Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation III Glitch Discussion

Mail glitch discovered in US version of Emerald. - Page 1

Mail glitch discovered in US version of Emerald.

Posted by: Npo
Date: 2018-03-23 08:08:02
By using a sub glitch of the instant pomeg glitch, I was able to recreate the Mail glitch from Ja Ruby and Sapphire.

How to perform:
First you need to have a party containing the Instant Pomeg glitch Pokemon (0x29C0 for emerald US) in the first slot, a dummy Pokemon that will be sacrificed, and a third Pokemon to give some mail. Make sure you have plenty of mail to give to your Pokemon and some extra dummy items to give to your Pokemon to swap out for the mail, antidotes are pretty cheap. Then perform the instant Pomeg glitch by talking to the reporter at the Pokemon fan club to remove the first Pokemon in your party.

The first thing to note about this glitch is that when you give a pokemon outside the normal party an item, so by pressing up twice after opening the party menu and then selecting the item option, the item will not be given to the selected pokemon but instead be given to the first pokemon in your party, in this case the empty space, and will replace whatever item the Pokemon was holding. We make use of this to replace the mail item the pokemon is holding without properly deleting the message atached to the mail.

so once you have the IPG set up just follow these steps.
Step 1) Open the pokemon menu and press A, then give the pokemon some mail and write any message.
Step 2) press UP twice then A, give the pokemon an antidote (or any non mail item).
Step 3) press A and give the Pokemon a new piece of mail swapping out the antidote. (the selected Pokemon will have moved back to the first Pokemon in your party)
Step 4) repeat steps 2 and 3 6 times until you will see the message allready filled out when giving the pokemon mail, (you wil have to write a new message this time)
Step 5) give the third pokemon in your party mail and you will see the mail message be filled with question marks (most likely, there may be other messages in their too).

Potential Uses of glitch
So unlike the Ja version of Ruby/Sapphire when changing the message of the glitched mail you will not alter tile data on the map, however you will be changing the Pokemon sub data of the Box 2 slot 27 Pokemon (Bottom row 3rd slot). if you move any Pokemon away from that space and then write a message, an invisible bag egg will appear there.

The data you corrupt starts at the second word of the second substructure of Pokemon data, and will end at the last byte of the third substructure. So on the in game traded Seedot that would be from experience in Growth substructure up to PP of move 4 in Attack substructure.
This means we have a new way edit one of the substrucers of a pokemon! For example we could alter the EVs gained by a pokemon without having to worry about the 510 EV limit or have to worry about messing up the EV training. Another great thing about this corruption is that it's 100% consistant, so there is no randomness involved!

Another use of this is that based off the messages that appear in the mail you can read the Pokemon's substructure, so you could potentially use this to calculate a Pokemons entire TID. However because of the limited number of valid messages that can appear, versus the total possible amount of data, there is about a 1 in 64 chance of a given two bytes of data being readable. however this is much more likely than finding a shiny Pokemon, which would be the only other method of legitimately finding out your entire TID.

Limitations
As mentioned before, because there are only about a thousand or so valid messages, you are quite limited in the number of bytes you can write to the Pokemon data and because of the check sum you would have to be careful in how you make these changes so as to not cause a net change in sum. However with some more research I believe this find can be very useful!

I plan to continue to research this glitch and update my findings here, and If there are any questions I will try my best to answer them! :)

Re: Mail glitch discovered in US version of Emerald.

Posted by: Torchickens
Date: 2018-03-23 10:25:55
Amazing! Thanks for this Npo.

While I don't fully understand the process, in the Japanese version there was also a recently documented way to get infinite Rare Candies. (https://www.speedrun.com/pkmnrubysapphire/run/yjk2ldnm) Could this be applied to Rare Candies or Master Balls in the English version too?

Re: Mail glitch discovered in US version of Emerald.

Posted by: Npo
Date: 2018-03-23 10:57:43
You can use this to get infinite items by having the Pokemon in the third slot hold an item, every time you give them mail after performing this glitch you will receive the item they were holding but the Pokemon will still be holding the item in their hand, you can then repeat this process as many times as needed so long as you have enough pieces of Mail. However I doubt this would be useful in a speedrun, as to perform the glitch requires having an 'empty' Pokemon in the first slot of your party, and the only way i know of to do this is through the Pomeg Berry glitch. I'm sorry if my description of how to perform the glitch isn't very clear, I will try to come up with a better documentation so that others can recreate it.

Re: Mail glitch discovered in US version of Emerald.

Posted by: Torchickens
Date: 2018-03-23 11:05:32

You can use this to get infinite items by having the Pokemon in the third slot hold an item, every time you give them mail after performing this glitch you will receive the item they were holding but the Pokemon will still be holding the item in their hand, you can then repeat this process as many times as needed so long as you have enough pieces of Mail. However I doubt this would be useful in a speedrun, as to perform the glitch requires having an 'empty' Pokemon in the first slot of your party, and the only way i know of to do this is through the Pomeg Berry glitch. I'm sorry if my description of how to perform the glitch isn't very clear, I will try to come up with a better documentation so that others can recreate it.


I see, thanks.

That's OK. :) Your description is clear, it's just in general I tend to have difficulty processing new glitches sometimes before I try them.

Re: Mail glitch discovered in US version of Emerald.

Posted by: Metarkrai
Date: 2018-03-27 12:38:48
Nice find !


So, from my tests, it turns out to be something like :

-You give a letter to the first party Pokémon (empty slot).
-Then, you hit Up twice in order to select party Pokémon 0xFF, and you give him an Item (the "Item" option is always available, probably due to a coding insight that overrides the "check if the party slot is not an Egg/Bad Egg/empty slot" condition).
-Then, either the Item is directly given to the first party Pokémon during the "give an Item" procedure, or the empty party slot 0xFF is moved in front of the party.
In either cases, the empty slot in first party slot now has a non-mail item.
-However, the contents of its mail hasn't been suppressed, as well as a counter that keeps how many letters have been written, and which letter is held by which Pokémon.

