Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

Idea to get 3TrainerPoké as an actual encounter without cheating or ACE - Page 1

Idea to get 3TrainerPoké as an actual encounter without cheating or ACE

Posted by: Torchickens
Date: 2015-02-02 11:10:56
These are ways you can get 3TrainerPoké in Yellow without trading 'M (00) over:

1) Through the LOL glitch (out of battle capture) when you manipulate CFD7 to be 00.
2) Through getting a glitch Pokémon like hex:CC (through Rival LOL glitch or regular LOL glitch? or Johto guard glitch) and evolving it into 3TrainerPoké.
3) Through English fossil conversion glitch.
4) Bringing a 3TrainerPoké up from a party of 6+.
5) Johto guard glitch if you don't move the ????? below the Pokémon you want to trade as a Generation I glitch Pokémon but the Pokémon is actually a hex:00/(conversion hybrid) - maybe applies to any trade if you have a hex:FF. (only tested in Red/Blue for 'M 00)
6) Arbitrary code execution.

None of these glitches except arbitrary code execution in theory let you encounter 3TrainerPoké in the wild, however. You cannot get 3TrainerPoké with Ditto trick, but:

The predefined command 2C (CC4E=2C) has you encounter a Pokémon based on D058, even if that Pokémon is 3TrainerPoké. If you leave that address set at 2C for a few frames (to stop the value from reverting), then you often encounter a Pokémon even if you are already in battle.

I wonder; is there a glitch that can corrupt CC4E and keep it that value over time? CoolTrainer and Super Glitch can only corrupt values beyond CF4B.

Re: Idea to get 3TrainerPoké as an actual encounter without cheating or ACE

Posted by: TheZZAZZGlitch
Date: 2015-02-03 16:11:00
It should be possible to corrupt $CC4E by using Super Glitch to obtain a very long name, then performing a variation of this glitch to overflow the screen buffer at $C3A0.

I'm not aware of any glitch that 'holds' the corrupted values for longer than one frame.

Re: Idea to get 3TrainerPoké as an actual encounter without cheating or ACE

Posted by: Torchickens
Date: 2015-02-03 17:53:03

It should be possible to corrupt $CC4E by using Super Glitch to obtain a very long name, then performing a variation of this glitch to overflow the screen buffer at $C3A0.

I'm not aware of any glitch that 'holds' the corrupted values for longer than one frame.


Thanks for that information.

I had an idea of trying out glitch box-sets for the corruption of CC4E where the extent of corruption would be just right. I am under the impression that if a box-set had 2C in its data having the box open would cause the game to constantly write to that value, but that seems unlikely due to 7F, 7C or 7A (or 79?) (specifically border or empty space tiles) values appearing in the corruption a lot. Can you have actual text (not border/empty space tiles) off the bottom edge of the screen/this far into the corruption?

I am not sure exactly when the game will execute the code. Going to a new route then flying with the code 012C4ECC activated the battle, as well as (I think) did opening and closing the menu at one point. The pointer table for PreDef commands in Yellow appears to be 3D:681D (instead of 13:7E79).

Going by the Pokémon Red disassembly the actual pointer is 0F:6F18 in Red (search dbw $0F,$6F18)

PredefPointers: ; 7E79
; these are pointers to ASM routines.
; they appear to be used in overworld map scripts.
dbw $0F,$4D60
dbw $0F,$70C6
dbw $0F,$7073
dbw $0B,$7E40
dbw $0F,$7103
dbw $1E,$5ABA
dbw $03,$7132
HealPartyPredef:
dbw BANK(HealParty),HealParty
MoveAnimationPredef:
dbw BANK(MoveAnimation),MoveAnimation; 08 play move animation
dbw $03,$771E
dbw $03,$771E
dbw $03,$781D
dbw $03,$7836
dbw $03,$771E
dbw $03,$771E
dbw $03,$7850
dbw $03,$7666
dbw $03,$71D7
dbw $03,$71A6
dbw $03,$469C
dbw $0F,$4A83
dbw $03,$71C8
dbw $03,$71C8
dbw $03,$6E9E
dbw $03,$7850
dbw $03,$4754
dbw $0E,$6F5B
dbw $01,$6E43
dbw $03,$78A5; 1C, used in Pokémon Tower
dbw $03,$3EB5
dbw $03,$3E2E
dbw $12,$40EB
dbw $03,$78BA
dbw $12,$40FF
dbw $03,$7929
dbw $03,$79A0
dbw $12,$4125
dbw $03,$7A1D
dbw $03,$79DC
dbw $01,$5AB0
dbw $0F,$6D02
dbw $10,$4000
dbw $0E,$6D1C
dbw $1C,$778C
dbw $0F,$6F18
dbw $01,$5A5F
dbw $03,$6A03
dbw $10,$50F3
dbw $1C,$496D
dbw $1E,$5DDA
dbw $10,$5682
dbw $1E,$5869
dbw $1C,$4B5D
dbw $03,$4586
StatusScreenPredef:
dbw BANK(StatusScreen),StatusScreen ; 37 0x12953
StatusSceren2Predef:
dbw BANK(StatusScreen2),StatusScreen2 ; 38
dbw $10,$50E2
dbw $15,$690F
dbw $10,$5010
Predef3BPredef:
dbw BANK(Predef3B),Predef3B; 3B display pic?
dbw $03,$6F54
dbw $10,$42D1
dbw $0E,$6FB8
dbw $1C,$770A
dbw $1C,$602B
dbw $03,$7113
dbw $17,$5B5E
dbw $04,$773E
dbw $04,$7763
dbw $1C,$5DDF
dbw $17,$40DC; 46 load dex screen
dbw $03,$72E5
dbw $03,$7A1D
dbw $0F,$4DEC
dbw $1C,$4F60
dbw $09,$7D6B
dbw $05,$7C47; 4C player exclamation
dbw $01,$5AAF; return immediately
dbw $01,$64EB
dbw $0D,$7CA1
dbw $1C,$780F
dbw $1C,$76BD
dbw $1C,$75E8
dbw $1C,$77E2
Predef54Predef:
dbw BANK(Predef54),Predef54 ; 54 initiate trade
dbw $1D,$405C
dbw $11,$4169
dbw $1E,$45BA
dbw $1E,$4510
dbw $03,$45BE
dbw $03,$460B
dbw $03,$4D99
dbw $01,$4DE1
dbw $09,$7D98
dbw $03,$7473
DrawHPBarPredef:
dbw $04,$68EF ; 5F draw HP bar
dbw $04,$68F6
dbw $07,$49C6
dbw $16,$5035


Earlier today I also tried to see if I could get the old man glitch to work in Yellow (this may sound like a stupid idea but I wanted to try it). I talked to the old man to store my name in the grass/cave encounter data, then forced grass tiles (hex:52) in the area by changing the event displacement data, thanks to the insta-(Glitch City) CoolTrainer data dump Lucky told us about.

I was not able to encounter any Pokémon in that grass, but if I changed D886 (encounter rate) from 00 to something else, I could indeed encounter Pokémon based on my name including 3TrainerPoké.

I tried changing one of the map's connections to Diglett's Cave too and that didn't work.

I tried forcing the old man battle in a place where the encounter rate is not 00, but the wild Pokémon list got overwritten after the battle so that didn't work either.

My only questions regarding manipulating the wild Pokémon list are:

1) Are there accessible glitch maps through manipulating a map connection with encounter lists based on the writable memory? If so, could we use them to encounter 3TrainerPoké even if we have to change the tileset and force a grass tile by event displacement manipulation?
2) Where are surfing Pokémon encounters stored?