Arbitrary code execution
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
[hr] No further extensions
Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)
Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)
[hr] Buffer overflow techniques
99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)
[hr] Item stack duplication glitch (Generation I)
Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch
[hr] Bad clone glitch (Generation II)
????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))
[hr] Closed menu Select glitches (Japanese Red/Green)
Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch
[hr] Pomeg glitch (Generation III)
Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch
[hr] Voiding (Generation IV)
Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)
[hr] 2x2 block encounter glitches (Generation I)
Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch
[hr] Glitch City
Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)
[hr] Large storage box byte shift glitch
Storage box remaining HP glitch | Generation I max stat trick
[hr] Pikachu off-screen glitch
Trainer corruption glitch
[hr] SRAM glitches
Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches
[hr] Trainer escape glitch
Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation
[hr] Walk through walls
Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls
[hr] Surf down glitch
Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))
(view, talk, edit)
The Viridian Forest 0xF8FF glitch is a major glitch in Pokémon Red and Blue which involves arbitrary code execution of the 0xF8FF region Echo RAM in Viridian Forest, due to a special glitch meta-map script activation. It was documented by gifvex.
This glitch may not work on certain emulators due to its abuse of specific CPU timing.
Although this location within the opponent Trainer's Pokémon data is tricky to manipulate, it can be made to run the Hall of Fame script. However, in order to run the Hall of Fame script a specific Trainer ID, player name, stored Pokémon data and some luck is involved. This includes having a 'good' current play time specific up to how many frames have passed before the next second.
This glitch is currently the fastest means of completing English Pokémon Red and Blue other than the SRAM glitch, obsoleting Brock Through Walls for this purpose.
StepsFirst name your player mMna.♀tF (the name is important) and manipulate the Trainer ID 61896 (F1C8), also important. Choose Charmander or Bulbasaur as the starter. It will get the ID 61896 which is necessary for the run.
Note: A different player name and Trainer ID have been used for TAS purposes, but these haven't been examined for non-TAS use yet.
Now continue the game as normal until you get to Viridian City, in which you should find a Spearow on Route 22 and name it "AAA". Then deposit your starter into the PC and use the 'death-warp' technique to blackout on the last Bug Catcher.
This means getting an encounter in the grass in the Bug Catcher's vision and fainting. This causes you to black out but sets up an instant encounter when you return. If using luck manipulation you can encounter a Pikachu to faint Spearow, otherwise poison Spearow beforehand.
Now, don't open the start menu or open any text boxes (or the glitch won't work properly) and return to Viridian Forest. You will re-fight the Bug Catcher. Win or lose against him, then you will immediately battle him again (again you can win or lose this fight). This activates glitch meta-map script 06, which causes lag when you walk and can interrupt A button presses.
Next save the game south outside of Viridian Forest to be safe, as your play time (including frames) can affect the upcoming Hall of Fame warp. Proceed to the first Bug Catcher you can fight and mash A until you get his encounter text to appear.
Win the fight and if lucky, you will enter the Hall of Fame.
If you want to do this with no luck manipulation, obtain the ID 61896 by swapping a quantity of 241 into item 30 and a HM05 into item 31 (see expanded items pack), then obtain a Charmander at Level 6 from the Trainer escape glitch and trade it over to the new game to deposit it into the PC.
You will still have to be lucky to encounter Spearow, get the death-warp and get Hall of Fame to work however.
Technical informationFor instant encounters from Trainer battles the game uses something called 'meta-map scripts'. These are scripts for a number of maps to perform a task (such as to encounter the Trainer, to stop the player from leaving Pallet Town into Route 1 and so on).
Due to a glitch beating the Trainer two times sets the meta-map script to glitch value 06. This causes walking lag. Proceeding to beat the other Trainer will execute F8FF in Echo RAM (in the middle of enemy Pokémon 3's data), in which copies of the player's name are executed as code. The code falls through to play time (in which the values including frames need to be 'safe'), and then to the stored Pokémon's data.
Here if we have exactly 1 specific Pokémon with the right ID you can proceed to execute the Hall of Fame script.
TheZZAZZGlitch also did further research into this. Apparently the execution of F8FF is due to an invalid predefined command function 0xF4. Apparently the code is supposed to execute F808 but ends up executing F8FF due to a VRAM inaccessibility related detail.
This glitch may not work on VisualBoyAdvance, Pokémon Stadium 2 or possibly Nintendo 3DS Virtual Console.