Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

Ultra Ball and Great Ball glitch, how does it work? - Page 1

Ultra Ball and Great Ball glitch, how does it work?

Posted by: Torchickens
Date: 2014-06-01 14:27:12
Copy and paste from my Youtube video:

In Pocket Monsters Blue, when you buy two sets of Ultra Ball x99 or Great Ball x99 it messes some data up.

If you bought two sets of Ultra Ball x99 the exit mat will no longer work, and if you save and reset you can see that what makes up the border has also changed.

If you bought two sets of Great Ball x99, your badges byte will be changed to something like 62h, which equates to having the Cascade Badge, Marsh Badge and Volcano Badge.

The cause is unknown. This glitch doesn't work on other versions, strangely not even in Red, Green or Pocket Monsters Pikachu.

Instead of another stack of x99, you can buy say 99 Great Balls and 1 Great Ball and get a different effect like no badges.

Do NOT save after buying the two sets of x99 Ultra Balls if you value your save file. You won't be able to escape Cinnabar Island PokéMart without blacking out, and there is no way to escape the Pokémon League at all, because loading the save file causes a freeze.

Relevant Poké Marts:

Lavender Town
Celadon Department Store - Great Ball section
Fuschia City
Cinnabar Island
Indigo Plateau


After some observation, the number of items you buy for the second stack directly influences the result.

With all badges, buy 99 Great Balls and then 1 Great Ball, and the number of badges address (D2D5) will change to 00 (no badges). With just the BoulderBadge (01), buy 99 Great Balls and then 1 Great Ball and it will change to 02 (just the Cascade Badge), suggesting it was a +1.

Another example; buy 99 Great Balls and then 50 Great Balls, and if you had FF in the badges byte it will change to 31h, which is 110001, so if you read the bits least significant first it means you have badge 1 (Boulder Badge), badge 5 (Soul Badge) and badge 6 (Marsh Badge). Notice that 31h is FFh + 32h (50, the number of balls for the second stack we bought) when modulo 256 is in effect.

The same logic applies to buying 99 Ultra Balls and another stack, but the address that changes is D2E7; the map's height in blocks, and changing this apparently means you can't use the exit mat to escape.

Why is it these addresses that change? They are notably close to D2C9; the 20th item quantity, if that matters.

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: hpoké_coloradohugge
Date: 2014-06-01 15:29:36
Soooo… should i go try this on my Jp Blue cartridge now, or will the save file be totally f*cked?

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: pokechu22
Date: 2014-06-01 17:23:30

Copy and paste from my Youtube video:


Relevant Poké Marts:

Lavender Town
Celadon Department Store - Great Ball section
Fuschia City
Cinnabar Island
Indigo Plateau



Why those specificaly?  That's weird. 

What happens when you buy other items?  And is it possible other data is corrupted too?

This almost sounds like the cause for the ZZAZZ glitch, where adition is breaking something.  But I'm not sure. 

Very weird. 

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: Torchickens
Date: 2014-06-01 17:37:27
Because those Poké Marts have Great Balls and/or Ultra Balls.

I started a new Pokémon Red, went to Cinnabar Island with just the Potion and got this after buying two stacks of 99 Ultra Balls, so apparently the glitch works in English versions! (but it stops working after a certain point, the same applies to Red/Green though I couldn't get it to work in Yellow):

[img]http://i.minus.com/juicpiQeWeQpU.png[/img][img]http://i.minus.com/jbaL3PX1FlGrFi.png[/img]

Then when I checked my items, apparently the game thought I only bought one stack of Ultra Balls:

[img]http://i.minus.com/jbeVYWNW2sYQF4.png[/img]

When buying a third stack of 99 Ultra Balls this happened:

[img]http://i.minus.com/jbuLQiCxAqTdNM.png[/img]

Then when I checked my items pack I only got 1 extra, and my 'position' on the map and the 'positions' of NPCs on the map got shifted down.

[img]http://i.minus.com/jbwQfEb6QVbrA6.png[/img][img]http://i.minus.com/jbvEozfQUXE7j2.png[/img]

From there, I could go off the map and get a freeze.

When I bought two stacks of 99 Great Balls nothing visible happened.

I came across this glitch by myself, so I don't know if it's already documented elsewhere.

Also:

[img]http://i.minus.com/jbo2x7iggZtOID.png[/img]

Um… apparently yes it does.

Edit: Trying to buy more Ultra Balls (specifically Ultra Balls for some reason) when you have 99 may cause you not to get another stack. You can keep buying 1 (or more) and you can browse through D35D values 01 up to 63 (which is 99 in decimal!), e.g. buy 2 and D35D changes from 00 to (+)02. Changing D35D changes the 'brightness value', but that name isn't really accurate.

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: pokechu22
Date: 2014-06-01 18:20:36
This is simply amazing.  That this was never found…  Wow.

Very impressive.  And odd. 

I can confirm that this also happens in Edición Roja (Spanish red).  Also, with the upward scrolling of the mart when buying three: It persists after saving.  And if you walk to where the exit should be, you can exit. 

