Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation II Glitch Discussion

Pokémon Crystal: Better ACE through Key Items Glitch - Page 4

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Torchickens
Date: 2014-12-29 12:49:49

First of all, extremely good work so far. Seems like things are coming along towards a speedrun route here, even if the bad clone process on Crystal might end up being very painful to execute.

Have you guys tried using the Goldenrod Mart's elevator to warp to Red? That was a possible strat in Gold Coin Case until we saw it doesn't work on console (due to map window issues that don't affect this particular ACE as far as I know). I assume Goldenrod Center being broken has something to do with the JP Crystal's special Center in Goldenrod, but the mart should be unchanged…


Executing the code, entering the elevator and exiting does work, so thank you, but both exits still placed me in a glitched portion of Silver Cave like what happened to lucky :(. Lucky, I assume you did all this from a new save, so could you also try this please?

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Dabomstew
Date: 2014-12-29 12:56:08
Do you guys have a savestate/save file/anything you can upload to let me mess around with it? I'd like to check a few things but don't know how to set this all up from scratch myself yet.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: luckytyphlosion
Date: 2014-12-29 13:02:08
Here are all my savestates (yes I used bgb this time), but I don't exactly have them labeled so you'll have to figure out each one, though. Number 6 is when I enter the daycare before cloning, number 1 is right before I clone and number 0 is right before I begin the setup for balls pocket underflow/byte shift.

Dropbox Link

EDIT: The elevator does use the same system as the second floor Pokemon Center to warp yourself, right?
EDIT2: I tried the elevator without changing box names, still puts me in a glitched position.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Torchickens
Date: 2014-12-29 13:05:38

Do you guys have a savestate/save file/anything you can upload to let me mess around with it? I'd like to check a few things but don't know how to set this all up from scratch myself yet.


This is my save.

I did cheat, because I skipped getting a bad clone and just changed the number of balls, but I placed the jump instruction into DA20 and manipulated an 09 in D959 (Pokédex mode) manually.

Before this I did some testing of how to set this up even though I didn't do this on the save above; the testing was some working steps after getting bad clone (Water Gun in slot 1, then slot 2, then slot 3 for three ItemFinders), and then Luckytyphlosion's key item underflow method.

I hope this is OK.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Dabomstew
Date: 2014-12-29 13:06:49
I'm still at a seriously n00b level here - are any of your uploaded states in position to execute the code immediately, and if so how do I do it?

EDIT: derp! Just had to look at the Pokedex. And confirmed my suspicions - Goldenrod Mart works!

1) Enter Goldenrod Mart
2) Go up to 2F
3) Arbitrary code
4) Enter & exit elevator
5) Talk to Red
6) GG

The missing part was telling you guys to not be on 1F, since it has 4 exits instead of 3 like all the other floors. The elevator is always the last exit on each floor, and you need it to be index 2, not index 3, so you need to go to any other floor other than the ground floor.

As for why Goldenrod's Center didn't work? It was remnants of the communication center from JP as i expected.


db $4
warp_def $7, $3, 15, GROUP_GOLDENROD_CITY, MAP_GOLDENROD_CITY
warp_def $7, $4, 15, GROUP_GOLDENROD_CITY, MAP_GOLDENROD_CITY
warp_def $6, $0, 1, GROUP_GOLDENROD_POKECOM_CENTER_2F_MOBILE, MAP_GOLDENROD_POKECOM_CENTER_2F_MOBILE
warp_def $7, $0, 1, GROUP_POKECENTER_2F, MAP_POKECENTER_2F


(vs any other center:)

db $3
warp_def $7, $3, 1, GROUP_AZALEA_TOWN, MAP_AZALEA_TOWN
warp_def $7, $4, 1, GROUP_AZALEA_TOWN, MAP_AZALEA_TOWN
warp_def $7, $0, 1, GROUP_POKECENTER_2F, MAP_POKECENTER_2F

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Torchickens
Date: 2014-12-29 13:19:13

I'm still at a seriously n00b level here - are any of your uploaded states in position to execute the code immediately, and if so how do I do it?


I got ninja'd. Congratulations on finding a quicker work around and explaining why it took us to a glitch area!

I'll give you a basic summary of what happens, although you might have the idea already if you were reading this thread before you registered.

Yes. On my save file opening the Pokédex will execute the arbitrary code.

The byte D959 is supposed to hold valid Pokédex modes including old Pokédex (00), new Pokédex (01) and A-Z (02); but values beyond that will execute a garbage pointer, including from the memory for some indices.

When D959 is 09 it executes arbitrary code from FA20 (echo RAM for DA20).

