAM1:D8EC	DE AF		SBC $AF \\ A=D2 : C=1<br />WRAM1:D8DE	EA 89 FF	LD $FF89,A \\ $(FF89)=D2<br />WRAM1:D8E1	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E2	50		LD D,B<br /><br />WRAM1:D8E3	F6 EF		OR $EF \\ A=EF<br />WRAM1:D8E5	EA 8A FF	LD $FF8A,A \\ $(FF8A)=EF<br />WRAM1:D8E8	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8E9	F6 F8		OR $F8 =&gt; A=F8<br />WRAM1:D8EB	50		LD D,B<br /><br />WRAM1:D8EC	EA 8B FF	LD $FF8B,A \\ $(FF8B)=F8<br />WRAM1:D8EF	AF		XOR A \\ A=00 : C=0<br />WRAM1:D8F0	F6 EF		OR $EF \\ A=EF<br />WRAM1:D8F2	DE XX		SBC $XX \\ A=EF-XX<br />WRAM1:D8F4	50		LD D,B<br /><br />WRAM1:D8F5	EA 80 80	LD $D0ED,A =&gt; $(D0ED)=XX ; victoire !<br />WRAM1:D8F8	AF			XOR A =&gt; A=00 : C=0<br />WRAM1:D8F9	80			RET NC<br />[/code]<br /><br />Here is the table of the PokÃ©mon you can get per table. For codes 3 to 5 I only wrote the PokÃ©mon that are not in the previous columns :<br />https://pastebin.com/W9Pe82uG


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Thanks Couldntthinkofaname! I&#039;ve updated the previous post with the codes and asm.<br /><br />[b]Below is the variant of Crystal_&#039;s OAM DMA Hijacking method adapted from MAP&#039;s pastebin. I cut it from the guide, and link it from there to here, so both methods are given with links.[/b]<br /><br />[quote]Use &#039;IV.2: GET ANY TM/HM x255 CODE&#039; to get TM09, unless you already have it.<br /><br />Give TM09 to hold to Quagsire, instead of TM02, and save.<br /><br />Rename Box 2 to Box 10 as follows:<br />p&#039;va&#039;vbÃ©!2 (english game) or pÂ°aÂ°bÃ©!2 (italian and spanish game)<br />&#039;v[Ã©?2&#039;v85 (english game) or Â°[Ã©?2Â°85 (italian and spanish game)<br />Ã©22&#039;v3Ã©02 (english game) or Ã©22Â°3Ã©02 (italian and spanish game)<br />hhh222hh<br />&#039;s82hhhÃ©Ã© (english game) or Ã³82hhhÃ©Ã© (italian and spanish game)<br />&#039;d2G2h&#039;d (english game) or Ã¬2G2hÃ¬ (italian and spanish game)<br />&#039;s02hÃ©,2h (english game) or Ã³02hÃ©,2h (italian and spanish game)<br />&#039;s02hÃ©/2h (english game) or Ã³02hÃ©/2h (italian and spanish game)<br />&#039;s02&#039;d (english game) or Ã³02Ã¬ (italian and spanish game)<br />NOTE: As of now, to my knowledge there is no equivalent to this for french games.<br /><br />Save.<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow: !.22]]<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow: !.23__ while replacing __ by the characters corresponding to the wanted PokÃ©mon in the following table (Pk and Mn are available symbols, not &quot;P followed by k&quot;):<br />AA	????? (nÂ°000)<br />AB	Bulbasaur<br />BB	Ivysaur<br />BC	Venusaur<br />CC	Charmander<br />CD	Charmeleon<br />DD	Charizard<br />DE	Squirtle<br />EE	Wartortle<br />EF	Blastoise<br />FF	Caterpie<br />FG	Metapod<br />GG	Butterfree<br />GH	Weedle<br />HH	Kakuna<br />HI	Beedrill<br />II	Pidgey<br />IJ	Pidgeotto<br />JJ	Pidgeot<br />JK	Rattata<br />KK	Raticate<br />KL	Spearow<br />LL	Fearow<br />LM	Ekans<br />MM	Arbok<br />MN	Pikachu<br />NN	Raichu<br />NO	Sandshrew<br />OO	Sandslash<br />OP	Nidoranâ™€<br />PP	Nidorina<br />PQ	Nidoqueen<br />QQ	Nidoranâ™‚<br />QR	Nidorino<br />RR	Nidoking<br />RS	Clefairy<br />SS	Clefable<br />ST	Vulpix<br />TT	Ninetales<br />TU	Jigglypuff<br />UU	Wigglytuff<br />UV	Zubat<br />VV	Golbat<br />VW	Oddish<br />WW	Gloom<br />WX	Vileplume<br />XX	Paras<br />XY	Parasect<br />YY	Venonat<br />YZ	Venomoth<br />ZZ	Diglett<br />Z(	Dugtrio<br />((	Meowth<br />()	Persian<br />))	Psyduck<br />):	Golduck<br />::	Mankey<br />:;	Primeape<br />;;	Growlithe<br />;[	Arcanine<br />[[	Poliwag<br />&#91;]	Poliwhirl<br />]]	Poliwrath<br />]a	Abra<br />aa	Kadabra<br />ab	Alakazam<br />bb	Machop<br />bc	Machoke<br />cc	Machamp<br />cd	Bellsprout<br />dd	Weepinbell<br />de	Victreebel<br />ee	Tentacool<br />ef	Tentacruel<br />ff	Geodude<br />fg	Graveler<br />gg	Golem<br />gh	Ponyta<br />hh	Rapidash<br />hi	Slowpoke<br />ii	Slowbro<br />ij	Magnemite<br />jj	Magneton<br />jk	Farfetch&#039;d<br />kk	Doduo<br />kl	Dodrio<br />ll	Seel<br />lm	Dewgong<br />mm	Grimer<br />mn	Muk<br />nn	Shellder<br />no	Cloyster<br />oo	Gastly<br />op	Haunter<br />pp	Gengar<br />pq	Onix<br />qq	Drowzee<br />qr	Hypno<br />rr	Krabby<br />rs	Kingler<br />ss	Voltorb<br />st	Electrode<br />tt	Exeggcute<br />tu	Exeggutor<br />uu	Cubone<br />uv	Marowak<br />vv	Hitmonlee<br />vw	Hitmonchan<br />ww	Lickitung<br />wx	Koffing<br />xx	Weezing<br />xy	Rhyhorn<br />yy	Rhydon<br />yz	Chansey<br />zz	Tangela<br />?N	Kangaskhan<br />?O	Horsea<br />?P	Seadra<br />?Q	Goldeen<br />?R	Seaking<br />?S	Staryu<br />?T	Starmie<br />?U	Mr. Mime<br />?V	Scyther<br />?W	Jynx<br />?X	Electabuzz<br />?Y	Magmar<br />?Z	Pinsir<br />?(	Tauros<br />?)	Magikarp<br />?:	Gyarados<br />?;	Lapras<br />?[	Ditto<br />?]	Eevee<br />?a	Vaporeon<br />?b	Jolteon<br />?c	Flareon<br />?d	Porygon<br />?e	Omanyte<br />?f	Omastar<br />?g	Kabuto<br />?h	Kabutops<br />?i	Aerodactyl<br />?j	Snorlax<br />?k	Articuno<br />?l	Zapdos<br />?m	Moltres<br />?n	Dratini<br />?o	Dragonair<br />?p	Dragonite<br />?q	Mewtwo<br />?r	Mew<br />?s	Chikorita<br />?t	Bayleef<br />?u	Meganium<br />?v	Cyndaquil<br />?w	Quilava<br />?x	Typhlosion<br />?y	Totodile<br />?z	Croconaw<br />9b	Feraligatr<br />9c	Sentret<br />9d	Furret<br />9e	Hoothoot<br />9f	Noctowl<br />9g	Ledyba<br />9h	Ledian<br />9i	Spinarak<br />9j	Ariados<br />9k	Crobat<br />9l	Chinchou<br />9m	Lanturn<br />9n	Pichu<br />9o	Cleffa<br />9p	Igglybuff<br />9q	Togepi<br />9r	Togetic<br />9s	Natu<br />9t	Xatu<br />9u	Mareep<br />9v	Flaaffy<br />9w	Ampharos<br />9x	Bellossom<br />9y	Marill<br />9z	Azumarill<br />&#039;r?	Sudowoodo<br />&#039;s?	Politoed<br />&#039;t?	Hoppip<br />&#039;v?	Skiploom<br />&#039;v!	Jumpluff<br />&#039;v.	Aipom<br />&#039;v&amp;	Sunkern<br />&#039;vÃ©	Sunflora<br />&#039;m$	Yanma<br />PkPk	Wooper<br />PkMn	Quagsire<br />MnMn	Espeon<br />Mn-	Umbreon<br />--	Murkrow<br />Pk?	Slowking<br />Mn?	Misdreavus<br />-?	Unown<br />-!	Wobbuffet<br />Mn&amp;	Girafarig<br />??	Pineco<br />?!	Forretress<br />!!	Dunsparce<br />!.	Gligar<br />..	Steelix<br />.&amp;	Snubbull<br />&amp;&amp;	Granbull<br />MnÃ—	Qwilfish<br />Pk/	Scizor<br />Pk,	Shuckle<br />Pkâ™€	Heracross<br />Pk0	Sneasel<br />Mn0	Teddiursa<br />?/	Ursaring<br />?,	Slugma<br />?â™€	Magcargo<br />?0	Swinub<br />!0	Piloswine<br />.0	Corsola<br />.1	Remoraid<br />.2	Octillery<br />.3	Delibird<br />.4	Mantine<br />.5	Skarmory<br />.6	Houndour<br />.7	Houndoom<br />.8	Kingdra<br />.9	Phanpy<br />â™‚3	Donphan<br />â™‚4	Porygon2<br />â™‚5	Stantler<br />â™‚6	Smeargle<br />00	Tyrogue<br />01	Hitmontop<br />11	Smoochum<br />12	Elekid<br />22	Magby<br />23	Miltank<br />33	Blissey<br />34	Raikou<br />44	Entei<br />45	Suicune<br />55	Larvitar<br />56	Pupitar<br />66	Tyranitar<br />67	Lugia<br />77	Ho-oh<br />78	Celebi<br />88	????? (nÂ°252)<br />89	Egg<br />99	????? (nÂ°254)<br /> A	????? (nÂ°255) (Be careful, there&#039;s a space before A)<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow: !.33â™‚5 <br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow: !.3401<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow: !.44..<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow: !.45-?<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow:&nbsp; A?e22 (Be careful, there&#039;s a space before A)<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow:&nbsp; A?f!. (Be careful, there&#039;s a space before A)<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case).<br /><br />Rename Box 1 (using Wrong Pocket TM ACE) or Box 9 (using Coin Case ACE) as follow:&nbsp; A?dPkMn (Be careful, there&#039;s a space before A ; Also, Pk and Mn are available symbols, not &quot;P followed by k&quot;)<br /><br />Use TM17 from the Wrong Pocket (or follow step 4 to 8 in chapter II if you use Coin Case) while making sure the &#039;Slide PokÃ©mon&#039; and Quagsire with RETURN and TM09 are placed in the right spots (1 and 2 for TM ACE, 3 and 4 for Coin Case). The wanted PokÃ©mon can now be found in the wild with a 100% encounter rate.[/quote]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misdreavus
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  @Skreef That worked; thanks.<br /><br />What would my pack setup be to modify a PokÃ©mon&#039;s DVs to a number of my choice (not necessarily max)?<br /><br />Also, does anyone know why I wouldn&#039;t be allowed to re-nickname the in-game trade Jynx after using ACE to change my trainer name to TRAINER and my ID to match its ID?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m curious Misdreavus, why do you want to do that? Just seems the effort to keep changing the ID and player name to attempt to nickname traded Pokemon to make them your own(?) is a bit over the top. When you can just get Jynx for example, with trainer fly with much less effort.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Misdreavus link=topic=6638.msg207655#msg207655 date=1510291084]<br />@Skreef That worked; thanks.<br /><br />What would my pack setup be to modify a PokÃ©mon&#039;s DVs to a number of my choice (not necessarily max)?<br />[/quote]<br /><br />As for any other thing you may want to do with 8F, you can just use the [url=http://forums.glitchcity.info/index.php?topic=6638.msg189609.html#msg189609]single-address value memory changing code[/url] multiple times, using the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Player]addresses that match the DV of the given PokÃ©mon[/url] :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Misdreavus link=topic=6638.msg207655#msg207655 date=1510291084]<br />Also, does anyone know why I wouldn&#039;t be allowed to re-nickname the in-game trade Jynx after using ACE to change my trainer name to TRAINER and my ID to match its ID?<br />[/quote]<br /><br />Actually you can do this, but there is one complication. The name TRAINER doesn&#039;t consist of each individual letter, but rather the 5D control character (TRAINER) followed by 10 0x50 terminators.<br /><br />Using 93 91 80 88 8D 84 91 50 00 00 00 won&#039;t work because it doesn&#039;t match how TRAINER in in-game trade PokÃ©mon is internally stored. To get it to work you need to use 5D 50 50 50 50 50 50 50 50 50 50 instead.<br /><br />Hope this helps.


