Arbitrary code execution
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
[hr] No further extensions
Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)
Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)
[hr] Buffer overflow techniques
99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)
[hr] Item stack duplication glitch (Generation I)
Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch
[hr] Bad clone glitch (Generation II)
????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))
[hr] Closed menu Select glitches (Japanese Red/Green)
Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch
[hr] Pomeg glitch (Generation III)
Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch
[hr] Voiding (Generation IV)
Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)
[hr] 2x2 block encounter glitches (Generation I)
Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch
[hr] Glitch City
Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)
[hr] Large storage box byte shift glitch
Storage box remaining HP glitch | Generation I max stat trick
[hr] Pikachu off-screen glitch
Trainer corruption glitch
[hr] SRAM glitches
Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches
[hr] Trainer escape glitch
Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation
[hr] Walk through walls
Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls
[hr] Surf down glitch
Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))
(view, talk, edit)
|This article is incomplete. Please feel free to add any missing information about the subject. It is missing: Index number.|
|Bulbapedia also has an article about .|
|PRAMA Initiative a également une page sur .|
It is particularly notable for allowing the player to hatch an Egg containing any Pokémon in the game as well as many glitch Pokémon, by placing specific Pokémon in storage box 1 and 2.
The name Glitzer Popping is assumed to have no meaning in itself. It was chosen by the speedrunner werster who was one of the early researchers of the glitch, because he did not want the glitch to have a name which in his opinion would be 'too generic'.
Due to a memory address location randomization mechanic known as DMA, it can take many attempts for the player to get their desired corruption with the glitch.
1. Prepare a party with a Pokémon to switch into ('switch Pokémon'), a Pokémon ('Pomeg Pokémon') with HP to be reduced using a Pomeg Berry which has a suitable number of EVs for its level (at least 10; e.g. a level 100 Pokémon with 10 or more HP EVs may drop 2 HP), and at least one fainted Pokémon (all of the Pokémon other than the switch Pokémon and the Pokémon to have its HP reduced must be fainted).
The Pokémon to have its HP reduced with a Pomeg Berry may have its HP reduced to 1 (or alternatively 2 if the Pomeg Berry would cause a drop of 2 HP) by poison and have its status healed with an item such as a Pecha Berry or Full Heal. Alternatively it can be a Pokémon with Curse (such as Banette) and an odd maximum HP value. This Pokémon may use Curse twice with full HP so that the player can attain 1 HP faster than the poison method.
2. Enter a battle and switch into the 'switch Pokémon', then run away.
3. Deposit the 'switch Pokémon' into the Pokémon Storage System.
4. Either use a Pomeg Berry on the Pomeg Pokémon to obtain negative HP and heal it to 'raise' its HP to 0, or have the Pokémon's HP drop to 0 without having to use a healing item (which method the player has to use will depend on the Pokémon's level and whether it had 1 or 2 HP).
5. Enter a battle to send out a Decamark.
6. Open the Pokémon menu and view the summary of the first (fainted) Pokémon.
7. Exit the summary screen and scroll up (or down) to access Cancel. From the Cancel menu scroll up to corrupt data and access Pokémon beyond slot six. Scrolling up too much may freeze the game.
The initial steps for Pomeg data corruption glitch in Pokémon FireRed/LeafGreen are the same as in Pokémon Emerald, except that a Pokémon with negative HP must be traded over from Emerald to faint the party since the Pomeg Berry does not reduce HP EVs in these versions.
ExploitsWhen the player scrolls past Pokémon beyond slot 6, to access Pokémon beginning from Pokémon 255 and working down, they will corrupt the data of unrelated data managed as a non-existing Pokémon.
In Pokémon Emerald, the data which the player is able to corrupt with Pomeg data corruption glitch is as such:
In Pokémon FireRed and LeafGreen, the Pomeg glitch will corrupt Pokémon Storage System data beginning from box 3 slot 1 instead of box 2 slot 24. 
Pokémon Storage Box corruptionPomeg data corruption glitch may be used to corrupt the attributes of Pokémon in the Pokémon Storage System. Below are some of the possible techniques for this.
