International Dokokashira Door Glitch full development
Posted by: Haxel
Date: 2015-12-19 11:00:26
So as you know maybe, the reason for this glitch to work is that when you get rid of the end-of-party terminator, the game reads all the following WRAM data as Pokémon, and for any given fake-Pokémon, if the address read as its Status matches the ID of the poison, the address read as its HP is decreased by 1 every 4 steps. To make this a little more clear, this is the standard memory section for a Pokémon's data (taken from DataCrystal, example for Pokémon 6):
D247 - Pokémon
D248-D249 - Current HP
D24A - Level
D24B - Status
D24C - Type 1
D24D - Type 2
D24E - Catch rate/Held item (When traded to Generation II)
D24F - Move 1
D250 - Move 2
D251 - Move 3
D252 - Move 4
D253-D254 - Trainer ID
D255-D257 - Experience
D258-D259 - HP EV
D25A-D25B - Attack EV
D25C-D25D - Defense EV
D25E-D25F - Speed EV
D260-D261 - Special EV
D262 - Attack/Defense IV
D263 - Speed/Special IV
D264 - PP Move 1
D265 - PP Move 2
D266 - PP Move 3
D267 - PP Move 4
D268 - Level
D269-D26A - Max HP
D26B-D26C - Attack
D26D-D26E - Defense
D26F-D270 - Speed
D271-D272 - Special
So if the game reads the following addresses as Pokémon data, THIS would be the data affected to fake-Pokémon 11:
D323 - Pokémon
D324-D325 - Current HP
D326 - Level
D327 - Status (Poisoned, Paralyzed, etc.)
D328 - Type 1
D329 - Type 2
D32A - Catch rate/Held item (When traded to Generation II)
D32B - Move 1
D32C - Move 2
D32D - Move 3
D32E - Move 4
D32F-D330 - Trainer ID
D331-D333 - Experience
D334-D335 - HP EV
D336-D337 - Attack EV
D338-D339 - Defense EV
D33A-D33B - Speed EV
D33C-D33D - Special EV
D33E - Attack/Defense IV
D33F - Speed/Special IV
D330 - PP Move 1
D341 - PP Move 2
D342 - PP Move 3
D343 - PP Move 4
D344 - Level
D345-D346 - Max HP
D347-D348 - Attack
D349-D34A - Defense
D34B-D34C - Speed
D34D-D34E - Special
But the normal use of address $D325 is 'Item 4 Quantity'. So if address $D327 (which is 'Item 5 Quantity') matches the ID of the poison (i.e. hex value of x8, x9, xA, xB, xC, xD, xE or xF) then every 4 steps, the quantity of item 4 decreases. When the quantity reaches 0, just like the HP are supposed to behave, this address rolls to FF, and $D324 which is the other byte of the HPs loses 1. So you will have x255 of the item just before in the big list. Have any item x8 in the 5th slot and Ultra ball x1 in the 4th slot, walk 8 steps, then you have Master Ball x255 instead. But when this second byte reaches 00, of course, the Pokémon 'dies' and the effect stops.
Just a reminder, to trigger this glitch you have several possibilities:
- Super Glitch in the traditionnal way described by TheZZAZZGlitch (27 letters before the Super Glitch move in the Rocket House of Celadon). Note that he described another technique for Yellow, I don't exactly know why, because this one also works, provided that you perform the corruption in the Party menu and not during a battle (because tile data is not brought into battle in Yellow).
- ZZAZZ Glitch with one, three, four or six Pokémon in the party, but this is more like a 'testing' option because it messes your game.
- Arbitrary Code Execution is a clean way to do it, probably the better way, but it's a little more tricky. Here is a 8F code giving you 7 Pokémon so you only have to switch Pokémon 1 and 7 to activate the DKD.
