Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation III Glitch Discussion

Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Page 27

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Stackout
Date: 2014-10-30 09:10:17
Not even a GBA RAM map helps here, as anything above 0x10000000 is unused. So, effects on real hardware may well be different. By the way, the ROM address space is at three locations: once at 08000000-09FFFFFF, once at 0A000000-0BFFFFFF, once at 0C000000-0DFFFFFF.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2014-10-31 13:21:43
Yup, RAM map isn't really useful, the "addresses" are too odd.
I wouldn't have thought that there would be ROM up to 0x0D00 0000 (I was thinking that both 0x48… and 0x0D…. were pointing to ?? things, and that the game was reading something somewhere).

Also, like voltage did, I tried the corruption on my cartridge with some AR codes to fasten things.
And the glitches resulting from talking to a NPC with a corrupted script adress are exactly the same on VBA and on console, so every result found in VBA is usable in console (even if the special sorruptions seem to depend on when you talk to the NPC).

What I'd like to know now is where the game picks data and uses it as the NPC script.
As we know now, either the values of the adress are RNG dependant, and maybe dependant on your save file, as we got slightly different corruptions on different save files (game corner page for example).

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-11-01 08:37:48

Also, here's the picture for the effect of the character 0xFB.
You get it by corruption character 0xBB (letter 'A') on a Pokemon Nickname.
Only the 4th and 8th character of a Pokemon nickname can be corrupted.
[img]http://www.pixenli.com/images/1414/1414496366085848600.png[/img]


Metarkai, how come in your picture the FB character is on the second letter. Did you make a mistake or did you hack it in?

I want to record this glitch. Thanks.

Edit: I got corruptions to E (BF) for the 4th and 8th letters (bit 2 set), so I have a feeling this will work after time.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: VaeporSage
Date: 2014-11-01 10:57:09
Metarkai, how come in your picture the FB character is on the second letter. Did you make a mistake or did you hack it in?


It replaces the 'a' in Castform.

I'm not totally sure why this FB character is notable though. I've gotten it before on Makuhitas and Sneasels and experimented with its effects in XD, FR/LG and R/S (including link battles), but it doesn't seem to do anything interesting besides the 'bloody battle' effect.

From what Metarkrai said, I gather that it could have some use in TheZZAZZGlitch's nickname-based code execution, but I couldn't guess how.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-11-01 11:09:41

Metarkai, how come in your picture the FB character is on the second letter. Did you make a mistake or did you hack it in?


It replaces the 'a' in Castform.

I'm not totally sure why this FB character is notable though. I've gotten it before on Makuhitas and Sneasels and experimented with its effects in XD, FR/LG and R/S (including link battles), but it doesn't seem to do anything interesting besides the 'bloody battle' effect.

From what Metarkrai said, I gather that it could have some use in TheZZAZZGlitch's nickname-based code execution, but I couldn't guess how.


I know that, but Metarkai said you can only corrupt the 4th or 8th letter, so I was wondering how he got it on the second letter (A in Castform).

I have got it to work with Castform named "AAAAAAAAAA" (though changing the Castform's PIDs to hex:45454545 seemed to make corruption more likely), but unfortunately I couldn't get the Pokémon species to change. So I also ask, where did the wild Kabutops come from?

This glitch also works in FireRed. It doesn't work in Ruby, where the game doesn't turn the screen red, and does a line break normally. (I'll upload a video of this once my files are joined)

Vae, if you want to do this on a real cartridge, can you see if it's possible to actually trade the Castform over please? I 'pseudo-traded' them by exporting a PKM file of the Castform with A-Save and then importing it to the other versions.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: VaeporSage
Date: 2014-11-01 11:52:40
Vae, if you want to do this on a real cartridge, can you see if it's possible to actually trade the Castform over please? I 'pseudo-traded' them by exporting a PKM file of the Castform with A-Save and then importing it to the other versions.


Yeah, they go over just fine. In XD: Gale of Darkness, the character is erased (i.e. 'Snesel').

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-11-01 14:02:58

Vae, if you want to do this on a real cartridge, can you see if it's possible to actually trade the Castform over please? I 'pseudo-traded' them by exporting a PKM file of the Castform with A-Save and then importing it to the other versions.


Yeah, they go over just fine. In XD: Gale of Darkness, the character is erased (i.e. 'Snesel').


Cool, thanks.

Well here's the video. Up next on my channel will be NPC corruption stuff.

According to this, FA-FF are control characters, so I wonder if there are more control character glitches. I'll test this.

Edit: Only FA and FB cause this glitch. For the others I couldn't immediately spot an effect other than letters being cut off/put on a new line.

Edit 2: I tried something completely different; removing the S.S. Anne guy. So far I haven't had any luck, but one time my name got changed from "RED" to "REDE". (I scrolled up for 30 seconds with online stopwatch with a party of 4)
Edit 3: I made it so I could walk past the S.S. Anne guy and re-board the S.S. Anne. Very satisfying. (Metarkai originally found this.) I will make a short bypass compilation video.
Edit 4: It's here.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2014-11-01 18:50:42
Torchickens :
Yup, I manually edited my Pokemon surname as I was too lazy to make Pomeg Glitch attempts.