subject: Re: Does Abwayax still check on this place?
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=7960.msg207659#msg207659 date=1510324014]<br />i&#039;m gonna sneak this in here before the thread gets locked because why not.<br />[/quote]<br /><br />OP hasn&#039;t been active in a while, this thread may never be locked at all.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  As a resident german person here is a pc item code to give you 255 of every TM/HM so you can use them to write your code.<br />Don&#039;t know if this will work on every european language, but it was the same for german and english so there is a good chance that it will work.<br />A bit expensive to set up (32 Carbos, etc.), you need TM10 and TM22 which you can only get once and one Lucky Egg which is awful to get without glitches, but at least you can get an easier medium to write Code with.<br /><br />Location to find some of the more specific items:<br />[list]<br />	[li]Carbos: buy for $9800 in Goldenrod/Celadon City[/li]<br />	[li]Lucky Egg: steal from wild Chansey[/li]<br />	[li]TM10: Lake of Rage, gift from a guy in the house North West[/li]<br />	[li]TM22: Route 27, behind a Whirlpool thingy[/li]<br />	[li]Energypowder: Buy in Goldenrod City Underground every Sunday (maybe also Saturday) from the Old Lady[/li]<br />[/list]<br /><br /><br />Use wrong-pocket TM execution with a Quagsire holding HP-Up with Sleep Talk as its first move. To get a TM in the wrong pocket use this [url=http://forums.glitchcity.info/index.php?topic=8109.0]guide by luckytyphlosion[/url].<br />Arrange the Items in your PC in the following way:<br />[code]<br />Any x Any<br />Any x 03<br />Full Restore x 01<br />Paralyz Heal x 13<br />Energypowder x 30<br />Exp_Share x 01<br />Any x Any<br />PokÃ© Ball x 38<br />TM22 x 01<br />Any x Any<br />Great Ball x 46<br />Revival Herb x 03<br />Dire Hit x 44<br />Awakening x 34<br />Ice Heal x 03<br />Carbos x 32<br />HM07 x 01<br />Any x Any<br />TM10 x Any<br />[/code]<br /><br />German Item names:<br />[code]<br />Any x Any<br />Any x 03<br />Top Genesung x 01<br />Para-Heiler x 13<br />Energiestaub x 30<br />EP-Teiler x 01<br />Any x Any<br />PokÃ©ball x 38<br />TM22 x 01<br />Any x Any<br />Superball x 46<br />Vitalkraut x 03<br />Angriffsplus x 44<br />Aufwecker x 34<br />Eisheiler x 03<br />Carbon x 32<br />VM07 x 01<br />Any x Any<br />TM10 x Any<br />[/code]<br /><br />Corresponding ASM code (everytime register b and/or c are used is filler code):<br />[code]<br />INC BC<br />LD C, 01<br />DEC C<br />DEC C<br />LD A, C<br />LD E, 39<br />LD BC, ...<br />DEC B<br />LD H, d5<br />LD BC, ...<br />INC B<br />LD L, 7c<br />INC L<br />INC L<br />INC C<br />LD [HL+], A<br />DEC BC<br />INC BC<br />DEC E<br />JR NZ, f9<br />LD BC, ...<br />RET<br />[/code]<br /><br />Afterwards, teach your Quagsire Attract (TM45) as its first move and make it hold a Lucky Egg. Your code will then be executed starting from the quantity of TM01 in your TM pocket. Write it by keeping/depositing the desired amount.<br />