Any Item
8F / ws*l||lm||
Lemonade x7
X Accuracy x99 (98 in Yellow)
Carbos x209
Poké Ball x119
Fresh Water x201
Now let's talk about every effect of the DKD. You have to know that unlike what TheZZAZZGlitch saw, all of those effects happen in Red, Blue, and Yellow. There is absolutely no differences I have seen between the versions which is totally normal if you have understood the way the glitch works.
Minor Effects:
- The entries for owned Pokémon 9 to 24 changes every 4 steps (17 to 24, then 9 to 16) if the entries for owned Pokémon 33 to 40 matches the poison value.
- Some NPC sprites can randomly gets corrupted or turn into the player's sprite. This is because one of the poison-affected address is in a WRAM section dealing with the sprites, but I don't know much about this.
- Some pickable items can disappear or reappear. This is because the glitch affects the famous "Missable object flags" section Torchickens and Krys3000 have been working on lately.
- The third letter of the third Pokémon's name loses an ID every 4 steps, if the 5th letter of this name has a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 2nd letter loses an ID.
- The third letter of the first and sixth Pokémon's OT loses an ID every 4 steps, if the 5th letter of this OT has a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 2nd letter loses an ID.
- The tenth letter of the OT and nicknames of stored Pokémon 3, 7, 11, 15 and 19 loses an ID every 4 steps, if the 1st letter of the following Pokémon matches a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 9th letter loses an ID.
- The tenth letter of the Pokémon in the Day Care, if there is one, loses an ID every 4 steps, if the first letter of its OT has a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 9th letter loses an ID.
- Attack EXP Stats (a.k.a. EV) of stored Pokémon 4, 8, 12, 16 and 20 can lower every 4 steps depending of the Defense EXP Stats of the same Pokémon.
Blackout-warping and map misconnection effects
One interesting thing about the original DKD is the ability to warp. You can do something somehow similar in the international DKD. Every 4 steps, the 'blackout map', in which you reappear after blacking out, loses an ID. This works everytime because the address which is two bytes further is always FF (but I really don't know what it is). Then, you have to fix the glitch, and lose a battle, so you directly warp to the selected map.
The tricky part is usually, your 'blackout map' (address $D719) is a town, so you have to go below ID 0 (Pallet Town) to be back to FF so you can pick any map including the hall of fame. Well, the address for the other HP byte here is $D718, and it's normally 00. But this address is related to the sprite of boulders, so if you're standing in front of a boulder with Strengh active, it goes 03 or 02. Thus, if your 4th step is you going away from a boulder with Strengh active, the lowering effect happens BEFORE $D718 goes back to 00. The 'blackout map' will then change to FF and you're free to lower it.
It's also possible to change the ID of the 'blackout map' by changing the HP of Fake-Pokémon 34 (using curing items for example, but you need to have enough max HP or increase them) accessible via the Super Glitch technique if you had 28 letters, or the 8F code with 34 Lemonade.
There is another way to reach a given map and that's the effect described originally by TheZZAZZGlitch, but it also works in Red and Blue: after 4 steps, the second byte of the south connection lowers by one. So, after FF x 4 = 1024 steps, the first byte changes, and so does the south connection. If the south connection of your current map is Route 12, 1024 steps makes it to become Route 11. You have to understand that the first time you change the connection, you probably have less than FF in your poison-affected byte, so it will take less steps to change the connection. This does not work on every map because the fourth byte of the connection must have a 'poison ID'. It only naturally works on the following maps :
- Lavender Town
- Indigo Plateau (outside)
- Routes 1, 2, 6, 10, 12, 17, 21, 23 and 24
+ Several buildings and other cities like Celadon who doesn't have a natural south connexion but can be used with WTW.
