Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

Making "Super Glitch" moves useful (Red/Blue/Green) - Page 2

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Addri Trainer
Date: 2014-05-16 03:45:57


Now I just saw the image of North / West, I went something like talking to Oak ZZAZZ with glitch activated:
[img]http://i.gyazo.com/28ffcd5847739ecb37d501bd402a38ce.png[/img]

Instead of giving me a nickname for Pikachu and instead put Yes / No put me North / West. Someone knows why that happens?


The ZZAZZ glitch changes many values to hex:99, with the amount of addresses affected depending on the Trainers' potential win money (it caps at 9999 but this is actually a cause of the glitch, see this). At address $D12C is the box-set ID; the ZZAZZ glitch may change this to a glitch box-set with the value $99, but I haven't seen this as North/West.

Did you try viewing a Super Glitch move? North/West is value 01, and it is possible for Super Glitch to write that value to $D12C.
All I did was do the trick of the glitch ZZAZZ team, ZZAZZ altered my game so that, when they had spent the entire game, Pikachu back to me, and I got it from North / West, which in truth is Yes / No .

Also appeared when I was going to keep at a time, it happened to me ZZAZZ glitch.



Now I just saw the image of North / West, I went something like talking to Oak ZZAZZ with glitch activated:
[img]http://i.gyazo.com/28ffcd5847739ecb37d501bd402a38ce.png[/img]

Instead of giving me a nickname for Pikachu and instead put Yes / No put me North / West. Someone knows why that happens?


What happened when you chose "North" or "West"? 

Those message boxes are interesting; especially with the screen wrapping. 

It is important to note that in cases where the "Yes/no" message box would appear, the game doesn't try to set the value for what will appear.  It assumes that it will be set to "Yes/no", and if it isn't, it will display whatever value is there. 
It's like you should choose Yes / No, only instead it appears North / West.
Maybe it is a curiosity and nothing more.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Torchickens
Date: 2014-05-16 09:00:33
Yeah, I think the direction options are just a curiosity, unfortunately. Just to confirm, they are unused option choices, though "NORTH" and "EAST" alone are referenced in the Safari Zone (though I don't know if the game gets the text from the same place).

The only thing that changes are the option names. This means if the options were originally Yes/No and they got changed to No/Yes (box-set ID=07), 'No' would act like 'Yes' and 'Yes' would act like 'No'.

But there is a use for glitch boxsets. For with really large widths and heights, such as hex:F9's height of 250 (source), memory corruption can occur due to the box stretching off the screen and addresses past the screen data being overwritten, even though the effects of the options shouldn't change.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: MrGlitch
Date: 2014-07-02 20:42:24
Huh. Looks like there are two ways to get a free Hitmonchan.

http://youtu.be/t2KtU6_C7Ho?t=2m42s

Great research, it is certainly useful. :)

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Torchickens
Date: 2014-07-07 14:48:41
Is there a way to optimize the chances of the CoolTrainer move causing corruption?

On this save file I'm using, and in BGB there is always a 50h inclusively between CD6D and CD80, meaning there's no buffer overflow after the copy to $CF4B. Its no longer working here, but I was able to get this glitch to work in the past various times. Not sure why.

I want to try and get as many glitch Pokémon as possible to verify which ones are possible with this trick.

I understand it may be hard to predict though, because of the fact that you often have to 'scroll' or open/close the fight screen many times.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: TheZZAZZGlitch
Date: 2014-07-07 15:19:03
Cooltrainer move's name pointer pretty much always ends up in the middle of boxed Pokemon data, RAM address $DA80 and beyond (BTW: this is also why Cooltrainer move sometimes takes the nicknames of Pokemon in the current box as its name).
Addresses beyond $DA80 contain a lot of 0x50 bytes, as this is where the Pokemon nicknames and Original Trainer names are stored.

The easiest way to increase the chances of the Cooltrainer move working is to try and change the number of Pokemon in current PC box. If it still doesn't work, change the number of boxed Pokemon once more and try again.

