Arbitrary code execution in the Pokémon series
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
List of arbitrary code execution programs
(view, talk, edit)
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
List of arbitrary code execution programs
(view, talk, edit)
Glitch items are invalid items in the Pokémon games. Unavailable items such as Pokémon FireRed and LeafGreen key items in Pokémon Emerald may also be considered to be glitch items, as well as unused/unavailable items such as ????? (hex:07) and BoulderBadge (hex:15) — see unused items.
Glitch items may have special uses (in Generations I and II), different names (in Generation I and to an extent Generation II) and Poké Mart buy and sell price data.
Some glitch items such as "9F" (hex:5E) in Pokémon Red and Blue or REDIRECT Template:Yellow, or "RIVAL'S" (hex: A2) in Red and Blue, or "o" (hex:94) in Yellow always have the same use(s).
Other glitch items execute data in writable memory, with a select few glitch items such as such as "8F" in Pokémon Red and Blue (hex:5D) and "ws m" in REDIRECT Template:Yellow (hex:63) being ideal for arbitrary code execution.
In Pokémon Red, Green, Blue, and Yellow
Glitch items occupy index numbers hex:00, hex:54 through to hex:C3 and hex:FB through to hex:FF.Types of glitch items:
Unterminated name glitch items: These are items without a 0x50 byte in the first 20 characters of their name. They can be used for various buffer overflow techniques with specific tiles on the screen. When the A-Button is pressed on them without a 0x50 sub-tile present on the screen, it is most likely the game will freeze.
Lag name glitch items: These cause the items list to temporary freeze until the player taps A or B a specific number of times while scrolling up/down. It is advised to tap B instead of A due to the risk of a game freeze from an unterminated name glitch item, which could freeze the game, and potentially destroy the save data, especially on Nintendo 3DS Virtual Console versions.
Rival's effect glitch items: These glitch items are capable of causing the Rival's effect; an effect that opens a menu and allows the player to walk through impassable tiles once it is closed with B.
Partial escape glitch items: These allow for the player to partially escape from a wild battle, or restart a Trainer battle.
Screen data saving glitch items: These allow for the player to create a copy of the screen while the items menu is open, which is useful for Rival LOL glitch or a similar glitch.
String printing glitch items: These may include a variable string in the item's name
Map distortion glitch items: Documented by TheZZAZZGlitch, these glitch items have the capability of corrupting the map when their name is shown, in an area with a lot of grass. A player name that is four characters long or more is also required.
Arbitrary code execution glitch items: These glitch items do not have hard coded effects; instead the effects are sourced from a pointer in rewritable memory, such as RAM. Depending on the source pointer, it is possible to manipulate the item to do almost anything in game. 8F (0x5D) and ws m (0x63) are infamous examples in the English versions.
RAM name glitch items: These are glitch items with randomized names. They are not known to exist in the English versions, but an example is ItemDexJP/B:000 from Pokémon Blue (Japanese).
How to obtain glitch items:
All glitch items:
Dry underflow glitch or original item underflow glitch>Celadon looping map glitch Glitch City RAM manipulation (Cut abuse): For expanded PC items Other expanded items pack glitches; namely, Super Glitch, 255 Pokémon glitch, ZZAZZ glitch and more
Some glitch items:
Get glitch items using left-facing shore tile glitch (Red/Blue) Get glitch items using Trainer escape glitch (Yellow) Glitch City RAM manipulation (buffer overflow techniques): For move 0x00 corruption
Many glitch items are available with the Celadon looping map trick, Item creation glitch (a Select glitch in Red/Green/Blue), Yami Shop glitch and other Poké Mart vendor glitches.
Examples of particularly useful glitch items include:
{|
|
In Pokémon Gold, Silver and Crystal
Glitch items in Pokémon Gold, Silver and Crystal occupy a number of index numbers, as such:{|
|
Note that Teru-Sama items which are not Teru-Sama in Crystal are the key items "Clear Bell" (hex:46), "GS Ball" (hex:73), "Blue Card" (hex:74) and "Egg Ticket" (hex:81) respectively.
TMs and HMs outside of the correct pocket
Main article: Wrong pocket TMs and HMsIn addition to the regular glitch items in Gold, Silver, Crystal, all of the normal TMs and HMs will serve as glitch items when used outside of the TM/HM pack, due to having invalid execution pointers.
Below are a number of useful TMs and HMs to use outside of the relevant pocket.
(Sources: http://forums.glitchcity.info/index.php?topic=7150.0, http://wiki.pokemonspeedruns.com/index.php?title=User:Entrpntr/Gold_251#Miscellaneous_TM47_vids, http://forums.glitchcity.info/index.php?topic=6979.0)
{|
|