subject: Re: GBZ80 - Teleportation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  I have an answer that&#039;s incomplete as I don&#039;t actually know without further research how to properly execute this either, sorry.<br /><br />However you can try:<br /><br />ld a,([url=https://bulbapedia.bulbagarden.net/wiki/List_of_locations_by_index_number_(Generation_I)]map ID[/url])<br />ld (d35e),a<br />ld h, d3<br />ld l, 6e<br />ld a,41<br />ld (hli),a<br />ld a,12 [1241 is LoadMapData in pokered disassembly]<br />ld (hli),a<br />ret<br /><br />After closing the menu, this will warp you anywhere but Glitch Cities may appear depending on exactly where you warped from. Refreshing the map is also possible by placing X Attack x18 into item 41 (level-script pointer, D36E-D36F) and the map&#039;s ID into item 33 (D35E).<br /><br />For more complex purposes, as Glitch Cities can appear depending on where you warp from, you may have to specify the data for these addresses in some way or get the game to look them up:<br /><br />D35F-D360 = Top-left block pointer<br />D361 - 1 byte integer = Current Player Y-Position<br />D362 - 1 byte integer = Current Player X-Position<br />D363 = Current Player Y-Position (Current Block)<br />D364 = Current Player X-Position (Current Block)<br />D3B1 = Entrance position ID (affects D35F-D360)<br />D3B5 = Entrance position ID (affects D35F-D360)<br /><br />(Note all of these addresses (for Red/Blue) are -1 in Yellow)<br /><br />If you just want to warp and don&#039;t mind having to walk through the exit of a door, you can modify D365. This address is the location specific exits like those from PokÃ©mon Centers and many houses take you. But the entrance position ID stays the same as the one from the original map, so you&#039;ve got to find one that works, use cheat code 010xxB5D3 01xxB1D3 to modify the entrance position ID, or alternatively do this:<br /><br />Change D3B1 to the entrance position ID (e.g. 01).<br />Change D3B2 to the desired map (or FF for the map stored in D365).<br /><br />Then you need to walk through the first warp of the building. (In a PokÃ©mon Center this should be the left-side of the exit mat).<br /><br />Also for what it&#039;s worth D3AF-D3B0 are the y and x-coordinates of the warp, but you&#039;ll need a proper map tile for this to work.<br /><br />Hope this helps and I hope somebody with better coding knowledge than me is able to assist. :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The only issue I see with that is the difficulty in obtaining the Lucky Egg. I managed to get one in my playthrough but that was like my first time ever getting it. In G/S, it&#039;s 1% for Chansey to appear and 8% chance for it to be holding a Lucky Egg.<br /><br />Here&#039;s a tip though: On Route 13 in G/S, Chansey comes at level 25, the highest level of Pokemon you can find on this route is 25 (unlike Crystal where the highest is 27). So by putting a Pokemon level 25 at the top of the party and use a Max Repel, you avoid the low level encounters and increase the chances of encountering a Chansey. It&#039;s a good tip in general for hunting the annoying 1% encounter rate Pokemon. 


subject: Death
poster_name: TheGameGlitcher
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  This place looks dead af, so I have a suggestion.<br /><br />Lets band together and make a discord.<br /><br />A proper server for glitching PokÃ©mon. I could throw together one now if enough people say they would join. :P<br />


subject: Re: Death
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Abwayax
icon: xx
body:
  We have this server already (although I don&#039;t know if it&#039;s what you were looking for).<br /><br />If you&#039;re interested, feel free to pop in. :)<br /><br />http://forums.glitchcity.info/index.php?board=118.0


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  True, but I didn&#039;t find a way around it at first.<br />Looked into it again and found a way using Revival Herb (Vitalkraut; same place as energypowder) and Dire Hit (Angriffsplus). :)<br />I&#039;ll update the original post with the change.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Would anyone happen to know of a reference to the German/French charset? I would be happy to assist with translations but unfortunately I only own the English copies of G/S.<br /><br />From what I understand, it is increasingly difficult to code for the German charset due to a lack of certain characters, but I am uncertain.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [url=http://forums.glitchcity.info/index.php?topic=8097.msg207116#msg207116]Here[/url] is one, but it doesn&#039;t account for non-input, but representable characters (e.g. [b]Ã©[/b] is not available in german, [b]&#039;[/b] is not available in english).<br /><br />I doubt box name codes are possible in German if they want to do more than calling/jumping to pre-existing code.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207670#msg207670 date=1510354243]<br />[url=http://forums.glitchcity.info/index.php?topic=8097.msg207116#msg207116]Here[/url] is one, but it doesn&#039;t account for non-input, but representable characters (e.g. [b]Ã©[/b] is not available in german, [b]&#039;[/b] is not available in english).<br /><br />I doubt box name codes are possible in German if they want to do more than calling/jumping to pre-existing code.<br />[/quote]<br /><br /><br />Ah, I see. Thanks for the reference!<br /><br />I may begin translating some of my codes to French as soon as wrap up my [s]suprise[/s] [url=https://youtu.be/eouJy9poa20]released[/url] 8f project. 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The character set in french is available in this pastebin: https://pastebin.com/W9Pe82uG<br /><br />Having spent a whole day translating your catch any PokÃ©mon code to french, I can relate that it&#039;s annoying af. Most times you can replace sub by sbc because the carry flag is not set, but the lack of ret nc could be a problem (you&#039;ll have to use ret c or reti). Sometimes, there is no easy solution and the whole thing has to be remade. If you eventually find the courage to do it, that would be great for us frenchies :D&nbsp; 