With the duplicate key items glitch you can corrupt the balls pocket so that it holds 255 balls (D8D7=FF). In this glitch inventory we can access D959 (a quantity) and place x09 there, and DA20 (an item), where we can place two items representing junk code and a jump instruction there to FB90 (box 4 character 1, where we use lucky's code). The items are Burn Heal x195
Dragon Fang x251 (both will appear x0 in the glitch inventory, with Dragon Fang perhaps only appearing if you corrupt the balls from a new game. You can't toss them, but all you have to do is deposit them with the right quantity in the PC; PC items directly follow balls in the glitch inventory) but you have to be careful as the items sometimes shift up when you place new ones.

We want 254 balls so that we can swap items beyond the buffer without the cursor going back to the top (luckytyphlosion's set up from a new save will let you get 254 balls). You also have to avoid viewing the "?" item's description by using select to register an item, as the description basically freezes the game.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: luckytyphlosion
Date: 2014-12-29 13:33:15
Finished instructions starting from obtaining a bad clone.


instructions after getting bad clone
depo useless and withdraw clone
have 6 mons in your party (5 mons + bad clone)
give and take back from daycare
put the bad clone in the front of party
use "move pkmn w/o mail" to move a croc to the front of the party (the party should look only have "CANCEL" in front of it)
put the bad clone in the daycare (the bad clone should be in slot 2)
swap to an empty box and deposit one croconaw
log off the pc and swap the 3rd croconaw's moves so that water gun is the second move
continue depositing from the FIRST pokemon until you can't deposit anymore (do not scroll down to deposit, just mash A to deposit the first)
withdraw all tm31s from the duped pokemon and walk to the mart.
sell the tm31s to get money, and buy:
enough balls to get 54 Poke balls
1 Great Ball
9 Flower mails
any money can be used to buy extra items for swapping in underflowed item pack
SAVE HERE!
Swap the second and third itemfinder, to create a coin case.
In the Balls pocket, the 54 Poké Balls and the 1 Great Ball will have turned into a Coin Case and 255 master balls.
Swap the Coin Case and Master Balls.
Close the item menu, log on to the PC and deposit the Coin Case in the Key Item Pocket.
Deposit some items with quantities too, for swapping. Swap the two itemfinders.
Your Key Items Pocket now has 255 items, but you can't use it to much use.
Instead, deposit an itemfinder from your key items pocket to byte shift your balls pocket so you now have 255 balls.
swap to the balls pocket, press 1 down, and select the coin case.
swap the coin case with the coin case you deposited.
select any item, and when your cursor is on a burn heal, press b.
log on to the pc and deposit 195 burn heals. (press down twice, and press left 6 times to get to 195 burn heals, then press a to depo)
press b after depositing, log off and scroll up to the burn heals you deposited. press b, and select the 195 burn heals.
press select again when you're a few items above master balls and 42 rare candies.
select the burn heals again, and press b when you find a dragon fang with 0 quantity.
deposit 251 dragon fangs into the pc.
select the dragon fangs, and scroll up to the 9 flower mails you deposited, and press b.
select the 9 flower mails, and swap them with the item 2 below the "? x2" item.
select the 9 flower mails, and press b on the 251 dragon fangs.
swap the 251 dragon fangs with the 195 burn heals.
exit the item menu and name your boxes starting from box 4
walk to goldenrod mart to the 2nd floor
walk to the elevator door (don't walk into it)
look at pokedex, then walk in and out of the elevator door
talk to red
mash hand on keyboard acquire free wr


The box names should be on one of my later posts (I think page 3?)

EDIT: Unrelated question to Crystal ACE, in the gold glitched run, why do you need to set "break on OAM DMA bad accesses" when all it does is bring up the Debugger when OAM DMA accesses non-hram?

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Dabomstew
Date: 2014-12-29 13:33:45
Thanks for the explanation Torchickens. I have indeed been following this a fair bit, but I haven't tried any of it myself so I don't really have my head around the entire sequence of glitches you chain together to achieve this result yet. Your explanation of the post-key-items bit helps a lot.

I'll offer my own explanation of the position glitch  thing. Basically, when you activate a warp to index 255 (such as in every Center + Goldenrod Mart), the game uses RAM values to pick what mapbank/mapnumber/index to place you on. So in Crystal's Goldenrod Center, the stored warp index is 4 (indexes appear to start from 1, not 0) so you get put on index 4 of Red's room in Silver Cave. In Gold, Goldenrod Center was a normal center with 3 warps, so the stairs to the 2nd floor were index 3. Similarly, Goldenrod Mart 1F's elevator entrance is index 4, while 2F-5F have it as index 3.

But where does this put us on the map we're going to? Well, Red's room only has /one/ warp, as it has a one-tile-wide cave entrance. So both index 3 and index 4 on it are actually invalid warps, and read from data that isn't warp data. But this data is still from ROM, and is in fact the same data as it was in Gold, because it ends up reading the game's entry for Red himself as warp data.

