Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

Theories and interesting stuff on MissingNo. and Glitch Pokemon - Page 1

Theories and interesting stuff on MissingNo. and Glitch Pokemon

Posted by: Crystal_
Date: 2013-05-01 13:49:59
As a newbie GBC ROM hacker and glitch lover I have been messing about with a Pokemon Red ROM to experiment with MissingNo. and glitch Pokemon. I'd like to share some stuff and the conclusions I have come to.

First, on MissingNo.'s sprites. I suggest you have this page handy unless you know how does MissingNo.'s general Pokemon data come and stand from.

As you know, only dimensions of fontsprite of 5x5, 6x6 and 7x7 are used. There is no space in the screen for anything bigger than 7x7. So how does 8x8 affect MissingNo.'s fontsprite then? It seems that it causes MissingNo. to have the backwards-L shape it has. Different "invalid" dimensions cause MissingNo. to have other weird forms:

9x9: [img][/img] AxA: [img][/img] FxF: [img][/img] Cx9: [img][/img] BxD: [img][/img]

As you see, most tiles seem to coincide in the five sprites, but in a different order. I think the order in which tiles are displayed in a sprite is stored somewhere in the ROM, but I don't know what's the reason these dimension values make the sprite look like that.

Pointer to fontsprite is 0x19 0x00. This points to 0x1900 in the RAM and thus 0x1900 in the ROM too. This means that every MissingNo. has the same sprite despite differences in Index Number (sprites are located in different banks depending on the index number of the Pokemon). In fact, if we manage to edit some bytes around there without crashing the game we'll see a different MissingNo. fontsprite:


So the data that determines MissingNo.'s fontsprite is indeed taken from 0x1900

Anyway, what came to my mind next is that, had MissingNo.'s fontsprite pointer pointed to somewhere between 0x4000 and 0x7FFF, MissingNo. would have different sprites depending on its Index Number, since then the RAM area accessed would be the switchable ROM bank area. Since sprites are stored in different banks, considering MissingNo. can have different Index Numbers, this could lead to four different fontsprites.

id bank
0x15 0x01
0xB6 0x0B
0x00 to 0x1E 0x09
0x1F to 0x49 0x0A
0x4A to 0x73 0x0B
0x74 to 0x98 0x0C
0x99 to 0xFF 0x0D

So I changed its pointer to fontsprite to 0x00 0x70 (so that it doesn't load data from other sprites like, say, 0x00 0x40 would) to see what happened:

This is MissingNo. 0x1F. This one accesses to ROM bank 0xA.

So then, my theory was that another Index Number would lead to a different sprite if the bank accessed was a different one. I tried with MissingNo. 0x50, which would load bank 0x0B. I didn't change the pointer:

And it's indeed different. This means, that since, MissingNo.'s pointer to fontsprite is after all random, had it had a different pointer which pointed to a ram area between 0x4000 and 0x7FFF, MissingNo. would have more than one sprite! (apart from Ghost and fossils that is). Moreover, certain pointer values would've made MissingNo. look like other real Pokemon, and share tiles with them. However, considering the Pokemon Bikers have (Voltorb, Koffing etc don't have index numbers in a range between 0x40 and 0x7F), all of that was unlikely to happen.

Pointer to backsprite is 0x8F37. This points to the Video Ram. This seems to be the reason MissingNo.'s backsprite changes depending on the opponent, since the VRAM data is not always the same.

[img][/img]  [img][/img]

It seems like, while RAM data around 0x8F37 to 0x9080 are always the same in a batlle regardless on the opponent, some bytes at around 0x9090 and onwards do change. I don't know what this data stands for, but must have to do with the sprite of the opponent. At first I thought 0x9090 was too far from 0x8F37 to be still MissingNo.'s backsprite data, but the only theory I have is that MissingNo.'s backsprite occupies that much space. I don't know how sprite data works anyway. According to this backsprites are around 0xA0 bytes long, but some are longer. 

Now, something on Glitch Pokemon learnsets and evolutions. Have a look at this first.

When I learned about how RAM is structured, my first thought was that the correction of 34000 has to do with the fact that a pointer of 0x00 0x1E points to 0x1E00 in RAM and thus it's the first ROM bank. So that's the reason Pokemon 0xBF takes its data from there. However, for example 0xC4, which has a pointer of 0x2B 0x40, would take data from the same bank the pointer is located at, since it points to the switchable ROM bank in the RAM. This pointer would then point to 0x3802B. And indeed data past the first 00 seems to match with 0xC4's learnset:
40 0 255 35 11 0 55 0 255 30 12 38 1 0 76 5 13 39 80 0 191 10 14 50 0

Then I thought about the possibility that a pointer leading to RAM areas with varying data would lead to Glitch Pokemon with varying evolutions/learnsets!

