Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation III Glitch Discussion

Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Page 44

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Torchickens
Date: 2018-05-10 16:21:04
Metarkrai I just found an interesting video of arbitrary code execution in Japanese Emerald and wonder if you've done it in this version yet?

https://www.youtube.com/watch?v=KG4X_l7FOos

The author has a little wiki:

http://pokeglitch.game-info.wiki/

and the exploit is detailed here:
http://pokeglitch.game-info.wiki/d/%b7%ea%c8%b4%a4%b1%a4%ce%c9%b3

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-10 16:45:27
Isn't it essentially a JP adaptation of TheZZAZZGlitch's first ACE glitch move setup ?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-10 17:39:10

Isn't it essentially a JP adaptation of TheZZAZZGlitch's first ACE glitch move setup ?


Yeah, he is using an animation pointer on save file data in order to execute his code.
This method doesn't require any DMA check, but it isn't console friendly as you can't easily check the order of the save partitions, and as the possible permutations are determined at the beginning of a save.

Minus this choice of amination pointer, the rest of the procedure is exactly a PC Items Code Execution, with a Bootstrap code also stored in PC Items.

I prefer prioritizing a Bootstrap code stored on Pokémon data and code stored on Pyramid Bag Items because this makes the procedure faster (you can store 10 Pyramid Bag Items at a time, whereas you need 1-2 corruptions to duplicate a single PC Item) with a weaker potential for mistakes (although mistakes can be made).

For FrLg, storage of a part of the code with PC Items is inevitable, but I would like to draw the maximal profit out of a "copy/paste and overwrite" Pokémon that I haven't finished calculating yet. (Once this Pokémon would be done, you would store the target adresses onto other PC Pokémon data with some EV training, and store the remaining part of the code with PC Items, a part that would be quite small).

As for Emerald Jpn, I need to find something to patch the issue I have regarding the fact that the current procedure for a Bootstrap Pokémon makes me unable to make a Bootstrap Pokémon for Pyramid Bag Items Code Execution.

But by writing that I had a potential idea that I need to test. (if the final glitch Pokémon has a good glitch curve, it could still gain exp and then obtain an Exp amount that would reduce the amount of EVs needed and make it go below the 510 bar).

If the Bootstrap works with a way lower priority (TheZzAzz used a priority of 0xFF and I used a priority of 0xB4), then the newfound Mail Glitch could potentially be useful here.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-11 04:01:39
I'm currently trying to understand how these ACE codes work using the RAM addresses you linked earlier

I get that the first 2 items of the Open Lv Pyramid Bag are the highest and lowest bytes of the RAM address that is to be modified, and that the 3rd item is the value that's supposed to be set there.
However, what i don't get is why does the 3rd Lv 50 Bag item sometimes change from code to code ? Shouldn't it always be the same code since what it does is set [item 3] to [item 2][item 1] ?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-11 04:37:18

I'm currently trying to understand how these ACE codes work using the RAM addresses you linked earlier

I get that the first 2 items of the Open Lv Pyramid Bag are the highest and lowest bytes of the RAM address that is to be modified, and that the 3rd item is the value that's supposed to be set there.
However, what i don't get is why does the 3rd Lv 50 Bag item sometimes change from code to code ? Shouldn't it always be the same code since what it does is set [item 3] to [item 2][item 1] ?


The shortest codes are codes that overwrite a double-word/word/byte.
In certain cases I opted for a word/byte overwrite as there was other data in the double-word that I didn't want to touch because it could take different values or I didn't want to seach what every flag did to find an optimal thing for it.

This is why there is this little change on the Item 3 of Lv 50 Pyramid Bag, to tell if a double-word/word/byte must be overwritten.

Here you have the main list of codes that I use : https://pastebin.com/0pU2SUXG (See 5.4) )
Although they are written in 8-bit format so you need to rewrite that in 16-bit to see which items are needed.

The codes in Pyramid Bag Items also differ by some margin as the values stored for destination adresses or for the value to be overwritten are a few double-words away from the rest of the code (in order to put them on Open Lv and leave the rest of the code in Lv 50).

- Other codes copy/paste a string of words.
This is useful when more than a double-word needs to be overwritten (for one teleport code, for example), or when you want to move a value at a certain adress to another position (copy/paste the Secret ID of a Pokémon onto the Attack of a party Pokémon, for example).

- Other codes are "copy/paste and overwrite".
They copy/paste a string of words to an area that is unaffected by DMA (0x0200D084), and then overwrite the script adress of a certain NPC (usually the girl below day care) to point it towards the area where the string of words was stored (0x0200D084).
This way, by talking to the NPC, it will execute script commands like givepokemon, special, or things like that.

If the script commands that the NPC must read are a bit too long, they need to be stored in PC Items (with the code to get back Battle Factory Pokémon, for example).