Accessing Super Glitch movesWhen Pokémon in the Pokémon Storage System or Day Care are corrupted, it is possible for them to know useful Super Glitch moves. When the player opens the Fight menu or attempts to use one of the Super Glitch moves, it can have effects such as finishing the battle (instant flee) or changing a Trainer battle into a wild Pokémon battle; allowing the player to steal other Trainer's Pokémon or escape from battle using a Fluffy Tail.
The Pokémon stolen fom other trainers will have their Trained ID changed to match the player's TID. If the initial TID of the Pokémon isn't the player's TID, the stolen Pokémon will turn into a Bad Egg. Pokémon from Battle Factory trainers are the only ones who have the player's TID.
DecaswitchDecaswitch is a derivative of Pokémon Storage Box corruption discovered by voltage which is possible if one of the Pokémon in the Pokémon Storage System becomes an invisible Decamark Bad Egg. Decaswitch allows a player to perform both Pomeg Glitch and Pomeg data corruption glitch without needing Pomeg Berries.
Hatch any PokémonThis is a popular exploit of Pomeg data corruption glitch that allows the player to hatch any Pokémon in the game, as well as glitch Pokémon which do not freeze the game after hatching.
In box 1 and 2 of the Pokémon Storage System, the player may place copies of Pokémon applicable for the glitch (obtained with cloning; ideally with the Battle Tower Pokémon cloning glitch) with attributes (e.g. Attack and HP EVs or a move) with an ID which would be converted into a species ID.
In order to know whether the Pokémon is applicable for the glitch and if so; which attribute needs to be converted into a species ID, the player must know the Pokémon's personality value and data substructure (determined by the Pokémon's personality value modulo 24). It is difficult to know a Pokémon's personality value (unless theoretically the Pokémon is a Spinda) without using an external device. For an illustration on how this works, see the section about the mechanics of Pokémon Storage System corruption below. However, thanks to Emerald's RNG, it is possible to easily determine the PID of a Pokémon that was caught right after soft-resetting by calculating its IVs and finding back the frame that generated the Pokémon.
Through SEASOR and DOTSThe in-game trade Pokémon "SEASOR" the Horsea and "DOTS" the Seedot are applicable for this glitch as their (constant) personality values of 0x0000007F and 0x00000084 respectively mean a successful corruption turns them into an Egg containing a Pokémon based on their Attack and HP EVs.
In order to obtain a desired Pokémon, the player must first know its index number. The upper two bytes of the four digit index number in decimal determines the number of Attack EVs required, while the lower two bytes in decimal determine the number of HP EVs required.
For example, in order to obtain a Mewtwo; the player can place copies of SEASOR or DOTS in the PC with an Attack EV of 0 and a HP EV of 150 (hex: 0096), and perform the glitch continually until one of the Pokémon in the Pokémon Storage System becomes a regular Egg containing Mewtwo. Often the Pokémon will become an Egg which still contains SEASOR or DOTS. This is normal, and if this occurs the player should reset the game and keep performing the glitch again until it works.
The following is a table of illusory Pokémon IDs and the required amount of Attack and HP EVs to force them into an Egg.
Through other Pokémon
Instead of using SEASOR the Horsea or DOTS the Seedot, it is possible that a different Pokémon could have its first move ID converted into a species ID or EVs converted into species. For example, a Sneasel knowing Beat Up (move ID hex:00FD) might become an Egg containing Celebi (species ID hex: 00FD), depending on the corrupted Sneasel's original personality value.
Corruption initiators (increasing success chance)
If the player is unsuccessful with the glitch after many attempts, they may attempt to place different Pokémon next to the Pokémon applicable for the glitch, referred to as corruption initiators for example they could try random Pokémon or (if the glitch was successful before) they could try placing a specific Caterpie known as "Caterpie the perfect initiator" next to SEASOR knowing Waterfall, Protect, Surf, Return (US)/no move (FR).
Another good corruption initiator is the in-game trade Plusle untouched but with all moves but Growl removed. This is a useful corruption initiator that is easy to get (if the player hasn't obtained the Plusle already). It is ideal for obtaining wrong Pokémon Eggs or double corruption, and is much quicker to get than the Caterpie.