01E00 - BF
02317 - C0
02827 - C1
0301F - C2
03720 - C3
0402B - C4
00024 - C5
01A00 - C6
01F2C - C7
02427 - C8
02905 - C9
02E2B - CA
00092 - CB
01001 - CC
000A7 - CD
01E08 - CE
0280E - CF
07415 - D0
01F1D - D1
02024 - D2
0182B - D3
00200 - D4
0010A - D5
0008E - D6
02F0D - D7
00312 - D8
06B18 - D9
0761F - DA
06F27 - DB
07130 - DC
00100 - DD
02314 - DE
00900 - DF
00F2B - E0
0161F - E1
01D77 - E2
02441 - E3
00061 - E4
01E01 - E5
0008D - E6
03111 - E7
07816 - E8
0711D - E9
08124 - EA
0992B - EB

00000 - EC
01E08 - ED
0280E - EE
02517 - EF
00000 - F0
03212 - F1
01D16 - F2
02D1B - F3
03721 - F4
06E25 - F5
0852C - F6
05E37 - F7
00100 - F8
09A20 - F9
00700 - FA
00D49 - FB
01616 - FC
01E4D - FD
0264B - FE
02E4A - FF
0364F - 00

According to this (taken from a post in the thread I linked before) there are 4 Glitch Pokemon with pointers past 0x8000. All of them point to the VRAM (0x8000 to 0x9FFF). According to the glitchdex 3 of these pokemon learn no moves via level up which makes sense considering that, in the VRAM, when a byte with a 0x00 comes it's generally followed by many more 0x00.

0xEA is the Pokemon that is illustrated to learn moves by leveling up in the glitchdex and bulbapedia. Its pointer points to 0x8124. I assumed that the information about the moves learned by leveling up was taken by leveling up the Pokemon via Rare Candies. So I emulated that, with the Memory viewer open at address 0x8124. I was pretty excited when I saw that the data in the RAM in the moment the Pokemon leveled up matched the learnset of 0xEA in the glitchdex:


Look past the first 00 that makes learnset data to start. Before that, we can see it doesn't evolve. This data is the following: 02 F1 0F F2 0E FC 0C F0 10 A0 60 C0 C0 40 40 00 40 00 00. The last 00 is the terminator. 02 F1 means that it learns TM 41 at level 2, and then 0C F0 means that it learns TM 40 at level 12. I assumed the glicthdex is mistaken here saying that it learns TM 41 at level 12 instead, since every other move matches.

So what if I leveled up the Glitch Pokemon by gaining experience points in battle? The VRAM would be different then, and thus the learnset too! I tested it with the Glitch Pokemon 0xEA itself. I altered its base stats data so that its moves don't crash the game and it grows up quickly. I rare candied it until level 11. Then I leveled it up to lv 12 via battling. And it didn't learn any move!


So, depending on how you level it up, 0xEA's learnset is different.

Then I had a look at the other 3 Pokemon. I assumed the glitchdex and bulbapedia say that they not learn any move via level up because their pointer points to a vram data that makes them learn no moves via rare candies.

Unfortunately, while I haven't checked each Pokemon separately so I'm not 100% sure, the VRAM data during a level up via battling at addresses 0x992B, 0x852C and 0x9A20 stands for learning no moves via battling either. However, I don't know if leaving the Pokemon in the daycare and leveling it up that way could offer any possibility of modifying the learnset of the glitch Pokemon.

Re: Theories and interesting stuff on MissingNo. and Glitch Pokemon

Posted by: Torchickens
Date: 2013-05-03 09:56:59
Nice finds! :)

I tried taking A (EAh) into Daycare, with 1 Exp to the next level, with $8124 reading '3F 00 12 01' (as my 'A' was level 17) but for some reason I wasn't able to find any conclusive proof to exactly how you can learn moves this way. Sometimes when I walked one step to get it to level up it learned Pound but other times it didn't.

By the way, if there is another 00 on one of the level bytes (doesn't count for move bytes) after the first 00 that marks the start of the level-up moves, the list of learnable moves ends early. Assuming learning a move through Daycare is something to do with the Pokémon leveling up when the data says it should, I'm not sure if there are any locations that are suitable.

Re: Theories and interesting stuff on MissingNo. and Glitch Pokemon

Posted by: Crystal_
Date: 2013-05-03 13:56:27
I did the same thing as you (though I just repointed rhydon to 0x8124 to make things easier, but in practice I guess the result would be the same) and I always got the desired and expected result. I made Rhydon learn Pound and Clamp this way. I left the Pokemon into the daycare with little exp needed to level up, edited the vram, and made sure I didn't leave the daycare to avoid the vram reseting again. And it did work everytime. So maybe the fact that Rhydon is not a glitch Pokemon and 0xEA is had something to do with the fact that it sometimes didn't work for you, but for me, with that Rhydon, it was 4 successes out of 4 tries.

However, now, as you say, is about finding suitable locations, if there is one. I have gone through the four vram locations of the four glitch pokemon, and checked the vram data there in a few outdoor and indoor maps. However, I never got a result that would lead to any learned move. Everytime and everywhere I tried, the first 0x00 was followed by at least another 0x00. For all four vram locations. It seems that 0xEA is pretty damn lucky to be able to learn those moves lol.

Re: Theories and interesting stuff on MissingNo. and Glitch Pokemon

Posted by: MrGlitch
Date: 2013-05-12 21:13:56
Basic question that I somehow never bothered to ask: does Missingno's backsprite change with different tilesets?