# smf_messages

subject: Emerald Teach move Glitch
poster_name: amoeba
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  First time posting so go easy on me if I do something dumb. I&#039;m an emerald speedrunner, and was recently doing some glitched runs when I accidentally activated this glitch. Managed to recreate it and make a video of it . Not sure if this has been discovered before, but I was told I should post it here, in case someone knows about it.<br /><br />https://www.youtube.com/watch?v=8RX2wRVnZOk&amp;feature=youtu.be


subject: Re: Greetings GCL people
poster_name: Alaistar
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thanks, everyone! :3<br />Torchickens, I&#039;ll start with the stuff you gave me. Thanks for your help!<br />You guys (and girl) are so inspiring.. keep it up! ;D


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Misero
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Has anyone created a save state meant for this arbitrary code execution?<br />If not, I&#039;ll go with gamesharking my way through.


subject: Re: Emerald Teach move Glitch
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  Learning a move within the evolution cutscene is intended behaviour. You can see it also when you evolve Combusken into Blaziken at level 36.<br /><br />EDIT: serves me right for being too lazy to watch the video all the way through :D


subject: Re: Emerald Teach move Glitch
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thereâ€™s no possibility of breaking the game through the move-learning dialogue tree, since the game only keeps track of which question itâ€™s currently asking, and not all of the options youâ€™ve selected to get there.<br /><br />The evolution cutscene includes its own implementation of the move-learning procedure, separate from the one used for level-up, TM/HM, and Move Tutor moves. It looks like the code that runs during the â€œDelete a move to make room forâ€¦?â€ question in the evolution cutscene is a bit sloppy:<br /><br />[list][*]If Down is pressed, and the cursor is on â€œYesâ€, play the button sound effect and move the cursor to â€œNoâ€<br />[*]If Up is pressed, and the cursor is on â€œNoâ€, play the sound effect and move the cursor to â€œYesâ€<br />[*]If A is pressed, play the sound effect, and:<br />[list][*]If the cursor is on â€œNoâ€, change the question to â€œStop learningâ€¦?â€.<br />[*]Otherwise (the cursor is on â€œYesâ€), change the question to the move selection, and fade to black.[/list]<br />[*]If B is pressed, play the sound effect, and change the question to â€œStop learningâ€¦?â€.[/list]<br /><br />These are separate â€œifâ€ statements for each button, rather than an â€œif-elseâ€ chain, so when these buttons are simultaneously pressed, each of these things will happen in sequence; if both A and B are pressed while the cursor is on â€œYesâ€, it will set the move selection as the next question, fade to black, and then change the question to â€œStop learningâ€¦?â€ This all happens before the next question is loaded, so the move selection menu never appears and the â€œStop learningâ€¦?â€ text is rendered into a black screen.<br /><br />Oddly, when I tried this glitch in the no$gba emulator, the red cursor for the Yes/No options was still visible on what was otherwise a black screen.


subject: Re: Emerald Teach move Glitch
poster_name: amoeba
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah Wack0 I knew that one, the reason I found this was because we always get Mud Shot on the Mudkip evo at lvl16 in speedruns.<br /><br />And thanks Hacky, my knowledge of the coding/whatever of the games isn&#039;t great. Good to know that there&#039;s nothing more interesting that can be done with this, if a little disappointing. Nice that I pretty much knew what was happening too.


subject: Re: The Pokegod People People Eaters!! [PWN YOU!]
poster_name: SCared_Fir3
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Carl Miller link=topic=1192.msg198897#msg198897 date=1439905191]<br />Expect the unexpected.<br />[/quote]<br /><br />expect the unexpected aka this topic being brought back from the dead


subject: Sort of tempted to update my Old 3DS...
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: MidnightNinetales
icon: xx
body:
  I don&#039;t have YouTube on it, so I&#039;d have to update it if I want to run homebrew on it. <br />Pros:<br />- Another 3DS (in addition to my New 3DS XL) that can run homebrew.<br />- If I accidentally update one in the future, I&#039;ll still have the other.<br />- Can update Pokemon X and OR. <br /><br />Cons:<br />- Might be unable to research glitch Pokemon, unless they don&#039;t brick the game when in boxes.<br /><br />Nobody&#039;s been doing much research on Gen 6 glitch Pokemon for quite a while, though. On one hand, I haven&#039;t felt much motivation for it lately, but on the other hand, I might be the only person left who&#039;s willing to continue...


subject: New person intro plus some glitches, traps, ect.
poster_name: deante0
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello I&#039;m a novice exploiter and this will be my first post, its going to cover a vast array of topics I&#039;ve found or am curious about. <br /><br />I would very much like suggestions on roms, emulators, and recording programs. I&#039;ve been working completely with cartridge and my old GBC, they are nice, but I am feeling certain limitations with them, mostly in speed. So if you like, please feel free to suggest an emulator or rom that is most similar to the original cartridge, I did just download the emulator Visual Boy Advance 1.8.0 Beta3 and the rom Pokemon yellow U [C][BF].<br /><br />While I was collecting the Ditto trick accessible glitch pokemon RBY (191) - (199) I was experimenting with level 1 pokemon and found a trap (which i will be writing an article for tomorrow) and that the GlitchDex entries are incomplete. I am cautious to edit any of the GlitchDex, or its entries, since its the only database currently functioning and I&#039;d hate to break it so I thought I&#039;d ask permission before hand. I would also like to ask what amount of proof I&#039;d need for posts, it seems video is a common one. <br /><br />Anyways the trap I found involves the EXP underflow trick, any pokemon stored in the PC with a negative valued exp will immediately become &quot;stuck&quot; in the PC attempting to withdraw this pokemon will cause a lockup. It will also occur if given to the daycare man if the pokemon is taken back immediately. Current pokemon i know to get caught (which is severally fucking annoying for me) are X - x (Y 196), u (Y 199), a (RB 192), h poke (RB 195), LM4 (RB 198), and Nidoking. I also know that at least X - x will jump to level 100 given small exp values. <br /><br />Back to the GlitchDex and it being incomplete, If a u (Y 199) is leveled up from 1 it will learn superglitch at level 2 and TM 25 at level 5. These are perhaps specific to my cartridge issue (I think i read somewhere there are different issues of the game is this true?) or just don&#039;t happen on emulators.<br /><br />Anyways I&#039;ll be posting more findings soon, I hope. Sorry for the massive and slightly random info bomb. Nice to meet you all.


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: pokechu22
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Welcome!<br /><br />[quote author=deante0 link=topic=7337.msg198901#msg198901 date=1440131374]<br />I would very much like suggestions on roms, emulators, and recording programs. I&#039;ve been working completely with cartridge and my old GBC, they are nice, but I am feeling certain limitations with them, mostly in speed. So if you like, please feel free to suggest an emulator or rom that is most similar to the original cartridge, I did just download the emulator Visual Boy Advance 1.8.0 Beta3 and the rom Pokemon yellow U [C][BF].<br />[/quote]<br /><br />Can&#039;t give you too much advice on roms :P.<br /><br />For emulators, don&#039;t use the original VBA (it&#039;s [I]extremely[/I] old).&nbsp; I recommend using [url=http://bgb.bircd.org/]bgb[/url], but there&#039;s also [url=http://vba-m.com/]VBA-M[/url] and [url=https://code.google.com/p/vba-rerecording/]VBA-RR[/url], which are updated versions of VBA.<br /><br />For screen recording, I recommend [url=https://obsproject.com/]OBS[/url], which can be configured to save to files (it defaults to livestreaming).&nbsp; <br /><br />Videos generally work well enough for evidence, and also generally provides a good way to make things reproducible.<br /><br />I actually haven&#039;t been too active on these forums for a while, so I can&#039;t answer many of your other questions.&nbsp; But the glitches you describe sound interesting.


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  â€œ[BF]â€ in your ROM name stands for â€œBung fixâ€, which means itâ€™s been altered to work with a particular Game Boy flash cartridge. A clean ROM dump would be tagged â€œ[!]â€ instead. Thereâ€™s only one (accurate) version of the English PokÃ©mon Yellow ROM, although there are four different versions of the Japanese release, which may have been what you read about.<br /><br />The experience underflow glitch, and the freeze caused when withdrawing the PokÃ©mon from the PC, both depend on the PokÃ©monâ€™s experience group. Torchickens made a list of glitch PokÃ©mon by experience group [url=http://forums.glitchcity.info/index.php/topic,6588.0.html]here[/url], and luckytyphlosion posted in that same thread a spreadsheet of the level-up behavior for each experience group in Red/Blue (theyâ€™re different in Yellow), showing that some PokÃ©mon will actually freeze the game when withdrawn from the PC at different levels.<br /><br />I was able to confirm that u (Y 199) learns super glitch (hex C0) at level 2 and TM25 at level 5. I wouldâ€™ve thought that someone, at some point, had systematically extracted all this information from the game, but I guess not! Maybe I shouldâ€¦


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Welcome to the forums deante0! Have fun researching.<br /><br />[quote author=deante0 link=topic=7337.msg198901#msg198901 date=1440131374]<br />I would very much like suggestions on roms, emulators, and recording programs. I&#039;ve been working completely with cartridge and my old GBC, they are nice, but I am feeling certain limitations with them, mostly in speed. So if you like, please feel free to suggest an emulator or rom that is most similar to the original cartridge, I did just download the emulator Visual Boy Advance 1.8.0 Beta3 and the rom Pokemon yellow U [C][BF].<br />[/quote]<br /><br />There is a website that documents the filenames, MD5s, etc. of &#039;good&#039; ROM dumps called DAT-O-MATIC. [url=http://datomatic.no-intro.org/index.php?page=show_record&amp;n=1571&amp;s=46]This[/url] is the entry for a &#039;good&#039; PokÃ©mon Yellow dump.<br /><br />The MD5 is like a digital fingerprint. Two exact files have the same MD5. Change one byte and you will most likely get a completely different MD5. Using an MD5 checker, such as [url=https://mega.nz/#!1skX3ZTK!-tecP_L_gpXZ4aCWK7LYII9IpZm-v_FFzkeKj30sZQ]this[/url] one, you can check to see whether you have the ROM on the database.<br /><br />I got the ROM with the filename you mentioned. Presuming we got the same one, it may not make much difference to use it compared to the one on DAT-O-MATIC.<br /><br />The only differences are:<br /><br />0000014E: 04 &gt; FA<br />0000014F: 7C &gt; 2C<br />00003E9C: EA &gt; 00<br />00003E9E: 60 &gt; 00<br />00003EAC: EA &gt; 00<br />00003EAE: 60 &gt; 00<br />00005E02: EA &gt; 00<br />00005E04: 60 &gt; 00<br />00005E19: EA &gt; 00<br />00005E1B: 60 &gt; 00<br />00005E22: EA &gt; 00<br />00005E24: 60 &gt; 00<br />00073E27: EA &gt; 00<br />00073E29: 60 &gt; 00<br />00073EA1: EA &gt; 00<br />00073EA3: 60 &gt; 00<br />00073EAC: EA &gt; 00<br />00073EAE: 60 &gt; 00<br /><br />You can check this with fc /b (file1) (file2) in command line.<br /><br />For files with many differences, Wack0 taught me a way to print differences in a text file using the Command Line. Sadly I cannot remember the way. I will ask him.<br /><br />[quote author=deante0 link=topic=7337.msg198901#msg198901 date=1440131374]<br />While I was collecting the Ditto trick accessible glitch pokemon RBY (191) - (199) I was experimenting with level 1 pokemon and found a trap (which i will be writing an article for tomorrow) and that the GlitchDex entries are incomplete. I am cautious to edit any of the GlitchDex, or its entries, since its the only database currently functioning and I&#039;d hate to break it so I thought I&#039;d ask permission before hand. I would also like to ask what amount of proof I&#039;d need for posts, it seems video is a common one.<br />[/quote]<br /><br />You have my permission for you to edit them. The GlitchDex entries used to be generated [url=https://web.archive.org/web/20090808152615/http://glitchcity.info/glitchdex/Y:249]like this[/url] with data. The contents of the wiki articles is the data, but apparently according to Adrian Malacoda (our webmaster) we no longer have a working MediaWiki extension to make it like in that archived page.<br /><br />[quote author=deante0 link=topic=7337.msg198901#msg198901 date=1440131374]<br />Anyways the trap I found involves the EXP underflow trick, any pokemon stored in the PC with a negative valued exp will immediately become &quot;stuck&quot; in the PC attempting to withdraw this pokemon will cause a lockup. It will also occur if given to the daycare man if the pokemon is taken back immediately. Current pokemon i know to get caught (which is severally fucking annoying for me) are X - x (Y 196), u (Y 199), a (RB 192), h poke (RB 195), LM4 (RB 198), and Nidoking. I also know that at least X - x will jump to level 100 given small exp values. <br />[/quote]<br /><br />Yes. It works the way like in [url=https://docs.google.com/spreadsheets/d/1NFojS1JlAGvfBlqfLJyGwUO3iZCG5UQvItr7xrHup8U/edit?pli=1#gid=1302000118]the spreadsheet[/url] Luckytyphlosion mentioned, as HÃ¡Äky said, and we can look up the experience groups of glitch PokÃ©mon using [url=http://forums.glitchcity.info/index.php/topic,6588.0.html]the list[/url] I made.<br /><br />I wasn&#039;t aware that this also occurs with the Day Care man, I guess it&#039;s not surprising, but interesting.<br /><br />[quote author=deante0 link=topic=7337.msg198901#msg198901 date=1440131374]<br />Back to the GlitchDex and it being incomplete, If a u (Y 199) is leveled up from 1 it will learn superglitch at level 2 and TM 25 at level 5. These are perhaps specific to my cartridge issue (I think i read somewhere there are different issues of the game is this true?) or just don&#039;t happen on emulators.<br />[/quote]<br /><br />Most glitch PokÃ©mon get their level up data from the ROM, and you should get the same results on a real cartridge and an emulator. An exception is glitch PokÃ©mon EA in PokÃ©mon Red and Blue, which takes its level up data from 0x8124 in VRAM, as Crystal_ [url=http://forums.glitchcity.info/index.php/topic,6648.0.html]has documented[/url] ([url=https://www.youtube.com/watch?v=ggLpyCRUWH8]video[/url]). It will learn moves if leveled up via Rare Candy but not in battle.<br /><br />[quote author=deante0 link=topic=7337.msg198901#msg198901 date=1440131374]<br />Anyways I&#039;ll be posting more findings soon, I hope. Sorry for the massive and slightly random info bomb. Nice to meet you all.<br />[/quote]<br /><br />No problem. I like posts like that. Nice to meet you too.<br /><br />[quote author=HÃ¡Äky link=topic=7337.msg198903#msg198903 date=1440141033]<br />I was able to confirm that u (Y 199) learns super glitch (hex C0) at level 2 and TM25 at level 5. I wouldâ€™ve thought that someone, at some point, had systematically extracted all this information from the game, but I guess not! Maybe I shouldâ€¦<br />[/quote]<br /><br />Actually, Echinodermata (level up moves, evolutions) and Photon Phoenix/Yuzihax (TM/HM moves) have done such a thing and TheZZAZZGlitch made text files with glitch Trainer data.<br /><br />I have a copy of this data as well as some CoolTrainer data (good invalid map exit Glitch Cities for CoolTrainer, how to make your own Glitch Cities by adjusting the event displacement bytes to get a PokÃ©mon of your choice) Luckytyphlosion showed us [url=https://mega.nz/#!o0EXjRYT!Rek3kWUe0etpZgh6NMMmnFE5aL5ebnvT0ueR75JIQKk]here[/url].<br /><br />Note that Echinodermata&#039;s data lists some by trade evolutions. I tried one and it did not work. The under level 100 stone evolutions worked however, if done via the evolve without trade glitch (a glitch that was fixed in Yellow).


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: pokechu22
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7337.msg198904#msg198904 date=1440177508]<br />You can check this with fc /b (file1) (file2) in command line.<br /><br />For files with many differences, Wack0 taught me a way to print differences in a text file using the Command Line. Sadly I cannot remember the way. I will ask him.<br />[/quote]<br /><br />It&#039;s [tt]fc /b (file1) (file2) &gt; file.txt[/tt].&nbsp; The [tt]&gt;[/tt] redirects the output.


subject: Re: Sort of tempted to update my Old 3DS...
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7336.msg198900#msg198900 date=1439952598]<br />- Another 3DS (in addition to my New 3DS XL) that can run homebrew.<br />[/quote]<br /><br />Do you currently have under 9.5.0-23?<br /><br />What homebrew can you run by updating? Can the under 9.5.0-23 firmware not run homebrew?<br /><br />Can later versions not do in-game exploits like getting glitch PokÃ©mon as well? (I don&#039;t know much about later exploits, please excuse my ignorance).<br /><br />[quote author=MidnightNinetales link=topic=7336.msg198900#msg198900 date=1439952598]<br />Cons:<br />- Might be unable to research glitch Pokemon, unless they don&#039;t brick the game when in boxes.<br /><br />Nobody&#039;s been doing much research on Gen 6 glitch Pokemon for quite a while, though. On one hand, I haven&#039;t felt much motivation for it lately, but on the other hand, I might be the only person left who&#039;s willing to continue...<br />[/quote]<br /><br />If you most feel like updating, go for it.<br /><br />I wouldn&#039;t personally, as I can use my other updated Nintendo 3DS for most things and only use the outdated Nintendo 3DS for exploits including getting any PokÃ©mon (as Generation VI glitch PokÃ©mon still interest me).


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=pokechu22 link=topic=7337.msg198905#msg198905 date=1440178230]<br />[quote author=Torchickens link=topic=7337.msg198904#msg198904 date=1440177508]<br />You can check this with fc /b (file1) (file2) in command line.<br /><br />For files with many differences, Wack0 taught me a way to print differences in a text file using the Command Line. Sadly I cannot remember the way. I will ask him.<br />[/quote]<br /><br />It&#039;s [tt]fc /b (file1) (file2) &gt; file.txt[/tt].&nbsp; The [tt]&gt;[/tt] redirects the output.<br />[/quote]<br /><br />That worked. Thank you very much!


subject: Re: Emerald Teach move Glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Welcome to the forums amoeba! Nice to see another speedrunner :D (we have a few here or people experienced in the field who have made posts like werster, luckytyphlosion, MrWint, Dabomstew).<br /><br />[quote author=amoeba link=topic=7335.msg198892#msg198892 date=1439770765]<br />First time posting so go easy on me if I do something dumb<br />[/quote]<br /><br />No, you didn&#039;t do anything wrong. Your post was informative and you shared a new glitch that didn&#039;t seem to be documented before. :)<br /><br />I have got the glitch to work in Ruby, Japanese Ruby and FireRed as well.<br /><br />Here is a video that includes the glitch in Ruby.<br />https://www.youtube.com/watch?v=jIooN4DX3TU<br /><br />[quote author=HÃ¡Äky link=topic=7335.msg198896#msg198896 date=1439854151]<br />Oddly, when I tried this glitch in the no$gba emulator, the red cursor for the Yes/No options was still visible on what was otherwise a black screen.<br />[/quote]<br /><br />Interesting.<br /><br />When I tried the glitch in English Ruby in the VBA emulator, the red box that normally surrounds &quot;YES&quot; or &quot;NO&quot; was still visible. The box did not appear in Japanese Ruby, FireRed or Emerald (which apparently do not have it).


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Misero link=topic=6638.msg198894#msg198894 date=1439836926]<br />Has anyone created a save state meant for this arbitrary code execution?<br />If not, I&#039;ll go with gamesharking my way through.<br />[/quote]<br /><br />Here are save files that have 8F and ws m set up with code to get Mew upon using 8F/ws m and closing the menu.<br /><br />English Red: https://mega.nz/#!8hF1XDiR!M-397Ob3EDtPlOHW3XUSO52FArph3Ork8Y_YXrJ45nQ<br />English Yellow: https://mega.nz/#!d8sGjZLT!yp1oMA5zGHOxI91I3qgweYZkY1Y6CzL2-m-MrxpSeyY<br /><br />If you want to change the code the game ends up running after the PokÃ©mon set ups (certain party PokÃ©mon in Red/Blue, certain stored PokÃ©mon in Yellow) you can edit D322 (Red/Blue) or D321 (Yellow) and onward, which represent the item 3 identifier and onward.<br /><br />Edit: Here is a save file for Japanese Green to get Mew with 5ã‹ã„ (with kattempla/pokebug&#039;s party PokÃ©mon set up) or ã¦ã¸.<br /><br />If you want to get it with ã¦ã¸ you have to watch the old man&#039;s demonstration first.<br /><br />The set ups have the code beginning at item 2 (D2A4). The PokÃ©mon redirect the program counter to item 2 for use with 5ã‹ã„. The name ã‚¢ã¦ãƒ¨ã‚ (after watching the old man&#039;s demonstration) redirects the program counter to item 2 (D2A4) for use with ã¦ã¸.<br /><br />https://mega.nz/#!NtMjQYBJ!K8KFbfuo7jI0638BuJIxWm1GsjozVX2iDu1nYRu7GEg


subject: Re: Greetings GCL people
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Alaistar link=topic=7331.msg198893#msg198893 date=1439835194]<br />Thanks, everyone! :3<br />Torchickens, I&#039;ll start with the stuff you gave me. Thanks for your help!<br />You guys (and girl) are so inspiring.. keep it up! ;D<br />[/quote]<br /><br />You&#039;re welcome!<br /><br />Thanks for the kind words.


subject: Re: Save Abuse Extended Warp
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Spoink link=topic=7333.msg198876#msg198876 date=1439577376]<br />Do the save abuse glitch, and instead, switch&nbsp; the first Ultra ball (screen brightness) with the second Masterball stack, and toss 0-255. THis works better because:<br />1. It always works.<br />2. You can go to any area.<br />[/quote]<br /><br />Cool.<br /><br />Are you still changing D364 (exit destination?) with the Ultra Ball quantity? If your x-position block (D363) is 1, then D364 may be the second Master Ball.<br /><br />If so, I see how screen brightness (D35C) is often always 00, unless you&#039;re in Rock Tunnel (where it will be 06); so regardless of what building you are in, you can access anywhere by tossing the D363 item (item 36).<br /><br />[quote author=Krys3000 link=topic=7333.msg198887#msg198887 date=1439617800]<br />Doesn&#039;t it always work and allow you to go to any area anyway ? I mean with the normal technique. I don&#039;t remember limitations.<br />[/quote]<br />In your house D364 is 00 (256) by default (Pallet Town&#039;s map ID), and you can access all other maps by tossing 1-255. But in other maps D364 is greater than 0, so you can only toss a limited amount. Hence a swap is usually required to make D364 0 again in buildings outside of Pallet Town.


subject: Re: Battle Spot Save Corruption
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  This is interesting. I am curious as to how it works too. It is pretty scary that you could enter Battle Spot and probably have your save file erased, but Game Freak acknowledged it, so maybe they are trying to prevent it.<br /><br />Is there a video of the save file getting corrupted?<br /><br />That first Japanese article you posted seems to say that they are speculating if it&#039;s really a glitch that occurs if you have a 9999 winning streak in the Battle Maison.


subject: Re: Save Abuse Extended Warp
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah, yes of course. I was not thinking about this.<br /><br />This makes it very interesting then&nbsp; :D


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Shina69 link=topic=6638.msg198877#msg198877 date=1439579452]<br />Good evening, guys.<br />First of all, you people are absolute unrecognized geniuses for coming up with such amazing programming tricks for the eyes of this humble gamer who spent his childhood exploring the neat forests of pokemon yellow, not regretting knowing so little as i did. Although times change and nostalgia grabs us once again to pick the old dusty cartridges and face our old childhood enemies... a magnificent team starts to assemble. Glitches were learned, stats analyzed, moves tactical duplicated in order to fulfill the needs, but... there&#039;s one thing that wasn&#039;t forgotten - [b]i can&#039;t delete the HM moves.[/b]<br />So i went deep and deeper, cause transfer my beloved X_ã‚¥-_xã‚¥, to a Gen 2+ wasn&#039;t an option, and i decided to come to you guys, as i got so fascinated with the wonders of arbitrary code execution.<br /><br />[b]Is there any way to come up with a move deleter for HM&#039;s or simply overwrite this annoying Flash move of X_ã‚¥-_xã‚¥, on Pokemon Yellow European Version (English)?[/b] [size=8pt](i believe this is the proper version, i&#039;m from Portugal and i will try to find that old box!)[/size]<br /><br />Not sure if this is the proper topic to send my request, but i&#039;m deeply thankful for the attention.<br />Keep mesmerizing us with new knowledge applied to old technologies, you guys rock!<br />[/quote]<br /><br />Sure. We can remove it with ws m!<br /><br />The following items from item 3 will replace move 1 of PokÃ©mon 1 with a move of your choice:<br /><br />Lemonade x(move ID)<br />TM34 x114<br />TM09 x201<br /><br />As code:<br /><br />[code]<br />ld a,xx<br />ld (D172),a<br />ret<br />[/code]<br /><br />As bytes:<br /><br />[code]<br />3E xx<br />EA 72 D1<br />C9<br />[/code]<br /><br />If you want to port this to Red/Blue, replace TM34 x114 with TM34 x115.<br /><br />To execute the code, you can get the items and use ws m (obtainable with [url=https://www.youtube.com/watch?v=ZyppANEvnh8]dry underflow[/url] and the [url=https://www.youtube.com/watch?v=98_azamLeh4]looping map trick[/url]) with relevant stored PokÃ©mon ([url=http://forums.glitchcity.info/index.php/topic,6638.msg194861.html#msg194861]example[/url]), or another means of arbitrary code. For example, replacing item 41 with Iron x 211 will make the game execute your code from item 5 in Yellow and does not require specific PokÃ©mon.<br /><br />Another non arbitrary code execution approach to getting X ã‚¥- xã‚¥ without Flash is by using the remaining HP glitch with a remaining HP of 196, if you can get Q (and this glitch only works if box 1 has never been filled completely). Since this glitch uses catch rate as an FF, data below it like moves are not affected during the data shift backs from each time you withdraw a PokÃ©mon after the terminator is removed (step 6 in the video below and beyond).<br /><br />This means you can have a PokÃ©mon with the moves you want, then turn it into X ã‚¥- xã‚¥ and have the moves unchanged.<br /><br />https://www.youtube.com/watch?v=9l1nuTS3VI0<br />(click video)<br /><br />If you can obtain a PokÃ©WTrainer in PokÃ©mon Red (it unfortunately freezes the game on the opponent&#039;s side however), then you may be able to trade it to Yellow to become a X ã‚¥- xã‚¥ without Flash.<br /><br />In theory, we might be able to get a level 255 X ã‚¥- xã‚¥ with the [url=https://www.youtube.com/watch?v=7klMjrBPLkU]overworld PokÃ©mon catch trick[/url] in a Glitch City, or some [url=https://www.youtube.com/watch?v=HwnymX80ZMc]-gm trickery[/url], and theoretically, it would appear with moves without Flash.<br /><br />[quote author=Shina69 link=topic=6638.msg198880#msg198880 date=1439591814]<br />[quote author=Spoink link=topic=6638.msg198878#msg198878 date=1439585339]<br />Shina69:<br />Catching above L:12 might erase the move, unless you want to keep your current one.<br />[/quote]<br />Oh i also tried that, forgot to mention&nbsp; );<br />Managed to make ditto swords dance 3 times and actually got a L:13 one but the move was still there.<br />Some other guy got the same results as i read on a youtube video comment, that&#039;s why i run out of options&nbsp; :&#039;(<br />(by the way, Flash is the 2nd move on the Fight list, if it helps :o)<br />[/quote]<br /><br />Yes, catching one at level 13 did not result in X ã‚¥- xã‚¥ having Flash for me either. All X ã‚¥- xã‚¥ level 1 through to level 13 had Flash. For reference, Flash is one of X ã‚¥- xã‚¥&#039;s starting moves, not just a move learned at a low level, which means it always has it at the lowest level and cannot learn it through level up (unless Flash appears in the level up database as well).<br /><br />For some reason, in the event that you catch&nbsp; X ã‚¥- xã‚¥ at level 255 it will not know Flash. Instead it will know Mega Punch, Tail Whip, Scratch, Disable. According to the Bulbapedia article, Mega Punch, Scratch and Disable are among its last learnable moves, though for whatever reason, Tail Whip isn&#039;t one of the last ones. Note that the learned moves list on Bulbapedia has at least one error. At level 1 X ã‚¥- xã‚¥ will try to learn the arbitrarily named hex:00 move (which is the CoolTrainer[F] type in Red/Blue and supports move selection corruption too in Yellow) if you somehow raise X ã‚¥- xã‚¥ to that level.<br /><br />I have some [url=https://mega.nz/#!o0EXjRYT!Rek3kWUe0etpZgh6NMMmnFE5aL5ebnvT0ueR75JIQKk]text databases[/url] with data extracted from the ROMs from various users including a level up database by Echinodermata. Unfortunately there seems to be an error because they note X ã‚¥- xã‚¥ as learning no moves which isn&#039;t true (even though much of the data is correct).


subject: Re: Save Abuse Extended Warp
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7333.msg198913#msg198913 date=1440186052]<br />Ah, yes of course. I was not thinking about this.<br /><br />This makes it very interesting then&nbsp; :D<br />[/quote]<br /><br />Yeah :)<br /><br />When I did my video about map FE corruption, I was not aware of this and used my own Master Ball x254 when trying to access map 254 from the PokÃ©mon Center; when I could have used the 00 brightness value to get Ultra Ball x0 in D363/D364 then tossed two to get 254.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Metarkrai link=topic=6868.msg198879#msg198879 date=1439588850]<br />If you want to know the hexadecimal values of the Glitch Pokemon you hatched, you can find them back with the extended 3rd Gen Pokedex (I forgot its exact name, but there is a subject on the forum where a download link is given, and I can&#039;t find it back) as they have a really clear name that you can trace back.<br />[/quote]<br /><br />Might it be [url=http://forums.glitchcity.info/index.php/topic,7127.msg197034.html#msg197034]Generation III Extended Hacking Suite[/url]?<br /><br />Another way to do it might be to send the glitch PokÃ©mon into battle (if that glitch PokÃ©mon can be sent into battle, maybe if it cannot you cannot use this method) and check one of the addresses 02023868, 02024084, 0202499E or 03005E58.<br /><br />Metarkai, do you know an easy way to edit the index number of a PokÃ©mon in the party to any glitch PokÃ©mon with memory viewer without having to do any glitching?<br /><br />I have usually got an Egg from double corruption first then corrupted it again with Pomeg glitch or manually with memory editor to get any PokÃ©mon (including unhatchable glitch PokÃ©mon) based on its EVs. I couldn&#039;t locate CCD7 with cheat searcher sadly.<br /><br />I would like to know of a way to manually change any PokÃ©mon. In the Game Boy games it&#039;s relatively trivial because you could just change two memory addresses (species byte 1 and byte 2); but in Generation III with you having to take the modulo 24 of the personality value to know where the species ID address would be, and the PokÃ©mon being protected by checksum, I don&#039;t know of a step by step way.<br /><br />With anti-DMA enabled, can you tell me the addresses of the stored checksum, and the species ID for PokÃ©mon for all four positions of &quot;Growth&quot; in the substructure orders please?<br /><br />[quote author=Metarkrai link=topic=6868.msg198879#msg198879 date=1439588850]<br />For the issue about levelling crashes, I don&#039;t know if this is due to the Pokemon trying to learn a new Glitch Move, its Exp curve being too glitchy, something about the stat increase he has, or the Glitch Pokemon trying to evolve, but it&#039;s something that is related either to the species or the stats increase.<br />[/quote]<br /><br />Yeah, perhaps without further knowledge it may be like Generation I (a PokÃ©mon with a glitch experience curve that can normally never stay past level 1 after battle, or a PokÃ©mon with a glitch experience curve that has [url=http://forums.glitchcity.info/index.php/topic,6588.msg196436.html#msg196436]division by zero[/url])


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=rortik link=topic=7332.msg198867#msg198867 date=1439270182]<br />The main one would be: What if I tried this in Yellow? Can ws m do the same thing? I assume that if it did, the executed code would have to be different, but is it at least possible?<br />[/quote]<br /><br />Yes. Provided that we can find a Yellow invalid map script ID that executes code from fa reasonable place in writable memory. This would take some research.<br /><br />My source code can be found here. http://pastebin.com/UarVudWr<br /><br />About extra changes that need to be done for Yellow:<br /><br />At DCD2 (will differ for maps of different sizes) - &quot;map script&#039;s code&quot;: The CopyData routine from PokÃ©mon Red and Blue also exists in PokÃ©mon Yellow at 00B5, so the call 00B5 do not have to be changed for Yellow programs that use CopyData. The parameter in bc 00CE is your map size. The parameter in hl DC04 is the beginning of the block data (the map you want) you write with arbitrary code with 8F/ws m - you don&#039;t have to change this address.<br /><br />The parameter in de C6F9 represents a block data address. The program will take the block data you write and write it here and beyond. How it works: C6F9 represents a 4x4 block somewhere, C6FA represents the next 4x4 block from to the east and so on in this pattern. For example, setting C6F9 to 00 with memory viewer adds part of a building [url=http://i2.minus.com/izTQbaNMXPFEh.png]here[/url] (top-left corner). If we set C6FA to 00, there would be the same block next to it to the east. The parameter does not have to change (unless you want the start of where blocks get changed to be in a different area of the map), because it appears that block addresses are the same in Yellow and not offset by -1. <br /><br />At DCDF &quot;set up glitch script&quot;, the parameter in bc 000D is the size of the code you want to be written to the pointer of (and executed by) the invalid map script. The parameter in hl DCD2 is the start of your glitch map script. The parameter in de DB3E is the execution pointer of Red&#039;s Pallet Town&#039;s map script $15. Hence, unless there is also a glitch map script that executes code from DB3E in Yellow, DB3E should be replaced with another value for porting this to Yellow.<br /><br />The parameter 15 in ld a,15 should be replaced with the ID of an invalid map script that exists for the map you want to change in Yellow.<br /><br />The D5F1 in ld (D5F1),a should be replaced with D5F0 if you want to edit Yellow&#039;s Pallet Town. Some of the addresses around the D5F0 area correspond to other maps. For example, D5F4 (D5F3 in Yellow) represents Viridian City&#039;s script. Sadly, I don&#039;t know if there is documentation of map script addresses.<br /><br />During the execution, which I made begin at DC01, the game jumps over the data at DC04 (the start of block data to copy that shouldn&#039;t be executed as code) into DCDF.<br /><br />Instead of TheZZAZZGlitch&#039;s Red/Blue coordinates data planting items, you can use these items, where the values you write depend on item quantities (I&#039;m afraid I wasn&#039;t sure how to port his exactly).<br /><br />Item 1 and item 2&#039;s quantities are important for this program, if in doubt, have item 2&#039;s quantity as 01 to begin with.<br /><br />Item 3 and beyond:<br /><br />Carbos x220<br />TM50 x32<br />TM11 x111<br />PokÃ© Ball x250<br />Repel x211<br />Ice Heal x119<br />Carbos x211<br />X Accuracy x32<br />Full Heal x11<br />Lemonade x255<br />Fresh Water x4<br />TM34 x30<br />TM11 x 201<br />TM33 x 201<br />ws m x(anything)<br /><br />[code]<br />ld h,DC<br />ld a,(D320)<br />ld l,a<br />inc b<br />ld a,(D31E)<br />dec c<br />ld (hl),a<br />ld h,D3<br />ld l,20<br />inc (hl)<br />dec bc<br />ld a,FF<br />inc a<br />inc b<br />ld (D31E),a<br />ret<br />jp hl<br />ret<br />[/code]<br /><br />How it works:<br /><br />Upon use, this code will plant a byte at DCXX (in stored PokÃ©mon 12&#039;s data). XX depends on item 2&#039;s quantity, hence if it is 1, a byte will be written to DC01. The value of the byte depends on item 1&#039;s quantity.<br /><br />After a value is written, the item 2 quantity is increased by 1, allowing you to write the next byte (e.g. DC02) and the item 1 quantity is reset to 00 (256), allowing you to choose any value for this by tossing 1-255 of them.<br /><br />To execute the code at DC01, prepare the items Carbos x220 (from the old code), X Accuracy x1 (you can toss from your existing stack of 32), TM33 x201 (in the old code but unused until now) at item 3. Note that the x220 represents DC. The x1 represents 01. Hence we execute DC01. If you had X Accuracy x223, you would execute data beginning at DCDF (actually now that I think about it, this means I never needed a jump in my code).<br /><br />[url=https://www.youtube.com/watch?v=q_T8aU35DZY]Example use[/url] to write some data to make talking to Pikachu give you Mew.<br /><br />[quote author=rortik link=topic=7332.msg198867#msg198867 date=1439270182]<br />Other minor questions are:<br />What if you hacked a grass tile into a city?<br />[/quote]<br />You would encounter no PokÃ©mon, unless your script changes the addresses at D887 (D886 in Yellow) and beyond. D887 is the encounter rate, D888 is the level of encounter 1, D889 is the species of encounter 1, etc.<br /><br />In the old man glitch, when the demonstration finishes, and when you enter Cinnabar Island, Sea Route 20, the grass encounter rate becomes 00 (it usually always is, unless you hack/glitch the old man battle in a place with encounters where the game would reset the encounter rate and encounters back to what they originally were after the battle). But after Flying away, the game still leaves over grass encounter data from the demonstration based on characters in your name.<br /><br />The reason why you can encounter grass PokÃ©mon on the strip even when the grass encounter rate is 00 is because the game uses the water encounter rate with the grass PokÃ©mon list.<br /><br />Apparently (I say this because I don&#039;t know a part of the disassembly to confirm it), according to Dabomstew this is because on the 2x2 block that makes up a position you can walk/Surf to, the west part of the block controls the PokÃ©mon you encounter and the east part controls the encounter rate. The &quot;coast&quot; is read as &quot;use grass encounter list&quot; (and with the old man glitch we can have grass encounters in this list we aren&#039;t supposed to have). The water is read as &quot;use water encounter rate&quot; (as one would expect).<br /><br />[img]http://i4.minus.com/ibySVUFUFpaPoc.png[/img]<br /><br />Apparently, this also explains [url=https://www.youtube.com/watch?v=oJ5SCIikzgo]a &#039;glitch&#039;[/url] that does not occur in PokÃ©mon Yellow, where in the Viridian Forest, if you walk on to a grass tile that has a star in it on the bottom right corner you won&#039;t get any encounters because, apparently the right half with a star is classified as neither a grass or water tile, so the game does &quot;encounter rate is 0&quot;.<br /><br />In Japanese PokÃ©mon Red, Green, Blue, you encounter no PokÃ©mon on the Cinnabar coast at all. I tried changing the grass encounter rate (D806) to 255 just to see if it would do anything and got no encounters either.<br /><br />In Spanish and Italian PokÃ©mon Red and Blue, the developers apparently made it so that if you are surfing, you will always get PokÃ©mon from the water list; although, if you are surfing on a grass tile you will still get a grass encounter rate. Furthermore, the old man glitch was &quot;semi-patched&quot; in these versions, surfing on the Cinnabar coast brings up Tentacool even after watching the old man&#039;s demonstration, however, the old man glitch can still be performed if you use a walk through walls glitch to walk on the coast.<br /><br />In these versions, there is an obscure glitch where if you encounter a Trainer then Surf on a non-water tile via the Surf down glitch, you can encounter PokÃ©mon you aren&#039;t supposed to if you press up and down but not move away from the tile as to stop Surfing, including &#039;M (00), Mew ([url=https://www.youtube.com/watch?v=Qu_t4FSlkt4]Paco81 did this in Unknown Dungeon[/url]) and other PokÃ©mon based on the Trainer.<br /><br />These PokÃ©mon are taken from the water encounter list, and encountering the Trainer affects it (the water encounter list starts at D8AA+ in Spanish/Italian Red, the data gets changed when the Trainer battle begins and can change again during the battle, but I do not know what determines the exact values).<br /><br />On maps with grass PokÃ©mon but normally no water PokÃ©mon, the water encounter rate is set to 00; meaning you would have to Surf on something like the grass to get the water PokÃ©mon you aren&#039;t supposed to get, and not a water tile.<br />https://www.youtube.com/watch?v=2jI9LeehZ8E (click)<br /><br />[quote author=rortik link=topic=7332.msg198867#msg198867 date=1439270182]<br />What if you hacked a warp to a nonexistant map, then hacked that map to have an actual tileset? Could you make new cities entirely?<br />[/quote]<br />That&#039;s a great idea definitely worth investigating! I would love to visit my own custom map that doesn&#039;t affect another location. Maybe you could if there are enough things about a map that depend on RAM and not ROM (and the glitch map&#039;s ROM data doesn&#039;t make the game freeze). However, I don&#039;t know if I have the technical know-how to be able to do that yet.<br /><br />Yellow&#039;s map FE is a non-existing map and its level-script pointer points in DC0E (box PokÃ©mon 12&#039;s total experience byte 1) so with experience of 201 (or another applicable value) you can avoid a freeze. But something different about the map forces a warp into map $99 (a house in Fuchsia City), and it also corrupts data (apparently the corruption is caused by the map&#039;s (Town Map?) name according to TheZZAZZGlitch). Whether you can avoid the forced warp by manipulating the level-script pointer data or maybe map FE&#039;s actual script I&#039;m not sure.<br /><br />You can visit a non-freezing map FE with the codes 01C90EDC, 01FE64D3 if you enter a building like a Pallet Town house and exit it. If you replace 01FE64D3 with 010064D3 after ending up in the Fuchsia house you can return to Pallet Town, but the aforementioned corruption affects maps scripts and causes many maps to freeze the game even after saving and resetting, and there are other effects too like forced spinning.<br /><br />Without cheating (without needing arbitrary code too), you can access glitch map FE with an expanded items pack obtained by a glitch like [url=https://www.youtube.com/watch?v=ZyppANEvnh8]dry underflow[/url] by changing the quantity of item 36 to 254 and leaving a building, and (as described above) to make it not freeze the game, stored PokÃ©mon 12 should have an experience such as 201. A video of some of the effects can be found here.<br /><br />https://www.youtube.com/watch?v=mUQxe0GqPBY<br /><br />More information about map FE&#039;s effects can be found [url=http://glitchcity.info/wiki/index.php/Map_254_(Yellow)]here[/url].


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: deante0
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: deante0
icon: xx
body:
  Oh a few other notes, my laptop HATES this site. Why? No idea. Second, I&#039;m terrible with code in almost every respect, so I&#039;ll probably be learning a great deal in that regard and annoying you all. Could someone write out the way to make a compressed link to the forums? Thanks for all the suggestions and checks for emulators and roms they will be very helpful. What else....<br />[quote author=HÃ¡Äky link=topic=7337.msg198903#msg198903 date=1440141033]<br />I was able to confirm that u (Y 199) learns super glitch (hex C0) at level 2 and TM25 at level 5. I wouldâ€™ve thought that someone, at some point, had systematically extracted all this information from the game, but I guess not! Maybe I shouldâ€¦<br />[/quote]<br />I thought the same honestly that&#039;s why I wanted to bring it up.<br />[quote author=Torchickens link=topic=7337.msg198904#msg198904 date=1440177508]<br />Actually, Echinodermata (level up moves, evolutions) and Photon Phoenix/Yuzihax (TM/HM moves) have done such a thing and TheZZAZZGlitch made text files with glitch Trainer data.<br /><br />I have a copy of this data as well as some CoolTrainer data (good invalid map exit Glitch Cities for CoolTrainer, how to make your own Glitch Cities by adjusting the event displacement bytes to get a PokÃ©mon of your choice) Luckytyphlosion showed us [url=https://mega.nz/#!o0EXjRYT!Rek3kWUe0etpZgh6NMMmnFE5aL5ebnvT0ueR75JIQKk]here[/url].<br /><br />Note that Echinodermata&#039;s data lists some by trade evolutions. I tried one and it did not work. The under level 100 stone evolutions worked however, if done via the evolve without trade glitch (a glitch that was fixed in Yellow).<br />[/quote]<br />I&#039;m glad someone did complete it, you have it, and even that it might be on the forums, but the major pages, which are most easily accessible, are incomplete so perhaps I should move the pertinent data around sometime. Though I guess leaving it that way is a good method to recruit new members....its why I joined.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Searinox
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Does anyone know any gameshark code for changing the moves of pokemon IN THE BOX? There&#039;s gameshark codes for changing party pokemon moves that can I wanted to try to convert to code exec using Chickasaurus&#039; [url=http://forums.glitchcity.info/index.php/topic,6638.msg189536.html#msg189536]post[/url] info but all I can find is codes for the party, not the box, which is useless since we&#039;re forced to use a full predefined party for the bootstrap.


