# Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

## Arbitrary Code Execution Discussion

### Pokémon Yellow: How to access (glitch) Trainers other than the standard 56 - Page 1

Previous Page

- 1

Next Page

#### Pokémon Yellow: How to access (glitch) Trainers other than the standard 56

Posted by: Torchickens
Date: 2019-01-04 13:42:06
This has been available with Game Genie for a while now (Wack0 provided the theory and I generated the codes), but the trouble with this is that the physical Game Genie doesn't like Pokémon Yellow's cartridge type; bringing up a blank screen if you use it. For reference however, the Game Genie codes to do this are: 3E0-2E9-B31 XX0-2F9-C49 (where XX is the Trainer class you want, equivalent to Trainer escape glitch ID minus 200). All you have to do for this method is battle any Trainer, and it will become the desired Trainer or glitch Trainer.
Now however, you can do this with ACE eliminating the need for Game Genie or ROM hacking.
Requirements:
0) To have mastered Celadon looping map glitch and to know how to destroy Cancel buttons.
1) ws m (0x63) bootstrapped to D321. C3 21 D3 at 0xDA7F will do the trick. You can use map script abuse or connection copier to write these values.
2) 4F (0x59) bootstrapped to D330. C3 30 D3 at 0xDA64 (technically 0xFA64; this might matter if you're using a bad emulator) will do this. This can be achieved with the same methods as 1).
3) The following code beginning from item 3 (no unterminated-name or lag glitch items, however those should be avoided with B-Button when you encounter them with Celadon looping map glitch):
Steps (code/items from below must be stored in the memory):
1) Use ws m. It appears 'nothing happened', but it actually copied data from ROM into RAM at DA7F (stored Pokémon).
2) Adjust Lemonade x0's quantity and use 4F immediately after using ws m to enter the battle with a Trainer class based on Lemonade's quantity.
@D321 (item 3) (routine copier)
ld a,3d
ld hl,5ff2
ld bc,0244
ld de,da7f
call 009d
ret
: Calls FarCopyData with source as 3D:5FF2, bytes to copy as 0x244 and destination as DA7F (modifies ws m)
@D330 (item 10 quantity) (pseudo-Game Genie and battle activator)
ld hl,dabb
ld a,3e
ldi (hl),a
inc b
ld a,(desired trainer class; d338)
ldi (hl),a
inc b
ld a,ff
ld (d058),a
inc b
inc b
ld b,3d
ld hl,da7f
call 3e84
ret
: 'Patches' DABB. This should be sub a,c8 (take the Trainer escape ID and subtract 200 to get Trainer class) but instead we change it to ld a, xx; allowing us to battle any Trainer class we want. D058 is set to a non-00 value, the bank is switched back to 0x3D and we run the code we copied to DA7F and modified with the patch.
The entirety of this code fills the item pack and touches money byte 1, so don't win any money from the trainer if you want to battle more than one in one session. The unique Trainer AIs you can access this way however may stop you and result in a freeze. TM55 (Trainer (actual):255) has an interesting AI which sends you to Victory Road.
The item list from item 3 is as such:
i3: Lemonade x61
i4: Thunderstone x242
i5: 10F x1
i6: X Special x2
i7: Max Potion x127
i8: TM18 x205
i9: Item 0x9D (#PkMn p# ##KE '#4) x0
i10: TM01 x33
i11: Item 0xBB (##) x218
i12: Lemonade x62
i13: Water Stone x4
i14: Lemonade x(desired (real) Trainer class ID)
i15: Water Stone x4
i16: Lemonade x255
i17: TM34 x88
i18: TM08 x4
i19: Poké Ball x6
i20: Soda Pop x33
i21 (normal end/money 1): Item 0x7F (# #### ### #####u#) x 218
i22 (money 2/3): TM05 x132
i23 (rival name 1/2) : Lemonade x201
You may also download the "all glitch trainers" save from my Google Sites, import it, and modify item 14's quantity to explore all 256 Trainers. Note the Lemonade x0 means Lemonade x256. You can toss from this quantity as if it was valid, to access roster 256 (no tossing) or rosters 1-255 (tossing).
Link: https://sites.google.com/site/torchickens2/pokemon-save-files
Unfortunately rosters are unsupported as of now. I'm unsure how to implement them but it may be possible.
Have fun glitching! :)

#### Re: Pokémon Yellow: How to access (glitch) Trainers other than the standard 56

Posted by: SloshedMail
Date: 2019-02-08 12:41:33
I will make a video showcasing these on Virtual Console Yellow - though it will require a little further testing in advance.
Please go to the next post.

#### Re: Pokémon Yellow: How to access (glitch) Trainers other than the standard 56

Posted by: Torchickens
Date: 2019-02-08 13:34:57
Cool! Thanks SloshedMail. :)

#### Re: Pokémon Yellow: How to access (glitch) Trainers other than the standard 56

Posted by: SloshedMail
Date: 2019-02-12 16:11:11
This took slightly longer than I thought.
https://www.youtube.com/watch?v=fs0sKbxmh_M
Edit: 30:13

#### Re: Pokémon Yellow: How to access (glitch) Trainers other than the standard 56

Posted by: Sherkel
Date: 2019-02-12 17:44:30
Wow, that was sudden in the best of ways! Welcome back and thank you for all that documentation. I may even end up watching through the whole thing.
Previous Page

- 1

Next Page