Big storage box byte shift glitch (aka 'remaining HP glitch') analysis
Posted by: Torchickens
Date: 2014-04-30 20:08:36
While the most simple thing you can do with the glitch is change the index number (specifically the recipient byte) of a Pokémon by taking it from its remaining HP, and get the Pokémon by taking it into the Daycare and out again, Paco81 used it to make a custom Dragonite for ciel4, and uacdario made his own shiny Mew with it.
SnorlaxMonster called the glitch the remaining HP glitch and made a basic Bulbapedia article about it, but I propose it should be named something else, like the "big storage box byte shift glitch"; you can byte shift any series of bytes before the next FF backwards as long as DA94 (Red/Blue: DA95); the end box byte following Pokémon 20 'donor' does not equal FF, and on real hardware this becomes FF when you get 20 Pokémon in a box and this stays. I'll explain why exactly the glitch doesn't work with this below.
The glitch also only works for box 1 on real hardware. I don't know why, but boxes other than 1 are filled with FF bytes, including DA94, making this glitch impossible on those boxes!
To clear up some things, for the remaining HP glitch, the Pokémon you catch that gets sent to the first position of box 1 must have a catch rate of 255, and the Pokémon below it (initially Pokémon 1) must have a catch rate of 255 too. The other Pokémon do not matter, even if they're say, Rhydon.
Useful links:
Youtube: Paco81's video, my video including a description.
Original temporary forum thread
How to Obtain Flawless Level 100 Pokémon on Smogon.
Remaining HP glitch on Bulbapedia.
[size=13pt]Let's take a look at why the remaining HP glitch works:[/size]
Questions:
1) Why do you need to have never filled box 1 before?
1A) DA94, the end byte following box position 20 would be FF. When you withdraw your Q or Charizard 'M (both FF) with DA94 as FF after the previous steps of the glitch, you're technically still byte shifting; just that everything before it up to DA87 (where the last shift occurs to DA86; stored Pokémon 6) is usually 00 from a former empty box, so you're just replacing 00s with 00s. The only peculiarity is that DA93 (box 20 position) becomes another FF.
2) Why do you need to get the catch rate 255 Pokémon sent to the box?
2A) When you capture a Pokémon with 6 Pokémon it gets sent to the first position. Whether that matters I don't know, but the game uses a different method than it does for depositing Pokémon through the PC. Before you catch your Pokémon, your box should look something like this, 05 24 A5 54 24 FF FF. But after you catch it, it changes into 06 A5 24 A5 54 24 FF 00. Notice that the second terminator is gone and replaced with 00 for some reason! This is important for the glitch.
When you deposit a Pokémon via the PC it works differently, the game leaves FFs only and adds an FF after the last Pokémon to place the Cancel, and this includes Q/Charizard 'M. If the game did not do this for those Pokémon the Cancel button would be missing, but you wouldn't be able to select that Pokémon due to your number of Pokémon byte being one value too small.
3) Why do all these 'strange' withdrawals work? :
3A) This glitch shifts all bytes before the next FF following the last Pokémon species byte backwards. A catch rate of 255 happens to be a suitable FF and in the data structure, DA9C (catch rate of Pokémon 1) follows DA94 (terminator after position 20) and everything before DA94 up to the last Pokémon should not be FF. The byte following the last Pokémon species donor (first byte) is not FF anymore because we removed it when capturing the catch rate 255 Pokémon and having it sent to the box.
The actual byte shifting occurs when you withdraw the last Pokémon Q/Charizard 'M (specifically everything up to DA86 is shifted back before the catch rate DA9C but with DA9B becoming FF. Notable bytes changed are DA94; end byte after Pokémon 20, DA95, Pokémon 1 recipient, DA96 HP byte 1, DA97 HP byte 2, DA98 level, DA99 status, DA9A type 1, DA9B type 2 (DA9B is the end of the corruption)).
This is the first corruption that occurs, and since the catch rate (DA9C) is the FF, it doesn't change. Note that if you had that Pokémon with a current HP byte 1 corresponding to a Pokémon you want and a reasonable FF somewhere, you could in theory get your desired Pokémon by withdrawing it, putting it in the Daycare Center and receiving it, however the normal HP cap is 999 (where byte 1 = 03); you'd need glitched HP to get anything other than 3TrainerPoké, Rhydon, Kangaskhan or Nidoran.
We still have the missing FF terminator that the game didn't place after Q, and now we've created another FF before DA9C at DA9B (type 2). The Pokémon that gets to the box having a catch rate of 255 does matter for some reason, but I don't get why since you withdraw it and have the second Pokémon take its position; the second Pokémon has the exact same data structure when it occupies the first position.
3i.)Why do we need to withdraw the first Pokémon after withdrawing Q/Charizard 'M?
Well you don't have to follow the trick as shown in Paco81's video and my video exactly, but this won't allow you to do as much. Instead of withdrawing the first Pokémon (the one that gets sent to the PC with a catch rate of 255) after withdrawing Q/Charizard 'M, you can go and withdraw the fifth Pokémon. This will cause the bytes to shift upwards again. After withdrawing the Charizard 'M/Q, the remaining HP byte 2 got shifted up to the remaining HP byte 1, and it will work as expected for withdrawing the fifth Pokémon; the remaining HP byte 1 will move up to the species byte!
The problem is though that you have to obtain the catch rate 255 Pokémon in the wild (to understand why you have to catch it, see 2A), so this means that its remaining HP isn't going to be too high. You could get a handful of Pokémon though and not just 3TrainerPoké, Rhydon, Kangaskhan or Nidoran through this method.
But to get any Pokémon, this is why we withdraw the first Pokémon. It won't mess with the former second Pokémon's data, but that Pokémon will now be in the first position for you to mess with, and you can deposit it, so it can have any HP you want.
At this point, like what would happen if we withdrew Pokémon 5 without withdrawing Pokémon 1, due to the missing FF terminator that the game didn't place after Q (notice that you can't see a Cancel), withdrawing the fourth Pokémon (the last at this point) will shift bytes upwards again, due to the first Pokémon's FF at DA9C (catch rate). This puts data from the current HP byte 2 into the current HP byte 1 (when we withdrew the first Pokémon it essentially made the new first Pokémon 'stable' again). Then you can repeat the procedure (withdraw Pokémon #3) to get the species you want, because you put your remaining HP in byte 2 into byte 1, and then into the recipient byte. From there, you can withdraw Pokémon 1, take it into the Daycare Center and have it change into the Pokémon you want based on the remaining HP at the start!
4) What is the difference between a donor and a recipient?
The donor byte is the first byte in the data structure (e.g. WRAM DA95 is stored Pokémon 1) and controls the sprite, mini-sprite, type, evolution method. It also controls the original name, learnset, TM/HM compatibility and effective typing. In the remaining HP glitch the donor byte is irrelevant because the game looks for an FF starting from where the end byte in the box should have been, so this doesn't get corrupted.
The recipient byte is the 'real' Pokémon, and it also controls the in battle palette for your Pokémon. This is what gets corrupted during the remaining HP glitch. Take a Pokémon into the Daycare and receive it, and the recipient byte is copied over to the donor byte, stabilizing your Pokémon.
See also:
I made an image that was a huge help in helping me understand this glitch better. See below. It shows the data shifting back and the addition of an FF when you withdraw the last Pokémon in the box list.
[img]http://i.minus.com/j7qYrXx6vrrjo.png[/img]
I was going to look into storage box byte shift glitches other than the 'remaining HP glitch', but I don't have time so I may work on that within two weeks.
Edit: My video of the get flawless DV and stat experience trick.