Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation III Glitch Discussion

Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Page 15

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: voltage
Date: 2014-05-13 16:47:07

Catching Pokemon in battle turns them into Bad Eggs.


I was thinking about this and from my experiences of looking at the in-game summaries of Trainer Pokemon, you can notice that each Pokemon has a different ID No. This is just a guess, but do you think they are related?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Sanqui
Date: 2014-05-13 17:05:23
After a few tries, one of my Spinda (I had five six unique ones and cloned the rest)'s personality values changed from B8 B2 3E F1 to F8 B2 3E F1. That's a change of 0x40 like the Makuhita Sanquii describes. But the Pokémon inside the Egg was still Spinda, albeit with glitch moves.

More importantly, it's a change of a single bit.  Same with all the other Pokémon I was seeing in this topic.  And, just now I saw on werster's stream a TENTACOOL turn into TENTACOSL.  And surprise: O is one bit away from S. (0b11001001, 0b11001101).

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-13 17:17:32

After a few tries, one of my Spinda (I had five six unique ones and cloned the rest)'s personality values changed from B8 B2 3E F1 to F8 B2 3E F1. That's a change of 0x40 like the Makuhita Sanquii describes. But the Pokémon inside the Egg was still Spinda, albeit with glitch moves.

More importantly, it's a change of a single bit.  Same with all the other Pokémon I was seeing in this topic.  And, just now I saw on werster's stream a TENTACOOL turn into TENTACOSL.  And surprise: O is one bit away from S. (0b11001001, 0b11001101).


Ah, I think I get you. B8->F8 is a change of +2^2 (or bit 2 or 3 if you include 2^0) on the most significant nybble.

In werster's case, C9 (O) gets changed to CD (S); this is +2^2 on the least significant nybble. (if it wasn't for Tiddlywinks' table I would have to look for an old post of mine where I found a Gen III character table online)

In werster's other case, it was a change of +2^0 (bit 0 or 1) on the least significant nybble of the first personality byte.

Edit: Yay. Werster just turned Kadabra into Deoxys.
Edit 2: But it won't obey him due to the anti-cheating measure. (Apparently all Deoxys and Mew that weren't met in a 'fateful encounter' work like this)

Plus, getting the AuroraTicket won't work. Even if you hack in to your Key Items or another pocket that alone won't cause Birth Island to appear in the list of options in the Slateport Harbor house.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: luckytyphlosion
Date: 2014-05-13 18:34:19
Can Deoxys still obey in a link battle? Does this Check occur in Gen 4+?

And never knew you needed to "activate" the event for it to work :o

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: werster
Date: 2014-05-13 20:11:43
Alright so yea, got my Kadabra to go to Deoxys via 154 HP EVs and 1 Attack EV. What I'm still confused by is why it's item is still ??, with 1 Defense and Speed EV I was expecting Green Scarf, it seems like the 3rd and 4th bytes don't get read correctly or something? (I noticed move 2 is the one that typically becomes a glitch move, even when Growth stays in the same position)

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: camper
Date: 2014-05-14 01:18:36
In a randomized ROM, we can obtain Mew or Deoxys and they will obey. Does the randomizer remove the anti-cheating feature or is there some way bypassing it?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: pigdevil2010
Date: 2014-05-14 05:11:14

Alright so yea, got my Kadabra to go to Deoxys via 154 HP EVs and 1 Attack EV. What I'm still confused by is why it's item is still ??, with 1 Defense and Speed EV I was expecting Green Scarf, it seems like the 3rd and 4th bytes don't get read correctly or something? (I noticed move 2 is the one that typically becomes a glitch move, even when Growth stays in the same position)


Since the 30th bit of PV got changed, every 6th bit of bytes that mod 4 equals 3 got changed. This means that held item, experience points, 2nd move, 4th move, 4th move's PP, speed EV, beauty condition, feel condition, pokeball caught and egg status (this explains why you always got it in egg form) got changed.


In a randomized ROM, we can obtain Mew or Deoxys and they will obey. Does the randomizer remove the anti-cheating feature or is there some way bypassing it?


