Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

Question about Glitch City - Page 1

Question about Glitch City

Posted by: camper
Date: 2012-08-08 14:01:04
I read from the wiki that the game tries to put you to wrap 4 of whatever map you're in when the PA rings.
However, Route 7 and 8 only seem to have 3 wrap points each, but having a valid wrap 4 (hence no glitch cities).
Can someone explain this? :???:

Re: Question about Glitch City

Posted by: Torchickens
Date: 2012-08-09 07:07:20

I read from the wiki that the game tries to put you to wrap 4 of whatever map you're in when the PA rings.
However, Route 7 and 8 only seem to have 3 wrap points each, but having a valid wrap 4 (hence no glitch cities).
Can someone explain this? :???:


These codes change the warp point a southern exit will take you in Red/Blue:

01xxB5D3
01xxB1D3

Activate both and you can change where you end up.


When you enter the Safari Zone gate the game loads these values as '04', so the exit actually takes you to 'warp 5', since 00 counts as the first warp. I'll make this clear on the article. The address at WRA1:D73B also changes, but you don't need to activate it for some reason.


There are two Route 7 maps, 0x12 (East of Celadon/West of Saffron) and 0x4C (Saffron gate). The article isn't entirely right, when you run out of steps in the Saffron gate the game will load exit 4 of the East of Celadon map.


Warp 0x04 happens to be the exit to Underground Path. The first invalid warp is warp 0x05; so the Safari Zone glitch won't work with Route 7, and it takes you here.

[img]http://i.imgur.com/pGKE2.png[/img]


Here are images for Route 7 warps ranging from 0x00 to 0x05.


Route 8 is similar. It seems to share the warps of other Route 8 maps. Like Route 7, valid values range from 0x00 to 0x04.

Warp 0x04 takes you here:

[img]http://i.imgur.com/eeXBB.png[/img]

Here are images for Route 8 warps.

Re: Question about Glitch City

Posted by: camper
Date: 2012-08-09 08:59:49
But why do the wraps 0x00 and 0x02 seem not working? For instance, I can't go left from the 0x00 exit point to the gatehouse. From the gatehouse, however, I can take the upper exit tile and exit at that wrap point.

There are two types of maps, the outdoor ones (routes, cities) and the indoor ones (caves, buildings, underground tunnels, Safari Zone). These two types of maps behave quite differently. When you run out of steps, the game will take you to the last outdoor map you were in. (I believe there's a byte storing it? Edit: Found it. 0xD365 is set to last outdoor map visited when entering an indoor map) So entering the gatehouse has the same results as staying in Route 7.

And do you mean if the map has fewer than 5 valid wraps, the game will take you to glitch city?

*looking for a outdoor map with exactly 4 wraps as an example, but can't find any*
Oh right, Route 18 has 4 wraps.

*tries taking the last step in Route 18*
*ends up in glitch city*
Guess you're right.

Re: Question about Glitch City

Posted by: Torchickens
Date: 2012-08-11 15:41:59

But why do the wraps 0x00 and 0x02 seem not working? For instance, I can't go left from the 0x00 exit point to the gatehouse. From the gatehouse, however, I can take the upper exit tile and exit at that wrap point.

There are two types of maps, the outdoor ones (routes, cities) and the indoor ones (caves, buildings, underground tunnels, Safari Zone). These two types of maps behave quite differently. When you run out of steps, the game will take you to the last outdoor map you were in. (I believe there's a byte storing it? Edit: Found it. 0xD365 is set to last outdoor map visited when entering an indoor map) So entering the gatehouse has the same results as staying in Route 7.

And do you mean if the map has fewer than 5 valid wraps, the game will take you to glitch city?

*looking for a outdoor map with exactly 4 wraps as an example, but can't find any*
Oh right, Route 18 has 4 wraps.

*tries taking the last step in Route 18*
*ends up in glitch city*
Guess you're right.




I don't know the exact answer to this. Some exits in Red/Blue won't necessarily place you in areas where you can walk back in. Take the upper-tile here:

[img]http://i.imgur.com/lLRqE.png[/img]

…and you'll end up here (facing right), without being able to take one step back in:

[img]http://i.imgur.com/WJaPh.png[/img]


If we assume D3B5 and D3B1 account for all real exits, and not just the exits from walking south, value $02 might be unused.

In $02 you get placed on top of an obstacle:

[img]http://i.imgur.com/R6YOp.png[/img]


But when you step out from here

[img]http://i.imgur.com/iM9ZR.png[/img]

… The game loads where value $03 is.

