Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Project "Gotta Document 'Em All"

StatDex? - Page 1


Posted by: Torchickens
Date: 2017-12-08 04:25:22
Using a Game Genie code (which acts as essentially a temporary ROM patch), could we investigate the names and relevant addresses related to glitch stats? (Invalid stats other than Attack, Defense, Speed, Special)

Not too long ago TheZZAZZGlitch did research on one of the glitch stats. He found that in Yellow, the hex:4E glitch stat can be lowered by using glitch move TM47, and that this affects address 0xCD7C.

I'll look into this if I find the time after ItemDex and AttackDex are done, but a little help is certainly welcome and is much appreciated. :)

Re: StatDex?

Posted by: Torchickens
Date: 2017-12-19 16:42:13
New finds!

Remember how TheZZAZZGlitch noted glitch items over 0x80 have the same effect pointer as the equivalent item minus 0x80? I used to believe this meant all of those glitch items (ignoring the unterminated name or 'TMTRAINER' effects) would function the same, but because the registers and other data are different this is not necessarily true.

Our range of glitch items ignoring TM51-TM55 extends up to 0xC3, and 0xC1-0xC3 correspond with 0x41-0x43 (X Attack, X Defense, X Speed). It would be expected that they would raise Attack, Defense, Speed and Special respectively, but it seems that they may instead return the "Nothing happened!" string.

After analysing the code thanks to the Pokémon Red disassembly, the X items other than X Accuracy are managed by ItemUseStat (3:6104, offset 0xE104). When the game gets to 3:611B it loads the value of CF91 into register 'a' (which will be the item's hexadecimal index number at the time), subtracts 0x37 from the value and uses that as the stat name. The way the game subtracts 0x37 from the initial index number is similar to how Trainer classes internally have two index numbers; the 'raw' index number and the index number plus 0xC8 which is used for instant encounter address D059.

The final index numbers are as such:

09: Blank name stat (might be valid but unused (maybe it's for HP), or might be a glitch stat)?
0A: Attack
0B: Defense
0C: Speed
0D: Special
0E: Accuracy
0F: Evasion ("Evade")
10: Seems to be a glitch stat. Is at 07 (neutral) at start of battle according to CD1A buffer.
11: Seems to be a glitch stat. Is also at 07 (neutral) at start of battle according to CD1A buffer.

It looks like glitch items 0xC1-0xC3 may be attempting to affect glitch stats 0x8A, 0x8B and 0x8C. To make an educated guess the game probably says "Nothing happened!" because it's modifying an address but the address is less than dec:02 or greater than dec:13.

I'm going to revisit what TheZZAZZGlitch wrote to see if that helps in finding those hypothetical addresses.

Edit: Now I'm unsure if you can raise them without the "Nothing happened!" message this way.
Edit 2: 01xxD3CF is a GameShark code for this, but you may still get the Nothing happened! message for many values.
Edit 3: Those values that work (other than 09, 10, 11) actually seem to be the move effect IDs (according to this) for raising a stat by one stage, interesting.

Re: StatDex?

Posted by: Torchickens
Date: 2017-12-19 19:20:56
All right, I decided that with too many variables involved (such as in addition to stat modifiers, whether the stat is at 999) a simple solution for now is to look into simply changing where the game gets the name string from.

According to the Pokémon Red text dump there are three different stat databases, as such:





3. (the one we're after in this case)


Set a breakpoint to 0F:768B and use the X item.

Register b will be equal to essentially the index number of the string in the third database (for example ATTACK is 01), and hl will be initially set to 769F (as the ATTACK string can be found at 0F:769F or offset $3F69F). In order to look up the stat name, it seems the game searches through the database until it finds a 0x50 character, decreasing register b by 1 each time until hl lands on the name of the string.

For example, the Defense stat is located at $3F6A6. By the time the game moves on to other tasks, hl is equal to 76A6 hence the game prints it and this is stored in buffer CF4B.

If you modify register b, you can look up the names for glitch stats.

Re: StatDex?

Posted by: Spoink
Date: 2017-12-19 20:55:48
I've collected a couple of the stat names, I couldn't see which addresses were effected ,sorry ;~; . it seemed to trigger the breakpoint after decreasing the stat, not before

00 seems to steal the names of hexes $0E, $0F, $10, or $11, for some reason.

I'll do the rest ($56-$FF) tomorrow unless someone claims it.

07 - =====
08 - 'm
09 - 3
0A - = $
0B -
0C -
0D - {NewLine}
0E - {YourPkMn}
0F - =
10 - = $/h
11 - 8{NewLine} {NewLine}
12 - j i
13 - y d
14 - {NewLine}{NewLine}
15 - 4, h Enemy {EnemyPkMn} {NewLine}
16 - ={NewLine}!
17 - 5
18 - {NewLine}{NewLine}
19 - 'm= $/h
1A - {NewLine}{NewLine}
1B - 999 9-'v
1C - 999
1D - 999 999
1E - 9999C.9
1F - 999toto
20 - 9999(V =9
21 -
22 - POKé9{NewLine}7
23 - {None}
24 - {None}
25 - {None}
26 - {None}
27 - {None}
28 - to
29 - {None}
2A - {None}
2B - {None}
2C - {None}
2E - {None}
2F - {None}
30 - {None}
31 - {None}
32 - GARY
33 - GARY
34 - {None}
35 - JAC 9
36 - ASH
37 - JAC
38 - {None}
39 - GARY
3A - {None}
3B - J
3C - {None}
3D - J
3E - ASH
3F - JAC
40 - JAC
41 - =to
42 -
43 - {None}
44 - {None}
45 - {None}
46 - =to
47 -
48 - {None}
49 -
4A - to
4B - {None}
4C - {None}
4D - {None}
4E - {None}
4F - {None}
50 - {None}
51 - {None}
52 - GARY
53 - {None}
54 - ASH
55 - ASH