Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of an article from Glitch City Laboratories wiki.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of the wiki in .tar.gz or .xml.gz formats.

Glitch item

Arbitrary code execution in the Pokémon series



0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC

List of arbitrary code execution programs

(view, talk, edit)


Glitch items are invalid items in the Pokémon games. Unavailable items such as Pokémon FireRed and LeafGreen key items in Pokémon Emerald may also be considered to be glitch items, as well as unused/unavailable items such as ????? (hex:07) and BoulderBadge (hex:15) — see unused items.

Glitch items may have special uses (in Generations I and II), different names (in Generation I and to an extent Generation II) and Poké Mart buy and sell price data.

Some glitch items such as "9F" (hex:5E) in Pokémon Red and Blue or
  • REDIRECT Template:Yellow, or "RIVAL'S" (hex: A2) in Red and Blue, or "o" (hex:94) in Yellow always have the same use(s).

    Other glitch items execute data in writable memory, with a select few glitch items such as such as "8F" in Pokémon Red and Blue (hex:5D) and "ws m" in
  • REDIRECT Template:Yellow (hex:63) being ideal for arbitrary code execution.

    In Pokémon Red, Green, Blue, and Yellow

    Glitch items occupy index numbers hex:00, hex:54 through to hex:C3 and hex:FB through to hex:FF.

    Types of glitch items:

  • Unterminated name glitch items: These are items without a 0x50 byte in the first 20 characters of their name. They can be used for various buffer overflow techniques with specific tiles on the screen. When the A-Button is pressed on them without a 0x50 sub-tile present on the screen, it is most likely the game will freeze.

  • Lag name glitch items: These cause the items list to temporary freeze until the player taps A or B a specific number of times while scrolling up/down. It is advised to tap B instead of A due to the risk of a game freeze from an unterminated name glitch item, which could freeze the game, and potentially destroy the save data, especially on Nintendo 3DS Virtual Console versions.

  • Rival's effect glitch items: These glitch items are capable of causing the Rival's effect; an effect that opens a menu and allows the player to walk through impassable tiles once it is closed with B.

  • Partial escape glitch items: These allow for the player to partially escape from a wild battle, or restart a Trainer battle.

  • Screen data saving glitch items: These allow for the player to create a copy of the screen while the items menu is open, which is useful for Rival LOL glitch or a similar glitch.

  • String printing glitch items: These may include a variable string in the item's name

  • Map distortion glitch items: Documented by TheZZAZZGlitch, these glitch items have the capability of corrupting the map when their name is shown, in an area with a lot of grass. A player name that is four characters long or more is also required.

  • Arbitrary code execution glitch items: These glitch items do not have hard coded effects; instead the effects are sourced from a pointer in rewritable memory, such as RAM. Depending on the source pointer, it is possible to manipulate the item to do almost anything in game. 8F (0x5D) and ws m (0x63) are infamous examples in the English versions.

  • RAM name glitch items: These are glitch items with randomized names. They are not known to exist in the English versions, but an example is ItemDexJP/B:000 from Pokémon Blue (Japanese).

    How to obtain glitch items:

    All glitch items:

  • Dry underflow glitch or original item underflow glitch>Celadon looping map glitch
  • Glitch City RAM manipulation (Cut abuse): For expanded PC items
  • Other expanded items pack glitches; namely, Super Glitch, 255 Pokémon glitch, ZZAZZ glitch and more

    Some glitch items:

  • Get glitch items using left-facing shore tile glitch (Red/Blue)
  • Get glitch items using Trainer escape glitch (Yellow)
  • Glitch City RAM manipulation (buffer overflow techniques): For move 0x00 corruption

    Many glitch items are available with the Celadon looping map trick, Item creation glitch (a Select glitch in Red/Green/Blue), Yami Shop glitch and other Poké Mart vendor glitches.

