Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation I Glitch Discussion

Pikawalk Glitch Information? - Page 1

Pikawalk Glitch Information?

Posted by: baconpants
Date: 2017-04-11 14:48:48
I am extremely curious about the glitch where Pikachu walks offscreen and the game becomes extremely confused. Is there any reason as to why a crash from this glitch may brick your save file? I would really like to know as my save file was corrupted while entering Glitch City and I lost my Pokemon to it. (That I was dearly attached to, but I'm attached to every one of them!)

Is the game just so confused by Pikachu it messes itself up, or does keeping track of Pikachu need a lot of work?

Re: Pikawalk Glitch Information?

Posted by: ISSOtm
Date: 2017-04-12 02:25:17
I don't exactly know why, but what happens is the game keeps track of your movement to move Pikachu. To do so, your movement is copied into a buffer, but when Pikachu is offscreen, the game writes past the buffer's bounds and ends up corrupting memory following the buffer. Now, as to why that bricked your save file, there may be a thousand different reasons. Mostly if you saved after attempting the glitch.

Re: Pikawalk Glitch Information?

Posted by: Torchickens
Date: 2017-04-12 02:52:57
That's right, the corruption affects addresses D438 onwards for the first step while Pikachu is off-screen with the following values:

South=01
North=02
West=03
East=04

So if you place Pikachu off-screen then move south, then west and east in that order, the data looks like 01 03 04.

It is possible to corrupt over 250 bytes using this glitch, I unfortunately can't remember the specifics but it might not be 255 bytes.

This is a list of addresses you may be able to corrupt using the glitch, from the Pokémon Yellow disassembly.


wExpressionNumber:: ; d447
ds 1
wPikaPicAnimNumber:: ; d448
ds 1

wPikachuMovementScriptBank:: ds 1  ; d449
wPikachuMovementScriptAddress:: dw ; d44a
wPikachuMovementFlags:: ; d44c
; bit 6 - spawn shadow
; bit 7 - signal end of command
ds 1

wCurPikaMovementData:: ; d44d
wCurPikaMovementParam1:: ds 1 ; d44d
wCurPikaMovementFunc1:: ds 1 ; d44e
wCurPikaMovementParam2:: ds 1 ; d44f
wCurPikaMovementFunc2:: ds 1 ; d450
wd451:: ds 1 ; d451
wCurPikaMovementSpriteImageIdx:: ds 1 ; d452
wPikaSpriteX:: ds 1 ; d453
wPikaSpriteY:: ds 1 ; d454
wPikachuMovementXOffset:: ds 1 ; d455
wPikachuMovementYOffset:: ds 1 ; d456
wPikachuStepTimer:: ds 1 ; d457
wPikachuStepSubtimer:: ds 1 ; d458
ds 5
wCurPikaMovementDataEnd:: ; d45e
ds wCurPikaMovementData - @


wPikaPicAnimPointer:: dw ; d44d
wPikaPicAnimPointerSetupFinished:: ds 1 ; d44f
wPikaPicAnimCurGraphicID:: ds 1 ; d450
wPikaPicAnimTimer:: ds 2 ; d451
wPikaPicAnimDelay:: ds 1 ; d453
wPikaPicPikaDrawStartX:: ds 1 ; d454
wPikaPicPikaDrawStartY:: ds 1 ; d455

wCurPikaPicAnimObject:: ; d456
wCurPikaPicAnimObjectVTileOffset:: db ; d456
wCurPikaPicAnimObjectXOffset:: db ; d457
wCurPikaPicAnimObjectYOffset:: db ; d458
wCurPikaPicAnimObjectScriptIdx:: db ; d459
wCurPikaPicAnimObjectFrameIdx:: db ; d45a
wCurPikaPicAnimObjectFrameTimer:: db ; d45b
ds 1
wCurPikaPicAnimObjectEnd:: ; d45d

ds 18

wPikachuHappiness:: ds 1 ; d46f
wPikachuMood:: ds 1 ; d470
wd472:: ds 1 ; d471
wd473:: ds 1 ; d472

ds 1

wd475:: ds 1 ; d474

ds 4

wd47a:: ds 1 ; d479

ds 24

wd492:: ds 1 ; d492

ds 1

wSurfingMinigameHiScore:: ds 2 ; 4-digit BCD little-endian
ds 1

wPrinterSettings:: ds 1
wUnknownSerialFlag_d499:: ds 1 ; d498
wPrinterConnectionOpen:: ds 1 ; d499
wPrinterOpcode:: ds 1 ; d49a
wd49c:: ds 1 ; d49b

ds 19

wNumSigns:: ; d4af
; number of signs in the current map (up to 16)
ds 1

wSignCoords:: ; d4b0
; 2 bytes each
; Y, X
ds 32

wSignTextIDs:: ; d4d0
ds 16

wNumSprites:: ; d4e0
; number of sprites on the current map
ds 1

; these two variables track the X and Y offset in blocks from the last special warp used
; they don't seem to be used for anything
wYOffsetSinceLastSpecialWarp:: ; d4e1
ds 1
wXOffsetSinceLastSpecialWarp:: ; d4e2
ds 1

wMapSpriteData:: ; d4e3
; two bytes per sprite (movement byte 2, text ID)
ds 32

wMapSpriteExtraData:: ; d503
; two bytes per sprite (trainer class/item ID, trainer set ID)
ds 32

wCurrentMapHeight2:: ; d523
; map height in 2x2 meta-tiles
ds 1

wCurrentMapWidth2:: ; d524
; map width in 2x2 meta-tiles
ds 1

wMapViewVRAMPointer:: ; d525
; the address of the upper left corner of the visible portion of the BG tile map in VRAM
ds 2

; In the comments for the player direction variables below, "moving" refers to
; both walking and changing facing direction without taking a step.

wPlayerMovingDirection:: ; d527
; if the player is moving, the current direction
; if the player is not moving, zero
; map scripts write to this in order to change the player's facing direction
ds 1

wPlayerLastStopDirection:: ; d528
; the direction in which the player was moving before the player last stopped
ds 1

wPlayerDirection:: ; d529
; if the player is moving, the current direction
; if the player is not moving, the last the direction in which the player moved
ds 1

wTilesetBank:: ; d52a
ds 1

wTilesetBlocksPtr:: ; d52b
; maps blocks (4x4 tiles) to tiles
ds 2

wTilesetGfxPtr:: ; d52d
ds 2

wTilesetCollisionPtr:: ; d52f
; list of all walkable tiles
ds 2

wTilesetTalkingOverTiles:: ; d531
ds 3

wGrassTile:: ; d534
ds 1

ds 4


I unfortunately don't know why the freezes from Pikawalk occur, but the reason why it can wipe the save may be related to the game filling the memory with 00 39 and affecting the SRAM.

As is documented, you can also use the Pikawalk for:

*Arbitrary code execution using glitch signs.
*To corrupt Pikachu's happiness/emotions.
*To enable 255 hours play-time.
*To create a 'Super Glitch City' (a Glitch City with an invalid tileset).
*To get the S.S. Ticket while Bill is still a Pokémon.
*To corrupt Trainer data.

Re: Pikawalk Glitch Information?

Posted by: baconpants
Date: 2017-04-12 16:58:30
Oh man, that's pretty neat!

I don't remember doing anything insane with my Pikachu, I was just typically walking along the exit of the Safari Zone, heading into Glitch City and of course, Pikachu starts going in different directions and not following me. As soon as it stepped out of the map, the game crashed with a screen similar to this:

[img]http://cdn.bulbagarden.net/upload/5/50/Redcrash.png[/img]

Similar to the one that appears when you encounter Yellow Missingno.