Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation III Glitch Discussion

Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Page 14

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: VaeporSage
Date: 2014-05-12 15:30:43
Well, I cloned a whole box of Acid Armor Grimer, but after 6 corruption attempts, nothing worked. The corruption was never identical, but the only Egg I got was the corrupted Grimer earlier which contained a Lv100 Grimer which wouldn't hatch.

It has of course been remarked many a time, but the 'stairs' patterns are interestingly constant.

If you find that any of your corrupted Pokémon or Bad Eggs have a glitched marking pattern and crash the game on viewing their summary, all you have to do is change their markings (or don't change them at all and select 'OK'). The summary screens will become stable again.

Yes, it corrupts box 1-3 unlike Emerald, where the corruption begins in the middle of box 2, but I should have been more clear, the only Pokémon I was able to corrupt in box 3 was the first.


Have there been any other differences found yet between FR/LG and Emerald?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-12 15:43:47

Have there been any other differences found yet between FR/LG and Emerald?


I'm unsure. When I opened the party with a Bad Decamark in it in FireRed, the game reset itself, so that may be a change.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: luckytyphlosion
Date: 2014-05-12 15:48:41
Does anyone know what causes the second, third and fourth move. Maybe if we could find the cause of those moves, you could swap a move with the index of Jirachi to the front to get an Jirachi EGG.

Deoxys can be gotten with the AuroraTicket (Manipulating EVs to be equivalent to the item), Mew can be gotten with the Old Sea Map or Acid Armor, Celebi can be gotten with Beat Up and Latios/Latias can be caught in the Battle Frontier.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-12 15:59:42
The Makuhita described here (apparently with the same substructure order as wester's, see description on the video here) had its substructure order changed from 03 (GEMA) to 11 (AMEG), so for Pokémon that works the same way, this is the conversion, if I'm not missing something important:

What growth bytes do (G):

Old species -> New move 1 (Makuhita -> Block)
Old held item -> New move 2
Old experience word 1 (pair of two bytes) -> New move 3
Old experience word 2 -> New move 4
PP Bonus value ->  New PP of move 1
Friendship value -> New PP of move 2
Unknown -> New PP of move 3/4

What EV bytes do (E):

Old HP EV -> Pokérus status
Old Attack EV -> Met location
Old Defense EV -> Origins info, byte 1
Old Speed EV -> Origins info, byte 2
Old Special Attack EV -> IVs, Egg and Ability byte 1
Old Special Defense EV -> IVs, Egg and Ability byte 2
Old coolness -> IVs, Egg and Ability byte 3
Old beauty -> IVs, Egg and Ability byte 4
Old cuteness -> Ribbons and obedience byte 1
Old smartness -> Ribbons and obedience byte 2
Old toughness -> Ribbons and obedience byte 3
Old feel -> Ribbons and obedience byte 4

What 'miscellaneous' bytes do (M):

Pokérus status -> HP EV
Met location -> Attack EV
Origins info byte 1 -> Defense EV
Origins info byte 2 -> Speed EV
IVs, Egg and Ability byte 1 -> Special Attack EV
IVs, Egg and Ability byte 2 -> Special Defense EV
IVs, Egg and Ability byte 3 -> coolness
IVs, Egg and Ability byte 4 -> beauty
Ribbons and obedience byte 1 -> cuteness
Ribbons and obedience byte 2 -> smartness
Ribbons and obedience byte 3 -> toughness
Ribbons and obedience byte 4 -> feel

What attack bytes do (A):

Move 1 -> Species
Move 2 -> Item held
Move 3 -> Experience word (two bytes) 1
Move 4 -> Experience word 2
PP 1 -> PP bonuses
PP 2 -> friendship
PP 3 -> unknown byte 1
PP 4 -> unknown byte 2

Our next step is finding out what exactly happens to the personality value?

The Makuhita that Sanquii used got it changed from 0xd5df024b to 0x95df024b. That's exactly the first byte minus 0x40, a nice round figure, but the glitch still relies on luck, evident by how you don't get the same result every time even when you scroll up the same number of times.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: pigdevil2010
Date: 2014-05-12 23:01:05


But by a sheer luck (1 in 256 chance) that the checksum is still match.


