Glitch City Laboratories Archives

Major glitches of the Pokémon series

Arbitrary code execution

No further extensions

Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)

[hr]

Buffer overflow techniques

Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch

[hr]

Bad clone glitch (Generation II)

Closed menu Select glitches (Japanese Red/Green)

Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch

[hr]

Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)

[hr]

2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch

[hr]

Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)

[hr]

Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick

[hr]

Pikachu off-screen glitch

Trainer corruption glitch

[hr]

SRAM glitches

Trainer escape glitch

Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls

[hr]

Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))

(view, talk, edit)

This article is outdated
	Feel free to update it. Reason given: Add the mechanics Háčky researched

'''This article is a summary page for different variations of a glitches, etc. when talked about as a whole.

This article is incomplete. Please feel free to add any missing information about the subject. It is missing: Index number.

The Coin Case glitches are glitches that are exclusive to the English versions of Pokémon Gold and Silver. These glitches do not exist in any other localization of the game, such as the Japanese version, and it do not exist in Pokémon Crystal.

Coin Case glitches were previously thought to be relatively useless, with things like Glitch Dimensions, 'glitchy coin counts' and freezes, being the only effects found, however, after Sanky and TheZZAZZGlitch researched the glitch, it was found that is possible to execute execute arbitrary code with it to do many things which began with exploits such as causing a custom message to be displayed by the Coin Case, warping to Mt. Silver and enabling Red, and obtaining Celebi or a ????? (FF).

Arbitrary code execution exploits summary

There are two commonly used variations of Coin Case arbitrary code execution. These include both arbitrary code execution through using box names and through using stored PC items.

Having a 'fresh' low level Pokémon (also known as a "slide Pokémon") in slot 3 and a special Quagsire in slot 4, making a specific movement pattern (such as four steps right from walking out of Cherrygrove Poké Mart or Professor Elm's lab), listening to Bellsprout or Machop's cry, switching item pockets (necessary) and using the Coin Case will lead to arbitrary code execution.

In order to execute box names as code (beginning from the second character of the first box name) the Quagsire should be holding a TM02 with Return as its first move.

If the player wants to start the execution at the first character of the first box name the Quagsire should be holding a TM01 instead, however TM02 can be obtained multiple times while TM01 cannot and this will likely not be compatible with codes that expect the TM02 setup.

In order to execute stored PC items as code the Quagsire should instead be holding a HP Up and know Sleep Talk as the first move (if the code starts at stored item 2's quantity), or be holding a Protein with Sleep Talk as the first move (if the code starts at stored item 3's item).

Troubleshooting

Emulation problems

Coin Case arbitrary code execution sadly will only work on English (both NA, EU, likely AUS) versions of Pokémon Gold and Silver. It will not work in the French, German, Spanish, Italian versions nor the Japanese and Korean versions.

If Coin Case arbitrary code execution is being performed on an emulator, it should first be performed on one that supports Echo RAM, as the Coin Case will always execute code in this region, and if there is incorrect emulation any Coin Case arbitrary code execution glitches will not work. An example of an emulator that doesn't support Echo RAM emulation is an older version of VisualBoyAdvance (however some newer versions support it), while an example of an emulator that correctly supports Echo RAM emulation is the latest version of BGB emulator.

Furthermore Coin Case arbitrary code execution may not work on Pokémon Stadium 2's GB Tower again due to incorrect Echo RAM emulation.

A few glitches that rely on obscure hardware details, such as YouTube user Crystal_'s real time walk through walls glitch OAM DMA exploit may also fail to work on certain platforms/emulators (possibly even including the 3DS Virtual Console Pokémon Gold and Silver).

Slide Pokémon

One of the most common problems with Coin Case arbitrary code execution is from having a bad slide Pokémon in slot 3. A "slide Pokémon" is a Pokémon that hasn't been trained, has good DVs, is at a good level (preferably low, caught from Route 29), has good stats and a non-problematic happiness value.

