Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

Another way to trigger the Walking Lag Glitch - Page 1

Another way to trigger the Walking Lag Glitch

Posted by: ISSOtm
Date: 2016-11-23 18:15:36
Approximate method, unconfirmed yet.

Works in French Red, running on a GBA SP.

Prerequisites : do not beat the following Trainers on Route 6 : the north-west long-range Trainer, and the guy talking to the girl in the middle.

1. Set up a Trainer Escape Glitch on Route 6, then return there.
2. Talk to the guy I mentioned previously, and fight his Squirtle. Beat it.
3. Upon defeat, he should say "… I'm awful !" (or something along these lines, in FR R/B it is "… J'suis nul !"). Get yer 400 rupees and exit. The battle should start again, but a glitch text box with a "2" should be also present.
4. Defeat that Squirtle again. His defeat speech should be a Pokémon cry, followed by the encounter/battle music starting over.
5. The same text box should pop up again, repeat step 4.
6. His defeat "text" will be similar to step 4's. Exit the battle and enjoy your glitch.


This setup doesn't seem to appear in the wiki article, but I didn't try this method with other setups ; please note that I also had a Trainer Escape Glitch set up on Route 24. Maybe that's why there were 3 encounters in a row (usually when triggering this glitch I got 2 instead).

Also, I tried talking to the south-east Trainer to trigger his battle, but after the battle he immediately saw me, and that was a softlock.

Maybe it won't work with other Trainers, because CF13 may get overwritten with battle-related data.

Re: Another way to trigger the Walking Lag Glitch

Posted by: Torchickens
Date: 2016-11-23 18:25:17
Interesting technique. Thanks for this ISSOtm. :) Walking lag glitch is one of those glitches I need to revise but feel free to add this to the wiki article once it's confirmed.

Re: Another way to trigger the Walking Lag Glitch

Posted by: ISSOtm
Date: 2016-11-23 18:35:22
I wonder why this glitch happens. What I have gathered is that the game tries to display a text box (hence the sound effects and disappearing sprites), but I don't know why it is. It also has to be related to map scripts, since this glitch only affects the map it takes place on.

Re: Another way to trigger the Walking Lag Glitch

Posted by: Torchickens
Date: 2016-11-23 18:46:49

I wonder why this glitch happens. What I have gathered is that the game tries to display a text box (hence the sound effects and disappearing sprites), but I don't know why it is. It also has to be related to map scripts, since this glitch only affects the map it takes place on.


From what I gathered about the glitch in the past, an invalid map script is exactly what happens. Many maps have their own 'specific map map script' value, and the invalid hex:15 script (execute DB3E) was used for my Pallet Town into Twinleaf Town exploit in Red/Blue.

For Trainer escape glitch places, the text box/encounter behaviour is controlled by map script 01; so setting a particular address such as W_ROUTE8CURSCRIPT to 01 will enable an encounter (manipulating one of the addresses may be possible with PC item underflow glitch and is partly how the Trainerless Mew glitch works). But if the value is set to another unintended value (via the walking lag glitch) the game may initiate a glitch script for the relevant map.

These are the specific map map script addresses.