-When you repeat the procedure, the new mail will take on the second mail slot, then 3rd, then… up to the 6th mail slot.
Once the game reaches the 6th given mail, more non-intended behaviour happens.

-When you try to give a new mail to a Pokémon after that, the game will look at the contents of mail 0xFF. [The game may be counting down the amount of mail given to party Pokémon, which could then trigger this effect.]
A copy of the selected mail is subtracted from the Bag.
If the Pokémon was already holding an Item, a copy of this Item is added to the Bag (with a check that the Bag isn't full). [The Item is indeed returned to the Bag at this moment in the procedure since even if you quit the mail menu that comes out later by hitting B, the item is still duplicated and one exemplary of the mail is removed.]
The contents for mail 0xFF are read in Pc Pokémon data [Box 2 Slot 27, as Npo said. The mail data is affected by DMA so a specific manipulation of PC Pokémon data is indeed possible.]
Due to another coding insight, the game doesn't check if the 0xFF-th mail already exists [The – word is 0xFFFF. 0x0000 is treated as ????, probably like all non-valid words. Thus, the 0xFF-th mail most always have non-FFFF data, but even if everything is set to 0xFFFF the game will present you the writing mode for the 7th mail]
When exiting this menu, the "change the Pokémon's held Item by a mail" command doesn't happen due to another coding error.
Thus, the Pokémon keeps its previous item, there is one less mail in the Bag, and no mail is given.


This also allows one to modify the data read as 0xFF-th mail data with all the possible non-glitched words.


Regarding the potential data modification, you can affect, as Npo pointed out :
PC Pokémon, Box 2 Slot 27 (located around 0x0202A98C with DMA)
2nd substructure : double-words 2 and 3
3rd substructure : doubles-word 1 and 2, 1st word of double-word 3. [the whole double-word 3 isn't affected]
4 double-words + 1 word = 9 words = 9 mail words you can manipulate

However, the Pokémon will turn into a Bad Egg after such a modification if its checksum isn't preserved.
This requires to know beforehand the data that is written in such double-words, which requires the ID/Secret ID couple of the trainer, the PID of the Pokémon, and some information regarding its EVs and contest stats.
Hopefully, all these things are known for in-game traded Pokémon.

This manipulation procedure could be used to create a Bootstrap Pokémon for ACE in a faster way than the one I planned, but this is completely dependant on the list of hex words that can be used for mail words.
This piece of code looks like this in general : 0258C903 0800B402. [For ACE redirected to Pyramid Bag Items in Emer non-Jpn, with a DMA translation of 18 double-words]
By having the 3rd substructure of the Pokémon being its EVs, xxxxC903 0800B402 could be obtained reasonably (08 is via Pokéblocks, while the rest requires EV manipulation on 4 stats).
Then, 0x0258 could be obtained with this glitch without having to play on double-corrupting the Pokémon and then use the held Item data and one more double-corruption to get it.

This glitch could also be used to obtain certain glitch moves on in-game traded Pokémon quite easily, or certain Items.

Is there a table/list somewhere of all the valid words for mails/tv news in RSE ?


Edit : I couldn't get to the contents of the 8th mail even by setting the contents of the 7th mail to 0xFFFF.
This may be possible, but I don't know how.

This opens to something that I didn't consider.
With another Instant Pomeg Glitch Pokémon (or with the same one but with a specific DMA pattern), it should be possible to affect the value of the 1st party Pokémon that managed the number of the held mail.

Since the data for held mails is quite short, it should start a bit before PC Pokémon data (unless I'm wrong), so not many things other than PC Pokémon corruption could be achieved this way.
However, this could allow us to modify the PID/TID/name/OT/.. of a PC Pokémon.

Edit : In Japanese Emerald, the PC Pokémon data affected by the 0xFF-mail data may be different.

Re: Mail glitch discovered in US version of Emerald.

Posted by: Npo
Date: 2018-03-27 18:15:04
Wow that is awesome Metarkrai!
I looked into trying to find a list of valid words for the easy chat system (the system used to write mail, reporter questions, questionnaire ect.) and wasn't able to find any. but by doing some experimentation I was able to figure out how it's organized. Each Word in the easy chat system is made of two bytes, The high byte marks what category the word is found under, and the low byte is the index of the word for that item. so for example the word "BAG" has the Hex index of 0x0215, 02 for being in the "TRAINER" group and 15 for being the 21'st word in that group stored in memory, (the words are NOT stored in alphabetical order).
I was able to find the order of the words stored in memory from a disassembly of Pokemon emerald found here: https://github.com/pret/pokeemerald/tree/master/data/text/easy_chat

It's also important to note that some groups need to be unlocked like the "Trendy Saying" witch requires talking to a man in Mauville Pokemon center to unlock a new saying once a day, "Pokemon 1" witch requires seeing the Pokemon form the Hoen Pokedex to be able to write, and "Pokemon 2" which requires getting the national Pokedex

So all the 16bit numbers we can write are organized into 22 groups of varying length.

Here is the list of bytes than can be written with the easy chat system:

Pokemon 1    (See note)
Trainer          0x0200-0x021B
Status          0x0400-0x046D
Battle            0x0600-0x063f
Greetings      0x0800-0x082a
People          0x0a00-0x0a4b
Voices          0x0c00-0x0c3f
Speach          0x0e00-0x0e3c
Endings          0x1000-0x1045
Feelings          0x1200-0x1245
Conditions      0x1400-0x1445
Actions          0x1600-0x164e
Lifestyle          0x1800-0x182d
Hobbies          0x1a00-0x1a36
Time              0x1c00-0x1c2d
Misc                0x1e00-0x1e2a
Adjectives      0x2000-0x2024
Events            0x2200-0x221d
Move 1            0x2400-0x249a
Move 2            0x2600-0x26c8
Trendy Saying  0x2800-0x2821
Pokemon 2      (see note)

Note: in Pokemon 1 data the index of the Pokemon name is the same as that Pokemon's index in game, for example "ABRA" would be 0x003f. So the index's of all Pokemon in the hoen pokedex can be written. Pokemon 2 data works similarly in that the index is based off the Pokemon index, but only Pokemon from gen 2 or earlier are included and the upper byte is written as 0x2A so for example "BULBASAUR" would be 0x2a01 coincidentally this means there are duplicates of Pokemon names from the Pokemon 1 group, for example if you pick "ABRA" from Pokemon 2 instead of Pokemon 1 you will write 0x2a3f instead.