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7337.msg198904#msg198904 date=1440177508]<br />There is a website that documents the filenames, MD5s, etc. of &#039;good&#039; ROM dumps called DAT-O-MATIC. [url=http://datomatic.no-intro.org/index.php?page=show_record&amp;n=1571&amp;s=46]This[/url] is the entry for a &#039;good&#039; PokÃ©mon Yellow dump.<br /><br />The MD5 is like a digital fingerprint. Two exact files have the same MD5. Change one byte and you will most likely get a completely different MD5. Using an MD5 checker, such as [url=https://mega.nz/#!1skX3ZTK!-tecP_L_gpXZ4aCWK7LYII9IpZm-v_FFzkeKj30sZQ]this[/url] one, you can check to see whether you have the ROM on the database.[/quote]<br /><br />Don&#039;t use MD5.. collision attacks have been performed successfully on it, in practise, not just in theory. Use SHA256 at least.<br /><br />[quote author=Torchickens link=topic=7337.msg198904#msg198904 date=1440177508]<br />For files with many differences, Wack0 taught me a way to print differences in a text file using the Command Line. Sadly I cannot remember the way. I will ask him.[/quote]<br /><br />fc /b file1 file2 &gt; diff.txt


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]The reason why you can encounter grass PokÃ©mon on the strip even when the grass encounter rate is 00 is because the game uses the water encounter rate with the grass PokÃ©mon list.<br /><br />Apparently (I say this because I don&#039;t know a part of the disassembly to confirm it), according to Dabomstew this is because on the 2x2 block that makes up a position you can walk/Surf to, the west part of the block controls the PokÃ©mon you encounter and the east part controls the encounter rate. The &quot;coast&quot; is read as &quot;use grass encounter list&quot; (and with the old man glitch we can have grass encounters in this list we aren&#039;t supposed to have). The water is read as &quot;use water encounter rate&quot; (as one would expect).<br /><br />Apparently, this also explains a &#039;glitch&#039; that does not occur in PokÃ©mon Yellow, where in the Viridian Forest, if you walk on to a grass tile that has a star in it on the bottom right corner you won&#039;t get any encounters because, apparently the right half with a star is classified as neither a grass or water tile, so the game does &quot;encounter rate is 0&quot;.<br />[/quote]<br /><br />Thank you for that explanation. I was looking for the reason why the encounter rate going back to 00 doesn&#039;t affect the Old Man Glitch and couldn&#039;t find it until then.<br /><br />About that glitch Paco documented, are we sure it doesn&#039;t work on other European versions? I believe Italian, Spanish, French and German games all share the same addresses. I&#039;d make a test in a french version unless you know it won&#039;t work.<br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  To build a Gameshark code, the only thing you need is [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map]a ram map[/url]. This gives you the RAM addresses you need to deal with. In your case, RAM addresses for the moves of the first PokÃ©mon in the active box are DA9E to DAA1.<br /><br />That means you can modify this using the gameshark codes 01xx9EDA to 01xxA1DA with xx being the hex value of the wanted move&nbsp; ;)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Searinox
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Searinox
icon: xx
body:
  I managed this on my own albeit with some problems at first.<br /><br />Firstly Chickasaurus&#039; post I linked in my previous post didn&#039;t work for me. Second, it requires a different item ID for each move which is slightly clunky. At first I had the idea of perhaps attempting a .j as a NOP to bring ID parity back and execute the instruction back in item amount instead of ID, but realised I was getting in way over my head since I would have to then figure out how to redirect to the address with another item and do not fully understand ASM instructions.<br /><br />I then went to try and find the memory address with VBA&#039;s cheat maker. For reasons completely beyond me the cheat searcher finds the address CA9E as the location instead of DA9E, and obviously the cheat doesn&#039;t work. Why this is so baffles me. I&#039;m using a modded VBA called VBA-M, svn926. I&#039;m not sure if it&#039;s got a bug with memory offset representation but it lead me to a dead end.<br /><br />Finally I found the RAM layout, but on Bulbapedia. Now I had the correct address, tested the GS code made with it and it worked(why do GS codes have 01xxB2B1 last 2 bytes reversed from how they are in RAM? DA9E editing requires the code to be written as 01xxs9EDA, but anyways I digress...). Now I needed a way to get the code converted into 8F item representation and like I said, I had failed with Chickasaurus&#039; post.<br /><br />FINALLY I found [url=http://glitchcity.info/wiki/index.php/Arbitrary_code_execution#Gameshark-like_code]your wiki[/url] which worked to convert the code into ACE!<br /><br />You were mentioning earlier that you were trying to get Flash off some glitch Pokemon... well this may help.<br /><br />[b]Long story short...[/b]<br /><br />[quote]Have the Pokemon to be altered be the first one in the PC. Have its move to be altered be put in first slot.<br />[code]8F<br />&lt;any item&gt;<br />X Accuracy x158 (changing this from 158 for first move to 161 for 4th move SHOULD change the move that&#039;s altered, though I have ONLY tested with the first move!)<br />Carbos x218<br />Max Revive x&lt;MOVE ID&gt;<br />Poke Ball x201[/code]<br />Where move ID obviously corresponds to the [url=http://www.psypokes.com/rby/codeviewer.php?page=attacks]move&#039;s ID[/url].<br />This will change the first move of the first Pokemon in your active box.[/quote]<br /><br />This also makes it possible to put glitch moves not previously obtainable on Pokemon, or contrary, remove dangerous Super Glitch moves from Pokemon without having to stand on some obscure tile in Celadon City&#039;s residence. :D<br /><br />You are going to end up doing a lot of Pokemon box swapping but also potential move swapping. If needed to get into battles to swap moves without entering an area that will load field data into Cinnabar(for item duping) I&#039;ve found it feasable to teach Tentacool Surf and put the Pokemon to alter first in party while Surfing the east coast for item duplication, so you don&#039;t have to deposit your whole bootstrap party. Even in default setup, with Pokeball being in 6th slot, it&#039;s unaffected by potential &#039;M/Missingno. encounters as 201 doesn&#039;t roll in any way since the first bit is already 1 so it doesn&#039;t mess up the ret. Keeps things simple.


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: Bent`
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7337.msg198920#msg198920 date=1440279538]<br />[quote author=Torchickens link=topic=7337.msg198904#msg198904 date=1440177508]<br />There is a website that documents the filenames, MD5s, etc. of &#039;good&#039; ROM dumps called DAT-O-MATIC. [url=http://datomatic.no-intro.org/index.php?page=show_record&amp;n=1571&amp;s=46]This[/url] is the entry for a &#039;good&#039; PokÃ©mon Yellow dump.<br /><br />The MD5 is like a digital fingerprint. Two exact files have the same MD5. Change one byte and you will most likely get a completely different MD5. Using an MD5 checker, such as [url=https://mega.nz/#!1skX3ZTK!-tecP_L_gpXZ4aCWK7LYII9IpZm-v_FFzkeKj30sZQ]this[/url] one, you can check to see whether you have the ROM on the database.[/quote]<br /><br />Don&#039;t use MD5.. collision attacks have been performed successfully on it, in practise, not just in theory. Use SHA256 at least.<br />[/quote]<br /><br />When no-intro uses CRC32, MD5, and SHA1, all of which are broken at this point, thereâ€™s not really much you can do.


subject: Re: New person intro plus some glitches, traps, ect.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=IIMarckus link=topic=7337.msg198924#msg198924 date=1440375227]<br />[quote author=Wack0 link=topic=7337.msg198920#msg198920 date=1440279538]<br />[quote author=Torchickens link=topic=7337.msg198904#msg198904 date=1440177508]<br />There is a website that documents the filenames, MD5s, etc. of &#039;good&#039; ROM dumps called DAT-O-MATIC. [url=http://datomatic.no-intro.org/index.php?page=show_record&amp;n=1571&amp;s=46]This[/url] is the entry for a &#039;good&#039; PokÃ©mon Yellow dump.<br /><br />The MD5 is like a digital fingerprint. Two exact files have the same MD5. Change one byte and you will most likely get a completely different MD5. Using an MD5 checker, such as [url=https://mega.nz/#!1skX3ZTK!-tecP_L_gpXZ4aCWK7LYII9IpZm-v_FFzkeKj30sZQ]this[/url] one, you can check to see whether you have the ROM on the database.[/quote]<br /><br />Don&#039;t use MD5.. collision attacks have been performed successfully on it, in practise, not just in theory. Use SHA256 at least.<br />[/quote]<br /><br />When no-intro uses CRC32, MD5, and SHA1, all of which are broken at this point, thereâ€™s not really much you can do.<br />[/quote]<br /><br />[me=Wack0]facepalms[/me]


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=6868.msg198916#msg198916 date=1440191897]<br />Might it be [url=http://forums.glitchcity.info/index.php/topic,7127.msg197034.html#msg197034]Generation III Extended Hacking Suite[/url]?<br />[/quote]<br /><br />Yup, exactly. It really helped me to determine the name lenght of glitch Pokemon and see what &quot;families&quot; had the biggest name lenght, in order to directly know approximative values of identifiants I should use if I wanted to corrupt certain values like Battle Pyramid Bag.<br />I also modified an US Emerald ROM in order to make it read French Pokemon names, as I wasn&#039;t able to fully modify the .ini to make it directly read a French ROM.<br /><br />For specific searches of Glitch Moves effects or Glitch Pokemon specificities, TheZzAzZGlitch gave me python scripts to help me for that (they are basic scripts as it&#039;s only a matter of wanting a certain value on a certain place, but I had nothing to do that for me before).<br /><br />&nbsp; For now, these scripts mainly helped me testing abuses of the &quot;NÂ° of party Pokemon in battle&quot; value.<br />My goal was to have a glitch move with a name long right enough to corrupt that value, and use healing or self-damaging moves to change the HP of my Pokemon. This would force the game to update the hp of the Pokemon &quot;sent in battle&quot;, which would have been the Pokemon at the corrupted party slot.<br />Depending on the party slot values, accurate corruptions of things like special islands flags, mirage island,... could have been possible. However, this value is right at the start of a block of values managing the battle, and all the glitch moves with a good name lenght make the game crash (another adress near the concerned one gets a value that makes the game freeze or reset).<br /><br /> But, writing this made me think about another possible way to exploit this, through the opponent&#039;s Pokemon HP. I&#039;ll look into this.<br /><br />&nbsp; There&#039;s another thing I wanted to test, which was the evolution lines. Can a Glitch Pokemon with a non-glitched sprite and name evolve ? And is that evolution condition the element that makes the game freeze when you give Rare Candies to a Glitch Pokemon ?<br /><br />&nbsp; I also wanted to check the Move Relearner a bit more accurately, as I confirmed that the list of relearnable moves contain one exemplary of each move present into the &quot;Learnable Move&quot; list of the Glitch Pokemon until Move 0000 shows (whereas in Gen III Extended suite, the learnable moves list goes further than that).<br /><br />&nbsp; I also wanted to test the Glitch Move types, to see if there were some that could have nice effects.<br />I also wanted to test the effects of Glitched Special abilities, but I don&#039;t really know how to make a test for this (to know if they have an effect during a battle or outside a battle, and what that effect might be). I also don&#039;t know their full name lenght, as maybe something like Skill Swap could make new RAM overwriting cases.<br /><br />&nbsp; Someone on PRAMA had a good idea about testing if Glitch Pokemon names could change the NPC&#039;s script to values that would be ROM adresses with interesting scripts (like Hall of Fame, engaging a battle against a legendary, ...).<br />However, the answer was negative. I didn&#039;t find any set of 4 bytes that would be near the end of a Glitch Pokemon&#039;s name with a certain lenght (like 18.000 characters long) that would look like a ROM adress towards NPC/events scripts.<br /> There are maybe some other values that could be exploited like this, but I don&#039;t really know what other values I could give for a NPC script adress in order to get nice results (it has to do someting like a teleport, as a glitch Pokemon species name of that lenght corrupts the player current location and he would be outside of the building, and taking a single step crashes the game).<br /><br />&nbsp; While trying to check the existence of the rumoured Lotad Swarm in RSE (I found the ROM adresses managing swarms and he wasn&#039;t there, so unless someone shows it, I heavily doubt he existed), I came to think of another way to make the game read a Glitch Pokemon species name, which would be TV news.<br />I haven&#039;t tested it yet, but with news that display the species name of Pokemon like the name master or other ones, I think the game would read the species name of the ID stored in the adresses related to the news.<br />&nbsp; This could maybe be useful for RAM data overwriting as it could provide another starting adress for that overwriting.<br />For now, I know of 2 adresses for RAM data overwriting : 0x02021CC0 (the adress where the species name is stored when you talk to Slateport&#039;s Journalist in the Pokemon Fan Club), and another adress around 0x020283E8 (the trainer name is stored there when you reload your save, exit the Safari game, and maybe with other actions).<br />If we had other adresses where names of Glitch Pokemon, Glitch Moves, or Glitches Trainer Name were stored, this would help into overwiting certain interesting values (0x020283E8 helps to get a NidoranM swarm, and could maybe have other uses for certain adresses, but I don&#039;t really know what yet since it&#039;s quite afar from main flag adresses).<br /><br /> This would also help do RAM corruptions in RS, as the storage adress of a Pokemon species name by Slateport&#039;s Journalist is really afar from other interesting adresses, (in Emerald, party pokemon data was a good thing to corrupt, but it isn&#039;t there in RS).<br /> I also haven&#039;t tested to see where the trainer&#039;s name is stored in RS in order to see if it could be helpful to corrupt it.<br />This reminds me that in RS, if the player&#039;s name is too long, you can&#039;t even use the pause menu or things like that, so you&#039;re really blocked if you want to overwrite too much data.<br /> <br /><br />[quote author=Torchickens link=topic=6868.msg198916#msg198916 date=1440191897]<br />Metarkai, do you know an easy way to edit the index number of a PokÃ©mon in the party to any glitch PokÃ©mon with memory viewer without having to do any glitching?<br /><br />I have usually got an Egg from double corruption first then corrupted it again with Pomeg glitch or manually with memory editor to get any PokÃ©mon (including unhatchable glitch PokÃ©mon) based on its EVs. I couldn&#039;t locate CCD7 with cheat searcher sadly.<br /><br />I would like to know of a way to manually change any PokÃ©mon. In the Game Boy games it&#039;s relatively trivial because you could just change two memory addresses (species byte 1 and byte 2); but in Generation III with you having to take the modulo 24 of the personality value to know where the species ID address would be, and the PokÃ©mon being protected by checksum, I don&#039;t know of a step by step way.<br /><br />With anti-DMA enabled, can you tell me the addresses of the stored checksum, and the species ID for PokÃ©mon for all four positions of &quot;Growth&quot; in the substructure orders please?<br />[/quote]<br /><br />If you only want to create a Glitch Pokemon to see what its glitch species does, it&#039;ll be faster to recreate that Pokemon from scratch.<br />But, if you want to have a certain Glitch Pokemon with &quot;more data&quot;, you only have one method to change the Pokemon EVs or species or whatever you want in its substructures.<br /><br />In 3rd Gen, a Pokemon&#039;s PC data (I use PC because you don&#039;t have the stats stored with it, which makes it a bit clearer) is 20 double-words long.<br /><br />To create a Glitch Pokemon with the species you want :<br />- use a Memory viewer in 32-bit mode (it&#039;s easier for Pokemon data to see everything with double-words)<br />- Stay on the Memory Viewer window during all the changes. If you get back to vba without all the changes done, the game can recheck the checkum, see an invalid one, and give you a Bad Egg.<br />- give him a PID (double-word 1) and TID (double-word 2) of 0x0000 0018. A nonzero PID prevents the Pokemon from disappearing when you multi-select PC Pokemon. <br />Its PID is equal to its TID, so the PID xor TID xor double word data crypt on its substructures won&#039;t bother you since it won&#039;t change anything between crypted and non crypted.<br />Its PID is a multiple of 24 in order to have the same substructure order as a PID of 0, because I have the habit of doing it with a PID/TID couple of 0.<br />The substructure order of that Pokemon will be : Growth - Attack - EVs - Misc. Each of these substructures is 3 double-words long, and is stored at the end of the Pokemon&#039;s data (in the case you forget the location of one of these substructures, you can track it back by starting with the end of the Pokemon&#039;s data and subtracting 3 double-words per 3 double-words)<br /><br />- Get to the substructure you want to modify. Check the location of the bits/bytes you want to modify with :<br />http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III<br />and change them to your liking.<br />For Growth, it will be double-words 9,10 and 11.<br />The Pokemon ID is stored on bytes 0 and 1, which means the rightmost bytes of the first double-word. (the right half of it)<br /> With a 32-bit view, these bytes will be in the right order (if you want Pokemon 0xCCD7, put 0000CCD7 in double-word 9), whereas with a 8-bit view the order would have been reversed (D7 CC 00 00).<br /><br />- Sum all the words of the substructures, keep the first 4 characters of it (or cut it modulo 0x1 0000), and store them on the right half of double-word 8.<br />This gives the Pokemon a valid checksum, so he won&#039;t turn into a Bad Egg.<br />With few changes, it&#039;s really easy to make the checksum since you only have few things to add.<br /><br />This is a procedure I use really frequently to make and test glitch pokemon, because it&#039;s fairly easy to do (I could even make a codebreaker code out of this and give you the part to change the species, but I prefer doing it by hand as you can keep trakc of things the Pokemon would get like new moves, exp, PPs,...) (if you want to put it at Lv 100, give him 0xF000 0000 exp points (double-word 10), that will do the trick).<br /><br />Now, if you want to change the same data on an already existing Pokemon, you&#039;ll have to do the same procedure except that you&#039;ll have to :<br />- stay on the memory viewer window, with 32-bit mode.<br />- calculate PID mod 24 and check the substructures order this gives to find back the double-words you want to change<br />- uncrypt the substructures double-words you&#039; want to change with : uncrypted double-word = crypted double-word xor PID xor TID<br />- write down the crypted and uncrypted double-word value<br />- write the double-words values you want (ex : change the species, exp, held item, evs,..)<br />- use the crypting formula to crypt these double-words<br />- write these new crypted double-words on their original place (having the crypted double-word value written down helps you remembering where you have to write the new one)<br />- cut all the uncrypted double-words in half, add all the modified ones, and subtract all the older ones<br />- add that value (mod 0x1 0000) to the ckecksum (right half of double-word 8 )<br /><br />&nbsp; And there you have your Pokemon modified. It&#039;s a bit trickier since it is harder to see the double-word you want to change, and since you have to write down the crypted and uncrypted values if you want to be sure that you didn&#039;t mess up a part (because if you mess up, you get a Bad Egg and you&#039;ll in general never be able to correct your mistakes, so you&#039;ll have to reload a savestate or deal with it).<br /><br />&nbsp; If you have issues with it or if my explanations are a bit messy, feel free to message me again and ask me any other thing you want about this. I can provide you saves, codes, dumps, or directly show it on skype or twitch for more efficiency, as I tried here to not take too much time writing down the procedure since this post is already quite long.<br /><br /><br /><br /><br />[quote author=Torchickens link=topic=6868.msg198916#msg198916 date=1440191897]<br />&nbsp; Yeah, perhaps without further knowledge it may be like Generation I (a PokÃ©mon with a glitch experience curve that can normally never stay past level 1 after battle, or a PokÃ©mon with a glitch experience curve that has [url=http://forums.glitchcity.info/index.php/topic,6588.msg196436.html#msg196436]division by zero[/url])<br />[/quote]<br /><br />I doubt this comes from the experience curve as some glitch pokemon can eat their Rare Candies easily. <br />However, I didn&#039;t check precisely their exp curves, so there could be certain exp curves that make the game crash.<br />But I think there are multiple reasons behind these crashes since the game doesn&#039;t always freeze at the same time.


subject: Re: Emerald Teach move Glitch
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7335.msg198908#msg198908 date=1440179592]<br />When I tried the glitch in English Ruby in the VBA emulator, the red box that normally surrounds &quot;YES&quot; or &quot;NO&quot; was still visible. The box did not appear in Japanese Ruby, FireRed or Emerald (which apparently do not have it).<br />[/quote]<br /><br />The red focus rectangle is only used by the Western Ruby and Sapphire due to the large font. Japanese Ruby and Sapphire and all versions of FireRed, LeafGreen, and Emerald use a black focus arrow.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Searinox link=topic=6638.msg198919#msg198919 date=1440241378]<br />Does anyone know any gameshark code for changing the moves of pokemon IN THE BOX? There&#039;s gameshark codes for changing party pokemon moves that can I wanted to try to convert to code exec using Chickasaurus&#039; [url=http://forums.glitchcity.info/index.php/topic,6638.msg189536.html#msg189536]post[/url] info but all I can find is codes for the party, not the box, which is useless since we&#039;re forced to use a full predefined party for the bootstrap.<br />[/quote]<br /><br />Damn. I overlooked that we wouldn&#039;t be able to use [url=http://forums.glitchcity.info/index.php/topic,6638.msg198914.html#msg198914]the code[/url] in Red/Blue (with x115 instead of x114) because of 8F requiring specific party PokÃ©mon (unless you wanted to change your Pidgey, Onix etc&#039;s moves). The code works in Yellow, but I didn&#039;t think about the party PokÃ©mon problem for Red/Blue, sorry.<br /><br />The code I made works in PokÃ©mon Yellow with ws m because that requires specific stored PokÃ©mon; so in Yellow you can manipulate the moves of party PokÃ©mon.<br /><br />[url=http://forums.glitchcity.info/index.php/topic,6638.msg196498.html#msg196498]The glitch item -g m (hex:6A)[/url] in Red/Blue can be used with a stored PokÃ©mon bootstrap code akin PokÃ©mon Yellow, provided there aren&#039;t bad values in Safari Balls, Day Care (if you have ever deposited a PokÃ©mon in the Day Care this may not be an option as values stay even after withdrawing). Hence that can be used to alter party PokÃ©mon moves in Red/Blue.<br /><br />If you cannot find a memory address on DataCrystal, another good two places are the [url=http://glitchcity.info/wiki/index.php/Pok%C3%A9mon_Red,_Blue_and_Yellow_GameShark_codes]GameShark codes archive[/url] (as you know, if you reverse the order of the last two bytes you will get the memory address, e.g. 01??81DA 01??96DA means modify DA81 and DA96) as well as [url=https://github.com/iimarckus/pokered/blob/master/wram.asm]PokÃ©mon Red disassembly[/url].<br /><br /><br />[quote author=Searinox link=topic=6638.msg198923#msg198923 date=1440354096]<br />Firstly Chickasaurus&#039; post I linked in my previous post didn&#039;t work for me. Second, it requires a different item ID for each move which is slightly clunky. At first I had the idea of perhaps attempting a .j as a NOP to bring ID parity back and execute the instruction back in item amount instead of ID, but realised I was getting in way over my head since I would have to then figure out how to redirect to the address with another item and do not fully understand ASM instructions.<br />[/quote]<br /><br />I&#039;m not sure if you did something wrong if it requires a different item ID. You could use that skeleton to create this code to change stored PokÃ©mon 1:<br /><br />3E xx<br />EA 9E DA<br />C9<br /><br />Lemonade x(move)<br />TM34 x158 (or 159 for changing move 2, 160 for move 3, 161 for move 4)<br />TM18 x209<br /><br />There may be confusion because the endianness is different for this method (9EDA instead of DA9E)<br />compared to using the h and l registers (DA in h, 9E in l).<br /><br />[quote author=Searinox link=topic=6638.msg198923#msg198923 date=1440354096]<br />I then went to try and find the memory address with VBA&#039;s cheat maker. For reasons completely beyond me the cheat searcher finds the address CA9E as the location instead of DA9E, and obviously the cheat doesn&#039;t work. Why this is so baffles me. I&#039;m using a modded VBA called VBA-M, svn926. I&#039;m not sure if it&#039;s got a bug with memory offset representation but it lead me to a dead end.<br />[/quote]<br />Yeah, it is a bug. When you see a CXXX address in cheat searcher, make sure to try it as DXXX as well.<br /><br />[quote author=Searinox link=topic=6638.msg198923#msg198923 date=1440354096]<br />Have the Pokemon to be altered be the first one in the PC. Have its move to be altered be put in first slot.<br />[code]8F<br />&lt;any item&gt;<br />X Accuracy x158 (changing this from 158 for first move to 161 for 4th move SHOULD change the move that&#039;s altered, though I have ONLY tested with the first move!)<br />Carbos x218<br />Max Revive x&lt;MOVE ID&gt;<br />Poke Ball x201[/code]<br />Where move ID obviously corresponds to the [url=http://www.psypokes.com/rby/codeviewer.php?page=attacks]move&#039;s ID[/url].<br />This will change the first move of the first Pokemon in your active box.<br />[/quote]<br /><br />Congratulations on doing this yourself! I see you used l and h. Your code is a little more flexible than the earlier skeleton Wack0 posted for built in GameShark if used as:<br /><br />X Accuracy x(address byte 2 e.g. 9E)<br />Carbos x(address byte 1 e.g. DA)<br />Max Revive x&lt;MOVE ID&gt;<br />Poke Ball x201<br /><br />Because the value (move ID) and both address bytes depend on the quantity - you can access every quantity easily (plus 00 if you got the X Accuracy with item underflow because you can have y-block values (following x coordinate) of 00), though you can&#039;t edit 00XX as it is in ROM (though you could &#039;write&#039; 0A to 0000 0A as that opens up SRAM (A000+) for write access, I&#039;m not sure how that works exactly).<br /><br />Plus, it&#039;s a bit messy, but we can use this altered code to set every quantity from item 3-5 to 0 (256, you can toss to get 1-255) upon use if you can force extra stacks of X Accuracy and Carbos and get two Water Stone stacks (by withdrawing two stacks of 99). This lets us change multiple addresses (even if you require a greater quantity) with multiple 8F uses.<br /><br />X Accuracy x(address byte 2 e.g. 9E)<br />Carbos x(address byte 1 e.g. DA)<br />Max Revive x&lt;MOVE ID&gt;<br />Carbos x 211<br />X Accuracy x 35<br />Soda Pop x175<br />Water Stone x44<br />PokÃ© Ball x34<br />Great Ball x44<br />Water Stone (or PP Up if you don&#039;t want two Water Stone stacks) x201<br /><br />ASM for the footer (set item 3-5 quantities to 0):<br /><br />[code]<br />ld h,D3<br />ld l,23<br />dec a<br />xor a<br />ldi (hl),a<br />inc l<br />inc b<br />ldi (hl),a<br />inc bc<br />inc l<br />ldd (hl),a<br />[/code]


subject: Re: Emerald Teach move Glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7335.msg198927#msg198927 date=1440433898]<br />[quote author=Torchickens link=topic=7335.msg198908#msg198908 date=1440179592]<br />When I tried the glitch in English Ruby in the VBA emulator, the red box that normally surrounds &quot;YES&quot; or &quot;NO&quot; was still visible. The box did not appear in Japanese Ruby, FireRed or Emerald (which apparently do not have it).<br />[/quote]<br /><br />The red focus rectangle is only used by the Western Ruby and Sapphire due to the large font. Japanese Ruby and Sapphire and all versions of FireRed, LeafGreen, and Emerald use a black focus arrow.<br />[/quote]<br /><br />Thanks for the info!


subject: Re: Emerald Teach move Glitch
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7335.msg198929#msg198929 date=1440448617]<br />Thanks for the info!<br />[/quote]<br /><br />You&#039;re welcome :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Searinox
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Searinox
icon: xx
body:
  Open up SRAM for write access? That sounds quite dangerous. I can do that with these instructions? Yikes. I don&#039;t wanna write to my save file!<br /><br />Yes I have deposited Pokemon in daycare before. Then again we can make a code to blank out the daycare memory area right? A bit bothersome however, because I use the daycare to stabilize some glitch Pokemon.<br /><br />Thanks for confirming the VBA Gameshark bug. I&#039;ll be updating VBA-M when I have time. Have you run into this before or is it strictly on my emulator build?<br /><br />Why use code to underflow items to x0? Can&#039;t we just create a stack of x255, clone it by tossing something, then toss x254 out of one stack to bring it down to x1 and swap it with the other x255 to merge them into a single x0 stack? Am I misunderstanding?


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Thank you! I will try these methods later.<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />Yup, exactly. It really helped me to determine the name lenght of glitch Pokemon and see what &quot;families&quot; had the biggest name lenght, in order to directly know approximative values of identifiants I should use if I wanted to corrupt certain values like Battle Pyramid Bag.<br /><br />I also modified an US Emerald ROM in order to make it read French Pokemon names, as I wasn&#039;t able to fully modify the .ini to make it directly read a French ROM.<br /><br />For specific searches of Glitch Moves effects or Glitch Pokemon specificities, TheZzAzZGlitch gave me python scripts to help me for that (they are basic scripts as it&#039;s only a matter of wanting a certain value on a certain place, but I had nothing to do that for me before).<br />[/quote]<br /><br />Yes, I&#039;ve also found that tool useful for choosing glitch PokÃ©mon of suitable length.<br /><br />Cool.<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />For now, these scripts mainly helped me testing abuses of the &quot;NÂ° of party Pokemon in battle&quot; value.<br />My goal was to have a glitch move with a name long right enough to corrupt that value, and use healing or self-damaging moves to change the HP of my Pokemon. This would force the game to update the hp of the Pokemon &quot;sent in battle&quot;, which would have been the Pokemon at the corrupted party slot.<br />Depending on the party slot values, accurate corruptions of things like special islands flags, mirage island,... could have been possible. However, this value is right at the start of a block of values managing the battle, and all the glitch moves with a good name lenght make the game crash (another adress near the concerned one gets a value that makes the game freeze or reset).<br /><br /> But, writing this made me think about another possible way to exploit this, through the opponent&#039;s Pokemon HP. I&#039;ll look into this.<br />[/quote]<br /><br />That&#039;s interesting. As well as out of bounds in battle HP slots, might you be able to have that PokÃ©mon gain experience? May simply sending it into battle to let the game know that the PokÃ©mon participated set an invalid value?<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />There&#039;s another thing I wanted to test, which was&nbsp; the evolution lines. Can a Glitch Pokemon with a non-glitched sprite and name evolve ? And is that evolution condition the element that makes the game freeze when you give Rare Candies to a Glitch Pokemon ?<br />[/quote]<br />Ah. Maybe there could be glitch evolution conditions that allow you to execute arbitrary code?<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />I also wanted to check the Move Relearner a bit more accurately, as I confirmed that the list of relearnable moves contain one exemplary of each move present into the &quot;Learnable Move&quot; list of the Glitch Pokemon until Move 0000 shows (whereas in Gen III Extended suite, the learnable moves list goes further than that).<br />[/quote]<br /><br />Interesting.<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />I also wanted to test the Glitch Move types, to see if there were some that could have nice effects.<br />I also wanted to test the effects of Glitched Special abilities, but I don&#039;t really know how to make a test for this (to know if they have an effect during a battle or outside a battle, and what that effect might be). I also don&#039;t know their full name lenght, as maybe something like Skill Swap could make new RAM overwriting cases.<br />[/quote]<br /><br />If you use [url=http://www.emuparadise.me/Nintendo_DS_Emulators/Windows/No$gba_Debugger/80]No$gba Debugger[/url], go on Debug&gt;Define Break/Condition and enter in the box [r15]&lt;80 (or [r15]&lt;30 if you want search for just WRAM and BIOS executions), and also enter [r15]&gt;90 then the emulator might be able to tell you what code it&#039;s trying to execute if you stumble across a glitch ability that executes arbitrary code. These breakpoints tell you when r15 (execution pointer) is less than 8000000, 3000000 or greater than 9000000 (past the end of the ROM).<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />Someone on PRAMA had a good idea about testing if Glitch Pokemon names could change the NPC&#039;s script to values that would be ROM adresses with interesting scripts (like Hall of Fame, engaging a battle against a legendary, ...).<br />However, the answer was negative. I didn&#039;t find any set of 4 bytes that would be near the end of a Glitch Pokemon&#039;s name with a certain lenght (like 18.000 characters long) that would look like a ROM adress towards NPC/events scripts.<br />There are maybe some other values that could be exploited like this, but I don&#039;t really know what other values I could give for a NPC script adress in order to get nice results (it has to do someting like a teleport, as a glitch Pokemon species name of that lenght corrupts the player current location and he would be outside of the building, and taking a single step crashes the game).<br />[/quote]<br /><br />Ah, that&#039;s a shame. :/<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />&nbsp; While trying to check the existence of the rumoured Lotad Swarm in RSE (I found the ROM adresses managing swarms and he wasn&#039;t there, so unless someone shows it, I heavily doubt he existed), I came to think of another way to make the game read a Glitch Pokemon species name, which would be TV news.<br />I haven&#039;t tested it yet, but with news that display the species name of Pokemon like the name master or other ones, I think the game would read the species name of the ID stored in the adresses related to the news.<br />&nbsp; This could maybe be useful for RAM data overwriting as it could provide another starting adress for that overwriting.<br />For now, I know of 2 adresses for RAM data overwriting : 0x02021CC0 (the adress where the species name is stored when you talk to Slateport&#039;s Journalist in the Pokemon Fan Club), and another adress around 0x020283E8 (the trainer name is stored there when you reload your save, exit the Safari game, and maybe with other actions).<br />If we had other adresses where names of Glitch Pokemon, Glitch Moves, or Glitches Trainer Name were stored, this would help into overwiting certain interesting values (0x020283E8 helps to get a NidoranM swarm, and could maybe have other uses for certain adresses, but I don&#039;t really know what yet since it&#039;s quite afar from main flag adresses).<br /><br /> This would also help do RAM corruptions in RS, as the storage adress of a Pokemon species name by Slateport&#039;s Journalist is really afar from other interesting adresses, (in Emerald, party pokemon data was a good thing to corrupt, but it isn&#039;t there in RS).<br /> I also haven&#039;t tested to see where the trainer&#039;s name is stored in RS in order to see if it could be helpful to corrupt it.<br />This reminds me that in RS, if the player&#039;s name is too long, you can&#039;t even use the pause menu or things like that, so you&#039;re really blocked if you want to overwrite too much data.<br />[/quote]<br /><br />I didn&#039;t know there was rumoured Lotad swarm, interesting.<br /><br />Nice. I hope TV corruption works then so we have even more stuff to do with glitch PokÃ©mon.<br /><br />[quote author=Metarkrai link=topic=6868.msg198926#msg198926 date=1440424154]<br />I doubt this comes from the experience curve as some glitch pokemon can eat their Rare Candies easily. <br />However, I didn&#039;t check precisely their exp curves, so there could be certain exp curves that make the game crash.<br />But I think there are multiple reasons behind these crashes since the game doesn&#039;t always freeze at the same time.<br />[/quote]<br /><br />I see.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Searinox link=topic=6638.msg198931#msg198931 date=1440452184]<br />Open up SRAM for write access? That sounds quite dangerous. I can do that with these instructions? Yikes. I don&#039;t wanna write to my save file!<br />[/quote]<br /><br />You do not have to. It is only if you do a 0A write to 0000 and then modify the code to write to a SRAM address of your choice. (These instructions won&#039;t have any unexpected side effects). With the old skeleton, you could use the start of it to write to 0000 too, it just required a hex:00 glitch item.<br /><br />If you are careful, writing to SRAM can be useful because you can choose to write custom Hall of Fame entries.<br /><br />[quote author=Searinox link=topic=6638.msg198931#msg198931 date=1440452184]<br />Yes I have deposited Pokemon in daycare before. Then again we can make a code to blank out the daycare memory area right? A bit bothersome however, because I use the daycare to stabilize some glitch Pokemon.<br />[/quote]<br /><br />Yes. You could use a program that alters itself (by means of increasing a quantity, etc.) modifying DA47 (number of Safari Balls) the first use, then DA48 (part of the Day Care the second use) and so on.<br /><br />Alternatively, you could use the FillMemory (call 36E0) function. First you&#039;d need to set &#039;a&#039; as 00, bc as how many bytes to fill (DA80-DA47=39h) and hl as DA80. That might be a harder program to write and get reasonable items with.<br /><br />[quote author=Searinox link=topic=6638.msg198931#msg198931 date=1440452184]<br />Thanks for confirming the VBA Gameshark bug. I&#039;ll be updating VBA-M when I have time. Have you run into this before or is it strictly on my emulator build?<br />[/quote]<br /><br />You&#039;re welcome. I&#039;ve had it on my build too, which is VBA v24 svn422. I do not know if it has been fixed. Yes.<br /><br />[quote author=Searinox link=topic=6638.msg198931#msg198931 date=1440452184]<br />Why use code to underflow items to x0? Can&#039;t we just create a stack of x255, clone it by tossing something, then toss x254 out of one stack to bring it down to x1 and swap it with the other x255 to merge them into a single x0 stack? Am I misunderstanding?<br />[/quote]<br /><br />Actually yes. You can do that. It would decrease your number of items each time, but if you&#039;re not going to use 8F 255 times, that&#039;s not such a problem.<br /><br />My intention is if you want to easily make multiple memory modifications later, even ones that require a higher quantity. Say you edited DA9E; so you toss your X Accuracy until you have 158 but later decided you an wanted to edit DA9F too (x159). But you couldn&#039;t create an extra X Accuracy (buying won&#039;t add to the stack, the game will try to split the stacks in 99s max) without another duplication or generation - so by setting the quantity back to 0, we could toss 97 to get 159.<br /><br />(Note, you could of course get 159 first and use 8F and then get 158 and not have to increase the quantity - but if you decided later you wanted to get 160 you&#039;d be &#039;stuck&#039;)<br /><br />If you can get the right items, the extended code is a straight forward and fast way that is more reliable, for the purpose of making many different modifications not restricted by quantity reducing, but it&#039;s not essential (you could do the x255 stack glitch to stockpile x255 items, or repeat item duplication, or fix your item pack then do item underflow again and item generation again).<br /><br />Thinking about how you could do it with item stack glitch...<br /><br />If you modified move 1 first but then later wanted to modify move 2 you could bring:<br /><br />8F<br />(item)<br />X Accuracy x255<br />Max Revive x&lt;MOVE ID&gt;<br />Poke Ball x201<br />Carbos x(address byte 1 e.g. DA)<br />(...249 items)<br /><br />1) Create an extra X Accuracy x255 in slot 2 by tossing the second item.<br />2) Get X Accuracy x158 in slot 3 and use 8F.<br />3) Put the X Accuracy x158 in slot 1. (not slot 2, as to avoid an item merge)<br />4) Put the X Accuracy x255 in slot 3.<br />5) Put the X Accuracy x158 in slot 2.<br />6) Toss the X Accuracy x158 to get an extra x255 and set up the list as above but with X Accuracy x159 instead.<br /><br />..Repeat steps 2-6 with quantities of your choice for further modifications.<br /><br />There may be a way that is logistically better.


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Krys3000 link=topic=7332.msg198921#msg198921 date=1440326216]<br />[quote]The reason why you can encounter grass PokÃ©mon on the strip even when the grass encounter rate is 00 is because the game uses the water encounter rate with the grass PokÃ©mon list.<br /><br />Apparently (I say this because I don&#039;t know a part of the disassembly to confirm it), according to Dabomstew this is because on the 2x2 block that makes up a position you can walk/Surf to, the west part of the block controls the PokÃ©mon you encounter and the east part controls the encounter rate. The &quot;coast&quot; is read as &quot;use grass encounter list&quot; (and with the old man glitch we can have grass encounters in this list we aren&#039;t supposed to have). The water is read as &quot;use water encounter rate&quot; (as one would expect).<br /><br />Apparently, this also explains a &#039;glitch&#039; that does not occur in PokÃ©mon Yellow, where in the Viridian Forest, if you walk on to a grass tile that has a star in it on the bottom right corner you won&#039;t get any encounters because, apparently the right half with a star is classified as neither a grass or water tile, so the game does &quot;encounter rate is 0&quot;.<br />[/quote]<br /><br />Thank you for that explanation. I was looking for the reason why the encounter rate going back to 00 doesn&#039;t affect the Old Man Glitch and couldn&#039;t find it until then.<br /><br />About that glitch Paco documented, are we sure it doesn&#039;t work on other European versions? I believe Italian, Spanish, French and German games all share the same addresses. I&#039;d make a test in a french version unless you know it won&#039;t work.<br />[/quote]<br /><br />You&#039;re welcome.<br /><br />I tried it in the French version and got grass encounters. In the German version I wasn&#039;t able to get any encounters, as in the English version, but I&#039;m unsure if I was unlucky. It could be that one of or both the German or English versions do give encounters.<br /><br />The glitch works in the Spanish and Italian versions. In English and Spanish Yellow, as well as Green v1.0, Japanese Blue, Japanese Yellow v1.0 I got grass encounters.<br /><br />I&#039;ve noticed that map script memory addresses are in the PokÃ©mon Red disassembly under [url=https://github.com/iimarckus/pokered/blob/master/wram.asm]wram.asm[/url] This should be useful for people who want to change another map to add an arbitrary script (and an arbitrary script can be found by experimenting with different IDs and setting a breakpoint in BGB to 8000-FEFF via debug&gt;access breakpoints, so that BGB will tell you where in memory it&#039;s executing code).<br /><br />[code]<br />W_OAKSLABCURSCRIPT:: ; d5f0<br />W_PALLETTOWNCURSCRIPT:: ; d5f1<br />W_BLUESHOUSECURSCRIPT:: ; d5f3<br />W_VIRIDIANCITYCURSCRIPT:: ; d5f4<br />W_PEWTERCITYCURSCRIPT:: ; d5f7<br />W_ROUTE3CURSCRIPT:: ; d5f8<br />W_ROUTE4CURSCRIPT:: ; d5f9<br />W_VIRIDIANGYMCURSCRIPT:: ; d5fb<br />W_PEWTERGYMCURSCRIPT:: ; d5fc<br />W_CERULEANGYMCURSCRIPT:: ; d5fd<br />W_VERMILIONGYMCURSCRIPT:: ; d5fe<br />W_CELADONGYMCURSCRIPT:: ; d5ff<br />W_ROUTE6CURSCRIPT:: ; d600<br />W_ROUTE8CURSCRIPT:: ; d601<br />W_ROUTE24CURSCRIPT:: ; d602<br />W_ROUTE25CURSCRIPT:: ; d603<br />W_ROUTE9CURSCRIPT:: ; d604<br />W_ROUTE10CURSCRIPT:: ; d605<br />W_MTMOON1CURSCRIPT:: ; d606<br />W_MTMOON3CURSCRIPT:: ; d607<br />W_SSANNE8CURSCRIPT:: ; d608<br />W_SSANNE9CURSCRIPT:: ; d609<br />W_ROUTE22CURSCRIPT:: ; d60a<br />W_REDSHOUSE2CURSCRIPT:: ; d60c<br />W_VIRIDIANMARKETCURSCRIPT:: ; d60d<br />W_ROUTE22GATECURSCRIPT:: ; d60e<br />W_CERULEANCITYCURSCRIPT:: ; d60f<br />W_SSANNE5CURSCRIPT:: ; d617<br />W_VIRIDIANFORESTCURSCRIPT:: ; d618<br />W_MUSEUM1FCURSCRIPT:: ; d619<br />W_ROUTE13CURSCRIPT:: ; d61a<br />W_ROUTE14CURSCRIPT:: ; d61b<br />W_ROUTE17CURSCRIPT:: ; d61c<br />W_ROUTE19CURSCRIPT:: ; d61d<br />W_ROUTE21CURSCRIPT:: ; d61e<br />W_SAFARIZONEENTRANCECURSCRIPT:: ; d61f<br />W_ROCKTUNNEL2CURSCRIPT:: ; d620<br />W_ROCKTUNNEL1CURSCRIPT:: ; d621<br />W_ROUTE11CURSCRIPT:: ; d623<br />W_ROUTE12CURSCRIPT:: ; d624<br />W_ROUTE15CURSCRIPT:: ; d625<br />W_ROUTE16CURSCRIPT:: ; d626<br />W_ROUTE18CURSCRIPT:: ; d627<br />W_ROUTE20CURSCRIPT:: ; d628<br />W_SSANNE10CURSCRIPT:: ; d629<br />W_VERMILIONCITYCURSCRIPT:: ; d62a<br />W_POKEMONTOWER2CURSCRIPT:: ; d62b<br />W_POKEMONTOWER3CURSCRIPT:: ; d62c<br />W_POKEMONTOWER4CURSCRIPT:: ; d62d<br />W_POKEMONTOWER5CURSCRIPT:: ; d62e<br />W_POKEMONTOWER6CURSCRIPT:: ; d62f<br />W_POKEMONTOWER7CURSCRIPT:: ; d630<br />W_ROCKETHIDEOUT1CURSCRIPT:: ; d631<br />W_ROCKETHIDEOUT2CURSCRIPT:: ; d632<br />W_ROCKETHIDEOUT3CURSCRIPT:: ; d633<br />W_ROCKETHIDEOUT4CURSCRIPT:: ; d634<br />W_ROUTE6GATECURSCRIPT:: ; d636<br />W_ROUTE8GATECURSCRIPT:: ; d637<br />W_CINNABARISLANDCURSCRIPT:: ; d639<br />W_MANSION1CURSCRIPT:: ; d63a<br />W_MANSION2CURSCRIPT:: ; d63c<br />W_MANSION3CURSCRIPT:: ; d63d<br />W_MANSION4CURSCRIPT:: ; d63e<br />W_VICTORYROAD2CURSCRIPT:: ; d63f<br />W_VICTORYROAD3CURSCRIPT:: ; d640<br />W_FIGHTINGDOJOCURSCRIPT:: ; d642<br />W_SILPHCO2CURSCRIPT:: ; d643<br />W_SILPHCO3CURSCRIPT:: ; d644<br />W_SILPHCO4CURSCRIPT:: ; d645<br />W_SILPHCO5CURSCRIPT:: ; d646<br />W_SILPHCO6CURSCRIPT:: ; d647<br />W_SILPHCO7CURSCRIPT:: ; d648<br />W_SILPHCO8CURSCRIPT:: ; d649<br />W_SILPHCO9CURSCRIPT:: ; d64a<br />W_HALLOFFAMEROOMCURSCRIPT:: ; d64b<br />W_GARYCURSCRIPT:: ; d64c<br />W_LORELEICURSCRIPT:: ; d64d<br />W_BRUNOCURSCRIPT:: ; d64e<br />W_AGATHACURSCRIPT:: ; d64f<br />W_UNKNOWNDUNGEON3CURSCRIPT:: ; d650<br />W_VICTORYROAD1CURSCRIPT:: ; d651<br />W_LANCECURSCRIPT:: ; d653<br />W_SILPHCO10CURSCRIPT:: ; d658<br />W_SILPHCO11CURSCRIPT:: ; d659<br />W_FUCHSIAGYMCURSCRIPT:: ; d65b<br />W_SAFFRONGYMCURSCRIPT:: ; d65c<br />W_CINNABARGYMCURSCRIPT:: ; d65e<br />W_CELADONGAMECORNERCURSCRIPT:: ; d65f<br />W_ROUTE16GATECURSCRIPT:: ; d660<br />W_BILLSHOUSECURSCRIPT:: ; d661<br />W_ROUTE5GATECURSCRIPT:: ; d662<br />W_POWERPLANTCURSCRIPT:: ; d663<br />W_ROUTE7GATECURSCRIPT:: ; d663	<br />W_SSANNE2CURSCRIPT:: ; d665<br />W_SEAFOAMISLANDS4CURSCRIPT:: ; d666<br />W_ROUTE23CURSCRIPT:: ; d667<br />W_SEAFOAMISLANDS5CURSCRIPT:: ; d668<br />W_ROUTE18GATECURSCRIPT:: ; d669<br />[/code]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Searinox link=topic=6638.msg198923#msg198923 date=1440354096]<br />why do GS codes have 01xxB2B1 last 2 bytes reversed from how they are in RAM?<br />[/quote]<br /><br />Because endianness. The Game Boy and GBC uses little-endian.


