# Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

## Generation II Glitch Discussion

### Crystal arbitrary code execution guide with setups for all three methods - Page 1

Previous Page

- 1

Next Page

#### Crystal arbitrary code execution guide with setups for all three methods

Posted by: Krys3000
Date: 2018-01-21 14:00:11
IMPORTANT UPDATE: THIS GUIDE HAS NOW BEEN INTEGRATED TO THE The newcomer and experienced user's guide to G/S/C Arbitrary Code Execution!. PLEASE PREFER READING THE WHOLE GUIDE RATHER THAN THIS CRYSTAL EARLY WORK
Hello there,
Since Pokémon Crystal gets released on Virtual Console in a few days, I thought it was the right time to write a guide for newcomers who wants to perform Arbitrary Code Execution in this version. This somehow follows my previous guide to G/S ACE, and I think at some point I could merge both together in one big G/S/C ACE guide. I just didn't wanna do that at this point since this is an early work in which I hope you could contribute. Any comments are welcomed!
Many thanks to everyone who helped me writing this on Discord: Crystal_ for the Bad Clone ACE setup, luckytyphlosion for the mail buffer and the discovery of TM15, Epsilon and ISSOtm for their current work on OAM DMA Hijacking
What are the three ACE methods in Crystal?
If you are familiar with ACE in G/S, you probably have heard of Coin Case Glitch, which is an english-only ACE method available in G/S. This doesn't work in Crystal games. You also probably know that it is not the mostly used method in G/S, because Wrong Pocket TM ACE is more permissive. Well, Wrong Pocket TM ACE can also be performed in Crystal, but unfortunately not without using another ACE method before.
Another method is Bad Clone ACE. This somehow can be considered the best method to start ACE in Crystal, because it's easier to setup than other ACE methods and can be performed early in the game. However, the code execution can only be done from a PC, and this may limit your possibilities with the glitch. I would personally recommend to use this method in order to setup the Wrong Pocket TM ACE ; and this is something this guide will teach you to do.
The last method is the Glitch Pokédex ACE which I prefer over the Bad Clone ACE (although this method is clearly not as good as the Wrong Pocket TM ACE), because the code is executed by opening the Pokédex and therefore, it can be done anywhere. However, the setup I present here for this is hard to get early in the game, and this can be a problem for you…
Note that EVERY METHOD uses a Bad Clone. Before freaking out, two things should be pointed here:
- The Bad Clone ACE can use any type of Bad Clone, including Pseudo-Bad Clones (Bad Clone without names but everything else is normal) and False Bad Clones (Bad Clones without names and with every data at 0 but still keeping their original Pokédex ID)
- The two other methods won't, but it's no big deal because in Crystal, you can convert Pseudo and False Bad Clones into Bad Clones that can be used for any method. To do this, store the Bad Clone in a PC Box and store 5 other Pokémon in that same box. Then, use the withdraw option to display that box. Leave it and use the withdraw option again. All Pokémon are now Kingdra. Withdraw the Bad Clone and you can now use it (in case of trouble with getting the Kingdra, please read this).
What is important here is that you can still execute code from items, from box names, OR from the mail buffer. However, if you're playing FRENCH OR GERMAN VERSION, YOU CAN'T COMPOSE CODES WITH BOX NAMES CHARACTERS. You won't have any problem with mail characters, though.
I. Wrong Pocket TM ACE adapted for Crystal version
Much like in G/S, Wrong Pocket TM ACE relies on a TM obtained in the Balls Pocket using luckytyphlosion's Item Shifting Glitch. This glitch works in Crystal games, however in this case, the TM you would need is TM15, not 17. Therefore, you would need to keep 206 Ultra Ball instead of 208. Of course, it is also possible to use another ACE method to get yourself TM15 in the Wrong Pocket.
Then, once again much like in G/S, you will need to catch a Quagsire (or evolve any Wooper). This Pokémon must have RETURN as first move and hold TM50 (to execute from FIRST STORED ITEM), or must have SAFEGUARD as first move (this can only be taught through breeding!) and hold MIRACLE SEED or THICK CLUB (to execute from respectively FIRST OR SECOND CHARACTER IN BOX 1 NAME), or must have RAIN DANCE as first move and hold no item (to execute from mail buffer). Place this Quagsire as first in the team everytime you execute code. I recommend to prepare 3 Quagsire and change it when needed.
Now comes the catch: you need to use any other ACE method to write C3 DF FC to addresses $DA10 to $DA12. There are numerous ways to do that, and with luckytyphlosion we think of writing as soon as possible a code that does it and gives TM15 in the wrong pocket at the same time. In the meantime, here's a unergonomic yet functional box code.
PP Up x252
TM42 x18
TM27 x3
TM10 x(any quantity)
Any other items in any quantities can go from here on
After executing the code once, toss 29 PP Up and 1 TM42 and execute again. Now toss 28 PP Up and 1 TM42 and execute a third time.
With all this done, you can save and you are now ready to execute any code in Crystal using your TM15.
II. Bad Clone ACE: easy but limited
This method has been discussed on some threads here, so I thank everyone involved in it, especially luckytyphlosion and once again Crystal_
There are two different setups available for this ACE method. Crystal_'s one is quick but only works if executing code from ITEMS or BOX NAMES ; luckytyphlosion's one can be used to execute code from the MAIL BUFFER instead.
Crystal_'s setup for ITEMS OR BOX CODES