W_OAKSLABCURSCRIPT:: ; d5f0
W_PALLETTOWNCURSCRIPT:: ; d5f1
W_BLUESHOUSECURSCRIPT:: ; d5f3
W_VIRIDIANCITYCURSCRIPT:: ; d5f4
W_PEWTERCITYCURSCRIPT:: ; d5f7
W_ROUTE3CURSCRIPT:: ; d5f8
W_ROUTE4CURSCRIPT:: ; d5f9
W_VIRIDIANGYMCURSCRIPT:: ; d5fb
W_PEWTERGYMCURSCRIPT:: ; d5fc
W_CERULEANGYMCURSCRIPT:: ; d5fd
W_VERMILIONGYMCURSCRIPT:: ; d5fe
W_CELADONGYMCURSCRIPT:: ; d5ff
W_ROUTE6CURSCRIPT:: ; d600
W_ROUTE8CURSCRIPT:: ; d601
W_ROUTE24CURSCRIPT:: ; d602
W_ROUTE25CURSCRIPT:: ; d603
W_ROUTE9CURSCRIPT:: ; d604
W_ROUTE10CURSCRIPT:: ; d605
W_MTMOON1CURSCRIPT:: ; d606
W_MTMOON3CURSCRIPT:: ; d607
W_SSANNE8CURSCRIPT:: ; d608
W_SSANNE9CURSCRIPT:: ; d609
W_ROUTE22CURSCRIPT:: ; d60a
W_REDSHOUSE2CURSCRIPT:: ; d60c
W_VIRIDIANMARKETCURSCRIPT:: ; d60d
W_ROUTE22GATECURSCRIPT:: ; d60e
W_CERULEANCITYCURSCRIPT:: ; d60f
W_SSANNE5CURSCRIPT:: ; d617
W_VIRIDIANFORESTCURSCRIPT:: ; d618
W_MUSEUM1FCURSCRIPT:: ; d619
W_ROUTE13CURSCRIPT:: ; d61a
W_ROUTE14CURSCRIPT:: ; d61b
W_ROUTE17CURSCRIPT:: ; d61c
W_ROUTE19CURSCRIPT:: ; d61d
W_ROUTE21CURSCRIPT:: ; d61e
W_SAFARIZONEENTRANCECURSCRIPT:: ; d61f
W_ROCKTUNNEL2CURSCRIPT:: ; d620
W_ROCKTUNNEL1CURSCRIPT:: ; d621
W_ROUTE11CURSCRIPT:: ; d623
W_ROUTE12CURSCRIPT:: ; d624
W_ROUTE15CURSCRIPT:: ; d625
W_ROUTE16CURSCRIPT:: ; d626
W_ROUTE18CURSCRIPT:: ; d627
W_ROUTE20CURSCRIPT:: ; d628
W_SSANNE10CURSCRIPT:: ; d629
W_VERMILIONCITYCURSCRIPT:: ; d62a
W_POKEMONTOWER2CURSCRIPT:: ; d62b
W_POKEMONTOWER3CURSCRIPT:: ; d62c
W_POKEMONTOWER4CURSCRIPT:: ; d62d
W_POKEMONTOWER5CURSCRIPT:: ; d62e
W_POKEMONTOWER6CURSCRIPT:: ; d62f
W_POKEMONTOWER7CURSCRIPT:: ; d630
W_ROCKETHIDEOUT1CURSCRIPT:: ; d631
W_ROCKETHIDEOUT2CURSCRIPT:: ; d632
W_ROCKETHIDEOUT3CURSCRIPT:: ; d633
W_ROCKETHIDEOUT4CURSCRIPT:: ; d634
W_ROUTE6GATECURSCRIPT:: ; d636
W_ROUTE8GATECURSCRIPT:: ; d637
W_CINNABARISLANDCURSCRIPT:: ; d639
W_MANSION1CURSCRIPT:: ; d63a
W_MANSION2CURSCRIPT:: ; d63c
W_MANSION3CURSCRIPT:: ; d63d
W_MANSION4CURSCRIPT:: ; d63e
W_VICTORYROAD2CURSCRIPT:: ; d63f
W_VICTORYROAD3CURSCRIPT:: ; d640
W_FIGHTINGDOJOCURSCRIPT:: ; d642
W_SILPHCO2CURSCRIPT:: ; d643
W_SILPHCO3CURSCRIPT:: ; d644
W_SILPHCO4CURSCRIPT:: ; d645
W_SILPHCO5CURSCRIPT:: ; d646
W_SILPHCO6CURSCRIPT:: ; d647
W_SILPHCO7CURSCRIPT:: ; d648
W_SILPHCO8CURSCRIPT:: ; d649
W_SILPHCO9CURSCRIPT:: ; d64a
W_HALLOFFAMEROOMCURSCRIPT:: ; d64b
W_GARYCURSCRIPT:: ; d64c
W_LORELEICURSCRIPT:: ; d64d
W_BRUNOCURSCRIPT:: ; d64e
W_AGATHACURSCRIPT:: ; d64f
W_UNKNOWNDUNGEON3CURSCRIPT:: ; d650
W_VICTORYROAD1CURSCRIPT:: ; d651
W_LANCECURSCRIPT:: ; d653
W_SILPHCO10CURSCRIPT:: ; d658
W_SILPHCO11CURSCRIPT:: ; d659
W_FUCHSIAGYMCURSCRIPT:: ; d65b
W_SAFFRONGYMCURSCRIPT:: ; d65c
W_CINNABARGYMCURSCRIPT:: ; d65e
W_CELADONGAMECORNERCURSCRIPT:: ; d65f
W_ROUTE16GATECURSCRIPT:: ; d660
W_BILLSHOUSECURSCRIPT:: ; d661
W_ROUTE5GATECURSCRIPT:: ; d662
W_POWERPLANTCURSCRIPT:: ; d663
W_ROUTE7GATECURSCRIPT:: ; d663
W_SSANNE2CURSCRIPT:: ; d665
W_SEAFOAMISLANDS4CURSCRIPT:: ; d666
W_ROUTE23CURSCRIPT:: ; d667
W_SEAFOAMISLANDS5CURSCRIPT:: ; d668
W_ROUTE18GATECURSCRIPT:: ; d669

