Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation III Glitch Discussion

Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Page 45

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-12 15:35:47
Well the idea was to only use it on pokemon that come from the same frame, being this one:
[img]https://i.gyazo.com/8dbf975de69d285e6cfdd94fe3a49e8c.png[/img]

But i didn't really get what you meant by double-words. I get that they're part of a pokemon's substructure but i don't know which values are counted and which ones aren't.

Also, by a pokemon's TID do you mean my TID or my SID ?

EDIT: I figured what the double words were. But isn't there a way to avoid modifying the code for each pokemon ? Like storing the checksum in a var and substracting the old IV's then adding the new ones by ACE (since all of my pokemon have the same IV's, PID and TID)

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-13 04:03:23
The TID is the Secret ID and Trainer ID grouped together. (the Secret ID takes the 4 high bytes while the ID takes the 4 low bytes of the double-word).

You could technically make a code that would do all the computations itself, but it would be way longer than the existing ACE codes.

Here, you know the IVs of your Pokémon and its PID.

You only need to know its checksum and your Secret ID, make some computations, and you're good.

In the end, this consists of 3 ACE with Pyramid Bag Items, which is reasonable.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-13 04:41:07
Well i already have my SID (56128) and my ID (44640) so i'm guessing the PID is DB40AE60 ?

In which case 3FFFFFFF encrypted would be 1609D608 (3FFFFFFF xor F2B68797 xor DB40AE60).

What bothers me is that i have quite a lot of pokemon i'd like to modify and, while they all come from the same frame, they have different movesets, species, etc. So the checksum would have to be hard-coded each time.

EDIT: After some calcs it seems what i have to do for the checksum to work is substract F7CA from it and then add EC11 (and set my pokemon's IV's to 1609D608 instead of 3FFFFFFF). Now the problems i have are:
- Is it possible to do all of this with a single ACE (even if it requires modifying the setup) ?
- What are the addresses i'm supposed to modify ? Since my pokemon's substructures are in the "MEAG" order, the Misc is what is read first, but i don't know at which address are the IV's specifically. I don't know where the checksum is, either. It would also be cool to target a pokemon in a specific PC slot so that it doesn't have to be KO'd each time. I have no idea if it's easy to do though.

EDIT 2: I wonder, since the checksum is calculated each time there's a validity check, isn't it possible to calculate it via ACE after changing stuff and then overwrite the old one with the calculated one ? That would make changing pokemon attributes way easier, for IV's or anything else

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-13 12:27:37

Well i already have my SID (56128) and my ID (44640) so i'm guessing the PID is DB40AE60 ?

In which case 3FFFFFFF encrypted would be 1609D608 (3FFFFFFF xor F2B68797 xor DB40AE60).

What bothers me is that i have quite a lot of pokemon i'd like to modify and, while they all come from the same frame, they have different movesets, species, etc. So the checksum would have to be hard-coded each time.

EDIT: After some calcs it seems what i have to do for the checksum to work is substract F7CA from it and then add EC11 (and set my pokemon's IV's to 1609D608 instead of 3FFFFFFF). Now the problems i have are:
- Is it possible to do all of this with a single ACE (even if it requires modifying the setup) ?
- What are the addresses i'm supposed to modify ? Since my pokemon's substructures are in the "MEAG" order, the Misc is what is read first, but i don't know at which address are the IV's specifically. I don't know where the checksum is, either. It would also be cool to target a pokemon in a specific PC slot so that it doesn't have to be KO'd each time. I have no idea if it's easy to do though.

EDIT 2: I wonder, since the checksum is calculated each time there's a validity check, isn't it possible to calculate it via ACE after changing stuff and then overwrite the old one with the calculated one ? That would make changing pokemon attributes way easier, for IV's or anything else


Okay, so you already know all the information you need aside from the Pokémon's checksum.

I think that you got things wrong for the checksum : it is the sum of the uncrypted bytes, not the sum of the crypted bytes.

Thus, having 0x3FFFFFFF as uncrypted IVs adds 0x3FFE to the checksum, while your IV combination subtracts Idon'tknowhow to the checksum.

The IVs are the second word of the Miscellanous substructure, so the tenth double-word of a PC Pokémon data structure.

You can technically make a code that would add the required value to your Pokémon's checksum, which would allows you to perform this code on multiple Pokémon who have the same PID.
However, I don't know how to write a code that would add a double-word/word to a set adress.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-13 13:05:56
Okay, my bad then.

What about the recalc thing ? Since the game already calcs the checksum, maybe there's a function for that and we can just call it

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-14 08:03:06
This is also technically possible, but that would require a way longer code than a simple "add this word to this word" code, because you would need to call the function and also feed it values in order to have the checksum recomputation on the right Pokémon.