Double corruptionDouble corruption is a method of obtaining a Pokémon in the Pokémon Storage System without hatching it. In order to exploit a double corruption, the player should attempt the steps to hatch any Pokémon with SEASOR (in-game trade Horsea), DOTS (in-game trade Seedot), PLUSES (in-game trade Plusle), or any other Pokémon with a beneficial corruption type with a specific attribute until the Pokémon turns into a regular Egg that is either a different Pokémon to the original or remains as the original.
The attribute to choose will depend on the Pokémon's personality value, which is constant for in-game trade Pokémon, as well as how substructure data will change after bit 6 is set on the upper bytes of the PID and TID. For SEASOR and DOTS it is the Attack and HP EVs that determine the Pokémon, while for PLUSES the Pokémon is determined by move 1's ID (but PLUSES is useful for obtaining moves and glitch moves, where the Attack and HP EVs determine the move of the Pokémon to be double corrupted provided it has at least 1 HP EV).
Afterwards, the player should save the game and continue to make corruptions to the Pokémon in the Pokémon Storage System (resetting if unsuccessful) until the Pokémon converts into an unhatched Pokémon.
During a double corruption, it is important that the player never picks up the Pokémon in the box with the glove otherwise the glitch will not work.
Double corruption may be used as a method of obtaining glitch Pokémon which would otherwise freeze the game upon hatching. It can also be used to obtain Pokémon holding an item chosen by the player, including unobtainable items (i.e. this can be manipulated from in-game trade Seedot's Speed and Defense EVs). All the data rewritten when an Egg hatches (EVs, Contests stats, Exp, Ribbons,...) can also be kept.
Pokémon News Reporter corruptionPokémon News Reporter corruption is a derivative of using the hatch any Pokémon to obtain a Decamark with an exceedingly long name. When the player speaks with the news reporter in the Pokémon Fan Club of Slateport City's Pokémon Fan Club with a specific Decamark in the first position of the party, it is possible to corrupt data after she mentions the Decamark's name.
"Guess Who?" glitchThe "Guess Who?" glitch allows the player to play as random NPCs after speaking to the news reporter with a specific Decamark in the first position of the party and stepping out of Slateport City's Pokémon Fan Club.
This is a table of "Guess Who?" Decamarks applicable for the glitch.
Instant Pomeg glitchInstant Pomeg glitch is a useful trick which allows the player to perform Pomeg data corruption glitch from the Pokémon menu without having to enter a battle, by forcing the first Pokémon in the party to be empty.
Glitch Pokémon 0x96B4 and 0x29C2 are examples of glitch Pokémon which enable instant Pomeg glitch in US Pokémon Emerald. REDIRECT Template:YouTube
New line arrow glitchThe new line arrow glitch occurs when a Pokémon has a 'new line' (hex:FB) character in its nickname. This Pokémon may be obtained rarely by performing Pomeg data corruption glitch when a Pokémon has the letter "A" as the fourth or eighth character in its nickname.
The new line arrow character causes a number of effects depending on the version, incuding:
The text after the down arrow in the Pokémon's name is hidden.
The down arrow is surrounded by the background in the party menu.
Sending out a Pokémon with a new line character in its name causes a red screen with "--" in it. Additionally, "H" and blue down arrows can be seen in the text box area. The fight box menu will be changed to a "-" surrounded by red.
Selecting the Pokémon or viewing its summary from another Pokémon causes the arrow's moving down animation to play once.
The new line arrow forces you to press A in battle to see the rest of the name.
The appearance of the arrow is different.
Corruption of the appearance of the items menu.
The red screen effect does not occur, but the press A to continue effect still occurs
The Pokémon's name on the party screen is displayed as if there was no arrow.
Bag item duplicationIn Emerald, if the player stops the up button scrolling from Cancel after about 17 whole seconds there is a chance that an item in the player's bag will have been duplicated. Sometimes this trick may 'remove' everything in the player's TM and Berry pockets although this effect does not occur every time. REDIRECT Template:YouTube
Switch cloningA method of Pokémon cloning with the access Pokémon beyond slot six glitch was discovered by luckytyphlosion in 2014 before it was known that scrolling past those Pokémon will corrupt data. Sometimes in the expanded party there will be a Pokémon that the player can send out. If the player sends this Pokémon into battle and whites out, it is possible for the player to clone the last Pokémon in their party.
