Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of an article from Glitch City Laboratories wiki.

A live version of this article is available at the Glitch City Wiki here.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of the wiki in .tar.gz or .xml.gz formats.

Duplicate key items glitch

Major glitches of the Pokémon series


Arbitrary code execution

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC

[hr] No further extensions

Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)


[hr] Buffer overflow techniques

99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)

[hr] Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch

[hr] Bad clone glitch (Generation II)

????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))

[hr] Closed menu Select glitches (Japanese Red/Green)

Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch

[hr] Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch

[hr] Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)


[hr] 2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch

[hr] Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)

[hr] Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick

[hr] Pikachu off-screen glitch

Trainer corruption glitch

[hr] SRAM glitches

Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches

[hr] Trainer escape glitch

Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation

[hr] Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls

[hr] Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))



(view, talk, edit)




PRAMA Initiative a également une page sur .
This duplicate Key Items glitch is a glitch in Pokémon Gold, Silver and Crystal, in which the player swaps two identical key items (obtained via byte shifting from ????? party overloading) in the Key Items pocket to obtain items (such as infinite use Rare Candies) or allow the player to set up an expanded Balls pocket with more than the maximum amount of items.

The reason the player obtains arbitrary items in the Key Items seems to be related to the facts that both: item quantities in the Key Items do not exist, and the game tries to merge the two stacks into one stack with a combined quantity.

Using the expanded Balls pocket, the player is able to use TMs and HMs from the wrong pocket for their own glitchy effects and arbitrary code execution (e.g. via TM33 in English Crystal, TM15 in English Crystal and TM25 in English Gold and Silver).

These TMs run code from the enemy Trainer's fifth Pokémon's nickname character 3 (TM33) or somewhere in the expanded Balls pocket.

Furthermore, the player can also enable glitch Pokédex categories (such as glitch Pokédex mode 09 in English Crystal for arbitrary code execution in the expanded Balls pocket) as well.

Via arbitrary code execution

This trick requires being able to set up arbitrary code execution on Pokémon Red, Blue, and Yellow. You may use 8F or ws m in Generation I to change the catch rate of Pokémon to value(s) corresponding to key items. (see The Big HEX List to see which IDs correspond to which key items)

Via bad clone glitch and ????? party overloading

Using tricks from ????? party overloading, the player can manipulate a key item as a held item on a Pokémon. This can be done in practise by using move PkMn w/o mail to obtain a seventh Pokémon, placing a Pokémon in slot 1 with a specific move then performing 1-4 shifts (depending on the position of the move) to shift the move ID into an equivalent held item ID. (see The Big HEX List to see which IDs correspond to which moves and held items)

Infinite items examples

Example 1:

If we have the following items:

Lost Item

Lost Item

Card Key

Basement Key

Cancel

Then swapping the first Lost Item with the second Lost Item will make us lose the original second Lost Item and Card Key but the second Lost Item will turn into a Master Ball with quantity 133 (Basement Key's index number). The Master Ball can be used infinitely because it is in the wrong pocket.

If we have the following items:

Lost Item (index no. 130)

Lost Item (index no. 130)

Card Key (index no. 127)

Basement Key (index no. 133)

Cancel (index no. 255)

If we swap the first Lost Item with the second, we lose the original second Lost Item and the Card Key, but the second Lost Item will turn into a Master Ball with quantity 133 (Basement Key's index number). The reason why the second item turns into a Master Ball in this example is because the Card Key is index number 127 (7F) and the Lost Item is index number 130 (82). Adding these together gives 257, but since items are defined by one byte, this becomes 257 modulo 256 or 1, which is Master Ball's index number.

Therefore we get:

Lost Item (index no. 130)

Master Ball (index no. 257 == 1) x133

CANCEL (index no. 255)

Example 2:

If the sum of the first Key Item's index number and the item below the second Key Item is greater than 100, then the third item is not lost, but becomes a BLK Apricorn (index no. 99). The second item identifier becomes equal to that of the sum of the first Key Item index number and the original third item minus 99. Its quantity is derived from the new third item identifier.

For example, consider the following Key Items pack:

Lost Item (index no. 130)

Lost Item (index no. 130)

Master Ball (index no. 1) x7

Bicycle (index no. 7) Cancel

If we swap the first Key Item with the second this gives us:

Lost Item (index no. 130)

Rare Candy (index no. 32 [130+1-99] )

BLK Apricorn (index no. 99)

Bicycle (index no.7)

CANCEL (index no. 255)

Expanded items pack

If you want to set up the expanded Balls pocket, change the catch rate of two Pokémon to 128 and 67 each. When traded to a Generation II game they will be holding Machine Parts and Secretpotions.

  • On the game with two SecretPotions and two Machine Parts
  • Put both Machine Parts in the last two slots of the Key Items pocket
  • Swap both items, which will turn into a single slot
  • Remove the Cancel item
  • Put both SecretPotions in the last two slots of the Key Items pocket
  • Swap these, and all bytes up to the Cancel in the Balls pocket will be shifted upwards

    Expanded Balls pocket

    Using specific duplicate key items, it is possible to enable the expanded balls pocket, which can later be used for memory corruption by swapping items in the pocket or arbitrary code execution via TMs/HMs outside of the correct pocket or glitch Pokédex categories.

    First the key items pocket must be filled with 25 items including two Machine Parts and two Secretpotions:

    Then..

  • Put both Machine Parts in the last two slots of the Key Items pocket
  • Swap both items to create Iron x99 and Blk Apricorn x10
  • Put both SecretPotions in the last two slots of the Key Items pocket
  • Swap these, and all bytes up to the Cancel in the Balls pocket will be shifted upwards, with the ID of the first item becoming the number of Balls.

    Note that this is not the only way to access the expanded balls pocket. The Pokémon Speedruns wiki details a different method involving two Itemfinders.

    YouTube video

    [b]YouTube video by PLASMA GER[/b]

    Categories