However, if we knew such functions, then I would work on making codes that I can't do now, like giving 255 EVs in every stat, making a Pokémon learn a set move, call the Emerald Jpn sound debug menu, bring the Pokédex entry of a specific Glitch Pokémon,…

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-14 13:07:05
Maybe it's possible to do like TheZZAZZGlitch did in gen 1 and write long codes somewhere in RAM (like in an otherwise unused PC box), then we'd just have to jp there ? I thought of something like writing, for example, the Box 3 Slot 1 pokemon's HP and / or ATK EV's as a byte

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: clay-doll
Date: 2018-05-14 14:04:42
So, I haven`t checked this forum in a while and wanted to know if there is currently a console-friendly method to access Navel Rock? I`m assuming the only possible way is through ACE, am I correct? And if that`s the case, has anyone achieved it on console yet?

I`m sorry if this question is kinda redundant, but scanning through all these pages seemed like a pain  ;)

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-14 17:46:00

So, I haven`t checked this forum in a while and wanted to know if there is currently a console-friendly method to access Navel Rock? I`m assuming the only possible way is through ACE, am I correct? And if that`s the case, has anyone achieved it on console yet?

I`m sorry if this question is kinda redundant, but scanning through all these pages seemed like a pain  ;)


I actually did test the Navel Rock code on real hardware and it worked just fine. Metarkrai posted a tutorial on page 41, and we talked about it as i was trying it on page 42. If you do everything as detailed you should be able to access it at least on non-Jpn Emerald.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-15 11:44:35

Maybe it's possible to do like TheZZAZZGlitch did in gen 1 and write long codes somewhere in RAM (like in an otherwise unused PC box), then we'd just have to jp there ? I thought of something like writing, for example, the Box 3 Slot 1 pokemon's HP and / or ATK EV's as a byte


Areas like the storage of the code and picture of the event Berry could be used to a longer code, yeah.

With a "copy/paste and overwrite" code stored on a Pokémon, you would write a part of the code with Pyramid Bag Items, then copy/paste it on the area you want in order to build a bigger code.

But a longer code is needed first.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-15 17:34:19
Could be worth it though. If the code is incrementing the address where it points each time, we'd be able to write bytes quickly and then we'd just need a different bootstrap pokemon to jp there.
The boring part would be doing the DMA check each time (which could potentially be avoided by writing something like the lowest byte of the in-battle pokemon's current HP but… yeah).

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Misdreavus
Date: 2018-05-16 06:48:27
I noticed that the "turn bootstrap Pokémon into an egg" step in the guide is incomplete.  Is it something I need to do (possibly via Pomeg corruption)?

I'm currently working on the bootstrap Pokémon but I just can't get the double corruption on step 1.4 to work.  I followed your guide, but after turning the glitch Pokémon into an egg in the first step of the double corruption (the PID corruption), I can't get it to turn into another glitch Pokémon in the next step (the TID corruption).  I removed everything else from boxes of 1 & 2 after the PID corruption, placed heart Caterpie right before my egg, and am having no success.  Did I likely mess up on EVs?  I would think if I had, it would still double corrupt into something, albeit not what I want.

Also, will any of the following codes be added any time soon?
*redo TV roamer event in Emerald (or any other way to capture Latios on Southern Island if I've already captured Latias there) - as mentioned on previous page
*make Mewtwo / birds respawn in FR/LG

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Tabbender
Date: 2018-05-16 15:13:45

I noticed that the "turn bootstrap Pokémon into an egg" step in the guide is incomplete.  Is it something I need to do (possibly via Pomeg corruption)?

I'm currently working on the bootstrap Pokémon but I just can't get the double corruption on step 1.4 to work.  I followed your guide, but after turning the glitch Pokémon into an egg in the first step of the double corruption (the PID corruption), I can't get it to turn into another glitch Pokémon in the next step (the TID corruption).  I removed everything else from boxes of 1 & 2 after the PID corruption, placed heart Caterpie right before my egg, and am having no success.  Did I likely mess up on EVs?  I would think if I had, it would still double corrupt into something, albeit not what I want.

Also, will any of the following codes be added any time soon?
*redo TV roamer event in Emerald (or any other way to capture Latios on Southern Island if I've already captured Latias there) - as mentioned on previous page
*make Mewtwo / birds respawn in FR/LG


I ignored the "turning the bootstrap pokemon into an egg" thing and it worked anyway. I think the point is mostly that glitch pokemon can make the game freeze upon viewing their profiles / due to their long names, while Eggs don't. This step isn't necessary (just avoid viewing their profiles).

