Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

International Dokokashira Door Glitch full development - Page 1

International Dokokashira Door Glitch full development

Posted by: Haxel
Date: 2015-12-19 11:00:26
Hello guys, I'm Haxel, another member of PRAMA Initiative's team (a french Pokémon glitch website, you probably already know ISSOtm and Krys3000). Since Krys3000 previously posted about potential ways to expand the Experience Underflow Glitch (I think he's gonna make an update of this soon) I decided to work more on the international Doko-Kashira Door Glitch, first to see if we could use for the Underflow, and also because it wasn't really documented much since its discovery by TheZZAZZGlitch.

So as you know maybe, the reason for this glitch to work is that when you get rid of the end-of-party terminator, the game reads all the following WRAM data as Pokémon, and for any given fake-Pokémon, if the address read as its Status matches the ID of the poison, the address read as its HP is decreased by 1 every 4 steps. To make this a little more clear, this is the standard memory section for a Pokémon's data (taken from DataCrystal, example for Pokémon 6):
D247 - Pokémon
D248-D249 - Current HP
D24A - Level
D24B - Status
D24C - Type 1
D24D - Type 2
D24E - Catch rate/Held item (When traded to Generation II)
D24F - Move 1
D250 - Move 2
D251 - Move 3
D252 - Move 4
D253-D254 - Trainer ID
D255-D257 - Experience
D258-D259 - HP EV
D25A-D25B - Attack EV
D25C-D25D - Defense EV
D25E-D25F - Speed EV
D260-D261 - Special EV
D262 - Attack/Defense IV
D263 - Speed/Special IV
D264 - PP Move 1
D265 - PP Move 2
D266 - PP Move 3
D267 - PP Move 4
D268 - Level
D269-D26A - Max HP
D26B-D26C - Attack
D26D-D26E - Defense
D26F-D270 - Speed
D271-D272 - Special

So if the game reads the following addresses as Pokémon data, THIS would be the data affected to fake-Pokémon 11:
D323 - Pokémon
D324-D325 - Current HP
D326 - Level
D327 - Status (Poisoned, Paralyzed, etc.)
D328 - Type 1
D329 - Type 2
D32A - Catch rate/Held item (When traded to Generation II)
D32B - Move 1
D32C - Move 2
D32D - Move 3
D32E - Move 4
D32F-D330 - Trainer ID
D331-D333 - Experience
D334-D335 - HP EV
D336-D337 - Attack EV
D338-D339 - Defense EV
D33A-D33B - Speed EV
D33C-D33D - Special EV
D33E - Attack/Defense IV
D33F - Speed/Special IV
D330 - PP Move 1
D341 - PP Move 2
D342 - PP Move 3
D343 - PP Move 4
D344 - Level
D345-D346 - Max HP
D347-D348 - Attack
D349-D34A - Defense
D34B-D34C - Speed
D34D-D34E - Special

But the normal use of address $D325 is 'Item 4 Quantity'. So if address $D327 (which is 'Item 5 Quantity') matches the ID of the poison (i.e. hex value of x8, x9, xA, xB, xC, xD, xE or xF) then every 4 steps, the quantity of item 4 decreases. When the quantity reaches 0, just like the HP are supposed to behave, this address rolls to FF, and $D324 which is the other byte of the HPs loses 1. So you will have x255 of the item just before in the big list. Have any item x8 in the 5th slot and Ultra ball x1 in the 4th slot, walk 8 steps, then you have Master Ball x255 instead. But when this second byte reaches 00, of course, the Pokémon 'dies' and the effect stops.

