Arbitrary code execution
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
[hr] No further extensions
Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)
Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)
[hr] Buffer overflow techniques
99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)
[hr] Item stack duplication glitch (Generation I)
Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch
[hr] Bad clone glitch (Generation II)
????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))
[hr] Closed menu Select glitches (Japanese Red/Green)
Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch
[hr] Pomeg glitch (Generation III)
Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch
[hr] Voiding (Generation IV)
Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)
[hr] 2x2 block encounter glitches (Generation I)
Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch
[hr] Glitch City
Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)
[hr] Large storage box byte shift glitch
Storage box remaining HP glitch | Generation I max stat trick
[hr] Pikachu off-screen glitch
Trainer corruption glitch
[hr] SRAM glitches
Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches
[hr] Trainer escape glitch
Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation
[hr] Walk through walls
Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls
[hr] Surf down glitch
Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))
(view, talk, edit)
Text pointer item ball manipulation is a trick in Pokémon Red, Blue, and Yellow and a derivative of text pointer manipulation, introduced by MrWint in a catch em all TAS.
Since then, speedrunners such as SheNanagans have used it for real time runs.
SummaryWith text pointer item ball manipulation, you can get a limited amount of Pokémon, (legendaries not included) with index numbers corresponding to items found in item balls.
This trick involves turning an item ball into a Pokémon or Trainer encounter. The ID of the item becomes the Pokémon (e.g. Escape Rope is 1D, so that gives Pinsir).
This is done by changing the map's 'text pointer list pointer' with an expanded items pack, which is stored at D36C in Red/Blue or D36B in Yellow. Item 40 and its quantity represent this word. The text pointer list pointer controls a list of texts for that map.
Either the default text pointer list pointer from another map or a custom text pointer list pointer (in the bank of the destination map) may be used in a careful way to map an item ball script into a Pokémon/Trainer battle.
Each map has index numbers for its texts. An individual text ID can be viewed via memory address CF13, after pressing A on that item/person/etc.
For example, the "(Player)'s house" sign in Pallet Town has the ID 06. In Viridian City, the Dream Eater guy's text has the ID 06 as well. Pallet Town and Viridian City happen to share the same bank (coincidentally, also 06), so this means if you put Viridian City's text pointer list pointer into memory in Pallet Town, talking to the sign will bring up the Dream Eater guy's text.
Using a text pointer list pointer that would result in a Pokémon or Trainer battle, it is possible to bring that text pointer list pointer from an older map into a newer map.
Note if the text pointer list pointer is being used directly from the one loaded in another map, the source map and the new map have the same bank, or the game will get text from the wrong place. After the newer map is given the old text pointer list pointer, you can talk to an item ball with an ID corresponding to a Trainer on the source map to encounter a Pokémon or Trainer with the same index number as the item in the ball.
Encountering TrainersIf the item ball was a TM, the encounter ID is going to be greater than 200, meaning you can encounter Trainers. The Trainer rosters happen to be roster 0, and Trainer escape glitch normally only allows roster 1-13. Though you can encounter roster 0s with the old man trick, those Trainers have a shared non-regular set of teams, meaning the 'real' roster set of Trainers can't be accessed that way.
1) An Escape Rope ball can be turned into a Pinsir battle by swapping Victory Road 3F's text pointer list into Pokémon Mansion 1F.
2) A Nugget ball can be turned into a Golem battle by swapping Pokémon Mansion 1F into Safari Zone entrance.
3) A TM14 ball can be turned into a Fisherman roster 0 battle by swapping Victory Road 3F's text pointer list into Pokémon Mansion B1F.
4) A Rare Candy ball can be turned into a Chansey battle by swapping Victory Road 3F's text pointer list into Pokémon Mansion B1F.