[li]Have a Bad Clone stored in the PC, the same way you would have obtained one for Item Shifting Glitch or a simple Bad Clone Trick. The best is not having any other Pokémon in the box, so they don't get corrupted.[/li]
[li]Have a Max Elixer or TM21 (FRUSTRATION, giveaway if your first Pokémon is sad at Goldenrod Store), in the bag.[/li]
[li]Catch a Quagsire (or evolve any Wooper). This Pokémon must have RETURN as first move (to execute from FIRST STORED ITEM), or must have SAFEGUARD as first move (to execute from respectively from BOX 1 NAME - this can only be taught through breeding!). Put it in the first slot of your team.[/li]
[li]Catch a Spearow and make it hold TM50 (NIGHTMARE, obtained on Route 31, after completing the mail quest) to execute code from FIRST STORED ITEM or make it hold MIRACLE SEED or THICK CLUB to execute from respectively character 1 or 2 in BOX 1 NAME. This Pokémon must be second in the team.[/li]

The code execution is then performed this way:

[li]Save and reset in front of a Pokémon Center.[/li]
[li]Enter the Center, go up until reaching the healing machine, go right until hitting the wall, go up to the PC. These steps are very precise, don't do any other pattern.[/li]
[li]Open the bag, place the cursor on the Max Elixer or TM21 but DON'T CLICK ON IT. Leave the bag.[/li]
[li]Use the deposit option on Bill's PC to view Quagsire's profile. Go to its moves page, then exit Quagsire's profile and hit down to display Spearow's sprite. Don't click on it.[/li]
[li]Exit the deposit menu, and use the withdraw option to view the box containing the Bad Clone. You'll see a bunch of "?" but it will also execute code![/li]

luckytyphlosion's setup for MAIL CODES
Here's a pastebin that roughly explains this setup: https://pastebin.com/DaWmYHLF
Please note that you must introduce "4AA" before starting your mail code. Otherwise, s**t will happen.
III. Glitch Pokédex ACE: hard but powerful
You will see that this method is not perfect, but once it's setup the first time, it's practical. In fact, if you intend to setup the TM15 for Wrong Pocket TM ACE, don't bother using this - Bad Clone ACE is way faster.
First, you must perform luckytyphlosion's Item Shifting Glitch in a certain way that I coined 'Double Item Shifting Glitch'. The catch here is that you want to get 255 items (Expanded Balls Pocket) but item 00 ("?") freezes the game when you place the cursor on it, so you need to make sure that there won't be an item 00 before stored items in the Expanded Balls Pocket. In order to avoid this,

[li]Have 3 Mystery Egg in the Key Items, instead of 2 (the pocket must still be filled)[/li]
[li]Have Ultra Ball x1 followed Poké Ball x2 in the Balls Pocket[/li]
[li]Place 2 Mystery Eggs at the bottom and swap them[/li]
[li]Go to the Balls Pocket and swap Master Ball x5 with Ultra Ball x255[/li]
[li]Fill your Balls Pocket by any mean[/li]
[li]Store the bottom-most Mystery Egg, then take it back[/li]
[li]Do the trick again with the 2 remaining Mystery Egg[/li]
[li]Store the remaining Mystery Egg, then take it back[/li]