Getting any Pokémon effect
So this is the part Krys3000 tried to use for the Expanded Experience Underflow but it couldn't work since you can't withdraw a 'negative EXP' Pokémon (see Torchickens' video here). Every 4 steps, Pokémon 9's hex ID is lowered by 1 if the 11th Pokémon ID has a 'poison ID' (note that having 10 Pokémon is having a FF terminator in the 11th slot, so this will make the glitch active). So this, for example, allows a Gyarados (hex ID 16) to turn into a Mew (hex ID 15) if you walk 4 steps. Remember: walking 4 new steps after the ID of this 9th Pokémon reached 00 will make him to take hex ID FF (Charizard 'M) but the 8th Pokémon will then lose an ID.
I don't have in mind the ws*l||lm|| setup for english games but be careful if you're using this method to trigger the glitch, not to change the Pokémon inside. This is an issue on french games so I usually change the active box to avoid it.
There is no other way to get a Pokémon with the DKD which can be explained with the mechanics of this glitch. I can't give any explanations to the previous reports of Party Pokémon changing (for a potential use in the Experience Underflow, which is the reason Krys3000 wanted me to work on this glitch), but we suspect this is a side effect of the Super Glitch method? Maybe TheZZAZZGlitch knows more.
Getting any item effects
There are two effects changing the IDs or quantities of items. The first trick is the one described in my example above, the quantity of item 4 lowering by 1 every 4 step if the quantity of item 5 is a poison value.
In the other effect, items 20 and 42 lose an ID every 4 steps if the IDs of items 21 and 43 respectively matches the poison value. So if you have 1 Ultra Ball (hex ID 02) in position 20 and 1 Antidote (hex ID 0B) in position 21 then walking 4 steps will turn the Ultra Ball in Master Ball. Once again, when the ID of the item gets below 00, it goes to FF and the item before (19 or 41 then) loses 1 ID. You just have to be careful not being too far away from the PC to withdraw the item before it changes again.
Getting any move effect, PP changing effect
The hex ID of the second move of stored Pokémon 3, 7, 11, 15 and 19 lowers every 4 steps if the ID of the 4th move of this Pokémon is a poison value. Example: if stored Pokémon 3 has Splash as 2nd move and Growl (hex ID 2D) as 4th move, walking 4 steps will turn Splash into Psywave. You are probably getting used to it but of course, if the ID of the move reaches 0, it will be the Cooltrainer move. 4 steps later, it will become glitch move FF and the first move of your Pokémon will lose an ID.
Meanwhile, PPs of the THIRD move of stored Pokémon 1, 5, 9, 13 and 17 lower every 4 steps, only if the following Pokémon's hex ID is a 'poison ID'. When they reach 0, walk 4 steps and the value goes to FF, so you now have 255 PP (however losing 1 PP of the previous move)! Of course healing your Pokémon will get everything back to normal.
Rival's name changing effect
While the DKD is active, the 8th letter of Rival's name lowers by 1 hex ID every 4 steps if the 10th letter of this name matches a 'poison ID'. I'm not sure if this helps a lot while using Rival's Cooltrainer or Rival's LOL Glitch, but you can also use this to turn this letter into the hex:50 end-of-name terminator (or the 7th letter, by walking enough steps), changing the number of letters in the name, so changing the letter displayed by a Rival's name item. (btw, I have recently made an exhaustive testing of Rival's name items for the letter they display according to the number of letters, if that's interesting to someone).
Other effects?
Here is the list of other addresses affected by the glitch. I either don't know what it is (not documented in the disassembly), don't know how to use it, or they cannot be used because the address two bytes after cannot get a poison value. If you want to have fun working on it!
- D3D5 (warp-related)
- D401 (warp-related)
- D42D (warp-related)
- D3A9 (unknown)
- D459 (unknown)
- D485 (unknown)
- D4B1 (unknown)
- D4DD (unknown)
- D535 (Grass tile, not usable)
- D611 (unknown)
- D695 (unknown)
- D6C1 (unknown)
- D6ED (unknown)
- D745 (unknown)
- D771 (unknown)
- D79D (unknown)
- D7C9 (unknown)
- D7F5 (unknown)
- D821 (unknown)
- D84D (unknown)
- D879 (unknown)