The relevant data (the real warp is bolded, warps take 5 bytes each where the first is Y-pos and second is X-pos):


21 09 02 03 4B
00 00 01 06 0E
0D 07 00 FF FF
80 00 03 46 62

Warp index 1 = y=33, x=9 (the valid index)
Warp index 2 = y=0, x=0 (this would put us in the middle of the rock structures to the left and we'd be trapped)
Warp index 3 = y=13, x=7 (this puts us right next to Red, same position as gold)
Warp index 4 = y=128, x=0 (this is completely useless and results in the glitched position)

Conclusion: index 3 is the way to success, the communication center almost messed it up, but luckily Goldenrod Mart is a thing.

EDIT: In response to lucky's post:

part 1) I get your instructions up to where you say to swap the itemfinders, at what point did you actually obtain the itemfinders? Some clarification would be nice (or I guess I can just wait for you to compile the full route including the stuff before bad clone :P )

part 2) I don't remember the exact details from the full explanation Sanqui gave for this, but I do know that the way we return control back to the game in the Coin Case ACE exploit messes up the game's sprite system in a way that causes OAM DMA to do invalid stuff if left alone. If you have this box unchecked, then you can remove a certain part of the box names that disables the overworld sprites to prevent the game crashing when you end your code and the game will still work, whereas an original console will crash. So checking this box is necessary to better simulate what an actual console would do when the Coin Case ACE is used. If the debugger comes up, a real console would have crashed.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Torchickens
Date: 2014-12-29 13:48:29
You're welcome. I think that even though this may look complicated to do at first, it really isn't complicated, (like with most things if you follow the steps carefully it will become more natural) because after you get the glitched inventory from the 3 Itemfinders (and the steps that follow), all you need to do is set the box names, place the right values in the right places using the glitch balls inventory, and use the Pokédex from Goldenrod Mart.

People like you, lucky, SheNanagans, etc. have done more complicated things/routes.

Thank you for your warp explanation! I have heard of this 'Special' mechanic where certain maps place you in the last location, but I didn't know exactly how it works.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Dabomstew
Date: 2014-12-29 13:55:04
Yeah, to be fair this isn't too dissimilar to Gold's Coin Case route in that way. Creating the route from scratch was a complex process for Sanqui, but once it was over with the end result was very easy to execute. The same can be said here, excluding the singular very difficult event (getting a bad clone).

I edited my above post with some questions/answers for lucky, so hopefully he responds to that.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: luckytyphlosion
Date: 2014-12-29 13:55:35
I wrote the route on the wiki, but it's kinda messy so you might want to fix it. I haven't tested this route in one go, so tell me if anything doesn't make any sense: Route

Making the route wasn't too hard. I analyzed dabomstew's TID coin case route and translated to crystal ram addresses, and it was much easier since Pokedex ACE relies on an actual function that has the game execute code, rather than the PC running off and executing code independant from the game. This way, I could remove much of the other codestuff (no 3 pops, no ei, inc sp), and the addresses for crystal didn't require as much setup as gold. (only needed to load two  new letters)

EDIT: You get the itemfinders by taking the items from the 3 Pokémon you withdraw after the final steps of the Celebi Trick.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Torchickens
Date: 2014-12-29 14:09:47

part 1) I get your instructions up to where you say to swap the itemfinders, at what point did you actually obtain the itemfinders? Some clarification would be nice (or I guess I can just wait for you to compile the full route including the stuff before bad clone :P )

This was the method I used, but with lucky's latest route it may no longer be relevant:
I got the three Itemfinders by doing the following steps:
1) Using a bad clone and move w/o mail, move a Pokémon to slot 1 when you have 6 to get rid of the party terminator.
2) Move the bad clone to the bottom of the party. This seems to prevent a party white screen later.
3) Deposit the top Pokémon (which became glitched) and then deposit three Pokémon (the order will matter. Deposit Pokémon 1, then Pokémon 2, then Pokémon 3) which have the following moves:

Pokémon 1: Move 1 - Water Gun
Pokémon 2: Move 2 - Water Gun
Pokémon 3: Move 3 - Water Gun

After this, the Pokémon that you store will have the Itemfinders.

But Lucky has just done a version that lets you get extra money and I'm not sure where the TM31s came from. I'm afraid I don't know what requirements that needs.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: luckytyphlosion
Date: 2014-12-29 14:19:57
Oops, forgot to put in the route that you give Croconaw TM31 before duplicating, so you have TM31s to sell :P. I added it in the route, before I posted, but I didn't realize it until now.

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Dabomstew
Date: 2014-12-29 14:24:18
Well I followed the route up to the point where you need to get a bad clone, am now stuck on that (surprise, surprise). Does the setup you came up with require 5 pokemon in the box and you deposit 5 more, or just depositing 5 into an empty box?

Re: Pokémon Crystal: Better ACE through Key Items Glitch

Posted by: Torchickens
Date: 2014-12-29 14:25:06

Oops, forgot to put in the route that you give Croconaw TM31 before duplicating, so you have TM31s to sell :P. I added it in the route, before I posted, but I didn't realize it until now.


Ah. Thanks then. :)