Unfortunately getting a good slide Pokémon is luck dependent, and it could take many attempts (even over 20 Pokémon) for you to get one.

The reason why bad attributes on the slide Pokémon is problematic is because these attributes are executed as code, until the game gets to Pokémon 4 where it reads the Quagsire's held item and first move as a jump location (because Quagsire's index number C3 represents the instruction jp yyxx) to a place like box names or stored PC items (depending on the item and move). This means bad opcodes such as FF (rst $38) could cause the game to not 'fall through' to the Quagsire's data, causing the game to never be able to execute the box names or stored PC items as code.

If a slide Pokémon was working in the past and suddenly stopped working the problem could be caused if the Pokémon gained experience (increasing its stat experience) or gained a bad happiness value. For this reason one should not walk too many steps with the slide Pokémon, and it is a good idea to faint the slide Pokémon if it previously worked but you can't get it to work anymore and didn't make it gain any experience.

Wrong box names/stored PC items

It is very important for the box names (if using a box name method) to be exactly right. If they are wrong (even if it is a small mistake such as using a character without an apostrophe before it or the wrong "x" character) the glitch will most likely not work. For this reason be extra careful when entering the box names.

It is also important to have stored PC items that are exactly right and are in the exact order if using a stored PC item method.

Sometimes as well a box name or stored PC item code will expect that the code begins at a specific location (such as character 2 of the first box name if using TM02 and Return). If the code is meant to be for another setup (like character 1 of the first box name if using TM01 and Return) then the code may not work.

Not switching pockets

Before using the Coin Case it is very important to switch item pockets at least once, or the glitch may not work.

Cries and movement pattern

If the player listened to a Pokémon cry other than Bellsprout, Machop (and a select few other compatible Pokémon) the glitch won't end up executing code in the desired location.

The player must also make the exact number of steps for the movement method (most commonly four steps right after walking outside of Professor Elm's lab or Cherrygrove City's Poké Mart) as making the wrong movement pattern will cause the arbitrary code execution glitch not to work.

Pressing A after viewing the Coin Case

For some box name codes, pressing A instead of B after viewing the number of coins in the Coin Case may cause the game to reset or freeze. For this reason one should always press B.

Immediately using the Coin Case again for the box name method can also cause the game to freeze, so one should never use the code again until they save and reset the game.

These codes may also slow down menus to the extreme and disable sprites. This is a workaround to the Coin Case glitch corrupting the stack pointer and can be fixed by tapping down to get to the save option, tapping A to save the game and resetting the game. Changing "Menu Account" to off in the settings beforehand will also disable the lag caused by the glitch.

Cause

In the Japanese versions of Pokémon Gold and Silver, after the hiragana 'まい' in the dialog "あなたのコイン (n)まい" (your number of coins) appears, a hex:57 control character is used (at offset 0xF9FE, in both versions, and in both revisions v1.0 and v1.1), and it is valid as a terminator in these versions.

The hex:57 character is still used as a terminator for "Coins: (x)" in the English versions (at offset 01985B0), but it is no longer a valid terminator there. The game jumps into memory at echo RAM address E112, which is essentially C112 and executes arbitrary code from there. This section of the memory can be changed by listening to cries, but if the player didn't listen to any cry, it is mainly 00, so 'nothing happens'.

When the player listens to a certain Pokémon cry before using the Coin Case, the game will execute code that has a noticeable effect, including glitch dimensions, altered number of coins text and freezes, due to the data no longer being mainly 00.

Machop, Bellsprout and other Pokémon's cries are special because they put a hex:33 at ECHO:E117. This is read as the opcode 'inc sp' (increment stack pointer) causing the next 'ret' (return) to go elsewhere, specially to EB12, which contains overworld data. Even though there is no known way to predict the contents of this data, the results are consistent if you move in a specific pattern.

By having useful overworld data here, which can be manipulated by moving around, it is possible for the game to jump to an address that can reasonably be manipulated.