There is no clear pattern - every save file needs a different number of boxed Pokemon for the Cooltrainer move to work properly. On my main save on an emulator, I needed 7 Pokemon in the box for the move to work. On my save on the cartridge the move works only if there are no Pokemon in the box. My different, older save file required 16 or 15.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Kelvinv
Date: 2014-07-07 15:25:01
Wonder if it ever can be used for arbitrary code.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Torchickens
Date: 2014-07-07 16:22:13

Cooltrainer move's name pointer pretty much always ends up in the middle of boxed Pokemon data, RAM address $DA80 and beyond (BTW: this is also why Cooltrainer move sometimes takes the nicknames of Pokemon in the current box as its name).
Addresses beyond $DA80 contain a lot of 0x50 bytes, as this is where the Pokemon nicknames and Original Trainer names are stored.

The easiest way to increase the chances of the Cooltrainer move working is to try and change the number of Pokemon in current PC box. If it still doesn't work, change the number of boxed Pokemon once more and try again.

There is no clear pattern - every save file needs a different number of boxed Pokemon for the Cooltrainer move to work properly. On my main save on an emulator, I needed 7 Pokemon in the box for the move to work. On my save on the cartridge the move works only if there are no Pokemon in the box. My different, older save file required 16 or 15.


Thanks TheZZAZZGlitch. I'll try a box with no Pokémon.


Wonder if it ever can be used for arbitrary code.


Arbitrary code execution and buffer overflow are two different things, because buffer overflow involves memory corruption, while arbitrary code execution involves forcing the game to jump to somewhere helpful (meaning to execute code there).

But if it is possible to corrupt D36E/D36F; the map's level script pointer (a map script like make you walk up and activate the Hall of Fame menu) to something helpful with Super Glitch, then the code will be executed all the time when you return to the map, until you leave it.

From what I understand, this pointer can either be in memory if it is 8000-FFFE (so you could set up custom code there) or to a ROM address (0000-7FFF).

Each map uses its own ROM bank for the level script pointer. (Relevant if you're using a ROM bank that isn't 0, i.e. it's relevant for 4000-7FFF) A list can be found here.

But a problem if you're planning on executing existing code is having the game not freeze after Super Glitch. The place that typically doesn't Diglett's Cave has a ROM bank of 18, so you could theoretically execute code from a pointer in ROM bank 18.

This relies on there being no $50 character after the name of the Super Glitch move (which was cut to 20 characters long), where the adjacent data that was from CD81 onward including the screen data is found, and you having control over what address to put into the level script pointer (D36E/D36F). There's also a chance you'll corrupt something important that will cause a freeze or corrupt the memory to a degree it's not worth the trouble.

Edit: This was a rushed reply as I've got to go soon, so some of what I say may be wrong. I haven't tested this. Sorry if it is.
Edit 2: Rival's name is at D34A so I guess it's impossible without corrupting that, because that's bound to have a 50.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Charmy
Date: 2016-09-10 13:59:20
Why does Cooltrainer not work for me on official Blue VC? There's no corruption ever and that's bad because…  AxXDao needs to fill his dex. And He doesn't want to waste trainers for the Mew trick. ACE also i won't do as I don't want the risk of my save being killed, just like the two previous ones.
Also, were you camping on this thread? I just went back and replied to something and you posted.

Edit by Torchickens: Merged into this thread.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Torchickens
Date: 2016-09-10 14:10:00

Why does Cooltrainer not work for me on official Blue VC? There's no corruption ever and that's bad because…  AxXDao needs to fill his dex. And He doesn't want to waste trainers for the Mew trick. ACE also i won't do as I don't want the risk of my save being killed, just like the two previous ones.


That can happen and for some reason it seems CoolTrainer is likely not to work after a certain point. Changing the number of hex:50 in the memory is said to help, so you can try various things such as: lengthening or shorten the nicknames of your Pokémon in the party or the number of Pokémon in the current box, adding items with quantities of x80 to the inventory and hopefully CoolTrainer will start to work.


Also, were you camping on this thread? I just went back and replied to something and you posted.