[img]http://i.imgur.com/HKGqp.png[/img]




There are two types of maps, the outdoor ones (routes, cities) and the indoor ones (caves, buildings, underground tunnels, Safari Zone). These two types of maps behave quite differently. When you run out of steps, the game will take you to the last outdoor map you were in. (I believe there's a byte storing it? Edit: Found it. 0xD365 is set to last outdoor map visited when entering an indoor map) So entering the gatehouse has the same results as staying in Route 7.


Thanks camper. That explains why I was taken back to Route 7 instead of the Route 7 Gate.

I've learned that you can walk to other routes without having D365 change (e.g. Fly to Viridian City and walk to Pallet Town, and D365 won't change from 01, to 00)


When you track D365, the byte is updated under the following circumstances.

1) You fly to another location.

Note: If you change D71A (changes the fly destination) to an indoor map, you'll go to that map and the game will set D365 to it.


2) You walk into an 'indoor' location.


3) You warp to your blackout location.


4) You beat the game and watch the end of the credits, in which case D365 is set to $00.


5) Maps may have scripts that constantly change the address provided you're on the map.

Some maps like Hall of Fame have special 'level-script pointers' which are constantly loaded into memory at D36E-D36F. Diglett's Cave (Route 11) [map $55] is an example with a level script pointer that constantly writes to D365.

This is how Pokémon Yellow was beat with the save glitch without having to leave the room. The level-script pointer was set to a certain pointer. The map number was then changed to a certain value that uses '3C' as a bank, in such a way that the game loads data from the offset where the 'walk up to Hall of Fame' script is. (more below)


Why does Diglett's Cave constantly write to D365:


When you step into the Diglett's Cave entrance on Route 11 the values are loaded as BA, 65.  Let's swap the endianness and interpret it as 65, BA.

To deduce the offset you have to know which bank the script is.

00000-03FFF -> ROM Bank 0
04000-07FFF -> ROM Bank 1
08000-0BFFF -> ROM Bank 2
0C000-0FFFF -> ROM Bank 3
10000-13FFF -> ROM Bank 4
18000-1BFFF -> ROM Bank 6
1C000-1FFFF -> ROM Bank 7
2C000-2FFFF -> ROM Bank 0B
44000-47FFF -> ROM Bank 11
48000-4BFFF -> ROM Bank 12
4C000-4FFFF -> ROM Bank 13
50000-53FFF -> ROM Bank 14
54000-57FFF -> ROM Bank 15
58000-5BFFF -> ROM Bank 16
5C000-5FFFF -> ROM Bank 17
60000-63FFF -> ROM Bank 18
74000-77FFF -> ROM Bank 1D
80000-83FFF -> ROM Bank 20
BC000-BFFFF -> ROM Bank 2F
E8000-EBFFF -> ROM Bank 3A
F0000-F3FFF -> ROM Bank 3C


According to this, map 2E is on bank 7.


Knowing this, Diglett's Cave (Route 11) level script is the pointer 07:65BA.


To work out the offset, we can follow this formula


romAddress = (bankNumber * 0x4000) + (twoBytePointer - 0x4000);
romAddress = (7 * 0x4000) + (65BA - 0x4000)
romAddress = 1C000 + 25BA
romAddress = 1E5BA

Now we have the starting offset of the actual assembly code, $1E5BA.


Open it in a hex editor and it will be in hex.

[img]http://i.imgur.com/Om8ai.png[/img]

You can convert it into ASM using this list of opcodes.


Or you can look up ROM7:65BA (our address, expressed as a pointer) on the emulator BGB (Link to screenshot, as picture is large)


Now this basically says,

*Call (3C3C)

*Set a register (more information here) called 'a' as $16 (Route 11)

*Put 'a' into $D365.

I'm not familiar with what 'Call 3C3C' does, though.


There's a shorter way to do this without knowing about $D36E and $D36F. If you go to Debug>Access Breakpoints you can set a breakpoint for D365 'on write', and the machine will automatically bring you to where the script is, but $D36E and $D36F cause the code to run provided you're on a map associated with a bank that takes you to the right script.


Now we can check D36E-D36F for the other Diglett's Cave map on Route 2 ($70), and we get B0, 5E. This map uses the same bank, so the game needs to run the script at 07:5EB0.



And do you mean if the map has fewer than 5 valid wraps, the game will take you to glitch city?

*looking for a outdoor map with exactly 4 wraps as an example, but can't find any*
Oh right, Route 18 has 4 wraps.

*tries taking the last step in Route 18*
*ends up in glitch city*
Guess you're right.


Yes. That seems to be what happens.

Re: Question about Glitch City

Posted by: Stackout
Date: 2012-08-14 21:26:45

I'm not familiar with what 'Call 3C3C' does, though.


runs the code at 0x3c3c and then goes back (in this case to 0x65bd) after a ret.

(at least i think so, i'm not that familiar with any ASM)