Edit: Here is a link to a paste-bin with the hex index of each word (hopefully there aren't any mistakes)
https://pastebin.com/s53DQyxX

Re: Mail glitch discovered in US version of Emerald.

Posted by: Npo
Date: 2018-03-27 22:06:58

Nice find !


So, from my tests, it turns out to be something like :

-You give a letter to the first party Pokémon (empty slot).
-Then, you hit Up twice in order to select party Pokémon 0xFF, and you give him an Item (the "Item" option is always available, probably due to a coding insight that overrides the "check if the party slot is not an Egg/Bad Egg/empty slot" condition).
-Then, either the Item is directly given to the first party Pokémon during the "give an Item" procedure, or the empty party slot 0xFF is moved in front of the party.
In either cases, the empty slot in first party slot now has a non-mail item.
-However, the contents of its mail hasn't been suppressed, as well as a counter that keeps how many letters have been written, and which letter is held by which Pokémon.

-When you repeat the procedure, the new mail will take on the second mail slot, then 3rd, then… up to the 6th mail slot.
Once the game reaches the 6th given mail, more non-intended behaviour happens.

-When you try to give a new mail to a Pokémon after that, the game will look at the contents of mail 0xFF. [The game may be counting down the amount of mail given to party Pokémon, which could then trigger this effect.]
A copy of the selected mail is subtracted from the Bag.
If the Pokémon was already holding an Item, a copy of this Item is added to the Bag (with a check that the Bag isn't full). [The Item is indeed returned to the Bag at this moment in the procedure since even if you quit the mail menu that comes out later by hitting B, the item is still duplicated and one exemplary of the mail is removed.]
The contents for mail 0xFF are read in Pc Pokémon data [Box 2 Slot 27, as Npo said. The mail data is affected by DMA so a specific manipulation of PC Pokémon data is indeed possible.]
Due to another coding insight, the game doesn't check if the 0xFF-th mail already exists [The – word is 0xFFFF. 0x0000 is treated as ????, probably like all non-valid words. Thus, the 0xFF-th mail most always have non-FFFF data, but even if everything is set to 0xFFFF the game will present you the writing mode for the 7th mail]
When exiting this menu, the "change the Pokémon's held Item by a mail" command doesn't happen due to another coding error.
Thus, the Pokémon keeps its previous item, there is one less mail in the Bag, and no mail is given.


This also allows one to modify the data read as 0xFF-th mail data with all the possible non-glitched words.


Regarding the potential data modification, you can affect, as Npo pointed out :
PC Pokémon, Box 2 Slot 27 (located around 0x0202A98C with DMA)
2nd substructure : double-words 2 and 3
3rd substructure : doubles-word 1 and 2, 1st word of double-word 3. [the whole double-word 3 isn't affected]
4 double-words + 1 word = 9 words = 9 mail words you can manipulate

However, the Pokémon will turn into a Bad Egg after such a modification if its checksum isn't preserved.
This requires to know beforehand the data that is written in such double-words, which requires the ID/Secret ID couple of the trainer, the PID of the Pokémon, and some information regarding its EVs and contest stats.
Hopefully, all these things are known for in-game traded Pokémon.

This manipulation procedure could be used to create a Bootstrap Pokémon for ACE in a faster way than the one I planned, but this is completely dependant on the list of hex words that can be used for mail words.
This piece of code looks like this in general : 0258C903 0800B402. [For ACE redirected to Pyramid Bag Items in Emer non-Jpn, with a DMA translation of 18 double-words]
By having the 3rd substructure of the Pokémon being its EVs, xxxxC903 0800B402 could be obtained reasonably (08 is via Pokéblocks, while the rest requires EV manipulation on 4 stats).
Then, 0x0258 could be obtained with this glitch without having to play on double-corrupting the Pokémon and then use the held Item data and one more double-corruption to get it.

This glitch could also be used to obtain certain glitch moves on in-game traded Pokémon quite easily, or certain Items.

Is there a table/list somewhere of all the valid words for mails/tv news in RSE ?


Edit : I couldn't get to the contents of the 8th mail even by setting the contents of the 7th mail to 0xFFFF.
This may be possible, but I don't know how.

This opens to something that I didn't consider.
With another Instant Pomeg Glitch Pokémon (or with the same one but with a specific DMA pattern), it should be possible to affect the value of the 1st party Pokémon that managed the number of the held mail.

Since the data for held mails is quite short, it should start a bit before PC Pokémon data (unless I'm wrong), so not many things other than PC Pokémon corruption could be achieved this way.
However, this could allow us to modify the PID/TID/name/OT/.. of a PC Pokémon.

Edit : In Japanese Emerald, the PC Pokémon data affected by the 0xFF-mail data may be different.



In regards to trying to construct a bootstrap Pokemon using the mail glitch, since there is no valid message that corresponds with 0x0258 you cannot simply write this message to edit the Pokemon, however, it may be possible to write a number that would result in the Pokemon having more EVs then needed, and then reduce it to the desired EV count using berries. for example on an in game traded Pokemon, that has been successfully corrupted, the higher two bytes of the PID would be 0x4000, and writing "MUK" from Pokemon 2 (0x2a58) to the corresponding EV stats would result in 106 and 88 EVs (once decrypted). We want to write 0x0258 which is 66 and 88 EVs once decrypted, so by giving the Pokemon 4 EV reducing berries, the encrypted data will be what we desire. A similar strategy can be used to construct bootstrap Pokemon for other purposes.

Re: Mail glitch discovered in US version of Emerald.

