Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of an article from Glitch City Laboratories wiki.

A live version of this article is available at the Glitch City Wiki here.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of the wiki in .tar.gz or .xml.gz formats.

Time Capsule exploit

Major glitches of the Pokémon series


Arbitrary code execution

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC

[hr] No further extensions

Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)


[hr] Buffer overflow techniques

99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)

[hr] Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch

[hr] Bad clone glitch (Generation II)

????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))

[hr] Closed menu Select glitches (Japanese Red/Green)

Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch

[hr] Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch

[hr] Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)


[hr] 2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch

[hr] Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)

[hr] Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick

[hr] Pikachu off-screen glitch

Trainer corruption glitch

[hr] SRAM glitches

Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches

[hr] Trainer escape glitch

Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation

[hr] Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls

[hr] Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))



(view, talk, edit)




PRAMA Initiative a également une page sur .
The Time Capsule exploit (known previously/also known as the Johto guard glitch or Johto cloaking trick) is a glitch in Pokémon Gold, Silver and Crystal connected with Pokémon Red, Blue, and Yellow. It becomes a possible exploit after obtaining a ????? (FF) in any of those versions.

For this glitch the player needs to have access to the Time Capsule, by meeting Bill in Ecruteak City and waiting at least one day. Access to the Cable Club (the Pokédex must have been obtained) is needed on the Generation I game.

Additionally, all moves exclusive to Pokémon Gold, Silver and Crystal must be deleted because although ????? cloaks the Pokémon species below it, it does not hide their moves.

Summary

When the player has a ????? (FF) at the top of the party and connects to the Time Capsule, it will 'mask' the Pokémon underneath it so that Johto Pokémon are undetected (unless they have Generation II-introduced moves), which allows the player to bring Johto Pokémon into the Time Capsule to be traded into Red, Blue and Yellow where they may become an equivalent glitch Pokémon that is usually taken from a conversion table in the ROM of the Generation II game, at $FBA26 in English Gold/Silver and $FB91C in English Crystal.

In order to obtain the equivalent glitch Pokémon, the player should either switch ????? (FF) to the bottom of the party after entering the Time Capsule and before trading, or stabilize the glitch Pokémon (which would be an 4h (hex
D6)
(Red/Blue)/4h (hex
D6)
(Yellow) and equivalent glitch Pokémon hybrid) after the trade by using the Pokémon Day Care on Route 5 in the Generation I game.

Obtaining a ????? (FF)

Obtaining a ????? (FF) is possible using the bad clone glitch in Gold, Silver, Crystal and Coin Case arbitrary code execution in English Gold, Silver.

Via the bad clone glitch

1) Obtain a bad clone.

2) Stabilize the bad clone in the Pokémon Day Care on Route 34 and it will become a ????? (00).

3) Put the ????? (00) at the top of the party and use "Move PkMn w/o Mail" to obtain a seventh Pokémon at the top of the party.

4) Stabilize the bad clone again (which should now be in the second position of the party) and it will become a ????? (FF).

5) Tidy up the party.

Via Coin Case arbitrary code execution

Main article: Coin Case glitch

The player should perform Coin Case arbitrary code execution with:

  • A 'fresh' wild Pokémon in slot 3.
  • A Quagsire holding a HP Up with Sleep Talk as its first move in slot 4.
  • Any other Pokémon (it will become ????? (FF))
  • The following stored PC items in the PC beginning from item 1 in the exact order shown in the table. The three stacks of Great Ball x4 can be obtained by buying multiple stacks of 99 of them, depositing them into the PC and tossing from the stacks.

    {|
    ItemQuantity
    [ANY ITEM][ANY QUANTITY]
    [ANY ITEM]x38
    TM27x2
    Fresh Waterx42
    Lovely Mailx1
    HM07x1
    Poke Ballx65
    Great Ballx4
    Great Ballx4
    Great Ballx4
    Everstonex1
    [ANY ITEM][ANY QUANTITY]
    Surf Mailx51
    Full Healx18
    Flower Mailx46
    HM03x1
    X Speedx1
    TM06x1
    [ANY ITEM][ANY QUANTITY]
    TM41x1


    Afterwards, they should deposit a Pokémon into the Day Care and withdraw it. It should become a ????? (FF) with the nickname of the original Pokémon.