subject: Anedapami hybrid?
poster_name: Sounansu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: clip
body:
  This is my first post here, sorry if my English isn&#039;t perfect, I&#039;m from Germany.<br /><br />So I&#039;ve been beaten Green 1.0 using the Dokokashira Door glitch and used the fix where you can get 25 Eevees. I decided to keep playing from there. I got to the point where you can choose between Hitmonlee and Hitmonchan. I chose Hitmonlee. I wasn&#039;t really paying attention to what I was doing next, I think I was just switching around pokemon in my party, but somehow, my regular Hitmonlee was gone and instead, I had a Hitmonlee with a Charizard sprite. Sometimes it hides the pokemon in below it in the party, just like Anedapami, but sometimes it shows them completely glitched. Not sure what that depends on. I tried playing around with it and it&#039;s stable in battle, but when it&#039;s defeated, it can&#039;t be healed at the Pokemon Center. So... is this known already or did I just discover a new glitch? If it is known, how exactly is it performed, because it just happened to me by accident... :-\


subject: Re: The Member's Guide to Topiclessness
poster_name: Missing? NO!
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  You know what something really weird is? I started using this site when I was 9 years old. I am now 18 years old and have graduated high school, and will study business administration/computer science in college at the University of Washington. I&#039;ve been on this site for literally half of my life.<br /><br />Life moves fast.


subject: 3DS Homebrew Launcher
poster_name: Missing? NO!
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Recently, a 3DS exploit involving the 3DS YouTube app was released by Smealum, allowing the user of the exploit to run homebrew software on their 3DS/New 3DS. As of now, the selection of homebrew is small, but extremely helpful. Homebrew applications, at the time of writing, include a Minecraft clone, emulators for NES, SNES, and Gameboy, along with FTP file hosting and other useful tools.<br /><br />Having downloaded and used the exploit myself, I can say that (and even though I sound like a canned review right now) the release of the Homebrew Launcher to the public will have a dramatic affect on the amount of homebrew applications available to the public. Basically, now that an exploit involving a commonly-installed app (YouTube) has been released to the public, I fully expect 3DS Homebrew to blow up in a few months time.<br /><br />A tutorial on how to install the 3DS Homebrew Launcher and applications can be found here: https://smealum.github.io/3ds/<br /><br />This is not been a paid advertisement.


subject: Re: 3DS Homebrew Launcher
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah I posted back when people had to download Ironfall but it was just a post so some people may have missed, sadly it was taken down from the eShop (it&#039;s better when you have it because you can use Youtube to install the offline launcher).<br /><br />[url=http://wiki.gbatemp.net/wiki/List_of_3DS_homebrew]List of all 3DS homebrew[/url], but only the ones with .3dsx are available and everything related to CFW or installing CIAs are a no-no since unlike Ninjhax 1.0 this does not have kernel access.<br /><br />Smea is going to release TVDS, which is a program to import/export saves, and allow us to gen again. Though it&#039;ll also allow editing stuff on PokÃ©Shuffle/Rumble so I&#039;m afraid this may trigger an update/fix. No ETA for release yet.<br /><br />As of now, the main things you can do is:<br />- Use emulators (I just tested SNES so far, but from reports, GBA seems to run slow)<br />- Custom themes (using [url=http://i.imgur.com/Mw0VSoI.jpg]this one[/url] right now :) )<br />- Edit play coins (not sure if actually works in this version)<br />- Access your sdcard via FTP (useful for installing apps, and will be a lot helpful when TVDS comes out)<br />- Play some random minigames on that page


subject: Re: The Pokegod People People Eaters!! [PWN YOU!]
poster_name: shaggs
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Back in the day, if me or scf3 were involved you had to expect the unexpected. Good times haha, I&#039;m so glad they made PokeGods real with mega evolutions. My childhood dream come true. I wish they would have given them original names, even if it&#039;s just temporary.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Searinox
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Searinox
icon: xx
body:
  This is becoming too fun. Wheeeeeeeeeeee!<br /><br />Perfect DVs for first Pokemon in active box:<br />[code]8F<br />&lt;any item&gt;<br />X Accuracy x178(speed, special, half of hp), then again with 177(attack, defense, the other half of hp)<br />Carbos x218<br />Max Revive x255<br />Poke Ball x201[/code]<br /><br />Tell me, the following code below can work right?<br /><br />[code]8F<br />&lt;any item&gt;<br />X Accuracy x178<br />Carbos x218<br />Max Revive x255<br />X Accuracy x177<br />Carbos x218<br />Max Revive x255<br />Poke Ball x201[/code]<br /><br />To do it in one go.


subject: Re: Anedapami hybrid?
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Glitched PokÃ©mon sprites are a common occurrence with Anedapami, and the go away USUALLY when you close the menu. It hiding the sprites, and not being able to heal, is unique to Anedapami, because the game stops reading at the PokÃ©mon terminator, which is value FF, the same as Anedapami, or Charizard &#039;M.


subject: Re: 3DS Homebrew Launcher
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spoink
icon: xx
body:
  Too bad I have no sd card access at the moment :( I still have the Tubehax and Ironfall downloaded :)


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spoink
icon: xx
body:
  If you have 0 fly locations, the town name data that is written is part of the Pikachu&#039;s Beach minigame graphics. This is why hooked metapod appears.


subject: Re: 3DS Homebrew Launcher
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Spoink link=topic=7340.msg198946#msg198946 date=1440599959]<br />Too bad I have no sd card access at the moment :( I still have the Tubehax and Ironfall downloaded :)<br />[/quote]<br /><br />Well you kinda just need a reader once to put the starter kit/boot.3dsx, because the next times you can just use the built-in FTP program. :) As long as your computer and 3DS are connected to the same router, it should work.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t think you could have the invalid slot Pokemon gain experience as this slot would be (nearly everytime) a Bad Egg, and Bad Eggs can&#039;t gain exp.<br /><br />What you&#039;re saying about the &quot;participation&quot; seems interesting. I don&#039;t think it could really do super things as the value for battle participation is beween the values managing the battle, and far away from other elements, but I&#039;ll look for that.<br /><br />I planned to answer all your remarks today, as I finally progressed in the speedrun route, but it looks like I won&#039;t be able to.<br />You made me rethink the &quot;slot of battling pokemon&quot; idea and I finally have a way to make it work !<br /><br />The way to make it work is relatively similar of Pomeg Glitch RAM corruption : <br />- Set a certain party slot for &quot;last pokemon sent in battle&quot;.<br />- Kill all your party with Pomeg Berries. <br />- Make a wild battle.<br /><br />The &quot;last Pokemon sent in battle&quot; byte, located at 0x0202406E is easily corruptible with Glitch Pokemon species names at Slateport, as you have around 2.000 bytes between that adress and the adress managing the trainer name and sprite.<br /><br />With the rough setup mentioned above, what the game does is that he sends in battle the data located at party slot &quot;slot of last battling Pokemon&quot;, whatever might be in that slot.<br />This will be in general either an empty slot (Decamark) or a Bad Egg.<br />In both cases, if you look at the Pokemon&#039;s moves, bad things will result (blacking out or freezing the game), so don&#039;t do it.<br /><br />I haven&#039;t tested many things with a Decamark since I directly went for data corruption, which gave me party slots containing Bad Eggs.<br />What happens for Bad Eggs is that when they take a hit, their HP are updated in the block of data managing the &quot;party slot&quot; where they came from. (You can&#039;t heal them yourself as they are Bad Eggs and they can&#039;t heal themselves as they have glitched moves)<br /><br />If your Bad Egg has 0 current HP, you won&#039;t be able to take a hit and black out.<br />If your Bad Egg has 0 Max HP, the game will softlock when you&#039;ll take a hit.<br />If the Bad Egg has less current HP than Max HP, then he&#039;ll take a hit like in a normal battle (I haven&#039;t checked what certain effects like poison would do), and the value managing its current HP will be updated.<br />If the Bad Egg has more current HP than Max HP, his current HP will start by decreasing down to its Max HP before being updated as if they took the hit normally. The decreasing speed of the HP depends on the Max HP value, and if you have 0 Max HP, it doesn&#039;t decrease at all. Thus, this waiting phase can be more or less long depending on the HP you have to lose, and the speed of the HP decrease.<br /><br />And after that, you&#039;re free to flee using a Fluffy Tail, the fact that you battle with an Egg doesn&#039;t bother the game much more than that.<br /><br />Regarding the party slot values, if you use values from 6 to 11, you&#039;ll end up with an opponent&#039;s Pokemon, and I haven&#039;t tested that, in the case there would be something funny/nice to do by battling with the opponent&#039;s Pokemon.<br /><br />The adresses for &quot;Remaining HP&quot; of every party slot are bytes on the left side of double-words, so you can&#039;t corrupt every byte you want.<br />Since you also need the Remaining HP and Max HP adresses to not be at 0x0000 beforehand, there are also adresses you can&#039;t corrupt because of this.<br /><br />Here is for now the list of corruptible elements that would be interesting to corrupt :<br />-Duplicate a PC/Bag Item. Duplicate Battle Bag items.<br />-Change the Feebas Tile value (well no, it finally isn&#039;t that interesting as you&#039;ll only change the value compared to the first value)<br />-Corrupt Repel Steps. (for approximately 65.000 repel steps)<br />-Get 2nd gen starters from Pr Birch.<br />-Get some Golden Symbols.<br />-Unlock Southern, Faraway, and Birth Islands.<br /><br />Yeah, this corruption is the easy door through Mew and Deoxys Islants unlock !<br />I already knew this method would work as I tried it a different way, and all it was needing was a working procedure.<br /><br />For now, I only have the Glitch Pokemon values for French Emerald, as I directly tried to see if a good party slot was available on French Emerald in order to get the Islands.<br /><br />Glitch Pokemon 0x94F8 gives a party slot of 0x68, whose Remaining HP are at 0x02026DE2 (and current HP at 02026DE4), which is a bit below the adresses for Islands event flags.<br />The byte for Faraway and Birth Islands flags is at 0x0000, so you&#039;ll first need to do a Pomeg Glitch in order to corrupt it for 0x0500, but this isn&#039;t hard to do (using an in-game trader Pokemon in PC to tell if the corruption was good or not, and maintaining UP for a certain amount of time).<br />Once this is done, here&#039;s the setup :<br />-Have a fully KO Party with : 0x94F8, Fly, (Surf for Faraway and Birth Islands)<br />Have many Fluffy Tails, as well as the event tickets in your Bag. (obtainable with a Double Corruption)<br />- Fly at Slateport and save in front of the journalist.<br />- Speak to the journalist to change the &quot;last battling Pokemon&quot; value to 0x68.<br />- For Southern Island, go at Route 101, and make a wild battle.<br />Once the Bad Egg is sent in Battle, look if he has 0x8500 current HP and 0x0001 Max HP. (look for ???/ 1 HP)(1/32 chance)<br />If this isn&#039;t the good HP amount, use a Fluffy Tail and make another encounter.<br />If his is the good HP amount, use X Attack,Speed,Accuracy until the wild Pokemon hits you.<br />Wait. (Here, this will be very long, a few hours at least, maybe something like 10-20 hours or even more)<br />Once your HP bar has finally decreased to 1, use a Fluffy Tail.<br />Fly at Lilycove, and check if you&#039;ve unlocked Southern Island. <br />If not, reset or go back to Route 101. (the ???/1 HP wasn&#039;t the right one)<br />If yes, enjoy.<br /><br />- For Faraway Island and Birth Island, enter Mt Pyre and stay in the first section. Make a wild Battle.<br />Once the Bad Egg is sent in Battle, look if he has 0x0500 current HP and 0x0010 Max HP. (look for ?80/ 16 HP)(1/32 chance)<br />If this isn&#039;t the good HP amount, use a Fluffy Tail and make another encounter.<br />If his is the good HP amount, use X Attack,Speed,Accuracy until the wild Shuppet hits you with Night Shade.<br />If he uses Curse first, it isn&#039;t good, reset.<br />Once he has used Night Shade, wait. (this will take 2-3 minutes)<br />Once your HP bar has finally decreased to 16, use a Fluffy Tail.<br />Fly at Lilycove, and unlock Faraway and Birth Islands.<br />Enjoy.<br /><br />I&#039;m really happy about that since one of the last remaining goals of Pomeg Glitch has fallen, and since a method I previously worked on was finally useable.<br /><br /><br />I&#039;ll look for a Glitch Pokemon that puts party slot 0x68 (or 0x69) in US Emerald Roms too, and maybe some other things for Pokeblocks and Battle Bag since they are on a hot topic for me.<br /><br /><br /><br /> Move Relearner won&#039;t be of any help.<br />It appears the main cases for Glitch Pokemon are :<br />- Not able to relearn any move.<br />- Able to learn Karate Chop.<br />- Able to learn a full list of Peck.<br /><br /> Also, TV news might be tricky to use, as the main source of Pokemon Species Name reading, the Name Rater, can&#039;t be used for Glitch Pokemon (the game mainly freezes when you try to rename them).<br />Maybe certain news related to Pokemon contests or wins at Battle Frontier could tell the species name of one of our Pokemon, but I&#039;m not sure of that (I think it would be the surname).<br />Thus, this method will most likely stay for now as I&#039;d need more data about these news to know if some could work.<br /><br /><br /> My initial idea of using a Glitch Move to change the &quot;party slot of opponent&#039;s battling Pokemon&quot; won&#039;t work, the value is right next to the other one, and no Glitch Move is able to change them without altering other values related to the fight that make the game freeze/reset.<br /><br />As for learnt moves, I saw quite a lot of Ice Punches, so Glitch Pokemon might only learn certain &quot;generic&quot; sets of Moves from levelling.<br />I was able to level out a Glitch Pokemon with a normal experience curve by using an Exp Share. It turns out that he wanted to learn a glitch move right after Ice Punch, so I suppose that it was this move who froze the game right on Ice Punch message.<br />Yeah, it&#039;s definitely that Glitch Move, now I&#039;m able to level the Pokemon normally.<br />What seems to freeze the game is the learning of a Glitch Move as new move in the party screen.<br />As the glitch move by itself has a short name and a non-freezing type sprite, who allow it bo be seen in the summary or removed.<br /><br />I used Pokemon 0x1015, who, according to Gen III Suite, can evolve via friendship.<br />However, that didn&#039;t happen. This might be because there are multiple friendship evolutions, or because the first evolution entries are empty. I&#039;ll test more things to sort this out.<br />I&#039;ve tried to evolve 0x101A and 0x101B who have a first evolution condition of Friendship at Day and Night, and it didn&#039;t work for both.<br />I put 0x102B who&#039;s supposed to &quot;evolve by breeding&quot; into a Forretress in Day Care, but there was no Forretress in the end.<br /><br /><br />It&#039;s strange, I have this memory of the learnable move list stopping at the first 0000, but what I saw there is different.<br />I&#039;ll try some things on my French Emerald version.<br /><br /><br />And thanks for the help on code execution. I&#039;ll try to familiarize with this and see if certain freezes can be exploited.<br /><br />


subject: Re: 3DS Homebrew Launcher
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pawny link=topic=7340.msg198941#msg198941 date=1440550096]<br />Smea is going to release TVDS, which is a program to import/export saves, and allow us to gen again. Though it&#039;ll also allow editing stuff on PokÃ©Shuffle/Rumble so I&#039;m afraid this may trigger an update/fix. No ETA for release yet.<br />[/quote]<br /><br />It sounds cool and all, but it seems pretty rude that lots of people keep pestering him about it. Is waiting such a big deal? The Homebrew Launcher isn&#039;t going anywhere. Well, unless you update your 3DS. <br /><br />[size=5pt](Why am I still awake...)[/size]


subject: Re: 3DS Homebrew Launcher
poster_name: Spoink
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7340.msg198953#msg198953 date=1440663516]<br />[quote author=Pawny link=topic=7340.msg198941#msg198941 date=1440550096]<br />Smea is going to release TVDS, which is a program to import/export saves, and allow us to gen again. Though it&#039;ll also allow editing stuff on PokÃ©Shuffle/Rumble so I&#039;m afraid this may trigger an update/fix. No ETA for release yet.<br />[/quote]<br /><br />It sounds cool and all, but it seems pretty rude that lots of people keep pestering him about it. Is waiting such a big deal? The Homebrew Launcher isn&#039;t going anywhere. Well, unless you update your 3DS. <br /><br />[size=5pt](Why am I still awake...)[/size]<br />[/quote]<br />A question, can&#039;t they force a game update?


subject: Re: 3DS Homebrew Launcher
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pawny
icon: xx
body:
  [quote author=MidnightNinetales link=topic=7340.msg198953#msg198953 date=1440663516]<br />It sounds cool and all, but it seems pretty rude that lots of people keep pestering him about it. Is waiting such a big deal? The Homebrew Launcher isn&#039;t going anywhere. Well, unless you update your 3DS. <br /><br />[size=5pt](Why am I still awake...)[/size]<br />[/quote]<br /><br />I personally am not rushed about it (I don&#039;t even play pokÃ©mon actively anymore), but the communities I go at are just rushed to pokÃ©gen again (the ones that updated). But the main thing is that Smea got kinda infamous for constantly delaying stuff so people call him attention-whore, etc. But yeah I don&#039;t agree with bashing him, people should be more grateful.<br /><br />[quote author=Spoink link=topic=7340.msg198954#msg198954 date=1440678727]<br />A question, can&#039;t they force a game update?<br />[/quote]<br /><br />Technically they can&#039;t force, but they can &quot;force&quot; like they did with pokÃ©mon X/Y and OR/AS releasing an nearly empty update just to force you to download it in order to play online, and since you can&#039;t download anything from eShop unless you&#039;re with the latest firmware (you can&#039;t spoof if you&#039;re above 9.2), you&#039;ll be locked out from online until you update everything. But if you don&#039;t really care about playing online (there&#039;s also other games, but I think only Smash is constantly updated to this day), you don&#039;t have to worry.


subject: Re: Anatomy of an e-Reader Mystery Event
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m linking to these PokÃ©Community threads here since they&#039;re helpful.<br /><br />[url=http://www.pokecommunity.com/showthread.php?t=224212]Tutorial on how to reinstate Mystery Events in non-Japanese Emerald[/url]<br /><br />[url=http://www.pokecommunity.com/showthread.php?t=348484]Team Fail&#039;s research on e-Reader content[/url]


subject: Scrapped PokÃ©mon from Gold and Silver
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  Apparently there were a few PokÃ©mon that Game Freak showed or otherwise mentioned at Nintendo Space World 1997 but then scrapped. Their names are ã‚¢ã‚¯ã‚¢, ã‚¢ã‚¯ã‚¨ãƒªã‚¢, ã‚¢ãƒ‹ãƒ¢ãƒ³, ã‚¨ãƒ¬ã‚­ãƒ³ã‚°, ãƒãƒã‚³, ã‚¤ã‚«ãƒª, ãƒšã‚¤ãƒ³ã‚¿ãƒ¼, ãƒ—ã‚¯ãƒ¼, ã‚µãƒ‹ãƒ¼, and ãƒ¨ãƒ­ã‚¤ãƒ‰ãƒª (sources: [url=https://web.archive.org/web/20040112111017/http://www3.synapse.ne.jp/pacific/users/pokemon/ibutsu/kingin_time_capsule/pokemon.html]1[/url], [url=https://web.archive.org/web/20091202180519/http://hakuda2.web.fc2.com/ir/poke2/t6.html]2[/url]) Some of them are claimed to have appeared in a promotional video for the event. Others seem to be earlier references to PokÃ©mon that eventually shipped.<br /><br />ãƒ›ãƒŽã‚ªã‚°ãƒž and ã‚¯ãƒ«ã‚¹ were the Fire-type and Water-type starters, respectively, in the demo, but Cyndaquil and Totodile took their roles by Nintendo Space World 1999. ãƒãƒƒãƒ‘ instead developed into Chikorita.<br /><br />I&#039;ve also found a few other sites talking about early Gold and Silver:<br /><br />https://web.archive.org/web/19990504203738/http://www.maccentral.or.jp/pokemon/q-zisyu/ninten000.html<br /><br />https://web.archive.org/web/20040112111018/http://www3.synapse.ne.jp/pacific/users/pokemon/ibutsu/kingin_time_capsule/analysys.html<br /><br />https://web.archive.org/web/20100522031051/http://www.reocities.com/TimesSquare/Castle/5553/prepm2.html<br /><br />https://web.archive.org/web/20021114111108/http://www.bekkoame.ne.jp/~niki/poke2.html<br /><br />Does anyone know more about this or is this somewhat obscure?


subject: Re: A Beta place?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I think this warrants a reply. SPECIAL in PokÃ©mon Gold, Silver, and Crystal is used for the second floor of PokÃ©mon Centers, which houses the Cable Club rooms, Time Capsule, and (in Japanese Crystal), the &quot;PokÃ©Com Club&quot; rooms [as English Crystal calls them in unused text]. Originally, Game Freak thought on using individual copies for the second floor (only in each Kanto location with a PokÃ©mon Center, though) but they postponed that idea to PokÃ©mon Ruby and Sapphire.<br /><br />If you play non-Korean Gold and Silver in SGB mode, you&#039;ll notice that the color palette will always be the same on the second floor of any PokÃ©mon Center, which proves that it is indeed the same location. They intentionally disabled the PokÃ©gear&#039;s phone (the game says you&#039;re &quot;out of the service area&quot;) and the map will instead tell you your last known location. Eggs hatched in SPECIAL are like the map as well, as confirmed by the PokÃ© Seer in Cianwood City, which is a NPC exclusive to Crystal.<br /><br />Also, in non-Japanese Crystal, the warps to the PokÃ©Com Club rooms are still there despite them replacing the map with the one from Gold and Silver.


subject: Re: The Pokegod People People Eaters!! [PWN YOU!]
poster_name: Bluelatios
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  By some insane coincidence, I happened to be thinking of this site so I logged in just to see who was still here....<br />[img]https://s-media-cache-ak0.pinimg.com/736x/ab/b9/4a/abb94a16496fc2e923603f707ff49a3f.jpg[/img]<br /><br />How ya doin&#039; guys?


subject: Re: Anedapami hybrid?
poster_name: Sounansu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah, okay. I didn&#039;t know Anedepami was the Japanese Charizard &#039;M. I couldn&#039;t find any information about it because I searched for the wrong name (The wiki page for the dokokashira door glitch says &#039;Anedapami&#039; instead of &#039;Anedepami&#039;). I&#039;ve also noticed other pokemon in my PC being &#039;merged&#039; the same way.<br /><br />By the way, can Anedepami prevent you from withdrawing pokemon from the PC? Because I did the level 100 Mew glitch, but my party was full, so it got transfered to the PC, but when I try to withdraw it, the game freezes. I&#039;m thinking Anedepami might have something to do with it (it was in the same box), since it already glitches the pokemon in the PC. Or does it have something to do with me using the Mew glitch while the WTW select glitch was active?


subject: Re: Scrapped PokÃ©mon from Gold and Silver
poster_name: Crystalame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve seen and heard all of the (available) general information about the Space World G/S prototypes and I&#039;m always interested in knowing more. Man, if I could get my hands on a copy of one of those carts somehow...&nbsp; :P<br /><br />Unfortunately, I haven&#039;t heard any new information on these prototypes in a long time. [url=http://bulbapedia.bulbagarden.net/wiki/Prototype_Pok%C3%A9mon_and_characters]Bulbapedia&#039;s article[/url] has some pictures of the scrapped Pokemon (though I see you&#039;ve done some work on Bulbapedia before so I bet you&#039;ve already seen this!)... but the most unfortunate thing, to me, is that there are no screenshots (well... photos, to be more accurate) anywhere of the demo, so no sprites of those starters or anything. :( I&#039;ve also heard some other pretty wacky info about the demo, such as really strange wild Pokemon (I can&#039;t remember the exacts, but DEFINITELY not what you&#039;d encounter that early in the game!) and I also heard the starters were a higher level in the demo... I think 9 or 10? I also recall hearing that &quot;Chikorita&quot; had a move named &quot;Serene&quot; or something as well? Wonder what that could have been!<br /><br />According to that Bulbapedia page, Kurusu&#039;s Pokedex number was also 212, which is... bizarre.<br /><br />Oh, also, I translated those names in your post, and I got (this is all assuming Google Translate isn&#039;t failing me here):<br />ã‚¢ã‚¯ã‚¢ = Aqua<br />ã‚¢ã‚¯ã‚¨ãƒªã‚¢ = Aquaria<br />ã‚¢ãƒ‹ãƒ¢ãƒ³ = Animon (what)<br />ã‚¨ãƒ¬ã‚­ãƒ³ã‚° = Eleking (Elekid? Or maybe Electivire was planned for G/S too? :S)<br />ãƒãƒã‚³ = Haneko (no idea--- oh it&#039;s hoppip apparently)<br />ã‚¤ã‚«ãƒª = Ikari<br />ãƒšã‚¤ãƒ³ã‚¿ãƒ¼ = Painter (99% sure this would be Smeargle)<br />ãƒ—ã‚¯ãƒ¼ = &quot;Puku&quot; this one is perhaps that Qwilfish prototype<br />ã‚µãƒ‹ãƒ¼ = Sonny (... well, apparently Sunflora was &quot;Sunny&quot;, so maybe this is just a translate fail)<br />ãƒ¨ãƒ­ã‚¤ãƒ‰ãƒª = Yoroidori<br /><br />Phew! That was a long post with... actually little substance, I&#039;m sorry, haha, you&#039;ve probably seen/heard about most of what I talked about already. I feel like a lot of things surrounding the G/S development are actually kind of mysterious, which makes me like it even more. :D So, overall, I&#039;d say it&#039;s fairly obscure. If you find any more/new info, I&#039;d be really excited to hear about it. Sadly I don&#039;t understand any Japanese, so I can&#039;t read those pages. :(


subject: Re: Yellow Move Effect F9
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Spoink link=topic=7338.msg198937#msg198937 date=1440519689]<br />01F9D2CF<br /><br />This can give you an instant glitch city.<br />[/quote]<br /><br />That is very cool. Thanks for sharing. :) It sent me to the Safari Zone gate and allowed for a Safari Zone exit (exit 04) Glitch City without having to do the standard steps.


subject: Re: Anedapami hybrid?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Sounansu link=topic=7339.msg198938#msg198938 date=1440538886]<br />This is my first post here, sorry if my English isn&#039;t perfect, I&#039;m from Germany.<br /><br />So I&#039;ve been beaten Green 1.0 using the Dokokashira Door glitch and used the fix where you can get 25 Eevees. I decided to keep playing from there. I got to the point where you can choose between Hitmonlee and Hitmonchan. I chose Hitmonlee. I wasn&#039;t really paying attention to what I was doing next, I think I was just switching around pokemon in my party, but somehow, my regular Hitmonlee was gone and instead, I had a Hitmonlee with a Charizard sprite. Sometimes it hides the pokemon in below it in the party, just like Anedapami, but sometimes it shows them completely glitched. Not sure what that depends on. I tried playing around with it and it&#039;s stable in battle, but when it&#039;s defeated, it can&#039;t be healed at the Pokemon Center. So... is this known already or did I just discover a new glitch? If it is known, how exactly is it performed, because it just happened to me by accident... :-\<br />[/quote]<br /><br />Welcome to the forums Sounansu. That&#039;s OK. Your English is good!<br /><br />When you perform the dokokashira door glitch, you receive Anedepami because you are swapping the PokÃ©mon end terminator (hex:FF) with the first PokÃ©mon, and even if you fill your party with five Eevee, you will still have the Anedepami in the party.<br /><br />I&#039;m not sure if you did because you mention it happened after withdrawing Hitmonlee and just switching PokÃ©mon around in the party, but do you remember if you happened to activate any event that removes a PokÃ©mon from a list? Did you also have an Anedepami directly above Hitmonlee?<br /><br />What you describe is typical of a hybrid glitch PokÃ©mon. If you still have access to the save, can you try putting it into the Day Care and tell me if you get Anedepami or Hitmonlee after you withdraw it please?<br /><br />The Charizard sprite and &quot;Andedepami&quot;&nbsp; behaviour definitely means it&#039;s using byte 1 as FF. Anedepami is hex:FF (like Charizard &#039;M from Red/Blue and Q from Yellow), so it works for the PokÃ©mon merge glitch.<br /><br />The [url=http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_merge_glitch]PokÃ©mon merge glitch[/url] is a known glitch that occurs when you remove a PokÃ©mon before hex:FF from a list (by depositing, withdrawing from a box, putting the PokÃ©mon into Day Care) when the list is like this: (PokÃ©mon 1), hex:FF PokÃ©mon, one-four PokÃ©mon (note you could also have two-four PokÃ©mon before the hex:FF and one-three PokÃ©mon and also withdraw one of those before FF to activate the glitch).<br /><br />When you perform the merge glitch, the PokÃ©mon below hex:FF basically hybridize with the first PokÃ©mon above them. A hybrid is a PokÃ©mon with the traits of one PokÃ©mon (such as its sprite, available TM/HM moves) and another.<br /><br />The merge glitch affects species byte 1; which controls species name (from status page 2), learnset, mini-sprite, evolutions, TM/HM compatibility, type shown on the summary screen, experience cap. Species byte 2 (controlling in-battle palette, effective typing, growth rate, &quot;real&quot; Day Care PokÃ©mon, growth rate) remains unchanged; so if you hybridized Pidgey with Mew, the PokÃ©mon would become a non-hybrid Mew again when taking it into the Day Care and .<br /><br />The addresses of species byte 1 and 2 for party PokÃ©mon 1 in Red/Green are D124 ,D12B respectively. So the GameShark codes 01xx24D1, 01xx2BD1 change the data.<br /><br />On a technical basis the merge glitch works like this:<br /><br />The game is supposed to shift the species bytes back when the number of PokÃ©mon decreases by removal until it finds an FF (in this case the game has to shift PokÃ©mon species byte 1s back), but the FF signals the game to stop shifting data back after it.<br /><br />Imagine the following party or box list:<br /><br />(PokÃ©mon 1)<br />Q<br />Hitmonlee<br />Pidgey<br />Cancel<br /><br />The data looks like this:<br /><br />xx FF 2B 24 FF<br /><br />xx: PokÃ©mon 1<br />FF: PokÃ©mon 2 - Anedepami<br />2B: PokÃ©mon 3 - Hitmonlee<br />24: PokÃ©mon 4 - Pidgey<br /><br />If you remove PokÃ©mon 1 the data becomes:<br /><br />FF FF 2B 24 FF<br /><br />The game was &#039;supposed to&#039; shift 2B and 24 back, so that Hitmonlee becomes PokÃ©mon 2, Pidgey becomes PokÃ©mon 3 but the FF (Anedepami) told it not to.<br /><br />It now means that the data would look like:<br /><br />FF: PokÃ©mon 1 - Anedepami<br />FF: PokÃ©mon 2 - &#039;Anedepami&#039;<br />2B: PokÃ©mon 3 - &#039;Hitmonlee&#039;<br />24: PokÃ©mon 4 - &#039;Pidgey&#039; (unselectable if you had 4 PokÃ©mon in the list because now we technically have 3)<br /><br />Though this looks normal, the PokÃ©mon in quotation marks have become hybrids.<br /><br />The reason is that the game apparently still alters different areas of data as if the byte shifts back were to occur. So Anedepami (PokÃ©mon 2) ends up with the nickname, moves, species byte 2 of Hitmonlee (PokÃ©mon 3) because it&#039;s as if that PokÃ©mon was PokÃ©mon 2.<br /><br />Similarly, the Hitmonlee would have Pidgey&#039;s nickname, moves and species byte 2.<br /><br />PokÃ©mon have two species bytes in memory. The first byte (which you can track/alter for party PokÃ©mon 1 with the code 01xx24D1) controls the species name (from status page 2), learnset, mini-sprite, evolutions, TM/HM compatibility, type shown on the summary screen. The second byte (which you can track/alter for party PokÃ©mon 1 with the code 01xx2BD1) controls the PokÃ©mon&#039;s color palette in battle, effective typing (so a Gastly hybrid may be able to get hit by Normal moves) as well as the PokÃ©mon you receive when the PokÃ©mon is taken into Day Care and out.<br /><br />Note about PokÃ©mon 1 being replaced with FF:<br /><br />When the game finds the first FF, the game replaces the byte before it with FF (which the [url=https://www.youtube.com/watch?v=tQ9JAJcofrs]max DVs and stat experience glitch[/url] abuses). This is because FF marks an end of list for PokÃ©mon (and items) that is placed at number of PokÃ©mon+1 (and number of PokÃ©mon decreases, so the game has to create another FF). In the party menu, it hides PokÃ©mon below it. The party menu will try to display PokÃ©mon you don&#039;t even have (but often the 0 maximum HP glitch freezes the game if it tries to) and this is prevented by having FF at number of PokÃ©mon +1.<br /><br />[quote author=Spoink link=topic=7339.msg198945#msg198945 date=1440599870]<br />Glitched PokÃ©mon sprites are a common occurrence with Anedapami, and the go away USUALLY when you close the menu. It hiding the sprites, and not being able to heal, is unique to Anedapami, because the game stops reading at the PokÃ©mon terminator, which is value FF, the same as Anedapami, or Charizard &#039;M.<br />[/quote]<br /><br />This.<br /><br />[quote author=Sounansu link=topic=7339.msg198962#msg198962 date=1440772331]<br />Ah, okay. I didn&#039;t know Anedepami was the Japanese Charizard &#039;M. I couldn&#039;t find any information about it because I searched for the wrong name (The wiki page for the dokokashira door glitch says &#039;Anedapami&#039; instead of &#039;Anedepami&#039;). I&#039;ve also noticed other pokemon in my PC being &#039;merged&#039; the same way.<br />[/quote]<br /><br />Fixed. Thanks for noting this error!<br /><br />[quote author=Sounansu link=topic=7339.msg198962#msg198962 date=1440772331]<br />By the way, can Anedepami prevent you from withdrawing pokemon from the PC? Because I did the level 100 Mew glitch, but my party was full, so it got transfered to the PC, but when I try to withdraw it, the game freezes. I&#039;m thinking Anedepami might have something to do with it (it was in the same box), since it already glitches the pokemon in the PC. Or does it have something to do with me using the Mew glitch while the WTW select glitch was active?<br />[/quote]<br /><br />If you are referring to catching Mew at level 1 (where its experience calculation medium-slow gives it -54 experience points or 16,777,162 experience points and you can gain less than 54 experience to jump to level 100), a freeze will happen if Mew is sent to the PC and withdraw it. The same freeze will occur if you capture a level 0 &#039;M (who is [url=http://forums.glitchcity.info/index.php?topic=6588.0]growth rate 1A[/url] (26 in decimal) in Red/Blue and it is sent to the PC).<br /><br />The freeze depends on both the PokÃ©mon&#039;s experience and its growth rate.<br /><br />This [url=https://docs.google.com/spreadsheets/d/1NFojS1JlAGvfBlqfLJyGwUO3iZCG5UQvItr7xrHup8U/edit?pli=1#gid=1302000118]table[/url] will tell you levels for when a freeze occurs. <br /><br />In Red and Blue, the default experience for level 1 is documented as the only harmful medium-slow level. I don&#039;t know if this also applies to Red and Green. In both Red (English) and Green (Japanese), although level 0 gives negative experience for medium-slow, it is not (necessarily) affected.


subject: Re: Scrapped PokÃ©mon from Gold and Silver
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  I&#039;ve also read about these PokÃ©mon but in 2011. They piqued my interest as well. I think that Ash PokÃ©master may have mentioned them on Bulbagarden too (definitely someone did) but I don&#039;t who it was for sure and my memory tells me they didn&#039;t know anything that wasn&#039;t already documented.<br /><br />There is a Japanese website called Botsu PokÃ©mon (ãƒœãƒ„ãƒã‚±ãƒ¢ãƒ³å¿œæ´éšŠ), &quot;Discarded PokÃ©mon&quot; ([url=http://hakuda2.web.fc2.com/ir/poke4/trust.html]or &quot;The Lost PokÃ©mon&quot;[/url])<br /><br />[url=http://hakuda2.web.fc2.com/ir/poke4/botu6.html]According to the site[/url], Akua (presumably Aqua) appeared in the Nintendo Space World 1997 trial demo. Aquaria was mentioned in the PokÃ©dex in a promotional video. Animon was mentioned in a video about new features of the PokÃ©dex. Ikari is believed to have been remembered from the word ã„ã‹ã‚Š (anger or anchor) (does this imply it may not have been called this?). Eleking is said to have appeared in the trial demo. BukÅ« is said to have looked like a flying squirrel and appeared at night.<br /><br />Additionally, this page mentions a PokÃ©mon called &quot;[url=http://hakuda2.web.fc2.com/ir/poke4/botu6.html]Netamon[/url]&quot; that appeared on routes that may be related to Metamon (Ditto).<br /><br />I think the most interesting thing is if Netamon is a relative of Ditto or that Eleking could have been Electivire but I feel it&#039;s more likely that it was just Elekid with a different name and/or design (maybe featuring a crown).<br /><br />I feel that some of the information could have arisen from false memory like the Netamon thing. Perhaps eventually the 1997 Space World demo will be dumped (and this way maybe even more unused PokÃ©mon names could be retrieved from the ROM), or perhaps more likely a video showing the PokÃ©mon could be retrieved.<br /><br />Related thread: http://profglitch.proboards.com/thread/431/prototype-capsule-monsters-green-designs<br /><br />Edit: Gonzou (ã‚´ãƒ³ã‚¾ã‚¦) is said to be another unused PokÃ©mon that became Munchlax in Generation IV(!). I just saw it on [url=http://wiki.xn--rckteqa2e.com/wiki/æ²¡ãƒã‚±ãƒ¢ãƒ³ã®ä¸€è¦§]Japanese PokÃ©mon Wiki&#039;s discarded PokÃ©mon page[/url]. I never noticed it there before, so maybe somebody added it later.<br /><br />Additionally, there is [url=http://hakuda2.web.fc2.com/ir/poke4/b7.html]a discussion[/url] about Gonzou and other interesting things on this page.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, after more analysis, a god part of my previous post was quite erroneous.<br /><br />I was able to unlock Faraway and Birth Islands, but that was way tougher than I originally thought.<br /><br />First, there is no Glitch Pokemon in US Emerald that would safely give you a value of 0x68 or 0x69 at 0x0202406E (party slot of fighting Pokemon), who are the required slots in order to get the word managing the Event Islands unlock treated as remaining HP.<br /><br />Secondly, the Bad Egg can have statuses, and when his remaining HP will be the word for islands unlock, he will, as its status word is read on some flags about visiting areas, completing the story, and talking to certain NPCs.<br />Thus, the Bad Egg suffers from Poison, Sever Poison, and Burn.<br /><br />If you went into Trainer Hill, the Max HP word will have a value of 0x14 = 20 at that time (unless you visited Navel Rock).<br />Thus, Poison does 2 damage, Burn 2, and Severe Poison does 1 to 15 damage depending on a counter.<br /><br />In the word for Remaining HP, you also have the flag for the advanced Trainer card (with Battle Frontier symbols and other things) amoungst the lowest bits, and as you can&#039;t get it again, you need to keep it.<br />Flags for Pyramid symbols are also some low bits of that word.<br />And this changes the amount of damage you&#039;d like to take in order to get flags for Islands unlocks while keeping the Trainer card.<br /><br />Also, if the party is still KO when Bad Egg suffers from Poison (or any indirect form of damage I think), the game makes you black out, so you have to use a Revive in order to revive one of your Party Pokemon.<br /><br />After that, it was a matter of searching the effect of all the flags in order to get everyone to the same values and to make them able to unlock both islands with a single HP loss on a fight.<br /><br />There&#039;s more details about that at the end of the pastebin for that method : http://pastebin.com/8N9sGwpb<br /><br /><br /><br />I have for now two more things to check with that &quot;battling Pokemon&quot; method, as I want to see how party Pokemon are managed when you open the party while the battling Pokemon comes from a slot higher than 5 (slots starting at 0), as it did strange things to my party, and I want to check if an empty slot could gain Exp and Evs from a fight (by fighting a Secret Base Pokemon who uses Memento), as this could have some (tiny) uses.<br />


subject: Re: A Beta place?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Thanks for the extra information Sato. :) Earlier I [url=http://glitchcity.info/wiki/index.php/Special_(location)]re-wrote[/url] the Special article.


