Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of an article from Glitch City Laboratories wiki.

A live version of this article is available at the Glitch City Wiki here.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of the wiki in .tar.gz or .xml.gz formats.


See: Zero-based numbering on Wikipedia
A form of indexing, where what would be called "the first item" in normal English has an index value of 0, and "the second item" has an index value of 1, etc. It is sometimes considered more "natural" in computer science. An example in daily life is the European scheme of floor numbering, where the ground floor can be considered as the 0th floor.

A form of indexing, where what would be called "the first item" in normal English has an index value of 1, and "the second item" has an index value of 2, etc.

Assembly (language)
A (processor-specific) programming language most close to machine code, to the point that conversion from assembly to machine code, known as assembling, is for the most part fully reversible—although any labels (arbitrary name assigned to code/memory locations) and comments will be lost.
Compiled higher-level languages (i.e. all those further from machine code) are compiled to assembly language just before being assembled into an object file made of machine code, which will (by itself or after being combined with other machine code and/or other files) form the final program (such as a ROM).
See also: disassembly

See memory bank.

Binary-coded decimal (BCD)
A technique for writing a number in hexadecimal where, unlike in the regular conversion from decimal to hexadecimal (for example, dec[58] = hex[3A]), the decimal digits are written as-is in hexadecimal, two per byte (for example, dec[58] = hex[58]).
In Pokémon games, BCD is often used for quantities of money and casino coins; it is also fairly commonly used in clock chips, such as the ones used in generation II and III games with said feature.

See breakpoint.

Buffer overflow
To write more data into a buffer than its size allows. The data will end up being written into adjacent memory areas, causing memory corruption.

See memory corruption.

Count byte
A byte representing the number of items in a list. Usually notable when the list itself has a terminator, since the code may determine the end of the list by the terminator at some places, and by the count byte at other places. Desynchronizing the count byte and the actual number of items in the list (according to the terminator) can cause glitches.

See also: assembly, List of Pokémon disassembly projects
The inverse process of assembling, i.e. converting machine code to assembly language, possibly complemented by manual analysis to recreate the missing labels and comments.
The result is a relatively easier to understand (and potentially easier to edit) program; if said program was compiled from an higher-level programming language (such as C, as in the case for most games for the GBA and DS) it is possible, although often with more effort, to go one step further (decompiling) and produce a source file functionally equivalent to the original one.
The creation and study of disassemblies, whether as a full-blown project or targeted study of a segment of code, is often useful for providing insight about complex and/or obscure game mechanics—most notably, the generation I and II Pokémon games have enjoyed a new wave of "scientific" research and understanding of glitches and other mechanics in the 2010s.

Item count
The value of the count byte for the list of items in the bag or in the PC. Normally, it is just the number of items in the bag or in the PC.
In Generation I, it is the item count, instead of the terminator, that controls how many items the player can actually access. The item count can be relatively easily decreased below the number of actual items with the item stack duplication glitch, and its value is important for item underflow glitches.

Jump table
A table of addresses pointing to assembly code (typically entry points of functions). A relatively well-known example of a jump table is ItemUsePtrTable in Generation I. An invalid index into a jump table will usually cause glitches, possibly arbitrary code execution exploits.

Memory bank
In the GameBoy, a segment of the ROM or the SRAM, mapped to a consecutive segment of the 16-bit GameBoy address space. With the exception of ROM bank 0 (the "home bank"), the banks are "switchable", i.e. they share the same address space ($4000~$7FFF for switchable ROM banks, $A000~$BFFF for SRAM banks), and are "switched" into and out of the accessible memory space with special instructions (technically, an "impossible write" to the ROM). This is to solve the problem that the space needed for those areas in a large game can be much larger than the 64KB that the 16-bit address space allows.

Memory corruption
Modification of a memory location by a piece of code that is never supposed to modify it, which may cause important data be overwritten in a potentially hard-to-discern pattern. This is usually caused by buffer overflow, but may also result from other forms of pointer manipulation; the ZZAZZ effect is an example.
This phrase should not be used when different data intentionally share the same memory location (e.g. the player's name and the grass encounter table in the old man trick), or when the code writes to the intended memory location an invalid value due to a logic error (e.g. changing the item count to 255 with item underflow).

1. For a value to exceed the range of its data type. For example, the range for an unsigned byte is 0~255, so trying to calculate 100+200 would result in an overflow. If the condition is not checked, then the value would usually be "wrapped around" to an in-range value: The above example would give 300-256 = 44. Depending on the exact definition, may or may not include underflow.
2. See buffer overflow.

Party count
The value of the count byte for a party Pokémon list. Normally, it is just the number of Pokémon in the party.

Species byte 1
See: unstable hybrid Pokémon
In Generation I and II, the first of two bytes determining the species of a Pokémon. In parties and boxes, the species byte 1 for each Pokémon is stored in a consecutive list, with a 0xFF terminator. Also known as the "donor" byte.

Species byte 2
See: unstable hybrid Pokémon
In Generation I and II, the second of two bytes determining the species of a Pokémon. It is the first byte of a Pokémon's main data. Also known as the "recipient" byte.

1. A data structure with a "last in, first out" semantic, supporting push and pop as the primary operations.
2. Specifically, a hardware-implemented stack in the CPU. Notably, the instructions call and ret are implemented using this stack: call pushes the program counter to the stack as a "return address", and ret jumps to an address popped from the stack. The stack is also often used to save the value of registers that would be overwritten by some other computation, especially another function called.

Stack corruption
Memory corruption in the stack area. This kind of corruption is usually highly disruptive to the execution flow because it may easily change return addresses on the stack, causing ret instructions to jump to unintended addresses. As a result, it is likely to crash the game, but when controlled it can also be used for many exploits, including arbitrary code execution.

Stack pointer
A special-purpose register that points to the topmost entry of the stack. In the GB CPU, the stack pointer is named sp, and it is decreased by 2 (since the stack entries are 2-byte numbers) for each push, and increased by 2 for each pop.

A value that signifies the end of a list or a string. To avoid ambiguity, it must be an otherwise invalid value for that list or string. Common values for terminators are 0x00 or 0xFF. Notably, in Generation I and II, the control character 0x50 usually acts as the terminator, although there are other control characters that also terminate the string (in addition to their other functions).

For a value to be lower than the minimum representable value in its data type. For example, the range for an unsigned byte is 0~255, so trying to calculate 0-1 would result in an underflow. If the condition is not checked, then the value would usually be "wrapped around" to an in-range value: The above example would give (-1)+256 = 255. May or may not be considered a type of overflow depending on the exact definition of the latter.
A notable example of underflow in Pokémon games is item underflow, which refers to underflowing the item count to 255, allowing the player to access an expanded item pack.

W^X (Write Xor eXecute)
Synonyms: Data Execution Prevention, No-Execute, ...
A technology used by some systems, with the intent to prevent accidental or malicious execution of non-program data, involving making enforceable declarations of which memory addresses are supposed to contain machine code and which don't.
No Nintendo console up to and including the Wii and DSi uses this system, resulting in the potential for arbitrary code execution whenever an avenue to have user-modifiable memory executed is available (although there may be other, often technical, restrictions to where code may be executed from).