Posted by: Metarkrai
Date: 2018-03-28 04:03:38

In regards to trying to construct a bootstrap Pokemon using the mail glitch, since there is no valid message that corresponds with 0x0258 you cannot simply write this message to edit the Pokemon, however, it may be possible to write a number that would result in the Pokemon having more EVs then needed, and then reduce it to the desired EV count using berries. for example on an in game traded Pokemon, that has been successfully corrupted, the higher two bytes of the PID would be 0x4000, and writing "MUK" from Pokemon 2 (0x2a58) to the corresponding EV stats would result in 106 and 88 EVs (once decrypted). We want to write 0x0258 which is 66 and 88 EVs once decrypted, so by giving the Pokemon 4 EV reducing berries, the encrypted data will be what we desire. A similar strategy can be used to construct bootstrap Pokemon for other purposes.



Oh yeah, I completely forgot about the potential use of EV-reducing berries.

I haven't looked at all the potential Pokémon names that can be used (especially those with a high second byte).

However, when corrupting the PID/TID of a Pokémon, you will only have a non-Egg form with 2 corruptions (PID and TID) and not just one (except two special cases).
And since PID xor TID is used for data encryption, the 0x4000xxxx that appear on the in-game traded Pokémon's PID and TID after a double-corruption (or 0x4001xxxx for Meowth and Plusle's PID) compensate together.
Thus, regarding (Speed Es)(Def EVs), the desired values are 0x02 and 0x058 to form 0x0258.
For the other EVs, the xor-ing changes everything, so it will really be dependent on the possible valid words.

The single in-game traded Pokémon that have their EVs substructure as 3rd substructure is Meowth (normal and double-corrupted)
[ Meowth : PID 0x0000008B, TID 0x00016559, PID xor TID : 0x000165D2, MGEA->AMEG ]
Its second substructure will be either Growth (normal) or Miscellanous (double-corrupted).
The data in Growth substructure that could then be changed is its Exp, PP bonuses, Happiness, and ??? (something whose use I don't know).

Thus, two contest stats, the ??? thing (that's at 0x0000), the PP bonuses, and the happiness can be determined beforehand and then be used to get a constant checksum after modifying Meowth's EVs with the Emerald Mail glitch.

An happiness of 0xFF could be useful as its crypted version is FF xor 65 = 9A.
Thus, a change of this 9A for something like 0x12 would change the happiness to 0x77, which would induce a checksum subtraction of 0x8800. (near the 0x8000 maximal change).


Unfortunately, none of the Emerald in-game traded Pokémon have their Growth substructure as their 3rd substructure (in either their normal or double-corrupted form).

However, for the Attacks substructure, Seedot (normal and double-corrupted) and Horsea (double-corrupted) have this substructure as their 3rd substructure.

Re: Mail glitch discovered in US version of Emerald.

Posted by: Npo
Date: 2018-03-28 11:19:25



Oh yeah, I completely forgot about the potential use of EV-reducing berries.

I haven't looked at all the potential Pokémon names that can be used (especially those with a high second byte).

However, when corrupting the PID/TID of a Pokémon, you will only have a non-Egg form with 2 corruptions (PID and TID) and not just one (except two special cases).
And since PID xor TID is used for data encryption, the 0x4000xxxx that appear on the in-game traded Pokémon's PID and TID after a double-corruption (or 4001xxxx for Meowth and Plusle's PID) compensate together.
Thus, regarding (Speed Es)(Def EVs), the desired values are 0x02 and 0x058 to form 0x0258.
For the other EVs, the xor-ing changes everything, so it will really be dependent on the possible valid words.

The single in-game traded Pokémon that have their EVs substructure as 3rd substructure is Meowth (normal and double-corrupted)
[ Meowth : PID 0x0000008B, TID 0x00016559, PID xor TID : 0x000165D2, MGEA->AMEG ]
Its second substructure will be either Growth (normal) or Miscellanous (double-corrupted).
The data in Growth substructure that could then be changed is its Exp, PP bonuses, Happiness, and ??? (something whose use I don't know).

Thus, two contest stats, the ??? thing (that's at 0x0000), the PP bonuses, and the happiness can be determined beforehand and then be used to get a constant checksum after modifying Meowth's EVs with the Emerald Mail glitch.

An happiness of 0xFF could be useful as its crypted version is FF xor 65 = 9A.
Thus, a change of this 9A for something like 0x12 would change the happiness to 0x77, which would induce a checksum subtraction of 0x8800. (near the 0x8000 maximal change).


Unfortunately, none of the Emerald in-game traded Pokémon have their Growth substructure as their 3rd substructure (in either their normal or double-corrupted form).

However, for the Attacks substructure, Seedot (normal and double-corrupted) and Horsea (double-corrupted) have this substructure as their 3rd substructure.




Although after performing a single corruption to a any Pokemon would result in it turning into an egg, you can still hatch the egg into a Pokemon to be able to modify it's EVs but still have a PID xor TID of 4000xxxx (or 4001xxxx in Meowths case) you would just have to make sure that the species of the Pokemon that is hatched is a non glitch Pokemon, or a Pokemon who doesn't cause the game to crash upon hatching. This way you can still modify the PID xor TID value (is there a shorthand name for that value?) through corruption and still be able to modify it's EVs. Unfortunately the only in game traded Pokemon who has EVs in the third substructure is Meowth and because of it's PID xor TID value, the required EVs to write the bootstrap code is over the limit, even with the work around I described previously. However this means you are not necessarily restricted to only being able to write valid hex values.

Also, although not as nice as using the in game traded Pokemon, we can use rng manipulation to catch pokemon with a specific PID, and using the fact that you can also READ the encrypted data (so long as it's a valid message) as well as write to it, you can calculate your players entire TID without needing to catch a shiny pokemon normally.
The method would work like this. Catch a bunch of spinda (since you can easily figure out their PID from their spots / IVs) and place one in the Box 2 slot that is edited by the mail glitch, and check to see if you can read any data on the left side of the mail (the values that would be Xord with your SID) if you can't replace the spinda with a new one until you find one that works (shouldn't take too long since there are ~1800 valid messages and your checking 4 different values each time) then you would figure out what data the valid message corresponds too and plug it into this equation
PID(high) Xor MessageIndex Xor Data = SID

This is just a rough over view of the method, I will type up a better step by step method when I have time later today.  :)


Re: Mail glitch discovered in US version of Emerald.

