Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation II Glitch Discussion

New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time) - Page 1

New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Torchickens
Date: 2015-07-14 12:47:48
I found what may be a new development in Pokémon Crystal speedrunning (that does not work for the English version) thanks to the "Missingning" glitch, so I used that to beat Pokémon Crystal in 43 minutes (with save states).

The most important glitch here other than the bad clone glitch is "Missingning", found by Paco81, in which you view a hex:FF's status and corrupt data.

In Japanese Crystal, Spanish Crystal (possibly others) but not English Crystal (at least not in the same place), when you step three steps right or more from the Goldenrod Pokémon Center and view the status of an FF ?????, you will be warped to the Bug Catching Contest building.

Your items and TM/HMs will become corrupted.

If you used a spot more than three steps east away, your balls, key items, TM/HMs, some of your PC items become corrupted too (the number of items get corrupted to a large value too). The large number of PC items means you cannot deposit the items you need in the PC for this route without a workaround (the game will state storage is full).

The workaround is that you can buy some items to introduce an FF in the PC items before Missingning (this means items appear properly in the PC and you do not need too many unique items, maybe 5), and then keep swapping "?" items with themselves to get a reasonable amount of items.

However, this takes time, so it seems to be better to use the spot exactly three steps away and corrupt the key items and balls pocket manually; because the only thing you have to do for this is swap items around/make the Lure Ball the first ball/make a higher ID item like TM01 the first ball (doesn't really take time at all).

Assuming that the Missingning corruption effects work on cartridge, I want to see if this route is really faster (it seems to be), so I would like a Pokémon speedrunner to run it, but there is one problem:

Sadly the route requires lots of counting to know where you are in the Balls pocket. However, if we are able to set the number of items to a specific amount that is not too high (when we byte shift the balls pocket a second time so that item 1 e.g TM01 becomes the number of items), this may mean you could scroll to the bottom of the balls pocket and count just a few times.

Potential problem 2:

Due to a glitch (I assume the save file $A800=FF glitch), simply entering the PokéCom Center may freeze the game.

This happened to me when I tried the run from power on. However, after I tried the run from power on again but used the reset save data function, the PokéCom Center no longer froze. Perhaps using the reset save data function fixes it, but I don't know for sure.

Potential problem 3:

One time after Missingning the game froze after I closed the Bug-Catching Contest results. The second time I tried this it worked. I wasn't really paying attention to what I was doing sadly, but maybe you have to only press B to avoid it.


Steps:

1) Do route as normal up to Goldenrod City. Pick up Kurt's Lure Ball and make it your only Poké Ball after catching a second Pokémon.
  The second Pokémon should be Abra if possible, so you can Teleport to the PCC Center to avoid Trainers north of Goldenrod after Missingning takes us into the north-east Bug-Catching Contest building.
2) Get a Bad Clone (hex:00) then turn it into a hex:FF using move w/o mail. Make sure you put Abra in the PC so you don't corrupt it (I need to elaborate on these steps)
  If party refuses to work, somehow fix it. Name boxes here or at Bug Catching Contest.
3) Enter Goldenrod PCC Center, do Missingning three steps right of Goldenrod PCC Center to warp to the north-east Bug Catching Contest building.
4) Step out of the contest building and back in to avoid a possible freeze when you open the bag and close it.
5) Deposit a TM01 into PC from glitched TM/HM pocket inventory as well as TM15 x195.
6) In regular items pocket, swap TM38 into ? x0 (corrupts key items pocket) (note: other swaps may work too)
7) In Key Items pocket, swap first ? x0 with ? x1 (above Kurt's ball) (note: other swaps may work too).
Ball ID becomes number of balls and you will receive Master Ball x255.
8) Move the TM01 up to the first balls slot.
9) In Key Items pocket do step 7 again to get 191 (TM01's index number) balls.
10) Deposit 251 Star Pieces from the items pocket into the PC.
11) The TM15 x195 and Star Piece x251 will appear in the glitched balls pocket. Swap them into the right place (Pokégear may disappear). (the hardest part because it's hard to know what item quantity represents DA10)
12) Teleport back to Goldenrod with Abra (otherwise you'll probably have to walk it)
13) Enter Goldenrod Department Store. Go up to the second floor. Use balls pocket TM15. It should execute the code you wrote in box names. Enter the lift. Go out to warp to Mt. Silver summit.
14) Talk to Red to beat the game.