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: luckytyphlosion
Date: 2014-06-01 19:21:43
When I tried with Item Underflow activated, I saw that it replaced the "Brightness Value" and the "X-Coord Value". The Brightness value are always Ultra Balls and the position that the character is in when it is on the left of the mart guy. So what must be happening is that the game places the Ultra Balls in those values, thinking that those values are part of the inventory. Don't know why this happens, though.

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: TheZZAZZGlitch
Date: 2014-06-02 01:35:19
The glitch is present in all Japanese releases and English R/B. It does not work in English Yellow.

When adding an item to the inventory, the game runs through every single item in the bag, executing the following algorithm:

1. See if the currently checked item is the one that is added to the inventory
2. If so, try to increase its quantity instead of adding a new stack. If it fails, advance to the next item and go back to step 1
3. See if the item after the checked item is an end terminator (0xFF). If so, stop.
4. Advance to the next item and go back to step 1

It works great for most situations. Some of the people may have spotted the error already: Once the game tries to increase the quantity of an item, it does not bother checking for the end terminator anymore. Because of that, things may start to get pretty bad if there's a 99 stack in the last inventory slot. Let's see how it works out in action - say we have the following inventory:

[tt]Potion          x1
Ultra Ball      x99
END_TERMINATOR  x0[/tt]

Let's assume we're adding Ultra Balls to the inventory. The game will walk through every single item, to see if the newly added items can merge into any of the stacks in inventory. It will eventually check the 99 stack of Ultra Balls to see if any new Ultra Balls can be merged with this stack. They can't, since the stack is already full. So the game will move on to the next item, the end terminator.
But the game only tests for the end terminator on the following item, not the currently checked one. So the end terminator goes unnoticed - as the result, memory beyond the inventory data will be treated as items.

On the previously presented Pokemon Blue example, the address that got corrupted was $D35D, because it was treated as an item quantity for $D35C. In Pokemon Blue, $D35C seems to always be 0x02 - the hex ID of Ultra Ball. Since it is the closest "Ultra Ball stack" the game could find, it will store the newly bought items there.

It's important to note that the glitch works with every item, not just Ultra Balls. The balls are just the most convenient items, since their hex IDs are very low and happen to exist in many memory locations.
Also it's the inventory adding subroutine that's faulty, not the Pokemon Mart selling mechanics. So the same glitch should be possible with item boxes or other inventories (if there are any).

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: Stackout
Date: 2014-06-02 06:10:13
So, we can essentially write arbitrary bytes in RAM (following those conditions, of course)? Could this be exploitable?

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: SM
Date: 2014-06-02 09:24:41
with yami shop glitch we can change other memory adress, too.
for example, buying master ball by yami shop glitch can change d365(warp location) to mart's town ~ 63(99) S.S.Anne Deck

http://youtu.be/6PxBIzRY4eg

D358 was 01 so I needed to make d359 63(99)
I bought 30 master ball because D359(Player ID?) was 45(69)

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: luckytyphlosion
Date: 2014-06-02 15:34:00

So, we can essentially write arbitrary bytes in RAM (following those conditions, of course)? Could this be exploitable?

Doesn't matter, an inventory with at least 40 slots cover most of the important ram bytes, shown in this post here: http://forums.glitchcity.info/index.php/topic,6914.0.html
The rest of the slots (40+ slots) don't affect the game, but that's just me testing.

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: pokechu22
Date: 2014-06-02 17:10:01
When I have text [acronym=Like this]Underlined[/acronym], hover over it for additional notes.


The glitch is present in all Japanese releases and English R/B. It does not work in English Yellow.

When adding an item to the inventory, the game runs through every single item in the bag, executing the following algorithm:

1. See if the currently checked item is the one that is added to the inventory
2. If so, try to increase its quantity instead of adding a new stack. If it fails, advance to the next item and go back to step 1
3. See if the item after the checked item is an end terminator (0xFF). If so, stop.
4. Advance to the next item and go back to step 1

It works great for most situations. Some of the people may have spotted the error already: Once the game tries to increase the quantity of an item, it does not bother checking for the end terminator anymore. Because of that, things may start to get pretty bad if there's a 99 stack in the last inventory slot. Let's see how it works out in action - say we have the following inventory:

[tt]Potion          x1
Ultra Ball      x99
END_TERMINATOR  x0[/tt]


I think I also see why it stops working after progressing in the game: Rather than being something like this as it is at the start of the game:


[table]
[tr][td][tt]Hex1[/tt][/td][td][tt]Hex2[/tt][/td][td][tt]||[/tt][/td][td][tt]Item name[/tt][/td][td][tt]Count[/tt][/td][/tr]
[tr][td][tt]14[/tt][/td][td][tt]01[/tt][/td][td][tt]||[/tt][/td][td][tt]Potion[/tt][/td][td][tt]x01[/tt][/td][/tr]
[tr][td][tt]FF[/tt][/td][td][tt][acronym=(I think; but it might be FF)]00[/acronym][/tt][/td][td][tt]||[/tt][/td][td][tt]End of list[/tt][/td][td][tt][acronym=(I think; but it might be FF)]x00[/acronym][/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[/table]