  • REDIRECT Template:YouTube

    Conversions

    The equivalent Pokémon for species 1-250 are hard-coded into the ROM of Pokémon Gold, Silver and Crystal, as was found by Torchickens after Koolboyman shared the location of the Generation I ID>Generation II ID table for the first 151 Pokémon.

    The table is as such:

    {|
    Generation IIGeneration I
    HexPokémonHexPokémon (Red/Blue)Pokémon (Yellow)
    98ChikoritaBF4h (hex
    D6)
    4h (hex
    D6)
    99ChikoritaC04h (hex
    D6)
    4h (hex
    D6)
    9AChikoritaC14h (hex
    D6)
    4h (hex
    D6)
    9BChikoritaC24h (hex
    D6)
    4h (hex
    D6)
    9CChikoritaC34h (hex
    D6)
    4h (hex
    D6)
    9DChikoritaC44h (hex
    D6)
    4h (hex
    D6)
    9EChikoritaC54h (hex
    D6)
    4h (hex
    D6)
    9FChikoritaC64h (hex
    D6)
    4h (hex
    D6)
    A0ChikoritaC74h (hex
    D6)
    4h (hex
    D6)
    A1ChikoritaC84h (hex
    D6)
    4h (hex
    D6)
    A2ChikoritaC94h (hex
    D6)
    4h (hex
    D6)
    A3ChikoritaCA4h (hex
    D6)
    4h (hex
    D6)
    A4ChikoritaCB4h (hex
    D6)
    4h (hex
    D6)
    A5ChikoritaCC4h (hex
    D6)
    4h (hex
    D6)
    A6ChikoritaCD4h (hex
    D6)
    4h (hex
    D6)
    A7ChikoritaCE4h (hex
    D6)
    4h (hex
    D6)
    A8ChikoritaCF4h (hex
    D6)
    4h (hex
    D6)
    A9ChikoritaD04h (hex
    D6)
    4h (hex
    D6)
    AAChikoritaD14h (hex
    D6)
    4h (hex
    D6)
    ABChikoritaD24h (hex
    D6)
    4h (hex
    D6)
    ACChikoritaD34h (hex
    D6)
    4h (hex
    D6)
    ADChikoritaD44h (hex
    D6)
    4h (hex
    D6)
    AEChikoritaD54h (hex
    D6)
    4h (hex
    D6)
    AFChikoritaD64h (hex
    D6)
    4h (hex
    D6)
    B0ChikoritaD74h (hex
    D6)
    4h (hex
    D6)
    B1ChikoritaD84h (hex
    D6)
    4h (hex
    D6)
    B2ChikoritaD94h (hex
    D6)
    4h (hex
    D6)
    B3ChikoritaDA4h (hex
    D6)
    {4h (hex
    D6)
    B4ChikoritaDB4h (hex
    D6)
    4h (hex
    D6)
    B5ChikoritaDC4h (hex
    D6)
    4h (hex
    D6)
    B6ChikoritaDD4h (hex
    D6)
    4h (hex
    D6)
    B7ChikoritaDE4h (hex
    D6)
    4h (hex
    D6)
    B8ChikoritaDF4h (hex
    D6)
    4h (hex
    D6)
    B9ChikoritaE04h (hex
    D6)
    4h (hex
    D6)
    BAChikoritaE14h (hex
    D6)
    4h (hex
    D6)
    BBChikoritaE24h (hex
    D6)
    4h (hex
    D6)
    BCChikoritaE34h (hex
    D6)
    4h (hex
    D6)
    BDChikoritaE44h (hex
    D6)
    4h (hex
    D6)
    BEChikoritaE54h (hex
    D6)
    4h (hex
    D6)
    BFChikoritaE64h (hex
    D6)
    4h (hex
    D6)
    C0ChikoritaE74h (hex
    D6)
    4h (hex
    D6)
    C1ChikoritaE84h (hex
    D6)
    4h (hex
    D6)
    C2ChikoritaE94h (hex
    D6)
    4h (hex
    D6)
    C3ChikoritaEA4h (hex
    D6)
    4h (hex
    D6)
    C4ChikoritaEB4h (hex
    D6)
    4h (hex
    D6)
    C5ChikoritaEC4h (hex
    D6)
    4h (hex
    D6)
    C6ChikoritaED4h (hex
    D6)
    4h (hex
    D6)
    C7ChikoritaEE4h (hex
    D6)
    4h (hex
    D6)
    C8ChikoritaEF4h (hex
    D6)
    4h (hex
    D6)
    C9ChikoritaF04h (hex
    D6)
    4h (hex
    D6)
    CAChikoritaF14h (hex
    D6)
    4h (hex
    D6)
    CBChikoritaF24h (hex
    D6)
    4h (hex
    D6)
    CCChikoritaF34h (hex
    D6)
    4h (hex
    D6)
    CDChikoritaF44h (hex
    D6)
    4h (hex
    D6)
    CEChikoritaF54h (hex
    D6)
    4h (hex
    D6)
    CFChikoritaF64h (hex
    D6)
    4h (hex
    D6)
    D0ChikoritaF74h (hex
    D6)
    4h (hex
    D6)
    D1ChikoritaF84h (hex
    D6)
    4h (hex
    D6)
    D2ChikoritaF94h (hex
    D6)
    4h (hex
    D6)
    D3ChikoritaFA4h (hex
    D6)
    4h (hex
    D6)
    D4Chikorita1F
  • D5Chikorita20
  • D6Chikorita32
  • D7Chikorita38
  • D8Chikorita3D
  • D9Chikorita3E
  • DAChikorita3F
  • DBChikorita43
  • DCChikorita44
  • DDChikorita45
  • DEChikorita4F
  • DFChikorita50
  • E0Chikorita51
  • E1Chikorita56
  • E2Chikorita57
  • E3Chikorita5E
  • E4Chikorita5F
  • E5Chikorita73
  • E6Chikorita79
  • E7Chikorita7A
  • E8Chikorita7F
  • E9Chikorita86
  • EAChikorita87
  • EBChikorita89
  • ECChikorita8C
  • EDChikorita92
  • EEChikorita9C
  • EFChikorita9F
  • F0ChikoritaA0
  • F1ChikoritaA1
  • F2ChikoritaA2
  • F3ChikoritaAC
  • F4ChikoritaAE
  • F5ChikoritaAF
  • F6ChikoritaB5
  • F7ChikoritaB6MissingNo. (Kabutops Fossil form)MissingNo. (Kabutops Fossil form)
    F8ChikoritaB7MissingNo. (Aerodactyl Fossil form)MissingNo. (Aerodactyl Fossil form)
    F9ChikoritaB8MissingNo. (Ghost form)MissingNo. (Ghost form)
    FAChikorita34