Execution details:
When TM/HMs are outside of their relevant pocket, they can execute arbitrary code. Using Missingning, we obtain all TM and HMs and can store them in the PC. With an expanded balls pocket, PC items will appear beyond the balls pocket, allowing us to use the TM/HM's glitch effect.

TM15 is most useful and jumps to FA10 (DA10), which is somewhere in the glitched balls inventory (what item quantity exactly is it?). I think it is slightly better than glitch Pokédex mode 09 for this run because you don't need to place 09 into D94C (the glitch Pokédex mode) and FA20 (glitch Pokédex mode 09) is the earliest glitch balls inventory Pokédex mode pointer.

List of execution pointers (TM/HMs):
here

List of execution pointers (glitch Pokédex modes):
here

At DA10 (in the middle of glitched balls inventory) we need:

(item) x195, Star Piece x 252 (represents C3 84 FB - a jump to FB84, box 4 name character 2)

We place them into glitched balls pocket by putting it into the items PC, then swap them into DA10+.

For (item) x 195 I used TM15; the item that executes FA10. Star Piece x0 is found somewhere in the glitched regular items pocket (luckily) and you can deposit 195 of them.


Now, if you name your boxes from box 4 the following, you can use TM15, then make Red appear, change your number of Pokémon to 0 (allowing instant victory by challenging any Trainer), change the map to Mt. Silver and warp there if were at Goldenrod Department Store 2F, entered the lift and exited.


づづ
ぶぶぶ

きづきみ

Final box name @DB83 code (actual execution at DB84):

Bytes:
AF AF AF 26 DB 2E 50 00 00 2C 32 26 DC 2E 9D 32 50 00 3C 3C 3C 26 DC 2E 80 2D 50 2D 2D 2D 2D 32 2E 7F 2D 50
2D 2D D6 B7 32 B7 D0 50


ASM:

xor a
xor a
xor a
ld h,DB
ld l,50
nop
nop
inc l
ldd (hl),a
ld h,DC
ld l,8D
ldd (hl),a
ld d,b
nop
inc a
inc a
inc a
ld h,DC
ld l,80
dec l
ld d,b
dec l
dec l
dec l
dec l
ldd (hl),a
ld l,7F
dec l
ld d,b
dec l
dec l
sub a,B7
ldd (hl),a
or a
ret nc
ld d,b
nop


How to improve:
1) Try to remove the element of counting too much in order to find the DA10 quantity more easily.
2) The code could be optimized, and perhaps it would be better if you could make it change your Teleport location to Mt. Silver.
3) My menuing wasn't very good, so a speedrunner who is more experienced with menuing should be able to save time in that respect.


Video (click to load): https://www.youtube.com/watch?v=D0VVZY5s_ac
BizHawk-1.9.1 movie: https://mega.co.nz/#!cos3hDAQ!nuv99WzlbuYeKN7onI-jiTx-SojQ942uHiuvhaSJtIA

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: kaikun97
Date: 2015-07-15 04:10:51
I watched this on YouTube and its really interesting. What else can you do with this arbitrary code execution method? I don't have a full understanding of this as I do not know assembly.

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Torchickens
Date: 2015-07-15 11:19:51

I watched this on YouTube and its really interesting. What else can you do with this arbitrary code execution method? I don't have a full understanding of this as I do not know assembly.


Thanks! Anything you can code that is short enough really.

Using the items in the run (TM17 x195 Star Piece x251), you can write 47 byte long programs from box names (or more if you make use of the terminator 50 in your code like I did here to access DB50; one off the Red address); and if you get an alternative item (Pink Bow x251, maybe you could write a program with the Star Piece method that gives you that) then you could start your code at box 1 and have space for a 72 byte long program (8*9: Maximum box name length*9 boxes).

The possibilities are endless if an opcode or operand (xx or yy value for the opcode) ID is the same as a reasonable character and the program fits.

Using ld h,D8 ld l,E6 jp (hl) - "?" we can redirect the code to D8E6 (PC item 1 quantity) and run programs longer than 47/72 bytes with specific stored PC items.

We can change values in RAM to anything if that can be represented with text character IDs.

Let's say we want to get Celebi. We can turn Pokémon 1's species byte 2 into Celebi (this can be an Egg if you like so it hatches and appears in the Pokédex or you can put it in the Day Care and out to get the Pokémon you desire) by setting DCA5 to FB (the equivalent of the GameShark code 01xxA5DC).