Posted by: Npo
Date: 2018-03-28 18:22:33
Ok here is the method I came up with for figuring out your players Secret ID using the Mail Glitch.
You will need to know / have these things:
1 Know how to set up the mail glitch
2 Know how to calculate the PID of a Spinda based of it's spots
3 Know how to calculate a Pokemon's IVs
4 A programming calculator that can do bit-wise Xor (or find one online)

In game you will need the following:
1: Have gotten the National Pokedex (not necessary but can help)
2: Have the necessary Pokemon party to set up and perform the Mail Glitch
3: Lots of extra Mail
4: About 10 or so Repeat Balls

Here are the steps
Step 1: Register a Spinda in your pokedex by capturing one, so that you can catch some more using the repeat balls.

Step 2: Save your game

Step 3: catch about ten or so Spinda on route 113

Step 4: place one of the Spinda in Box 2 slot 27

Step 5: Give a piece of mail to a Pokemon in your party to activate the mail glitch and check to see if there are any Valid Messages (anything that is not "???") in one of the four slots on
the right hand side of the mail.

Step 6: If the spinda dose not have any valid messages then go back to step 4 swapping the spinda out for a new one, if none of the spinda work reset and try again.

Step 7: Once you have a Spinda that has a valid message on the right hand side of the mail,
copy down what the message is and what 'slot' the message is in the top right most slot being one, and the bottom right being 4.
If the message is the name of a Pokemon that existed in gen 2 but also exist in the Hoen pokedex, Abra for example, then you will have to double check to see if it's from the Pokemon 1 or Pokemon 2 group. You can do this by re writing the name of the Pokemon from Pokemon group 2 and then attempt to give the mail to the Pokemon, if a message appears asking you if you want to stop giving the mail to the Pokemon, than note that the Pokemon name came from group 2, if it  ask you if your OK with giving this message to the Pokemon then note down that the Pokemon name came from group 1. DO NOT GIVE the Pokemon the mail!

Step 8: Calculate the PID of the spinda who has a valid message using this website:
http://www.freewebs.com/gatorshark/Spinda%20Painter.htm

Step 9: Now we need to know what data the message you copied down references, to do that we find the PID modulo 24 then use the table from the Bulbapedia page on pokemon substructure to figure out the order of the substructures of the spinda.
https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III

For example my spinda had a PID of 0xA0953C09,
Modulo 24 comes out to 9 so the order of the substructures is AEMG
If the message appeared in slot 1 or 2 then the data we are looking for is in the 2nd substructure (in my case E),
if the message appeared in slot 3 or 4 then the data we are looking for is in the third substructure (in my caseM)

Now depending on what substructure / slot your message appeared in you can find what data it's referencing

Growth (G)
Slot 1 and 4: upper Experience bytes
your Spinda's total EXP should be less than 65535 so the data should be 0x0000
Slot 2: Unknown data
for all Pokemon this data is 0x0000
Slot 3: Held Item
Check to see if your spinda is holding a chesto berry (5%) if it is the data is 0x0086
otherwise it will be 0x0000

Attacks (A)
Slot 1 and 4 : Move 4
Attack 4 should be either Psybeam or nothing, if it's Psybeam then the data is 0x003c
otherwise it will be 0x00
Slot 2: PP4 + PP3
Move 3 will be Faint attack and move 4 is either Psybeam or nothing, so these two bytes will either be 0x0014 if there is no Psybeam or 0x1414 if there is.
Slot 3: Move 2
Attack 2 should be Uproar, the data is 0x00FD

EVs and Conditions (E)
All slots:
Since you just caught the spinda all of it's eves and conditions should be zero,
the data is 0x0000

Miscellaneous (M) (a little more complicated)
Slot 1 and 4:  IVs
You will have to calculate the spindas IVs for Special Defense, Special Attack, and Speed. then write out the following number using those values,
00(SpD)(SpA)(Spe*)
*only need to write the 4 most significant bits of the speed IV
then that would be your data.

Slot 2:Ribbons and Obedience
Since you just caught the spinda it shouldn't have any ribbons
the data is 0x0000

Slot 3: Origins Info
Fill out the following info in binary from the Origins info table from the bulbapedia page:
https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III

you will need to know your characters gender the poke-ball spinda was caught in (repeat ball)
the game of origin (Emerald) and the level you caught it at (14,15, or 16)

Step 10:
Now you should have 3 pieces of information, the Spindas PID, the valid message it corresponds to, and the data it's referencing. find the hex id of the message using the info from my previous post and the link it goes to, and then find the bit wise Xor of the higher 4 bytes of the PID the Data you found and the Hex id of the message. This is your SID

So for example my spindas PID was 0xA0953C09, I found the message "SEALEO" in slot one which has a hex id of 0x0156 and corresponds to the EVs section for my spinda, and so my data is 0x0000, then I xor the three numbers,
0xA095 XOR 0x0156 XOR 0x0000 = 0xA1C3 so my SID is 0xA1C3 or 41411 in decimal, now i can use this number for rng manipulation of shiny pokemon or for other uses.

Re: Mail glitch discovered in US version of Emerald.

Posted by: Metarkrai
Date: 2018-03-29 08:57:10

Although after performing a single corruption to a any Pokemon would result in it turning into an egg, you can still hatch the egg into a Pokemon to be able to modify it's EVs but still have a PID xor TID of 4000xxxx (or 4001xxxx in Meowths case) you would just have to make sure that the species of the Pokemon that is hatched is a non glitch Pokemon, or a Pokemon who doesn't cause the game to crash upon hatching. This way you can still modify the PID xor TID value (is there a shorthand name for that value?) through corruption and still be able to modify it's EVs. Unfortunately the only in game traded Pokemon who has EVs in the third substructure is Meowth and because of it's PID xor TID value, the required EVs to write the bootstrap code is over the limit, even with the work around I described previously. However this means you are not necessarily restricted to only being able to write valid hex values.  This is just a rough over view of the method, I will type up a better step by step method when I have time later today.  :)


Well, unfortunately no.
When hatching an Egg, its TID is changed to yours and all its data is re-encrypted with the new PID xor TID.
Thus, you completely lose the 0x0000xxxx TID from the in-game trainer of the in-game traded Meowth, which makes the rest of the procedure undoable unless you can determine your Secret ID and do many calculations.