So that means we can luck-manipulate to get a valid Pokémon with a glitch move? That would overcome the Tate&Liza/Steven double-battle problem in a "glitched" TAS. Though we'd still need to manipulate it further to make it speedrunning-viable. But it's awesome how manipulable this is getting, Glad to see my favorite gen getting glitched like this. :)


Whoops, I was too sleepy yesterday. The checksum is 2 bytes long, means that it's 1 in 65536 chance it will match.



So today, I tried to mess around this glitch again and found out that every time it changed the memory just one bit when the cursor is scrolled up 1 time and it surprisingly changed one of my Pokémon's PV from 0DDA11A1 to 4DDA11A1. Because of this, this Pokémon's data changed significantly. This is a result of decoding this Pokémon's data and this is a video of me messing with this Pokémon.

The reason why the checksum is still match and won't turn into a bad egg is because PV's 30th bit got changed and made every decrypted subdata dword's 30th bit got changed, when it is read in word to compute the checksum, the changed bit will be the 14th bit of the read data. For example:
00 19 8D 21 | 15 6C 26 03 -> 00 19 8D 61 | 15 6C 26 43 -> 00 19 | 8D 61 | 15 6C | 26 43
Since GBA read the data in little endian. If the 14th bit got changed from 0 to 1, the read value will be increased by 0x4000 and the data is 48 bytes long means that there's 12 dword got changed (assumed that every dword's 31th bit are 0) so the computed checksum will be increased by 0x4000 x 12 = 0x30000. Since 0x30000 is gone out of range for word, it will be truncated to 0x0 so this means that the computed checksum isn't changed and the Pokémon will not turn into a bad egg.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Stackout
Date: 2014-05-13 03:49:59

changed one of my Pokémon's PV from 0DDA11A1 to 4DDA11A1


That's again the same bit that got flipped in the PV…

Could we be onto something here?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: werster
Date: 2014-05-13 04:39:58
Well I finally found a save editor that lets me see the changes after the corruption without crashing <_<

Anyway doing some initial tests, I had a Smeargle's PID change from CCE3151D (mod 13, EGMA) to CDE3151D (mod 5, GMEA)

This turned it into one of the "invisible" pokemon, and it was holding a Pink Scarf (this came from no EVs, not 1 speed Sanqui!!), which makes sense since EVs are going into Growth.

I changed all the Pokemon in box 2 to have 9 Attack and speed EVs. As a result, I've got a Spheal to change from 34592110 (mod 16, EMGA) to 74592110 (mod 8, AEGM) and a Poochyena to change from 1F983F29 (mod 17, EMAG) to 5F983F29 (mod 9, AEMG). These had the same change as the Makuhita before it, but in reverse, and obviously stayed as their previous forms because Growth didn't change position

Had a Latios change from 9C82A5C7 (mod 23, MEGA) to 9D82A5C7 (mod 15, EAMG) and be a Bad Egg, but holding the Pink Scarf. It's consistenly showing up as the "0" item, which is strange since it should be 0x0100 from what I understand?

Repeated the Kadabra into Gengar change. Kadabra was A2E151B (mod 11, AMEG) and changed to 4A2E151B (mod 3, GEMA). Lots of similar changes happening here

Last one before I go to sleep for tonight. Had a Taillow go from A8BF63D3 (mod 3, GEMA) to E8BF63D3 (mod 19, MGEA) Because it had 9 Attack and Speed EVs I was expected regular Held item and Pokemon (Repeat Ball/Blastoise) but instead it hatched into another decamark, curiously at Level 0 when it hatched. Would only level up through Rare Candy, experience wouldn't do the job, and then it jumped to Level 6 and softlocked the game after showing me its stats (which were ass) I guess I'm misunderstanding how the EVs are being read or something I guess =(

I'll kept editing as I test more stuff

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Sanqui
Date: 2014-05-13 07:16:57
Anyway doing some initial tests, I had a Smeargle's PID change from CCE3151D (mod 13, EGMA) to CDE3151D (mod 5, GMEA)

This turned it into one of the "invisible" pokemon, and it was holding a Pink Scarf (this came from no EVs, not 1 speed Sanqui!!), which makes sense since EVs are going into Growth.