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=Spoink link=topic=7332.msg198947#msg198947 date=1440600654]<br />If you have 0 fly locations, the town name data that is written is part of the Pikachu&#039;s Beach minigame graphics. This is why hooked metapod appears.<br />[/quote]<br /><br />Do you know where exactly the graphics are stored?<br /><br />For some reason, when I fly with no locations CD6D (that would display the name for other maps) is always 58 90 00 00 44 44 FF (...) but I cannot find this data in ROM - and when I bring up the fly map successively the data written to $CF4B is not always the same.<br /><br />Somehow it is possible to make the corruption go further, into your party PokÃ©mon and items. I don&#039;t know exactly how, but I closed and opened the menu repeatedly and my party list got replaced with 255 PokÃ©mon, many of which were Tentacool. It reminded me of [url=https://www.youtube.com/watch?v=Q8zcf2qQo6w]this video[/url] by TheZZAZZGlitch. But I tried doing that again and it did not work.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Yep! That will work.<br /><br />Your code is like this.<br /><br />[code]<br />ld l, B2<br />ld h, DA<br />ld (hl),FF<br />ld l, B1<br />ld h, DA<br />ld (hl),FF<br />inc b<br />ret[/code]<br /><br />We can shorten it a little if we turn it into this:<br /><br />[code]<br />ld l, B2<br />ld h, DA<br />ld a,FF<br />ldd (hl),a<br />ldi (hl),a<br />ret[/code]<br /><br />[code]<br />2E B2 26 DA 3E FF 32 22 C9<br />[/code]<br /><br />As items, this is:<br />8F<br />(any item) x (any quantity)<br />X Accuracy x178<br />Carbos x218<br />Lemonade x255<br />PP Up x34<br />TM01 x(anything)<br /><br />Note that if you don&#039;t want to use a PP Up, you can use this alternative which has all items you can buy from shops other than 8F. It is the same as the code above but has inc b (PokÃ© Ball, 04) above ldd (hl),a (PP Up, 32) so that what was the PP Up is now expressed as a quantity (hex:32 in decimal or 50).<br /><br />8F<br />(any item) x (any quantity)<br />X Accuracy x178<br />Carbos x218<br />Lemonade x255<br />Poke Ball x50<br />Water Stone x201<br /><br />In this code we store FF into the a register for use later. Ldd (hl),a writes to the value of &#039;a&#039; (FF) into DAB2, and then decrements the hl value to DAB1. Then we can use another ld (hl),a (I chose ldi (hl),a because it represents a good item) to write FF into DAB1.


subject: Some grass surfing glitch (Spanish and Italian Red/Blue) technical details
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  The grass surfing glitch is a glitch exclusive to Spanish and Italian PokÃ©mon Red/Blue that was posted on a Spanish forum and thought to be fake, until Paco81 noticed it and brought it up with members of a different forum called POKÃ©MON-STATS in a thread called [url=http://www.pokemon-stats.com/foros/viewtopic.php?f=5&amp;t=10223]Â¿Tentacools en la hierba?[/url]. After some research they found it was indeed real.<br /><br />It allows one to encounter PokÃ©mon from the water encounter table, apparently using the grass encounter rate; and by encountering a Trainer, the data in the water encounter table is overwritten, allowing people to encounter PokÃ©mon they normally wouldn&#039;t be able to encounter such as &#039;M (00) and even Mew. The PokÃ©mon available depend on the Trainer.<br /><br />This glitch seemingly does not work in the English and German versions, as no PokÃ©mon ever appeared for me (however, this may have been down to bad luck). French versions give grass encounters.<br /><br />The steps for this glitch are:<br /><br />1) Encounter a Trainer.<br />2) Surf in the grass (via the [url=http://glitchcity.info/wiki/index.php/Surf_down_glitch]Surf down glitch[/url]) in a place that doesn&#039;t have water encounters.<br />3) Turn in the grass so you do not dismount your PokÃ©mon until you encounter a wild PokÃ©mon. Often you will dismount the PokÃ©mon. If this happens, reset the game and try again.<br /><br />The glitch enables you to encounter water encounter table PokÃ©mon (in contrast with how the old man trick gives grass encounter table PokÃ©mon). These are based on the last Trainer you encountered in the session before you saved.<br /><br />I do not know if it has been documented how exactly the Trainer affects the encounters, so I decided to investigate.<br /><br />The addresses D8A9 (D8A4 in English versions) and beyond control the water encounter rate (D8A9) and water encounter levels/PokÃ©mon (D8AA+).<br /><br />It turns out that this area is used for Trainer&#039;s PokÃ©mon data as well. The size of this data is of no fixed length; so more data will get written to later addresses if the opponent has e.g. 5 PokÃ©mon compared to 2 PokÃ©mon.<br /><br />Fortunately, this database is documented [url=http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map#Opponent Trainer&#039;s PokÃ©mon]under &quot;Opponent Trainer&#039;s PokÃ©mon&quot; on the Datacrystal PokÃ©mon Red/Blue article[/url].<br /><br />Here D8A9 is enemy PokÃ©mon 1&#039;s index number, D8AA/D8AB is enemy PokÃ©mon 1&#039;s current HP, D8AC is an undocumented address, D8AD is apparently the foe&#039;s status, D8AE is type 1, D8AF is type 2 and so on.<br /><br />If we encounter the Jr Trainerâ™‚ we are facing here:<br /><br />[img]http://i2.minus.com/ioKN7CuIYWQfU.png[/img]<br /><br />Then he has a level 20 Squirtle and the data from D8A9 starts B1 00 32 00 00 15 15 2D 21 27 91 37 E4 or:<br /><br />$B1: Squirtle<br />$00 $32: 50 current HP<br />$00: Unknown byte<br />$00: No status<br />$15: Type 1 is Water<br />$15: Type 2 is Water (note that single-typed PokÃ©mon are internally two types of the same value)<br />$2D: Unknown byte<br />$21: Move 1 is Tackle<br />$27: Move 2 is Tail Whip<br />$91: Move 3 is Bubble<br />$37: Move 4 is Water Gun<br />$E4: Trainer ID byte 1; the same as the player (mine is 58602 and if you convert that into hexadecimal, the first byte is $E4. $E4 also applies to an ID between 58368 ($E400) and 58623 ($E4FF)<br />$EA: Trainer ID byte 2<br />$00: Experience byte 1<br /><br />According to [url=http://forums.glitchcity.info/index.php/topic,6814.msg193322.html#msg193322]this post[/url], the water PokÃ©mon data in English Red/Blue has the same size as the grass PokÃ©mon data (21 bytes), so the data for it should finish at D8BD (PokÃ©mon 1&#039;s Attack EV byte 2). IIMarckus says there are 7 level/species pairs for grass and water PokÃ©mon.<br /><br />Hence from that data we can apply this:<br /><br />*Water encounter rate = B1 (gets reset to 00 after returning, but water encounter rate in Spanish and Italian Red/Blue for grass surfing).<br />*Water PokÃ©mon 1 level = 0<br />*Water PokÃ©mon 1 species = Missingno. (hex:32)* - *if you beat the PokÃ©mon this forces the data to become 0 corresponding to &#039;M (hex:00)<br />*Water PokÃ©mon 2 level = 0<br />*Water PokÃ©mon 2 species = &#039;M (hex:00)<br />*Water PokÃ©mon 3 level = 21<br />*Water PokÃ©mon 3 species = Mew (hex:15)<br />*Water PokÃ©mon 4 level = 45<br />*Water PokÃ©mon 4 species = Growlithe (hex:21)<br />*Water PokÃ©mon 5 level = 39<br />*Water PokÃ©mon 5 species = Marowak (hex:91)<br />*Water PokÃ©mon 6 level = 55<br />*Water PokÃ©mon 6 species = Scientist (hex:E4)<br />*Water PokÃ©mon 7 level = 234<br />*Water PokÃ©mon 7 species = &#039;M (hex:00)<br /><br />It seems like some manipulable variables for encountering PokÃ©mon are the first enemy PokÃ©mon&#039;s current HP byte 1 (if the data does not change after losing to the Trainer), its moves 1-4 (with move 1 and 3 controlling species), the second type (which allowed for Mew with this Jr. Trainer) and the Trainer ID byte 1 (you could possibly keep resetting a new game until this value becomes something useful such as Mewtwo, hex:83 - however, you would have to rely on lots of luck). If the water encounter table actually supports more than 7 level and species pairs, then we may be able to encounter a few more PokÃ©mon such as one based on the PokÃ©mon&#039;s last experience byte (total experience modulo 256).<br /><br />Paco81 has taught that instead of surfing in the grass, you can surf on a rock in the Unknown Dungeon to get the same encounters.<br /><br />The grass encounter rate in Unknown Dungeon is lower compared to Route 24 ($0A instead of $19), but the trick is useful because when you are on your PokÃ©mon in the grass north of Cerulean City, taking one step will put you off the PokÃ©mon and it is difficult to keep turning around in one grass tile without taking a step. When you are on this rock you can move right and down (but not left because that can dismount you on a walkable part of the rock) without fear of dismounting.<br /><br />Video of the trick in Route 24:<br />https://www.youtube.com/watch?v=2jI9LeehZ8E<br />(click)<br /><br />Video of the trick used to get Mew:<br />https://www.youtube.com/watch?v=Qu_t4FSlkt4<br />(click)<br /><br />In English Red and Blue, if memory serves right, in the [url=https://www.youtube.com/watch?v=fX0Wac1pCyk]link-up coast exploit[/url] the water encounter table becomes corrupted, so this means that possibly one could get different PokÃ©mon with the grass surf glitch that are not based on the last NPC trainer.<br /><br />Note that if you go to a place with water encounters, the water encounter table gets overwritten.<br /><br />The last Trainer may be Champion Blue or an Elite Four Trainer, meaning that you do not necessarily need to encounter a Trainer that wasn&#039;t used up. With Champion Blue, the data stays even after the credits sequence.<br /><br />This glitch can be done with blacking out against the Trainer as well as winning against them. If you lose before taking down a Trainer&#039;s first PokÃ©mon, then the current HP byte 2/water encounter 1 species address can remain as a value other than hex:00 (&#039;M 00).<br /><br />I have made some notes about this glitch (as well as the old man glitch) in another post, which you may be interested in reading. http://forums.glitchcity.info/index.php/topic,7332.msg198917.html#msg198917


subject: Re: Some grass surfing glitch (Spanish and Italian Red/Blue) technical details
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Interesting documentation, Torchickens :) This means that yet another bug [url=http://bulbapedia.bulbagarden.net/wiki/List_of_glitches_in_Generation_I]is going on the list[/url] :P


subject: Re: Using 8F to &quot;permanently&quot; change maps... Does ws m work the same?
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7332.msg198972#msg198972 date=1440877586]<br />Somehow it is possible to make the corruption go further, into your party PokÃ©mon and items. I don&#039;t know exactly how, but I closed and opened the menu repeatedly and my party list got replaced with 255 PokÃ©mon, many of which were Tentacool. It reminded me of [url=https://www.youtube.com/watch?v=Q8zcf2qQo6w]this video[/url] by TheZZAZZGlitch. But I tried doing that again and it did not work.<br />[/quote]<br />Could it be possible that the stack got somehow corrupted since you&#039;re supposed to be already in a battle after you first enter the fly menu?


subject: Re: Zowayix's Procrastinated Anime Reviews
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Cough cough tumbleweed blows dust off this thread and that sort of thing that alludes to the fact that I&#039;ve neglected to write a review in a while. Anyway, today the anime of reviewing is known by the name of Gantz, which I said I was going to review like 4 reviews ago or however long it&#039;s been since I reviewed Future Diary and said I was going to review Gantz. Apparently, it&#039;s about some guy who dies, and then he doesn&#039;t, and then shit gets freaky. And R rated, which doesn&#039;t automatically make it cool, but naturally doesn&#039;t exclude it from being good either. Anyway, I have to watch it to find out whether it&#039;s cool or not, so without further adios, let&#039;s do that.<br /><br />...Said Zowayix, after... according to when I started watching this on MyAnimeList... 3 months and 20 days. So, I fucked up there. Well, the black dog is a bitch. Perhaps literally. But I&#039;m here now, so on with the writing. Maybe with more swearing this time? Fuck yeah! Let&#039;s do that shit.<br /><br />[size=15pt]The all-encompassing header where I write things about the whole thing and don&#039;t go in other headers [/size]<br />After watching it[1], I still don&#039;t know what the fuck Gantz is actually about, genre-wise. I mean, I guess it&#039;s... shonen? I mean, you got the fuckin&#039; fight scenes and all that shit, so I mean it&#039;s not like pure psychological horror sort of thing, which otherwise it would be because of all the weird shit. I would say the best compromise to put it under would be that &quot;survival game&quot; genre which is apparently a distinct genre now that Future Diary and others don&#039;t count as being the genres they would be if they weren&#039;t survival games. You know, those ones where there&#039;s a bunch of people and the main character and they all have to do some arbitrary task where they might could die and then it&#039;s about who doesn&#039;t die.<br /><br />I mean, you get the idea. It&#039;s kind of a bit weird. Not in a sort of avant-garde way, or the 2deep4u way like one of those &#039;hurr you don&#039;t even know what this anime is even about because it&#039;s like a metaphor man and it&#039;s like so meaningful man because like you can&#039;t understand it, maaaaan&#039; ones like Evangelion[2] or Serial Experiments Lain[3], just that... you know what? Fuck it, I&#039;m going to cheat. Wikipedia says it&#039;s action, science fiction, horror, and thriller. That&#039;ll do. But I mean, you got like fuckin&#039; robot dudes with fucking chickens on their heads that scream at you and your ears explode, and giant Buddhas that shoot laser beams and turn into penis aliens, and then you gotta go to Wikipedia later anyway because somehow they know what&#039;s going the fuck on and you don&#039;t. It doesn&#039;t explain jack shit, and you&#039;re probably not supposed to think about the plot too much anyway, because it&#039;d be full of plot holes and &quot;because magic&quot; if you applied thorough analysis to it.<br /><br />Most of the characters here are complete dickheads, and in a general sense, that&#039;s sort of fine, because it&#039;s not the kind of genre where you want everyone to be your waifu. You don&#039;t necessarily have to connect with the characters. But it sometimes does go too far in that you find yourself yelling at your TV &quot;JUST FUCKING {DO OBVIOUS THING} YOU FUCKING DIPSHIT I FUCKING HATE YOU I HOPE YOU DIE YOU FUCKING PIECE OF SHIT!!!!!!!&quot; and that sort of detracts from the experience, no? Whatever experience is supposed to be had in the first place. I mean, maybe the whole point of Gantz as intended by the author was to make you hate the main character. I personally think that&#039;s fucking stupid, but you never know. Because like I said, it&#039;s weird. You sort of get the feeling that they were trying to deliver some kind of message to the audience, but you don&#039;t know what it is[4]. On the other hand, there may be some fruit to that salad, because even just random background characters are absolute fucking arsehats, and maybe they were going for a &quot;IT WAS HUMANS WHO WERE THE TRUE EVIL!&quot; message, which is then reinforced by showing alien characters and mysterious sphere dudes who are quite blatantly just as if not more evil than the human characters.<br /><br />Without spoiling too much (ideally, without spoiling anything at all), maybe some people die. If that is the case, I&#039;m not telling you which ones, but be on your toes. Besides, I know some of you kids just watch stuff because random people die[5], so I&#039;m just mentioning that for your sake.<br /><br />[size=15pt]Animation[/size]<br />Obvious CGI is obvious. But the other parts are fine, I guess. Sorta. Everyone&#039;s faces are fucking weird, but maybe that&#039;s just how it was in 2003[6], or these Gonzo[7] people just suck[8], or maybe it&#039;s just a deliberate design choice. But anyway, there&#039;s not much to say here, it&#039;s pretty average. It&#039;s not notably a clusterfuck, and not notably my eyes are having an orgasm for how cool this looks.<br /><br />[size=15pt]Soundtrack[/size]<br />First things first, I&#039;m going to complain about the opening theme. Now don&#039;t get me wrong, it&#039;s actually not that bad, it&#039;s like a combination of big beat and hip-hop and some rock subgenre, but there&#039;s the problem there. It sounds like I&#039;m watching Tony Hawk&#039;s Fucking Pro Skater: The Animation or some shit. Not whatever it is Gantz is supposed to be. I&#039;m not sure why they chose it, the lyrics don&#039;t even really have anything to do with the series either. Is the manga different and more fitting of that[9]? Was the director going to take Gantz into a different direction into a sort of &quot;cool kids 90s-esque action&quot; show and it would have made sense as an opening theme, but then he changed his mind? Are these Rip Slyme folks friends with the music choose people at Gonzo? Apparently they don&#039;t consider it significant either, it&#039;s not even a single. It&#039;s like track 3 on some EP they did that has no connection to anything. Did they run out of budget for licensing things or contracting a band to make a specific opening theme, so they had to just look for some random band, and they were just like &quot;Oh okay, for like 500 yen we&#039;ll let you use this song that we just came up with&quot;? Do I just not know? I don&#039;t get it. But like I said, it&#039;s not actually a bad song, I&#039;d consider it listen-worthy, just that it&#039;s entirely irrelevant.<br /><br />The ending theme is just some random female singer ballad that I didn&#039;t pay much attention to, and so it will not be elaborated on further.<br /><br />As for the main score it doesn&#039;t exist. Yet another case of the creators are too cool to release a CD, or even a bonus extra on some Bluray set that&#039;s spread across different volumes and you have to pay $599 US dollars for the whole thing, or just chuck it on iTunes[11], or the composer[12] kept the master tapes lying around and the rights and just put it on the intertubes one day, or any of that shit. It&#039;s actually not a bad soundtrack, there&#039;s a few moments on there where I was hoping there was a soundtrack release. However, it suffers from the same problem as the opening theme in that none of it fucking fits. Okay, some of it does. But there&#039;s too many scenes in where they just had the completely wrong music playing, and not in a &#039;deliberately invoke dissonance just to fuck with the viewer way&#039;, it becomes very distracting and ruins what might have been some intense, touching, or otherwise noteworthy moments.<br /><br />[size=15pt]Dubbing, DVD stuff, that sort of localisation-related thing[/size]<br />The voice acting isn&#039;t FUCKING TERRIBLE HOLY SHIT WHY, but it&#039;s not that great, either. It&#039;s below average erring on the side of detracting from the overall experience. So, ehh. The translation team referenced Shaft unironically, so they lose points for that. Yeah, I know. That was just one line. It bugged me. I don&#039;t even know why it bugged me. Maybe because it wasn&#039;t that funny. Maybe because I&#039;m not old enough to actually know what Shaft is other than it was on the Simpsons once with that episode where they go to a Japanese restaurant and Homer eats the fugu. Maybe because it was just thrown in there. Maybe because I&#039;m actually a shit reviewer and I&#039;m just looking for something to nitpick.<br /><br />DVD sucks. Sorry, Madman. The whole thing is one title and the episode/chapter markers are all over the fucking place, so if you try to watch one episode individually from the menu, you&#039;ll find yourself starting at some point in the ending credits of the last episode, or halfway through the opening credits, or who fucking knows when else. Even worse if you&#039;re a person who likes to rip their DVDs into a nice organised media library. Makes it a bit harder to watch because you have to constantly get up and fiddle with your media player if you&#039;re not just watching everything in one sitting. Apparently it has a documentary and some other things, but I think I forgot to watch it. Oh well.<br /><br />[size=15pt]Why you shouldn&#039;t watch this with your kids[/size]<br />Alrighty! Here&#039;s what I&#039;ve been fucking waiting for. This will be the huge meaty part of this review. The fun part. Perhaps even the whole selling point of Gantz. Remember how I was saying this had an R rating when a lot of other animes deserving of that rating don&#039;t, so the standards must be pretty high? Because it still has an R rating regardless of whether I said that or not. Anyway, if you have to ask the question &quot;Does this contain content I may find objectionable?&quot; then the answer is already yes. Because perhaps one of the intentions of Gantz is to make you uncomfortable. If you run out of your living room screaming and vomiting and posting to Tumblr that you think it should be banned, it has already won. So what&#039;s the best way to approach this paragraph? Well, the other day, and some other days, I was reading about how in Muricaland they have their ESRB thing where they don&#039;t just give ratings to video games like you see on the box, they also contain detailed points about what is considered objectionable in that video game but still making it all generic and spoiler-free, like &quot;The game includes instances of comical/bodily humor: a PokÃ©mon with animated mucous dripping from its nose&quot; or &quot;During the course of the game, players can unlock/obtain character trophies that depict female characters in revealing outfits (e.g., short skirts, moderate amounts of cleavage).&quot;[13] or &quot;One character emits flatulence gas clouds to attack opponents.&quot; or &quot;In a handful of missions, players are tasked with killing police officers and dispensing â€œmayhemâ€ to complete objectives.&quot;... you get the point.<br />Anyway, it inspired me to do a similar thing for Gantz and perhaps future reviews, just to make a point of how inappropriate this one is.<br /><br />- A character refuses to help an old woman with directions to a train station.<br />- Two characters are hit by a train, which results in decapitation which is fully depicted with blood.<br />- Frequent strong coarse language is found in dialogue throughout the series.<br />- Over the course of the story, many alien characters are killed with unrealistic guns that cause explosions.<br />- Multiple characters are depicted as their bodies being created slowly and the insides of their bodies are visible while they are being partially constructed.<br />- Certain characters are revealed to be members of the Yakuza, or other gangs.<br />- Many characters frequently appear naked with nipples being shown but no penises or vaginas visible.<br />- A character is implied to have attempted suicide by slashing their wrists in a bathtub while naked, which is then depicted later.<br />- A character attempts to rape another character.<br />- References to a character having an erection are made.<br />- Characters are tasked with killing aliens and are encouraged towards this goal via monetary rewards.<br />- Several characters&#039; heads explode for a reason that is not made apparent at the time.<br />- A child-like alien character is killed on-screen mercilessly and is depicted as being helpless.<br />- An alien character kills multiple human characters.<br />- A character uses supernatural powers to perform dangerous stunts which could result in injury if attempted in real life.<br />- A character is injured in a fight which prompts another character to retaliate with hand to hand combat.<br />- An alien character is physically restrained by a supernatural device.<br />- A character urges another character to murder an alien character, but as the latter character does not, kills the alien instead.<br />- A character threatens another character with a fantasy-style gun.<br />- A school bully threatens another character with violence in exchange for large amounts of money.<br />- A suit that enhances strength is revealed to be powered by a character&#039;s erections.<br />- A character is shown carrying around a case of teeth that he has removed from his victims.<br />- Two characters, including a child, are revealed to live with a family member who frequently commits acts of domestic abuse, both physically and verbally and other methods such as denial of food.<br />- A homeless character begs another character to give them a place to stay and offers to be a &quot;pet&quot; in exchange. Sexual fantasies are shown as a result.<br />- A character purchases condoms with the intent of using them for sexual intercourse.<br />- A character reluctantly agrees to another character sexually touching them.<br />- A gang of bikers are depicted pulling down a character&#039;s pants and underwear.<br />- A homosexual character is beaten severely due to a character being told the homosexual character is going to rape them.<br />- A biker gang kills another rival gang over a territorial dispute.<br />- A character taunts other characters for relying on others and tells them they will die.<br />- A character fires a fantasy gun at another character in retaliation for attempting to punch them, this causes that character&#039;s head to implode.<br />- A group of characters refuse to help another character who is in immediate danger of death, who refuses to apologise for murdering another character.<br />- A character&#039;s eardrums are burst and their eyes explode.<br />- Two characters are intimidated by another character with a gun into going into dangerous situations.<br />- A child character is depicted naked (buttocks are shown) to urinate.<br />- An elderly character is killed off-screen, the corpse is shown immediately afterwards with blood coming from their eyes and mouth.<br />- A character&#039;s head is torn off by a giant bird.<br />- A slightly effeminate male is referred to with derogatory homophobic slurs.<br />- A character threatens to shoot their spouse with one of the guns present in the series in a domestic argument.<br />- A religious priest tells several characters they will go to hell.<br />- Two characters have fully depicted sexual intercourse.<br />- Two characters talk openly about killing homeless people for enjoyment, and do so. Many beaten up faces are shown.<br />- A character is crushed by a giant animated statue.<br />- Multiple characters are killed by having their torsos cut off.<br />- A character is killed by having their lower body dissolved by acid.<br />- A character&#039;s arm and leg are burnt off.<br />- A character asks for another character to shoot them due to the pain they are experiencing.<br />- An alien stabs a character in the heart, killing them.<br />- Many other things, I didn&#039;t go and re-watch the whole series to add every single point possible<br /><br />So you get the idea. That writing style just isn&#039;t me, so I won&#039;t be doing that for future reviews, but this section will still be here with similar intentions.<br /><br />[size=15pt]That ending tho[/size]<br />I&#039;ll try not to spoil much, but anyway: It&#039;s bullshit. I&#039;m really not exaggerating when I say this is the most bullshit ending I&#039;ve ever seen. I couldn&#039;t even spoil it for you anyway, because that would involve knowing what the fuck happens. As it turns out, the last arc completely deviates from the manga, which explains a lot. A lot of stuff in that last arc just feels like it was just pulled straight out of someone&#039;s arse, and then the ending. What ending? I would almost say it&#039;s not even an ending at all. Is everyone dead? Is everyone alive? It&#039;s not even one of those metaphor things where it doesn&#039;t _directly_ tell you what happens, it just straight out literally doesn&#039;t tell you. There is nothing to even figure out. Like for example you might take Evangelion&#039;s ending, and be like &quot;Well that&#039;s a metaphor for coming out of depression or some shit&quot;, or you might watch Code Geass[14] and be like &quot;Well that had plot holes everywhere and was a really underwhelming finish to an awesome series&quot;. You can&#039;t do that here. There&#039;s nothing that actually happens for you to interpret.<br /><br />So what do I do? Read the manga? I guess I have to really, because it sounds like from what I can gather that it actually wraps things up and then keeps going and is overall an entertaining experience. Can&#039;t find it on the eBays... except in French, which I can&#039;t read. I don&#039;t like being left to what is basically piracy, but if I have no choice, fine. I&#039;ll read it online one day. Will I review it again when that happens? Maybe. If you want me to.<br /><br />[size=20pt]Final score: What the fuck / 10[/size]<br /><br />[url=http://imgur.com/a/BWkRu]Oh yeah, here&#039;s some Facebook shitposting.[/url]<br /><br />[1] And not just because I failed to write this review while it was still fresh in my head.<br />[2] Evangelion&#039;s not that bad for that aspect, actually. But it is the most prominent example, hence why I mention it here.<br />[3] Fuck Serial Experiments Lain.<br />[4] More accurately, I don&#039;t know what it is. And hey, maybe I&#039;m just an idiot. Or maybe I just don&#039;t get metaphors. But still.<br />[5] I haven&#039;t seen that Game of Thrones thing that you whippersnappers rave on about, or that Attack on Titan thing, but that seems to be the focus of them.<br />[6] It wasn&#039;t.<br />[7] They also did the music video for &quot;Breaking the Habit&quot; by Linkin Park around the same time, but I haven&#039;t seen any cheesy AMVs combining the two yet.<br />[8] They don&#039;t, Bokurano was just fine and there&#039;s some other prominent series they animated that I haven&#039;t seen but maybe are also good.<br />[9] Not the case from what I&#039;ve read, the manga appears to be just as fucked up. I&#039;ve seen some image where it&#039;s Hitler&#039;s head on a naked female body and he&#039;s saying &quot;The god you cling to does not exist&quot; or some shit, and that was before I saw this series. Maybe that&#039;s why I purchased it in the first place, because I was like &quot;Cool! Naked female Hitler&quot;. Sadly, there is no Naked Female Hitler[10] in this series.<br />[10] If any of you are starting a band, I recommend adding Naked Female Hitler to the pool of names.<br />[11] Yeah I know, that wasn&#039;t around back in the days of 2003, but they can still put a soundtrack up retroactively. My point is that they don&#039;t care.<br />[12] Apparently, it was by Natsuki Togawa and that dude who did the Fairy Tail soundtrack later in life. So it&#039;s not as though the soundtrack was an afterthought if they bothered finding two people for it, or so I would think.<br />[13] That was from SSB4 incidentally and IT FUCKING DOES NOT CONTAIN REVEALING OUTFITS YOU FUCKING PURITAN ARSEFUCKS YOU FUCKING GOT THARJA REMOVED YOU FUCKERS! WHAT ARE YOU JUST FUCKING OFFENDED BY THE FUCKING FEMALE BODY? DO YOU WANT EVERYONE TO DRESS UP IN FUCKING BURKAS INSTEAD? DO YOU JUST TRAVEL OVER TO THE MIDDLE FUCKING EAST AND BE ALL LIKE &quot;I REALLY LOVE THE WAY EVERYONE IS DRESSED HERE, I WISH MY COUNTRY WAS THIS MODEST&quot;? FUCK YOU<br />[14] Psst... that&#039;s what&#039;s up next. Yes, I&#039;m aware I have obviously already watched it.<br />


subject: Re: Some grass surfing glitch (Spanish and Italian Red/Blue) technical details
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=SatoMew link=topic=7344.msg198978#msg198978 date=1440888722]<br />Interesting documentation, Torchickens :) This means that yet another bug [url=http://bulbapedia.bulbagarden.net/wiki/List_of_glitches_in_Generation_I]is going on the list[/url] :P<br />[/quote]<br /><br />Thanks Sato!<br /><br />Later I remembered that luckytyphlosion made [url=http://forums.glitchcity.info/index.php/topic,36.msg197768.html#msg197768]a post[/url] about the grass surfing glitch, and he explained a way of getting PokÃ©mon in the water table when the water encounter rate should be 0 with glitch items in English Red/Blue (even though you can&#039;t surf on grass or on a cave tile to encounter water PokÃ©mon with the grass PokÃ©mon rate in English Red/Blue).<br /><br />I made a video about that method (which I notice you saw).<br /><br />https://www.youtube.com/watch?v=NE2DotmvjAs<br /><br />I feel that the glitch deserves its own article, personally. It is another &#039;get unexpected PokÃ©mon&#039; glitch and the article could display in a table which Trainer data corresponds with which levels/species.


subject: Glitch moves lowering glitched stats - potential to alter a useful address?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  In PokÃ©mon Yellow, the glitch move TM47 (hex:F7) has the move effect $92 (one can check the move effect without the need of looking in the ROM by putting the cursor over a glitch move and checking the address CFD3 (Red/Blue) or CFD2 (Yellow)).<br /><br />Move effect $92 gives it a chance of apparently lowering a glitched stat with a name that may be blank, though I&#039;ve also had it as named &quot;ONIX&quot; (which makes me curious if the &#039;stat name&#039; may be unpredictable like CoolTrainer&#039;s internal name).<br /><br />When I learned about it lowering a glitched stat, it made me wonder whether the game actually tries to decrease the value of a used memory address that could represent something useful to manipulate (maybe for instance we could lower the value of a species byte and we do not know it yet!). Though there&#039;s the possibility that it doesn&#039;t or tries to lower a read only address as well.<br /><br />Bulbapedia says that HM01 can also cause a glitched stat to become lowered. But this may be an error. In Red, its move effect is $8F. When I used the move, the game said &quot;nothing happened&quot; after damage was dealt, and when I set breakpoints to writable memory (8000-FEFF) in BGB, the debugger did not break there, so no arbitrary code was executed at that point.<br /><br />In Yellow, HM01 has the effect 4B, which is documented [url=http://kusabax.cultnet.net/romdocs/rbymoveinfo.txt]here[/url] as &quot;none&quot; (or is it?).<br /><br />On the subject of obtaining TM47, Bulbapedia seem to unfortunately have [url=http://bulbapedia.bulbagarden.net/wiki/List_of_glitch_moves#TM47]error(s)[/url] regarding the details of acquiring it as well.<br /><br />Yellow&#039;s Z ã‚¥ (hex:E5) will not learn TM47 at level 47, and I don&#039;t know if you can get it with the trade evolution glitch with Alakazam because Alakazam does not try to learn Shadow Ball (hex:F7) at any level.<br /><br />If we want to obtain TM47 without arbitrary code execution and no PokÃ©mon learns it, I guess that we might be able to get it with Super Glitch in a Glitch City that has a â™‚&nbsp; symbol in it, or possibly the [url=https://www.youtube.com/watch?v=tQ9JAJcofrs]max stat experience and DVs trick[/url] if you shifted a current experience of 247 (TM47&#039;s index number) into a move.


subject: Re: Glitch moves lowering glitched stats - potential to alter a useful address?
poster_name: TheZZAZZGlitch
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  TM47&#039;s move effect pointer causes an accidental jump to 0F:7502. This is a valid move effect subroutine responsible for handling side effect stat reductions - all of them. To determine which stat it&#039;s supposed to lower, it reads the move effect ID, which for valid stat reduction effects should be between 0x44 and 0x47, and subtracts 0x44 to obtain the stat identifier.<br /><br />TM47&#039;s move effect ID is 0x92, so the game will try to lower an out of bounds stat with ID 0x4E. Enemy stat changes are stored in an 8-byte table at $CD2E. Attempting to index this table with a wrong stat ID causes out of bounds writes. In our case, the move effect will cause address ($CD2E+$4E) = $CD7C to be decreased.<br /><br />That doesn&#039;t help us in any way. $CD7C is in the middle of the temporary text buffer. Any changes there do not matter, as they will be overwritten as soon as a new text string is loaded. After that is the cached screen data, and changing it also isn&#039;t helpful in any way.<br /><br />So lowering glitched stats indeed causes out of bounds writes, but they are all useless.<br /><br />The glitched stat name is unpredictable, just like the Cooltrainer move&#039;s internal name. The whole scenario is exactly the same. A 0x50 separated list of stat names is searched at 0F:7655. Out of bounds stat IDs cause the search to go beyond the buffer, and the final name pointer is determined by the amount of 0x50 bytes in the RAM.<br />The only difference is that the name can&#039;t cause any memory corruption like Cooltrainer does. The game always copies exactly 7 characters from the table, no more. You can get some insanely long stat names if the name isn&#039;t properly terminated, but it&#039;s never copied between any buffers after it&#039;s loaded, so no memory corruption occurs.<br /><br />So the glitch name isn&#039;t useful in any way either. It just looks nice.


subject: Re: Glitch moves lowering glitched stats - potential to alter a useful address?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Oh, that&#039;s a shame we can&#039;t do anything with it. Thanks for your research. :) I appreciate it a lot.<br /><br />Edit:<br /><br />[quote author=TheZZAZZGlitch link=topic=7346.msg198985#msg198985 date=1441010131]<br />After that is the cached screen data, and changing it also isn&#039;t helpful in any way.<br />[/quote]<br /><br />I&#039;m not sure if I&#039;m misunderstanding something, but this made me theorize about something.<br /><br />I was thinking if there is actually a way something like this could hypothetically be a little helpful in Red/Blue and Yellow, only if there happens to be another move that handles stat reductions and can decrement one of the cached screen data addresses. It seems very unlikely we could find something useful though, I know.<br /><br />You could maybe (only potentially) corrupt some addresses in between CF4B-D006 or D0E1-D19C ($CD2E+$FF-$44 is a difference of $BB) with Super Glitch to -1 of what the data would normally be (dictated by the screen cache), with some of those being useful, such as a letter in your name, and in Yellow since you can&#039;t (normally?) bring over screen data from outside of battle, it could have its own use there because of you needing to open the party menu in battle.<br /><br />In battle, it seems like you can normally only get two corruptions in Yellow other than a freeze (the one that gives level 127 Missingno. and the inversed sprites one that gives level 127 Horsea). I&#039;m not sure if that&#039;s really the case though.<br /><br />The cached screen data may not change if you do not open the party menu or items menu as you originally found (Red/Blue/Yellow).<br /><br />With Super Glitch, could you have the Super Glitch effects fail, and while you&#039;re on the fight screen use the glitch move with a lowering effect to alter a byte in the cached screen data, then have Super Glitch work to have the game copy the data to one of the two buffers including the byte that was altered? So for instance if we found a move that combined with Super Glitch would alter CFD8 to 1 less than expected (highly unlikely), could you use that to have a CoolTrainer/Super Glitch spot give a different PokÃ©mon (e.g. Mr. Mime instead of Hitmonlee?).<br /><br />For Red/Blue and Yellow, there is a glitch that would allow the steps in theory to work with CoolTrainer (where you can normally only select one move when CoolTrainer is the first move). If your moves are like hex:00, (glitch move) and then you view the summary of a PokÃ©mon in battle with more than one move, then you can move the cursor beyond hex:00, the number of moves you can select depending on the PokÃ©mon, which would mean you could use the glitch move to lower the stat and then access hex:00 without opening the party menu and changing the data at CD81 onward that way.<br /><br />Incidentally, I&#039;ve noticed that in Yellow if the foe makes a move or the &quot;hurt by the burn!&quot;/&quot;fast asleep&quot;, possibly other messages appear; the cached screen data at CD81+ will be updated again.<br /><br />Edit 2: What would happen if it was the opponent that used the glitch move on the user and it happened to lower a glitch stat rather than the other way around?


subject: &quot;Item Cooltrainer Trick&quot; Manipulation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Hello guys,<br /><br />Here is a new video I made for PRAMA in which I show a new way to generate PokÃ©mon with the Cooltrainer Trick using the stored items. This comes from TheZZAZZGlitch&#039;s video about Out-of-Bounds glitch city item manipulation, but it has been readapted by our tester ISSOtm that you probably know for being a wiki contributor here.<br /><br />I don&#039;t think it has been researched or discussed previously by TheZZAZZGlitch or anybody else. Because of Youtube description limitations and because I want to provide this video an English description, I will post that translated description here, and put a link in the video&#039;s description, as I did with my previous one. This will lead people directly in this thread.<br /><br />[youtube]https://www.youtube.com/watch?v=kUie0JMqYGM[/youtube]<br /><br />[EN]: This video is made by Krys3000 of the PRAMA Initiative<br />It shows a new variation of the Cooltrainer Trick in which you generate PokÃ©mon from the stored items in the PC. This method involves a Glitch City and the Noclip Trick (aka Walk through walls glitch. I consider this name to be irrelevant, because you don&#039;t walk &quot;through&quot; walls at all, you walk over them).<br /><br />Since you probably don&#039;t read french, here are some useful Glitch City Labs pages :<br />[url=http://glitchcity.info/wiki/index.php/Out_of_bounds_Glitch_City_(Generation_I)]http://glitchcity.info/wiki/index.php/Out_of_bounds_Glitch_City_(Generation_I)[/url]<br />[url=http://glitchcity.info/wiki/index.php/Walk_through_walls_trick_(ledge_method)]http://glitchcity.info/wiki/index.php/Walk_through_walls_trick_(ledge_method)[/url]<br /><br />Our previous (though french speaking) video about Noclip trick : <br />[quote]https://www.youtube.com/watch?v=_hEm8x7kfoU[/quote]<br /><br />The Cooltrainer Trick is a glitch allowing you to catch a PokÃ©mon based on tiles, discovered by TheZZAZZGlitch: <br />[quote]https://www.youtube.com/watch?v=Sst_5kAX2y4[/quote]<br /><br />An extension discovered by luckytyphlosion and documented by ChickasaurusCL/Torchickens allows to generate a PokÃ©mon from the second letter of your PokÃ©mon:<br />[quote]https://www.youtube.com/watch?v=aqy9QSbn1to[/quote]<br /><br />TheZZAZZGlitch then discovered a region in OoB Glitch City matching with the items :<br />[quote]https://www.youtube.com/watch?v=KSWob-e6i5U[/quote]<br /><br />THIS METHOD WORKS IN ENGLISH VERSIONS - But the video shows a french game. In English games you will need to go 10 steps left after going up to reach the &quot;Number of stored items&quot; address.<br /><br />To generate the PokÃ©mon you want using this new method, you must:<br /><br />- Get a Ditto to know the Cooltrainer Move. To do this, catch a Ditto, get him to fight a PokÃ©mon with more than one move. Transform into it, and switch move 1 and 2. End the fight, and your Ditto now has an empty move in the first slot. This is the Cooltrainer Move.<br /><br />- Be able to use the Cooltrainer Corruption. This depend on several RAM parameters. You have a good english post from TheZZAZZGlitch with indications to make it to work on GCLF:<br />http://forums.glitchcity.info/index.php/topic,6992.msg198569.html#msg198569<br /><br />- Know the hex value of the 4x4 tile block containing the tile you need to face this PokÃ©mon using this trick. The tile must be well-placed within the block as you can see in the video. We have established a tileblockdex to help you with this :<br />http://prama-initiative.com/RBJ/CTRAM1.png<br />But note some characters are different in English versions, which might lead to differences in some blocks.<br /><br />- You can generate PokÃ©mon of any of the 12 first stored items. To use the first item, its hex value must match the hex value of the determined 4x4 tile block (see above). The item which is 28 positions after (meaning the 29th item if you use the first, 30th if you use the second etc.) will be used to generate a tile block containing the tree (hex:50 tile) necessary for this glitch to work. There are many items you can use, for example a Full Heal if your PokÃ©mon&#039;s tile is in the lower half of the 4x4 block, and a PokÃ©doll if not.<br /><br />You can also use any item at both slots, if their quantities matches the decimal conversion of the hex values. In my example, the Bicycle (hex:06) and the Full Heal (hex:34) can easily be replaced by a PokÃ©ball x6 and a Potion x52, provided that you place yourself differently in the Glitch City (see below).<br /><br />You also have to be careful because some items generate trees and can break the glitch. Avoid having as the two following items of the two chosen ones (here, positions 2, 3, 30 and 31) : PokÃ©doll, Full Heal, Revive, Max Revive, X Defense and Old Rod (and the prototype version of PP Up) unless you know what you&#039;re doing. Also avoid that item quantity of both the chosen items (and the following one, in each case) is 50, 51, 52, 53, 54, 66 or 76.<br /><br />GCL&#039;s list for PokÃ©mon/Item/Hex/Dec matching:<br />http://glitchcity.info/biglist.htm<br /><br />Tile positions in this region of Glitch City:<br />http://www.prama-initiative.com/RBJ/ICT-grid.png<br /><br />Steps :<br />1/ Store both items at the right position. All the items between them can be anything, but avoid any hex:3X item close to your two used items because this might generate tree tiles.<br />2/ Have an Escape Rope (optionnal), Potions and Balls in your item bag, and a PokÃ©mon knowing Fly.<br />3/ Perform the Noclip Trick:<br />3.1/ All your PokÃ©mon must be fainted but one, which must be poisoned. Go to Fuchsia City inside the PokÃ©mon Center, then go out and enter Safari Zone.<br />3.2/ Exit immediately, answer NO to get back inside the Zone, and walk a few steps.<br />3.3/ Note your remaining steps, save and reset. Exit the Zone counting your steps. You must jump a ledge with your 500th step including those made before the reset and those to exit the Safari Zone. You will be called back in the Hall with the ability to walk above walls. The poisoned PokÃ©mon must not faint during this step, so heal it when needed.<br />3.4/ Allow your poisoned PokÃ©mon to faint by walking inside the hall without exiting the map. You will be back in Fuchsia&#039;s PokÃ©mon Center with the glitch active.<br />4/ Place Ditto in first position.<br />5/ Place yourself above the wall in the intersection with Sea Route 19 (as in the video). Do 44 steps left and 93 steps up to reach the Glitch City region generated from stored items ; in English versions, do an extra ~10 steps left to reach the good zone.<br />6/ Place yourself one step beneath and 4 step right to the 2x2 tile containing your tile in its right superior corner. The tree must be in the row located one 2x2 tile beneath you and not lower (see image above !)<br />7/ Open the start menu and Fly to Vermillion City. DO NOT OPEN THE START MENU ANYMORE.<br />8/ Perform the Cooltrainer Trick:<br />8.1/ Go inside Diglett&#039;s Cave and encounter a PokÃ©mon.<br />8.2/ Open the FIGHT menu and close it. Sound slowly fades, changes, and the screen gets glitched. If it didn&#039;t work, try again several times. If you need to, run away and try another PokÃ©mon. If it still doesn&#039;t work, see TheZZAZZGlitch&#039;s post above to help yourself getting this to work. NEVER OPEN ANY OTHER MENU.<br />8.3/ Catch the PokÃ©mon using balls. He will be changed to the PokÃ©mon you wanted!<br />8.4/ Leave the cave with an Escape Rope or by Open/Closing the Start Menu then taking the normal exit. Don&#039;t forget to heal both Ditto and the PokÃ©mon you just got to clean them from the corruption.<br />


subject: Re: &quot;Item Cooltrainer Trick&quot; Manipulation
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  This is a great trick! Thank you very much Krys3000 and ISSOtm. :D<br /><br />No. I don&#039;t think that anyone has ever manipulated items as tile blocks for CoolTrainer like that before. It&#039;s cool that you can access the data of the stored PC items as blocks in the Glitch City. :)<br /><br />On the subject of what index numbers the 4x4 blocks have, the tool [url=http://www.zophar.net/utilities/gblevel/pokemap.html]Pokemap[/url] should be of help. However, it does not cover glitch 4x4 blocks, though you could use memory editor to find them (e.g. with this code that may or may not be different by +5 in the French version).<br /><br />[img]http://i2.minus.com/iuMAGtPiOwWJM.png[/img]<br /><br />I will think of working on a block dex :).<br /><br />There are two other CoolTrainer techniques luckytyphlosion discovered that you might be interesting in adapting to the French version:<br /><br />1) [url=http://forums.glitchcity.info/index.php/topic,6992.msg197087.html#msg197087]Instant CoolTrainer[/url] (requires an expanded items pack)<br /><br />D35F-D360 (D364-D365 in French versions) control the &quot;event displacement&quot; address. It is a pointer that points to where the game gets block data for the top-left 4x4 block on the screen (and blocks that follow I imagine).<br /><br />Apparently someone named gifhevexxin generated a huge number of logs that tell you pointers for every PokÃ©mon except for Omantye, Dugtrio, Caterpie, Kingler, Haunter, Missingno. (hex: A2, dec 162), Charmeleon, Oddish, &quot;â–¼ W G d &quot; (hex: CE, dec 206).<br /><br />The logs can be found [url=https://mega.nz/#!o0EXjRYT!Rek3kWUe0etpZgh6NMMmnFE5aL5ebnvT0ueR75JIQKk]here[/url] in the &quot;instaCT logs&quot; folder.<br /><br />If we want a Mew CoolTrainer, we can open document 21.<br /><br />The document will look like this.<br /><br />[img]http://i3.minus.com/iNgQlQZOg1NO4.png[/img]<br /><br />This means that you have to go to one of the maps listed (what the index numbers correspond to can be looked up [url=http://bulbapedia.bulbagarden.net/wiki/List_of_locations_by_index_number_(Generation_I)]here[/url]) and then change event displacement (item 33 quantity, item 34) to the &quot;offset&quot; value (endianness is reversed!), block y (item 35 quantity), block x (item 36) and map width (item 38 quantity) to what is listed.<br /><br />We can use map 37 (Red&#039;s House 1F) or one of the other maps listed (though I haven&#039;t tested them for Mew). 4FE0 is a good &quot;offset&quot; because E0 is TM24 (which is not a glitch item unlike B4 or AC).<br /><br />So if we put in the data:<br /><br />[quote]<br />insta(tileset=1,offset=4fe0,blocky=0,blockx=1,width=1)<br />[/quote]<br /><br />(D35F/D360: E04F, D363=0, D364=1, D369=1), you can get the tiles for a Mew CoolTrainer instantly after closing the menu and opening it again (hence the name instaCT).<br /><br />To Dig away from your house, set D367 (item 37 quantity) to 03 afterwards.<br /><br />[img]http://i4.minus.com/i4uMPbyZEM2Lc.png[/img]<br /><br />A video of this glitch to get Weedle. I find it a bit like &quot;using a sledge hammer to crack a nut...&quot; but apparently it helped in speedruns.<br /><br />https://www.youtube.com/watch?v=1zPTOT1BCJg<br /><br />Sadly the ROM data between English and French data are bound to be different.<br /><br />However, if the event displacement pointer is in WRAM (e.g. in the middle of PC items?), then you may be able to force an instant Glitch City based on manipulable data, like how in this item Cooltrainer you bring up an out of bounds Glitch City with stored PC data.<br /><br />I get the impression that this may reveal something deeper into how out of bounds Glitch Cities work; does the event displacement pointer (that changes as you walk around) end up in WRAM(?).<br /><br />2) Rival CoolTrainer glitch: Some glitch items such as hex:9E in Red/Blue print tiles on to the screen. For this glitch item (or hex:80 in Yellow), it is possible to print the Rival&#039;s name if you view the item in [url=http://i.imgur.com/s5AZIod.png]a specific location[/url] (due to one of the tiles on the screen being hex:53 &quot;roof tile&quot; which serves as the rival name control character), and it is possible to print one of these Rival&#039;s name letters on to coordinate x=1, y=6; which controls the species for CoolTrainer/LOL glitch. <br /><br />By using 9F (hex:5F, Red/Blue) or -gm (hex:6A, Yellow) you can save this data into the cached screen data, and use it for CoolTrainer, provided that a 50 tile is still present on the screen.<br /><br />Since you can do this with Rival&#039;s name letter 4 (if Rival name length is 6) and since it is item 24&#039;s quantity; you can access many tiles printed as though they were in-text by changing your Rival&#039;s name. Non-text characters like hex:15 can be used for Rival CoolTrainer but certain control characters, etc. like $52, $53, $54, $56, $59, $5C, $5D, $5E cannot.<br /><br />https://www.youtube.com/watch?v=HwnymX80ZMc


subject: Re: &quot;Item Cooltrainer Trick&quot; Manipulation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Thank you for your answer Torchickens! We are happy to have contributed to the knowledge about this very interesting glitch. We are at the beginning of this, we plan to make an article for PRAMA, maybe also add it to GCL when it will be more elaborated? :)<br /><br />Thanks about this indication for glitch 4x4 blocks. I have been using VBA&#039;s Memory Viewer to change the stored items while being in this glitch city region to view them; but this will help a lot.&nbsp; ;)<br /><br />I already have seen data about those glitch items while watching your videos on the LOL Glitch to write an article about this one too (though I still have to do it...). However I did not know about the Instant Cooltrainer. I have seen and downloaded this archive before, but I didn&#039;t really understood what it was about - and now it&#039;s very clear. Thanks!&nbsp; :D<br /><br />This Instant Cooltrainer variation is awesome and probably is the most powerful Cooltrainer variation, and I will definitely look forward into this for french games. Anyway, I was confident that we could &quot;power&quot; the Cooltrainer trick with 8F code execution, for example, in order to get rid of every limitations (such as modifying tiles to generate any PokÃ©mon you want) but I didn&#039;t mention it because ultimately, having access to an expanded item pack gives you so much control on the game that every other glitch becomes unnecessary to whatever you want to do!<br /><br />I think item underflow/8F-generated glitches (or variations of glitches) are interesting on another level than those who don&#039;t use them for this reason. However, I must say that using just the expanded item pack to trigger glitches (here the Cooltrainer but also the Ditto trick) might be less painful to do than getting every item and PokÃ©mon you need for an 8F setup. So that&#039;s really great&nbsp; ;D


subject: Re: &quot;Item Cooltrainer Trick&quot; Manipulation
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Torchickens link=topic=7347.msg198988#msg198988 date=1441044156]<br />This is a great trick! Thank you very much Krys3000 and ISSOtm. :D<br />[/quote]<br />Man, when I started glitching PokÃ©mon Yellow, I didn&#039;t think one day the Great King Of Awesome Glitchiness [b]Torchickens[/b] [size=8pt]Seriously, you and TZG are awesome[/size] would congrat me.<br />Now I can turn back to my human form. Thanks.<br />April: Oh! ISSOtm is back to his real form. You guys are great! Thanks for your help. Let&#039;s celebrate with a pizza.<br /><br />(okay, maybe I should stop playing old NES games)<br /><br /><br />Okay, now on to the serious stuff.<br />There are some things I want to patch from the video :<br />[list]<br />[li]The Escape Rope is NOT required. Instead, you want to open your START menu inside the cave before exiting. No worries, there is NO chance of crashing this way :)[/li]<br />[li]In Red/Blue, you can use the Walk around with fainted PokÃ©mon glitch to make this perhaps easier. Or maybe not ([color=red]ISSOtm wonders...[/color]). If it turns it is, maybe we need to walk ~30 less steps inside of the Safari Zone. That&#039;s not really different.[/li]<br />[li]Another method exists, but it requires specific badges to be possessed. It also is (I think) a bit easier but sadly less flexible, and also it resembles what TZG did when he discovered the OoB[/li]<br />[/list]<br /><br />Now, I&#039;d like to say : well, we might have found something cool but you found something definitely far better and more powerful. We guys from the PRAMA Initiative need to port it to international releases. Good job anyways.<br /><br />Your suggestion of using Instant Cooltrainer with PC items sounds good.<br />[img]http://img4.wikia.nocookie.net/__cb20120601153205/brutallegend/images/a/a5/Challenge_Accepted.jpg[/img]<br />First thing I can tell for Rival Cooltrainer is that instead of 9F, we French players will need 8Ã¨me Ã©tage. We should work on this from now on. Gee, thanks a lot Torchickens !<br /><br /><br />Lastly, just a heads up : contrary to what is written in GCL wiki, OoB Glitch Cities and Wrong Warp Glitch Cities are EXACTLY the same thing. Maybe you wanna change that :)


subject: Re: 3DS Homebrew Launcher
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Some bad news and some good news regarding TDVS. <br />[url=https://twitter.com/smealum/status/638542089014284288]https://twitter.com/smealum/status/638542089014284288[/url]<br />[url=https://twitter.com/smealum/status/638542144823689217]https://twitter.com/smealum/status/638542144823689217[/url]<br />[url=https://twitter.com/smealum/status/638542169024819200]https://twitter.com/smealum/status/638542169024819200[/url]


subject: Re: 3DS Homebrew Launcher
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Someone actually released a tool to backup/restore savefiles this Saturday on 4chan, but it&#039;s only starting to spread now, not sure if Smea if aware of it.<br /><br />[url=https://www.reddit.com/r/PokemonPlaza/comments/3j3uy4/tutorial_how_to_use_pkhex_in_latest_3ds_system/]Here&#039;s a tutorial made recently on reddit[/url]. If your game is digital (not 100% sure that it doesn&#039;t apply to physical as well), never try to restore an old save or else your game will refuse to load it. If you ever save in-game, re-dump if you want to edit stuff.


