Mail glitch discovered in US version of Emerald.
Posted by: Npo
Date: 2018-03-23 08:08:02
How to perform:
First you need to have a party containing the Instant Pomeg glitch Pokemon (0x29C0 for emerald US) in the first slot, a dummy Pokemon that will be sacrificed, and a third Pokemon to give some mail. Make sure you have plenty of mail to give to your Pokemon and some extra dummy items to give to your Pokemon to swap out for the mail, antidotes are pretty cheap. Then perform the instant Pomeg glitch by talking to the reporter at the Pokemon fan club to remove the first Pokemon in your party.
The first thing to note about this glitch is that when you give a pokemon outside the normal party an item, so by pressing up twice after opening the party menu and then selecting the item option, the item will not be given to the selected pokemon but instead be given to the first pokemon in your party, in this case the empty space, and will replace whatever item the Pokemon was holding. We make use of this to replace the mail item the pokemon is holding without properly deleting the message atached to the mail.
so once you have the IPG set up just follow these steps.
Step 1) Open the pokemon menu and press A, then give the pokemon some mail and write any message.
Step 2) press UP twice then A, give the pokemon an antidote (or any non mail item).
Step 3) press A and give the Pokemon a new piece of mail swapping out the antidote. (the selected Pokemon will have moved back to the first Pokemon in your party)
Step 4) repeat steps 2 and 3 6 times until you will see the message allready filled out when giving the pokemon mail, (you wil have to write a new message this time)
Step 5) give the third pokemon in your party mail and you will see the mail message be filled with question marks (most likely, there may be other messages in their too).
Potential Uses of glitch
So unlike the Ja version of Ruby/Sapphire when changing the message of the glitched mail you will not alter tile data on the map, however you will be changing the Pokemon sub data of the Box 2 slot 27 Pokemon (Bottom row 3rd slot). if you move any Pokemon away from that space and then write a message, an invisible bag egg will appear there.
The data you corrupt starts at the second word of the second substructure of Pokemon data, and will end at the last byte of the third substructure. So on the in game traded Seedot that would be from experience in Growth substructure up to PP of move 4 in Attack substructure.
This means we have a new way edit one of the substrucers of a pokemon! For example we could alter the EVs gained by a pokemon without having to worry about the 510 EV limit or have to worry about messing up the EV training. Another great thing about this corruption is that it's 100% consistant, so there is no randomness involved!
Another use of this is that based off the messages that appear in the mail you can read the Pokemon's substructure, so you could potentially use this to calculate a Pokemons entire TID. However because of the limited number of valid messages that can appear, versus the total possible amount of data, there is about a 1 in 64 chance of a given two bytes of data being readable. however this is much more likely than finding a shiny Pokemon, which would be the only other method of legitimately finding out your entire TID.
Limitations
As mentioned before, because there are only about a thousand or so valid messages, you are quite limited in the number of bytes you can write to the Pokemon data and because of the check sum you would have to be careful in how you make these changes so as to not cause a net change in sum. However with some more research I believe this find can be very useful!
I plan to continue to research this glitch and update my findings here, and If there are any questions I will try my best to answer them! :)