The wild Kabutops comes from a Randomized Emerald Rom (my only US Emerald Rom).
But yeah, I should get a clean US Rom, since a part of Pomeg Glitch relies on execution of script in adresses that can potentially be anywhere.
I tend to play on French Roms for Glitch Moves, (I have now an application that helps me pointing them out)

Also, having a Pokemon with a PID of 0x45…. has increased chances to not get corrupted, since its PID can't be normally corrupted. With a TID of 0x00…. (other possibilities, but this works) you lessen the chances even more (but they aren't null).
But yeah, since here you want a Surname corruption without corrupting anything else on the Pokemon (to avoid obtaining a Bad Egg), this is useful.

I also manually tried other characters with a similar value, but got lots of blank spaces.
Also, by seeing the description of Glitch Moves, there doesn't seem to be other characters with such "importance". The only cool one left (to me) being the smiley.

In order to alter the RAM area related to NPCs, you only have to maintain up for 16 seconds, as it's a bit below Bag Items, and you need 17 seconds of scrolling to corrupt Bag and PC items. It also means that you won't corrupt your Berry and TM/HM pouches while doing this.

You can also remove the little girl on Island 4 to see that the grass behind the house wasn't coded as a walkable area.

EDIT : I also remembered that I already had a video where I made some NPC removal.
I also tried to speak about a method to ShinyHunt legendaries like Celebi, Mew, Jirachi,Deoxys (and other rare Pokemon) with Pomeg Glitch only, but it was too hard for me to concentrate about what I needed to say and my accent, so my pronunciation sucked a lot. (but that's a damn cool shinyhunting method, though)
Here's the video though.




VaeporSage :
It's not only the 0xFA character, but all the possible caracters that could allow the use of different codes with ACE.
But I don't have any knowledge in this, so I don't know what kind of value would be useful, since we can't even obtain every character on 4th and 8th place with Pomeg Glitch.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2014-11-02 07:21:48
I see. Thanks for your reply!

I like your video :).


I tend to play on French Roms for Glitch Moves, (I have now an application that helps me pointing them out)


That sounds pretty cool, what does it do?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2014-11-02 07:54:58
It's an application that allows me to sort all 65.535 Moves in Emerald Fr depending on their effect, type, power, accuracy,effect accuracy,priority,…
Thus, I can find Glitch Moves with cool effects and priority, who have names that will interfere with the battle or not, in order to make a little list of interesting Glitch Moves to obtain with Pomeg Glitch.
I'm also using it to test how targets are determined, and also what can Glitch Effects do (normal effects have identifiants from 0x00 to 0xD2, so there are a few Glitch effects).

In my cartridge, for Battle Frontier, I've given myself a 100% Guillotine effect + priority Glitch Move (quick KO on Battle Frontier), a 100% Freeze + low damage + priority Glitch Move (useful to shinyhunting + against Sturdy Pokemon since Freezing is overpowered), a 100% Sleep + priority Glitch Move, and a Battle type changing Glitch Move in order to have free access to Bag Items.
I'm using them to ShinyHunt for a Lv 96 Milotic (and Dusclops), but I'll use them to get all the Gold Symbols.
At first, I wanted to put these moves on a Smeargle, but he's way too frail to tank out a hit or two if I make a mistake, or in Battle Palace.
Thus, I used Double Corruption to have some full 31 IV + high EVs Pokemon (I can choose the identifiant), and I found some Glitch Pokemon with incredibly high Base Stats.
Thus, my future team is completely cheap, but it's quite fun to use it.
My most problematic issue was Battle Palace though, and the best solution was to find a high damaging Steel Move (steel is physical on 3rd Gen), and Sketch it with a Glitch Pokemon who has Pure Power and ~240 Base Attack (596 in Attack at Lv 100).
The only Pokemon that I don't OHKO are Steelix, Skarmory, Suicune, and probably other bulky water type Pokemon with 31 IVs and a lot of EVs that resist Steel damage. But I can't OHKO them (only around 90% damage) because Metal Coat didn't boost my damage, and because the Glitch move isn't stabbed.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: VaeporSage
Date: 2014-11-02 07:59:51
I'd love to see this program, though I suck at using any kind of tool like that. Still, I was thinking of a way to best experiment with glitch moves, and that would be it. Did you write the program? And are the moves any different in FR/LG?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2014-11-02 09:57:15
Here's a download link
It's made by Megadrifter, a French guy that was kind enough to answer my request.
It's not finished thouh : there's no correspondance for effects and targets, and there's no explanation file, nor a list of non glitch moves.
Also, it's only for French Emerald, since Glitch Moves data is read on ROM. So yeah, it's different between versions and languages, but I should ask him to include a version selection option (as there's just ROM data to provide, since the application structure is made).