    Examples of particularly useful glitch items include:

    {|
    NameIndex number (hexadecimal)Index number (decimal)GameUses
    j.000Pokémon Red and BlueOne of the most common glitch items, which can be sold for a high price of 414925 Pokédollars.
    #×##000Pokémon YellowOne of the most common glitch items, which can be sold for a high price of 414925 Pokédollars.
    CascadeBadge1622Pokémon Red, Blue, YellowThrow a rock and double a wild Pokémon's catch rate.
    4F5989Pokémon Red, Blue, YellowArbitrary code execution (initially runs FA65 in the Echo RAM region, equivalent to DA65 in Day Care data)
    5かい5A90Pokémon Red, Green, Blue (Japanese)Arbitrary code execution (initially runs D123; Pokémon data)
    8F5D93Pokémon Red and BlueArbitrary code execution (initially runs D163; Pokémon data)
    9F5E94Pokémon YellowReload a map and bring graphics back to normal after a Super Glitch induced Glitch City.
    9F5E94Pokémon Red and BlueRestart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch). Overflowing the stack.
    かいがらバッヂ (Shell Badge)6399Pokémon Yellow (Japanese)Arbitrary code execution (initially runs D9B2; stored Pokémon data).
    ws m6399Pokémon YellowArbitrary code execution (initially runs DA7F; stored Pokémon data).
    はやぶさバッヂ (FalconBadge)65101Pokémon Yellow (Japanese, v1.1+)Causes arbitrary code execution at 0xD4CA (ninth PC item).
    なかよしバッヂ (FriendBadge)67103Pokémon Red, Green, and Pokémon Blue (Japanese)Arbitrary code execution (initially runs D983, number of Safari Balls and the Day Care data, stored Pokémon data which follows. A special Day Care Pokémon name can be used to redirect the code directly to a location of the player's choice, otherwise if there is no Safari Ball/Day Care data, stored Pokémon data can be used like English Yellow's ws m and English Red/Blue's -g m.
    ゴールドバッヂ (GoldBadge)6A106Pokémon Red and Green (Japanese, v1.0)May act as a Poké Mart with 240 items. Can be used to buy Rare Candies (with specific data in RAM) and Master Balls.
    ゴールドバッヂ (GoldBadge)6A106Pokémon Yellow (Japanese, v1.1+)Acts as a Pokémon Center nurse.
    -g m6A106Pokémon YellowRestart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch)
    -g m6A106Pokémon Red and BlueArbitrary code execution (initially runs DA47; in which Safari Zone data and Day Care data follows. If this is blank; code will 'fall through' to DA80; stored Pokémon data).
    Lg-6E110Pokémon YellowRestart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch). Make walking Pikachu stay (useful for Pikachu off-screen glitch).
    ?????0707Pokémon Red, Blue, YellowActs outside of battle like using the field move Surf. Can also be used to change to the wrong music bank inside of a battle if used in a battle facing water.
    (blank)78120Pokémon Red and BlueRestart the music. Change to an overworld (02, 1F) sound bank from the sound bank (08). Play the music with ID at D35B with bank at D35C (D35B, D35C can be manipulated with expanded items pack).
    てへ7B123Pokémon Red and GreenArbitrary code execution (initially runs D806; wild Pokémon data or temporary player name storage for the old man battle) and an unterminated name glitch item.
    がつ円れにギぅ ぶ ぐどべぇ べあ゙ザ (etc.)7B123Pokémon Blue (Japanese)Unterminated name glitch item. Arbitrary code execution (initially runs D806; wild Pokémon data or temporary player name storage for the old man battle).
    ♀へん7C124Pokémon Yellow (Japanese, v1.0)Steal other Trainer's Pokémon.
    8 87C124Pokémon Red and BlueCreate encounter chains from a Trainer escape glitch encounter by using it when the menu pops up in a specific map. Must be used indirectly via unterminated name glitch item, or in combination with a unterminated name glitch item, to avoid a freeze when CFC4 is odd.
    PC80128Pokémon Red and BlueUnterminated name lagless glitch item (useful for LOL glitch). Hex:00 item effect freeze.
    2pゥ92146Pokémon YellowUnterminated name lagless glitch item (useful for LOL glitch). Acts as an Ultra Ball.
    o94148Pokémon YellowActivate the Rival's effect. Otherwise if used on a Pokémon may act like a Lemonade.
    RIVAL'SA2164Pokémon Red and BlueActivate the Rival's effect. Otherwise if used on a Pokémon may acts like an item with no noticeable effect.