subject: Re: 3DS Homebrew Launcher
poster_name: Missing? NO!
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Pawny, is there a tutorial or anything like that that you used in order to install/create a custom theme? I&#039;d love to do something like that and get rid of my stock theme, but I haven&#039;t had much success.


subject: Re: &quot;Item Cooltrainer Trick&quot; Manipulation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  (you should, but I can&#039;t blame you, since I&#039;ve been in SNES mode lately)<br /><br />You&#039;re more the expert than I am, ISSO. But, maybe, both are Out-of-Bounds (since with wrong warp glitch city you can reach the normal map by going to real coordonates) but not the exact same thing ? Like, one being FAR AWAY from the map and the other NOT SO FAR AWAY or something like that. I haven&#039;t checked at all.<br /><br />Anyway as I told you, I wasn&#039;t aware about the &quot;Start menu in the cave&quot; stuff to avoid freeze. Though I got used to do the Cooltrainer Trick this way so I didn&#039;t really wonder when I did the video. I&#039;ll add that in annotations and description&nbsp; :D<br /><br />Yep, I didn&#039;t had enough space in the french description to talk about the other method that generates from bag items but needs you to have 4 badges. But since we have this thread now we can do that! Be my guest&nbsp; :P 


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Searinox
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Searinox
icon: xx
body:
  How can this be converted easily into a way to write a given value from address X to address X+Y? As in, write a value to a total of Y addresses starting from X?<br /><br />This one in particular benefits since it would be nice to write FF to all 8 bytes consecutively without filling the inventory ridiculously. This one is for Stat EXP./EVs of first pokemon in active box.<br />[code]8F<br />&lt;any item&gt;<br />X Accuracy x175(Special), 173(Speed), 171(Defense), 169(Attack), 167(HP)<br />Carbos x218<br />Max Revive x255<br />Poke Ball x201[/code]<br />2nd byte doesn&#039;t matter, 65280 is enough for all 63 stat points at level 100.


subject: Re: 3DS Homebrew Launcher
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pawny
icon: xx
body:
  [quote author=Missing? NO! link=topic=7340.msg198993#msg198993 date=1441087251]<br />Pawny, is there a tutorial or anything like that that you used in order to install/create a custom theme? I&#039;d love to do something like that and get rid of my stock theme, but I haven&#039;t had much success.<br />[/quote]<br /><br />There are videos around, but they almost all use 3ds_extdata_tool which I find harder to use. [url=https://www.youtube.com/watch?v=F9fDVJV6l7s]This video[/url] uses CHMM which is VERY easy.<br /><br />People upload custom themes here: http://www.3dsthemes.com/<br /><br />[url=https://gbatemp.net/threads/chmm-custom-homemenu-manager.379349/]Custom Home Menu Manager (CHMM):[/url] This is my favorite tool to install themes since it&#039;s extremely straightforward and you can hold as many themes as you want<br /><br />[url=https://gbatemp.net/threads/release-yet-another-theme-application-plus-yata-3ds-theme-editor.393355/]YATA+[/url]: great theme maker/editor<br /><br />Easy instructions:<br />1. Download CHMM and put it in the &#039;3ds&quot; folder (the CHMM folder must be named &#039;CHMM&#039;, should look like [i]..\3ds\CHMM\CHMM.3dsx[/i], feel free to ignore/remove the .cia and .3ds files and the empty &#039;Themes&#039; folder).<br />2. Download a theme (or themes) you like from the site and extract it/them.<br />3. Create a folder named &#039;Themes&#039; on your 3DS&#039; sdcard root and put your theme(s) in subfolders (eg. [i]..\Themes\themeA\body_LZ.bin[/i] and [i]bgm.bcstm[/i], etc, don&#039;t be confused by the &#039;Themes&#039; folder that came in the CHMM package).<br />4. Every time before applying a theme, put a plain color theme (I&#039;m not entirely sure if this is necessary, but the second time I was going to install a theme I got an error, and when I do this I never got any errors).<br />5. Open CHMM in the Launcher, select your theme on the list and press A. After it&#039;s done installing press start to leave and then you can restart your 3DS with start+A)<br /><br />As for making your own themes, try your luck on YATA+ I guess, I never edited/made any theme myself. I also don&#039;t know how to deal with bcstm files and loops, but someone recommended to download premade ones from [url=http://www.brawlcustommusic.com/]here[/url], though they can&#039;t exceed 3.3MBs so you&#039;d need to edit them somehow if they do.<br /><br />I also recommend opening the themes you download on YATA+ before installing them just to preview or make sure it&#039;s not corrupted since anyone can upload stuff there.


subject: Re: 3DS Homebrew Launcher
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I found [url=https://gbatemp.net/threads/tutorial-creating-a-3ds-custom-theme-from-scratch-with-yata-v1-1.393602/]a tutorial[/url] for YATA+. 


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Spectramark
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Spectramark
icon: clip
body:
  I hatched EARTHQUAKE (Hex:0205) at Level 5 and boy, this Decamark learns so many moves.<br /><br />Upon using Rare Candies, EARTHQUAKE tried to learn Guillotine and Pay Day at Level 6, Mud Sport at Level 7, A glitch move at Level 8 and Barrier at Level 9. The game crashed upon reaching Level 10. Sadly, the type of the glitch move crashed the game on both the Battle Moves and Contest Moves screens.<br /><br />With the Move Tutor, I could teach it Waterfall, Skull Bash and a different glitch move.<br /><br />I&#039;ll test the effects of these moves in battle and in a contest and get back to you on the results tomorrow.<br /><br />On a different note, two of the four glitch moves my PokÃ©mon get when they hatch have turned out to be pretty useful, one being possible to use in battle and in contests with no negative effects, and one that appears to give instant victory in battles when used. I&#039;ll get pictures of these tomorrow.<br /><br />Oh, and just to clarify, I&#039;m doing all this on a cartridge. :)<br /><br />-----<br /><br />[b]EDIT:[/b] Unfortunately, both glitch moves proved uneventful in battle as they both seem to have 0 accuracy (Always missed) and both crash the game before you can select your move in contests...<br /><br />The glitch move EARTHQUAKE learns at Level 8: [glow=red,2,300][Attachment 1][/glow]<br /><br />The glitch move at the Move Tutor: [glow=red,2,300][Attachment 2 &amp; 3][/glow]<br /><br /><br />As for the four glitch moves my PokÃ©mon hatch with, here they are: [glow=red,2,300][Attachment 4 &amp; 5][/glow]<br /><br />The move &quot;&#91;]ÃÃŽ&nbsp; BLPOÃ‰&quot; can be used in battle and in contests with (from what I&#039;ve seen so far) no negative effects, and &quot;MNPOPOPOPOPOPOPO&quot; seems to give instant victory in battle when used, but it must be placed first on the moves list for it to work.<br />Below is a list of the effects and stats of the moves that I have found so far.<br /><br />[b]MNPOPOPOPOPOPOPO[/b]<br />-----<br />[b]Type:[/b] [Glitch type; crashes game] - Cool<br />[b]PP:[/b] ?1<br />[b]Power:[/b] 70<br />[b]Accuracy:[/b] 1<br />[b]Battle description:[/b] &lt;blank&gt;<br />[b]Appeal:[/b] 4<br />[b]Jam:[/b] 0<br />[b]Contest description:[/b] &quot;A highly appealing move.&quot;<br />[b]Effect in battle:[/b] &quot;[PokÃ©mon] used [Long line of text; wraps around screen 3 times]!&quot; [glow=red,2,300][Attachment 6][/glow] - Always misses, due to having 1 accuracy. Turns battle into a Battle Tent match. Selecting &quot;RUN&quot; afterward will say &quot;[Trainer] forfeited the match!&quot;. The trainer you just battled will act as if you had beaten them.<br />[b]Effect in contest:[/b] Crashes game.<br /><br />[b]&#91;]ÃÃŽ&nbsp; BLPOÃ‰[/b]<br />-----<br />[b]Type:[/b] Normal - Cool<br />[b]PP:[/b] 8<br />[b]Power:[/b] 243<br />[b]Accuracy:[/b] 29<br />[b]Battle description:[/b] &lt;blank&gt;<br />[b]Appeal:[/b] 3<br />[b]Jam:[/b] 0<br />[b]Contest description:[/b] &quot;The next appeal can be made earlier next turn.&quot;<br />[b]Effect in battle:[/b] &quot;[PokÃ©mon] used a NORMAL move!&quot; - Damages the target significantly.<br />[b]Effect in contest:[/b] &quot;[PokÃ©mon] appealed with COOL move!&quot; - Animation looks like Pound.<br /><br />[b]C&nbsp; &nbsp;  Ã‡ Ã¬ â™‚Ã€&nbsp; Ãº[/b]<br />-----<br />[b]Type:[/b] Normal - Cool<br />[b]PP:[/b] 0<br />[b]Power:[/b] ---<br />[b]Accuracy:[/b] ---<br />[b]Battle description:[/b] &lt;blank&gt;<br />[b]Appeal:[/b] 2<br />[b]Jam:[/b] 1<br />[b]Contest description:[/b] &quot;Badly startles POKÃ©MON that made SMART appeals.&quot;<br />[b]Effect in battle:[/b] Softlocks game when &quot;FIGHT&quot; is selected.<br />[b]Effect in contest:[/b] Crashes game.<br /><br />[b]â†‘Ãšâ†‘Ãšâ†‘Ãšâ†‘Ãšâ†‘Ãšâ†‘[/b]<br />-----<br />[b]Type:[/b] Normal - Cool<br />[b]PP:[/b] 0<br />[b]Power:[/b] ---<br />[b]Accuracy:[/b] ---<br />[b]Battle description:[/b] &quot;qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF qÃF&quot;<br />[b]Appeal:[/b] 8<br />[b]Jam:[/b] 4<br />[b]Contest description:[/b] &lt;blank&gt;<br />[b]Effect in battle:[/b] Crashes game when &quot;FIGHT&quot; is selected.<br />[b]Effect in contest:[/b] Crashes game.<br /><br />I&#039;m not too sure if this info will help you guys in any way, but I just thought I&#039;d share it anyway. :)


subject: Re: &quot;Item Cooltrainer Trick&quot; Manipulation
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Wrong wrap glitch cities have different event displacement (is this the term?) from if you walk there normally.


subject: Re: Gen III: Access PokÃ©mon beyond the sixth slot sub-glitches.
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  About your &quot;effect in battle&quot; and &quot;effect in contest&quot; lines: remember (or discover, since I assume you don&#039;t know about it yet) [url=http://forums.glitchcity.info/index.php/topic,7156.0.html]this effect that I and Torchickens researched[/url].


subject: Core game music in spin-offs
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  PokÃ©mon Pinball&#039;s Blue Field theme is a rearrangement of PokÃ©mon Gold&#039;s and Silver&#039;s Ecruteak and Cianwood City theme, even though Pinball came out first.<br /><br />Video: [url=https://www.youtube.com/watch?v=dOenACS8qY8]https://www.youtube.com/watch?v=dOenACS8qY8[/url]<br /><br />Do you guys know of other similar rearrangements? I will be glad to upload them :) 


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: shutterbug2000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m just gonna leave this here.<br /><br />http://gbatemp.net/threads/save-data-manager-and-editor-for-firmware-up-to-9-9.396245/


subject: New 3DS-only games on Old 3DS?
poster_name: MidnightNinetales
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Does anyone know what would happen if you tried to run a New 3DS-only game on an Old 3DS that hadn&#039;t been updated since before the New 3DS was released by using the Homebrew Launcher&#039;s region free launcher? I just can&#039;t stop wondering about this for some reason. 


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pawny
icon: xx
body:
  Since the thread is bumped, I confirmed the game start up normally with the glitchmons on the box. Although this isn&#039;t as convenient as the browser exploit for quick checking, you can fill your box(es) with glitchmons to check a batch.<br /><br />0x7c5 - Snubbull<br />0x7c6 - Arceus-Electric<br /><br />0x7c4 and below should have more interesting hybrids is anyone is willing to check.<br /><br />Also I confirmed 100% that there&#039;s no &quot;old save restoring protection&quot; or anything on physical carts so you can play around with savefiles back and forth. But be extra careful with digital copies: only edit your latest save and if you ever save in-game, re-dump.<br /><br />EDIT: well since I decided to test harder with more unstable mons to make sure the game does always start, I ended up testing more of those hybrids in the process:<br /><br />0x7c4 - Tangrowth<br />0x7c3 - Bulbasaur<br />0x7c2 - Mega Lopunny<br />0x7c1 - Bulbasaur<br />0x7c0 - Shinx<br />0x7bf - Bulbasaur<br />0x7be - Dodrio<br />0x7bd - nothing/freezes<br />0x7bc - Golem<br />0x7bb - Ivysaur<br />0x7ba - Kadabra


subject: Re: Core game music in spin-offs
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [url=http://bulbapedia.bulbagarden.net/wiki/PokÃ©mon_Pinball#Trivia]Bulbapediaâ€™s list[/url] of the various recycled music in PokÃ©mon Pinball says that the name entry music was the basis for Soootpolis Cityâ€™s theme, but to me it sounds like both of them are based on the ending theme from Gold and Silver.<br /><br />Of course, the PokÃ©mon Stadium games, PokÃ©mon Pinball: Ruby &amp; Sapphire, and PokÃ©mon Box Ruby &amp; Sapphire have soundtracks entirely based on the respective main series games, as does the Battle Mode in PokÃ©mon Colosseum and XD. In Story Mode, Colosseum and XD use the main series PokÃ©mon Center and evolution themes, but just the other day (while playing with [url=https://tcrf.net/PokÃ©mon_Ruby_and_Sapphire/Debug_Menus#Sound_Test]Ruby and Sapphireâ€™s sound test[/url]) I noticed a more subtle reference: their news broadcast theme resembles Gabby &amp; Tyâ€™s encounter theme.


subject: Re: &quot;Item Cooltrainer Trick&quot; Manipulation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh, I see. Thanks for that.<br /><br />I&#039;ve made some extra findings on this that might be interesting.<br /><br />- The Item Cooltrainer Manipulation [b]works in English versions as well[/b]. You only need to go a little more left (I went to 7E, 3D like I did for the French version, then around 10 steps to the left you will find the English address for stored items).<br /><br />- You can actually visualise a lot of RAM Map in OoB glitch city. If you continue up, you will find blocks based on PokÃ©mon data, for example. [b]I was able to generate Cooltrainer yield using the nickname of my PokÃ©mon, and also through stat data from my 6th PokÃ©mon[/b].<br /><br />- You probably have seen TheZZAZZGlitch using OoB Glitch City to change the quantities of his items by cutting a tree on a 4x4 tile. You can do the same thing here to affect your PokÃ©mon. [b]For example if you have 51 in a stat, you can turn it instantly to 108 by going to the corresponding tile and cutting the tree in it[/b]. That&#039;s awesome.<br /><br />This is very cool, really. I will continue researching Glitch City RAM viewing (and manipulating)! Don&#039;t hesitate to join as well if you have time :p


subject: Re: Core game music in spin-offs
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: camper
icon: xx
body:
  If you mean the theme labelled &quot;Interviewers&quot;, that&#039;s not Gabby and Ty&#039;s encounter theme, but instead is the theme when you watch the interview on TV IIRC.<br /><br />I don&#039;t play the spin-off games, but if you&#039;re talking about reusing music, the Printer theme from Yellow is used for the Pokewalker in HGSS.


subject: Re: Core game music in spin-offs
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=camper link=topic=7348.msg199009#msg199009 date=1441290225]<br />If you mean the theme labelled &quot;Interviewers&quot;, that&#039;s not Gabby and Ty&#039;s encounter theme, but instead is the theme when you watch the interview on TV IIRC.[/quote]<br />Itâ€™s both.


subject: Re: Core game music in spin-offs
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7348.msg199007#msg199007 date=1441249005]<br />[url=http://bulbapedia.bulbagarden.net/wiki/PokÃ©mon_Pinball#Trivia]Bulbapediaâ€™s list[/url] of the various recycled music in PokÃ©mon Pinball says that the name entry music was the basis for Soootpolis Cityâ€™s theme, but to me it sounds like both of them are based on the ending theme from Gold and Silver.<br /><br />Of course, the PokÃ©mon Stadium games, PokÃ©mon Pinball: Ruby &amp; Sapphire, and PokÃ©mon Box Ruby &amp; Sapphire have soundtracks entirely based on the respective main series games, as does the Battle Mode in PokÃ©mon Colosseum and XD. In Story Mode, Colosseum and XD use the main series PokÃ©mon Center and evolution themes, but just the other day (while playing with [url=https://tcrf.net/PokÃ©mon_Ruby_and_Sapphire/Debug_Menus#Sound_Test]Ruby and Sapphireâ€™s sound test[/url]) I noticed a more subtle reference: their news broadcast theme resembles Gabby &amp; Tyâ€™s encounter theme.<br />[/quote]<br /><br /><br />Thanks for the information :) As to the Blue Field theme, it sounds like Ecruteak&#039;s and Cianwood City&#039;s theme to me. The name entry theme, on the other hand, doesn&#039;t strike me as Sootopolis City&#039;s either. If you want, here are the [url=https://en.wikipedia.org/wiki/Game_Boy_Sound_System]Game Boy Sound System[/url] files for [url=http://www.zophar.net/music/gbs/pokemon-pinball.html]Pinball[/url] and Crystal ([url=http://www.zophar.net/music/gbs/pokemon-crystal-]http://www.zophar.net/music/gbs/pokemon-crystal-[/url][pocket-monsters-crystal].html).


subject: Re: Anedapami hybrid?
poster_name: Sounansu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  (Late) thanks for the thorough respone! That answered all of my questions and then some!<br /><br />[quote author=Torchickens link=topic=7339.msg198966#msg198966 date=1440859291]<br />Welcome to the forums Sounansu. That&#039;s OK. Your English is good!<br /><br />When you perform the dokokashira door glitch, you receive Anedepami because you are swapping the PokÃ©mon end terminator (hex:FF) with the first PokÃ©mon, and even if you fill your party with five Eevee, you will still have the Anedepami in the party.<br /><br />I&#039;m not sure if you did because you mention it happened after withdrawing Hitmonlee and just switching PokÃ©mon around in the party, but do you remember if you happened to activate any event that removes a PokÃ©mon from a list? Did you also have an Anedepami directly above Hitmonlee?<br /><br />What you describe is typical of a hybrid glitch PokÃ©mon. If you still have access to the save, can you try putting it into the Day Care and tell me if you get Anedepami or Hitmonlee after you withdraw it please?<br />[/quote]<br /><br />I did have Anedepami in my party somewhere, I probably put it directly above Hitmonlee when I was switching pokemon. I&#039;m not sure what you mean by &#039;removing a pokemon from a list&#039;, but I think I deposited one of my Eevees to make room for Hitmonlee if that&#039;s what you mean. I&#039;ll try the daycare thing when I get around to it.<br /><br />[quote author=Torchickens link=topic=7339.msg198966#msg198966 date=1440859291]<br />The Charizard sprite and &quot;Andedepami&quot;&nbsp; behaviour definitely means it&#039;s using byte 1 as FF. Anedepami is hex:FF (like Charizard &#039;M from Red/Blue and Q from Yellow), so it works for the PokÃ©mon merge glitch.<br /><br />The PokÃ©mon merge glitch is a known glitch that occurs when you remove a PokÃ©mon before hex:FF from a list (by depositing, withdrawing from a box, putting the PokÃ©mon into Day Care) when the list is like this: (PokÃ©mon 1), hex:FF PokÃ©mon, one-four PokÃ©mon (note you could also have two-four PokÃ©mon before the hex:FF and one-three PokÃ©mon and also withdraw one of those before FF to activate the glitch).<br /><br />When you perform the merge glitch, the PokÃ©mon below hex:FF basically hybridize with the first PokÃ©mon above them. A hybrid is a PokÃ©mon with the traits of one PokÃ©mon (such as its sprite, available TM/HM moves) and another.<br /><br />The merge glitch affects species byte 1; which controls species name (from status page 2), learnset, mini-sprite, evolutions, TM/HM compatibility, type shown on the summary screen, experience cap. Species byte 2 (controlling in-battle palette, effective typing, growth rate, &quot;real&quot; Day Care PokÃ©mon, growth rate) remains unchanged; so if you hybridized Pidgey with Mew, the PokÃ©mon would become a non-hybrid Mew again when taking it into the Day Care and .<br /><br />The addresses of species byte 1 and 2 for party PokÃ©mon 1 in Red/Green are D124 ,D12B respectively. So the GameShark codes 01xx24D1, 01xx2BD1 change the data.<br /><br />On a technical basis the merge glitch works like this:<br /><br />The game is supposed to shift the species bytes back when the number of PokÃ©mon decreases by removal until it finds an FF (in this case the game has to shift PokÃ©mon species byte 1s back), but the FF signals the game to stop shifting data back after it.<br /><br />Imagine the following party or box list:<br /><br />(PokÃ©mon 1)<br />Q<br />Hitmonlee<br />Pidgey<br />Cancel<br /><br />The data looks like this:<br /><br />xx FF 2B 24 FF<br /><br />xx: PokÃ©mon 1<br />FF: PokÃ©mon 2 - Anedepami<br />2B: PokÃ©mon 3 - Hitmonlee<br />24: PokÃ©mon 4 - Pidgey<br /><br />If you remove PokÃ©mon 1 the data becomes:<br /><br />FF FF 2B 24 FF<br /><br />The game was &#039;supposed to&#039; shift 2B and 24 back, so that Hitmonlee becomes PokÃ©mon 2, Pidgey becomes PokÃ©mon 3 but the FF (Anedepami) told it not to.<br /><br />It now means that the data would look like:<br /><br />FF: PokÃ©mon 1 - Anedepami<br />FF: PokÃ©mon 2 - &#039;Anedepami&#039;<br />2B: PokÃ©mon 3 - &#039;Hitmonlee&#039;<br />24: PokÃ©mon 4 - &#039;Pidgey&#039; (unselectable if you had 4 PokÃ©mon in the list because now we technically have 3)<br /><br />Though this looks normal, the PokÃ©mon in quotation marks have become hybrids.<br /><br />The reason is that the game apparently still alters different areas of data as if the byte shifts back were to occur. So Anedepami (PokÃ©mon 2) ends up with the nickname, moves, species byte 2 of Hitmonlee (PokÃ©mon 3) because it&#039;s as if that PokÃ©mon was PokÃ©mon 2.<br /><br />Similarly, the Hitmonlee would have Pidgey&#039;s nickname, moves and species byte 2.<br /><br />PokÃ©mon have two species bytes in memory. The first byte (which you can track/alter for party PokÃ©mon 1 with the code 01xx24D1) controls the species name (from status page 2), learnset, mini-sprite, evolutions, TM/HM compatibility, type shown on the summary screen. The second byte (which you can track/alter for party PokÃ©mon 1 with the code 01xx2BD1) controls the PokÃ©mon&#039;s color palette in battle, effective typing (so a Gastly hybrid may be able to get hit by Normal moves) as well as the PokÃ©mon you receive when the PokÃ©mon is taken into Day Care and out.<br /><br />Note about PokÃ©mon 1 being replaced with FF:<br /><br />When the game finds the first FF, the game replaces the byte before it with FF (which the max DVs and stat experience glitch abuses). This is because FF marks an end of list for PokÃ©mon (and items) that is placed at number of PokÃ©mon+1 (and number of PokÃ©mon decreases, so the game has to create another FF). In the party menu, it hides PokÃ©mon below it. The party menu will try to display PokÃ©mon you don&#039;t even have (but often the 0 maximum HP glitch freezes the game if it tries to) and this is prevented by having FF at number of PokÃ©mon +1.<br />[/quote]<br /><br />Yes, I&#039;ve heard about that one. Not sure if I understand all the technical stuff, but I&#039;ll try it sometime.<br /><br />[quote author=Torchickens link=topic=7339.msg198966#msg198966 date=1440859291]<br />Fixed. Thanks for noting this error!<br />[/quote]<br /><br />No problem!<br /><br />[quote author=Torchickens link=topic=7339.msg198966#msg198966 date=1440859291]<br />If you are referring to catching Mew at level 1 (where its experience calculation medium-slow gives it -54 experience points or 16,777,162 experience points and you can gain less than 54 experience to jump to level 100), a freeze will happen if Mew is sent to the PC and withdraw it. The same freeze will occur if you capture a level 0 &#039;M (who is [url=http://forums.glitchcity.info/index.php?topic=6588.0]growth rate 1A[/url] (26 in decimal) in Red/Blue and it is sent to the PC).<br /><br />The freeze depends on both the PokÃ©mon&#039;s experience and its growth rate.<br /><br />This [url=https://docs.google.com/spreadsheets/d/1NFojS1JlAGvfBlqfLJyGwUO3iZCG5UQvItr7xrHup8U/edit?pli=1#gid=1302000118]table[/url] will tell you levels for when a freeze occurs. <br /><br />In Red and Blue, the default experience for level 1 is documented as the only harmful medium-slow level. I don&#039;t know if this also applies to Red and Green. In both Red (English) and Green (Japanese), although level 0 gives negative experience for medium-slow, it is not (necessarily) affected.<br />[/quote]<br /><br />Yes, that&#039;s the glitch I was referring to. Wow. Look at me thinking way too deep into things.&nbsp; ;D


subject: Re: OT name of in-game traded PokÃ©mon (Generation I)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Blaziken257 link=topic=6441.msg187042#msg187042 date=1335021491]<br />Some of the magic words are weird, too. Why is the &quot;......&quot; there? I&#039;ve never seen it (at least from what I can remember), and I didn&#039;t even know raised ellipsis even existed in Generation I (though I&#039;ve seen it lots of times in the English Crystal). &quot;TM&quot; doesn&#039;t seem that necessary; it&#039;s only two characters, although I guess that adds up for the names of all the TMs. Also, I find it odd that &quot;Enemy &quot; has a space after it, while none of the other strings do.<br />[/quote]<br /><br />[quote author=Torchickens link=topic=6441.msg187044#msg187044 date=1335036666]<br />Regarding &quot;......&quot; ($59), it was sometimes used in the Japanese versions. I don&#039;t remember it being used in the English games either, so it might simply be a leftover like the way that there are still some Japanese characters in the English games. It may be of note that the English Generation II used this, as they incorporated &quot;......&quot; as part of the message at the beginning of the game before you set the clock time.<br /><br />[img]http://i1271.photobucket.com/albums/jj640/Torchickens/SixElipses.png[/img]<br />[/quote]<br /><br />[url=https://ja.wikipedia.org/wiki/%E3%83%AA%E3%83%BC%E3%83%80%E3%83%BC_(%E8%A8%98%E5%8F%B7)#.E7.AC.A6.E5.8F.B7.E4.BD.8D.E7.BD.AE]Midline horizontal ellipses[/url] (&quot;â‹¯&quot;) are common in Japanese. They&#039;re used in the localizations of Crystal (but not Gold and Silver, IIRC) during battles by mistake. The NEW GAME text uses the regular Western ellipses.


subject: Gen I: How to break the money cap and other glitchy-richness
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: The G-Meister
icon: xx
body:
  [color=red]ATTENTION: This first post is under maintenance while I clear up and explain some of the discoveries made below. Sorry if bits of it don&#039;t make much sense right now :/[/color]<br /><br />Here are multiple methods to get the player&#039;s money to 999,999 or over, using a few basic glitches.<br /><br />[b][size=12pt]Method 1: Editing Money Bytes ($D347 - $D349 RB) via Item Underflow[/size][/b]<br /><br />You might not have known it, but that CANCEL button at the bottom of your item pack is the key to all the money you could ever need. By far the most efficient of the lot, this method gets the counter to FFxxxx, where the xxxx value is the money the player had to start with. In the method described, only byte $D347 is modified.<br /><br />[u]The player must have:[/u]<br /><br />[b]1.[/b] less than 10,000 PokÃ©mon dollars<br />[b]2.[/b] a stack of 255 items<br />[b]3.[/b] any two separate disposable items<br />[b]4.[/b] access to a PC (including the one in the player&#039;s bedroom)<br /><br />[u]Procedure 1 (if the item pack has been filled to the maximum at any point during the playthrough):[/u]<br /><br />If the player has filled up their item pack such that they cannot hold any more items, a TM55 (CANCEL) needs to be tossed using this method. If you find multiple or even just one hex 00 item below the cancel button (displayed as a &quot;j.&quot; in English RBY) you will need to refer to procedure 2 below.<br /><br />[b]0.[/b] If the player hasn&#039;t already, it might be a good idea to duplicate the stack of 255 items. Do this by depositing it in the PC, then depositing a cheap item (EG an Antidote), then withdrawing any item above the x255 stack. Then re-deposit the item, to have the antidote replaced by another x255 stack of the same item, which the player can withdraw. Alternatively, buy two separate disposable items. Put one above the x255 stack, and one underneath. Sell the one above back to the vendor, or toss it, then buy another item to return the pack back to normal.<br />[b]1.[/b] Set up your item pack like so:<br /><br />Disposable Item 1<br />Disposable Item 2<br />Item x255<br />CANCEL<br /><br />[b]2.[/b] Deposit the first two items in the PC, to have the Item x255 duplicated twice.<br />[b]3.[/b] Toss 253 of the first item.<br />[b]4.[/b] Swap items one and two twice. Dry item underflow is now activated.<br />[b]5.[/b] Scroll down past &quot;CANCEL&quot; (as in, keep scrolling until &quot;CANCEL&quot; disappears off the top of the screen, will be roughly 19 flashes of the cursor from the top of the pack.)<br />[b]6.[/b] Scroll back upwards, such that when the cursor lands back on &quot;CANCEL&quot; you don&#039;t press &quot;up&quot; again. If you do so, repeat step 5 up until this point.<br />[b]7.[/b] Toss 1 of &quot;CANCEL&quot;.<br />[b]8.[/b] Withdraw both of your disposable items to return the pack back to normal. The one you withdraw first will get destroyed.<br /><br />[u]Procedure 2 (if the item pack has not been filled to the maximum at any point in the playthrough):[/u]<br /><br />If an item slot has not been filled up yet in the current playthrough, it&#039;s default values are hex 00 (&quot;j. x0&quot;), and are replaced by hex 255 (&quot;CANCEL x0&quot;, although the x0 is not displayed) once an item is removed from it. This makes it seem like you are not scrolling anywhere, when in fact you are scrolling past many &quot;CANCEL&quot;s, they just have the property whereby they &quot;hide&quot; all the items beneath them, including other &quot;CANCEL&quot;s.<br /><br />Follow steps [b]0.[/b] to [b]4.[/b] from Procedure 1.<br />[b]5.[/b] Scroll down past &quot;CANCEL&quot;, until you see one or more &quot;j. x0&quot;<br />[b]6.[/b] Find the last &quot;j. x0&quot; in your clump and toss 1. If your money is 000000, find the second to last &quot;j. x0&quot; in the clump and toss 1.<br />[b]7.[/b] Withdraw both of your disposable items to return the pack back to normal. The one you withdraw first will get destroyed.<br /><br /><br />[u]Result:[/u]<br /><br />If buying an item, look at your money counter in the top right. If you have done everything correctly (or my explanation is up to scratch), you should see two identical glitch blobs as the first and second digits. These are both the games representation of a hex value of &quot;F&quot;. You&#039;ve effectively added 1650000 PokÃ©mon dollars to your wallet. Have fun carrying that around.<br /><br />[i]Having used this method for item underflow many a time on console myself, I find it much easier to use and key items you might have accumulated during your playthrough for the initial steps (makes depositing/withdrawing faster and easier) and to have a stack of over 100 disposable items in my PC, which I use to withdraw and turn the pack back to normal. This means that I can do the whole process while stood in front of the PC, and do it multiple times without having to go out to the Mart and back.[/i]<br /><br />An alternative method for this involves you swapping the item underneath CANCEL with something like a x255 stack of TM54, increasing the 3rd, 4th, 5th and 6th digits to glitch blobs too, although this is only a marginal increase from the method above, and was not worth a full explanation.<br /><br />[b]Method 2: Selling Nuggets[/b]<br /><br />As much as they might taste &quot;Yeeehaaa,&quot; they&#039;re worth more in the bank than they are in your stomach. Sorry Pete.<br />Cereal jokes aside, this method gets the counter to 999999<br /><br />This was my first attempt. Using the dry item underflow, standing at the Easternmost point of Celadon City, on the North side of the path, it&#039;s possible to swap the remaining item(s) with a 0x stack of Nugget, found not too far down the list. Subsequently the player should fly back to a city of their choice, and sell them in batches of 99x for max efficiency, giving 450,000 PokÃ©mon dollars per 99 (selling 100+ at a time simply results in them selling for 499,999 PokÃ©mon dollars due to reasons outside of my knowledge). Seen as the player has 256 of them, they have more than enough to max out their money to the normal cap of 999,999 PokÃ©mon dollars.<br /><br />A few nuggets should remain, they can either be deposited in the PC for later use, tossed, or sold. Finally, the player should buy 3 items with their newly-found riches to return their pack back to normal.<br /><br />[b][size=12pt]Arbitrary Code Execution[/size][/b]<br /><br />Working on a code for 8F and ws m. Bear with :P<br /><br />[b][size=12pt]Sample Text[/size][/b]<br /><br />[b][size=12pt]End Note: Glitch symbols[/size][/b]<br /><br />Some of these methods break the cap of 999,999, and subsequently display glitched symbols instead of numbers. When viewing the player&#039;s profile, most of these glitched characters are blank, and will not give you much insight into what character it actually is. To get around this, go to a PokÃ©mon mart and speak to the lady who sell the player stuff, the Safari Zone entrance and speak to the guy who lets the player in, the PokÃ©mon center before rock tunnel and speak to the man who sells the player a Magikarp (if the Magikarp has not been bought yet) or any other place outside of the player&#039;s profile to get a proper reading. The PokÃ©mon center Magikarp guy is probably the most useful to you, as this image as taken from [url=http://forums.glitchcity.info/index.php/topic,6638.0.html]this post[/url] tells you what the correct values are. Seen as each digit only goes up to 15, you should only need the first 5.<br /><br />[img]http://i38.tinypic.com/2d8jgqg.png[/img]


subject: Re: Gen I: Maxing out PokÃ©dollars (money)
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  The most valuable item in Yellow is not the Nugget, but rather ï¿½ï¿½[[i]page down[/i]]ï¿½ (hex $96), which sells for 469745 PokÃ©dollars.


subject: Re: Gen I: Maxing out PokÃ©dollars (money)
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: The G-Meister
icon: xx
body:
  [quote]The most valuable item in Yellow is not the Nugget, but rather ï¿½ï¿½[page down]ï¿½ (hex $96), which sells for 469745 PokÃ©dollars.[/quote]<br /><br />Oh nice! Never thought of selling glitch items. However after a bit of testing, it seems that even if the player sells or tosses any of them (I was using a 0x stack) it converts into another item (on Yellow anyway, and I&#039;d love to tell you what it is, but apart from telling you the array of glitchy symbols, I can&#039;t tell you anything. Man, I should really start using an emulator :/). The shop-keeper then says in response to selling it (something along the lines of) &quot;I&#039;m afraid I can&#039;t put a price on that,&quot; meaning it&#039;s classed as a special item.<br /><br />So the player can sell one, then they have to go and retrieve another one... and unless they fumble around with converting the thing we&#039;re left with back into what it originally was, then the nugget method would be more practical, as the player only has to do one round of nugget-selling to get the max of 999,999. Furthermore, it doesn&#039;t matter what item you use for the underflow, as the 0x stack of nuggets is relative you your Y co-ordinate. What the player has to do to get the &quot;ï¿½ï¿½[page down]ï¿½&quot; (hex $96) is do a whole lap of Celadon city and an extra 3 spaces to convert a Max Elixer into one.<br /><br />And even after all of that, we&#039;re still only at 999,999 :/<br /><br />[Edit]: After screwing around a bit more, and replacing the item under the &quot;CANCEL&quot; button with a x255 stack of TM54, I managed to get the last four digits to be FEFF, and discovered that although in the items menu the bytes are combined to give the TM54 and x255, they&#039;re handled individually when it comes to money, meaning the max possible total is... 1,666,665 in decimal? (1500000+150000+15000+1500+150+15)


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Flameduck
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Flameduck
icon: xx
body:
  I&#039;ll see if I can edit out the glitches from my party this way. It&#039;s worth a shot.<br /><br />EDIT: might take a while? Not sure. 