White Decamark effectSometimes after viewing the status of a Pokémon in the expanded party it is possible to have the game lockup with the foe becoming a white Decamark. Additionally, the HP bar may become glitched and be filled in beige.
NPC corruptionsPomeg data corruption glitch may be used to sometimes corrupt NPCs on the map if the player escapes from battle using a Fluffy Tail instead of through whiting out.
Script corruptionsIf the player performs Pomeg data corruption glitch on a route with Trainers it can cause corruption of the player's challenge music, and/or corruption of their text (often long instances of "qÁF" in their text) or cause a full red screen. Sometimes after closing the text box (it may take a very long time for to finish printing it) it can cause a battle with a glitch Trainer to begin.
Reportedly the NPC outside of the Winstrate family house on Route 111 can be corrupted to a shop vendor, where talking to them brings up a BUY/QUIT option and items can be purchased (possibly glitch decorations) that are sent to the player's PC.
The same NPC may be used to trigger a 'super corruption glitch' in which the player's Pokémon, name, items, Pokédex data, play time and gender according to the save box is corrupted and saving may break the save, causing a black screen upon loading.
It is also possible to bring up the Game Corner slots with a script corruption.
Reboarding the S.S. AnneScript corruption may be used in FireRed/LeafGreen to disable the guard to the S.S. Anne from checking if the player has a ticket, if the player performs the scrolling after fishing in Vermilion City. This may also be used to reboard the S.S. Anne or Surf in the harbour to where the truck is.
Access behind the Day CarePomeg data corruption glitch may be used in Emerald and FireRed/LeafGreen to change the coordinates of NPCs on the map. This is useful for accessing behind the Day Care on Route 117 and Four Island in both versions, by encountering a Pokémon in the grass in Route 117 or fishing for a Pokémon in Four Island before scrolling up past Pokémon 255.
Day Care corruptionPomeg data corruption glitch may corrupt the data of Pokémon in the Day Care in Emerald if the player scrolls beyond stored box data (Pokémon 255-215) while scrolling up.[clarification needed]
Flag corruptionsPomeg data corruption glitch can be used to corrupt in-game flags either directly through scrolling up past Pokémon 255 or with a derivative trick which involves a glitch Pokémon obtained with the hatch any Pokémon trick.
Evergrande City Fly flagPomeg data corruption glitch may rarely set the Fly flag that allows the player to Fly to Evergrande City (where the entrance to Victory Road is and not outside of the Pokémon League) if the player hasn't unlocked it already.
Southern IslandPomeg data corruption glitch may rarely set the flag for an NPC to appear on the second floor of the Pokémon Center and give the player an Eon Ticket. This allows the player to access Southern Island and capture Latios or Latias. REDIRECT Template:YouTube
Faraway Island and Birth IslandMain article: Coin Case glitch In non-English versions of Pokémon Emerald including the French, German, Spanish and Italian versions of Emerald, it is possible for the player to use Pokémon News Reporter corruption with a specific glitch Pokémon (obtained with Pomeg data corruption glitch) to change an address telling the game which Pokémon to send out in battle and activate access to Faraway Island and Birth Island. A video explaining how to do this glitch may be found below and more information can also be found in this Pastebin.
Overworld position corruptionPomeg data corruption glitch may rarely affect the player's overworld position and place them in the wrong location (such as in the middle of trees) after escaping with a Fluffy Tail.
Surfing/Walking on Cycling RoadRarely after instant Pomeg glitch is set up, it is possible for the player to Surf on Seaside Cycling Road of Route 110 if they perform the scrolling from one step out of Mauville City's Pokémon Center and walk up.
This will make the player go through a 'door' that leads into the water on Route 110 near the Cycling Road and the player is able to surf through Cycling Road. Going through the right-most door of the Cycling Road's entrance and out will allow the player to walk on Cycling Road.
Secret Base decoration corruptionSee also: glitch decoration.