Just a reminder, to trigger this glitch you have several possibilities:
- Super Glitch in the traditionnal way described by TheZZAZZGlitch (27 letters before the Super Glitch move in the Rocket House of Celadon). Note that he described another technique for Yellow, I don't exactly know why, because this one also works, provided that you perform the corruption in the Party menu and not during a battle (because tile data is not brought into battle in Yellow).
- ZZAZZ Glitch with one, three, four or six Pokémon in the party, but this is more like a 'testing' option because it messes your game.
- Arbitrary Code Execution is a clean way to do it, probably the better way, but it's a little more tricky. Here is a 8F code giving you 7 Pokémon so you only have to switch Pokémon 1 and 7 to activate the DKD.
Any Item
8F / ws*l||lm||
Lemonade x7
X Accuracy x99 (98 in Yellow)
Carbos x209
Poké Ball x119
Fresh Water x201

Now let's talk about every effect of the DKD. You have to know that unlike what TheZZAZZGlitch saw, all of those effects happen in Red, Blue, and Yellow. There is absolutely no differences I have seen between the versions which is totally normal if you have understood the way the glitch works.

Minor Effects:

- The entries for owned Pokémon 9 to 24 changes every 4 steps (17 to 24, then 9 to 16) if the entries for owned Pokémon 33 to 40 matches the poison value.
- Some NPC sprites can randomly gets corrupted or turn into the player's sprite. This is because one of the poison-affected address is in a WRAM section dealing with the sprites, but I don't know much about this.
- Some pickable items can disappear or reappear. This is because the glitch affects the famous "Missable object flags" section Torchickens and Krys3000 have been working on lately.
- The third letter of the third Pokémon's name loses an ID every 4 steps, if the 5th letter of this name has a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 2nd letter loses an ID.
- The third letter of the first and sixth Pokémon's OT loses an ID every 4 steps, if the 5th letter of this OT has a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 2nd letter loses an ID.
- The tenth letter of the OT and nicknames of stored Pokémon 3, 7, 11, 15 and 19 loses an ID every 4 steps, if the 1st letter of the following Pokémon matches a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 9th letter loses an ID.
- The tenth letter of the Pokémon in the Day Care, if there is one, loses an ID every 4 steps, if the first letter of its OT has a "poison ID". When the ID reaches 00, after 4 steps, it goes to FF and the 9th letter loses an ID.
- Attack EXP Stats (a.k.a. EV) of stored Pokémon 4, 8, 12, 16 and 20 can lower every 4 steps depending of the Defense EXP Stats of the same Pokémon.

Blackout-warping and map misconnection effects

One interesting thing about the original DKD is the ability to warp. You can do something somehow similar in the international DKD. Every 4 steps, the 'blackout map', in which you reappear after blacking out, loses an ID. This works everytime because the address which is two bytes further is always FF (but I really don't know what it is). Then, you have to fix the glitch, and lose a battle, so you directly warp to the selected map.

The tricky part is usually, your 'blackout map' (address $D719) is a town, so you have to go below ID 0 (Pallet Town) to be back to FF so you can pick any map including the hall of fame. Well, the address for the other HP byte here is $D718, and it's normally 00. But this address is related to the sprite of boulders, so if you're standing in front of a boulder with Strengh active, it goes 03 or 02. Thus, if your 4th step is you going away from a boulder with Strengh active, the lowering effect happens BEFORE $D718 goes back to 00. The 'blackout map' will then change to FF and you're free to lower it.

It's also possible to change the ID of the 'blackout map' by changing the HP of Fake-Pokémon 34 (using curing items for example, but you need to have enough max HP or increase them) accessible via the Super Glitch technique if you had 28 letters, or the 8F code with 34 Lemonade.

There is another way to reach a given map and that's the effect described originally by TheZZAZZGlitch, but it also works in Red and Blue: after 4 steps, the second byte of the south connection lowers by one. So, after FF x 4 = 1024 steps, the first byte changes, and so does the south connection. If the south connection of your current map is Route 12, 1024 steps makes it to become Route 11. You have to understand that the first time you change the connection, you probably have less than FF in your poison-affected byte, so it will take less steps to change the connection. This does not work on every map because the fourth byte of the connection must have a 'poison ID'. It only naturally works on the following maps :
- Lavender Town
- Indigo Plateau (outside)
- Routes 1, 2, 6, 10, 12, 17, 21, 23 and 24
+ Several buildings and other cities like Celadon who doesn't have a natural south connexion but can be used with WTW.