We can try:

ld h,DC
ld l,A5
xor a  ; a=00
sub 05 ; a=FB (Celebi)
ld d,b (50 box name terminator)
ldd (hl),a
or a
ret nc

This is:

Box 4: (any character)
Box 5: づきみ

P.S. A regular ret (の) may work as well so box 5's name might only need to be "づの". I'm unsure why the or a ret nc was part of the English Crystal glitched run but I seem to remember there being a reason unless I imagined it.

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Krys3000
Date: 2015-07-18 10:49:24
Hey!

Just to mention,

The missingning/warp method does not work either in French versions. I have no idea why this works on Spanish ones  :o

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Torchickens
Date: 2015-07-22 11:51:12

Hey!

Just to mention,

The missingning/warp method does not work either in French versions. I have no idea why this works on Spanish ones  :o


Hey Krys3000!

OK. Thanks for that information. :)

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Torchickens
Date: 2016-09-02 16:21:59
*Bump*

In the Niconico video described in this post, taba activates the GS Ball Celebi event in Japanese Crystal using TM18 (rather than TM15) arbitrary code execution.

According to the data dump I created for glitch TM execution pointers, TM18 should execute D261 which is the third "enemy Trainer" byte in the Japanese Crystal GameShark codes archive. I haven't tested whether it does execute D261 yet and can test to see shortly. If it turns out to be true, does anybody know how this or the data following D261 could be manipulated for making code to obtain Celebi?

Edit: I edited the values at D261 to code that would change the first item into a Master Ball and it successfully worked.

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Yeniaul
Date: 2016-09-02 17:21:22

*Bump*

In the Niconico video described in this post, taba activates the GS Ball Celebi event in Japanese Crystal using TM18 (rather than TM15) arbitrary code execution.

According to the data dump I created for glitch TM execution pointers, TM18 should execute D261 which is the third "enemy Trainer" byte in the Japanese Crystal GameShark codes archive. I haven't tested whether it does execute D261 yet and can test to see shortly. If it turns out to be true, does anybody know how this or the data following D261 could be manipulated for making code to obtain Celebi?
If I remember correct, your main on WyeTubz is "ChickasaurusGL", right Torchickens? You, of ALL people, should know how this works. Remember how your "delete event objects" method works in Gen 1? Game Freak used this method of "disposal" for lists until Gen 5.
Think about this:
What conbination of routes can I use to get the code I want? The FF deposited at the end is a problem, but a JMP would make quick work of that. And there's plenty of bytes to work with. Take this info you learned in Gen 1 and just… think through it. Write your ASM and think "How can I pull this off?"
[size=4pt]GOD I'm sick of being the only one here who can think logically… I do everyone else's theorizing.[/size]

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Yeniaul
Date: 2016-09-02 18:43:57

Edit: I edited the values at D261 to code that would change the first item into a Master Ball and it successfully worked.

Well, there you go. Was I right? I'm fairly sure I was, but if not, you can tell me. I'll admit to my mistakes… when someone shows me evidence.

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Torchickens
Date: 2016-09-02 19:07:42


*Bump*

In the Niconico video described in this post, taba activates the GS Ball Celebi event in Japanese Crystal using TM18 (rather than TM15) arbitrary code execution.

According to the data dump I created for glitch TM execution pointers, TM18 should execute D261 which is the third "enemy Trainer" byte in the Japanese Crystal GameShark codes archive. I haven't tested whether it does execute D261 yet and can test to see shortly. If it turns out to be true, does anybody know how this or the data following D261 could be manipulated for making code to obtain Celebi?
If I remember correct, your main on WyeTubz is "ChickasaurusGL", right Torchickens? You, of ALL people, should know how this works. Remember how invisible items work in Gen 1? Game Freak used this method of "disposal" for lists until Gen 5.
Think about this:
What conbination of routes can I use to get the code I want? The FF deposited at the end is a problem, but a JMP would make quick work of that. And there's plenty of bytes to work with. Take this info you learned in Gen 1 and just… think through it. Write your ASM and think "How can I pull this off?"
[size=4pt]GOD I'm sick of being the only one here who can think logically… I do everyone else's theorizing.[/size]


I'm unsure if you misunderstood what I meant and mean I don't know what the addresses are in the Japanese version beyond D261 (and not a general question about how to manipulate code), so my question was more 'what is that data'; because it's not listed in the codes archive. Once the data past D261 is mapped out (possibly with the help of English Crystal WRAM map) if you were talking about preparing the code without cheats then yes, with whatever data is there it would be a matter of manipulating it to let the code fall through to anything that could be represented as code and avoiding bad instructions like rst 38 (FF).