While doing this, you will also need three stored items:

[li]TM19 (GIGA DRAIN, obtained at the Radio Tower or at Celadon's store)[/li]
[li]TM29 (PSYCHIC, given by some NPC in Saffron City or obtained at Celadon's Game Corner)[/li]
[li]Any item with a quantity of 9[/li]

You will then need to catch a Quagsire (or evolve any Wooper). This Pokémon must have RETURN as first move and hold TM50 (to execute from FIRST STORED ITEM), or must have SAFEGUARD as first move (this can only be taught through breeding!) and hold MIRACLE SEED or THICK CLUB (to execute from respectively FIRST OR SECOND CHARACTER IN BOX 1 NAME), or must have RAIN DANCE as first move and hold no item (to execute from mail buffer). Place this Quagsire as second in the team everytime you execute code. I recommend to prepare 3 Quagsire and change it when needed.
Unlike the other methods and much like in G/S, you will need a 'Slide Pokémon' in first position of party. To get it, catch either:
- a Bellsprout in Violet City that you raise at lvl5 then trade for Rocky the Onix with the NPC in Violet City.
- an Abra that you raise at lvl13 then trade for Muscle the Machop with the NPC in Goldenrod Departement Store.
- a lvl2 Sentret in Route 29, that doesn't have a 6 in its SP. DEF. stat (if so, catch another - this stat value appears in 31.25% of lvl2 Sentret).
Onix, Abra or Sentret must then never win any battle, or you won't be able to use it anymore.
Open the Balls Pocket and slide down, you will see the PC Items after the CANCEL that follows the last ball (although only the description might show up). Using SELECT, place the x9 item at position 65, the TM19 at position 165, and the TM29 at position 166.
With this done, everytime you use the Pokédex, code gets executed!
Redirect an execution from items to box names
If you don't feel like breeding a Wooper to get SAFEGUARD or get one of the two crap items that are used to execute box codes, you can also use this item code which will act as a redirection to box names.
Awakening x3
Paralyz Heal x3
Poké Ball x38
TM28 x3
Ultra Ball x46
Ragecandybar x44
X Attack x35
TM41 x(any quantity)
Code will now be executed from character 1 of box name 1.
Can I use a G/S code on my Crystal
Depends. I won't provide box codes translation, but here are translations for some item codes of the the G/S guide.

[li]In the INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE, change the quantity of Fresh Water to 7. The first two items must be Awakening x3 and Paralyz Heal x3[/li]
[li]In the GET ANY ITEM CODE, change the quantity of Fresh Water to 6. The first two items must be Awakening x3 and Paralyz Heal x3[/li]
[li]In the MEMORY EDITOR CODE, A.K.A. GAMESHARK SIMULATOR, the first two items must be Awakening x3 and Paralyz Heal x3[/li]
[li]In the MAKE THE SIXTH POKEMON IN PARTY SHINY CODE, change the quantity of X Accuracy to 228, and the TM28 x62 to a TM29 x62. The first two items must be Awakening x3 and Paralyz Heal x3.[/li]

How to trigger the Celebi Event
Here is the code.
Great Ball x62
TM02 x38
TM27 x46
Carbos x45
Leaf Stone x04
TM10 x(any quantity)
Then, talk to Kurt to receive the GS Ball. You can now go to Ilex Forest and trigger the event!

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Fortranm
Date: 2018-01-21 14:24:06
I remember it's stated that you will be able to get GS Ball legally in this release after beating the game once, but it's good to have a way to trigger it earlier nonetheless.

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Krys3000
Date: 2018-01-22 07:03:58
Yep, that's true for the Celebi event.
But anyway, we can make a box code allowing to encounter any Pokémon with OAM DMA Hijacking, as we do in G/S :)
EDIT: Modified the Glitch Pokédex process a bit

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Couldntthinkofaname
Date: 2018-01-22 08:26:37

> But anyway, we can make a box code allowing to encounter any Pokémon with OAM DMA Hijacking, as we do in G/S :)

I'm away from my PC at the moment (I lack Crystal anyhow),but try (with Wrong Pocket):
`
A p 0 'm é J 9 5
p 0 - é K 9 5 5
p 0 2 é L 9 5 5
p 'v 6 é (male) 2 5 5
p 0 9 'v é y y y
y y é A 'm p 'd
`
and see if that forces Celebi to appear in the wild.
Edit: Fixed mistake. Still unsure if it will work.
Edit2: I confirmed this not to work. I am working on a fix.