31th bit of Ribbons and Obedience dword (the last dword of miscellaneous section) determines the obedience of Mew and Deoxys

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Sanqui
Date: 2014-05-14 07:47:26

Since the 30th bit of PV got changed, every 6th bit of bytes that mod 4 equals 3 got changed. This means that held item, experience points, 2nd move, 4th move, 4th move's PP, speed EV, beauty condition, feel condition, pokeball caught and egg status (this explains why you always got it in egg form) got changed.

Exactly this.  And the only bits of the PID that *may* change are the top 16 ones (otherwise the checksum won't match). 
Because the PID XORs the substructures, and the bit in the PID has changed, the same bit will change every 32 bits of the substructures.
So every second or third byte (zero-indexed) of the substructures will be changed accordingly (usually resulting in stuff like the glich items or second moves).

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: TheZZAZZGlitch
Date: 2014-05-14 10:56:28
Done some research, and hereby I present the results.
Warning: It's going to be a long read.

[size=12pt]The glitch's cause:[/size]

Ironically, the reason why scrolling past slot 6 corrupts the memory is… the anti-cheating system.

Before the game lets you do anything with a Pokemon in party, the checksum is verified. If the verification fails, the game will turn the Pokemon into a `Bad EGG` - to do this, it sets 3 bits: Bit 0 at offset 0x13, Bit 1 at offset 0x13, and bit 6 at offset 0x07 from the `Miscellaneous` substructure (which changes its location depending on the personality value - the 32-bit word at offset 0x00).

Behavior of the Pokemon beyond slot 6 hasn't changed since Generation I. As before, these Pokemon represent different memory areas in the game.
Assuming we are all playing on the US version of the ROM, party Pokemon memory block starts at address 0x020244EC. Every Pokemon uses 100 bytes of memory. So the Pokemon at slot 255 is assumed to be at address 0x020244EC + 255*100 = 0x0202A888.

The game treats whatever it finds in this address as a Pokemon structure. That means it will also try to recompute the checksum as if it was a Pokemon, and obviously it's not going to match. So the game will set the previously mentioned 3 bits to turn the 'Pokemon' into a Bad EGG. The problem is that it's no Pokemon, so the game ends up changing bits where it's not supposed to.

Here's the relevant piece of code, if anyone else besides me decided to learn ARM assembly just because of this glitch:

[tt]; (…)
ldrh  r1, [r1,#0x1C]
cmp  r0, r1            ; Check if checksum is correct
beq  _ChecksumCorrect  ; Go to _ChecksumCorrect if it is
mov  r2, r8
ldrb  r0, [r2,#0x13]    ; Load the byte from structure's offset 0x13
mov  r1, #0x00000001   
orr  r0, r1            ; Set bit 0 (Bad EGG flag)
mov  r1, #0x00000004   
orr  r0, r1            ; Set bit 2 (Normal egg flag)
strb  r0, [r2,#0x13]   
ldrb  r0, [r5,#0x07]    ; Load the byte from `Miscellaneous` substructure, offset 0x07
mov  r1, #0x00000040
orr  r0, r1            ; Set bit 6 (Yet another egg flag)
strb  r0, [r5,#0x07]
_ChecksumCorrect:
ldr  r0, [sp]          ; Continue processing
; (…)[/tt]

[size=12pt]Trying to make the glitch predictable:[/size]

As mentioned before, there are only two possible corruption patterns for a single byte: Either the 0th and 2nd bit will be set, or the 6th bit will be set.
Let's say we have a Pokemon with personality value of 0xB064AF62. Then, all its possible corruptions are:

[tt]0xB564AF62  (set bit 0 and 2 of byte 3)
0xB065AF62  (set bit 0 and 2 of byte 2)
0xB064AF62  (set bit 0 and 2 of byte 1 - has no visible effect)
0xB064AF67  (set bit 0 and 2 of byte 0)
0xF064AF62  (set bit 6 of byte 3)
0xB064AF62  (set bit 6 of byte 2 - has no visible effect)
0xB064EF62  (set bit 6 of byte 1)
0xB064AF62  (set bit 6 of byte 0 - has no visible effect)[/tt]

The ability to severely corrupt Pokemon's data (severely == enough to change its species, moves or other properties) strongly depends on the binary representation of the personality value. If we say I was unlucky and my Pokemon got a personality value of 0x59F577DF - I will have hard time doing anything with this glitch, because in every byte of the personality value, bits 6, 2 and 0 are already set.
This is one of the main problems - to predict what will happen, knowing the personality value is a necessity.