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207662#msg207662 date=1510330853]<br />As a resident german person here is a pc item code to give you 255 of every TM/HM so you can use them to write your code.<br />Don&#039;t know if this will work on every european language, but it was the same for german and english so there is a good chance that it will work.<br />[/quote]<br /><br />Kind of confused here.<br />To get enough money for 44 Dire Hits I continued playing (up to defeating Red) and the code suddenly stopped working.<br />Also, using a Lucky Egg-Attract-Quagsire with a simple return code (201 of TM01) crashed my game.<br /><br />To me this looks like the memory address for TM quantities was changed, but I somehow doubt Nintendo would do this. Need to look a bit more into this one. I&#039;m using VC version so far btw., will try on emulator to check what&#039;s going on here.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misdreavus
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Misdreavus
icon: xx
body:
  [quote author=Nostalgia link=topic=6638.msg207656#msg207656 date=1510306386]<br />I&#039;m curious Misdreavus, why do you want to do that? Just seems the effort to keep changing the ID and player name to attempt to nickname traded Pokemon to make them your own(?) is a bit over the top. When you can just get Jynx for example, with trainer fly with much less effort.<br />[/quote]Well, I haven&#039;t experimented with the Trainer Fly glitch before outside of getting Mew (it&#039;s the glitch that&#039;s the basis of the famous Mew glitch, right?), so it didn&#039;t really occur to me.&nbsp; Good idea though... perhaps I&#039;ll look into it.<br /><br />EDIT:<br /><br />[quote author=Krys3000 link=topic=6638.msg207657#msg207657 date=1510308522]<br />[quote author=Misdreavus link=topic=6638.msg207655#msg207655 date=1510291084]<br />@Skreef That worked; thanks.<br /><br />What would my pack setup be to modify a PokÃ©mon&#039;s DVs to a number of my choice (not necessarily max)?<br />[/quote]<br /><br />As for any other thing you may want to do with 8F, you can just use the [url=http://forums.glitchcity.info/index.php?topic=6638.msg189609.html#msg189609]single-address value memory changing code[/url] multiple times, using the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Player]addresses that match the DV of the given PokÃ©mon[/url] :)<br />[/quote]Thanks.&nbsp; <br /><br />from 2nd link:<br />DAB1 - Attack/Defense IV<br />DAB2 - Speed/Special IV<br /><br />Let&#039;s say I want to set my Chansey&#039;s DVs to 8/15/15/15.&nbsp; (That&#039;s a legal R/B/Y spread for that PokÃ©mon that doesn&#039;t compromise Defense, Speed, or Special.)&nbsp; My code for the Attack and Defense DVs would be:<br /><br />Item 1: any item<br />Item 2: 8F<br />Item 3: Lemonade x143 (8 Attack, F [15] Defense)<br />Item 4: X Accuracy x177 (decimal equivalent of B1)<br />Item 5: Carbos x218 (decimal equivalent of DA)<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br />Is this correct?&nbsp; Would I just set this up and use 8F once?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [S]It&#039;s unlikely Nintendo would think to change TM addresses, and from what i&#039;ve seen from the G/S disassembly there is no script capable of doing so.<br /><br />Here are a few possibilites:<br /><br />1. If you allowed mom to save your money, she likely bought an object that screwed up the opcodes.<br />2.Your slide stopped working due to happiness/EVs<br /><br /><br />Regarding the game crash, it&#039;s likely the latter issue. Slide PokÃ©mon will eventually stop working once they reach a specific opcode, specifically $10 (stop command), and anything else that otherwise messes with the stack, jumps to unrelated code, etc.<br /><br />Hope this helps resolve the issue :)[/s]<br /><br />Edit: Disregard this, apparently memory does indeed shift in the UE releases.<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The memory is shifted in UE releases. Not sure how exactly, though, but it&#039;s definitely shifted.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s very interesting, I have never seen anything similar on any other gameboy title. Maybe this was designed to discourage use of the GameShark?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Nostalgia
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Misdreavus link=topic=6638.msg207674#msg207674 date=1510364296]<br />Well, I haven&#039;t experimented with the Trainer Fly glitch before outside of getting Mew (it&#039;s the glitch that&#039;s the basis of the famous Mew glitch, right?), so it didn&#039;t really occur to me.&nbsp; Good idea though... perhaps I&#039;ll look into it.<br />[/quote]<br /><br />Well if you just want a regular Jynx, Trainer-Fly is the way to go. Use this map for a guide: https://puu.sh/257S A quick look at the map now shows a swimmer south of Pallet Town yields a Jynx with the Trainer-Fly glitch.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  No, it&#039;s actually very often that Europe releases have a slightly different memory layout than US releases. This is the case for all PokÃ©mon games (at least until Gen IV), as well as other GB titles, which I&#039;m not going to list because :p


subject: A minimalistic (yet functional) Pseudo-Gameshark GUI with 8f
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  Hey all. Recently, I&#039;ve been developing a program that allows you to enter in codes at your disposal; similar to that of a gameshark.<br /><br />Conveying the concept into words is difficult, so instead I have provided a [url=https://youtu.be/eouJy9poa20]video demonstration[/url] as well as some attached photos. [b]Nota bene[/b], the youtube video is inaccurate, as it demonstrates that the volume is muted (this has been changed), and it claims that the program must be written at $D8C5 (this has been fixed, it now can fit into $D901) <br /><br />Basically, it&#039;s a GUI that acts as a memory editor, allowing you to change any byte in memory that you desire.<br /><br />To use, first write [url=https://pastebin.com/ks7biiww]these bytes[/url] at $D901 (if you&#039;re on hardware, this can be done with [url=http://glitchcity.info/wiki/Executing_large_programs_with_arbitrary_code_execution]this[/url] RAM writer)<br /><br />Then, arrange your bag as the following:<br />8f<br />Any Item<br />Carbos&nbsp;  x217<br />X Accuracy&nbsp;  x1<br />TM33&nbsp; &nbsp;  xany<br /><br />After this, arrange your party in the usual 8f bootstrapping format. Once this has been accomplished, you now have a Pseudo-Gameshark program at your disposal :).<br /><br />Syntax goes as follows:<br />First 2 characters = Byte to write<br />Second 2 characters = Low byte of address<br />Final 2 characters = High byte of address<br /><br />Here are some codes for use with this (note that if there are more than one lines of code, this means the program is used once for each line):<br /><br />x255 Master Balls in slot 2<br />0120D3<br />FF21D3<br /><br />Encounter any Pokemon<br />XX59D0<br /><br />Replace XX with the SpeciesId<br /><br />Walk through walls <br />0138CD<br /><br />... and many more is possible with this program.<br /><br />Here are the known drawbacks<br /><br />-Encountering any trainer overwrites $D901 (unfortuantely there isn&#039;t much I can do regarding this :( )<br />-This program is rather large. If you&#039;re planning on writing this on hardware, ensure you have at least an hour to spare<br />-It&#039;s impractical<br /><br />I understand the impracticality of this, and frankly this was more of &quot;for the lulz&quot; project more than anything. But if you like this idea,feel free to try it out.<br /><br />[url=https://pastebin.com/S03jXTU2]Here&#039;s the source[/url] for anyone who&#039;s interested.<br />


subject: Re: A minimalistic (yet functional) Pseudo-Gameshark GUI with 8f
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Parzival link=topic=8133.msg207681#msg207681 date=1510444783]<br />DebugYellow&#039;s would work well. Go copy that. :P<br />seriously nice job tho<br />[/quote]<br /><br />Wait, this was already done?! Welp, there goes my weekend project :P<br /><br />If you wouldn&#039;t mind, would you please link me to the original post?