This type of code is shorter than the initial code that calls a subroutine, so I prefer using this one to execute overworld scripts.

- One or two codes are an "overwrite and copy/paste".
For a few codes, I need a string of double-words to have a fixed value (like 0xFFFF for perfect Pokéblocks).
To do that, I overwrite a double-word with 0x0000FFFF at the target adress, and then use a copy/paste code that will copy the words stored at "target adress" and paste them at "target  adress +2".
Due to hos the copy/paste code works, this copies the 0xFFFF word to the next word, then copies another 0xFFFF to the next word, etc…

To have a complexe Pokédex, you would need 5 codes like this.





Seeing that you said the roamer tv news wasn't there a second time, there must be something else that prevents it.
If you're on emulator, can I have a copy of your save to study it ?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-11 05:03:59
Thanks for the info ! I think i'm going to try to create my own setups as well.

Regarding the roamers repop issue, sadly i'm on real hardware (i'm only using emulators when i attempt things that i really consider too dangerous to  perform on real hardware), so i can't give you the .sav file. However, there's the thing i noticed earlier with the Mystery Gift guy being corrupted. Maybe the issue comes from here ?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-11 08:18:11

Thanks for the info ! I think i'm going to try to create my own setups as well.

Regarding the roamers repop issue, sadly i'm on real hardware (i'm only using emulators when i attempt things that i really consider too dangerous to  perform on real hardware), so i can't give you the .sav file. However, there's the thing i noticed earlier with the Mystery Gift guy being corrupted. Maybe the issue comes from here ?


The delivery guy has nothing to do with the roamers event, so I don't think so.

To store the code in RAM, you can use the data there : https://pastebin.com/0pU2SUXG ; to help you.
For some other adresses, you can use the ones present in the codes. (bear in mind that adresses in the codes are taken with a DMA pattern of 18, which adds 0x48 to each adress)
Use an Anti-DMA code when trying to write RAM data in order to be sure that you are writing at the good spot, and then don't forget to disable it when trying to execute code.


Yesterday's idea about an alternative procedure to obtain a Bootstrap Pokémon paid off, and the issue with Emerald Jpn is now solved : https://pastebin.com/5PCe14AQ
This adds one more double-corruption and some more training to the usual procedure, and uses a 176 exp gain to compensate for a 176 SpAtk EV training.

It was also possible to use Mail Glitch to obtain a similar result (with word 0x2402), but it was easier this way.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-11 12:21:21
… i just encountered Latias randomly while EV-training a pokemon. I was surprised as hell XD

So apparently the ACE worked, but i didn't have to trigger the event with the whole league thing. Weird. I'll try to make the stationary Lati@s repop again later to see if it's a Latios (because for now this save file only gave me Latiases).

EDIT: The Latias have "?09/125" HP. Nice.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-11 12:24:39

… i just encountered Latias randomly while EV-training a pokemon. I was surprised as hell XD

So apparently the ACE worked, but i didn't have to trigger the event with the whole league thing. Weird. I'll try to make the stationary Lati@s repop again later to see if it's a Latios (because for now this save file only gave me Latiases).


Were you sure that you had no roamer alive before this ACE ?
Because the ACE for the roamers only changes the var tied to the player's house in order to trigger again the event with the tv news that generates a new roamer.

And thanks to that, I now know why it didn't work on your game.

There are two trainer houses, so there are two vars (one for each house).
Thus, there needs to be one code for male trainers, and one code for female trainers.
I'll fix this today.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-11 12:33:28
Unless some flag shenanigas happened, i'm sure as hell i caught Latias around 9 years ago :p

But yeah, maybe that's the reason why i was unable to get the TV event again. Still extremely weird how both my roamer and my Southern Island pokemon are Latiases. My game hates Latios apparently

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-11 12:57:19

Unless some flag shenanigas happened, i'm sure as hell i caught Latias around 9 years ago :p

But yeah, maybe that's the reason why i was unable to get the TV event again. Still extremely weird how both my roamer and my Southern Island pokemon are Latiases. My game hates Latios apparently


You may have revived your roamer Latias due to some Pomeg Glitch corruption (I think that giving it non-zero HP is enough).

Also, Pomeg Glitch corruptions affected the Southern Island Lati@s value (0 = Latios, non-zero = Latias), which means that you ended up with a Latias on it.

That's a common case for people who unlocked Southern Island.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-11 15:39:13
Okay, so i just tried my first ACE setup and it didn't work properly, though i feel like i'm on the right path.

It was a setup to give the pokemon in party slot 1 perfect 31 IV's.