But that's not the only problem that needs to be taken care of. Generation III Pokemon games have a crude implementation of something that we call ASLR on modern machines. Basically, some of the important data blocks, like boxed Pokemon or items in bag, have their location in memory randomized. Certain in-game actions, like exiting the Pokemon menu or accessing the PC cause the randomization to happen again. So what once happens to be located at a specific memory address, next time it won't be there anymore.

The easiest solution is to keep trying over and over again. The game offsets the important data blocks by a maximum of 32 bytes in two directions from a base address - so there are 64 possible cases - about 1.5% chance that the memory ends up offset where you want to. After 30 tries you have about 50% chance of succeeding.
In case we just want to corrupt a Pokemon in the box, you can take the brute force approach, and fill the entirety of box 1 and 2 with exactly the same Pokemon. Then, at least one of them should get corrupted in the way you want it to.

[size=12pt]Other possible corruptions:[/size]

Since we know already how the corruption pattern looks like, maybe we shouldn't limit ourselves to just corrupting Pokemon boxes?
Here's a list of addresses that are 100% certain to be affected by the glitch (have their bits 0 and 2 set):

$2024563, $20245C7, $202462B, $202468F, $20246F3, $2024757, $20247BB, $202481F, $2024883, $20248E7,
$202494B, $20249AF, $2024A13, $2024A77, $2024ADB, $2024B3F, $2024BA3, $2024C07, $2024C6B, $2024CCF,
$2024D33, $2024D97, $2024DFB, $2024E5F, $2024EC3, $2024F27, $2024F8B, $2024FEF, $2025053, $20250B7,
$202511B, $202517F, $20251E3, $2025247, $20252AB, $202530F, $2025373, $20253D7, $202543B, $202549F,
$2025503, $2025567, $20255CB, $202562F, $2025693, $20256F7, $202575B, $20257BF, $2025823, $2025887,
$20258EB, $202594F, $20259B3, $2025A17, $2025A7B, $2025ADF, $2025B43, $2025BA7, $2025C0B, $2025C6F,
$2025CD3, $2025D37, $2025D9B, $2025DFF, $2025E63, $2025EC7, $2025F2B, $2025F8F, $2025FF3, $2026057,
$20260BB, $202611F, $2026183, $20261E7, $202624B, $20262AF, $2026313, $2026377, $20263DB, $202643F,
$20264A3, $2026507, $202656B, $20265CF, $2026633, $2026697, $20266FB, $202675F, $20267C3, $2026827,
$202688B, $20268EF, $2026953, $20269B7, $2026A1B, $2026A7F, $2026AE3, $2026B47, $2026BAB, $2026C0F,
$2026C73, $2026CD7, $2026D3B, $2026D9F, $2026E03, $2026E67, $2026ECB, $2026F2F, $2026F93, $2026FF7,
$202705B, $20270BF, $2027123, $2027187, $20271EB, $202724F, $20272B3, $2027317, $202737B, $20273DF,
$2027443, $20274A7, $202750B, $202756F, $20275D3, $2027637, $202769B, $20276FF, $2027763, $20277C7,
$202782B, $202788F, $20278F3, $2027957, $20279BB, $2027A1F, $2027A83, $2027AE7, $2027B4B, $2027BAF,
$2027C13, $2027C77, $2027CDB, $2027D3F, $2027DA3, $2027E07, $2027E6B, $2027ECF, $2027F33, $2027F97,
$2027FFB, $202805F, $20280C3, $2028127, $202818B, $20281EF, $2028253, $20282B7, $202831B, $202837F,
$20283E3, $2028447, $20284AB, $202850F, $2028573, $20285D7, $202863B, $202869F, $2028703, $2028767,
$20287CB, $202882F, $2028893, $20288F7, $202895B, $20289BF, $2028A23, $2028A87, $2028AEB, $2028B4F,
$2028BB3, $2028C17, $2028C7B, $2028CDF, $2028D43, $2028DA7, $2028E0B, $2028E6F, $2028ED3, $2028F37,
$2028F9B, $2028FFF, $2029063, $20290C7, $202912B, $202918F, $20291F3, $2029257, $20292BB, $202931F,
$2029383, $20293E7, $202944B, $20294AF, $2029513, $2029577, $20295DB, $202963F, $20296A3, $2029707,
$202976B, $20297CF, $2029833, $2029897, $20298FB, $202995F, $20299C3, $2029A27, $2029A8B, $2029AEF,
$2029B53, $2029BB7, $2029C1B, $2029C7F, $2029CE3, $2029D47, $2029DAB, $2029E0F, $2029E73, $2029ED7,
$2029F3B, $2029F9F, $202A003, $202A067, $202A0CB, $202A12F, $202A193, $202A1F7, $202A25B, $202A2BF,
$202A323, $202A387, $202A3EB, $202A44F, $202A4B3, $202A517, $202A57B, $202A5DF, $202A643, $202A6A7,
$202A70B, $202A76F, $202A7D3, $202A837, $202A89B