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  What confuses me here is that it worked before (with the Lucky Egg, but even that version stopped working) and suddenly stopped after beating a bunch of gym leaders, elite 4 and red (iirc).<br />Also, from what I have seen with my limited knowledge using BGB TMs seem to be in the same location.<br /><br />Anyway, here is an PC Item code (Quagsire, HP-Up, Sleep Talk) to give you lot&#039;s of money. Basically sets the first money byte ($d573) to ff.<br />Should make aquiring the Carbos a bit easier.<br />[code]<br />Any x Any<br />Any x 03<br />Full Restore x 01<br />Paralyz Heal x 13<br />Energypowder x 38<br />TM22 x 01<br />Any x Any<br />PokÃ© Ball x 46<br />Rage Cany Bar x 44<br />Great Ball x 34<br />TM10 x Any<br />[/code]<br /><br />ASM representation:<br />[code]<br />INC BC<br />LD C, 01<br />DEC C<br />DEC C<br />LD A, C<br />LD H, d5<br />LD BC, ...<br />DEC B<br />LD L, 72<br />INC L<br />INC B; LD [HL+], A<br />RET<br />[/code]<br /><br /><br />Reset my VC savegame (well, one of them) to test a bit more. This one worked on german Silver VC version.<br /><br />Edit:<br />Maximize TM-quantities worked as well.<br />Guess it&#039;s time to beat up Red again and see if VC is weird and it will stop working again. â€¾\(-[color=black]_[/color]-)/â€¾


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Just noticed, that you can input a lot more characters when writing a mail.<br />Since it is stored in SRAM ([url=https://github.com/pret/pokecrystal/blob/master/sram.asm]according to this[/url] at least in Crystal and I would assume it&#039;s similar in gold/silver) and I remember reading somewhere that there are some problems with in conserning VC I&#039;m not too sure how useful this really is.<br />At least I found a place where I can input [b]Ã©[/b] in german version. I even found an [b]Ã¯[/b] character (two dots i for double the fun&nbsp; 8)).


subject: Re: A minimalistic (yet functional) Pseudo-Gameshark GUI with 8f
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not exactly like yours, it&#039;s an entire suite of shit but it includes a memory writer too.<br />As for the link, I don&#039;t have it. Go poke through TheZZAZZGlitch&#039;s youtube channel until you find it, it&#039;s got its own video in everything.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Parzival
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Parzival
icon: xx
body:
  VC + SRAM exec = VC freaks the hell out, crashes, then erases your save next boot. Source: ISSOtm&#039;s testing.


subject: Re: A minimalistic (yet functional) Pseudo-Gameshark GUI with 8f
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  Ah, I believe I may know what you&#039;re referring to. It was probably [url=https://youtu.be/BkIDPwkeGWs]this[/url] ROM hack.<br /><br />My project was an attempt at making a similar memory writer without manipulating the ROM in any way, using 100% 8f exploits, which allows the program to be written on a real cartridge (provided you have an hour to spare lol). I wasn&#039;t necessarily aiming for practicality, I was instead demonstrating for myself (and hopefully others) the limits of 8f.<br /><br />Thank you for pointing that out, however. I had found ZZAZZ&#039;s debug menu a few years back but had forgotten about it since. 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  [quote author=Misdreavus link=topic=6638.msg207674#msg207674 date=1510364296]<br />[quote author=Krys3000 link=topic=6638.msg207657#msg207657 date=1510308522]<br />[quote author=Misdreavus link=topic=6638.msg207655#msg207655 date=1510291084]<br />@Skreef That worked; thanks.<br /><br />What would my pack setup be to modify a PokÃ©mon&#039;s DVs to a number of my choice (not necessarily max)?<br />[/quote]<br /><br />As for any other thing you may want to do with 8F, you can just use the [url=http://forums.glitchcity.info/index.php?topic=6638.msg189609.html#msg189609]single-address value memory changing code[/url] multiple times, using the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Player]addresses that match the DV of the given PokÃ©mon[/url] :)<br />[/quote]Thanks.&nbsp; <br /><br />from 2nd link:<br />DAB1 - Attack/Defense IV<br />DAB2 - Speed/Special IV<br /><br />Let&#039;s say I want to set my Chansey&#039;s DVs to 8/15/15/15.&nbsp; (That&#039;s a legal R/B/Y spread for that PokÃ©mon that doesn&#039;t compromise Defense, Speed, or Special.)&nbsp; My code for the Attack and Defense DVs would be:<br /><br />Item 1: any item<br />Item 2: 8F<br />Item 3: Lemonade x143 (8 Attack, F [15] Defense)<br />Item 4: X Accuracy x177 (decimal equivalent of B1)<br />Item 5: Carbos x218 (decimal equivalent of DA)<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br />Is this correct?&nbsp; Would I just set this up and use 8F once?<br />[/quote]<br /><br />Provided that your game is an english R/B (otherwise, addresses would be $DAB6 and $DAB7 in european non-english R/B, $DAB0 and $DAB1 in english yellow, and $DAB5 and $DAB6 in european non-english yellow) then yes this would be exactly what you have to do. Change the values to 255/178/218 and use 8F a second time for the Speed/Special IVs :) (don&#039;t forget your PokÃ©mon setup though)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As I&#039;ve seen only matches between US memory addresses and european ones (as well as codes working in both) I&#039;m interested in knowing exactly what is shifted, because I honestly didn&#039;t know that&nbsp; :???:


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=6716.msg207689#msg207689 date=1510487559]<br />As I&#039;ve seen only matches between US memory addresses and european ones (as well as codes working in both) I&#039;m interested in knowing exactly what is shifted, because I honestly didn&#039;t know that&nbsp; :???:<br />[/quote]<br /><br />I&#039;m also interested, as making code translations into French is going to be difficult if I can&#039;t pinpoint exactly what i&#039;m editing.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=Parzival link=topic=6716.msg207686#msg207686 date=1510457234]<br />VC + SRAM exec = VC freaks the hell out, crashes, then erases your save next boot. Source: ISSOtm&#039;s testing.<br />[/quote]<br /><br />Ok, so utterly impossible to use this. Thanks.<br />I knew reading something like this before, but wasn&#039;t sure.<br /><br />[quote author=Krys3000 link=topic=6716.msg207689#msg207689 date=1510487559]<br />As I&#039;ve seen only matches between US memory addresses and european ones (as well as codes working in both) I&#039;m interested in knowing exactly what is shifted, because I honestly didn&#039;t know that&nbsp; :???:<br />[/quote]<br /><br />From what I&#039;ve seen so far you have to be careful with codes that call something.<br />Party-PokÃ©mon, Money, Items, PC-Items, etc. seem to be in the same location. So most codes that write stuff directly should be fine.<br />Had some issues with TM-quantities though, but I still need to confirm if that was just VC being weird, me being stupid or a real issue.<br />Also, stuff like Room decorations, Trainer-ID etc. might be different. Haven&#039;t looked into this one. Same for any OAM DMA loop codes.<br /><br /><br />Edit:<br />To add to my previous posts, here is an PC Item Code for wrong-pocket TM execution to change the Item of your first party pokÃ©mon to a Lucky Egg.<br />[code]<br />Give Lucky Egg to first PokÃ©mon ($da2b):<br />Any x Any<br />Any x 3				INC BC<br />PokÃ© Ball x 38		DEC B; LD H, da<br />TM27 x 3			INC BC<br />Fresh Water x 43	LD HL, 2b<br />Great Ball x 22		INC B; LD D, 7c<br />Revival Herb x 03	INC BC<br />Repel x 20			INC D; INC D<br />Energy Root x 34	LD A, D; LD [HL+], A<br />TM10 x Any			RET<br />[/code]<br />Tested on German VC version, but I don&#039;t see any reason why it shouldn&#039;t work on english version. Don&#039;t know about other european languages, but should be fine as well.