Getting any Pokémon effect

So this is the part Krys3000 tried to use for the Expanded Experience Underflow but it couldn't work since you can't withdraw a 'negative EXP' Pokémon (see Torchickens' video here). Every 4 steps, Pokémon 9's hex ID is lowered by 1 if the 11th Pokémon ID has a 'poison ID' (note that having 10 Pokémon is having a FF terminator in the 11th slot, so this will make the glitch active). So this, for example, allows a Gyarados (hex ID 16) to turn into a Mew (hex ID 15) if you walk 4 steps. Remember: walking 4 new steps after the ID of this 9th Pokémon reached 00 will make him to take hex ID FF (Charizard 'M) but the 8th Pokémon will then lose an ID.

I don't have in mind the ws*l||lm|| setup for english games but be careful if you're using this method to trigger the glitch, not to change the Pokémon inside. This is an issue on french games so I usually change the active box to avoid it.

There is no other way to get a Pokémon with the DKD which can be explained with the mechanics of this glitch. I can't give any explanations to the previous reports of Party Pokémon changing (for a potential use in the Experience Underflow, which is the reason Krys3000 wanted me to work on this glitch), but we suspect this is a side effect of the Super Glitch method? Maybe TheZZAZZGlitch knows more.

Getting any item effects

There are two effects changing the IDs or quantities of items. The first trick is the one described in my example above, the quantity of item 4 lowering by 1 every 4 step if the quantity of item 5 is a poison value.

In the other effect, items 20 and 42 lose an ID every 4 steps if the IDs of items 21 and 43 respectively matches the poison value. So if you have 1 Ultra Ball (hex ID 02) in position 20 and 1 Antidote (hex ID 0B) in position 21 then walking 4 steps will turn the Ultra Ball in Master Ball. Once again, when the ID of the item gets below 00, it goes to FF and the item before (19 or 41 then) loses 1 ID. You just have to be careful not being too far away from the PC to withdraw the item before it changes again.

Getting any move effect, PP changing effect

The hex ID of the second move of stored Pokémon 3, 7, 11, 15 and 19 lowers every 4 steps if the ID of the 4th move of this Pokémon is a poison value. Example: if stored Pokémon 3 has Splash as 2nd move and Growl (hex ID 2D) as 4th move, walking 4 steps will turn Splash into Psywave. You are probably getting used to it but of course, if the ID of the move reaches 0, it will be the Cooltrainer move. 4 steps later, it will become glitch move FF and the first move of your Pokémon will lose an ID.

Meanwhile, PPs of the THIRD move of stored Pokémon 1, 5, 9, 13 and 17 lower every 4 steps, only if the following Pokémon's hex ID is a 'poison ID'. When they reach 0, walk 4 steps and the value goes to FF, so you now have 255 PP (however losing 1 PP of the previous move)! Of course healing your Pokémon will get everything back to normal.

Rival's name changing effect

While the DKD is active, the 8th letter of Rival's name lowers by 1 hex ID every 4 steps if the 10th letter of this name matches a 'poison ID'. I'm not sure if this helps a lot while using Rival's Cooltrainer or Rival's LOL Glitch, but you can also use this to turn this letter into the hex:50 end-of-name terminator (or the 7th letter, by walking enough steps), changing the number of letters in the name, so changing the letter displayed by a Rival's name item. (btw, I have recently made an exhaustive testing of Rival's name items for the letter they display according to the number of letters, if that's interesting to someone).

Other effects?

Here is the list of other addresses affected by the glitch. I either don't know what it is (not documented in the disassembly), don't know how to use it, or they cannot be used because the address two bytes after cannot get a poison value. If you want to have fun working on it!