  • One-way conversions

    Háčky, a member of the Glitch City Laboratories forums made research into more complex Time Capsule exploit conversions which are not accounted for in the table above. Specifically, this section describes conversions for Pokémon index numbers 0, 251, 252, 253, 254 and 255.

    From Generation I to Generation II

    {|
    Index number (hexadecimal)Index number (decimal)VersionGlitch PokémonTradeTrade-back
    000All official Gold/Silver/Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    SlowpokeSlowpoke
    FB251All official Gold/Silver/Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Wobbuffet4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    FC252All official Gold/Silver/Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Wobbuffet4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    FD253All official Gold/Silver/Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Ho-OhMissingNo. (hex:34)
    FE254Japanese Gold/Silver4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    PidgeyPidgey
    FE254Japanese Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    ElectrodeElectrode
    FE254Korean Gold/Silver4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    MagcargoMissingNo. (hex:43)
    FE254English/European Gold/Silver4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    NidorinaNidorina
    FE254English/European Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    MeowthMeowth
    FF255Japanese Gold/Silver4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Snubbull4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    FF255Japanese Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Granbull4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    FF255Korean Gold/Silver4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Snubbull4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    FF255English/European Gold/Silver4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Snubbull4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    FF255English/European Crystal4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)
    Granbull4h (hex
    D6)
    (Red/Blue) 4h (hex
    D6)
    (Yellow)


    From Generation II to Generation I

    The Pokémon that an Egg from Gold when traded to Generation I becomes (and not Silver due to an $FD sprite specifically appearing on the Gold title screen in Ho-Oh's sprite at $82AA) may be Magikarp if a game is started from a save on the second floor of a Pokémon Center.