subject: Re: Which starters are your favorites?
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Jchu link=topic=7805.msg205274#msg205274 date=1495560017]<br />EDIT: Wow, no votes for kalos? I feel bad for picking johto now. [b]is re voting possable?[/b]<br />[/quote]<br /><br />Got you covered there (even without looking at your post first&nbsp; :D).<br /><br />Was a toss-up between Johto (Nostalgia overload) and Kalos for me as well.<br />Gen1 somehow lost part of its charm for me over the years.<br />Gen2 is great (even though Feraligatr looks weird).<br />Never really played Gen 3 &amp; 4, so there never was really a time to grow liking their pokÃ©mon.<br />Gen5 I think only the Snivy line is great. Others are fine as well, but nothing amazing.<br />Gen6 is great as well.<br />Gen7 was in the mix as well, but Incineroar killed the Litten-line for me (why did it suddenly become a wrestler? There was no indication before). Also, the Popplio-line wasn&#039;t anything amazing imo.<br /><br />Therefore, Kalos starters it is.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The mail might be stored in SRAM, but can&#039;t you make a setup that copies mail data into WRAM and executes it ?<br />For extra easiness, copy backwards.<br />[code]<br />ld de, MailDataEnd<br />ld hl, TempStorage<br />ld c, length<br />.loop<br />ld a, [de]<br />dec de<br />ld [hld], a<br />dec c<br />jr nz, .loop<br />inc hl<br />jp [hl]<br />[/code]


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The OAM DMA thing of Crystal_ (and your version, Couldntthinkofaname) works in french and italian games, once adapted for character issues.<br /><br />I&#039;ve used codes to edit several points in WRAM before in french or italian games (Trainer ID, Items, PokÃ©mon, etc.) using exactly the same addresses than english games, so maybe the whole WRAM is exactly the same in english and european games, and you can use OAM DMA the same way in both too, but things in other part of the memory are different.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=ISSOtm link=topic=6716.msg207693#msg207693 date=1510494725]<br />The mail might be stored in SRAM, but can&#039;t you make a setup that copies mail data into WRAM and executes it ?<br />For extra easiness, copy backwards.<br />[code]<br />ld de, MailDataEnd<br />ld hl, TempStorage<br />ld c, length<br />.loop<br />ld a, [de]<br />dec de<br />ld [hld], a<br />dec c<br />jr nz, .loop<br />inc hl<br />jp [hl]<br />[/code]<br />[/quote]<br /><br />Need to unlock SRAM and find mail data there first, but should be possible.<br />You&#039;d also need a large enough space of temp data to store your code without destroying everything.<br />Had the same idea, but didn&#039;t bother to code it so far. Might look into it a bit more.<br /><br />[quote author=Krys3000 link=topic=6716.msg207694#msg207694 date=1510496699]<br />The OAM DMA thing of Crystal_ (and your version, Couldntthinkofaname) works in french and italian games, once adapted for character issues.<br /><br />I&#039;ve used codes to edit several points in WRAM before in french or italian games (Trainer ID, Items, PokÃ©mon, etc.) using exactly the same addresses than english games, so maybe the whole WRAM is exactly the same in english and european games, and you can use OAM DMA the same way in both too, but things in other part of the memory are different.<br />[/quote]<br /><br />The code that is called in the box name variant to maximize TM quantities ($314c) is shifted to a few bytes earlier in german version. Easiest approach for now is probably to just try if the code adjusted for local charset with same memory adressed works. Chance seems to be reasonably high. :)


subject: Re: A minimalistic (yet functional) Pseudo-Gameshark GUI with 8f
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Amazing work Couldntthinkofaname :)<br /><br />[quote author=Parzival link=topic=8133.msg207685#msg207685 date=1510457142]<br />Not exactly like yours, it&#039;s an entire suite of s**t but it includes a memory writer too.<br />As for the link, I don&#039;t have it. Go poke through TheZZAZZGlitch&#039;s youtube channel until you find it, it&#039;s got its own video in everything.<br />[/quote]<br /><br />[quote author=Couldntthinkofaname link=topic=8133.msg207687#msg207687 date=1510461388]<br />Ah, I believe I may know what you&#039;re referring to. It was probably [url=https://youtu.be/BkIDPwkeGWs]this[/url] ROM hack.<br />[/quote]<br /><br />Yes that&#039;s it.<br /><br />A Japanese user named Offgao also made a memory viewer/editor for the original game, where you can browse the memory in real time and adjust addresses. Cryo ported it to English versions.<br />https://forums.glitchcity.info/index.php?topic=7773.0<br /><br />Before that there was a Japanese website that hosted a video of a memory editor more similar to yours:<br />https://www.youtube.com/watch?v=lRNQrkFXA-0


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207695#msg207695 date=1510499318]<br />[quote author=ISSOtm link=topic=6716.msg207693#msg207693 date=1510494725]<br />The mail might be stored in SRAM, but can&#039;t you make a setup that copies mail data into WRAM and executes it ?<br />For extra easiness, copy backwards.<br />[code]<br />ld de, MailDataEnd<br />ld hl, TempStorage<br />ld c, length<br />.loop<br />ld a, [de]<br />dec de<br />ld [hld], a<br />dec c<br />jr nz, .loop<br />inc hl<br />jp [hl]<br />[/code]<br />[/quote]<br /><br />Need to unlock SRAM and find mail data there first, but should be possible.<br />You&#039;d also need a large enough space of temp data to store your code without destroying everything.<br />Had the same idea, but didn&#039;t bother to code it so far. Might look into it a bit more.<br />[/quote]<br /><br />Daycare memory? In gen 1 it does not reset when you turn off the game, not sure if it does so in gen 2 though.<br />


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  I think Generation II Day Care memory stays.<br /><br />The only potential difficulties I see is if the Day Care couple produce an Egg after walking around and this messes up your code (or you overload the party with ????? party overloading; corrupting this data). There are also values around this region that may increase or decrease every step (maybe experience and/or amount of steps left for an Egg).


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=https://github.com/PikalaxALT/pokegold/blob/master/wram.asm]According to this[/url] time to creating a new egg is $dc78 which is right in the middle of day care data.<br /><br />I think party pokÃ©mon OT and nicknames would be the best bet here. Unless you just want to overwrite box names.<br />Other than that, you can still use bag/pc items &amp; quantities.<br />[code]<br />$DB4A to $DB54 = First Pokemon Name OT<br />$DB55 to $DB5F = Second Pokemon Name OT<br />$DB60 to $DB6A = Third Pokemon Name OT<br />$DB6B to $DB75 = Fourth Pokemon Name OT<br />$DB76 to $DB80 = Fifth Pokemon Name OT<br />$DB81 to $DB8B = Sixth Pokemon Name OT<br />$DB8C to $DB96 = First Pokemon Name<br />$DB97 to $DBA1 = Second Pokemon Name<br />$DBA2 to $DBAC = Third Pokemon Name<br />$DBAD to $DBB7 = Fourth Pokemon Name<br />$DBB8 to $DBC2 = Fifth Pokemon Name<br />$DBC3 to $DBCD = Sixth Pokemon Name<br />[/code]<br /><br />What is also interesting are these two adresses:<br />[code]<br />wNamingScreenDestinationPointer:: dw ; c5d0<br />wNamingScreenType:: ds 1 ; c5d4<br />[/code]<br />Didn&#039;t try it, but judging from the name maybe it is possible to change available charset while typing. Since you can&#039;t access menu there it would have to be done via OAM DMA loop.