No, but I suppose it could be that I loaded the main page of the forums about the same time you posted while creating the new child boards.

Edit by Torchickens: Merged into this thread.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Charmy
Date: 2016-09-10 14:13:56

That can happen and for some reason it seems CoolTrainer is likely not to work after a certain point. Changing the number of hex:50 in the memory is said to help, so you can try various things such as: lengthening or shorten the nicknames of your Pokémon in the party or the number of Pokémon in the current box, adding items with quantities of x80 to the inventory and hopefully CoolTrainer will start to work.

I forgot about that… *derp*… Trying this right now.

Edit by Torchickens: Merged into this thread.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Torchickens
Date: 2016-09-10 14:16:36


That can happen and for some reason it seems CoolTrainer is likely not to work after a certain point. Changing the number of hex:50 in the memory is said to help, so you can try various things such as: lengthening or shorten the nicknames of your Pokémon in the party or the number of Pokémon in the current box, adding items with quantities of x80 to the inventory and hopefully CoolTrainer will start to work.

I forgot about that… *derp*… Trying this right now.


OK, good luck! I will split this discussion off into another thread.

Edit by Torchickens: Merged into this thread.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Charmy
Date: 2016-09-10 14:28:31
You can later move this somewhere…
My Ditto has a nickname of "CT" which stands for CoolTrainer and my Fearow (flyer) has a nickname of "h".
Also, my current box has 11-13 Pokémon in it and my other box has 4 Pokémon in it. The rest are empty.
Now I'll try CoolTrainer. If that doesn't work then items.
BUT:I forgot something, I managed to get CoolTrainer to work but the game "00 39 00 39"'d my right away.

EDIT:Around 50 UP presses later, nothing. Trying items now.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Torchickens
Date: 2016-09-10 14:32:23

You can later move this somewhere…
My Ditto has a nickname of "CT" which stands for CoolTrainer and my Fearow (flyer) has a nickname of "h".
Also, my current box has 11-13 Pokémon in it and my other box has 4 Pokémon in it. The rest are empty.
Now I'll try CoolTrainer. If that doesn't work then items.
BUT:I forgot something, I managed to get CoolTrainer to work but the game "00 39 00 39"'d my right away.


I see, happy that it worked that time. You likely already know this but would like to share just in case you weren't aware, the reason why it may have froze is because you need to open the items menu or Pokémon menu at a specific place first and then never open it afterwards until you do the corruption; for example opening the items menu in battle before doing the corruption allows you to force a Missingno. on the opponent's side.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Charmy
Date: 2016-09-10 14:36:19

I see, happy that it worked that time. You likely already know this but would like to share just in case you weren't aware, the reason why it may have froze is because you need to open the items menu or Pokémon menu at a specific place first and then never open it afterwards until you do the corruption; for example opening the items menu in battle before doing the corruption allows you to force a Missingno. on the opponent's side.

Yes, I knew that, and so i opened it somewhere in Diglett's Cave, then got into a encounter. It's because of backup onscreen data, right?

EDIT:Goddammit Spearow… I can encounter 'M, Normal Missingno., and Areodactyl Fossil Missingno on that goddamn coast but i got you… as well as Sandshrew's. Oh, and level 151 Mewtwo's too.

Re: Making "Super Glitch" moves useful (Red/Blue/Green)

Posted by: Torchickens
Date: 2016-09-10 14:48:24


I see, happy that it worked that time. You likely already know this but would like to share just in case you weren't aware, the reason why it may have froze is because you need to open the items menu or Pokémon menu at a specific place first and then never open it afterwards until you do the corruption; for example opening the items menu in battle before doing the corruption allows you to force a Missingno. on the opponent's side.

Yes, I knew that, and so i opened it somewhere in Diglett's Cave, then got into a encounter. It's because of backup onscreen data, right?

EDIT:Goddammit Spearow… I can encounter 'M, Normal Missingno., and Areodactyl Fossil Missingno on that goddamn coast but i got you… as well as Sandshrew's Oh, and level 151 Mewtwo's too.


Yep, that's right.