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Couldntthinkofaname
Date: 2018-01-23 07:49:05
Apologies for double posting.
Ok, so as the Discord conversations have indicated this wont be the "quick fix" I had anticipated. For my own sake, and for others, it has become necessary to map out the Characters that can be used to Represent areas of the box name, similar to what Spamviech did with G/S. (Self-modding in Crystal is done with é*5)
(Characters with _ are not directly reachable, and characters behind | are end-terminators)
`
$DB75 - $DB7D: _ _ _ _ _ _ _ _ | _
$DB7E - $DB86: _ (space) A B C D E F | G
$DB87 - $DB8F: H I J K L M N O | P
$DB90 - $DB98: Q R S T U V W X | Y
$DB99 - $DBA1: Z ( ) : ; [ ] a | b
$DBA2 - $DBAA: c d e f g h i j | k
$DBAB - $DBB3: l m n o p q r s | t
$DBB3 - $DBBC: u v w x y z _ _ | _
$DBBD - $DBC5: _ _ _ _ _ _ _ _ | _
$DBC6 - $DBCE: _ _ _ _ _ _ _ _ | _
$DBCF - $DBD7: _ 'd 'l 'm 'r 's 't 'v | _
$DBD8 - $DBE0: _ _ _ _ _ _ _ _ | _
$DBE1 - $DBE9: (PK) (MN) - _ _ ? ! . | &
$DBEA - $DBF2: é _ _ _ _ (male) _ * | _
`
Thankfully, it seems box names in Crystal are somewhat easier to self-modify.

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Krys3000
Date: 2018-01-23 12:29:53
A lot more new ACE insight have come up on Discord, thanks to luckytyphlosion. I will update the whole thread tomorrow if possible :)

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Krys3000
Date: 2018-01-25 07:54:15
I have entirely modified this guide with new advances in the field. Many thanks to everyone who contributed to the work on Discord.
Please note that this is the advised way to proceed to Crystal ACE:
- Use Bad Clone ACE to give yourself TM15 in the Wrong Pocket, and to write what is needed at $DA10 to $DA12.
- Use Wrong Pocket TM ACE with the Quagsire that suits your needs to execute whatever you want to.

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Inkblot
Date: 2018-01-29 13:39:08
I have a few questions regarding setting up the tm 15 method. How would you get 252 PP ups to get the tm 15? or, what would be the box code to get tm 15 in the items pocket if using that method? also, How would you know when you have a bad clone? I ask this as I tried getting a bad clone in GS, but i didn't have a box that had never been filled, and the closest i got was a clone that had the species of the pokemon i was cloning, but the moves and name of the pokemon that was previously in the box. Would that have gotten me a bad clone had the box never been filled before? also, when trying to get the bad clone in crystal, is the idea to turn off the power earlier than normal? I ask as i did the cloning glitch a few times and I found when i did it too early, no clone was made. so i was wondering if you are supposed to hit a sweet spot where you are late enough for the cloning to start, but early enough that the clone doesn't happen properly and you get a bad clone.
EDIT: After looking over the G/S guides and this guide again, I Instead want to ask if there is a way to get all the TMs in crystal using an item ACE set up, as all the item codes in the G/S require TM 10 and TM 23, which can't be obtained till very late in the game.