Actually, I think I can explain this now.
If you look at the Smeargle's PID, you can see only one bit changed - from CC to CD.  That's the 0th bit being *set*.  Since the PID XORs all the substructures, this means that, besides them being shuffled, every 0th bit of every 3rd byte (counting from 0) will be inverted.  That means the first four EVs - 00 00 00 00 - will turn into 00 00 00 01 as they're being put into Growth.  And 00 01 is Pink Scarf indeed.
Depending on which bit of the PID gets corrupted, the Pink Scarf can come both from from the PID corruption, or from 0 defense and 1 speed EV.

[size=8pt]This glitch's is effects are so complicated yet fun to think about, I love it.[/size]

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-13 09:25:28
I have an idea I thought of last night. Would it be viable to have an indicator of your Pokémon's personality value mod 24 by catching a certain Spinda.

Example:
[img]http://i.minus.com/jLZfeVLYT1gKi.png[/img]

Here I ignored patterns with a hard to identify 4th spot (controlled by the last byte) due to the possibility of another spot taking its same place, or spots that make the 4th spot hard to identify due to overlay.

But my image is wrong. The last byte alone doesn't affect the modulo. If you had the last word as 01 9C for instance, the remainder would be 4 instead of 12, and that's assuming everything else was 00.

So just before I was going to bed, I thought about working in another base system, like base 24, without understanding much about it.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: pigdevil2010
Date: 2014-05-13 10:51:01

So just before I was going to bed, I thought about working in another base system, like base 24, without understanding much about it.


Good luck on working. One of my Pokémon have a PV of G7MA3N224 and have a GAME substructure order :P

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-13 11:27:35
Thanks. I don't think this is a good thing to do on further analysis. Try changing the all digits of a base 24 number by +1 other than the last one, and the differences in spot coordinates when converted back to hexadecimal will be much different.

I thought it would be good since if you work in modulo 24, the final digit will tell you what the modulo is, regardless of the digits before it. For a few substructures where we could theoretically turn EVs into species, applicable last digits are C, D, E, F G or H.

Edit: This is my theoretical method of getting Deoxys through certain EVs.

1) Move all of the box 1/2 Pokémon up to box 2 position 23 to other boxes, or release them all.
2) Fill box 1/most of box 2 with Spinda caught from east of Fallarbor Town.
3) Now this is tedious, but it lets you find your Pokémon's personality values and modulus. Download A-Save and a Pokémon Emerald save file.
4) Load the save file, select 'Storage', right click on one of your Spinda in box 1/2 and select 'Edit'. Change the Pokémon to Spinda and click on PID. The fields not under PID like the nickname and item don't matter.
5) This is one of the hardest parts and possibly the longest: Try to recreate your Spinda's spots by clicking 'Spinda Spots'. You'll have to edit them exactly as they appear on your Game Boy Advance.
6) Check to see if A-Save says your Spinda is the same nature and gender as your Game Boy Advance cartridge says. This will likely verify that you got the spots right.
7) If you get the wrong nature and gender, try again and see if you made a mistake in placing the spots. This is easily done.
8) When you're done, click accept and look at the new personality value in A-Save. Go on Windows Calculator and switch to 'programmer' mode from 'view'.  Copy and paste the personality value (it's in decimal, so be in that mode) then click 'mod' and enter '24', then click the equals sign.
9) Check to see if your modulus is a 'good' value. Good values are 12-17 because they have 'E' as the first structure in the substructure order.
10) Repeat steps 5-9 with different Spinda. Release all other Spinda once you get a good value.
11) Now you'll want to EV train your Spinda. Give it 154 (hex:9A) HP EVs and one Attack EV, exactly. It's a good idea to buy 10 HP Ups; this will give you the first 100 EVs. The rest can be got by battling Whismur in the cave on Route 106 for 1 HP EV each (can be increased to 2 at a time with Macho Brace) and one Carvanha (1 Attack EV) on Route 119 via Super Rod.
12) Clone your Spinda using the old Pokémon Emerald cloning glitch until you fill box 1 and box 2 up to position 23.
13) Save at this point, after reducing a Pokémon to negative HP via Pomeg Berry and a Pokémon with enough HP EVs and make sure you have a healing item.
14) Do the 'access Pokémon beyond sixth slot glitch'. The less Pokémon you use to pull it off, the better but I can't remember if there's a minimum you need, sorry. When you view your Pokémon's status, scroll up 3 times to get to FF. Then scroll up exactly 40 times (up to D7). This will corrupt the minimum amount of data while corrupting your Spinda; your Daycare Pokémon won't get corrupted.
15) Run, then check your boxes for regular Eggs, not a Bad EGG. If you don't have any Eggs, restart the game and return to step 13.
16) Put all Eggs you can in into your party then enter a battle (switching Egg positions when necessary) to send them out to check if you have an Egg with Deoxys.
17) Use the Bicycle and go back and forth until your Deoxys hatches.

