Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of an article from Glitch City Laboratories wiki.

A live version of this article is available at the Glitch City Wiki here.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of the wiki in .tar.gz or .xml.gz formats.

ItemDex/Y:089

(↑ Back to the ItemDex index.) Template:ItemInfoGenI

(hex:59) is a glitch item in Pokémon Yellow. Its name is taken from lists of lift destinations.

This glitch item when used, will execute FA64 in Echo RAM. As FA64 both is in the middle of Pokémon Day Care data and can fall through to FA7F (stored Pokémon), it is ideal for arbitrary code execution.

However it may be preferable to use ws m (hex:63) if on a console/emulator that doesn't properly support Echo RAM.

Bootstrapping

Although the possibility of 4F arbitrary code execution is previously known, the credit for convenient bootstrapping setups goes to Krys3000, who posted them in this thread for both English and non-English Yellow games.

English games

Deposit and withdraw (or not) at the Day Care a Nidorina (that should not be evolved from a Nidoran♀), with Bite, Fury Swipes, Double Kick and Growl (the first two moves are placeholders and can be replaced with some other moves, but not just any move). Then, store in the active PC Box:

  • Any lvl25 Pokémon with currently 24 HP, 33 PP currently for the first AND second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
  • Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP

    Using 4F will then execute code from the third item.

    WRA1:DA64 <- 03 || inc bc

    WRA1:DA65 <- 78 || ld a,b

    WRA1:DA66 <- 2C || inc l

    WRA1:DA67 <- 9A || sbc d

    WRA1:DA68 <- 18 2D || jr DA97

    WRA1:DA97 <- 18 19 || jr DAB2

    WRA1:DAB2 <- 21 21 D3 || ld hl,D321

    WRA1:DAB5 <- 00 || nop

    WRA1:DAB6 <- 04 || inc b

    WRA1:DAB7 <- 00 || nop

    WRA1:DAB8 <- E9 || jp hl

    The reason the Nidorina should not be evolved from a Nidoran♀ is that the bootstrapping code goes through the "catch rate" byte in the Pokémon's data, which is set when a Pokémon is caught, but not updated when it evolves. Therefore a Nidorina caught as a Nidoran♀ will have 0xEB (235) instead of 0x78 (120), which is an invalid opcode and may freeze the game (depending on the platform).

  • REDIRECT Template:YouTube

    In other European versions

    Deposit and withdraw (or not) a lvl80 Pokémon with currently 24 HP in the Day Care. The, store in the active PC Box:

  • Any Pokémon with 33 PP currently for the first move, 38 PP currently for the second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
  • Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP

    Using 4F will then execute code from the third item.

    WRA1:DA64 <- 00 || nop

    WRA1:DA65 <- 18 50 || jr DAB7

    WRA1:DAB7 <- 21 26 D3 || ld hl,D326

    WRA1:DABA <- 00 || nop

    WRA1:DABB <- 04 || inc b

    WRA1:DABC <- 00 || nop

    WRA1:DABD <- E9 || jp hl



    This article or section is a stub. You can help wiki by [ expanding it].

    Categories