I've also searched the value managing Battle Frontier pauses, and unfortunately it's not a value that can be corrupted with Pomeg Glitch (with direct corruption).
My idea was to make a Battle Frontier fight, to have a Battle Frontier team saved in RAM, then corrupt the value managing the pauses, and go to another facility (like Battle Factory), in order to start matches again, but with the previously saved team (the Battle Frontier team isn't refreshed to 0 until you reset).
The adress for the pause managing value is 020256FC and you need Bit 1 to be set (0x0..02) to be able to restart matches immediately.
I don't know where the Battle Frontier team is stored (if it's upper or below this value), but if it's below, it may be possible to corrupt it without corrupting the Battle Frontier team with NPC corruption.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Crystalame
Date: 2014-11-03 12:49:29
Hopefully this isn't a stupid question and I really hope it wasn't answered and I just didn't notice, but Metarkrai, your Mew video made me really curious. If I'm remembering right, there's an obedience flag for Mew (and Deoxys?) in FR/LG/E (and maybe R/S). Doesn't that mean a Mew obtained through this method wouldn't obey?

It's an awesome trick, but if it doesn't obey it's a bummer since you wouldn't be able to do much with it. :(

Also, my apologies for not having much else to contribute. I actually haven't dabbled much into messing around with Gen 3, maybe I should try sometime.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2014-11-03 17:41:57
You're completely right. I was more focused on Jirachi and Celebi, and I already had some protocol made for obedience, so I didn't think about this.
So yeah, an hatched Mew / Deoxys wouldn't have its obedience flag set, since Egg generation doesn't raises it.

This method, since you need Emerald + Fr or Lg to do it, was dealing more with Shinyhunting than a basic Pokemon Corruption, as the setup is tougher to make than the normal one (you can only make a single corruption at a time, have to wait for the full hatching, and have lower chances to achieve the right corruption).
In a ShinyHunting point of view, it's a quite fast egg hunting method (since Battling with an Egg trick is used), and I would be pleased to hunt any legendary, or any rare Pokemon (ones that would need lots of steps, or have harsh reproduction rate), even if for the later ones you just need Battling with an Egg trick to get up with something. So yeah, it would be at least the 2nd gen roamers, Ho-Oh, Lugia, Jirachi, Celebi, the Lati@s you miss (you can get the missed one on Southern Island with Pomeg Glitch too), and Mew+Deoxys (if you transfer them into 4th gen, would they obey ?)

The advantage it has over a basic corruption is that the Egg IVs are completely random, compared to a corruption where the IVs are directly depending on the dummy (you can manipulate them though, and have near perfect IVs with the classic corruption, but it's again a matter of how long you want the setup to be).

You can also pull the same technique on Emerald : corrupting the 2nd parent in Day Care, but since the whole PID is determined when the Day Care man steps forward, the Shinyness is determined once and for all, so you can't ShinyHunt the Pokemon (you still have random IVs though).
Even if there are fewer in-game trades, with some clones, you can have enough data-determined Pokemon to use them as a corruption indicator (and nullify the amount of Bad Eggs you need to delete with reverse cloning trick).
But the setup I have for the basic Corruption is now way more stable than before, so if you want for example all the legendaries, you'll gain a lot of time and execution sweetness by performing it (the initial setup is longer, but you can pull way more manipulations, and increase your chances of making a good corruption).

With basic corruption, you can use some specific dummies with specific training to set the obedience flag, so obedient Mew/Deoxys isn't an issue at all.

Here, you could render an hatched Mew/Deoxys obedient with some specific data substructures order (the comparison between the order before corruption, and after corruption).
I think you'd need at least EVs or Attacks read on Miscellanous (and maybe another condition).
The way to do it would be to make a double corruption / corruption (with double corruption, I'm sure there would be no problem, but with a basic corruption, there may have one or two) to have a new Pokemon.
This new Pokemon, once corrupted again, would transform into a Mew/Deoxys, and since its Miscellanous data would be read on EVs / Attacks (the second corruption is the reverse of the first one), you could manipulate them to get an Obedience flag.
Also, the PID and TID after this double double corruption (or double basic corruption) wouldn't change, so Shinyness is retained.
It seems a bit tricky, but stacking corruptions can be done without any major issue (before, you needed to make a ton of clones, and hope that a random one would be corrupted after some time ; it was a bit too messy for me since when you'd try more manipulated corruptions, there would have been a lot of cases where things would mess up).

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: VaeporSage
Date: 2014-11-07 11:20:19
Trainer script corruption is neat. I was wondering some things:

-As signposts, rocks, and maybe the notices on Pokémon Centres/Marts all count as NPCs, could they ever become trainers and walk up to you somehow? That would be really cool to watch.

-When you corrupt the script of a trainer in an area, how far does this area extend to? Is it the entire map of that area (e.g. all of Route 104)? For example, if you entered Victory Road from the League entrance and corrupted trainers there, could all trainers on that floor be affected, or just the trainers on a certain portion of the floor (within a certain radius, perhaps)?

I also managed to obtain the Eon Ticket, so I read up on this thread's analysis of whether or not Faraway Island/Navel Rock could be accessed. I'm not sure I understand fully: it involves corruption of TMs 18 and 24 to obtain the relevant key items in some way, and then there is an extra flag to be checked? It really would be cool to get to those islands through glitching. ^_^

There wasn't any mention of Birth Island. Is there a possibility of reaching there either? :3