01, Lv50 | 0x4805 (72 Spd, 5 Def, 1 PP Max) |
02, Lv50 | 0x4904 (73 Spd, 4 Def, 1 PP Max) |
03, Lv50 | 0x6008 (96 Spd, 8 Def, 1 PP Max) |
04, Lv50 | 0xBDF0 (189 Spd, 240 Def) |

01, Open Lv | 0x4534 (69 Spd, 52 Def, 1 PP Max) |
02, Open Lv | 0x0202 (02 Spd, 02 Def) |
03, Open Lv | 0xFFFF (See video) |
04, Open Lv | 0x3FFF (63 SPD, 255 DEF) |


Unfortunately, the pokemon in slot 1 turns into a Bag Egg upon use. Did i do something wrong or does the checksum detect modifications like this ?

Also i noticed that having a 5 pokemon party and checking it in battle with the new setup will make the LAST pokemon disappear, so make sure to have the invisible bad egg there.

Regarding the Lati@s thing, would redoing the TV event and picking Latias turn my stationary into Latios again ?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-12 03:56:08

Okay, so i just tried my first ACE setup and it didn't work properly, though i feel like i'm on the right path.

It was a setup to give the pokemon in party slot 1 perfect 31 IV's.

01, Lv50 | 0x4805 (72 Spd, 5 Def, 1 PP Max) |
02, Lv50 | 0x4904 (73 Spd, 4 Def, 1 PP Max) |
03, Lv50 | 0x6008 (96 Spd, 8 Def, 1 PP Max) |
04, Lv50 | 0xBDF0 (189 Spd, 240 Def) |

01, Open Lv | 0x4534 (69 Spd, 52 Def, 1 PP Max) |
02, Open Lv | 0x0202 (02 Spd, 02 Def) |
03, Open Lv | 0xFFFF (See video) |
04, Open Lv | 0x3FFF (63 SPD, 255 DEF) |


Unfortunately, the pokemon in slot 1 turns into a Bag Egg upon use. Did i do something wrong or does the checksum detect modifications like this ?

Pokémon data is encrypted by a xor computation, so you need to take that into account when modifying a part of a Pokémon substructures. (else you will not get 31 IVs on your Pokémon)
Keep also in mind that the IVs are on the miscellanous substructure, whose position depends on the Pokémon's PID.
You also need to change the checksum accordingly in order to keep a valid checksum. (else you will obtain a Bad Egg)

These 3 things are the reason why it's very tough to manipulate Pokémon data with a direct code execution.


Also i noticed that having a 5 pokemon party and checking it in battle with the new setup will make the LAST pokemon disappear, so make sure to have the invisible bad egg there.


Oh, I didn't know that. I was testing with 4 Pokémon but didn't test with 5.
I will add that to the procedure.


Regarding the Lati@s thing, would redoing the TV event and picking Latias turn my stationary into Latios again ?


Yeah, redoing the TV news will release the roamer and set the species of the Southern Island Lati@s.

I also checked but it appears that the same var is used to manage this event on both trainer houses.
I will try doing a round at the league to see how this var behaves with both trainers, as this may be the issue.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-12 06:17:59
Well i got the address from this, but yeah i figured structure positions might be an issue here, though in the code they didn't seem to care about it for some reason. Also, how does modifying the checksum work ? I feel like that was the problem here.

Wasn't the issue that my Latias was already released due to some corruption ?

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-12 13:09:06

Well i got the address from this, but yeah i figured structure positions might be an issue here, though in the code they didn't seem to care about it for some reason. Also, how does modifying the checksum work ? I feel like that was the problem here.

Wasn't the issue that my Latias was already released due to some corruption ?


Their code was written in raw format and this one is completely non-working.

About checksum :
Take all double-words in a Pokémon substructures (their hexadecimal values as stored in RAM). That's 12 double-words.
Decrypt these double-words with : decrypted double-word = double-word xor PID xor Trained ID.

You end up with 12 decrypted double-words.
Take the 24 words composing your 12 double-words, and sum them.
A Pokémon's checksum is the 4 hexadecimal digits of this sum (or sum mod(0x10000) if you prefer).
This checksum is then compared to the checksum stored in the Pokémon's data.

If it matches, ok.
If it does not match, the Pokémon is turned into a Bad Egg.


Thus, in your case, to change a Pokémon's IVs to 31 :
You need first to know the exact IVs of your Pokémon in order to compute the decrypted double-words tied to these IVs. (don't forget to check the special ability too)
You need to know the value of the Pokémon's checksum (use an ACE to get this value)
You need to compute the new Pokémon's checksum if its IVs changed to full 31. (you add the words tied to the full 31 IVs to the checkum and you subtract the words tied to the current IVs of the Pokémon)
Determine the PID of the Pokémon (with an ACE)
Determine the TID of the Pokémon (with an ACE)
Use the PID to know where the IVs are stored in the Pokémon's data.
Then, compute the encrypted value of your full 31 IVs with : 0x3FFFFFFF xor PID xor TID

Perform an ACE to copy/paste the encrypted value for the new IVs at the right place, and to overwrite the checksum with the new checksum.