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pawny
icon: xx
body:
  [quote author=Flameduck link=topic=7179.msg199018#msg199018 date=1441587410]<br />I&#039;ll see if I can edit out the glitches from my party this way. It&#039;s worth a shot.<br /><br />EDIT: might take a while? Not sure.<br />[/quote]<br /><br />You can edit your party with this indeed. Not sure if it could make your game boot right way, but you definitively can replace your entire savefile to make it boot. Also, you can convert your last ramsav with this.


subject: Missing announcer phrases in Pokemon Stadium (Int.)
poster_name: Crystalame
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I don&#039;t believe this is a glitch, so I&#039;m posting this in the general Pokemon Discussion section instead. If it turns out it is a glitch, feel free to move it.<br /><br />_________<br /><br />So for some reason in this particular version of Pokemon Stadium (the International version, NTSC to be specific) I&#039;ve been playing, I&#039;ve noticed two things:<br /><br />1. Jynx is black instead of purple. I believe I already read somewhere that this is normal for older releases of the game, but the most notable thing is...<br /><br />2. The announcer is missing at least two phrases. I noticed it immediately because one of them was always really satisfying to hear, and... he never says it in the version of the game I&#039;m playing. In the cartridge I had a long time ago, he did.<br /><br />The two phrases I&#039;m referring to are &quot;Taken down on the word go!&quot; and &quot;There&#039;s been major action already!&quot;.<br /><br />I&#039;mma cite Werster&#039;s [url=https://www.youtube.com/watch?v=952MJlAMwUU]newly-uploaded Pokemon Stadium speedrun[/url] since it&#039;s what reminded me. You can hear both of the mentioned phrases at 3:03 to 3:13 or so. There may actually be more as well, but these two are the ones I recognized immediately being missing. Glad there&#039;s a video handy, because when I first realized they were missing, I thought I was just going insane or something.<br /><br />I&#039;ve never heard anything about this, which is why I&#039;m so curious. It seems to funny to just add phrases in later copies (? I&#039;m assuming later since Jynx&#039;s design was changed) of the game. Just for more variety, I guess...?


subject: Re: Missing announcer phrases in Pokemon Stadium (Int.)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  According to DAT-O-MATIC, there are three revisions of the American version ([url=http://datomatic.no-intro.org/?page=show_record&amp;s=24&amp;n=0576]1[/url], [url=http://datomatic.no-intro.org/?page=show_record&amp;s=24&amp;n=0577]2[/url], [url=http://datomatic.no-intro.org/?page=show_record&amp;s=24&amp;n=0937]3[/url]) and two of the English European version ([url=http://datomatic.no-intro.org/?page=show_record&amp;s=24&amp;n=0570]1[/url], [url=http://datomatic.no-intro.org/?page=show_record&amp;s=24&amp;n=0571]2[/url]). That might explain the differences you&#039;re noticing.


subject: Re: Gen I: Maxing out PokÃ©dollars (money)
poster_name: FSX
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: FSX
icon: xx
body:
  As far as I can tell, the game stores the amount of money the player has as a 6-digit, that is, 3 byte, binary coded decimal number. The way binary coded decimal addition works in RBY is that overflow is handled by capping, so if the result has to be a 6-digit number, which it does, it will never produce a result larger than 999,999.<br /><br />So you&#039;re never going to get more than Â¥999,999 by selling items in the store.<br /><br />I think your estimation of the maximum amount of money is probably correct, though.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I just found out that the Pewter Museum guy is gone after he&#039;s being used to replaced the trainer encounter needed for the Trainer-Escape glitch. Why did that happen and is there a way to get him back?


subject: Re: Gen I: Maxing out PokÃ©dollars (money)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  I don&#039;t really know if that helps but using [url=http://forums.glitchcity.info/index.php/topic,7347.0.html]Glitch City RAM manipulation[/url] you can do interesting things with your money.<br /><br />I recently used this to give me 6F6F6F PokÃ©dollars (the game considers this to be 696969). We can&#039;t go more so it&#039;s not &#039;maxing out&#039; but since it is easy to do and required quite nothing outside of Fly and Cut, it has a certain utility I think.<br /><br />I intend to start a thread on glitch city RAM manipulation soon. Aside from generating Cooltrainers from a lot of RAM values (money, moves, items, etc.) it has other useful applications, like allowing some PokÃ©mon to learn Solar Beam.


subject: Re: Gen I: Maxing out PokÃ©dollars (money)
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: The G-Meister
icon: xx
body:
  [quote author=FSX link=topic=7350.msg199022#msg199022 date=1441928855]So you&#039;re never going to get more than Â¥999,999 by selling items in the store.[/quote]<br /><br />That&#039;s what I&#039;d seen from experiments. Thinking about it though, 999,999 PokÃ©dollars is pretty close to 1,666,665, and is the closest we&#039;ve gotten so far.<br /><br />[quote author=Krys3000 link=topic=7350.msg199024#msg199024 date=1441961937]I recently used this to give me 6F6F6F PokÃ©dollars (the game considers this to be 696969). We can&#039;t go more so it&#039;s not &#039;maxing out&#039; but since it is easy to do and required quite nothing outside of Fly and Cut, it has a certain utility I think.[/quote]<br /><br />To be honest, any money manipulation is good. If it takes less work than getting a x255 stack of items to underflow some Nuggets, I think it&#039;s worth mentioning.<br /><br />And if we&#039;re going with that, I think I&#039;ll change the title.<br /><br />When you said &quot;the game considers this to be 696969&quot;, is that what the display value came up as? Maybe something activated the cap? With the underflow I managed to get glitchy symbols in my money, which acted like their respective values, and still counted down with glitchy symbols when buying things.<br /><br />I literally just had an amazing idea while writing this. It might be possible to get the first two digits set to 0 , then, using underflow, selecting the CANCEL button and tossing 1 item (seen as it acts like a TM55, not a cancel button). To the Gameboy!<br /><br />[Edit]: It works! GG, G, GG. So I had 58 PokÃ©dollars (been doing a lot of ditto-tricking and thus, blacking out a lot). EG, 000058. Did the dry underflow, and tossed 1 item from CANCEL... And it didn&#039;t work (theory is, the middle two bytes have to be filled before the front two register... Or I&#039;m being inept, most likely that). I then replaced the item underneath with a 0x stack of Nuggets, tossed 1, and went to the PokÃ©mart. Talked to the counter lady, and BAM! FF58FF, or 1500000+150000+5000+800+150+15, which equals 1,655,965 PokÃ©dollars.<br /><br />Now I&#039;m a nerd, so I&#039;d like to go 1 digit further... and by that I mean obtaining a x255 stack of TM55, and I&#039;m not exactly sure how to do that. By swapping an item with one that is relative to your X-coordinate in the underflow, and walking left (when I&#039;m using Masterballs) two steps makes the game think you&#039;ve gone off the edge of the map, and instead you get Calcium, which is rather annoying :/<br /><br />At the moment, using a x255 stack of TM54 and tossing one item from CANCEL we can get up to FFFEFF, which is very close, but I&#039;d like it on the dot. We&#039;re nearly there :P<br /><br />I&#039;ll do a cleanup of the first post, and get all the relevant information in there... after I&#039;ve done some experimenting with how the game handles your glitchy money (like trying to buy something for 1000 PokÃ©dollars when you only have 000FFF, so you technically have enough, although the game might look for a 001000).<br /><br />Wait... can we afford a bike now?


subject: Re: Gen I: How to get a decent amount of PokÃ©dollars (money)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote]To be honest, any money manipulation is good. If it takes less work than getting a x255 stack of items to underflow some Nuggets, I think it&#039;s worth mentioning.<br /><br />And if we&#039;re going with that, I think I&#039;ll change the title.<br /><br />When you said &quot;the game considers this to be 696969&quot;, is that what the display value came up as? Maybe something activated the cap? With the underflow I managed to get glitchy symbols in my money, which acted like their respective values, and still counted down with glitchy symbols when buying things.<br />[/quote]<br /><br />It&#039;s way easier because you don&#039;t need any stack and you don&#039;t need to encounter MissingNo. But I won&#039;t say it&#039;s quick, because, of the many manipulations you could do using Glitch City RAM map, the better one for this application requires you to start with 343434 PokÃ©dollars. Then, if you have seen [url=https://www.youtube.com/watch?v=kUie0JMqYGM]this video[/url], you know most of the glitch :<br />1- Trigger Walk through walls (safari zone + poisoned PokÃ©mon)<br />2- Go here and walk 50 steps left, 116 steps up<br />[img]http://www.prama-initiative.com/RBJ/rammap.png[/img]<br />It brings you to the coordinates (6D,01)(38,00), matching with the money bytes.<br />3- Cut the three trees and you now have 6F6F6F pokÃ©dollars.<br /><br />What I meant by &quot;the game considers this to be 696969&quot; is that indeed, I had 6[glitch]6[glitch]6[glitch] pokÃ©dollars, but then when I bought something costing 1200 pokÃ©dollars, I only had 695789 pokÃ©dollars left, just as if I had 696969.<br />If this is really something unique to Glitch City RAM manipulation, it would be interesting to know why.


subject: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  [b]A WAY TO EXECUTE CODE USING THIS, REQUIRING NO MISSINGNO. AT ALL, HAS BEEN FOUND. SEE BEYOND THIS FIRST POST. I WILL THOUGH KEEP IT UPDATED[/b]<br /><br />Hey guys. This is something I started following [url=http://forums.glitchcity.info/index.php/topic,7347.0.html]my previous thread[/url] in which I discuss and show an example of using Glitch City regions matching with RAM data to perform the Cooltrainer Trick (based on TheZZAZZGlitch&#039;s previous discovery of a region matching with the items).<br /><br />I decided to explore a little more of this and to &quot;map&quot; this specific Out-of-Bounds Glitch City by matching it with RAM data. The results are, I think, worth the try.<br /><br />More importantly, I decided to work on an English version, since RAM addresses are +5 in other European versions like the french one I normally use<br /><br />[b]What is this about?[/b]<br /><br />You can view most, if not all, the values of the game&#039;s RAM addresses by going to a specific glitch city, in form of 4x4 tile blocks. By doing this, you are literally WALKING on RAM. Basically, having the item whose hex ID is 3C in first position will make the tile block matching with the first item in this glitch city to appear as the tile block whose hex ID is 3C.<br /><br />This is a tileblockdex for which you must note that some characters are different in english versions so it might lead to differences in some blocks :<br />http://prama-initiative.com/RBJ/CTRAM1.png<br /><br />It first was [url=http://forums.glitchcity.info/index.php?action=profile;u=1400]ISSOtm[/url] from our website PRAMA Initiative who developped a way to use the blocks generated by stored items to perform an item-custom cooltrainer as shown in the other thread. <br /><br />Here I will explain how to visualise a lot more RAM data, so you can perform the Cooltrainer with, but also how to change the values directly through glitch city for other useful or entertaining purposes.<br /><br />[b]How to access to this Glitch City?[/b]<br /><br />Using a glitch to walk through walls (e.g. [url=http://glitchcity.info/wiki/index.php/Walk_through_walls_trick_(ledge_method)]the ledge method[/url] which is easy and doesn&#039;t require anything), you can access this OoB Glitch City by walking, starting from here (south of Fuschia City):<br />[img]http://prama-initiative.com/RBJ/rammap.png[/img]<br />And walking 104 steps left then 95 steps up. This is an example entry point I use on my grid below:<br /><br />[b]Matching RAM with blocks[/b]<br /><br />[img]http://prama-initiative.com/RBJ/ram-grid.png[/img]<br /><br />If you followed the steps above, you will be as indicated on a block matching with RAM address $D524. The GC is organized in rows of 56 blocks matching with 56 addresses, then you go back to block 1 of the following row for the following address. In this grid, I voluntarly skip the first three and last three addresses of each row. <br />You can visualize them but I don&#039;t recommand it, because their behaviour is random; they will turn into something else when you hit start (e.g. water, even though the value of this address does not match with water blocks). This makes them unusable for the Cooltrainer Trick, and also, you will not be able to manipulate their value anyway.<br /><br />Here, I indicate which block match with which address using informations from datacrystal. As you can see, you can visualise the data from some PokÃ©mon (stats, moves, names etc.), money, items, PokÃ©dex, rival&#039;s name and much more. The big white space between player&#039;s ID and stored items is audio and tileset data. I don&#039;t know much on how to use them so I will not talk about this.<br /><br />I personnally never went further the 5th PokÃ©mon data but I assume you can continue to go up to find new data, such as you can go down and reach event flags or stored PokÃ©mon.<br /><br />If you intend to perform the cooltrainer trick, since you will need a block containing a tree below the block with the good tile for the PokÃ©mon you want, the best thing is to use PokÃ©mon data (since you can change stats) or stored items (using, for example, item 1 and 29 as I did in the video of the other thread). Of course, you can use &quot;bag&quot; items, and generate a tree from Badges data - this is what we did first at PRAMA before ISSOtm finds the stored items region.<br /><br />[b]Manipulating the data[/b]<br /><br />Now what is really awesome here is that we can manipulate this data. This is very limited and certainly is not an in-game memory viewer. But you will be able to get 8F and ws||&#039;lm|| with this, allowing you to execute code [b]without MissingNo. or any form of corruption[/b]. <br /><br />The only way for the player to change a tile block from one to another is this tile block having grass or a cuttable tree and cut it. There are 7 tiles block you can Cut (hex values 0B, 32, 33, 34, 35, 60, D5). This means if a value on ANY address you can reach is one of those, you can manipulate it.<br /><br />- 0B is a grass block. Once cut, it will turn into block 0A. This lowers a value by 1, meaning if you wanted to have a special stat of 10 but unfortunately got 11, you can fix that.<br />- 32 is a block containing a cuttable tree in the upper right corner. Once cut, it becomes block 6D. This is a good way, for example, to turn a stat of 50 to 109.<br />- 33 has a cuttable tree in the down-right tile. Once cut, it becomes 6C.<br />- 34 has one in the upper-left corner and turns to 6F. This is the highest available value by GC RAM Manipulation.<br />- 35 has one in the upper-right corner too, and turns to 4C.<br />- 60 has one in the down-left corner and turns to 6E.<br />- 5D is a glitched block. Cutting the tree won&#039;t change anything to the tile, who will still have a tree and a hex value of 5D. <br /><br />Outside from obvious uses of getting more money, more casino chips, or better stats for your PokÃ©mon easily, this is also important because of hex value matching with items, moves and PokÃ©mon.<br /><br />Here is another excel table:<br />[img]http://prama-initiative.com/RBJ/ram-corres.png[/img]<br /><br />As you can see this is useless for player&#039;s name manipulation. So bad. About PokÃ©mon, probably the only useful thing here is to change Lickitung for Exeggutor... and if you have the good MissingNo. I guess it&#039;s an easy way to get Poliwrath.<br />Then you can learn Solar Beam to any fire-type PokÃ©mon which previously know Flamethrower. Considering this is a powerful attack you could use on a ground or rock-type foe.<br /><br />But it becomes even more fun when you deal with items (besides having a whole lot of moon stones) as you can use this to get glitch items without the need for ACE or expanded item pack! Probably glitch items 6D and 6E are not realistic because you can&#039;t have the prototype PP Plus or 11F (floor) item in game. <br /><br />Item 6C reads $3DED (ROM data) so it&#039;s probably useless, however using Item 6F execute code from $CDD1 which is inside a tile buffer ; this address particularly is a tile from the Start menu when it is open. The code here jumps to $9C60 which is a screen tile. I don&#039;t know is this can lead a code execution but I&#039;ll check that some day. It&#039;s not the most important part of this glitch.<br /><br />[b]Trigger a PC overflow and taking advantage of it[/b]<br /><br />Now this is the most recent and maybe the major breakthrough here. You can have a maximum of 50 items inside the PC. 50 is hex:32, so it&#039;s a cuttable tile! If you cut the tree in it, it will turn into 6D... which is 109 stored items. You just activated an overflow.<br /><br />[u]Use the PC overflow to trigger an inventory underflow (and execute code)[/u]<br /><br />The most complete form of using this is also very easy. You will have a lot of items x0 in this overflow. Just toss 1 item of one stack and withdraw the remaining x255. You don&#039;t need anything else to perform a regular dry underflow and get an expanded item pack.<br /><br />Now you can use this to manipulate bytes and also get 8F / ws*lâ€™||lm||. [url=http://forums.glitchcity.info/index.php/topic,6638.0.html]Click here to read more[/url] about 8F Code Execution.<br /><br />[u]Use the PC overflow to directly get glitch items such as ws*lâ€™||lm||[/u]<br /><br />If you play Yellow, you might wanna do this trick with 63 casino chips. Doing so, once the PC is at 109 items, your 52nd item will be ws*lâ€™||lm||, which is the item you need to execute code. You don&#039;t even need to underflow your item menu anymore.<br /><br />I&#039;m working on a R/B adaptation of this but you can&#039;t have 5E (hex for the item 8F used in R/B code execution) chips. Maybe some addresses after can be used but they are indicated as &quot;Missable Object Flags&quot; and I don&#039;t know what that means.<br /><br />Anyway, using the chips, you can get pretty much any item or glitch item whose hex value contains no letters. This includes a lot of &quot;xF&quot; and &quot;x||lm||&quot; items but I still need to watch if they are documented. Also Surfboard, Master Ball, etc. are easy to get.<br /><br />[u]Use the PC overflow to directly get the 8F item (or others items you could not get with the casino chips trick[/u]<br /><br />From item 55 onwards, items match with the fact that you did or did not picked visible items on Routes (see posts below) with one address/item matching with the current status of 8 items (one per bit). Therefore, there is a way to use this to get some items, including the 8F item (hex:5D) for code execution.<br /><br />if you have picked :<br />- Hp Up on Route 2<br />- TM04 on Route 4<br />- TM30 on Route 9<br />- TM16 on Route 12<br /><br />But haven&#039;t picked :<br />- Moon Stone on Route 2<br />- Iron on Route 12<br /><br />And the Snorlax in Route 12 is still sleeping, then 8F will appear as the 56th item in the PC.<br /><br />[b]Delete an item[/b]<br /><br />Well this is a more a side trick but it can be useful if, for some reason, you wanna get rid of a rare, untossable item, or a glitch item. Then, just have 11 items (PC or held) with the last being this item. Then go to the number of items spot in Glitch City (the one according whether you chose to do that in the stored items or not) and cut the grass. The item will be deleted as the number of items drops to 10.<br /><br />Sorry for the long post, I think it comes to an end now (for now). Next step is the dex. Don&#039;t hesitate to tell me what you think about all this!


subject: Re: Glitch City RAM Manipulation
poster_name: Xiphiidae
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Very interesting post! <br />Just one error to point out though; in your last table, you have the PokÃ©mon listed for hex value 6E as Ditto, when it should be Poliwhirl. 


subject: Re: Gen I: How to get a decent amount of PokÃ©dollars (money)
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7350.msg199026#msg199026 date=1442049456]<br />What I meant by &quot;the game considers this to be 696969&quot; is that indeed, I had 6[glitch]6[glitch]6[glitch] pokÃ©dollars, but then when I bought something costing 1200 pokÃ©dollars, I only had 695789 pokÃ©dollars left, just as if I had 696969.<br />If this is really something unique to Glitch City RAM manipulation, it would be interesting to know why.<br />[/quote]<br /><br />Amount of money is stored in binary-coded decimal, if I remember correctly. That&#039;s why.


subject: Re: Gen I: How to get a decent amount of PokÃ©dollars (money)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Yeah, that was my guess. But then, if I understood well, The G-Meister says he can get ACTUAL A, B, C, D, E or F amount of money using other techniques. Meaning that, if he has F00, spending 200 will give him D00 and not 700, as it happens using GC-RAM Manipulation.<br /><br />That&#039;s what I don&#039;t get why&nbsp; :???:


subject: Re: Glitch City RAM Manipulation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Guys, I&#039;m a complete newbie on this but thanks to ISSOtm who assisted me, it seems glitch item 6F executes code from CDD1.<br /><br />CDD1 is indicated as part of &quot;second buffer for temporarily saving and restoring current screen&#039;s tiles (e.g. if menus are drawn on top)&quot; on pokÃ©red. Apparently it points to the tile just before the PokÃ©mon option in the start menu. ISSO says when you use the item, it executes some code then jumps to 9C60 which is a screen tile we could use.<br /><br />Do you think we can execute code from here? Or just give ourselves 8F (the item) so we could do 8F ACE without the need for any MissingNo. ? That would be a major breakthrough.<br /><br />Then, glitch item 6C reads from 3DED but I don&#039;t know if this is useful.


subject: Re: Gen I: How to get a decent amount of PokÃ©dollars (money)
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7350.msg199031#msg199031 date=1442226341]<br />[quote author=Krys3000 link=topic=7350.msg199026#msg199026 date=1442049456]<br />What I meant by &quot;the game considers this to be 696969&quot; is that indeed, I had 6[glitch]6[glitch]6[glitch] pokÃ©dollars, but then when I bought something costing 1200 pokÃ©dollars, I only had 695789 pokÃ©dollars left, just as if I had 696969.<br />If this is really something unique to Glitch City RAM manipulation, it would be interesting to know why.<br />[/quote]<br /><br />Amount of money is stored in binary-coded decimal, if I remember correctly. That&#039;s why.<br />[/quote]<br />Yep, it is.<br />But the display doesn&#039;t read it as BCD.<br /><br />Also, each number seems to be capped in the code, but I can&#039;t remember where I saw this in the code...


subject: Re: Gen I: How to get a decent amount of PokÃ©dollars (money)
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: The G-Meister
icon: clip
body:
  [quote author=Krys3000 link=topic=7350.msg199032#msg199032 date=1442227635]<br />Yeah, that was my guess. But then, if I understood well, The G-Meister says he can get ACTUAL A, B, C, D, E or F amount of money using other techniques. Meaning that, if he has F00, spending 200 will give him D00 and not 700, as it happens using GC-RAM Manipulation.<br /><br />That&#039;s what I don&#039;t get why&nbsp; :???:<br />[/quote]<br /><br />I most surely can. Two things though: 1. I&#039;m playing on Yellow, and 2. I was buying things in the Celadon department store. Either of those might have something to do with it. If you gimme a mo, I&#039;ll get a couple pictures on my camera<br /><br />[Edit]: If the pictures below are a little hard to understand, I&#039;m about to buy x10 TM32, equivalent of 10,000 PokÃ©dollars, which will decrease the 2nd digit by 1. The second one shows the result: a symbol change. If you look at the MONEY box in the top right of the screen, you&#039;ll see that the second character changes from 1 glitchy symbol to another (if you really want the specifics, for the first floor of the Celadon Department store, in the first shot it&#039;s a blue line, a black line, another blue line, another black line, 3 more blue lines, and a black line to finish off. The second time, after I&#039;ve bought the TMs, it&#039;s a white line, a blue line, a green line, and the rest are blue lines.)<br /><br />[Edit 2]: Is this what&#039;s supposed to happen?


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Found a small, miscellaneous quirk the other day. I assume it&#039;s been found before, and it&#039;s so small and unimportant it&#039;s not even worth searching for anywhere.<br /><br />I was playing on Yellow, and it seems if the player walks directly down onto a doormat and immediately holds another directional button as soon as they start walking (as if to avoid walking out of the door), they still walk out the door.


subject: Re: Zowayix's Procrastinated Anime Reviews
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=voltage link=topic=7041.msg196769#msg196769 date=1414358351]<br />I like reading these reviews even if I hadn&#039;t seen any particular anime you&#039;ve reviewed yet.<br />[/quote]<br /><br />Same here, it even reminded me to look up some of the anime I haven&#039;t watched yet. I think he should write more of these :P 


subject: Re: Glitch City RAM Manipulation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Oh my God, I think I just discovered a way to arbitrary code execution using this.<br /><br />If you have 50 stored items in your PC, which is the maximum, the tile block matching with the number of stored item (first dark red block on the image above) is 32. If you cut it, it will turn into 6D... which is 109 stored items. You just activated an overflow.<br /><br />Now the only thing you have to do is to go to a PC and take any x255 item (toss one item of the numerous x0 items then take it) and perform the &quot;dry&quot; item underflow in the item menu to get 8F.<br /><br />You can also toss 255 of the 100th item just like [url=http://glitchcity.info/wiki/index.php/Trainer_escape_glitch]explained here[/url] and perform the no-trainer ditto trick to get MissingNo. so it will allow you to make a new stack of 255. But this is time lost :D<br /><br />Finally, finally, we have a method ANYONE can do, in Red Blue AND Yellow, without the need for MissingNo. Without the need for a trainer, for a specific name, for a working cooltrainer corruption or super glitch. You just need fly and cut and the world is yours.<br /><br />I am so happy.


subject: Re: Glitch City RAM Manipulation
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Oh wow, that&#039;s nice!<br />Only 1 thing, how, if at all, is it possible to get the PC back to normal? And if we can&#039;t, how do items behave when deposited?


subject: Re: Glitch City RAM Manipulation
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  To fix an underflow, whether it is on the PC or the item menu, you normally need to buy new items until it becomes impossible to go beyond the CANCEL button. However here, we have a non-complete overflow and this won&#039;t work.<br /><br />But this is not a problem even if you can&#039;t fix the PC this way, since you can do arbitrary code execution to set back the number of items into an acceptable value.<br /><br />I&#039;m adding two interesting thing :<br /><br />[b]Directly get &quot;ws l&#039;m&quot; and other items/glitch items without underflowing[/b]<br /><br />If you play Yellow, you might wanna do this trick with 63 casino chips. Doing so, once the PC is at 109 items, your 52nd item will be ws l&#039;m, which is the item you need to execute code. You don&#039;t even need to underflow your item menu anymore.<br /><br />I&#039;m working on a R/B adaptation of this but you can&#039;t have 5E (hex for the item 8F used in R/B code execution) chips. Mayne some addresses after can be used but they are indicated as &quot;Missable Object Flags&quot; and I don&#039;t know what that means.<br /><br />Anyway, using the chips, you can get pretty much any item or glitch item whose hex value contains no letters. This includes a lot of &quot;xF&quot; and &quot;x||lm||&quot; items but I still need to watch if they are documented. Also Surfboard, Master Ball, etc. are easy to get.<br /><br />[b]Delete an item[/b]<br /><br />Well this is a more a side trick but it can be useful if, for some reason, you wanna get rid of a rare, untossable item, or a glitch item. Then, just have 11 items (PC or held) with the last being this item. Then go to the number of items spot in Glitch City (the one according whether you chose to do that in the stored items or not) and cut the grass. The item will be deleted as the number of items drops to 10.<br /><br />


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello everyone,<br /><br />If you guys haven&#039;t seen it yet, I document [url=http://forums.glitchcity.info/index.php/topic,7353.0.html]in this thread[/url] a new method to trigger an underflow which does not require you to encounter MissingNo. It&#039;s called &quot;partial PC underflow&quot; and is inspired by a work TheZZAZZGlitch did a few monthes ago.<br /><br />I don&#039;t know if we can say that it&#039;s an easier way, but it&#039;s very useful if you can&#039;t do the old man trick (e.g. playing in yellow), the ditto trick (e.g. no available trainer) and the cooltrainer trick (corruption not working). <br /><br />Also this method allows you to get many glitch items, including ws&#039;||lm||, without triggering the underflow so this is even quicker :)<br /><br />It might be worth mentionning in the first post, it&#039;s up to you.


subject: Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thought it might be that simple... although is it? That&#039;s a lot of items to buy... 146? And won&#039;t they have to be different to the ones you already have?... which means you&#039;ll need quite a bit of cash to buy them all, if that many are even obtainable. I&#039;m not sure exactly what goes on, but perhaps removing items might be easier?<br /><br />And if it&#039;s hard to get exactly the right amount of casino chips for &quot;8F&quot;, if you can swap an item into the casino chips bytes (or simply get the right amount of chips) such that it yields one of the tiles with grass or trees in, then you can go and cut the grass/tree to give you more than 5E chips, then you can simply spend some to get the right amount... unless it happens to work the same way the money did with the capping :/


subject: Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Yes, that is the problem. If you appear to have 6D chips (appearing as 6[tile]), the game behaves as 67 chips. If you spend 3, you will have 64 left. It will be impossible, then, to naturally go to an amount of 5D.<br /><br />Other available bytes are Active box second byte (which I don&#039;t really understand how it works), address $D5A3 which is mentionned in the disassembly as &quot;unused&quot; although it happened that its value changed in my games.<br /><br />Then we move on those Missable Objects Flags which are probably our best shot. I don&#039;t however understand what they are.<br /><br />About the overflow fix, you are probably right. One more realistic solution is, once you have 8F/ws*l&#039;||lm|, to prepare this before using it with the proper PokÃ©mon setup:<br /><br />Any item<br />8F / ws*lâ€™||lm||<br />Limonade x50<br />TM34 x213<br />Dire Hit x201<br /><br />In english games, and<br /><br />Any item<br />8F / ws*lâ€™||lm||<br />Limonade x50<br />TM34 x213<br />S.S. Ticket x201<br /><br />in any other european game.<br /><br />This is an example code to set back the total items in storage to 50 but you can also delete some items by modulating the number of Limonades. All those items at such quantities can be obtained with the underflow.


subject: Re: Core game music in spin-offs
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  Although not directly related, the themes of the PokÃ©mon Leagues in Kanto and Unova are rearranged from MOTHER&#039;s Mt. Itoi theme.<br /><br />Video: [url=https://www.youtube.com/watch?v=Z61YTqitYRc]https://www.youtube.com/watch?v=Z61YTqitYRc[/url]


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;ve been trying to do a bit of this myself recently, learning up on Gameboy code and the like, and I tried to write a script and (as assumed) it failed massively.<br /><br />It seems to freeze (not crash, meaning I think I&#039;ve got the right PokÃ©mon in my box (and yes, I&#039;m using ws m)) whenever I use the item, so I thought it might not be terminated correctly.<br /><br />I was using the PokÃ©mon arrangement as stated on the GCL page, and started the code at my 3rd item.<br /><br />So, if I&#039;m correct, is there any way I can make a blank script which simply terminates the moment it gets to my item pack? As in, what item should I put as my third to end the script?


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  What you are searching for is a ret intruction. Your third item needs to be CT01 (any quantity) if you want to make this blank script.<br /><br />Depending on the instructions on your code, you always have to finish your items with CT01 or an item in quantity 201 to terminate the code.<br /><br />If you could speak french, I could advise you [url=http://prama-initiative.com/8F]ISSOtm&#039;s GBZ80 to items compilator[/url] which makes things easier, but I don&#039;t think he plans an english version for now&nbsp; :P


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ahhh looking at the big list this makes sense now. [url=http://gskartwii.arkku.net/optohex]This converter[/url] that someone posted doesn&#039;t seem to use the right items. I&#039;ll do my own work instead of being lazy this time! Thanks!


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: The G-Meister
icon: xx
body:
  Wait, so if I have my item pack set as follows:<br /><br />Bicycle<br />ws m<br />TM01&nbsp; x01<br /><br />It should just do nothing right? The menu should close and I can continue on my merry way? Because if so, I&#039;m still getting the freeze. I&#039;m sure I&#039;ve got the PokÃ©mon box set up correctly :/<br /><br />[Edit]: Nevermind! My ineptitude strikes again, the Seel has to have 233 HP not 255<br /><br />[Edit 2]: Aaaand I&#039;m still getting the freeze &gt;.&lt;


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello again,<br /><br />Hmm I don&#039;t use that setup because I&#039;m playing a french version. I need to check where the problem is. It&#039;s late here now, so give me some time and I&#039;ll work on this tomorrow :)


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Now that I think about it, The G-Meister, I&#039;m actually using this setup:<br /><br />http://forums.glitchcity.info/index.php/topic,6638.msg194861.html#msg194861<br /><br />with the slight modification that in european non-english games, you have to replace Growlithe with Kadabra.<br /><br />So I can guarantee you that if you have this in your active box, it will jump to the third item. Then if you have a working code here, things should be OK&nbsp; :D


subject: Re: Gen I: How to get a decent amount of PokÃ©dollars (money)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello,<br /><br />I can see that, but I just tried to artifically give myself the same amount of money you have in picture 1 (meaning I changed the values to FF31FF in Memory Viewer). When I buy it, money drops to 0.<br /><br />If I use some other values with letters inside, it&#039;s always considered as numbers (F = 9, E = 8, etc.) when I buy something, and I never had a tile change like you had.<br /><br />Maybe that&#039;s something related to the underflow only... I have no idea. I&#039;ll check.


subject: Re: Core game music in spin-offs
poster_name: Zowayix
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7348.msg199045#msg199045 date=1442413206]<br />Although not directly related, the themes of the PokÃ©mon Leagues in Kanto and Unova are rearranged from MOTHER&#039;s Mt. Itoi theme.<br /><br />[youtube]https://www.youtube.com/watch?v=Z61YTqitYRc[/youtube]<br />[/quote]<br /><br />I think that one&#039;s a bit of a stretch. The harmony is similar but not identical and the main melody is completely different.


subject: Re: Core game music in spin-offs
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=7348.msg199063#msg199063 date=1442492440]<br />I think that one&#039;s a bit of a stretch. The harmony is similar but not identical and the main melody is completely different.<br />[/quote]<br /><br />Well, it is rather common for people to note that Indigo Plateau&#039;s theme originates in Mt. Itoi&#039;s and I can see why (there are some similarities and the same company is involved). The video at least serves as a side-by-side comparison of the themes and puts rest to any doubts.


subject: Re: Gen I: How to get a decent amount of PokÃ©dollars (money)
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: The G-Meister
icon: xx
body:
  Well it&#039;s either the underflow has supernatural capabilities, or something&#039;s different between versions (assuming you were trying on the French, or Red/Blue... or both)<br /><br />[Edit]: Seen as x255 stack like to duplicate themselves when something above them is tossed, if we can get the CANCEL to become x255, then simply remove the item above it... We would get the TM55 x255 as the CANCEL, and another TM55 x255 underneath...? So it might be as simple as doing the underflow, and tossing your first item? There&#039;s gotta be a catch, it can&#039;t be [i]that[/i] simple :/<br /><br />[Edit 2]: Dang, don&#039;t think it is. I&#039;ll mess around some more tomorrow


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ah thanks, I&#039;ll go try that one.<br /><br />So incase I&#039;m not alone, can anyone else try the PokÃ©mon box setup for ws m on the [url=http://glitchcity.info/wiki/index.php/Arbitrary_code_execution#Using_.22ws_m.22_.28Yellow.29]GCL page[/url]? Seen as I&#039;m on console, I&#039;ve got no emulator issues, and just to make sure I&#039;m not being dumb (again), but I think it might not work :/


subject: Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Here is the video about this glitch to make all this a little more visual&nbsp; ;)<br /><br />[youtube]https://www.youtube.com/watch?v=fH-W5hfpkFQ[/youtube]<br /><br />As always I wrote too much in French so this is the english description:<br /><br />[EN:] This video was made by Krys3000 of the PRAMA Initiative.<br /><br />It shows how to trigger the Item Underflow Glitch and, therefore, 8F Arbitrary Code Execution (meaning also the trainerless Ditto Trick) without the need for MissingNo.&#039;s item duplication.<br /><br />This very recent discovery within the team changes everything because it is now possible to everyone, including those who can&#039;t use the Old Man Trick (bad name or yellow), defeated all trainers, and for whom the cooltrainer corruption does not work, to execute code!<br /><br />Torchickens&#039; video about &quot;dry&quot; item underflow : <br />[code]https://www.youtube.com/watch?v=ZyppANEvnh8[/code]<br /><br />http://glitchcity.info/wiki/index.php/Arbitrary_code_execution<br /><br />The glitch is based on PRAMA team member ISSOtm&#039;s discovery of a glitch city region generated from stored items. We first used that to create custom cooltrainers. <br /><br />https://www.youtube.com/watch?v=kUie0JMqYGM<br /><br />For more informations about custom cooltrainers using RAM and possible RAM Manipulations through Glitch City, please refer to this : http://forums.glitchcity.info/index.php/topic,7353.0.html<br /><br />In this precise application, when you have 50 different stored items in the PC (which is 32 in hexadecimal) the 4x4 tile bloc matching with memory address $D53A ($D539 in yellow) (stored items number) contains a cuttable tree. Once cut, the block changes into the hex:6D tile block (dec:109) which makes the number of stored items to become 109. Manipulating the 59 extra items allows RAM manipulation, allowing you to :<br />- Generate trainerless ditto trick on several routes by changing the quantities of items starting from the 95th.<br />- Get many items and glitch items as 54th item, by changing the quantities of casino chips (every item with a hex ID of x0 to x9 with x being not more than 9 can be obtained); this allows to get ws*lâ€™||lm|| without underflow.<br />- Get a stack of 255 items to generate a classical &quot;dry&quot; underflow in the item menu.<br /><br />[b]UPDATE[/b] : It is also possible to get items like the 8F item (which allows code execution in R/B) directly in the PC if you haven&#039;t picked up some items on Routes. Scroll down to the post below for an explanation.<br /><br />Step-by-step:<br /><br />1/ Have a PokÃ©mon with Fly and one with Cut.<br />2/ Store 50 different items in your PC, and only useless items in your &quot;bag&quot;.<br />Recommended: Don&#039;t have more than 99 casino chips.<br />Recommended if you want to get 8F or ws*lâ€™||lm|| with the underflow: have a X Special in your bag.<br />If you play Yellow and want to get ws*lâ€™||lm|| without underflow: Have 63 casino chips.<br />3/ Perform the Noclip Trick:<br />3.1/ All your PokÃ©mon must be fainted but one, which must be poisoned. Go to Fuchsia City inside the PokÃ©mon Center, then go out and enter Safari Zone.<br />3.2/ Exit immediately, answer NO to get back inside the Zone, and walk a few steps.<br />3.3/ Note your remaining steps, save and reset. Exit the Zone counting your steps. You must jump a ledge with your 500th step including those made before the reset and those to exit the Safari Zone. You will be called back in the Hall with the ability to walk above walls. The poisoned PokÃ©mon must not faint during this step, so heal it when needed.<br />3.4/ Allow your poisoned PokÃ©mon to faint by walking inside the hall without exiting the map. You will be back in Fuchsia&#039;s PokÃ©mon Center with the glitch active.<br />4/ Place yourself above the wall in the intersection with Sea Route 19 (as in the video). Do 60 steps left and 95 steps up to reach the Glitch City region generated from stored items. In Yellow games, you have to do 62 steps left instead of 60. In European non-english games, you have to do 50 (R/B) / 52 (Yellow) steps left instead of 60, which is what I do in the french version in the video. Then, cut the cuttable tree.<br />5/ Fly anywhere and access the stored items to go below the 50th.<br />To get ws*lâ€™||lm|| without underflow: withdraw ws*lâ€™||lm|| (54th item)<br />To generate an underflow in the item menu, toss one of any item with a quantity of 0 and withdraw the remaining 255 (if you have less than 100 coin chips, the 53th item is x0)<br /><br />Code Execution through underflow:<br /><br />1/ Place the x255 item as third and toss the first two.<br />2/ Toss 255 of this item until you can only select two items (the second one being in fact CANCEL).<br />3/ Toss 253 of the first item.<br />4/ Switch twice item 1 and 2. The underflow is active.<br />5/ Go to the eastern entrance of Celadon, as shown in video. Switch the X Special with the Nugget x1 in 35th position.<br />6/ Do 5 steps left, 5 steps down, 20 (R/B) or 26 (Yellow) steps right and open the item menu to find 8F / ws*lâ€™||lm||. Switch it back with the Nugget.<br />7/ Fly to any town, store the item in the PC, buy a new item and withdraw the 8F / ws*lâ€™||lm|| item (which was in position 110.)<br />8/ Prepare a proper PokÃ©mon setup for code execution as explained in the link above.<br /><br />Special thanks in the video at the end. Also a little bonus with a game :)<br /><br />It&#039;s in french, but you can, if you want, use our compilator to generate easily 8F codes. It was made by ISSOtm<br />http://www.prama-initiative.com/8F/


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Dang! So I got the code working finally, and even though IssoTM&#039;s coder is French, you only need to be able to 1. understand the code itself, and 2. know translations of the items (a lot of which are similar to the English as well).<br /><br />It seems that even if we modify the &quot;Bike speed&quot; byte, we [i]STILL[/i] can&#039;t cycle indoors... It seems Ash abides by the rules even when he&#039;s not told to &gt;.&lt;<br /><br />Aside from that, you can use this code to get onto/off of a bicycle without changing the music, so if you feel like you&#039;re getting bored of the bike music, you can just use the first code to get on your bike and keep the music of the area you&#039;re in! I&#039;m sure there&#039;s much better ways of changing the soundtrack if you&#039;re that preoccupied about it though. The amusing side effect is, when you go into a different area, the music has an abrupt key change as it fades out... but that&#039;s about it ;-;<br /><br />Incase anyone feels like compacting this worthless dump, don&#039;t bother, seen as it&#039;s completely useless... as of yet, anyway.<br /><br />Anyway, code:<br /><br />[b]Get OFF your bike, without music change (ws m)[/b]<br /><br />[code]<br />ld a, $02<br />ld ($D6FF), a<br />ret<br />[/code]<br /><br />3E 02 EA FF D6 C9<br /><br />Lemonade x2 (technically this can be anything that isn&#039;t 1)<br />TM34 x255<br />TM14 x201<br /><br />[b]Get ON your bike, without music change (ws m)[/b]<br /><br />[code]<br />ld a, $01<br />ld ($D6FF), a<br />ret<br />[/code]<br /><br />3E 01 EA FF D6 C9<br /><br />Lemonade x1<br />TM34 x255<br />TM14 x201


subject: Re: G/S/C glitch discussion
poster_name: Crystalame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystalame
icon: xx
body:
  This is a very minor glitch and perhaps not particularly useful either, but it makes me very curious.<br /><br />Bulbapedia claims that [url=http://bulbapedia.bulbagarden.net/wiki/List_of_glitches_in_Generation_II#Catch_rate_errors]the Love Ball has an 8x catch rate on Pokemon of the same species, [i]but also the same gender[/i][/url] as the Pokemon you currently have sent out in battle. This begs the question: Does this boost [i]also[/i] apply to genderless Pokemon? So if I, for example, were to battle an Unown with an Unown of my own, would the Love Ball grant me an 8x multiplier, or is it exclusively male or female Pokemon?<br /><br />A more fun (and useful) example would be something like Ho-Oh vs. Ho-Oh, but things like Magnemite and Unown are easier to get :p<br /><br />I assume that genderless Pokemon are, uh... treated as if the gender mechanic doesn&#039;t exist at all [size=8pt](well... duh, but I suppose you never know in the older games)[/size], but I thought I&#039;d ask anyway, because it seemed really interesting.


subject: Re: Arbitrary code execution in Red/Blue using the &quot;8F&quot; item
poster_name: ISSOtm
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=The G-Meister link=topic=6638.msg199070#msg199070 date=1442605854]<br />Dang! So I got the code working finally, and even though IssoTM&#039;s coder is French, you only need to be able to 1. understand the code itself, and 2. know translations of the items (a lot of which are similar to the English as well).[/quote]<br />Wow, finally a feedback ! (I thought nobody else than me used it :P)<br />Well, you just motivated me to release an English version. Okay, I&#039;ll get into it.<br />[me=ISSOtm]begins working...[/me]


subject: Re: G/S/C glitch discussion
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Crystalame link=topic=6594.msg199072#msg199072 date=1442664621]<br />This is a very minor glitch and perhaps not particularly useful either, but it makes me very curious.<br /><br />Bulbapedia claims that [url=http://bulbapedia.bulbagarden.net/wiki/List_of_glitches_in_Generation_II#Catch_rate_errors]the Love Ball has an 8x catch rate on Pokemon of the same species, [i]but also the same gender[/i][/url] as the Pokemon you currently have sent out in battle. This begs the question: Does this boost [i]also[/i] apply to genderless Pokemon? So if I, for example, were to battle an Unown with an Unown of my own, would the Love Ball grant me an 8x multiplier, or is it exclusively male or female Pokemon?<br /><br />A more fun (and useful) example would be something like Ho-Oh vs. Ho-Oh, but things like Magnemite and Unown are easier to get :p<br /><br />I assume that genderless Pokemon are, uh... treated as if the gender mechanic doesn&#039;t exist at all [size=8pt](well... duh, but I suppose you never know in the older games)[/size], but I thought I&#039;d ask anyway, because it seemed really interesting.<br />[/quote]<br />No, it doesnâ€™t apply to genderless PokÃ©mon.


subject: Re: G/S/C glitch discussion
poster_name: Crystalame
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Crystalame
icon: xx
body:
  Alright, I figured it most likely wouldn&#039;t, but I thought I&#039;d ask just for the sake of thoroughness. :) Thanks!


subject: Question About Colosseum/XD Glitches
poster_name: greentyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Not tried this myself yet as clearing out and restarting either game would take me a while, but I had an idea about a potential glitch.<br /><br />I&#039;ve searched online to see if anyone has tried this, but found nothing yet.<br /><br />I am reasonably certain that in Colosseum and XD the AI is programmed to switch if any of their Pokemon are under the effects of a move such as Yawn or Perish Song (this is certainly the case with higher-level trainers, such as those in the Orre Colosseum, and some in-game bosses such as Gorigan and Evice). My question is what would happen if the opponent switched out their Shadow Pokemon on the same turn you tried to catch it - would you potentially be able to capture another Pokemon on their team?<br /><br />I would assume there is some sort of mechanism to prevent this from ever happening, but, as I mentioned, I have not found any details of this anywhere else. If anyone&#039;s willing to try it or has already done so, feel like sating my curiosity? :)


subject: Re: Question About Colosseum/XD Glitches
poster_name: greentyphlosion
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I&#039;m not sure - Bulbapedia lists switching and using items as both being at +6 priority in Generation 3. I&#039;d imagine it would, though. That&#039;s disappointing.


subject: Re: Battle Tower Lati@s glitch
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  *Bump*<br /><br />A couple of months ago a user named [url=http://forums.glitchcity.info/index.php?action=profile;u=1485]SailorJupiter[/url] sent me a private message with some great news that the Latios glitch works on US Ruby!<br /><br />I unfortunately couldn&#039;t find the time to try it earlier on, but I decided to try it out today and got the glitch to work with both an English Ruby and English Sapphire ROM. I was able to capture a Battle Tower PokÃ©mon holding an item without it turning into a Bad Egg.<br /><br />https://www.youtube.com/watch?v=FjqMC_p024A<br /><br />Save files of beaten PokÃ©mon Ruby and Sapphire with roaming Latios and Latias available:<br /><br />Ruby: https://mega.nz/#!E51lEYAL!2gdB7jbUl-btN_bGto2DZwYJghCWG-pZpP_SPR-N2po<br />Sapphire: https://mega.nz/#!V8tkFIjD!8IwPTNdqMB86wn_-VZEZ-icQ9GusY2bCz70cSgmSVyQ<br /><br />Below are some of my questions. I will try to answer most of these tomorrow, unless someone else would like to answer some of the questions (I would be grateful).<br /><br />Edit: Answered questions<br /><br />1) The roaming Latios roaming TV flash if your character in Ruby is female always being there was apparently an accidental memory editing thing (not a glitch).<br />2) The glitch does not work on (English at least) Emerald<br />4) Defeating all the glitch Battle Tower Trainer&#039;s PokÃ©mon causes the battle to end with no victory text.<br /><br />Remaining questions:<br />3) How far can PokÃ©mon caught with the Lati@s glitch be transferred through the generations?<br />5) Can the glitch be performed in FireRed/LeafGreen with Trainer Hill Trainers or another Trainer and Raikou, Entei, Suicune?


subject: Re: Invalid PokÃ©mon in Gen 6
poster_name: Flameduck
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Flameduck
icon: xx
body:
  SUCCESS!<br /><br />ALPHA SAPPHIRE has managed to load after deleting the glitches in the party. Saves are recoverable through Tubehax!<br /><br />This is just really a great moment - I can play the game I thought I had lost forever. Whoo!


subject: Re: Battle Tower Lati@s glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  Oh, that&#039;s very nice!<br /><br />I hope this glitch is not fixed in french versions, I will test this asap and maybe try to answer some questions.