Also, although not as nice as using the in game traded Pokemon, we can use rng manipulation to catch pokemon with a specific PID, and using the fact that you can also READ the encrypted data (so long as it's a valid message) as well as write to it, you can calculate your players entire TID without needing to catch a shiny pokemon normally.
The method would work like this. Catch a bunch of spinda (since you can easily figure out their PID from their spots / IVs) and place one in the Box 2 slot that is edited by the mail glitch, and check to see if you can read any data on the left side of the mail (the values that would be Xord with your SID) if you can't replace the spinda with a new one until you find one that works (shouldn't take too long since there are ~1800 valid messages and your checking 4 different values each time) then you would figure out what data the valid message corresponds too and plug it into this equation
PID(high) Xor MessageIndex Xor Data = SID

This is just a rough over view of the method, I will type up a better step by step method when I have time later today.  :)


This is a really nice idea, and a really nice way to determine the Secret ID of a save file in Gen III !
Good Pokémon to catch for an easy PID determination are Smeargles as they are high levelled and are easy to find and by catching them up to a few minutes after a soft-reset, their TID is easily found on RNG Reporter.



For them, the indicative information becomes :



List of decrypted values depending on their slot and substructure :
Growth (G)
Slot 1 and 4: upper Experience bytes
0x0000 if Smeargle's EXP is lower or equal to 65.535
0x0001 else. (as they have less than 131.072 exp at Lv 50)
Slot 2: Unknown data
0x0000 for every Pokémon
Slot 3: Held Item
0x0000 (No held Item)

Attacks (A)
Slot 1 and 4 : Move 4
0x0000 (No 4th Move)
Slot 2: 256*PP4 + PP3
0x0000 (0 PPs for Move 3 and 0 PPs for Move 4)
Slot 3: Move 2
0x0000 (No Move 2)

EVs and Conditions (E)
All slots:
0x0000 (No EVs, No Contest stats)

Miscellaneous (M) (a little more complicated)
Slot 1 and 4:  IVs
Compute : (floor(Speed IV/2))+16*(Special Atk IV) + 512*(Special Def IV) + 32.768*(Ability) in decimal.
Then convert this value to hexadecimal to obtain the decrypted value.

Ability is 0 if the Pokémon has its first ability, and 1 if it has its second ability. (It is 0 for a wild Smeargle.)

Slot 2:Ribbons and Obedience
0x0000 (No Ribbons)

Slot 3: Origins Info
Compute : Met Lv + (Origin version)*128 + (Ball)*2048 + (Trainer gender)*32.768 in decimal.
Then, convert it to hexadecimal to obtain the decrypted value.

Origin version is 3 for Emerald
Ball is 1 for Master Ball, 2 for Ultra Ball, 9 for Repeat Ball.
Trainer gender is 0 for male and 1 for female
For the whole possible values, check bulbapedia's page : https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_in_Generation_III


- Obtain the hexadecimal value tied to the mail word.
If this isn't a Pokémon name, find the value here : https://pastebin.com/s53DQyxX
If this is the name of a Gen 3 Pokémon, the tied value is the hexadecimal identifiant of this Pokémon in Gen III. (not the national Pokédex number) List of Gen III identifiants : https://bulbapedia.bulbagarden.net/wiki/List_of_Pok%C3%A9mon_by_index_number_(Generation_III)
If this is the name of a Gen 1-2 Pokémon that isn't in the Hoenn Pokédex, the tied value is the hexadecimal identifiant of this Pokémon.

If the message is the name of a Gen 1-2 that is in the Hoenn Pokédex, Abra for example, then you will have to double check to see if it's from the Pokemon 1 or Pokemon 2 group. You can do this by re writing the name of the Pokemon from Pokemon group 2 and then attempt to give the mail to the Pokemon, if a message appears asking you if you want to stop giving the mail to the Pokemon, than note that the Pokemon name came from group 2, if it ask you if your OK with giving this message to the Pokemon then note down that the Pokemon name came from group 1. DO NOT GIVE the Pokemon the mail!
If the Pokémon's name is from the "Pokémon 1" group, then its tied value is 0x00yy the hexadecimal identifiant of this Pokémon.
If the Pokémon's name is from the "Pokémon 2" group, then its tied value is 0x2Ayy, where yy is the hexadecimal dentifiant of this Pokémon.


- Then, obtain the PID in hexadecimal with the formula : PID = (mail word value) xor (high PID) xor (decrypted value).

Re: Mail glitch discovered in US version of Emerald.

Posted by: Npo
Date: 2018-03-29 09:42:44



Well, unfortunately no.
When hatching an Egg, its TID is changed to yours and all its data is re-encrypted with the new PID xor TID.
Thus, you completely lose the 0x0000xxxx TID from the in-game trainer of the in-game traded Meowth, which makes the rest of the procedure undoable unless you can determine your Secret ID and do many calculations.



I compleatly forgot about the TID being replace once hatched.  :P




This is a really nice idea, and a really nice way to determine the Secret ID of a save file in Gen III !
Good Pokémon to catch for an easy PID determination are Smeargles as they are high levelled and are easy to find and by catching them up to a few minutes after a soft-reset, their TID is easily found on RNG Reporter.



For them, the indicative information becomes : ….


I like the idea of using smeargle better, calculating a PID from spinda spots gets kinda finicky. I did do some calculations for the odds of finding a spinda that would work for my method and it comes out to about 7%, so a box for a box full of spinda there is a ~89% chance one of them will work. The odds would be slightly different for smeargel since most of the possible values that could be read from ie. Move 4 , PP3 + PP4 Move 2, ext. would always have the same value of zero unencrypted, so if smeargles PID mod 24 = 0 for example, all for slots would be the same number. This is also true in some cases for spinda as well, so it would ultimately be a pretty small change in odds. It would still be better to go for the smeargle strategy.