If the 'out of New Bark Town lab' four steps right method is used, the game will jump to ECHO:FA98 (essentially DA98), which is the second byte of the third Pokémon's Attack stat experience.

If the 'out of Cherrygrove City mart' four steps right method is used, the game will jump to ECHO:FA99 (essentially DA99), which is the first byte of the third Pokémon's Defense stat experience.

This glitch was patched in language versions later than the English version and never occurred in the original Japanese versions; Kin/Gin. Foreign versions other than the Japanese versions use the valid hex:50 terminator instead of a hex:57 'terminator' in at least the French, German, Italian and Spanish versions. While Pocket Monsters Kin/Gin use a hex:57 character, it is a valid terminator here.

It does not exist in English Pokémon Crystal, which also uses the correct 50 terminator (at offset 1C5C88).

(Thanks to Sanky from the forums for the explanation, Wack0 for pointing out the changes to 50 in foreign non-Japanese versions and Torchickens for noticing there is a 57 as a terminator in the Japanese version)

Get Celebi with Coin Case arbitrary code execution

REDIRECT Template:YouTube

This trick allows you to change the recipient byte of a Pokémon in Day-Care south of Goldenrod City to hex:FB, the same as Celebi. It was made by TheZZAZZGlitch.

Since withdrawing a Pokémon from Day-Care makes the game match the donor byte to the value in the recipient byte, it will be a perfectly stable Celebi when it is withdrawn.

Requirements

This glitch requires specific items in the player's item storage system (see below), and they need to be in the exact order they appear in the table, from top to bottom. For this trick, when it is done correctly, the last jump the game makes will be to the address which governs the item storage system's quantity of the second item (D61A).

Item	Quantity
[ANY ITEM]	[ANY QUANTITY]
[ANY ITEM]	x38
TM27	x2
Fresh Water	x42
Lovely Mail	x1
HM07	x1
Poke Ball	x65
Great Ball	x4
Everstone	x1
[ANY ITEM]	[ANY QUANTITY]
Surf Mail	x51
Full Heal	x18
Flower Mail	x46
HM03	x1
X Speed	x1
TM06	x1
[ANY ITEM]	[ANY QUANTITY]
TM41	x1

When the items above exist in the PC, the player will also need in the party:

A freshly caught low level Pokémon.

A Quagsire holding a HP UP, with Sleep Talk as the first move.

Any Pokémon (this will become Celebi).

The player also needs:

The Coin Case

A Pokémon including Bellsprout, Machop, Machoke or Omanyte registered in the Pokédex.

Access to the Pokémon Day-Care on Route 34 and New Bark Town via Fly.

Steps

First confirm that you meet the requirements above.

Put the low level Pokémon in your third slot. Put your Quagsire in your 4th slot. Put the chosen Pokémon (which will become Celebi) in your first slot.

Fly to New Bark Town and enter Prof. Elm's lab. Save and reset.

Step out of Prof. Elm's lab, take four steps right (so you are below the tree), then open the Pokédex and listen to either Bellsprout, Machop, Machoke or Omanyte's cry.

Exit the Pokédex, and open the items pack and switch over to the Key Items pocket. Switching pockets before viewing the Coin Case after listening to the cry in the current session is important, otherwise the trick won't work properly.

Use the Coin Case. If you followed the steps properly the game won't cause a glitch dimension or freeze.

Fly over to Goldenrod City and walk south to the Pokémon Day-Care Center. Enter it.

Deposit the chosen Pokémon (do not deposit another Pokémon) with the Day-Care man or lady and get it back to get Celebi. Its name will not be changed (e.g. it may be still called 'Rattata'), so you will have to rename it at the Name Rater in Goldenrod City north of the Magnet Train station. It will also have its old moves, but you can remove illegal moves at the Move Deleter in Blackthorn City at the house west of the Poké Mart.