- D3D5 (warp-related)
- D401 (warp-related)
- D42D (warp-related)
- D3A9 (unknown)
- D459 (unknown)
- D485 (unknown)
- D4B1 (unknown)
- D4DD (unknown)
- D535 (Grass tile, not usable)
- D611 (unknown)
- D695 (unknown)
- D6C1 (unknown)
- D6ED (unknown)
- D745 (unknown)
- D771 (unknown)
- D79D (unknown)
- D7C9 (unknown)
- D7F5 (unknown)
- D821 (unknown)
- D84D (unknown)
- D879 (unknown)

Re: International Dokokashira Door Glitch full development

Posted by: Krys3000
Date: 2015-12-21 10:16:37
I made a video to illustrate the 'blackout warping' to a wanted map explained by Haxel. In the video I show how to use the DKD to warp to the HoF and instantly finish the game.


Here is a translation of the description:

DKD warping effect:

When you manage to get 7 Pokémon in the Party and switch Pokémon 1 with Pokémon 7, it triggers the DKD: every 4 steps, the value of several memory addresses lowers by 1 if the memory address two bytes further has a value ending with 8, 9, A, B, C, D, E or F. To learn why, just read the post before this one which explains the mechanism of this glitch.

If you perform enough steps, you can get the value of an address to be 00. Doing 4 more steps, the value will change to FF and the value of the previous address will be lowered by 1, but this doesn't work if this previous address also has a value of 00.

Memory address $D719 ($D718 in Yellow) contains the hex ID of the last map in which you healed your party. This is the map in which you will warp if you faint during a fight. It cannot be naturally more than hex:15 (Route 10). When the DKD is active, its value always lowers every 4 steps, since two bytes further you have memory address $D71B ($D71A in Yellow) which is always FF.

Here's an english list of map's hex IDs and dec IDs :

The address before the 'blackout map', $D718 ($D717 in Yellow), is always 00 unless you are facing a boulder with STRENGTH active (it then becomes 03). To bring the 'blackout map' from 00 to FF, you will then need to do the 4th step FROM a boulder as shown in video, so 03 00 lowers to 02 FF.

Warning: at least on VBA, $D71B/$D71A goes back to 00 if $D719/$D718 goes to 00 while $D718/$D717 is also 00 (lol). This might be an emulator issue but to avoid it, you must do your 4th step from the boulder to lower the map to 00 and then again to lower it to FF (see video).

Introduction about 8F:

To get 7 Pokémon, I didn't wanted to use Super Glitch/ZZAZZ Glitch so I used this 8F code instead (this is the version adapted for english games):
1. (anything)
2. ws*l||lm|| (Y) / 8F (R/B)
3. Lemonade x7
4. X Accuracy x98 (Y) / x99 (R/B)
5. Carbos x209
6. Poké Ball x119
7. Fresh Water x201
Then I use the ws*l||lm|| (Y) / 8F (R/B) item. It will also work for you if you have the good Pokémon setup in the active box of the PC (Yellow) / in the party (R/B).

To learn how to get the ws*l||lm|| / 8F item you can read this (MissingNo. method) and this (No MissingNo. method). The first link will also teach you what is a Pokémon setup.

Yellow step-by-step:

0/ Have a Pokémon knowing STRENGTH. You must also have a fainted Pokémon (not the first). Have a proper Pokémon setup in the active box and the above-listed items. Having been healed for the last time in Pewter City is not an obligation but if you don't do this, you will have to adapt the steps (poison must be allowed to act dec ID + 1 times to reach FF)

1/ Use ws*l||lm||

2/ Without moving, change the active PC box to avoid a potential corruption of the Pokémon by the DKD (this depends of the setup you use).

3/ Go to the warden's house in Fuschia City.

4/ Switch Pokémon 1 et 7 and activate STRENGTH, then allows the poison to act three times (more/less if the current 'blackout map' is not Pewter) ; During the two last times, the step that triggers the poison must be done from the boulder.

5/ Walk 4 x (255-dec ID of the map you want to reach) steps. Here, 548 steps. Then switch back Pokémon 1 and 7.

6/ Change the active PC box again to put back the setup box then toss a limonade and use ws*l||lm|| so you can get 6 Pokémon again.

7/ Store every Pokémon but the fainted one.

8/ Exit the PC and walk a few steps : the game ends.

In R/B games, the idea is the same but you must have the good Pokémon in your team (and there is no need to change the active box).