subject: Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Krys3000
icon: xx
body:
  It&#039;s me again and this time with [b]a way to get the item 8F for code execution without the item menu underflow[/b]!<br /><br />As suggested earlier this is a bit more complicated than having casino chips. Fact is, item above 50 are organized this way:<br /><br />- 51: [Cancel] x[Active box number byte 1]<br />- 52: [Active box number byte 2] x[Number of HOF teams]<br />- 53: [Apparently Unused] x[Casino Chips Byte 1] (this is why this item basically always is hex:00 x0 if you have less than 99 chips, allowing you to get an easy x0 item to underflow the item menu)<br />- 54: [Casino Chips Byte 2] x[first address of the Missable Object Flags section] (this item is used to get easily ws l&#039;m, with 63 casino chips)<br />- 55 onwards : Missable Objects Flags section, followed by the Game Progress Flags section which includes the Map Scripts (accepting only 0 and 1 as value) used for [url=http://glitchcity.info/wiki/index.php/Trainer_escape_glitch#Trainerless_method]trainerless ditto trick[/url].<br /><br />I did not know what Missable Objects Flags were about until Torchickens eventually found out that setting address $D5A9 (matching with item 56 in the &quot;PC overflow&quot;) to FF gets the visible items of Route 2 to appear again.<br /><br />So this is what it is about; this address controls the 8 first visible items you could get on Routes, each bit controlling one. I insist of &quot;visible&quot; because hidden items are not controlled by this address, and on &quot;Routes&quot; because visible items of Viridian Forest or Mt Moon, for example, will not affect its value neither. For some reason, when you start a new game the value begins at 1 and not at 0. For the remaining 7 bits, the items are :<br />- 1: default<br />- 2: Moon Stone (Route 2)<br />- 3: Hp Up (Route 2)<br />- 4: TM04 (Route 4)<br />- 5: TM30 (Route 9)<br />- 6: Snorlax (Route 12). Yep, it is considered as an item!<br />- 7: TM16 (Route 12)<br />- 8: Iron (Route 12)<br /><br />[b]Long story short: if you have picked the Hp Up, the TM04, 30 and 16, but haven&#039;t picked the Moon Stone, the Iron, and the Snorlax in Route 12 is still sleeping, then $D5A9 value is 5D (bin:01011101) and then 8F appears as the 56th item in the PC.[/b]<br /><br />This is only one method and since probably everyone awoke the Snorlax here, keep in mind there are surely many more using the other missable object flags addresses&nbsp; ;)


subject: Re: Unused Distortion World maps (Platinum)
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  Found a new unused map in Diamond, Pearl, and Platinum. It seems they planned a record mixing room like the one in Ruby, Sapphire, and Emerald.<br /><br />Video: [url=https://www.youtube.com/watch?v=fu2RpMOB1eE]https://www.youtube.com/watch?v=fu2RpMOB1eE[/url]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  Some of you may already know this but in the Japanese Diamond/Pearl v1.0, you can open the menu in a Mystery Zone, which means you&#039;re not limited to using a registered item like the Town Map to refresh the graphics.<br /><br />Video: [url=https://www.youtube.com/watch?v=3rGBFldj6gY]https://www.youtube.com/watch?v=3rGBFldj6gY[/url]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7198.msg199096#msg199096 date=1442873036]<br />Some of you may already know this but in the Japanese Diamond/Pearl v1.0, you can open the menu in a Mystery Zone, which means you&#039;re not limited to using a registered item like the Town Map to refresh the graphics.<br /><br />[youtube]https://www.youtube.com/watch?v=3rGBFldj6gY[/youtube]<br />[/quote]<br /><br />Yup, that&#039;s actually the reason the coordinates to Shaymin/Darkrai are WAAAAAY shorter on jp version: you can save on MZ and they also take you to real Sinnoh


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Um, so I was going through and catching a bunch of glitch PokÃ©mon on Yellow (using ACE to change the ID in battle, so I could catch the ones that normally pop up as trainers), and I saw that some of them counted as catching other PokÃ©mon, namely a Bulbasaur, a Snorlax and an Oddish.<br /><br />Has this been found before? And if it has, have all such PokÃ©mon been documented?<br /><br />If not, is this a viable speedrun technique?


subject: Re: Battle Tower Lati@s glitch
poster_name: Metarkrai
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Metarkrai
icon: xx
body:
  Well, after few more tests, I finally understand more clearly what happens with the Roamer Rematch.<br /><br />In RS (Jap, US, Fr) (and every EU version), opponent party slots 2 to 6 aren&#039;t cleared when a Roamer is encountered.<br />If one of these slots contains a Pokemon that is able to fight (not a Bad Egg, not KO), this Pokemon will be sent out in battle if the roamer is killed, like the game would do in a normal trainer fight.<br />This can only happen if your last battle before meeting the roamer was a trainer fight, and if you lost that trainer fight, (an opposing Pokemon in slot 2 to 6 must be alive when you lost the fight).<br /><br />If you make a wild encounter before meeting the roamer, the opponent party slots will be cleared and there won&#039;t be any opposing Pokemon in slots 2 to 6 anymore.<br /><br />Since sending another Pokemon was only supposed to happen in trainer matches, the message boxes displayed when another Pokemon is sent into battle use the trainer name of the last battled trainer, which is in many (if not every) case the trainer who had the Pokemon you&#039;re currently fighting against.<br /><br />As this is a wild battle, you can catch any opposing Pokemon you want.<br />Catching a Pokemon will trigger the catching sequence, and end the battle.<br />If you win the battle, nothing (apart gaining exp) will happen, and you&#039;ll be back to the grass.<br />If you flee, well, you flee, and it ends the battle.<br />If you have &quot;Shift&quot; mode enabled, and if you chose NO when the game asks you about switching Pokemon (after killing one opposing Pokemon), this will be counted as you trying to flee (like it would do if one of your Pokemon dies).<br /><br />And since it&#039;s a Roamer battle, every Pokemon will try to flee when sent into battle.<br />And if the Pokemon flee, the battle is over.<br />Thus, if you want to see multiple opposing Pokemon, you&#039;ll either need to OHKO them or to trap them with Shadow Tag / Mean Look / Spider Web and kill them slowly.<br /><br />Also, as it&#039;s a Roamer battle, if you end the battle by killing every Pokemon or by catching a Pokemon, the Roamer will be considered beaten/caught and he won&#039;t appear again in Hoenn.<br />However, if you end the fight without killing everything/catching a Pokemon (by fleeing, losing, or letting an opposing PokÃ©mon flee), the Roamer will still be considered &quot;Roaming&quot; and you&#039;ll still be able to meet him, even if he has 0 HP remaining.<br /><br />If the Roamer has 0 HP remaining and if you perform Roamer Rematch Glitch, you&#039;ll directly face a Pokemon from the previous trainer instead of the roamer.<br /><br /><br /> Since the opposing Pokemon you&#039;re meeting with the Roamer Rematch glitch come from the remnants of Pokemon data of your previous opponent&#039;s Pokemon, their IVs won&#039;t be affected at all by the Roamer IV storage glitch.<br />Roamer IV Storage Glitch : When a 3rd gen roamer is generated, its PID, IVs, Level, Species,.. are stores in specific adresses in order to recreate the Pokemon data of the roamer everytime he&#039;s met. But in RS/FrLg, the IVs double-word is stored as a byte, which means that the recreated IVs double-word of the roamer can only take values of 0000 00XX.<br /><br />All the Pokemon you&#039;ll meet with the Roamer Rematch Glitch will be trainer Pokemon.<br />Thus, if you catch them, it will be the same thing as you stealing them directly from the trainer.<br /><br />When you catch a wild Pokemon, its ID/SID couple is changed to yours. If the ID/SID couple of the Pokemon was originally different from yours, changing it will completely screw up the Pokemon data substructures as well as its checksum, transforming it into a Bad Egg.<br />However, you will keep the Dex entry as you&#039;re in a wild battle. (If you were stealing Pokemon in Trainer Tower or in Battle Frontier, you wouldn&#039;t have any Dex Entry as the Pokedex is disabled.)<br /><br />In RS, the only Trainers&#039; Pokemon that have a ID/SID couple equal to yours are Trainer Tower Pokemon. Thus, they are the sole PokÃ©mon you can steal and keep as valid Pokemon.<br />(The reasons for this are unknown, as it&#039;s not a really important data generation gain, and as the only useful thing I see in this is to keep shinyness and ownership of Battle Factory Pokemon in Emerald.)<br /><br />You can use the Roamer Rematch Glitch to shinyhunt in Trainer Tower. This is quite an interesting hunt since you&#039;ll meet evolved forms of Pokemon taken from a huge pool of trained Pokemon, but its flaw is that you can&#039;t catch the first Pokemon (as it&#039;ll be replaced by the roamer). Thus, you have a 1/3 chance of meeting an uncatchable shiny.<br />You also need to be cautious and lose the battle without killing the shiny, or you won&#039;t be able to see it with the Roamer Rematch Glitch. (You can&#039;t forfeit during a battle in RS Trainer Tower, unless you use a Glitch Move to change the battle type into a wild battle and flee.)<br /><br />You could think of Secret Base Trainers, but their Pokemon have a randomized ID/SID couple each time you face them. (Shinyness isn&#039;t even kept)<br />Thus, you can&#039;t clone one of your Pokemon with this method, even if this wouldn&#039;t be an efficient cloning method at all.<br /><br />However, you can use Secret Base Trainers to meet and catch specific Pokemon and obtain their Dex Entry.<br />And this can be pretty interesting with Glitch Pokemon, as their Dex Entries can either be :<br />- a normal Pokemon entry (it provides the entry that Pokemon)<br />- an entry of Decamark (a cool Dex Entry)<br />- a glitched entry (lots of japanese characters overflowing, as in US/Eu RS games, they aren&#039;t replaced by blank characters like in US/Eu Emerald)<br />- a freeze/soft reset<br /><br />I don&#039;t know what were the things that made the game freeze/soft reset, so this might be useful for code execution. (it&#039;s not something I can for now test)<br />[img]https://pbs.twimg.com/media/CPXFVCCVAAAXvFK.png[/img] [img]https://pbs.twimg.com/media/CPXFVGeUYAAHAm4.png[/img] [img]https://pbs.twimg.com/media/CPXFVEpUsAAKo7j.png[/img]<br /><br /><br />This glitch doesn&#039;t work in Emerald or FrLg, as encountering a Roamer clears the other opponent party slots.<br />Meeting a swarm Pokemon also clears these party slots. (I tried it since swarm Pokemon and Roamers are stored and generated in a similar way).<br /><br /><br />The supposed Infinite Roamer Glitch was something I noticed on my Ruby save, and I discovered that it was linked to my save not having the flag for the beginning Tv News (with the player&#039;s father) as well as different flags on the word&nbsp; containing the Tv News flag.<br />I have no idea about the causes of that, since that save was made to hunt Mudkip on console, so I had no reason to make some teleport to skip the utmost beginning of the game, and as I cheated after getting Mudkip in order to get the first badge and get my 2 other shiny starters from a trade at Odale.<br />But this is an old story and I might have forgotten things, so I&#039;m waiting until I can get my hands back on the first Gameshark snapshot I have of that file in order to try to unveil the truth.<br />In curiosity, I checked RS roms and I found no trace of a clearflag command for the Tv News flag, (but that could be done inside a special sommand, I don&#039;t really know about that) so I really can&#039;t conclude about that glitch.<br />I objectively think that I screwed something up and that this glitch is a lucky unwanted consequence, sorry.<br /><br /><br />The stolen Trainer Tower Pokemon, they can at least be transferred to 6th gen (I don&#039;t know the main checks done during PokÃ©transfer), as they&#039;re PokÃ©mon coming from 3rd gen who only happen to have weird IVs (they&#039;re all equal), and as 3rd-&gt;4th and 4th-&gt;5th transfers don&#039;t check things like that on Pokemon coming from 3rd gen.


subject: Bringing back item balls with a fossil bug in at least Red/Green?
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  Earlier Krys3000 mentioned the &quot;missable objects flags&quot; memory addresses and how you may be able to manipulate them as 8F (hex:5D) in the expanded 50+ stored items pack you can get with [url=http://forums.glitchcity.info/index.php/topic,7353.msg199092.html#msg199092]Glitch City RAM manipulation[/url].<br /><br />We figured out that these are responsible for objects that can disappear including item balls (and Krys3000 confirmed Snorlax counts), and Krys3000 found a method to get 8F by manipulating the flags.<br /><br />Today HÃ¡Äky documented a glitch called the [url=http://bulbapedia.bulbagarden.net/w/index.php?title=List_of_glitches_in_Generation_I&amp;curid=195440&amp;diff=2336317&amp;oldid=2330924]vending machine glitch[/url]. I recorded it and SatoMew asked me whether there may be any Japanese fan-sites who knew about the bug before.<br /><br />I searched for it on Google and found [url=http://www2u.biglobe.ne.jp/kakeru/pokemon/sittoku.htm]a page[/url] that indeed mentions it, as well as something I haven&#039;t heard about before that piqued my interest, which I&#039;ve mentioned below.<br /><br />Apparently, in PokÃ©mon Red and Green one of the hidden object addresses (items that do not appear as item balls on the screen) have some flags reset every time you try to pass a fossil over to Cinnabar Lab even when you choose not to revive it, causing hidden objects that may have been taken to reappear.<br /><br />According to the page, the hidden objects that can re-appear this way are:<br /><br />Rocket Hideout: Nugget<br />Mimic Girl&#039;s house: Nugget<br />Route 14: Calcium<br />PokÃ©mon Mansion B1F: Rare Candy<br />Unknown Dungeon 1F: Rare Candy<br />Unknown Dungeon B1F: Ultra Ball<br /><br />Hence we may be looking at an obscure method of farming money and getting infinite Rare Candies.<br /><br />Source text:<br />[quote]<br />ã‚¢ã‚¤ãƒ†ãƒ ãƒ•ãƒ©ã‚°å…±æœ‰ã®ç½ ï¼ï¼Ÿã€€å®Ÿç”¨åº¦ï¼‘ï¼’ï¼ï¼…<br /><br />èµ¤ç·‘ç‰ˆã«ãŠã„ã¦ã€ä¸€éƒ¨ã®éš ã—ã‚¢ã‚¤ãƒ†ãƒ ï¼ˆç”»é¢ä¸Šã§ã‚¢ã‚¤ãƒ†ãƒ ãƒœãƒ¼ãƒ«ã®å½¢ã‚’ã¨ã‚‰ãªã„ã‚¢ã‚¤ãƒ†ãƒ ï¼‰ã®å…¥æ‰‹ãƒ•ãƒ©ã‚°ãŒå…±æœ‰ã•ã‚Œã¦ã„ã‚‹ã€‚<br />ã©ã†ã„ã†ã“ã¨ã‹ã¨è¨€ã†ã¨ã€1ã¤ã‚’å…¥æ‰‹ã—ã¦ã—ã¾ã†ã¨ä»–ã®ã‚‚ã®ãŒå–ã‚Œãªããªã£ã¦ã—ã¾ã†ã®ã ï¼<br />ä»Šã®ã¨ã“ã‚ã€ä»¥ä¸‹ã®6ç®‡æ‰€ãŒç¢ºèªã•ã‚Œã¦ã„ã‚‹ã€‚<br /><br />ãƒ­ã‚±ãƒƒãƒˆå›£ã‚¢ã‚¸ãƒˆã€æŠ€ãƒžã‚·ãƒ³ï¼‘ï¼ã®æ±éš£ã«ã‚ã‚‹ã€Œé‡‘ã®çŽ‰ã€<br />ãƒ¢ãƒŽãƒžãƒã‚€ã™ã‚ã®å®¶ã®ãƒ™ãƒƒãƒ‰ã«ã‚ã‚‹ã€Œé‡‘ã®çŽ‰ã€<br />14ç•ªé“è·¯ã®ã€Œæ­ã‚’ã¯ã•ã‚“ã§å·¦å´ã€ã®çœ‹æ¿ãã°ã®ã€Œãƒªã‚¾ãƒã‚¦ãƒ ã€<br />ãƒã‚±ãƒ¢ãƒ³å±‹æ•·B1Fã€ã²ã¿ã¤ã®ã‚«ã‚®ãŒã‚ã‚‹éƒ¨å±‹ã®å·¦ä¸Šéš…ã€Œãµã—ãŽãªã‚¢ãƒ¡ã€<br />ãƒãƒŠãƒ€ã®æ´žçªŸ1Fä¸­å¤®ä»˜è¿‘ã®å²©ã€Œãµã—ãŽãªã‚¢ãƒ¡ã€<br />ãƒãƒŠãƒ€ã®æ´žçªŸB1Fã’ã‚“ãã®ã‹ãŸã¾ã‚Šä»˜è¿‘ã®å²©ã€Œãƒã‚¤ãƒ‘ãƒ¼ãƒœãƒ¼ãƒ«ã€<br />èµ¤ç·‘ã‚’ä½•å‘¨ã‹ãƒ—ãƒ¬ã‚¤ã—ã¦ã„ã‚‹ã¨ã€Œã‚ã‚‹ã¯ãšã®ã‚¢ã‚¤ãƒ†ãƒ ãŒç„¡ã„ï¼Ÿï¼ã€ã¨ã„ã†äº‹æ…‹ã‚’çµŒé¨“ã—ãŸäººã‚‚å°‘ãªããªã„ã ã‚ã†ãŒã“ã‚ŒãŒåŽŸå› ã§ã‚ã‚‹<br /><br />ã“ã‚Œã‚‰ã®ã‚¢ã‚¤ãƒ†ãƒ ã¯ã©ã‚Œã‹1ã¤ã—ã‹å…¥æ‰‹ã§ããªã„ã®ã‹ï¼Ÿã¨å•ã‚ã‚Œã‚Œã°ã•ã«ã‚ã‚‰ãšã€‚<br />ãªãœã‹ã‚°ãƒ¬ãƒ³ç ”ç©¶æ‰€ã§åŒ–çŸ³ã‚’æ¸¡ãã†ã¨ã™ã‚‹ãŸã³ã«ãƒ•ãƒ©ã‚°ãŒå¾©æ´»ã™ã‚‹ã€‚<br />å†ç”Ÿã›ãšã¨ã‚‚ã€æ¸¡ãã†ã¨ã—ã¦ã€Œã„ã„ãˆã€ã‚­ãƒ£ãƒ³ã‚»ãƒ«ã—ã¦ã‚‚å¾©æ´»ã™ã‚‹ã€‚<br />ã¤ã¾ã‚Šä¸Šè¨˜ã®ã‚¢ã‚¤ãƒ†ãƒ ã¯ã‚„ã‚ã†ã¨æ€ãˆã°ä½•å€‹ã§ã‚‚æ‹¾ã†ã“ã¨ãŒã§ãã‚‹ã®ã ï¼<br />æ­£ç›´è¨€ã£ã¦ãƒã‚°ã ã¨æ€ã‚ã‚Œã‚‹ã®ã§åˆ©ç”¨ã«ã¯ä¸€å¿œæ³¨æ„ã§ã‚ã‚‹ã€‚<br />ã§ã‚‚å…ƒã¯ã¨ã„ãˆã°ãƒ•ãƒ©ã‚°ã‚’å…±æœ‰ã•ã›ã‚‹ã»ã†ãŒæ‚ªã„ã‚ˆã†ãªæ°—ã¯ã™ã‚‹ã‘ã©â€¦ã‚‚ã—ã‹ã—ã¦ä»•è¾¼ã¿æŠ€ã ã£ãŸã‚Šï¼Ÿ<br /><br />æƒ…å ±æä¾›ï¼šæ¾ªã•ã‚“<br />[/quote]<br /><br />I&#039;m going to hopefully try and perform this glitch tomorrow and see if it works in the English versions.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=The G-Meister link=topic=36.msg199100#msg199100 date=1442938708]<br />Um, so I was going through and catching a bunch of glitch PokÃ©mon on Yellow (using ACE to change the ID in battle, so I could catch the ones that normally pop up as trainers), and I saw that some of them counted as catching other PokÃ©mon, namely a Bulbasaur, a Snorlax and an Oddish.<br /><br />Has this been found before? And if it has, have all such PokÃ©mon been documented?<br />[/quote]<br /><br />I think you may have captured some hybrid PokÃ©mon. Hybrid glitch PokÃ©mon have been known before, but I&#039;m unsure if anyone has pointed out that they register their respective PokÃ©mon before.<br /><br />If you capture a hybrid glitch PokÃ©mon (a PokÃ©mon that shares the same PokÃ©dex number of a valid PokÃ©mon 1-151), then the game will register the PokÃ©dex entry of what the glitch PokÃ©mon is a hybrid of; even though the PokÃ©dex entry that loads after catching the glitch PokÃ©mon is likely to be different.<br /><br />The [url=http://glitchcity.info/wiki/index.php?title=GlitchDex]GlitchDex[/url] has a list of PokÃ©mon by PokÃ©dex number (which you can use to check what glitch PokÃ©mon will register which normal PokÃ©mon if you know what the PokÃ©dex number represents). According to the GlitchDex, the available PokÃ©mon are:<br /><br />Red/Blue:<br />Charizard (FF)<br />Beedrill (CF)<br />Pidgeotto (CB, DC)<br />Pidgeot (F7)<br />Rattata (F8)<br />Arbok (CE)<br />Raichu (F3)<br />Nidorino (FA)<br />Wigglytuff (F6)<br />Mankey (CC)<br />Poliwhirl (C0, D7)<br />Poliwrath (C6, D1)<br />Tentacruel (DD)<br />Slowpoke (FE)<br />Magnemite (CD, DE, FC)<br />Dodrio (E0, EB)<br />Gengar (C3, D4)<br />Onix (C9, DA, FB)<br />Jolteon (FD)<br /><br />Yellow:<br />Bulbasaur (D5, F7)<br />Charmander (D6)<br />Charizard (C7, F0)<br />Blastoise (CC, CD, CE, CF)<br />Metapod (FE)<br />Beedrill (C3)<br />Pidgey (D7)<br />Pidgeotto (EC, F4)<br />Pidgeot (FB)<br />Sandshrew (FD)<br />Nidorino (C9, D2, E9, F1)<br />Wigglytuff (EF)<br />Oddish (FC)<br />Persian (E5)<br />Golduck (C5)<br />Poliwrath (DF)<br />Slowpoke (C6)<br />Slowbro (C0)<br />Magnemite (CB)<br />Doduo (D1)<br />Haunter (D0)<br />Onix (DA)<br />Seaking (E8)<br />Starmie (FF)<br />Magmar (FA)<br />Pinsir (F2)<br />Tauros (D3)<br />Snorlax (D4, EA, F5)<br />Articuno (F8)<br /><br />[url=http://bulbapedia.bulbagarden.net/wiki/Glitch_Pok%C3%A9mon_family]This page[/url] also has a list which is incomplete, so I&#039;ll edit it to add the omissions tomorrow.<br /><br />I unfortunately do not know which of these glitch PokÃ©mon&#039;s PokÃ©dex entries you cannot exit, if any.<br /><br />Additionally, when you capture (not encounter) glitch PokÃ©mon with PokÃ©dex numbers greater than 151 (000 is applicable as it counts as 256), the game will set a valid PokÃ©mon as seen, ranging from Bulbasaur (if the glitch PokÃ©mon has a PokÃ©dex number of 153) to Cubone (if the glitch PokÃ©mon has a PokÃ©dex number 000).<br /><br />It continues in this pattern: capturing 153 - set Bulbasaur, capturing 154 - set Ivysaur, capturing 155 - set Venusaur, etc.<br /><br />In actuality, no glitch PokÃ©mon cover all PokÃ©dex numbers 153 to 256 (000); so for instance, there are no glitch PokÃ©mon with PokÃ©dex numbers 154 to see Ivysaur, but in Yellow, capturing 3TrainerPokÃ© $ (number 176) allows us to mark Arbok as seen.<br /><br />A list of the effects of 152+ glitch PokÃ©mon capture flags can be found here.<br /><br />http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9dex_flags#Capture_flags<br /><br />[quote author=The G-Meister link=topic=36.msg199100#msg199100 date=1442938708]<br />If not, is this a viable speedrun technique?<br />[/quote]<br /><br />That would be interesting. If speedrunners don&#039;t mind about catching a glitch PokÃ©mon to mark a real PokÃ©mon as owned, can pull off some steps to get the glitch PokÃ©mon faster than a real PokÃ©mon (and avoid possible long PokÃ©dex entries), then I think it may be worth it. Except, I feel I would personally prefer them to catch the actual PokÃ©mon.


subject: Re: Battle Tower Lati@s glitch
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pawny
icon: xx
body:
  [quote author=Torchickens link=topic=7016.msg199079#msg199079 date=1442699109]<br />3) How far can PokÃ©mon caught with the Lati@s glitch be transferred through the generations?<br />[/quote]<br /><br />[quote author=Metarkrai link=topic=7016.msg199101#msg199101 date=1442959330]<br />The stolen Trainer Tower Pokemon, they can at least be transferred to 6th gen (I don&#039;t know the main checks done during PokÃ©transfer), as they&#039;re PokÃ©mon coming from 3rd gen who only happen to have weird IVs (they&#039;re all equal), and as 3rd-&gt;4th and 4th-&gt;5th transfers don&#039;t check things like that on Pokemon coming from 3rd gen.[/quote]<br /><br />I&#039;m pretty sure in most cases they can reach Gen 6 except if it&#039;s a special case like event legendaries. Info like breed status and location are lost upon being transferred to Gen 4 and their met level is lost upon being transferred to Gen 5 (it&#039;s replaced by the level it was transferred at*), so all that&#039;s really up to be checked is [url=http://www.serebii.net/games/geniball.shtml]ball legality[/url], which isn&#039;t really a big deal.<br /><br />*you may need to level up your pokÃ© to a legit level if it would be otherwise underleveled, like a lv 50 Tyranitar, otherwise its met level will be wrong forever after being transferred. Anything over level 70 should be legit iirc.


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: camper
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Long (and never-ending) Pokedex entries are really rare, at least in Red/Blue. Most of them are completely empty.


subject: Re: Bringing back item balls with a fossil bug in at least Red/Green?
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Well, this is more interesting than the vending machine thing :P<br /><br />Each map has its own [url=https://github.com/iimarckus/pokered/blob/cbc85b4d220b31c28266a227ff8789818631c4e9/data/hidden_objects.asm]list of invisible objects[/url]â€”which includes things like PCs and posters in addition to hidden items. Each entry defines the coordinates of the object and the function which is called when you inspect that object. Hidden items use a function aptly named [url=https://github.com/iimarckus/pokered/blob/master/engine/overworld/hidden_items.asm]HiddenItems[/url] in the disassembly, which checks the flag to see if the item has already been picked up.<br /><br />In order to know which flag represents which hidden item, it calls the function FindHiddenItemOrCoinsIndex, which scans through [url=https://github.com/iimarckus/pokered/blob/cbc85b4d220b31c28266a227ff8789818631c4e9/data/hidden_item_coords.asm]this list of hidden items[/url] until it finds an entry which matches the current map number and the coordinates of the hidden item youâ€™re trying to pick up. The problem is that, in Red and Green only, several hidden items have the wrong coordinates in this list, and one item is completely missing!<br /><br />[table][tr][td][b]Item[/b][/td][td][b]Location[/b][/td][td][b]Actual coordinates[/b]<br />(hidden object list)[/td][td][b]Wrong coordinates[/b]<br />(hidden item list)[/td][/tr]<br />[tr][td]Nugget[/td][td]Rocket Hideout B3F[/td][td](27, 17)[/td][td](22, 23)[/td][/tr]<br />[tr][td]Calcium[/td][td]Route 13[/td][td](16, 13)[/td][td](48, 8â )[/td][/tr]<br />[tr][td]Rare Candy[/td][td]PokÃ©mon Mansion B1F[/td][td](1, 9)[/td][td][i]missing[/i][/td][/tr]<br />[tr][td]Nugget[/td][td]Copycatâ€™s house 2F[/td][td](0, 6)[/td][td](0, 1)[/td][/tr]<br />[tr][td]Rare Candy[/td][td]Cerulean Cave B1F[/td][td](14, 11)[/td][td](15, 11)[/td][/tr]<br />[tr][td]Ultra Ball[/td][td]Cerulean Cave 1F[/td][td](27, 3)[/td][td](29, 22)[/td][/tr][/table]<br /><br />When a hidden item canâ€™t be found on the list, the game ends up using hidden item flag 255. Since that flag is used for all of these ill-defined items, picking up any one of them will cause all the others to disappear.<br /><br />Hidden item flags are kept in RAM starting at $D66F, so flag 255 is bit 7 of $D68E. And when a fossil is shown to the scientist in PokÃ©mon Lab (before youâ€™ve agreed to have him restore it), the item index is stored in $D68Eâ€”either $1F for Old Amber, $29 for Dome Fossil, or $2A for Helix Fossil. Since none of these values have bit 7 set, selecting any fossil to show to the scientist will clear hidden item flag 255, and allow one of these six items to be collected again.<br /><br />[hr]<br /><br />Side note: The Nugget in Copycatâ€™s house is also one of four hidden items which was moved between Red/Green and Blue. Its Red/Green coordinates of (0, 6) place it on her bed, while in later versions itâ€™s at (1, 1), which is on her desk.<br /><br />The Hyper Potion on S.S. Anne B1F was at (0, 6) in Red/Green, which appears to be out of bounds, but is still obtainable. (Itâ€™s actually not outside the map, which contains six cabins.)<br /><br />[img]http://imgur.com/Esvr7XI.png[/img]<br /><br />In Blue, it moved to (3, 1), which is on the bed.<br /><br />Less excitingly, the Elixer on Silph Co. 5F moved from (11, 3) [the left plant] to (12, 3) [the right plant], and the Rare Candy on Route 17 moved from (15, 15) [in the tall grass] to (15, 14) [still in the tall grass].


subject: Re: Bringing back item balls with a fossil bug in at least Red/Green?
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  That&#039;s very interesting HÃ¡Äky, and it&#039;s a really nice glitch, so bad it&#039;s limited to JP versions :(<br /><br />Thanks also for the knowledge about hidden items. I was about to check this to see if there&#039;s a way to use hidden items to have 8F in the 109-expanded PC (as it might be easier to get the correct configuration than using visible items). It will help me :)


subject: Re: Battle Tower Lati@s glitch
poster_name: Krys3000
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Great work as always Metarkrai! Thanks for the explanation ;)<br /><br />I was about to ask you about this glitch on PRAMA&#039;s Skype group but it seems you saw everything by yourself :D<br />


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  [quote author=Pawny link=topic=7198.msg199097#msg199097 date=1442883631]<br />Yup, that&#039;s actually the reason the coordinates to Shaymin/Darkrai are WAAAAAY shorter on jp version: you can save on MZ and they also take you to real Sinnoh<br />[/quote]<br /><br />Saving in the Mystery Zone also helps in accessing the Underground from the void while on your way to 430N in Japanese Diamond and Pearl v1.0. I found a path to the Underground thanks to this:<br /><br />237N/238N* &amp; save + reboot â†’ 1E â†’ 1S â†’ 32S â†’ 362E â†’ 160S<br />[size=8pt](I don&#039;t know whether it must be 238N or if 237N also works since 237N is where it usually starts playing the Underground theme.)[/size]<br /><br />Walking south for a while will eventually present you with the actual maps of the Underground.<br /><br />Here&#039;s a video of the path: [url=https://www.youtube.com/watch?v=MurIM4N15F4]https://www.youtube.com/watch?v=MurIM4N15F4[/url]


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: The G-Meister
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Ahh, hybrids. Makes sense now. A lot of them seem to share the base moves, stats and some even manage to match the correct sprite too, even though the colour is grey (they all seem to be that way, assuming grey is the default value when not specified).<br /><br />Sadly, in terms of a speedrun technique, the problem isn&#039;t the long PokÃ©dex entry because, as camper pointed out, they&#039;re normally empty. The problem is more the massive wait time you have to, well, wait for, as the cry finishes. I&#039;m not sure where they take their cry data from, but wherever it is, each one usually lasts a good couple minutes, and even it&#039;s not a speedrun technique... it still sounds hilarious xD One of them seems to have a completely different cry every time you look at its stats, and some are so freaky I might start to take some belief in that so called &quot;Lavender Town Syndrome&quot;. If I had a capture card I&#039;d gladly show you.<br /><br />And yeah, as you said, it seems a little unethical catching glitch PokÃ©mon to register as a normal PokÃ©mon just because it&#039;s quicker (when in most cases it&#039;s won&#039;t be, anyway).


subject: Re: Bringing back item balls with a fossil bug in at least Red/Green?
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=7359.msg199108#msg199108 date=1443002057]<br />That&#039;s very interesting HÃ¡Äky, and it&#039;s a really nice glitch, so bad it&#039;s limited to JP versions :( <br />[/quote]<br /><br />The vending machine bug affects both Japanese and English Generation I games. The European versions probably didn&#039;t fix it either ;) 


subject: Re: Official 1st Gen (Red/Blue and Yellow) Glitch Discussion
poster_name: Torchickens
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Torchickens
icon: xx
body:
  [quote author=camper link=topic=36.msg199106#msg199106 date=1442989703]<br />Long (and never-ending) Pokedex entries are really rare, at least in Red/Blue. Most of them are completely empty.<br />[/quote]<br /><br />Ah. I see. I&#039;ve never explored the dex entries glitch by glitch in the past. Thanks for this. :)<br /><br />[quote author=The G-Meister link=topic=36.msg199111#msg199111 date=1443026837]<br />Ahh, hybrids. Makes sense now. A lot of them seem to share the base moves, stats and some even manage to match the correct sprite too, even though the colour is grey (they all seem to be that way, assuming grey is the default value when not specified).<br />[/quote]<br /><br />About that, all hybrid glitch PokÃ©mon (#1-151) share the same starting moves, typing, base stats, TM/HM learnset as the valid PokÃ©mon, as well as everything that can be found here.<br /><br />http://hax.iimarck.us/files/missingno_explained.html<br /><br />They do not (necessarily) have the same cry and level up moves as this data is taken from ID rather than PokÃ©dex number.<br /><br />The reason why they do not always have the same front-sprite, back-sprite as the valid PokÃ©mon (even though the two byte sprite pointer and dimensions are taken from the valid PokÃ©mon) is because each PokÃ©mon ID has a particular sprite bank. http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_base_stats_data_structure_in_Generation_I#Sprites<br /><br />A PokÃ©mon like Bulbasaur uses sprite bank 0x0D (it is documented that all IDs ranging from 0x99-0xFF but are not 0xB6, 0xB7, or 0xB8 have this bank but I do not know for sure), and in Red, Blue, Yellow, its sprite is taken from 0D:4000 (offset 34000). <br /><br />&#039;ã‚¥. is a Bulbasaur hybrid and is hex:D5. It is in bank 0x0D and correctly uses Bulbasaur&#039;s sprite data from 0D:4000 (offset 34000).<br /><br />But ã‚¥$ 6ã‚¥ (hex:FD, Jolteon hybrid) has a different bank to Jolteon. Jolteon&#039;s sprite is in bank 0B. Its front sprite&#039;s two byte pointer data is 688F, so the sprite is located at 0B:688F (offset 2E88F). Hex:FD&#039;s sprite bank is 0D, so its front sprite points to 0D:688F (offset 3688F) instead.<br /><br />[quote author=The G-Meister link=topic=36.msg199111#msg199111 date=1443026837]<br />Sadly, in terms of a speedrun technique, the problem isn&#039;t the long PokÃ©dex entry because, as camper pointed out, they&#039;re normally empty. The problem is more the massive wait time you have to, well, wait for, as the cry finishes. I&#039;m not sure where they take their cry data from, but wherever it is, each one usually lasts a good couple minutes, and even it&#039;s not a speedrun technique... it still sounds hilarious xD One of them seems to have a completely different cry every time you look at its stats, and some are so freaky I might start to take some belief in that so called &quot;Lavender Town Syndrome&quot;. If I had a capture card I&#039;d gladly show you.<br />[/quote]<br /><br />Yeah, some cries can be long. Like how if you keep viewing h POKÃ© (hex:C3)&#039;s status, then eventually you may come across a cry that is exceptionally long. I agree, they can get pretty creepypasta-ish and you may hear high-pitched sounds.<br /><br />Yeah I think the cries can get pretty entertaining, additionally I like it when PokÃ©dex entries bring up a variety of sounds, and how some glitch PokÃ©mon play music like when you view from the summary, withdraw or deposit ã‚¡7g. <br /><br />[quote author=The G-Meister link=topic=36.msg199111#msg199111 date=1443026837]<br />And yeah, as you said, it seems a little unethical catching glitch PokÃ©mon to register as a normal PokÃ©mon just because it&#039;s quicker (when in most cases it&#039;s won&#039;t be, anyway).<br />[/quote]<br /><br />Yeah. There&#039;s the aspect that you wouldn&#039;t be watching what you were expecting to watch.<br /><br />I believe in the idea that a catch &#039;em all run should capture the real PokÃ©mon, otherwise I don&#039;t think it&#039;s really a catch &#039;em all at all.<br /><br />I feel that it takes the spirit away from it to do that, you may be filling up the dex entries but you aren&#039;t actually getting the PokÃ©mon. I like to be able to see their sprites and like it when the PokÃ©dex entries of the PokÃ©mon you are registering show as well.<br /><br />[quote author=Torchickens link=topic=36.msg199103#msg199103 date=1442964230]<br />[url=http://bulbapedia.bulbagarden.net/wiki/Glitch_Pok%C3%A9mon_family]This page[/url] also has a list which is incomplete, so I&#039;ll edit it to add the omissions tomorrow.<br />[/quote]<br /><br />Updated the page with omissions. :)


subject: Re: The Member's Guide to Topiclessness
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Zowayix link=topic=3088.msg199117#msg199117 date=1443088283]<br />Apparently it&#039;s my birthday. Here&#039;s to 23 years of me not having killed myself yet.<br />[/quote]<br /><br />Stay safe.<br /><br />[img width=600]http://safebooru.org//images/1239/104d8cbf6ba1689ccd8a8a03109db340.png[/img]


subject: Re: The Member's Guide to Topiclessness
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Krys3000 link=topic=3088.msg199119#msg199119 date=1443095643]<br />Well, it appears it&#039;s mine too, unless I was born 3 years before you, Zowayix!<br />[/quote]<br /><br />Happy birthday! :) 


subject: Re: The &quot;Mawhile&quot; typo in PokÃ©mon Ruby
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  Oxford Dictionaries defines a [b]bug[/b] as &quot;[url=http://www.oxforddictionaries.com/definition/english/bug]an error in a computer program or system[/url]&quot; and a [b]glitch[/b] as &quot;[url=http://www.oxforddictionaries.com/definition/english/glitch]a sudden, usually temporary malfunction or fault of equipment[/url]&quot;, which is how the two are traditionally defined in common usage outside of the video game scene.<br /><br />As to Blaziken257&#039;s contribution, the typo [url=http://forums.glitchcity.info/index.php/topic,7211.0.html]and some other things[/url] were fixed in the English version release 1.1. Release 1.2 only fixed the Berry bug, which was also fixed by Japanese and European version release 1.1.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  In the Japanese Diamond/Pearl v1.0, you can use the Explorer Kit in a Mystery Zone, even as a registered item. The game will save and overwrite the data but, depending on the Mystery Zone (and your coordinates?), it&#039;ll either work or throw back an error.<br /><br />If the Mystery Zone plays the Underground theme, then you can&#039;t use the Explorer Kit. This applies to both the Underground itself (which the game calls &quot;Mystery Zone&quot;) and a void area called Mystery Zone with the theme. The part of that Mystery Zone that plays the regular Mystery Zone theme will let you use the Explorer Kit but the game will return the Union Room communication error while transporting you underground.<br /><br />Subsequent releases and games fixed this so that the Explorer Kit instead returns the Rowan can&#039;t-use message in every Mystery Zone.<br /><br />Video: [url=https://www.youtube.com/watch?v=97ZXk3ZP1iw]https://www.youtube.com/watch?v=97ZXk3ZP1iw[/url]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Hello, I was a member of both HoO forums (and their predecessor PokemonGlitching101). I was pretty young at the time so I didn&#039;t contribute anything useful but I did my best to keep up with all the threads so I do remember a lot.<br /><br />It&#039;s not possible to reach 430N in (US) Platinum via tweaking. I&#039;m not sure about Japanese. I just tested it myself in NO$GBA to be sure, and there are invisible walls all around the building. They do behave a bit weirdly, since it&#039;s possible to get stuck if you&#039;re persistent in walking back and forth (perhaps they&#039;re elevation changes? Or they could just change). Using the walk through walls code you can pass them no problems.<br /><br />If you want to make sure your results are tweaking compatible, just disable the code after getting outside Poketch Co. This gives pretty boring results in Platinum, since I&#039;m not aware of any inside location that doesn&#039;t have the walls. It&#039;s important in (US) Diamond/Pearl though since invisible walls are rare but do show up very occasionally.


subject: A stalker that really needs to stop stalking.
poster_name: TwilightHakuryuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  As the title of this post states; I REALLY need to stop stalking this place and start speaking up...<br /><br />Unfortunately -and much to my disdain- my phone REALLY doesn&#039;t like it when I attempt to write posts on this forum and then switch to another tab to look for my reference links. When I tab back in, the forum says &quot;Oopsies~ I had an error and had to reload!&quot; and *poof*, there goes my three paragraph response to a question about a glitch that I actually had a pretty damn good explanation for. (I.E. G-Meister asked about invalid Pokemon in Pokemon Yellow setting flags in the Pokedex for valid Pokemon. I thought &quot;don&#039;t Hybrids do that?&quot; And while I was looking into it to be sure I was correct, the forum reloaded on me, and gave me a background of smiley emoticons for three days. Needless to say the blinding, happy yellow background was not pleasing to my eyes~)<br /><br />Anyways~ Hello, hello! I am TwilightHakuryuu, or TwilightDragonair if you prefer. You are welcome to also call me by a host of other names or nicknames. I will answer to pretty much anything that is directed specifically at me.<br /><br />I have been stalking this forum and its predecessors for years, however I have only recently decided to finally make an account with GCL in an attempt to truly join in the discussion. I made this account during this past Summer shortly after getting in contact with Torchickens via skype to both greet a fellow glitcher for the first time in a long time as well as inquire about a small variety of glitches and some strange side effects affecting others.<br /><br />I am a proud owner of THREE handheld Nintendo systems that are compatible with Gameboy and Gameboy Color games; a GBC, and GBA, and a GBA-SP. I also possess most of the English core series Gen I and Gen II Pokemon Games with a few that have still-alive internal batteries- two copies of Red, one Blue, and Silver. Besides those, I also have dead Pokemon Gold and Crystal, as well as a horribly-translated English hack of Pokemon Green. I am fairly certain the language and characters (refering to the alphabets) are the only features that were changed in this particular hack, but I have yet to test it for japanese-exclusive glitches that do not rely on saving the game.<br />(I also own a DSLite, DSi, DSiXL, and a 3DS with all associated core series Pokemon Games excluding Black 2.) So, I look forward to trying out new glitches and playing with potential new subglitches related to the older glitches on the physical cartridges and devices! <br /><br />My past major attempts at aiding in glitch discovery had little payoff. I hope that by participating here I will be able to be of more use!<br /><br />Also, I would like to add that I enjoy glitching other games, with my primary interest outside of Pokemon being my good old Spyro:YotD game on my PS2. (Unfortunately my memory card recently died so I will have to start that over.) And I have also been trying to figure out how I caused a glitch I experienced in Sonic3K for PC. <br /><br />If there is anything in particular any of you would like to ask me, have at it! Personal questions don&#039;t bother me, I just left that stuff out because I think I am terribly boring.~ Please blame my excessive rambling paragraphs on insomnia.<br /><br />On a side note...<br />@Torchickens: With college starting back up and having two lab courses and a bizarre combination of schedules between myself and my mate, I have not had an opportunity to investigate the sound effect discrepencies between my cartridge and the ROMs when triggering Cooltrainer in the overworld. I will certainly try to figure it out as soon as I have a real opportunity.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=~Poke~ link=topic=7198.msg199123#msg199123 date=1443153894]<br />Hello, I was a member of both HoO forums (and their predecessor PokemonGlitching101). I was pretty young at the time so I didn&#039;t contribute anything useful but I did my best to keep up with all the threads so I do remember a lot.<br />[/quote]<br /><br />Hey ~Poke~, nice to meet you! :) <br /><br />[quote author=~Poke~ link=topic=7198.msg199123#msg199123 date=1443153894]<br />It&#039;s not possible to reach 430N in (US) Platinum via tweaking. I&#039;m not sure about Japanese. I just tested it myself in NO$GBA to be sure, and there are invisible walls all around the building. They do behave a bit weirdly, since it&#039;s possible to get stuck if you&#039;re persistent in walking back and forth (perhaps they&#039;re elevation changes? Or they could just change). Using the walk through walls code you can pass them no problems.<br /><br />If you want to make sure your results are tweaking compatible, just disable the code after getting outside Poketch Co. This gives pretty boring results in Platinum, since I&#039;m not aware of any inside location that doesn&#039;t have the walls. It&#039;s important in (US) Diamond/Pearl though since invisible walls are rare but do show up very occasionally.<br />[/quote]<br /><br />Yes, I&#039;m well aware that the walls are a problem if one tweaks rather than using wall-disabling codes. [url=http://forums.glitchcity.info/index.php/topic,7198.msg197663.html#msg197663]Like I said earlier in the thread,[/url] I don&#039;t tweak because it&#039;s very hard for me to successfully achieve the desired result.<br /><br />I believe that both methods are valid in the study of the void since the &quot;walk through walls&quot; or &quot;walk anywhere&quot; codes lift some of the limitations that would render access impossible in certain cases.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7198.msg199125#msg199125 date=1443175470]<br />Hey ~Poke~, nice to meet you! :) <br /><br />Yes, I&#039;m well aware that the walls are a problem if one tweaks rather than using wall-disabling codes. [url=http://forums.glitchcity.info/index.php/topic,7198.msg197663.html#msg197663]Like I said earlier in the thread,[/url] I don&#039;t tweak because it&#039;s very hard for me to successfully achieve the desired result.<br /><br />I believe that both methods are valid in the study of the void since the &quot;walk through walls&quot; or &quot;walk anywhere&quot; codes lift some of the limitations that would render access impossible in certain cases.<br />[/quote]<br /><br />On page 3 you were asking, so I thought I should clarify. Looking back, that was in February so I guess you got your answer elsewhere.<br />Codes certainly are a good way to explore, since they allow more access. A lot of Hall of Origin&#039;s efforts were focused on the glitching only side - mostly trying to find Arceus (which proved impossible) but also the other events, early access to regular legendaries, and Hall of Fame for speedruns.<br />Once the practical uses like that are out of the way, it&#039;s interesting to see what&#039;s out there and codes are necessary for most exploration outside of Diamond and Pearl.<br />HoO&#039;s approach to this is probably why there&#039;s less information about Platinum, and basically nothing about Heart Gold and Soul Silver.<br /><br />On that subject, it would be nice if Hall of Origin and etc. hadn&#039;t moved around so much. Between the four separate forums by my count (two by each name) there would have been some pretty solid documentation at least on Diamond and Pearl&#039;s void. That Google doc seems to have a lot of the basics covered though.<br /><br />I haven&#039;t seen the second PG101 mentioned here. Judging by the Wayback Machine and posts on the original, it seems to have existed from late 2008 to mid 2009. I don&#039;t know what was on there, since there don&#039;t seem to be any records but it was around that time that people started to actually understand void exploration. Still, anything discovered there was probably repeated in the HoO vBulletin backup so it shouldn&#039;t mean any knowledge was lost.<br />[size=8pt]I made a (very low quality) [url=https://www.youtube.com/watch?v=gqi1JfS__ls]Youtube video[/url] of Jubilife City music with one track disabled which directed people there, and shows the logo.[/size]


subject: Re: Forum Bug List and Reports
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  A minor note. I signed up for email notifications, but they get sent to spam in gmail. The reason given is that apparently they violate some kind of Google guideline? [url=https://support.google.com/mail/answer/81126?hl=en-GB#authentication]It links to this[/url].<br /><br />My thoughts on this are basically &quot;Fuck off Google&quot;, so I made a never spam filter. Still, this is apparently something inherent to the emails themselves that&#039;s probably getting triggered for all gmail users.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=~Poke~ link=topic=7198.msg199127#msg199127 date=1443189982]<br />On page 3 you were asking, so I thought I should clarify. Looking back, that was in February so I guess you got your answer elsewhere.<br />[/quote]<br /><br />No, it&#039;s OK. I appreciate your help and all input is welcome :) <br /><br />[quote author=~Poke~ link=topic=7198.msg199127#msg199127 date=1443189982]<br />Codes certainly are a good way to explore, since they allow more access. A lot of Hall of Origin&#039;s efforts were focused on the glitching only side - mostly trying to find Arceus (which proved impossible) but also the other events, early access to regular legendaries, and Hall of Fame for speedruns.<br />Once the practical uses like that are out of the way, it&#039;s interesting to see what&#039;s out there and codes are necessary for most exploration outside of Diamond and Pearl.<br />HoO&#039;s approach to this is probably why there&#039;s less information about Platinum, and basically nothing about Heart Gold and Soul Silver.<br />[/quote]<br /><br />I believe it may be possible to find a path to the real Hall of Origin but, much like with the path I found to the Underground, it&#039;ll come up randomly :P The only known Hall of Origin path is the one that leads the player to the unused copy that has no events or warps programmed. Crystalmourne has [url=https://www.youtube.com/watch?v=CPSdWG-JfDg]a video[/url] showing this.<br /><br />[quote author=~Poke~ link=topic=7198.msg199127#msg199127 date=1443189982]<br />On that subject, it would be nice if Hall of Origin and etc. hadn&#039;t moved around so much. Between the four separate forums by my count (two by each name) there would have been some pretty solid documentation at least on Diamond and Pearl&#039;s void. That Google doc seems to have a lot of the basics covered though.<br /><br />I haven&#039;t seen the second PG101 mentioned here. Judging by the Wayback Machine and posts on the original, it seems to have existed from late 2008 to mid 2009. I don&#039;t know what was on there, since there don&#039;t seem to be any records but it was around that time that people started to actually understand void exploration. Still, anything discovered there was probably repeated in the HoO vBulletin backup so it shouldn&#039;t mean any knowledge was lost.<br />[/quote]<br /><br />It is indeed unfortunate due to the information loss :-\ <br /><br />[quote author=~Poke~ link=topic=7198.msg199127#msg199127 date=1443189982]<br />[size=8pt]I made a (very low quality) [url=https://www.youtube.com/watch?v=gqi1JfS__ls]Youtube video[/url] of Jubilife City music with one track disabled which directed people there, and shows the logo.[/size]<br />[/quote]<br /><br />That sounds like the theme played in the &quot;Jubilife City&quot; voids that you encounter on the path to the Underground, which you can listen to for a while in the video I made (linked to on page 3).