Get ????? (FF) with arbitrary code execution

To get ????? (FF), you can do the exact same Celebi trick described above, but with two extra stacks of Great Ball x4 below the first one (item 8). This is because Great Ball x4 corresponds to two of the opcodes 'inc b' (as one address is for the item identifier, and another is for the quantity), and the opcode 'inc b' increases the register 'b' by one. Normally the result here is FB; Celebi's index number, but having two extra Great Ball x4 adds four inc b, and FB + 4 = FF, which is ????? (FF)'s index number.

"Hello world" program

REDIRECT Template:YouTube

This trick was made by TheZZAZZGlitch and lets the player change the 'number of coins' to a Pokémon's nickname.

Requirements

Like the Celebi trick described above, this trick requires certain items in the PC, and the order matters. They are listed below.

Item	Quantity
[ANY ITEM]	[ANY QUANTITY]
[ANY ITEM]	x38
TM27	x2
Nugget	x1
[ANY ITEM]	[ANY QUANTITY]
Surf Mail	x46
Charcoal	x1
[ANY ITEM]	[ANY QUANTITY]
Squirtbottle	x1
[ANY ITEM]	[ANY QUANTITY]
Leaf Stone	x1
[ANY ITEM]	[ANY QUANTITY]
Ice Heal	x62
Revive	x7
Lovely Mail	x60
Ultra Ball	x34
Flower Mail	x51
Max Repel	x43
TM37	x1
[ANY ITEM]	[ANY QUANTITY]
Full Heal	x18
Portraitmail	x46
HM03	x1
[ANY ITEM]	[ANY QUANTITY]
TM41	x1

Like the species changing trick described above, a freshly caught low level Pokémon is needed, as well as a Quagsire holding a HP UP with Sleep Talk as its first move. Other requirements include the stored items above, the Coin Case, access to the Name Rater in Goldenrod City and the ability to use Fly to Goldenrod City and New Bark Town.

Steps

Put the low level Pokémon in the third slot.

Put the Quagsire in the fourth slot.

Go to the Name Rater north of the Magnet Train station and change the first Pokémon's nickname to something that is 10 characters ('AAAAAAAAAA' is used in the video).

Afterwards, change the nickname of the first Pokémon to something nine characters long, which will be what you want the Coin Case to display.

Fly to New Bark Town and enter Prof. Elm's laboratory, save the game and reset.

Exit the lab, take four steps right (so you're below the tree), then open the Pokédex and listen to Machoke's cry (other cries like Bellsprout may work, but they are unconfirmed).

Switch to the Key Items pocket (it is important that you do the switch after listening to the cry and before using the Coin Case), then use the Coin Case.

The first Pokémon's nickname will be displayed under 'Coins:' instead of the current amount of coins.

Known 'random' but consistent effects

This section lists effects that happen randomly, but may happen consistently after a player listens to a Pokémon's cry.

A Pokémon listed under any of these effect headers does not mean it will always cause the effect, but simply that it may without further manipulation.

The effects here happen for:

Saving the game and resetting next to the Machop in Vermilion City, and not moving before or after listening to the Pokémon's cry. But they commonly happen in other circumstances.

Glitch Dimension

Main article: Coin Case glitch

This was one of the first known applications of the glitch, and the described requirements were talking to the Machop flattening out the land in Vermillion City and then using the Coin Case.

However, the player does not need to talk to that particular Machop; the cry of any Machop may cause the same effect (not when following one of the arbitrary code execution steps described in earlier sections).

The cries of the following Pokémon in the Pokédex can be used to start a Glitch Dimension.