For the double corruption at point 1.4 you have to make sure you didn't take the egg with the cursor. Also note that since there is only one egg, success chances are lower than usual. It also happened to me that some eggs simply wouldn't work for a double corruption (though it might have been bad luck). If you think that's the case for you, try to redo the first part of the double corruption and aim for an egg with a pokeball different than this one's. Also check if the egg have the right markings (and name upon viewing its profile). It happened to me that a corruption initiator got turned into an egg and i got tricked by this.
In any case, it can't be the EV's. It would simply give you another pokemon or, if your pokemon had 0 HP and 0 ATK EV's, corrupt it into an empty slot, and you wouldn't have gotten an egg in the first place.

Metarkrai already did a setup to reset the TV event flag, it just didn't work in my game presumably because i accidentally resurrected my Latias due to some corruption. Selecting Latias as your roamer will set Latios as your stationary, however you'll need to make him repop with another code and if you're unlucky enough it's possible that you accidentally corrupt it into Latias again while making the Safari Park guy depop. I'm guessing the chances are of 1/32.
Can't say anything about FR/LG though, sorry.

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Metarkrai
Date: 2018-05-17 09:46:40

I noticed that the "turn bootstrap Pokémon into an egg" step in the guide is incomplete.  Is it something I need to do (possibly via Pomeg corruption)?

I'm currently working on the bootstrap Pokémon but I just can't get the double corruption on step 1.4 to work.  I followed your guide, but after turning the glitch Pokémon into an egg in the first step of the double corruption (the PID corruption), I can't get it to turn into another glitch Pokémon in the next step (the TID corruption).  I removed everything else from boxes of 1 & 2 after the PID corruption, placed heart Caterpie right before my egg, and am having no success.  Did I likely mess up on EVs?  I would think if I had, it would still double corrupt into something, albeit not what I want.

Also, will any of the following codes be added any time soon?
*redo TV roamer event in Emerald (or any other way to capture Latios on Southern Island if I've already captured Latias there) - as mentioned on previous page
*make Mewtwo / birds respawn in FR/LG


Yeah, turning a Pokémon into an Egg is supposed to be done via a Pomeg Glitch Data Corruption (corrupt the TID of the Pokémon), as it makes the Egg tradeable through any game easily.
Bus if you want to use this Bootstrap Pokémon for your own game, there's virtually no requirement for that part.

Well, the non-success in the second corruption in a double-corruption is in general the result of the "specific criteria" not being met, or the fact that you didn't use the right corruption initiator.
Here, for a second double-corruption, you indeed need the Heart Caterpie as a corruption initiator.
I don't have the time to check things now, so I don't know if this is due to a mistake in EVs/training or a mistake by my side (due to not managing 4th Move PPs or something like that, probably that).(yeah, I think it's probably due to that, so it's a mistake on my part)

I will be away for around ten days, so I will fix that upon my return.

I made the code for the TV roamer event in Emerald, but it didn't work for Tabbender and I don't know why yet (the code works in my save, so there must be another value messing things up, it's hard to say without a save to study).

Once I'll be done with codes on Emerald, I'll work on codes for Fr/Lg, don't worry ; )

Re: Gen III: Access Pokémon beyond the sixth slot sub-glitches.

Posted by: Roy
Date: 2018-05-23 15:40:01
I've been messing around trying to get good IVs on double corrupted pokes and I just had a quick question about what miscellaneous data is kept when you hatch an egg from a PID corruption. Obviously the met location and origins info is reset and the IVs/ability should stay the same, but what about ribbons and obedience? For the obedient deoxys/mew method I was thinking you could give a smeargle 183 (255-72) coolness and 63 beauty, do a PID corruption to store those values as IVs and hatch the pokemon (hopefully resetting the ribbons and obedience section). Then double corrupt it back so that it has the higher contest stats with 0 total feel and do the rest of the procedure, substituting the six blue pokeblocks with six red ones and giving it a glitch item so that there are an even number of yes's. Finally fill in the rest of the sp.atk and sp.def evs to get the IVs you want (won't be perfect, but still).

The other way would be to go through attacks->misc but I have had a lot of trouble getting that to work properly. I managed to sketch 0x3FFF just fine but pretty much everything else I have tried sketching crashes the game (0xFFFF, 0FFFE, 0xFFEF, 0xFFDF, 0xFDFF, etc.) and it's pretty time consuming doing all these double corruptions when it seems likely that anything higher than 0xFF00 can't be sketched. Besides, getting obedient mew/deoxys would require four glitch moves which would probably not work.