Pomeg data corruption glitch may rarely affect the Secret Base decorations they have in their PC. For example, TheZZAZZGlitch changed Thunder Mat (0x3C) into a 'ÛË ▼ÛË ÀÀÚËÔÀ ÀÀCAN' (0x7C) glitch decoration which acts like a portable two-square hole.
Arbitrary code executionPomeg data corruption glitch ultimately allows for arbitrary code execution if the player has favourable DMA.
It can be abused in two known ways:
1. By viewing the summary of Decamark 0x097D with a specific nickname Pokémon from the bottom-right corner of box 3 after saving twice. This trick may not work with certain save files.[why?]
2. With glitch move 0x27A2's animation and a specific stored item bootstrap code, which could theoretically be obtained with double corruption. (See video; below)
MechanicsPokémon Ruby, Sapphire and Pokémon Emerald introduced encryption for Pokémon in the party and storage box system, as well as a four byte value known as the personality value which determines a Pokémon's attributes such as its gender, ability, nature and shininess.
Pokémon have a stored checksum and calculated checksum, and a data substructures split into four sections, referred to as "Growth", "Attack", "EVs & Condition" and "Miscellaneous". The order that the sections appear is determined by a value that is calculated from the Pokémon's personality value modulo 24.
When the player selects a non-existing Pokémon from beyond slot 6, the game will attempt to verify the checksum of the Pokémon in what appears to be an anti-cheating mechanism. If it is found to be invalid, the game will corrupt it by setting bit 0 at offset 0x13, bit 1 at offset 0x13, and bit 6 at offset 0x07 from the 'Miscellaneous' data substructure).
Since the data for Pokémon beyond slot 6 corresponds with unrelated variables, it is possible (listed in the aforementioned exploits section) to corrupt data in a limited number of ways which include:
An addition of +5 (hex:05) (bit 0 and bit 2 set). An addition of +64 (hex:40) (bit 6 set).
The variables which are corrupted during scrolling are random due to a mechanism known as DMA. DMA shifts the location of a memory address to one of 64 locations each time the player performs an action such as opening the Pokémon menu outside of battle, or entering battle. This is the reason why it can take many attempts for a successful Pomeg data corruption glitch corruption.
Pokémon Storage System corruptionWhen Pomeg data corruption glitch touches a Pokémon's data, it will become a Bad Egg if its calculated checksum and stored checksum do not match.
However, sometimes[clarification needed]
For example, the in-game trade Horsea named "SEASOR" has an initial personality value of 0x0000007F (substructure: AGME) ; and the in-game trade Seedot named "DOTS" has an initial personality value of 0x00000084 (substructure: EGAM). When the glitch sets bit 6 of its upper personality byte, the personality values become 0x4000007F (substructure: MEAG) and 0x4000084 (substructure: GMAE) respectively.
This causes data from one substructure to be moved into another, for example; Seasor or Dot's "EVs & Condition" (E) data is moved into "Growth" (G) in which the species ID is stored; meaning that the Pokémon's Attack and HP EVs become the ID of the Pokémon inside of the Egg.
During a double corruption, both the Pokémon's personality value and Trainer ID is corrupted, and this causes the Pokémon to become a valid unhatched species as long as the player doesn't pick it up with the glove when it becomes an Egg.[why?]
Removing unwanted Eggs and Bad EggsAfter filling the Pokémon Storage System with Eggs and Bad Eggs, any unwanted Eggs and Bad Eggs created from Pomeg data corruption glitch can easily be removed with the Battle Tower inverse cloning glitch or fast inverse cloning.
External linksThread on Glitch City Laboratories forums.
CreditsVoltage first discovered the sub-glitch to send out a Decamark in early 2011.
On April 9, 2014 luckytyphlosion discovered that the glitch could be used to create both Bad Eggs and hatchable Eggs.
In May 2014, Sanqui, TheZZAZZGlitch and werster analyzed the glitch, discovered its mechanics and how it can be used to hatch any Pokémon in the game.
Metarkrai has thoroughly researched the glitch and has published many tricks such as information on methods to enter event islands, obtain obedient Mew and Deoxys and arbitrary code execution.