Re: Another way to trigger the Walking Lag Glitch

Posted by: ISSOtm
Date: 2016-11-23 19:05:58
But why is the map script index set to an invalid value ? That's what I don't understand.

Re: Another way to trigger the Walking Lag Glitch

Posted by: Crystal_
Date: 2016-12-12 08:45:32
I'm trying this but I just get a static encounter when going back to route 6 and the squirtle guy battles me normally.

Re: Another way to trigger the Walking Lag Glitch

Posted by: ISSOtm
Date: 2016-12-12 09:33:46
Did you fight another Trainer before returning to Route 6 ? I didn't mention it, but the glitch has to be in the state where none of the Trainers on Route 6 see you (and no text box pops up when entering the route)

Re: Another way to trigger the Walking Lag Glitch

Posted by: Crystal_
Date: 2016-12-12 11:51:35
So I just got back home and I somehow managed to trigger this by first talking to someone in the pokemon center before going to route 6, which changed the text box id and led to a static battle with a bug catcher. The trainer-fly glitch left the route 6 script with 1, and a trainer battle advances 3 scripts, to id 4 (the whole process or the cur script increments is in home.asm but I haven't looked into it carefully). Script 4 is out of bounds, and essentially overflows into the text pointers, which typically have the TalkToTrainer call to initiate a battle (if they are trainer texts). This initiates the battle with a glitch text, and advances the cur script by 3 again. Eventually this overflows the text pointers too and it's when it generally would crash due to following garbage pointers (e.g. from the data of the first trainer in the route).

tl;dr: ARBITRARY CODE EXECUTION BABY

Edit, some more info. The trainer beaten flag is read from the address of the text script followed, plus 2. For example, with a script id of 4 in Route 6, Route6Text2 is followed, and a bit of [Route6Text2 + 2] is tested in order to determine whether to initiate the fight or not. So the outcome is purely luck based. In the cases where you don't get this "battleception" effect, you seem to always get the so called walking lag glitch, due to the game still trying to print some text, which is by the way, read from following the pointer at the text script plus 6 (e.g. [Route6Text2 + 6] and [Route6Text2 + 7]). The text isn't printed though; the text box is drawn in the tilemap, but not transferred to VRAM. This behavior seems to match the general behavior during the overworld, where only one row/column of data is transferred during the player's movement, and no data is transferred otherwise. Probably some flag that should be set before printing text and isn't set during this glitch (the font tiles aren't loaded either).

Fun fact. Text scripts start with TX_ASM which is interpreted as ld (d16), sp when executed as asm code. This means that a random RAM address could be corrupted depending on how the text script starts. This extra starting byte could also shift the following instructions and possibly even turn the TalkToTrainer call into another unrelated instruction. This doesn't seem very useful though.