I appreciate your help and you (or anyone else) don't have to theorize about anything but I don't feel it's nice to express negative thoughts on the boards re: sick of doing all the work as people may see it as impolite or an indirect attack, and I feel "You, of ALL people" came across a little rude.



Edit: I edited the values at D261 to code that would change the first item into a Master Ball and it successfully worked.

Well, there you go. Was I right? I'm fairly sure I was, but if not, you can tell me. I'll admit to my mistakes… when someone shows me evidence.

I did it with a cheating device as proof of concept so this wasn't a true verification; only proof that TM18 executes arbitrary code at D261 in Japanese Crystal.

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Yeniaul
Date: 2016-09-02 19:39:39
Sorry… I misunderstood. I thought you were literally stumped on how to do this. (That's not an excuse, it's just an explanation of what happened.) I hope you can forgive me.

And on the topic of manipulation:

Remember your video on deleting objects in RBGY? Remember how the byte "disposal" worked (or rather didn't exist)? That applies here. And since it's executing from the THIRD trainer data byte, logically, wouldn't it execute from the FOURTH? You could just go from area to area, writing code with Game Freaks' assholery (the list 'disposal') and hopping the FFs. Theoretically, of course. It'd be like the position aspect of the Coin Case in Gen2, but with more travel, and there'd be the problem of intermediate routes, unless we could hit up the Item Pack or boxes on this trip through *RAM?

Oh, and when my PC's FINALLY stable I can start expunging people's old inventory/box data in SAVs so there's a NOP sled instead of old item data. Y'know, for those glitches that have to have the Box/Inventory in the most-items-there-have-ever-been state. :D

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: TheZZAZZGlitch
Date: 2016-09-03 03:56:59
If it turns out to be true, does anybody know how this or the data following D261 could be manipulated for making code to obtain Celebi?


Address $D261 is indeed in the middle of enemy trainer data. If this data is made harmless, the execution slides all the way to $D48E, which contains the player's name. This can be manipulated to jump anywhere we'd like. On the video, the player's name is set to "てみ" - which is 0xC3, 0x05, 0xD0 - jp $d005. I assume that the author of the video put some code there to activate the event.

Re: New Japanese Pokémon Crystal speedrun route (test: 43 minutes in game time)

Posted by: Torchickens
Date: 2016-09-03 07:26:43

Sorry… I misunderstood. I thought you were literally stumped on how to do this. (That's not an excuse, it's just an explanation of what happened.) I hope you can forgive me.


That's OK Yeniaul. Don't worry about it.  :)


And on the topic of manipulation:

Remember your video on deleting objects in RBGY? Remember how the byte "disposal" worked (or rather didn't exist)? That applies here. And since it's executing from the THIRD trainer data byte, logically, wouldn't it execute from the FOURTH? You could just go from area to area, writing code with Game Freaks' assholery (the list 'disposal') and hopping the FFs. Theoretically, of course. It'd be like the position aspect of the Coin Case in Gen2, but with more travel, and there'd be the problem of intermediate routes, unless we could hit up the Item Pack or boxes on this trip through *RAM?

Oh, and when my PC's FINALLY stable I can start expunging people's old inventory/box data in SAVs so there's a NOP sled instead of old item data. Y'know, for those glitches that have to have the Box/Inventory in the most-items-there-have-ever-been state. :D


I'm unsure what that video was and the only things that comes to mind is TheZZAZZGlitch's video about deleting objects with the Mew glitch but I think I get what you mean; a lot of data is left the way it was and not disposed; and the game would execute data after it yes.

Cool, have fun with playing around with the saves!


If it turns out to be true, does anybody know how this or the data following D261 could be manipulated for making code to obtain Celebi?


Address $D261 is indeed in the middle of enemy trainer data. If this data is made harmless, the execution slides all the way to $D48E, which contains the player's name. This can be manipulated to jump anywhere we'd like. On the video, the player's name is set to "てみ" - which is 0xC3, 0x05, 0xD0 - jp $d005. I assume that the author of the video put some code there to activate the event.


Ooh, that's neat. Thanks TheZZAZZGlitch!