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7198.msg199129#msg199129 date=1443195789]<br />I believe it may be possible to find a path to the real Hall of Origin but, much like with the path I found to the Underground, it&#039;ll come up randomly :P The only known Hall of Origin path is the one that leads the player to the unused copy that has no events or warps programmed. Crystalmourne has [url=https://www.youtube.com/watch?v=CPSdWG-JfDg]a video[/url] showing this.<br />[/quote]<br /><br />The Hall of Origin itself may be found, but the Arceus battle can&#039;t be started since it&#039;s a scripted part of the event. People did search for a way to trigger the event, like the other events that can be triggered in the void (Underground tutorial, receiving the Pal Pad, getting kicked out of the restaurant because it&#039;s closed) but they weren&#039;t successful. <br /><br />The Hall of Origin event relies on having the flute so this wouldn&#039;t work without at least already having the flags set, though there&#039;s also the question of how the event itself is triggered. It starts by using the flute in Spear Pillar, so whether anything can be triggered in the Hall of Origin at all depends on how it&#039;s coded.<br /><br />It still would be interesting to find the real Hall. It&#039;s strange that it hasn&#039;t already shown up, though it&#039;s probably just coincidence. In Diamond and Pearl Arceus apparently is there (though can&#039;t be interacted with) so it would be a novelty to see.<br /><br />[quote author=SatoMew link=topic=7198.msg199129#msg199129 date=1443195789]<br />That sounds like the theme played in the &quot;Jubilife City&quot; voids that you encounter on the path to the Underground, which you can listen to for a while in the video I made (linked to on page 3).<br />[/quote]<br /><br />Yep, that&#039;s it. It seems to be the base track without the additions from day or night. I wonder if other songs can be heard like that.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=~Poke~ link=topic=7198.msg199130#msg199130 date=1443199847]<br />The Hall of Origin itself may be found, but the Arceus battle can&#039;t be started since it&#039;s a scripted part of the event. People did search for a way to trigger the event, like the other events that can be triggered in the void (Underground tutorial, receiving the Pal Pad, getting kicked out of the restaurant because it&#039;s closed) but they weren&#039;t successful. <br /><br />The Hall of Origin event relies on having the flute so this wouldn&#039;t work without at least already having the flags set, though there&#039;s also the question of how the event itself is triggered. It starts by using the flute in Spear Pillar, so whether anything can be triggered in the Hall of Origin at all depends on how it&#039;s coded.<br />[/quote]<br /><br />When you say that the Hall of Origin can be found, are you referring to the real one? If so, does it mean that people have come across it or void areas using its location header and theme but that a path to the Hall itself has yet to be discovered?<br /><br />[quote author=~Poke~ link=topic=7198.msg199130#msg199130 date=1443199847]<br />It still would be interesting to find the real Hall. It&#039;s strange that it hasn&#039;t already shown up, though it&#039;s probably just coincidence. In Diamond and Pearl Arceus apparently is there (though can&#039;t be interacted with) so it would be a novelty to see.<br />[/quote]<br /><br />Yes, without setting the event flags, Arceus&#039;s sprite appears at the real Hall of Origin in Diamond and Pearl as well as Platinum but it cannot be interacted with.<br /><br />[img]https://i.imgur.com/uCJ7fIA.png[/img]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Sorry, I meant may as in potentially. I don&#039;t think it ever did happen, I just don&#039;t know of any reason it wouldn&#039;t be possible.<br /><br /><br />In the spirit of experimentation, I decided to follow the instructions to reach the beta Jubilife place &quot;in Zow&#039;s vid&quot;. Instead of starting at Poketch Co, however, I started from Spear Pillar. I have vague memories of a theory that Jubilife City places are all over the void because you start exploring from there, so I thought I&#039;d try starting somewhere else... but it didn&#039;t make any difference to the locations that show up. So that&#039;s that rumour proven wrong, and also some evidence (perhaps not conclusive proof) that the void has the same layout regardless of the entry point.<br /><br />Anyway, the interesting thing (in my mind at least) is that when I got there, it had the 3d perspective enabled. [url=http://www.youtube.com/watch?v=YRp2NsijtFQ]Crystalmourne visits the same place here[/url], but it&#039;s shown in 2d. Another difference is that the npc is invisible (the shadow is still there) and can&#039;t be talked to.<br /><br />Saving and resetting didn&#039;t change the camera, but made the npc appear.<br />Going downstairs to the next (still beta) map reset the camera to normal.<br /><br />[img]http://i.imgur.com/pSKS3Ed.png[/img]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Pawny
icon: xx
body:
  [quote author=~Poke~ link=topic=7198.msg199132#msg199132 date=1443202311]I have vague memories of a theory that Jubilife City places are all over the void because you start exploring from there, so I thought I&#039;d try starting somewhere else... but it didn&#039;t make any difference to the locations that show up. So that&#039;s that rumour proven wrong, and also some evidence (perhaps not conclusive proof) that the void has the same layout regardless of the entry point.<br />[/quote]<br /><br />Any void is full of Jubilifes because there&#039;s almost 65,000 Jubilife areas in the game (don&#039;t remember the exact number but I think the last valid area in DP which is Contest Hall is something like ID 554, so 555~65535 would be Jubilifes, that&#039;s an approximation, don&#039;t quote those numbers), because it was the first city programmed in the game. I also remember something about many Jubilifes in the void actually being negative map IDs that underflow and becomes Jubilifes.<br /><br />About the void variance, it&#039;s something like this:<br /><br />The Jubilife/430N void we know is actually the &quot;Sinnoh void&quot;. Any overworld area should have the same void, which mean outdoors cities/routes as well, Jubilifes are just more common. It&#039;s the void with the most variety of areas so it&#039;s usually the target of exploration. Some areas are also subject to being affected by flags.<br /><br />Small indoors areas voids are static except for the area between the two first Floaroma Meadow areas, known as &#039;second secion&#039; (SS).<br /><br />And there&#039;s bigger indoors areas, which I don&#039;t know much about or if they&#039;re actually that different from the small indoors ones, but I remember they have some interesting areas around them, but I don&#039;t know about far. Take Hearthome Gym (tweakable into) and some caves as examples.<br /><br />(well sorry for some lack of certainty, most of this is 2010 knowledge and my memory is kinda bad) 


subject: Re: A stalker that really needs to stop stalking.
poster_name: Ketsuban
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Welcome :D<br /><br />[img]http://orig08.deviantart.net/05ab/f/2013/089/9/b/hereforever_by_fartprincess-d5ztsoc.jpg[/img]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=~Poke~ link=topic=7198.msg199132#msg199132 date=1443202311]<br />Sorry, I meant may as in potentially. I don&#039;t think it ever did happen, I just don&#039;t know of any reason it wouldn&#039;t be possible.<br />[/quote]<br /><br />Oh, I see.<br /><br />[quote author=~Poke~ link=topic=7198.msg199132#msg199132 date=1443202311]<br />So that&#039;s that rumour proven wrong, and also some evidence (perhaps not conclusive proof) that the void has the same layout regardless of the entry point.<br />[/quote]<br /><br />The void does certainly seem to have an order of sorts in the midst of all that &quot;chaos&quot;. However, rebooting the game affects the void areas you find at any given time.<br /><br />[quote author=~Poke~ link=topic=7198.msg199132#msg199132 date=1443202311]<br />Anyway, the interesting thing (in my mind at least) is that when I got there, it had the 3d perspective enabled. [url=http://www.youtube.com/watch?v=YRp2NsijtFQ]Crystalmourne visits the same place here[/url], but it&#039;s shown in 2d.<br />[/quote]<br /><br />That is indeed interesting, I wonder what caused the change in the camera&#039;s perspective. Perhaps it has to do with the path you used?<br /><br />[quote author=Pawny link=topic=7198.msg199133#msg199133 date=1443203499]<br />Any void is full of Jubilifes because there&#039;s almost 65,000 Jubilife areas in the game (don&#039;t remember the exact number but I think the last valid area in DP which is Contest Hall is something like ID 554, so 555~65535 would be Jubilifes, that&#039;s an approximation, don&#039;t quote those numbers), because it was the first city programmed in the game. I also remember something about many Jubilifes in the void actually being negative map IDs that underflow and becomes Jubilifes.<br />[/quote]<br /><br />The Contest Hall&#039;s map ID in Diamond and Pearl is 0x022E (558) and has the internal name &quot;C05R1103&quot;. The only other map IDs with interesting internal names are 0x0000 (&quot;EVERYWHERE&quot;; apparently it&#039;s used by the Battle Tower void), 0x0001 (&quot;NOTHING&quot;), and 0x0002 (&quot;UG&quot;; the Underground, which can be found in the void like I showed earlier), but all of them use the &quot;Mystery Zone&quot; location header, although Spiky&#039;s DS Map Editor conflicts with the in-game data when it comes to the Battle Tower void in Platinum since the former states it&#039;s &quot;Mystery Zone&quot; while the latter displays &quot;Faraway place&quot; (in Diamond and Pearl, it is &quot;Mystery Zone&quot;).<br /><br />[quote author=Pawny link=topic=7198.msg199133#msg199133 date=1443203499]<br />Small indoors areas voids are static except for the area between the two first Floaroma Meadow areas, known as &#039;second secion&#039; (SS).<br /><br />And there&#039;s bigger indoors areas, which I don&#039;t know much about or if they&#039;re actually that different from the small indoors ones, but I remember they have some interesting areas around them, but I don&#039;t know about far. Take Hearthome Gym (tweakable into) and some caves as examples.<br />[/quote]<br /><br />By &quot;static&quot;, you mean that the location never changes, correct?


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: Tsukuu
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7198.msg199135#msg199135 date=1443204141]<br />The Contest Hall&#039;s map ID in Diamond and Pearl is 0x022E (558)[/quote]<br /><br />Oh ok, so we should have 64977 placeholder Jubilifes.<br /><br />[quote author=SatoMew link=topic=7198.msg199135#msg199135 date=1443204141]<br />By &quot;static&quot;, you mean that the location never changes, correct?<br />[/quote]<br /><br />Its void, actually. If you try to explore PokÃ©tch&#039;s void, Jubi TV, PokÃ©mart void, etc, without saving at 430N (which would take you to Sinnoh void like I said before) they should have the exact same areas except for the SS. They also don&#039;t seem to be affected by flags at all, different savefiles at different points on the game always had the same areas.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Pawny link=topic=7198.msg199136#msg199136 date=1443204827]<br />Its void, actually. If you try to explore PokÃ©tch&#039;s void, Jubi TV, PokÃ©mart void, etc, without saving at 430N (which would take you to Sinnoh void like I said before) they should have the exact same areas except for the SS. They also don&#039;t seem to be affected by flags at all, different savefiles at different points on the game always had the same areas.<br />[/quote]<br /><br />Yes, they are all seemingly endless Mystery Zones as long as you are visible on the Town Map. For example, walking straight south in the Jubilife PokÃ© Mart void will lead you to a Mystery Zone but if you go a bit west, you enter &quot;Jubilife City&quot; and other voids because you&#039;re already out of the Town Map&#039;s radar, thus you&#039;re no longer in the Mystery Zone that&#039;s part of the entry point&#039;s void (the Town Map will also instead show your last known location instead of changing as you move like in the Mystery Zone of the void of the location you originally entered from).<br /><br />Also, I just found out that the Hiker in the Underground will freeze the game if you try to interact with him after getting there in the void.<br /><br />[img]https://i.imgur.com/7gmJ83p.png[/img]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=SatoMew link=topic=7198.msg199135#msg199135 date=1443204141]<br /><br />That is indeed interesting, I wonder what caused the change in the camera&#039;s perspective. Perhaps it has to do with the path you used?<br />[/quote]<br /><br />Nope, it seems the perspective carries over from where you started.<br />I did a really tiny trip to confirm this: Went North from Oreburgh Gate (the cave - it was the closest 3d place) until I hit Jubilife TV. Saved, went back down. The same effect happens here.<br />[img]http://i.imgur.com/oerqNxE.png[/img]<br />Since this is a real place, it also shows that it&#039;s a real &quot;override&quot; instead of maybe the beta place not having a perspective set.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=~Poke~ link=topic=7198.msg199138#msg199138 date=1443206104]<br />Nope, it seems the perspective carries over from where you started.<br />I did a really tiny trip to confirm this: Went North from Oreburgh Gate (the cave - it was the closest 3d place) until I hit Jubilife TV. Saved, went back down. The same effect happens here.<br />[img]http://i.imgur.com/oerqNxE.png[/img]<br />Since this is a real place, it also shows that it&#039;s a real &quot;override&quot; instead of maybe the beta place not having a perspective set.<br />[/quote]<br /><br />Quite interesting, too bad that they dropped the 3D perspective from interior areas.<br /><br />Also, at 319W from the center of the Hall of Origin&#039;s entry point (with the stairs above it and Mt. Coronet&#039;s entrance/exit below it) there&#039;s a Mystery Zone that plays the Underground theme. From there I walked a lot north, west, and south, and I came across a real Hall of Origin void surrounded by Mystery Zones to the south and east, a Solaceon Ruins void to the north, and an Iron Island void to the west.<br /><br />[img]https://i.imgur.com/v0ulNxQ.png[/img]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s possible to track the location you&#039;re in through DeSmuME&#039;s RAM search while exploring the void, which is interesting. It&#039;s probably already known and not that hard to figure out if you know what you&#039;re doing, but I haven&#039;t seen any instructions so I&#039;ve written some - at least, for my own method.<br />So far I&#039;ve done this in US Pearl and Platinum.<br /><br />The addresses are randomised on startup/reset, so I search for them each time.<br />I&#039;ve got a good routine to find the right address while in the overworld:<br />Set data size to 2 bytes<br />Search for 3 while in Jubilife City<br />Search for 345 while in Route 204<br /><br />At this point there are still ~20 matches, but the first one listed is the right one. (The others seem to copy it depending on what map it is - all switch to 2 for underground but only the first is set to 553 or etc. for Turnback Cave).<br /><br />The part that&#039;s a bit less certain is keeping track of it after the save and reset at 430N, and later saves.<br />You need to keep track of the ID of 430N&#039;s Jubilife City, or the other place you&#039;re saving. (430N&#039;s specific ID varies, though only within a few hundred.)<br />After the save and reset, you need to reset the RAM search and search for that map ID. Then take one step and search for the place you&#039;re in now - likely Mystery Zone at ID 0, but other places are possible eg. Underground at ID 2.<br /><br />Now can see what map ID you&#039;re in while exploring the void! You can compare to a list eg. from Spiky&#039;s Map Editor to find out which specific map you&#039;ll get if you save and backtrack.<br />This is useful to distinguish between maps of the same name (including real Jubilife houses from fake Jubilife overworld).<br /><br />Potentially void exploration could be automated with a lua script that records this value as it travels. I might try this later, though I&#039;ll have to learn lua first. The void does vary between files (and a little between different attempts) so a full on map isn&#039;t too meaningful, but many places are consistent so I think it&#039;d still be worth doing.<br /><br />To clarify this method if the explanation is confusing, I made a video of me doing it in US Platinum. This was maybe a silly choice of game because I don&#039;t know any interesting places to go, and ended up choosing the entrance to Turnback Cave (it set more addresses than the others, I was curious!) Still, it&#039;s about the method, not the results.<br /><br />[youtube]https://www.youtube.com/watch?v=smrOI6UJj_A&amp;feature=youtu.be[/youtube]<br /><br />I go past plenty of negative Jubilife City areas but it&#039;s possible the map ID isn&#039;t actually signed, so it might not really mean anything.<br /><br />We can also see the perspective override here, since Turnback Cave is shown in 2d until I change rooms.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  I guess that gen4 has a rudimentary ASLR, like gen3 does.<br /><br />Has anyone bothered doing major reversing of gen4 yet, both static analysis and debugging (setting in-memory breakpoints etc)?


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=Wack0 link=topic=7198.msg199143#msg199143 date=1443308981]<br />I guess that gen4 has a rudimentary ASLR, like gen3 does.<br /><br />Has anyone bothered doing major reversing of gen4 yet, both static analysis and debugging (setting in-memory breakpoints etc)?<br />[/quote]<br /><br />While looking into it I found [url=http://projectpokemon.org/wiki/Notable_Breakpoints]this list on Project Pokemon[/url], and the [url=http://www.gamefaqs.com/boards/925602-pokemon-pearl-version/40532445?page=3]50 page gamefaq thread[/url] it links to. The Project Pokemon forum might have more threads where they researched this for their list, but I don&#039;t see them at a glance and their search is a bit annoying. It looks like they&#039;ve moved on to 5th and 6th gen now.<br /><br />There are tools available to change a lot on the ROM hacking side, but I&#039;m not finding more than that about how the engine works.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  While wandering around in the void, I encountered a Battle Tower void with a negative map ID. I found interesting how the menu suddenly became far more limited, as if replicating a Battle Tower mode.<br /><br />[img]https://i.imgur.com/O7l7iLu.png[/img]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: vowel
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: vowel
icon: xx
body:
  I&#039;ve found something interesting while playing around in my Pearl version. I saved in front of the Oreburgh Pokemon Center, and then I used Pokesav to generate an AR code that would change my map coordinates to that of the HoO:<br />[code]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;we start out with offset=0, obviously<br />94000130 FCFF0000 ;if we are holding L+R:<br />B21C4D28 00000000 ;offset = read(offset + 0x21C4D28)<br />B0000004 00000000 ;offset = read(offset + 0x4)<br />100014A4 000001FE ;write(offset+0x14A4,0x1FE) (0x1FE = dec 510 = HoO map id)<br />10002866 0000012F ;write(offset+0x2866,0x12F) (x coordinate)<br />1000286A 000002F5 ;write(offset+0x286A,0x2F5) (y coordinate)<br />1000286E 00000002 ;write(offset+0x286E,0x2) (z coordinate)<br />D2000000 00000000 ;terminate code (reset offset to 0)[/code]<br />(I&#039;ve tried to annotate the generated code using data from here: http://doc.kodewerx.org/hacking_nds.html#action_replay )<br /><br />Now, something extraordinarily interesting happens if you hold L+R with this code active and keep walking:<br />[list]<br />[li]The game will keep reloading the overworld map, which means that it creates two or three copies of every walking NPC present (maybe it actually creates an infinite number of copies, but some are stacked on top of each other?);[/li]<br />[li]If you walk through a door holding L+R, it will load the graphics, music, and camera of HoO, but you will otherwise be in the area you should have been in. This is exactly what happens in the void as well: if you save in a void that is named Jubilife City (but is not map id 3, but one of the many higher undefined map ids), you will load the tileset, music, camera of the undefined map you&#039;re really in (an invalid map, so you get nothing, just blackness), but if you reload these things by opening the pokedex or your bag, they are loaded from the location you&#039;re really in - the OW;[/li]<br />[li]If you trigger script #1 (e.g. walk into the Oreburgh mine, talk to the first man you see) while holding L+R, the Arceus script is triggered! (If you trigger any other script, the script engine freezes - it&#039;s not a game freeze though, as the music keeps playing - and you have to reset.)[b][/b];[/li]<br />[li]Don&#039;t walk into a building, because the game will hard-freeze trying to superimpose the HoO&#039;s 3D camera onto the forced 2D perspective inside buildings.[/li]<br />[/list]<br /><br />[b]This means that Arceus might still be possible to find in the Void![/b] [i]If[/i] we happen to stumble upon an invalid map ID that the game considers to be HoO (just as many invalid OW map IDs are considered Jubilifes) in the void, and [i]if[/i] this map contains at least one script (e.g. an NPC), then we can trigger a battle with Arceus!<br /><br />Further investigation is needed.......<br /><br />[b]EDIT:[/b] well, that was easy... here&#039;s a lua script showing your current map id and x,y,z coordinates (PEARL ONLY, probably also works on Diamond? probably won&#039;t work on PT/HG/SS):<br />[code]local function whereami()<br />	local aslr_data_ptr = memory.readdword(0x021C4D28)<br />	local mapdata_ptr = memory.readdword(aslr_data_ptr + 0x4)<br />	local m = memory.readword(mapdata_ptr + 0x14A4)<br />	local x = memory.readword(mapdata_ptr + 0x2866)<br />	local y = memory.readword(mapdata_ptr + 0x286A)<br />	local z = memory.readword(mapdata_ptr + 0x286E)<br />	gui.text(1,184,string.format(&quot;Matrix: %d, X: %d, Y: %d, Z: %d&quot;,m,x,y,z))<br />end<br />gui.register(whereami)[/code]<br />it would be really really really awesome if someone could extend this to show the id of the map to your left, right, top, and bottom, and how many steps away those are...&nbsp; );


subject: I made a track using Gameboy Death sounds..
poster_name: Zhiqua
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  So as many of you have come across before countless times, exploiting glitches in R/B/Y often causes a long string of random sounds usually made up of pokemon cries and menu sounds which have been pitched and stretched. I decided to record a bunch of these sounds and make an EDM track out of it, titled &quot;Corruption&quot;. <br /><br /><br />Wondered what you guys thought? Been a lurker on here for a good few years now :)<br /><br />https://soundcloud.com/itssnyd/snyd-corruption-original-mix


subject: Re: Wiki Bug List and Reports
poster_name: Raltseye
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  One bug that occurs for me any way is that when I press submit changes the page goes blank, but the changes have been submited, I think, they atleast show up in the recent changes so I guess they do. Could someone fix this please :)


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: ~Poke~
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=vowel link=topic=7198.msg199147#msg199147 date=1443360479]<br />[b]This means that Arceus might still be possible to find in the Void![/b] [i]If[/i] we happen to stumble upon an invalid map ID that the game considers to be HoO (just as many invalid OW map IDs are considered Jubilifes) in the void, and [i]if[/i] this map contains at least one script (e.g. an NPC), then we can trigger a battle with Arceus!<br />[/quote]<br />This doesn&#039;t really add up to me. To have the Arceus script loaded, you need to be in the real HoO. To run the script, you need an event (npc or etc) set to run the script.<br /><br />The effects you&#039;re getting sound like they&#039;re from being &quot;In&quot; the real HoO (at least partially loading it) but having the rest of the data loaded from another map.<br /><br />I&#039;m not sure if that can be done through the void. The only scripts I&#039;ve seen run are the ones that start immediately on entering the map (Hall of Fame, Cynthia battle, getting kicked out of the restaurant at night, receiving the Pal Pad) because while in the void there aren&#039;t any npcs/signs/etc to trigger other scripts. Once you save, backtrack and enter the map you&#039;re actually in that map with npc data and all, so there&#039;s no different person to talk to to trigger the script.<br /><br />That said, I&#039;d love to be proven wrong. Perhaps if a Hall of Origin void can be found directly next to a real place, a tweak could be used to displace it, so you can be &quot;In&quot; it and talk to an npc from that real place. I don&#039;t like the odds of that showing up though, and I&#039;m not sure if any tweaks really work like that.<br /><br />[quote author=vowel link=topic=7198.msg199147#msg199147 date=1443360479]<br />[b]EDIT:[/b] well, that was easy... here&#039;s a lua script showing your current map id and x,y,z coordinates (PEARL ONLY, probably also works on Diamond? probably won&#039;t work on PT/HG/SS):<br />[code]local function whereami()<br />	local aslr_data_ptr = memory.readdword(0x021C4D28)<br />	local mapdata_ptr = memory.readdword(aslr_data_ptr + 0x4)<br />	local m = memory.readword(mapdata_ptr + 0x14A4)<br />	local x = memory.readword(mapdata_ptr + 0x2866)<br />	local y = memory.readword(mapdata_ptr + 0x286A)<br />	local z = memory.readword(mapdata_ptr + 0x286E)<br />	gui.text(1,184,string.format(&quot;Matrix: %d, X: %d, Y: %d, Z: %d&quot;,m,x,y,z))<br />end<br />gui.register(whereami)[/code]<br />it would be really really really awesome if someone could extend this to show the id of the map to your left, right, top, and bottom, and how many steps away those are...&nbsp; );<br />[/quote]<br /><br />Nice! I&#039;m running it on Pearl and the map matrix works perfectly! On the other hand the coordinates only change when I save, so I don&#039;t think they&#039;re reading the right thing?


subject: Re: Differences between English Ruby/Sapphire v1.0 and v1.1
poster_name: HÃ¡Äky
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7211.msg197749#msg197749 date=1424136929][b]PokÃ©mon name change on evolution[/b] ($803FB68 in v1.0 and v1.1)<br />This function is called when a PokÃ©mon evolves. It checks if the PokÃ©monâ€™s name is the same as the species it is evolving from, and if so, changes it to the name of the species it is evolving into.<br /><br />In version 1.1, this function has an additional check: if the PokÃ©mon originates from a non-English game, the name will not be changed on evolution. So, for example, if a Bulbasaur from an Italian or Spanish game (where all PokÃ©mon have the same names as in English) is traded to English Ruby/Sapphire v1.0, its name will be changed to â€œIVYSAURâ€ when it evolves, but in v1.1, its name will remain â€œBULBASAURâ€, as if that was a nickname.[/quote]<br />There may have been a good reason for changing this. Since Latin letters are available for nicknames in the Japanese Generation III games, itâ€™s possible, for example, to hatch a Pichu in a Japanese game, nickname it PICHU, trade it to English Ruby/Sapphire 1.0, and evolve it into a Pikachu named PIKACHU.<br /><br />â€¦Whatâ€™s so bad about that, you ask? Since the PokÃ©mon originated in a Japanese game, its name, which is now longer than five characters, will still be printed in the Japanese font, and when you open the party screen or send it into battle, it will [i]crash the game.[/i] (At least, it did when I tried it. I havenâ€™t looked into the exact cause yet.)<br /><br />[hr]<br /><br />Hereâ€™s a few things I missed the first time around. I believe this completes the list of changes in Ruby v1.1, although I still havenâ€™t checked for any changes exclusive to Sapphire.<br /><br />[b]Font metrics function[/b] ($80048E8 in v1.0 and v1.1)<br />This function looks up the pixel width of a text character in one of four tables, given some font information and the character code. In version 1.0, this function will always return a default value of 8 as long as offset 2 of the font data is [i]not[/i] set to 2. In version 1.1, it will return 8 if this offset [i]is[/i] set to 1. I presume the value being checked is a language code, because Japanese is language code 1, English is 2, and the Japanese fonts use a fixed width of 8 px while the English character widths need to be looked up in a table. Version 1.0 is returning the fixed 8 px width if the language is anything other than English, while version 1.1 only does this if the language is Japanese specifically, a change which was probably meant to accomodate the European localizations somehow. I donâ€™t know if this actually makes a difference anywhere.<br /><br /><br />[b]Text box overflow[/b] ($8146E50 in v1.0, $8146E70 in v1.1)<br />The functions at $8146E50, $8147048, $8147154, and $8147218 in v1.0 (add $20 for v1.1) were altered. I havenâ€™t figured out what these functions actually do or in what circumstances theyâ€™re called, but they display these text strings (along with the sprite of Prof. Birchâ€™s bag from the starter selection screen?):<br />[quote]Save failed.<br />Checking the backup memory...<br />Please wait.<br />â€œTime required: 1 minuteâ€<br /><br />The backup memory is damaged or<br />the internal battery has run dry.<br />The game can be played. However,<br />progress cannot be saved.<br /><br />â€œGameplay cannot be continued.<br />Returning to the title screen...â€<br /><br />Check completed.<br />Attempting to save again.<br />Please wait.<br /><br />Save completed.<br />â€œGameplay cannot be continued.<br />Returning to the title screen.â€<br /><br />Save completed.<br />â€œPlease press the A Button.â€[/quote]<br />In version 1.0, these messages are printed in a text box that has space for three lines, but some of them are four lines long, so the last line would be cut off at the bottom of the screen. In version 1.1, the coordinates were adjusted to make room for the fourth line.<br /><br /><br />[b]That room nobody uses[/b] ($81A45FE in v1.0, $81A461E in v1.1)<br />[quote]Welcome to the POKÃ©MON CABLE CLUB<br />RECORD CENTER.<br />You may mix your records as a TRAINER<br />with the records of your friends.<br />Would you like to mix records?[/quote]<br />In version 1.1, â€œRECORD CENTERâ€ was changed to â€œRECORD CORNERâ€.<br /><br /><br />[b]Font metrics table[/b] ($81E62DE in v1.0, $81E62F6 in v1.1)<br />There are four tables here which define how wide each character is in the gameâ€™s two Western fonts.<br /><br />The first tables (220 bytes each) are for the small font: the one used for PokÃ©mon names next to their health bars. For some reason, there are two identical copies of this table. The tables in version 1.1 have the expected changes to account for the modified [sup]er[/sup] glyph and the replacement of the characters ãƒƒ ãƒ£ ãƒ¥ ãƒ§ ã‚‡ with [sup]re[/sup] [sup]e[/sup] â€¹ â€º ; for French.<br /><br />The next tables (254 bytes each) are for the large font used for most text in the game. There are also two copies of this table, and in version 1.0 there are nine characters which have different widths in the two tables: Ã¬ ãƒ ã… ã‡ ã‚‡ Â¡ Ã¢ Ã­ ã‚®. The accented letters have 1â€“2 px of extra space in the first table, and the kana and inverted exclamation mark are 1â€“2 px narrower in the first table. Most notably, ã‚® is given a width of 6 px in the first table, which would cut off the right side of the glyph.<br /><br />It seems that the second table is used rather than the first:<br />[img]http://imgur.com/J6L6uKr.png[/img]<br />If the first table were used, it would theoretically look like this (done in an image editor):<br />[img]http://imgur.com/i13nBiY.png[/img]<br /><br />In version 1.1, the two tables are identical and are derived from version 1.0â€™s second table, with changes to account for the replaced and modified characters.<br /><br />I donâ€™t know if anything in the game uses the first table, but function $80048E8 is designed to use it if the right value is passed.<br /><br /><br />[b]Togepi Doll description[/b] ($83EAD1E in v1.0, $83EAD3A in v1.1)<br />[quote]A TOPGEPI doll.<br />Place it on a mat<br />or a desk.[/quote]<br />In version 1.1, the spelling of â€œTOPGEPIâ€ was corrected to â€œTOGEPIâ€. Unlike MAWHILE, this mistake doesnâ€™t seem to have been documented anywhere, and I guess thatâ€™s not really surprising, since the only way to obtain the Togepi Doll is by spending 48 BP in Emeraldâ€™s Battle Frontier and sending it back to Ruby/Sapphire via the Trader in Mauville City.


subject: Re: Differences between English Ruby/Sapphire v1.0 and v1.1
poster_name: Stackout
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: Wack0
icon: xx
body:
  [quote author=HÃ¡Äky link=topic=7211.msg199152#msg199152 date=1443436916]<br />The functions at $8146E50, $8147048, $8147154, and $8147218 in v1.0 (add $20 for v1.1) were altered. I havenâ€™t figured out what these functions actually do or in what circumstances theyâ€™re called, but they display these text strings (along with the sprite of Prof. Birchâ€™s bag from the starter selection screen?):<br />[/quote]<br /><br />I&#039;m interested myself to know when these functions are called. Via some google searching I saw an image of when one of those functions was called on Emerald, on real hardware, that was from a post on serebii.net forums, from December 2008: (I mirrored it to imgur; the original was on imageshack. Knowing imageshack, I&#039;m amazed I managed to download the image.)<br />[url=https://imgur.com/wY7lvwg]https://imgur.com/wY7lvwg[/url] (link, the original is 2048x1536..)<br /><br />Note how by Emerald, the message has changed, from &quot;The game can be played. However,\nprogress cannot be saved.&quot; to &quot;You can still play, but not save.&quot;<br /><br />I&#039;m sure I saw one of those messages in a youtube video somewhere also. No idea what video it was though.


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: vowel
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: vowel
icon: xx
body:
  [quote author=~Poke~ link=topic=7198.msg199151#msg199151 date=1443416866]This doesn&#039;t really add up to me. To have the Arceus script loaded, you need to be in the real HoO. To run the script, you need an event (npc or etc) set to run the script.[/quote]<br />You are completely right, but it depends on what the game considers to be &#039;in the real HoO&#039;. My point was mostly intended to rebut the standard &#039;we can&#039;t get Arceus through tweaking because Arceus won&#039;t appear in the HoO unless its flag has been set&#039;; I believe my findings show that we don&#039;t need to talk to the actual Arceus, we just need to talk to a script handler when the game thinks we&#039;re in the HoO. Doing this in the real HoO is impossible because the only script handler is Arceus, which isn&#039;t going to be present, but my findings open up the possibility that we might not need to be in the real HoO, just in an area that is *identified* as the HoO (just like many different areas are identified as Jubilife). Finding such an area, and also finding one that contains an NPC such as the seven star restaurant dude, is still an open, and perhaps impossible, challenge.<br /><br />[quote]The effects you&#039;re getting sound like they&#039;re from being &quot;In&quot; the real HoO (at least partially loading it) but having the rest of the data loaded from another map.<br /><br />I&#039;m not sure if that can be done through the void. The only scripts I&#039;ve seen run are the ones that start immediately on entering the map (Hall of Fame, Cynthia battle, getting kicked out of the restaurant at night, receiving the Pal Pad) because while in the void there aren&#039;t any npcs/signs/etc to trigger other scripts. Once you save, backtrack and enter the map you&#039;re actually in that map with npc data and all, so there&#039;s no different person to talk to to trigger the script.[/quote]<br />You are completely correct, so for an actual 510 HoO, we would still have to talk to the real Arceus, which is impossible. However, if we can find a non-510 (or 511) HoO that just happens to contain a script somewhere, we&#039;re in business. We know from the events you cite that this is possible (but apparently extremely unlikely).<br /><br />It would be interesting to find out what exactly are the requirements for a script to trigger. E.g., does the seven star restaurant dude kick you out when you&#039;re on a certain x,y position within the void, or do you also need to be on a certain invalid map id? Also, why do these scripts trigger automatically?<br /><br />[quote]That said, I&#039;d love to be proven wrong. Perhaps if a Hall of Origin void can be found directly next to a real place, a tweak could be used to displace it, so you can be &quot;In&quot; it and talk to an npc from that real place. I don&#039;t like the odds of that showing up though, and I&#039;m not sure if any tweaks really work like that.[/quote]This is an interesting thought. I guess in terms of realism it&#039;s no less hopeful than my ideas&nbsp; ;D<br /><br />[quote]On the other hand the coordinates only change when I save, so I don&#039;t think they&#039;re reading the right thing?[/quote]Indeed! I&#039;ve fixed x and y, but I wasn&#039;t sure where to find z. I&#039;ve searched around and found six possible candidate RAM locations, and I picked the one closest by, but if my z reading appears off, it probably is&nbsp; ;)<br />[code]local function whereami()<br />	local aslr_data_ptr = memory.readdword(0x021C4D28)<br />	local mapdata_ptr = memory.readdword(aslr_data_ptr + 0x4)<br />	local m = memory.readword(mapdata_ptr + 0x14A4)<br />	local x = memory.readword(mapdata_ptr + 0x14A4 + 8)<br />	local y = memory.readword(mapdata_ptr + 0x14A4 + 12)<br />	local z = memory.readword(mapdata_ptr + 0x14A4 + 0x6C99A)<br />	gui.text(1,184,string.format(&quot;Matrix: %d, X: %d, Y: %d, Z: %d&quot;,m,x,y,z))<br />end<br />gui.register(whereami)[/code]<br />This shows something interesting though: while the saved x,y,z coordinates versus your current x,y,z coordinates are stored in different RAM locations, the matrix id is only stored at one single location in RAM...


subject: Re: Differences between English Ruby/Sapphire v1.0 and v1.1
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Thank you for the research, HÃ¡Äky. I hope you can fill in some of the missing details soon :) <br /><br />[quote author=Wack0 link=topic=7211.msg199153#msg199153 date=1443448191]<br />I&#039;m sure I saw one of those messages in a youtube video somewhere also. No idea what video it was though.<br />[/quote]<br /><br />True Time Attack has a video showing them in Emerald.<br /><br />[youtube]https://www.youtube.com/watch?v=1lSPJwjnnUI[/youtube]


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  Nice going, you two ;) <br /><br />[quote author=~Poke~ link=topic=7198.msg199151#msg199151 date=1443416866]<br />That said, I&#039;d love to be proven wrong. Perhaps if a Hall of Origin void can be found directly next to a real place, a tweak could be used to displace it, so you can be &quot;In&quot; it and talk to an npc from that real place. I don&#039;t like the odds of that showing up though, and I&#039;m not sure if any tweaks really work like that.<br />[/quote]<br /><br />When you mean &quot;real place&quot;, are you referring to an actual location or a void area with the same map ID as said location?


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: vowel
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: vowel
icon: xx
body:
  [quote author=SatoMew link=topic=7198.msg199156#msg199156 date=1443461027]<br />Nice going, you two ;) <br /><br />[quote author=~Poke~ link=topic=7198.msg199151#msg199151 date=1443416866]<br />That said, I&#039;d love to be proven wrong. Perhaps if a Hall of Origin void can be found directly next to a real place, a tweak could be used to displace it, so you can be &quot;In&quot; it and talk to an npc from that real place. I don&#039;t like the odds of that showing up though, and I&#039;m not sure if any tweaks really work like that.<br />[/quote]<br /><br />When you mean &quot;real place&quot;, are you referring to an actual location or a void area with the same map ID as said location?<br />[/quote]<br />I think the hypothetical situation is if we were to find a new tweaking place (e.g. something other than Poketch HQ or Galactic HQ) where we end up with (real or fake, as long as they aren&#039;t Stickyman) HoOs, rather than, say, Veilstones (or Mt Starks - on my Pearl, I used to have a Mt Stark, then I received the Pal Pad inside the void and I&#039;ve had the usual Veilstone department stores ever since) or Floaroma Meadows.<br /><br />If you use pokesav to place yourself into the void surrounding the HoO and start walking, you run into Iron Islands and Solaceon Ruins. If only we knew where these areas were read from, we could extrapolate where we would need to enter the void in order to get HoOs.... (keep in mind we can enter the void from any building we want, even buildings that are untweakable, by performing the regular void glitch and saving behind the building&#039;s door when in FS).<br /><br />[b]EDIT:[/b] Figured something out. Walk into the Jubilife pokemon center, save your game, then use pokesav to change your map coordinates to 510,6,9,0. When you reload, you&#039;ll be in the HoO but with the Jubilife pokemon center&#039;s NPCs. Talk to the little girl in front of you to trigger a battle with Arceus. Now change your coordinates to 510,13,5,0. You&#039;re in front of a different person now, yet talking to him will also trigger Arceus.<br /><br />This means that more than just one single script can trigger Arceus (but not all of them, e.g. Nurse Joy doesn&#039;t say &#039;Dodogyuuun&#039; now :P ). Given that I just demonstrated that you keep the NPCs from the last map you save in, we will for sure trigger a battle with Arceus if, starting from a void area X, we manage to - [i]without saving and resetting[/i] - find a HoO void when our x and y positions are at values that put us next to NPCs on our original map X.<br /><br />If only we knew where the &#039;next map id&#039; bits were stored in memory, we might be able to write a lua script that determines whether the HoO is reachable from any given position...


subject: Re: &quot;Void Knowledge Archive, by the members of HallofOrigin&quot;
poster_name: SatoMew
poster_email: *****@*****
poster_ip: ***.***.***.***
modified_name: SatoMew
icon: xx
body:
  Well, I asked for clarification because I have already reached a real Hall of Origin void (I posted about it earlier). But the voids surrounding it are the same ones bordering the Hall of Origin itself.<br /><br />[b]EDIT:[/b] Here&#039;s yet another real Hall of Origin void which may or may not be the same one I found earlier. I only went west and south of 319W this time around.<br /><br />[img width=545]https://i.imgur.com/qlHHS4u.png[/img]


subject: Free picture-in-picture/splitscreen software/websites
poster_name: VaeporSage
poster_email: *****@*****
poster_ip: ***.***.***.***
icon: xx
body:
  It&#039;s immensely frustrating that neither Movie Maker nor any free stuff I find can do something as utterly rudimental as play two videos at the same time. Can anyone recommend any way for me to put a video on top of/beside another video (in a Movie Maker-like program, ideally) without have to pay money for such a ridiculously simple task?