Either way this method is MUCH faster then trying to find a shiny Pokemon! And using rng manipulation you can now search for PID's that would xor with your trainer id so that you can write values into the item slot to get specific glitch items much faster and easier. Or even to set up bootstrap pokemon.

Re: Mail glitch discovered in US version of Emerald.

Posted by: Metarkrai
Date: 2018-03-29 11:32:29

I like the idea of using smeargle better, calculating a PID from spinda spots gets kinda finicky. I did do some calculations for the odds of finding a spinda that would work for my method and it comes out to about 7%, so a box for a box full of spinda there is a ~89% chance one of them will work. The odds would be slightly different for smeargel since most of the possible values that could be read from ie. Move 4 , PP3 + PP4 Move 2, ext. would always have the same value of zero unencrypted, so if smeargles PID mod 24 = 0 for example, all for slots would be the same number. This is also true in some cases for spinda as well, so it would ultimately be a pretty small change in odds. It would still be better to go for the smeargle strategy.

Either way this method is MUCH faster then trying to find a shiny Pokemon! And using rng manipulation you can now search for PID's that would xor with your trainer id so that you can write values into the item slot to get specific glitch items much faster and easier. Or even to set up bootstrap pokemon.


I thought once again, and the Smeargle idea is not that good in the end.

It is more interesting to have a decrypted value different in each case in order to maximize the chances to have a mail word value that ends up valid.
Thus, things like giving an Item are interesting.

With 935 + 220 + 251=1406 valid mail words and 4 different decrypted values, I found a ~8.4% chance that a Pokémon deposited at Box 2 Slot 27 will give a valid word in one of the 4 different slots. (in the uniform and independant care, but it's less in reality since the 4 values that are read are not independent)


I thought of a modified version of the procedure with catches that are a bit slower, but with Spindas that give the maximal (or near-maximal) chance to get a positive result.

This procedure may be a bit slower time-wise, but it makes the final computations easier by removing some cases.

Step 0 :
Obtain an Instant Pomeg Glitch Pokémon, and Glitch Item 0x6400.
You can obtain one by performing a double-corruption on an in-game traded Seedot with an in-game traded Plusle with Growl only as a corruption initiator. (See a reference about double-corruption for that)
The EVs you need to give to a clone of the in-game traded Seedot are :
Emer Fr: 0x29C8 (41 Atk,200 HP) | Emer US : 0x29C0 (41 Atk,192 HP) | Emer Spa : 0x948C (148 Atk,140 HP) | Emer Ger : 0x29C9 (41 Atk, 201 HP) | Emer Jp : 0x4360 (67 Atk,96 HP) | Emer Ita : 0x9481 (148 Atk,129 HP) |
As well as 100 Speed EVs (10 Carbos) for Glitch Item 0x6400.

Here's some Ev-training data to help you in the EV-training :
- Macho Brace : Doubles the EVs won in a battle.
- Exp.Share : The holder also receives EVs when Pokémon are KOed.
- PokéRus : Doubles the EVs won in a battle. /!\ AVOID IT /!\ (Obtaining odd EVs with PokéRus is a problem)
- HP : HP Up : +10 HP (Up to 100 HP) | Marill (Route 102,111) : +2 HP | Wishmur (Rusturf Tunnel) : +1 HP.
- Attack : Protein : +10 Atk (Up to 100 Atk) | Mighthyena (Route 120,121) : +2 Atk | Poochyena (Route 101,102,120,121) : +1 Atk.

Once you obtain the Instant Pomeg Glitch Pokémon, don't try to take its Item directly.
Catch a Smeargle/wild Pokémon, and nickname it "Item 6400".
Withdraw the Instant Pomeg Glitch Pokémon in your party and take its Item.
Then, give this Item to the Pokémon nicknamed "Item 6400".
This way, you know that Glitch Item 0x8000 is held by this Pokémon. (since all glitch items look the same, this is important to distinguish them)

Step 1 :
Perform the Emerald Mail Glitch. (See NPO's first post of this topic)
Once you filled all 6 slots for party Pokémon mails and can access Mail N°255, break the Instant Pomeg Glitch and save.


Step 2 :
Make around 5 Pokéblocks with 3 NPC, with Chesto Berries, at ~93 maximum RPM. (They should be Blue Pokéblocks at Lv12 with 21 Feel)
Clone Glitch Item 0x6400.
Buy/clone 10 Master Balls/Repeat Balls.
Buy/clone 20 Carbos.
Go to Route 117 and save.

Step 3 :
Find a wild Spinda.
Find the PID of each Spinda by using http://www.freewebs.com/gatorshark/Spinda%20Painter.htm
(Check Spinda's gender and nature to see if you are correct)
Take the decimal value of the PID, and compute PID modulo 24. (or the remainder in the euclidian division of PID by 24)
If the value is : 00,02,06,08,12,14,18,19,20,21,22,23, then catch the Spinda and nickmane it with the value. (Nickname it "23" if the result of the computation is 23).
Else, flee and meet another Spinda.

Repeat the process until 10 Spindas are caught.

Step 4 :
Once you have caught 10 Spindas, go into the PC and withdraw a Spinda.
Look at the first Spinda in your party.

-If the value is 00 or 21 (MAEG or GAEM) : Give it 2 Carbos and Teach it Strenght as its 4th Move. (replace Psybeam if he knows it).
Its 2nd substructure is Attacks, and its 3rd substructure is EVs.
-If the value is 02 or 23 (MEAG or GEAM) : Give it a Blue Pokéblock (Lv 12, 21 Feel), and teach it Strenght as its 4th Move. (replace Psybeam if he knows it).
Its 2nd substructure is EVs, and its 3rd substructure is Attacks.
-If the value is 14 or 20 (EAGM or MAGE) : Teach it Strenght as its 4th Move. (replace Psybeam if he knows it).
Its 2nd substructure is Attacks, and its 3rd substructure is Growth.
-If the value is 12 or 18 (EGAM or MGAE) : Teach it Strenght as its 4th Move (replace Psybeam if he knows it), and make it hold Glitch Item 0x6400.
Its 2nd substructure is Growth, and its 3rd substructure is Attacks.
-If the value is 06 or 19 (AGEM or MGEA) : Give it a Blue Pokéblock (Lv 12, 21 Feel), give it 2 Carbos, and make it hold Glitch Item 0x6400.
Its 2nd substructure is EVs, and its 3rd substructure is Attacks.
-If the value is 08 or 22 (AEGM or MEGA) : Give it a Blue Pokéblock (Lv 12, 21 Feel), and make it hold Glitch Item 0x6400.
Its 2nd substructure is EVs, and its 3rd substructure is Attacks.