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Krys3000
Date: 2018-01-29 17:19:43
So many questions :p
How would you get 252 PP ups to get the tm 15?
=> One way to do that is to execute the code 'INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE' twice on a PP Up x1 using another ACE method before (i.e. Bad Clone ACE) to get it to x255 and then toss 3. This code is available in the general guide that I am currently updating for Crystal. For the code to work in Crystal, change the quantity of Fresh Water to 7 and do not have the first two items (start with Fresh Water as item 1).
EDIT: This however is not the code to get TM15, but the jump config code (which is mandatory, no matter how you get TM15).
or, what would be the box code to get tm 15 in the items pocket if using that method?
=> Good question. In english games, such a code hasn't been made yet but I hope it will be done asap, as it would provide a good alternative to the 252 PP Up issue. What I can tell you is that in french games (where box codes cannot be made), a mail buffer equivalent code would be p0îj'9j'9ém'm'n'
How would you know when you have a bad clone?
=> The clone would have "??????" as name (in Crystal).
I tried getting a bad clone in GS, but i didn't have a box that had never been filled, and the closest i got was a clone that had the species of the pokemon i was cloning, but the moves and name of the pokemon that was previously in the box. Would that have gotten me a bad clone had the box never been filled before?
=> Yes, absolutely :)
when trying to get the bad clone in crystal, is the idea to turn off the power earlier than normal
=> Exactly as it is in G/S, but in Crystal, cloning can only occur if you reset after the final dot of "DON'T TURN OFF THE POWER." appears. So you need to reset IMMEDIATELY after the dot appears to get a Bad Clone.
After looking over the G/S guides and this guide again, I Instead want to ask if there is a way to get all the TMs in crystal using an item ACE set up, as all the item codes in the G/S require TM 10 and TM 23, which can't be obtained till very late in the game.
=> Like what we do in G/S, you could use a box code that would give you any TM x255. This code doesn't exist so far to my knowledge in Crystal but I hope someone does it soon. Another (annoying) solution is to use the Bad Clone Trick to generate these items.
Hope you got everything you need :)

#### Re: Crystal arbitrary code execution guide with setups for all three methods

Posted by: Inkblot
Date: 2018-01-29 17:46:11

> So many questions :p
> How would you get 252 PP ups to get the tm 15?
> => One way to do that is to execute the code 'INCREASE/DECREASE THE QUANTITY OF AN ITEM CODE' twice on a PP Up x1 using another ACE method before (i.e. Bad Clone ACE) to get it to x255 and then toss 3. This code is available in the general guide that I am currently updating for Crystal. For the code to work in Crystal, change the quantity of Fresh Water to 7 and do not have the first two items (start with Fresh Water as item 1).
> EDIT: This however is not the code to get TM15, but the jump config code (which is mandatory, no matter how you get TM15).
> or, what would be the box code to get tm 15 in the items pocket if using that method?
> => Good question. In english games, such a code hasn't been made yet but I hope it will be done asap, as it would provide a good alternative to the 252 PP Up issue. What I can tell you is that in french games (where box codes cannot be made), a mail buffer equivalent code would be p0îj'9j'9ém'm'n'
> How would you know when you have a bad clone?
> => The clone would have "??????" as name (in Crystal).
> I tried getting a bad clone in GS, but i didn't have a box that had never been filled, and the closest i got was a clone that had the species of the pokemon i was cloning, but the moves and name of the pokemon that was previously in the box. Would that have gotten me a bad clone had the box never been filled before?
> => Yes, absolutely :)
> when trying to get the bad clone in crystal, is the idea to turn off the power earlier than normal
> => Exactly as it is in G/S, but in Crystal, cloning can only occur if you reset after the final dot of "DON'T TURN OFF THE POWER." appears. So you need to reset IMMEDIATELY after the dot appears to get a Bad Clone.
> After looking over the G/S guides and this guide again, I Instead want to ask if there is a way to get all the TMs in crystal using an item ACE set up, as all the item codes in the G/S require TM 10 and TM 23, which can't be obtained till very late in the game.
> => Like what we do in G/S, you could use a box code that would give you any TM x255. This code doesn't exist so far to my knowledge in Crystal but I hope someone does it soon. Another (annoying) solution is to use the Bad Clone Trick to generate these items.
> Hope you got everything you need :)

XD i am so sorry for all the questions. But thank you for answering them all! I was hoping to get the items i needed for crystal ACE before i leave goldenrod, but it looks like i might just have to wait till i can get tm 10 and tm 23 the normal way, and then just use the cloning glitch to get the amount i need. but this does clear up a lot of things i was wondering, like the bad clone issue i had. i'll defiantly save a box in crystal for use in getting the bad clone, so i don't have the same issue. also i wish you guys luck in getting the box codes you need! thanks again!
Previous Page

- 1

Next Page