Because there's no RAM map for Pokemon Emerald anywhere, I checked the addresses myself. The layout looks like this:

[tt]~$2029840 - Pokemon boxes
~$2028A40 - Daycare
~$2028070 - Secret base decorations
~$2025F80 - Items in bag
~$2025EF0 - Boxed items
Addresses are not constant.[/tt]

This implies the following possibilities:
- Corrupting contents of Pokemon boxes 1 and 2.
- Corrupting the Pokemon in Daycare.
- Obtaining glitch decorations for my secret base.
- Item mutation/item duplication.

The last one sounds very interesting. Let's try it!

[size=12pt]Pokemon Emerald: Item duplication glitch:[/size]

1. Do the standard setup to access the Pokemon beyond the sixth slot. It was described a thousand times already.
2. Once you get to the part with the half-lit cancel button, get yourself a stopwatch.
3. Start holding up and start the stopwatch at the same time.
4. Once the stopwatch gets to 17 seconds, press the B button.
5. Check your bag and hope something valuable got duplicated.

A small problem with this glitch is that in some cases it will delete everything in TM or Berries pockets. However, it does not occur every time, so at this point it's just trial and error.
One iteration of this method usually duplicates about 5 items, both in bag and in the PC.

Video: https://www.youtube.com/watch?v=OH8apzY9r0c

[size=12pt]Secret base glitch decorations:[/size]

Through the use of this glitch, it's also possible to obtain glitch decorations. This may take a lot of tries. For example, after 19 tries, I managed to turn my Thunder Mat (0x3C) into ' CAN' (0x7C - 6th bit was changed).

[img]http://i.minus.com/ihJmHzYmiKHxW.png[/img]

And it turned out to be a portable 2-square hole :P

[img]http://i.minus.com/iby8pIL301oq1e.png[/img]

[size=12pt]Arbitrary code execution![/size]

I previously found that viewing the summary of some of the glitch Pokemon caused the game to execute code from locations it's definitely not supposed to.
Further analysis confirmed that the reason of this problem were the 'markings'.
Each Pokemon can be given a combination of the different markings, stored in Pokemon structure's markings byte. There are only 4 markings normally available, yet a byte has 8 bits. The valid markings byte only ranges from 0x00 to 0x0F. Any other byte will cause the game to draw illegible sprites, and eventually, jump to an invalid place in memory.

I checked every possible invalid markings byte for useful jumps to the game's RAM. There is only one value, 0xA6, which jumps to $20207C8 - a valid location!
[size=6pt](0xA6 is also the first Super Glitch move index number in Gen I - coincidence? ;p)[/size]

This will definitely not allow for hack-free controllable arbitrary code execution like 8F, but it may be possible to prepare a save file which will run the code upon loading (something like Twilight Hack).
I am really surprised that the Gameboy Advance has absolutely no problem with executing data as code.

The end!

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-05-14 11:17:50
Thanks so much for your research TheZZAZZGlitch! After I mess around with the Pokémon mutation via EVs part enough, I think I'm going to make a glitch decoration dex, provided a glitch decoration is stored in one byte, unless somebody beats me to it.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Stackout
Date: 2014-05-14 13:28:38

Ironically, the reason why scrolling past slot 6 corrupts the memory is… the anti-cheating system.