If you're using an emulator, you can just put a Pokémon in position 1 and look at memory address 020244EC to see the personality value that you'll take the modulus of.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: VaeporSage
Date: 2014-05-13 14:43:12
What I plan to do now is breed a whole bunch of Eevee and Sneasel, fill a box full of them, and hope that one of them corrupts correctly after a couple of tries.

Then, I'll take that specimen and raise and/or evolve it to the correct level so that it will learn Acid Armor (index 151, Vaporeon) or Beat Up (index 251, Sneasel). Then I'll perform the corruption again with it and hope it works out right.

Is there any reason (beyond bad luck on my part) why this shouldn't work?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-13 14:51:28

What I plan to do now is breed a whole bunch of Eevee and Sneasel, fill a box full of them, and hope that one of them corrupts correctly after a couple of tries.

Then, I'll take that specimen and raise and/or evolve it to the correct level so that it will learn Acid Armor (index 151, Vaporeon) or Beat Up (index 251, Sneasel). Then I'll perform the corruption again with it and hope it works out right.

Is there any reason (beyond bad luck on my part) why this shouldn't work?


I don't see why there would. Good luck :)

Anyone see a problem with my Deoxys method? Am I missing an easier way of doing it? I have a feeling I am.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: voltage
Date: 2014-05-13 15:10:26

Am I missing an easier way of doing it? I have a feeling I am.


Would there be a way to get Deoxys by mutating a Pokemon with Trick so it holds an Aurora Ticket?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-13 16:16:30


Am I missing an easier way of doing it? I have a feeling I am.


Would there be a way to get Deoxys by mutating a Pokemon with Trick so it holds an Aurora Ticket?


Maybe. Do you even need Trick? Does an Egg keeps its held item when it hatches?


On second thoughts I don't know why I came to the conclusion those substructure orders (starting with EVs & Condition) would be better. Catch Pokémon indiscriminately and give them the right EVs and there might be a better chance of success.

I'm poking in the dark because I don't know how the randomness works.

After a few tries, one of my Spinda (I had five six unique ones and cloned the rest)'s personality values changed from B8 B2 3E F1 to F8 B2 3E F1. That's a change of 0x40 like the Makuhita Sanquii describes. But the Pokémon inside the Egg was still Spinda, albeit with glitch moves.

If there's the possibility that a certain change like +0x40 will never happen, that's an obstacle, but if it can happen with any box Pokémon or group of boxed Pokémon by chance, what we could do is look at a Spinda's personality value and its structure order (either manually by placing Spinda spots on A-Save or through memory viewer), then pretend the first byte (apparently on memory viewer the bytes are stored in reverse order) increased by 0x40, then calculate the new structure order and see if Growth (G) gets put in the 'order number' EVs & Condition (E) used to be. This way, with the right old personality value and the right EVs, you might have a chance to get the change you want.

Edit: I will play around with this more, but I have a question for anyone who knows about the data sub-structures. What bit/value governs an Egg? I know that there is a section in the 'miscellaneous' substructure where "IVs, Egg and Ability" is stored in 4 bytes, but what byte controls the Egg and what minimum value would give you an Egg in it?