subject: Re: Game Boy Camera emulation driver - help?
poster_name: spowell
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: lamp
body:
  I know this post is deader than dead, but Iâ€™ve figured that since Iâ€™m the one who opened it in the first place, I owe it closure.<br />Iâ€™ve recently picked up this particular project again and I managed to compile the camera driver.<br />For whomever it may be of use, Iâ€™m sharing the Game Boy Camera and Game Boy Printer emulators in one SFX file.<br />Download link, since the forums arenâ€™t allowing me to attach: [url=https://yadi.sk/d/lTRS-CM33PdPVT]https://yadi.sk/d/lTRS-CM33PdPVT[/url]<br />Cheers! :)<br />~ SP


subject: Re: Game Boy Camera emulation driver - help?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=spowell link=topic=7692.msg207700#msg207700 date=1510505237]<br />I know this post is deader than dead, but Iâ€™ve figured that since Iâ€™m the one who opened it in the first place, I owe it closure.<br />Iâ€™ve recently picked up this particular project again and I managed to compile the camera driver.<br />For whomever it may be of use, Iâ€™m sharing the Game Boy Camera and Game Boy Printer emulators in one SFX file.<br />Download link, since the forums arenâ€™t allowing me to attach: [url=https://yadi.sk/d/lTRS-CM33PdPVT]https://yadi.sk/d/lTRS-CM33PdPVT[/url]<br />Cheers! :)<br />~ SP<br />[/quote]<br /><br />Thanks.<br /><br />Mirrored :D<br /><br />https://sites.google.com/site/torchickens2/miscellany


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207699#msg207699 date=1510504329]<br />Didn&#039;t try it, but judging from the name maybe it is possible to change available charset while typing. Since you can&#039;t access menu there it would have to be done via OAM DMA loop.<br />[/quote]<br /><br />I came across that address in the past too. It indeed allows you to change the available characters but it seems 05 and up work as if you&#039;re nicknaming a PokÃ©mon (so it will say (POKÃ©MON)&#039;s nickname, display a menu sprite and bring up the characters you can input while nicknaming one), and box names (04) happens to be the best menu in terms of available characters. I may be wrong though.<br /><br />03 is the unused menu for naming your mother.<br /><br />[img]https://i.imgur.com/Nputhrt.png[/img]<br /><br />Mother&#039;s name is stored at D1AE and can be returned with the hex:49 control character, but since the Dude&#039;s demonstration overwrites it it may come up as your player&#039;s name.<br /><br />C5D0 appears to look for where the characters are, and moves them to the other buffer/destination like D8BF (box 1 name). In box names the pointer is CEED. Changing values in the buffer at CEED will print characters on the screen.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Evie âœ¿ link=topic=6716.msg207703#msg207703 date=1510507077]<br />03 is the unused menu for naming your mother.<br /><br />[img]https://i.imgur.com/Nputhrt.png[/img]<br /><br />Mother&#039;s name is stored at D1AE and can be returned with the hex:49 control character, but since the Dude&#039;s demonstration overwrites it it may come up as your player&#039;s name.<br />[/quote]<br /><br />Normally this should go the other way around. :XD:<br /><br /><br />Mail charset appears to have the most characters. Was hoping to get it available to name boxes.


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207705#msg207705 date=1510508663]<br />Mail charset appears to have the most characters. Was hoping to get it available to name boxes.<br />[/quote]<br /><br />Oh, I overlooked the mail character set. Thanks! Yeah. C5D4 was 48 while on the mail naming screen, but sadly attempting to name a box came up with the PokÃ©mon nickname screen when 0148D4C5 was enabled instead. :(<br /><br />In theory though, with some work we can bring up the mail menu with a custom destination with OAM DMA hijacking to execute with TM17, TM25 etc. upon pressing a button (e.g. B) instead. It may not be worth it, but would be interesting to do.<br /><br />Thinking about it, it would be good to port offgao&#039;s memory editor from Generation I over to Generation II.


subject: Re: The Member's Guide to Topiclessness
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  nice!<br /><br />i used to be the type of person who would think that transgender is some sort of dumb thing (to put it less lightly, i was an edgy little shit), but now i&#039;ve matured to the point that i support those that transition. and i&#039;ve made lots of new friends from all walks of life that have influenced my opinion; i&#039;ve stopped being an edgy shit like i used to be several years ago and i&#039;m really proud of you for having the courage to state that opinion on a public forum<br /><br />[s]if i accidentally use the wrong pronouns, please let me know. i tend to be a bit rusty with remembering this stuff. please don&#039;t be too offended by my wording choice &gt;.&lt;[/s]


subject: Re: The Member's Guide to Topiclessness
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Evie âœ¿
icon: xx
body:
  Thanks realsamusaran, Krys3000, danny. :)<br /><br />[quote author=realsamusaran link=topic=3088.msg207641#msg207641 date=1510088925]<br />Unrelated to any of that, does anyone happen to know what map in PokÃ©mon Yellow has the most missable items on its list? I don&#039;t have an emulator or debugger and wouldn&#039;t know where to start or what values to look for. If I had to guess I would say the Power Plant, but I can&#039;t say for sure, so I thought I&#039;d ask. It&#039;d probably be the same for all the Gen 1 games but I&#039;m not sure about Yellow&#039;s changes.<br />[/quote]<br /><br />I don&#039;t know the answer to that, sorry. However there is an online interactive map for PokÃ©mon Yellow which can be used for finding hidden items [url=http://pokeworld.herokuapp.com/rb/1#178,273]here[/url]. I&#039;m not sure if any of the hidden items in Yellow changed though. Hope this helps in any way. :)


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: Couldntthinkofaname
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Couldntthinkofaname
icon: xx
body:
  [quote author=Evie âœ¿ link=topic=6716.msg207706#msg207706 date=1510509208]<br />Thinking about it, it would be good to port offgao&#039;s memory editor from Generation I over to Generation II.<br />[/quote]<br /><br />I was toying around with the idea of a memory editor GUI for gen 2. In fact, [url=http://forums.glitchcity.info/index.php?topic=8133.msg207680#msg207680]this[/url] project was originally meant for G/S, but for whatever reason I ditched the idea and made it for R/B instead.<br /><br />I don&#039;t see why it wouldn&#039;t work, but we would need to find a large portion of unused/mostly unused data, similar to $D901 from R/B/Y.<br /><br />Also, it&#039;s worth noting that the tilemap in G/S works differently from it&#039;s gen 1 counterpart. Rather than accepting direct writes to $C3A0 and onward, it is required to call internal subroutine $0F74, with the pointer to the desired tiles into register &quot;de&quot;.


subject: Re: The Member's Guide to Topiclessness
poster_name: Charmy
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Honestly, I don&#039;t know why I literally became inactive here and became super-active on the discord... &#129300;