But later in the game, you have this, assuming you bought and sold stuff (but not the potion):

[table]
[tr][td][tt]Hex1[/tt][/td][td][tt]Hex2[/tt][/td][td][tt]||[/tt][/td][td][tt]Item name[/tt][/td][td][tt]Count[/tt][/td][/tr]
[tr][td][tt]14[/tt][/td][td][tt]01[/tt][/td][td][tt]||[/tt][/td][td][tt]Potion[/tt][/td][td][tt]x01[/tt][/td][/tr]
[tr][td][tt]FF[/tt][/td][td][tt][acronym=(I think; but it might be FF)]00[/acronym][/tt][/td][td][tt]||[/tt][/td][td][tt]End of list[/tt][/td][td][tt][acronym=(I think; but it might be FF)]x00[/acronym][/tt][/td][/tr]
[tr][td][tt]FF[/tt][/td][td][tt][acronym=(I think; but it might be FF)]00[/acronym][/tt][/td][td][tt]||[/tt][/td][td][tt]End of list[/tt][/td][td][tt][acronym=(I think; but it might be FF)]x00[/acronym][/tt][/td][/tr]
[tr][td][tt]FF[/tt][/td][td][tt][acronym=(I think; but it might be FF)]00[/acronym][/tt][/td][td][tt]||[/tt][/td][td][tt]End of list[/tt][/td][td][tt][acronym=(I think; but it might be FF)]x00[/acronym][/tt][/td][/tr]
[tr][td][tt]FF[/tt][/td][td][tt][acronym=(I think; but it might be FF)]00[/acronym][/tt][/td][td][tt]||[/tt][/td][td][tt]End of list[/tt][/td][td][tt][acronym=(I think; but it might be FF)]x00[/acronym][/tt][/td][/tr]
[tr][td][tt]FF[/tt][/td][td][tt][acronym=(I think; but it might be FF)]00[/acronym][/tt][/td][td][tt]||[/tt][/td][td][tt]End of list[/tt][/td][td][tt][acronym=(I think; but it might be FF)]x00[/acronym][/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[tr][td][tt]00[/tt][/td][td][tt]00[/tt][/td][td][tt]||[/tt][/td][td][tt][acronym=Fine, #j..  But for the developers, nothing.]Nothing[/acronym][/tt][/td][td][tt]0[/tt][/td][/tr]
[/table]

So the game skips the first FF, but hits the next.

I hypothesize that one could avoid this by buying enough items that the bag is almost full save for one FF.  Maybe. 

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: OwnageMuch
Date: 2014-06-02 23:44:41

I hypothesize that one could avoid this by buying enough items that the bag is almost full save for one FF.  Maybe. 


Yes, certainly, unless the game checks for the number of items in the bag as well before letting you buy anything.

I find it somewhat interesting that the FF entries remain there after items have been added and removed, but I suppose there would be no legitimate reason to change them back to 00 if the method didn't have a bug.

Instead of removing the warp, is it possible to change the warp to somewhere else?

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: Torchickens
Date: 2014-06-05 12:10:57
Thanks for your replies and research guys while I've been away. I'll play around with this glitch to do cool things like what SM did at some point.


I find it somewhat interesting that the FF entries remain there after items have been added and removed, but I suppose there would be no legitimate reason to change them back to 00 if the method didn't have a bug.


Stuff like that probably happens in several cases. Here, usually the FF entries are for item identifiers, not item quantities though. Example - an 'empty' items pack that had 3 items max: FF 00 FF 02 FF 02 FF.

FF permanence is also the case with your boxed Pokémon, and when you get 20 boxed Pokémon you can never take the FF out of the end byte (DA94 position 21) which is why the storage box data shift glitch (involving shifting bytes upward) no longer works after having a full box 1 at any point without you having to reset the game, and boxes other than box 1 are apparently filled with FF by default on real hardware.


I bought 30 master ball because D359(Player ID?) was 45(69)


Yes, D359 is byte 1 of the player ID word.

I've found that although the game will stop at the next FF other than a checked one according to TheZZAZZGlitch's explanation, FFs for item quantities rather than identifiers don't matter (i.e. odd addresses)

If you have ever had 20 items, you may never able to pull off this glitch without other tricks (maybe it's possible to enable again with something like item underflow glitch or 8F?) Getting a 20th item places an FF on D346, and say you had 99 Ultra Balls in position 19 and bought more Ultra Balls, the game will add a 20th Ultra Ball stack (with correct quantity) but wrongly say your items pack is full when you try to buy more. If you have 19 items but removed the FF in D346 with memory viewer, the glitch can indeed work with 19 items and buying a 20th.

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: OwnageMuch
Date: 2014-06-05 17:48:41
Well, you could always just use 8F to rewrite those bytes that were changed to FF… It would be a hassle of course though

Re: Ultra Ball and Great Ball glitch, how does it work?

Posted by: Blaziken257
Date: 2014-07-04 22:11:38
This glitch is news to me; I hadn't heard of it until I read this thread. It amazes me that glitches like these don't get caught during testing and make their way into the final game.

I am wondering a couple of things though: