Arbitrary code execution
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
[hr] No further extensions
Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)
Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)
[hr] Buffer overflow techniques
99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)
[hr] Item stack duplication glitch (Generation I)
Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch
[hr] Bad clone glitch (Generation II)
????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))
[hr] Closed menu Select glitches (Japanese Red/Green)
Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch
[hr] Pomeg glitch (Generation III)
Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch
[hr] Voiding (Generation IV)
Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)
[hr] 2x2 block encounter glitches (Generation I)
Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch
[hr] Glitch City
Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)
[hr] Large storage box byte shift glitch
Storage box remaining HP glitch | Generation I max stat trick
[hr] Pikachu off-screen glitch
Trainer corruption glitch
[hr] SRAM glitches
Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches
[hr] Trainer escape glitch
Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation
[hr] Walk through walls
Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls
[hr] Surf down glitch
Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))
(view, talk, edit)
|PRAMA Initiative a également une page sur .|
For example, in Red, Blue and Yellow the normal maximum number of bag items is 20 and the maximum number of stored PC items is 50 and under normal circumstances, trying to obtain another item will bring up a message that there is no more space.
In actuality, the maximum amount of items that the player can use, swap or toss is 255 or whichever value a 'number of items' address, such as D31D (Red/Blue, D31C (Yellow) (number of items in the overworld item pack) becomes corrupted to.
Attributes of items beyond the item limitThe items and quantities beyond the imposed item limit represent unrelated memory addresses with values interpreted as items or quantities. The memory addresses follow on as expected.
See the following articles for more specific information:
Expanded bag item documentation (Generation I) Expanded PC item documentation (Generation I) Expanded bag item documentation (Generation II)
ExamplesFor expanded bag items in Red, Blue and Yellow, addresses D344 and D345 (-1 in Yellow) are used for item 20 and item 20's quantity respectively. Item 21 (RB: D346, Y:D345) is also used as FF (Cancel) as an item end of list address when the player has a properly terminated list of 20 items.
Item 21's quantity (RB: D347, Y:D346) marks the start of unrelated memory addresses; namely it is the first money byte (multiples of 10,000 in binary coded decimal) hence changing the value of item 21's quantity will affect the multiple of 10,000 in the player's money (e.g. changing the value to 153, hex:99 will give the player 99XXXX money)
Another example is how item 36 quantity (RB: D365, Y:D364) represents the exit location for many maps.
EquationThe following equation can be used to find what memory address an item represents or the other way around. That memory address +1 will represent a quantity.
Memory address = [First item position address -1] + [Cursor positon] + ([Cursor position -1])
Example for expanded bag items in Pokémon Red and Blue: D365 (exit destination) = D31D (number of items) + (x) + (x-1) D365-D31D=0x48 0x48/2=0x24 D31D + 0x24 + 0x23 = D364
From this we can gather that item 36 (0x24 in hexadecimal) represents D364 (which is the 'block-x' value that is either 00 ("j." or "x") or 01 (Master Ball)). This means that D365 (map exit) represents item 36's quantity.
Note that this equation does not apply for items 129 (0x81) through to 256 (0x00) because those items represent items 1-128 again.
Returning a bag of 255 items back to normal (Generation I)This is very simple : you need to buy three items to return your menu to normal.
Warning : the first item will be lost !
With arbitrary code execution, the following code should work :
Lemonade x(# of items in your inventory before the glitch)
hex:1C (Earth Badge) x201
Generation I activation
By underflowThere are two known ways of tricking the game into decrementing the item count when it is already 0, which causes the it to underflow to 255. Both methods require an item stack of something x255: Item underflow glitch (event method) Dry underflow glitch
Methods to obtain x255 stack1) Encounter a MissingNo. (e.g. with old man glitch, Trainer escape glitch, CoolTrainer♀ glitch) to add 128 to the sixth item quantity (if less than 127).
For Pokémon Yellow:
Unstable MissingNo. will not freeze the game if encountered for the first time after a wiped save file with Up+Select+B and if no other glitch Pokémon sprite was viewed. More reliably, the double Trainer escape glitch with Level 80 Starmie can be used (video) to encounter a Fossil/Ghost MissingNo., which will not freeze the game. Alternatively though more difficult, the player may perform the Ditto glitch sub-glitch of the Trainer escape glitch by having Ditto Transform into a Pokémon with 182, 183, 184 Special.
2) Either encounter MissingNo. again or catch it with the sixth item quantity as x127 to get the x255 stack. Note this will not work when catching the MissingNo. if the item used to catch it was the sixth and a Poké Ball x127, therefore items like X Special are more desirable (also in this case, because X Special can be used for Celadon looping map glitch)
By save corruptionThis method has many downsides (similar to the Japanese Dokokashira door glitch) but can be triggered very early in the game and is sometimes used to beat the game in 0:00
The first requirement is that the player must never have created a Save file.
If one was created, go to the title screen, do not enter the Continue/New Game/Options menu. Hold the down arrow and Select in the same time, and press the B button.
WARNING ! This will completely destroy and overwrite your current save file !
Select "Yes" and skip the title screen.
The Continue option shouldn't be present. Hit New Game, and pick names. Then open the start menu, hit Save and get prepared (if on an emulator, a save state is recommended to save much time). You need to hit Yes and reset your game between the time the Yes/No box disappears and the instant the Saving... text appears.
At this point, there are three possibilities when booting the game again : A text box pops saying "The save file is destroyed !". You reset too early, try again. A Continue button is present, but your Pokemon menu isn't accessible. You reset too late, erase the save file and try again. A Continue button appears on the homescreen, and you can access a glitchy Pokémon menu. Swap any of the first 6 Pokémon (first or second is recommended) with the tenth (it should be just offscreen). Now you can access 255 items in your pack !
By the ZZAZZ glitchUsing the ZZAZZ glitch, it is possible to make all FF bytes up to the terminator in the player's bag disappear and then perform the party Pokémon box data shift glitch.
The party Pokémon box data shift glitch will shift all bytes in the player's inventory up to the FF upwards, therefore, having an item such as a TM01 (hex:BF) in the first position of the bag would allow for hex:BF (dec:191 items).
This glitch may stop working later in the game due to FF values appearing in the memory before the bag addresses.
By arbitrary code executionIf you can use arbitrary code execution (ACE), you may run the following code for the English games (both with 8F for Pokémon Red and Blue and ws m for REDIRECT Template:Yellow).
TM34 x29 (x28 in Yellow)
This basically changes the item counter to hex:FF.
Using GamesharkThe Gameshark code 01FF1CD3 (Yellow) or 01FF1DD3 (Red/Blue) will give the player 255 items.
By Glitch City RAM ManipulationBy having 50 slots filled in the PC, GCRM can turn this number to 109 ; it is then possible to retrieve a stack of 255 items, and perform either method of item underflow (see above).
This method has the enormous advantage that it doesn't require Missingno, which is good for EU Pokémon Red and Blue and US REDIRECT Template:Yellow players.
However, since the PC has 109 items accessible, storing items is likely to corrupt game data instead of returning the PC to normal. The best solution is Arbitrary code execution, although retrieving 59 items from the PC will also work (but it's difficult).
Generation II activation
|This article is incomplete. Please feel free to add any missing information about the subject. It is missing: Index number.|
One can access an expanded Poké Balls pocket through duplicate key items glitch abuse.
NotesIn Red, Blue and Yellow, when scrolling down the list, the cursor may seem to freeze ; in that case hit B until the cursor responds again. (If A is used, and is pressed while a long-name item is selected the game will crash and save data may be partially overwritten.) This happens when the game prints a large name which spans multiple lines. In Pokémon Crystal, the glitch description of item hex:00 will usually freeze the game. This can be avoided if the player presses Select on another item to bring up the text "Where should this be moved to?" before scrolling down. The expanded item pack is useful for Pokémon 'glitched' speedruns as it allows the manipulation of many addresses such as map destinations, text pointers (for text pointer manipulation) and so on.
Here is a list of interesting items to mess with :