    In Pokémon Gold, Silver and Crystal

    Glitch items in Pokémon Gold, Silver and Crystal occupy a number of index numbers, as such:

    {|
    Hex IDDec IDItem
    000?
    06, 19, 2D, 32, 38, 46 (G/S only), 5A, 64, 73 (G/S only), 74 (G/S only), 78, 81 (G/S only), 87, 88, 89, 8D, 8E, 91, 93, 94, 95, 99, 9A, 9B, A2, AB, B0, B3, BE5, 19, 45, 32, 38, 46 (G/S only), 90, 100, 115 (G/S only), 116 (G/S only), 120 (G/S only), 129 (G/S only), 135, 136, 137, 141, 142, 145, 147, 148, 149, 153, 154, 155, 162, 171, 176, 179, 190Teru-Sama
    C3195TM04 (useless)
    DC220TM28 (useless)
    FA250HM08 (Generation II glitch item)
    FB251HM09 (Generation II glitch item)
    FC252HM10 (Generation II glitch item)
    FD253HM11 (Generation II glitch item)
    FE254HM12 (Generation II glitch item)
    FF255HM13/CANCEL/Berry


    Note that Teru-Sama items which are not Teru-Sama in Crystal are the key items "Clear Bell" (hex:46), "GS Ball" (hex:73), "Blue Card" (hex:74) and "Egg Ticket" (hex:81) respectively.

    TMs and HMs outside of the correct pocket

    Main article: Wrong pocket TMs and HMs

    In addition to the regular glitch items in Gold, Silver, Crystal, all of the normal TMs and HMs will serve as glitch items when used outside of the TM/HM pack, due to having invalid execution pointers.

    Below are a number of useful TMs and HMs to use outside of the relevant pocket.

    (Sources: http://forums.glitchcity.info/index.php?topic=7150.0, http://wiki.pokemonspeedruns.com/index.php?title=User:Entrpntr/Gold_251#Miscellaneous_TM47_vids, http://forums.glitchcity.info/index.php?topic=6979.0)

    {|
    Hex IDDec IDItemVersionUse
    CE206TM15Crystal (Japanese)Executes arbitrary code from FA10 (Echo RAM for DA10, which is somewhere in the expanded Balls pocket. If "(item) x195", "Star Piece x 252" (represents C3 84 FB - a jump to FB84, box 4 name character 2) are stored at DA0F, then this will serve as a bootstrap code to stored box Pokémon names.
    CE206TM15Crystal (English)Executes arbitrary code from FA10 (Echo RAM for DA10, which is somewhere in the expanded Balls pocket.
    D0208TM17Crystal (English)Executes arbitrary code from FA47 (Echo RAM for DA47, which is somewhere in the expanded Balls pocket.
    D0208TM17Gold/Silver (English)Executes arbitrary code from FA47 (Echo RAM for DA47, which is the caught data for party Pokémon 1. The player can make a jump to somewhere more useful (via C3 yy xx), using Pokémon 1 as a slide Pokémon if necessary.
    D4212TM21Crystal (English)Executes arbitrary code from FA69 (Echo RAM for DA69, which is somewhere in the expanded Balls pocket; like TM21.
    D8216TM25Crystal (English)Executes arbitrary code from FA69 (Echo RAM for DA69, which is somewhere in the expanded Balls pocket; like TM25.
    D8216TM25Gold/Silver (English)Executes arbitrary code from FA6A (Echo RAM for DA6A, and DA6A is the least significant Defense EV byte of the second Pokémon in the party. The Speed EVs word follows, and the player can make a jump to somewhere more useful (via C3 yy xx). This may be possible without trading, but getting the exact EVs would be tedious and it would be hard to keep track of them without a memory viewer. Through arbitrary code execution in Pokémon Red, Blue, and Yellow, the second Pokémon may be manipulated to have Defense and Speed EV values that the player desires.
    E1225TM33Crystal (English)Executes arbitrary code from F418 in Echo RAM (essentially D418); the third character of the fifth enemy Pokémon's nickname. Through arbitrary code execution in Pokémon Red, Blue, and Yellow, the player may rename this Pokémon to include a jump instruction (e.g. to C3 F2 D8 bytes which reads jp D8F2, i.e. jumps to the first item in the item storage system).
    EF239TM47Gold/Silver (English)Allows the player to offset their position on the map, as documented here.


    In Pokémon Ruby, Sapphire and Pokémon Emerald, Pokémon FireRed and LeafGreen

    There are many glitch items in these games named "????????" with no apparent use other than for arbitrary code execution setup. The hex:FFFF "????????" can be distinguished for having the 'return to menu' sprite as its sprite.

    In Pokémon Diamond, Pearl and Platinum, Pokémon HeartGold and SoulSilver

    These games feature a hex:0000 glitch item which is referred to as "None" when forced as a Poké Mart gift. There are also glitch items with index numbers between hex:0071 and hex:0086, and a large number of other glitch items which may be nameless.

    External links

  • Link to the ItemDex item database.

    See also

  • Glitch decoration

    Categories