    The other trades that depend on RAM can be manipulated with glitch Pokédex category arbitrary code execution, and it is even possible to transform a Celebi from Pokémon Gold into a Mew in Yellow with good luck.

    Note: These tests have been performed on an emulator only.

  • REDIRECT Template:YouTube

    {|
    Index number (hexadecimal)Index number (decimal)VersionPokémonTradeTrade-back
    000English Gold/Silver4h (hex
    D6)
    ChikoritaRhyhorn
    FB251English Gold/SilverCelebi(Depends on RAM)(Varies)
    FC252English Gold/Silver4h (hex
    D6)
    ChikoritaWigglytuff
    FD253English Gold/SilverEgg(Depends on RAM)(Varies)
    FE254English Gold/Silver4h (hex
    D6)
    MissingNo. (hex:38)Chikorita
    FF255English Gold/Silver4h (hex
    D6)
    ChikoritaMankey
    000English Crystal4h (hex
    D6)
    ChikoritaRhyhorn
    FB251English CrystalCelebiChikoritaOmastar
    FC252English Crystal4h (hex
    D6)
    ChikoritaVenonat
    FD253English CrystalEgg(Depends on RAM)(Varies)
    FE254English Crystal4h (hex
    D6)
    MissingNo. (hex:38)Sneasel
    FF255English Crystal4h (hex
    D6)
    MankeyMankey


    Reverse Time Capsule exploit



    Due to any stable glitch Pokémon in Generation I under level 101 with a matching type as the equivalent Generation II Pokémon not being deemed as "abnormal", any glitch Pokémon that had its stored types changed with arbitrary code execution to match the equivalent Generation II Pokémon (however, note that this is unconfirmed for Pokémon with Generation II-introduced types) will be transferable to Gold, Silver, Crystal.

    Additionally, there are a few glitch Pokémon in Generation I that usually have matching stored types with their equivalent Generation II Pokémon and do not require arbitrary code execution. These are as such:

    1. 4h (hex
    D6)
    shares the Pokédex number/types of Chikorita in Red/Blue and becomes Chikorita in Generation II.

    2. 4h (hex
    D6)
    shares the Pokédex number/types of Chikorita in Red/Blue and becomes Chikorita in Generation II.

    3. 4h (hex
    D6)
    shares the Pokédex number/types of Chikorita in Red/Blue and becomes Chikorita in Generation II.

    4. 4h (hex
    D6)
    shares the Pokédex number/types of Chikorita in Yellow and becomes Chikorita in Generation II.

    5. 4h (hex
    D6)
    shares the Pokédex number/types of Chikorita in Yellow and becomes Chikorita in Generation II.

    6. 4h (hex
    D6)
    shares the Pokédex number/types of Chikorita in Yellow and becomes Chikorita in Generation II.

    7. 4h (hex
    D6)
    shares the Pokédex number of Chikorita in Yellow and becomes Chikorita in Generation II.

    8. 4h (hex
    D6)
    shares the Pokédex number of Chikorita in Yellow and becomes Chikorita in Generation II.

    9. Kabutops Fossil MissingNo. (hex:B6) takes its stored type based on a Pokémon that was loaded into memory. Due to this, the Trainer escape glitch may be used to obtain a Rock/Ground-type Kabutops Fossil MissingNo. when the player has an Onix, Geodude, Graveller or Golem[clarification needed], which will be able to transferred over as Pupitar in Generation II.

    History

    The Time Capsule exploit (then known as Johto guard glitch) was proposed on TRsRockin as a theoretical method of obtaining any glitch Pokémon in the English Pokémon Red, Blue, and Yellow, before a method was found of obtaining ????? (hex 0xFF).

    It was posted on the TRSRockin forums that a ????? (FF) allows the player to circumvent the game from restricting post-151 Pokémon into the Time Capsule if it was placed into the party above other Pokémon.

    After Paco81's discovery of the Celebi trick and its submission to Glitch City Laboratories, a legitimate method was found of obtaining ????? (FF), so the glitch was further investigated on Glitch City Laboratories forums.

    It was found on Glitch City Laboratories that Pokémon below ????? would become an 'M/3TRAINERPOKé ‎₽. when traded back to Pokémon Red and Blue (a side effect of leaving it as the first Pokémon in the party), which complicated verification of the exploit as a valid glitch.

    Categories