subject: Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
poster_name: spamviech
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: spamviech
icon: xx
body:
  [quote author=spamviech link=topic=6716.msg207673#msg207673 date=1510359792]<br />[quote author=spamviech link=topic=6716.msg207662#msg207662 date=1510330853]<br />As a resident german person here is a pc item code to give you 255 of every TM/HM so you can use them to write your code.<br />Don&#039;t know if this will work on every european language, but it was the same for german and english so there is a good chance that it will work.<br />[/quote]<br /><br />Kind of confused here.<br />To get enough money for 44 Dire Hits I continued playing (up to defeating Red) and the code suddenly stopped working.<br />Also, using a Lucky Egg-Attract-Quagsire with a simple return code (201 of TM01) crashed my game.<br /><br />To me this looks like the memory address for TM quantities was changed, but I somehow doubt Nintendo would do this. Need to look a bit more into this one. I&#039;m using VC version so far btw., will try on emulator to check what&#039;s going on here.<br />[/quote]<br /><br />I think I screwed up somewhere on my first try. Probably deposited an additional TM22 or something.<br />Anyway, beat up red again and the Box Item Code to maximize TMs still worked without problems.&nbsp; :)<br /><br /><br />Edit:<br />Successfully executed my code to fill your box on german VC version. :)<br />Note: [s]Be careful when withdrawing/releasing a pokÃ©mon created this way. For a previously empty box it shifted some bytes for the remaining pokÃ©mon in the box (item becomes species, etc.) and I&#039;m not sure when it stops.<br />I&#039;ll try to improve the code so this effect vanishes.[/s] [size=8pt]Successfully fixed that bug. :) Still trying to improve the code.[/size]<br /><br />Since box name codes aren&#039;t available, first use this TM quantity code (Quagsire, Lucky Egg, Attract) to set HM01-HM03 quantities:<br />[code]<br />TM01	62/193			LD A, 20<br />TM02	32/223			<br />TM03	234/21			LD [b0f5], A<br />TM04	176/79			<br />TM05	245/10			<br />TM06	62/193			LD A, eb<br />TM07	235/20			<br />TM08	234/21			LD [b1f5], A<br />TM09	177/79			<br />TM10	245/10			<br />TM11	62/193			LD A, c9<br />TM12	201/54			<br />TM13	234/21			LD [b2f5], A<br />TM14	178/79			<br />TM15	245/10			<br />TM16	201/54			RET<br />[/code]<br />Afterwards, use this slightly adjusted box item code (Quagsire, HP-UP, Sleep Talk) to maximize quantities for TM01-TM49 (leave HM-quantities untouched):<br />[code]<br />Any x Any<br />Any x 03			INC BC<br />Full Restore x 01	LD C, 01<br />Paralyz Heal x 13	DEC C; DEC C<br />Energypowder x 30	LD A, C; LD E, 31<br />X-Attack x 01		LD BC, ...<br />Any x Any			<br />Great Ball x 38		INC B; LD H, d5<br />TM22 x 01			LD BC, ...<br />Any x Any			<br />PokÃ© Ball x 46		DEC B; LD L, 7c<br />Revival Herb x 03	INC BC<br />Dire Hit x 44		INC L; INC L<br />Awakening x 34		INC C; LD [HL+], A<br />Ice Heal x 03		DEC BC; INC BC<br />Carbos x 32			DEC E; JR NZ, f9<br />HM07 x 01			LD BC, ...<br />Any x Any			<br />TM10 x Any			RET<br />[/code]<br />Finally, use this TM quantity code to fill your box:<br />[code]<br />TM01	62/193			LD A, 0a<br />TM02	10/245			<br />TM03	234/21			LD [ff00], A | A-&gt;0a<br />TM04	255/0			<br />TM05	0/255			<br />TM06	62/193			LD A, 01<br />TM07	01/254			<br />TM08	234/21			LD [ff40], A | A-&gt;00<br />TM09	255/0			<br />TM10	64/191			<br />TM11	33/222			LD HL, 6cad | HL-&gt;ad6c<br />TM12	108/147			<br />TM13	173/82			<br />TM14	1/254			LD BC, 1a00 | BC-&gt;001a<br />TM15	26/229			<br />TM16	0/255			<br />TM17	62/193			LD A, 14 | A-&gt;14<br />TM18	20/235			<br />TM19	87/168			LD D, A<br />TM20	95/160			LD E, A<br />TM21	34/221			LD [HLI], A<br />TM22	62/193			LD A, (species)<br />TM23	(species)/		<br />TM24	34/221			LD [HLI], A<br />TM25	21/234			DEC D<br />TM26	32/223			JR NZ, fc | (Loop back to last LD [HLI], A)<br />TM27	252/3			<br />TM28	54/201			LD [HL], ff<br />TM29	255/0			<br />TM30	35/220			INC HL<br />TM31	87/168			LD D, A<br />TM32	122/133			LD A, D<br />TM33	34/221			LD [HLI], A<br />TM34	62/193			LD A, (item)<br />TM35	(item)/			<br />TM36	34/221			LD [HLI], A<br />TM37	62/193			LD A, (move1)<br />TM38	(move1)/		<br />TM39	34/221			LD [HLI], A<br />TM40	62/193			LD A, (move2)<br />TM41	(move2)/		<br />TM42	34/221			LD [HLI], A<br />TM43	62/193			LD A, $(move3)<br />TM44	(move3)/		<br />TM45	34/221			LD [HLI], A<br />TM46	62/193			LD A, $(move4)<br />TM47	(move4)/		<br />TM48	34/221			LD [HLI], A<br />TM49	9/246			ADD HL, BC<br />TM50	29/226			DEC E<br />HM01	32/223			JR NZ, eb | (Loop Back to LD A, D)<br />HM02	235/20			<br />HM03	201/54			RET<br />[/code]


subject: Re: What song are you listening to right now?
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I have made [url=https://www.youtube.com/watch?v=a9DJRhRuG3o&amp;list=PLaIjfqxisLpEgMuWQnMvZIxtduuhasKwk&amp;index=69]this playlist[/url] of VGM music. And I&#039;m listening all of it, non-stop.<br />Lucky channel slightly more than the rest :p


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Skeef
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Skeef
icon: xx
body:
  [quote author=Krys3000 link=topic=6638.msg207688#msg207688 date=1510487336]<br />[quote author=Misdreavus link=topic=6638.msg207674#msg207674 date=1510364296]<br />[quote author=Krys3000 link=topic=6638.msg207657#msg207657 date=1510308522]<br />[quote author=Misdreavus link=topic=6638.msg207655#msg207655 date=1510291084]<br />@Skreef That worked; thanks.<br /><br />What would my pack setup be to modify a PokÃ©mon&#039;s DVs to a number of my choice (not necessarily max)?<br />[/quote]<br /><br />As for any other thing you may want to do with 8F, you can just use the [url=http://forums.glitchcity.info/index.php?topic=6638.msg189609.html#msg189609]single-address value memory changing code[/url] multiple times, using the [url=http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Player]addresses that match the DV of the given PokÃ©mon[/url] :)<br />[/quote]Thanks.&nbsp; <br /><br />from 2nd link:<br />DAB1 - Attack/Defense IV<br />DAB2 - Speed/Special IV<br /><br />Let&#039;s say I want to set my Chansey&#039;s DVs to 8/15/15/15.&nbsp; (That&#039;s a legal R/B/Y spread for that PokÃ©mon that doesn&#039;t compromise Defense, Speed, or Special.)&nbsp; My code for the Attack and Defense DVs would be:<br /><br />Item 1: any item<br />Item 2: 8F<br />Item 3: Lemonade x143 (8 Attack, F [15] Defense)<br />Item 4: X Accuracy x177 (decimal equivalent of B1)<br />Item 5: Carbos x218 (decimal equivalent of DA)<br />Item 6: PokÃ© Ball x119<br />Item 7: Fresh Water x201<br /><br />Is this correct?&nbsp; Would I just set this up and use 8F once?<br />[/quote]<br /><br />Provided that your game is an english R/B (otherwise, addresses would be $DAB6 and $DAB7 in european non-english R/B, $DAB0 and $DAB1 in english yellow, and $DAB5 and $DAB6 in european non-english yellow) then yes this would be exactly what you have to do. Change the values to 255/178/218 and use 8F a second time for the Speed/Special IVs :) (don&#039;t forget your PokÃ©mon setup though)<br />[/quote]<br /><br />Probably easyer to run the Speed/Special code first, then drop 1 X Accuracy and drop Lemonade to 143. Saves you the trouble of multiplying those 2 back. Since you can&#039;t just withdraw or buy more if the quantities are over 99.<br /><br />8F<br />Any<br />Lemonade x255 / 143<br />X Accuracy x178 / 177 <br />Carbos x218<br />PokÃ© Ball x119<br />Fresh Water x201<br /><br />This is the same code, just less items really:<br />8F<br />Any<br />X Accuracy x178 / 177<br />Carbos x218<br />Max Revive x255 / 143<br />TM01 xAny