I figured this was the case, based on what happens on my glitched Ruby save (with no Pokémon, and access to the party, you can scroll past the sixth slot).

On Ruby (and I guess Sapphire too), the checksum is checked when you press A on a Pokémon in the party. And after it gets the nickname string to show in the text box. Given that A showed a longass sometimes improperly terminated nickname based on some part of RAM (and possibly causes some other interesting effects too, I've seen some locations that glitch the music), and then B, A showed "Bad EGG"…

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Kelvinv
Date: 2014-05-14 13:46:29
i wonder  what those pokemon are if the anti-cheat mechanism could be bypassed

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: VaeporSage
Date: 2014-05-14 14:53:36


Catching Pokemon in battle turns them into Bad Eggs.


I was thinking about this and from my experiences of looking at the in-game summaries of Trainer Pokemon, you can notice that each Pokemon has a different ID No. This is just a guess, but do you think they are related?


Are there any interesting trainer ID numbers you found? Of course if we were looking at 65535 or 00000 or 08192 or something there would be an obvious link.

With regard to trainers' Pokémon, I've caught and documented a whole bunch of them under the following categories:

Origin: what trainer they came from and the Pokémon stolen, including level;
After being stolen: whether it has Pokérus or not, the Poké Ball it is now found in as a Bad Egg, and the various glitch moves it has.

But I have no idea if the results I've got are the same as anyone else's (no-one seems have attempted a similar project yet, it would seem). I'll provide some examples if anyone would like to try to catch that same Pokémon in battle and compare the results they get.

Pokémon are caught by changing the battle mode via any "K " move and throwing a Poké Ball. Then, in order to test the moveset, a wild Ditto must Transform into your Bad Egg, as the Bad Egg itself will crash the game if 'Fight' is selected.

If we all find the resultant Bad Egg produced when the trainer's Pokémon is caught to be identical, then we can all get the same glitch effects on every game and get predictable results. Here are a few distinct examples to try to copy:

Swimmer Tanya (Route 125)

Lv34 Luvdisc becomes Bad Egg in Net Ball with Pokérus. It has no moves.

Swimmer Sharon (Route 125)

Lv34 Seaking becomes Bad Egg in Poké Ball with Pokérus. It has two moves:

-"E: Judging category 3, body!" (Thunder Wave under a different name)
-"nt" (Splash under a different name)

Swimmer Stan (Route 125)

Lv34 Horsea becomes Bad Egg in Poké Ball with Pokérus. It has three moves:

-"Transformed into revents the foe's type"
-[A string of glitch letters four lines long]
-A move that freezes the game before its execution

Swimmer Leonardo (Route 126, single battle)

Lv34 Carvanha becomes Bad Egg in Premier Ball with Pokérus. It has three moves:

-"!" (Deals damage)
-"a Poison move" (hits itself)
-"u [grave accent] fled!" (Deals damage)

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Missingnoguy55
Date: 2014-05-14 15:41:49
I didn't think this was possible beforehand but holy shit ZZAZZ I am legitimately impressed with this.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: luckytyphlosion
Date: 2014-05-14 15:55:03

- Item mutation/item duplication.

The last one sounds very interesting. Let's try it!

[size=12pt]Pokemon Emerald: Item duplication glitch:[/size]

1. Do the standard setup to access the Pokemon beyond the sixth slot. It was described a thousand times already.
2. Once you get to the part with the half-lit cancel button, get yourself a stopwatch.
3. Start holding up and start the stopwatch at the same time.
4. Once the stopwatch gets to 17 seconds, press the B button.
5. Check your bag and hope something valuable got duplicated.

A small problem with this glitch is that in some cases it will delete everything in TM or Berries pockets. However, it does not occur every time, so at this point it's just trial and error.
One iteration of this method usually duplicates about 5 items, both in bag and in the PC.

The only problem with that method is, on a real GBA/DS, you have to mash the "up" button for the game to scroll the cursor, unlike VBA, where it allows you to simply hold the up key.

Congrats on finding arbitrary code though :)!