Bulbasaur^{[citation needed]}

Caterpie^{[citation needed]}

Metapod^{[citation needed]}

Weedle^{[citation needed]}

Kakuna^{[citation needed]}

Beedrill^{[citation needed]}

Pidgey^{[citation needed]}

Arbok^{[citation needed]}

Pikachu^{[citation needed]}

Raichu^{[citation needed]}

Nidoran♀^{[citation needed]}

Nidorina (without switching item pockets)

Nidorino^{[citation needed]}

Clefairy (may require not having switched items pockets)

Clefable (may require not having switched items pockets)

Vulpix^{[citation needed]}

Ninetales^{[citation needed]}

Jigglypuff^{[citation needed]}

Wigglytuff^{[citation needed]}

Zubat^{[citation needed]}

Oddish^{[citation needed]}

Paras^{[citation needed]}

Diglett^{[citation needed]}

Dugtrio^{[citation needed]}

Psyduck^{[citation needed]}

Mankey^{[citation needed]}

Poliwhirl^{[citation needed]}

Abra^{[citation needed]}

Machop

Machoke

Machamp^{[citation needed]}

Bellsprout (works like Machop)

Tentacool^{[citation needed]}

Geodude^{[citation needed]}

Magnemite^{[citation needed]}

Farfetch'd (after switching item pockets)

Doduo^{[citation needed]}

Seel^{[citation needed]}

Drowzee^{[citation needed]}

Krabby^{[citation needed]}

Voltorb^{[citation needed]}

Hitmonlee^{[citation needed]}

Horsea

Meganium (without switching item pockets)

Cyndaquil^{[citation needed]}

Totodile^{[citation needed]}

Croconaw^{[citation needed]}

Natu^{[citation needed]}

Xatu^{[citation needed]}

Mareep^{[citation needed]}

Flaaffy^{[citation needed]}

Miltank^{[citation needed]}

Celebi

"Which move?he PP of." (Dratini glitch)

This effect is also known as the "Dratini glitch". It will cause the text "Coins:Which move?PP of." to pop up after viewing a certain cry and using the Coin Case. This text is long enough to go outside of the text box border.

The following cries have been confirmed to work:

Charmander

Charmeleon

Squirtle

Wartortle

Butterfree

Ekans

Sandshrew

Gloom

Dratini

Articuno

Moltres

Larvitar

"Which move?"

This effect will cause the text 'Coins:Which move?PP of.' to pop up after viewing a certain cry, not switching item pockets, and using the Coin Case.

The cries of the following Pokémon have been confirmed to work.

Venusaur

Dragonair

Ho-oh

Lugia

Tyranitar

Pupitar

Other effects

Other Coin Case glitch effects include game freezes and 'random' tiles being placed on the screen. The effects may depend on whether the player switched item pockets before viewing the Coin Case.

Here is a list of Pokémon that can cause effects other than a Glitch Dimension or the effects 'which move?he PP of.' or 'Which move?':

Clefairy^{[citation needed]}

Clefable^{[citation needed]}

Paras (switching pockets before viewing the Coin Case may cause a different effect, including a tile being placed on the screen)

Dodrio (may require not switching item pockets)

Nidorina (after switching item pockets it may place a tile on the screen)

Farfetch'd (without switching item pockets, it may freeze the game)

Meganium (after switching item pockets the game may print a glitch character after the number of coins)

External Links

Youtube: a Machop cry induced glitch dimension.

Youtube: Pokémon Gold/Silver: Arbitrary code execution with Coin Case (hello world program).

Youtube: Pokemon Gold/Silver: Yet another Celebi glitch, using Coin Case arbitrary code execution.

Glitch City Laboratories Archives

Coin Case glitches

Arbitrary code execution exploits summary

Troubleshooting

Emulation problems

Slide Pokémon

Wrong box names/stored PC items

Not switching pockets

Cries and movement pattern

Pressing A after viewing the Coin Case

Cause

Get Celebi with Coin Case arbitrary code execution

Requirements

Steps

Get ????? (FF) with arbitrary code execution

"Hello world" program

Requirements

Steps

Known 'random' but consistent effects

Glitch Dimension

"Which move?he PP of." (Dratini glitch)

"Which move?"

Other effects

See also

External Links

Categories