Arbitrary code execution
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
[hr] No further extensions
Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)
Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)
[hr] Buffer overflow techniques
99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)
[hr] Item stack duplication glitch (Generation I)
Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch
[hr] Bad clone glitch (Generation II)
????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))
[hr] Closed menu Select glitches (Japanese Red/Green)
Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch
[hr] Pomeg glitch (Generation III)
Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch
[hr] Voiding (Generation IV)
Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)
[hr] 2x2 block encounter glitches (Generation I)
Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch
[hr] Glitch City
Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)
[hr] Large storage box byte shift glitch
Storage box remaining HP glitch | Generation I max stat trick
[hr] Pikachu off-screen glitch
Trainer corruption glitch
[hr] SRAM glitches
Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches
[hr] Trainer escape glitch
Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation
[hr] Walk through walls
Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls
[hr] Surf down glitch
Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))
(view, talk, edit)
The 99 item stack glitch is a memory corruption glitch and natural glitch which occurs in Pokémon Red and Blue and Pokémon Yellow (Japanese). It does not work in English Yellow.
DescriptionIf the player performs a task that increments the number of items in a list (purchasing an item from a Poké Mart, depositing it via the PC or withdrawing it via the PC) while they have an existing stack of 99 of that item in the last slot of their inventory (e.g. Ultra Ball x99), the game will try to add to an item quantity of the same item from beyond that slot in an attempt to contain the items in an existing stack without creating a new one.
The end terminator is ignored if it directly follows the 99-quantity stack. This means the game reads past the item list, and start to interpret unrelated memory addresses as item index number and item quantity. If the game finds the same interpreted item index before it finds a 0xFF terminator, it may change the respective quantity byte.
This works even if the existing item stack has less than 99 items, as long as the total quantity of the existing stack and the new stack is greater than 99. In this case, the game will add enough items to make the existing stack x99 and then proceed to trigger the glitch.
Note that any memory address in an "item type" slot (even address for bag, odd address for PC) with value 0xFF will end the search. The new item is put in the correct slot because it's calculated from the number of items, not decided by the 0xFF terminator. As a result, the glitch will not occur if the player has less item slots occupied than previously (e.g., if the player has had 15 item slots filled in his inventory, having less than 15 item slots occupied will prevent the glitch), because in this case the item list will have multiple terminators. Having all 8 badges in the English versions will also prevent most corruptions.
The glitch also doesn't happen if the item list is already full (20 in the case of the bag and 50 for the PC), because in these cases, the game wouldn't even try to move past the first existing stack.
ExamplesIn English versions, when buying Ultra Balls with Ultra Ball x99 in the last slot of the inventory, it is possible to corrupt $D35D (item 32 quantity; controlling the screen palette) if $D35C (item 32; current sound bank value) is 2 (Ultra Ball). In English versions, one can exploit the Yami Shop glitch to buy Master Balls. If $D364 (Block-X ID) is 1 and there are no Master Ball stacks which aren't ×99 before it, then one can add to $D365 (map exit warp) to access locations up to 0x63 (S.S. Anne Deck). It may be necessary to change the quantity in address $D358 to 99 first. In Japanese versions, when buying Great Balls with Great Ball x99 in the last slot of the inventory, it is possible to corrupt number of badges ($D2D5) if the options byte ($D2D4) is equal to 3 (Battle Animation On, Battle Style On, medium text speed).
The last example is not possible in the English version of Yellow because there the options byte ($D355) is an odd address, and the array of badges obtained ($D356) is an even address.