Repeat the process with all the Spindas you caught.
Deposit all your Spindas in Box 2, but avoid Slot 27.

Step 5 :
Move 1 Spinda to Box 2 Slot 27.
Close the PC.
Open the bag, and give a mail to a party Pokémon.
This will display you the contents of the mail N°255, which are read on the data of the Pokémon at Box 2 Slot 27.

Look if one of the 4 words in the right is a normal word (and not "????"). (it must be on the right column, and not on the left column)

If yes, proceed to the next step.
If no, close the Bag, open the PC, put another Spinda at Box 2 Slot 27, and repeat the process.

If all 10 of your Spindas don't work, reset and go back to step 3 to catch 10 more Spindas.

The chance that a normal word appears instead of a "????" is less than 10% per Spinda. (It is ~8.5% in the uniformly randomized theoretical case, so it's less than that in reality.)


Step 6 :
Note the word that appeared.
Note the line at which the normal word appeared. (Line 1,2,3 or 4.)
Close the mail, close the Bag, and save.
Open the PC and note the nickname of the Spinda that is in Box 2 Slot 27.
Use the information at step 4 and note the 2nd substructure and the 3rd substructure of this Spinda.
These substructures will be used later on to compute some other values.

Determine the PID of this Spinda again with http://www.freewebs.com/gatorshark/Spinda%20Painter.htm
Write down the hexadecimal value of this PID.
Cut this PID in two and note the left part. (Ex : If PID is 0x001457AF, I note 0x0014)
This part of the PID is called "high-PID", and will be used later.

Step 7 :
Obtain "word value", the hexadecimal value tied to the mail word.
If this isn't a Pokémon name, find the value in this list : https://pastebin.com/s53DQyxX
If this is the name of a Gen 3 Pokémon, the tied value is the hexadecimal identifiant of this Pokémon in Gen III. (not the national Pokédex number)
Here is a list of Gen III identifiants : https://bulbapedia.bulbagarden.net/wiki/List_of_Pok%C3%A9mon_by_index_number_(Generation_III)
If this is the name of a Gen 1-2 Pokémon that isn't in the Hoenn Pokédex, the tied value is the hexadecimal identifiant of this Pokémon.

If the message is the name of a Gen 1-2 that is in the Hoenn Pokédex (Abra for example) then you will have to double check to see if it's from the Pokemon 1 or Pokemon 2 group.
You can do this by re writing the name of the Pokemon from Pokemon group 2 and then attempt to give the mail to the Pokemon, if a message appears asking you if you want to stop giving the mail to the Pokemon, than note that the Pokemon name came from group 2, if it ask you if your OK with giving this message to the Pokemon then note down that the Pokemon name came from group 1. DO NOT GIVE the Pokemon the mail!
If the Pokémon's name is from the "Pokémon 1" group, then its tied value is 0x00yy the hexadecimal identifiant of this Pokémon.
If the Pokémon's name is from the "Pokémon 2" group, then its tied value is 0x2Ayy, where yy is the hexadecimal dentifiant of this Pokémon.

Step 8 :
Note the value of the "dectypted data" from the list below that corresponds to your situation.

If the line at which your normal word appeared is the 1st or the 2nd line, look at the part of the list tied to the 2nd substructure of your Spinda.
If the line at which your normal word appeared is 3rd or the 4th line, look at the part of the list tied to the 3nd substructure of your Spinda.
(Ex : If the Spinda's nickname is "21", its 2nd substructure is Attacks and its 3rd substructure is EVs. If the non-glitched word appeared in 4th line, I need to look at the EVs section in the list).


Growth (G) :
Line 1 : upper Experience bytes
0x0000 (Spinda has less than 65.536 exp)
Line 2: Unknown data
0x0000 for every Pokémon
Line 3: Held Item
0x6400 (Glitch Item 0x6400 held)
Line 4 : upper Experience bytes
0x0000 (Spinda has less than 65.536 exp)

Attacks (A) :
Line 1 : Move 4
0x0046 (Strenght)
Line 2: 256*PP4 + PP3
0x0F14 (20 PPs for Faint Attack and 15 PPs for Strenght)
Line 3 : Move 2
0x00FD (Uproar)
Line 4 : Move 4
0x0046 (Strenght)

EVs and Conditions (E) :
Line 1 : 256*(Beauty)+Coolness
0x0D00 (13 Beauty, 0 Coolness)(if Spinda's nature is Modest, Mild, Quiet, or Rash)
0x0B00 (11 Beauty, 0 Coolness)(if Spinda's nature is Adamant, Impish, Jolly, or Careful)
0x0C00 (12 Beauty, 0 Coolness)(if Spinda's nature is not one of the previous ones)
Line 2: 256*Feel + Toughness
0x1500 (21 Feel, 0 Toughness)
Line 3 : 256*(Speed EVs) + Def
0x1400 (20 Speed EVs, 0 Def EVs)
Line 4 : 256*(Beauty)+Coolness
0x0D00 (13 Beauty, 0 Coolness)(if Spinda's nature is Modest, Mild, Quiet, or Rash)
0x0B00 (11 Beauty, 0 Coolness)(if Spinda's nature is Adamant, Impish, Jolly, or Careful)
0x0C00 (12 Beauty, 0 Coolness)(if Spinda's nature is not one of the previous ones)


Step 9 :
Obtain your Secret ID in hexadecimal by computing : Secret ID = (decrypted data) xor (high-PID) xor (word value).