Arbitrary code execution
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
[hr] No further extensions
Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)
Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)
[hr] Buffer overflow techniques
99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)
[hr] Item stack duplication glitch (Generation I)
Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch
[hr] Bad clone glitch (Generation II)
????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))
[hr] Closed menu Select glitches (Japanese Red/Green)
Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch
[hr] Pomeg glitch (Generation III)
Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch
[hr] Voiding (Generation IV)
Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)
[hr] 2x2 block encounter glitches (Generation I)
Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch
[hr] Glitch City
Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)
[hr] Large storage box byte shift glitch
Storage box remaining HP glitch | Generation I max stat trick
[hr] Pikachu off-screen glitch
Trainer corruption glitch
[hr] SRAM glitches
Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches
[hr] Trainer escape glitch
Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation
[hr] Walk through walls
Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls
[hr] Surf down glitch
Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))
(view, talk, edit)
The ZZAZZ glitch is a major glitch which occurs when the player encounters a certain roster of a glitch trainer.
In Pokémon Red and Blue, using a Special stat of either 248, 251, 252, 254, 255 for the Ditto Trick and not altering the attack stage of the enemy Pokémon (7 by default) can cause the glitch. Likewise, in Pokémon Yellow if the attack stage is not changed (left at 7), Special stats of 248, 249, 250, 252, 253, 254 and 255 will work.
When the glitch happens, the player encounters a glitch trainer that turns all of the player's Pokémon into Level 153 Bulbasaur knowing Explosion, except for the 3rd and 6th Pokémon. All of the letters in the player's name, except at spaces that are multiples of 3, are replaced with Zs.
The name "ZZAZZ glitch" came from the player using the name "OLD MAN" which resulted in this glitch editing part of the player's name to be "ZZAZZ".
Whether a Trainer causes the ZZAZZ glitch or not is controlled by two things; firstly their Trainer class (controlled by byte D059 in Red/Blue or D058 in Yellow) and secondly their roster (controlled by byte D05D in Red/Blue or D05C in Yellow).
The Trainer class is important because each Trainer class has a certain base money payout, and the roster is important because the last level[clarification needed]
The following factors will cause greater ZZAZZ glitch corruptions:
If the Trainer is from a glitch Trainer class, because glitch Trainer classes in Generation I typically have large base money payouts. If the last level of the Pokémon is high or 0 (technically 256).
In Pokémon Red/Blue/Yellow, money is stored so that a hexadecimal value represents a decimal value, which is related to why the ZZAZZ glitch writes 99 (normally dec:153) to things.
Upon encountering a ZZAZZ glitch Trainer (or any Trainer), its base money payout will be multiplied by the level of the last Pokémon and the result (the prize money) will be stored at D079 (D078 in Yellow), capped at "009999".
Multiplication in the winning money calculation is implemented as a consecutive addition (like 3*4 is 3+3+3+3), but a glitch occurs when the money caps at 9999. Every time the game resets the payout back to 9999, the game moves the payout money pointer 3 bytes forward, so the game keeps writing hex:9999 to memory addresses located past the winning money bytes when it still has additions left to do and encounters another cap.
The first byte in the series (XX 99 99) is never written to, meaning that some values stay the way they were. Bytes may not be kept at 99 if they change naturally in battle. An example is the address D083 (D082 in Yellow), which may be constantly changing before the player sends out their Pokémon so that the low HP noise is played.
(Thanks to the user TheZZAZZGlitch and bbbbbbbbba for the cause from the forums)
When the player encounters a glitch trainer which can trigger the ZZAZZ glitch (see above for examples) many in-game variables will be changed to a constant of 153. This explains why most of the player's name are changed to include 'Z' because the letter Z has a hexadecimal identifier of 99 or 153 in decimal.
When the player is about to make a move all of his or her moves will have been changed to Explosion except for the third move because it is a multiple of three. The player's Pokémon except for those in slot 3 and 6 are also changed to be level 153 Bulbasaurs.
When the player tries to order one of their level 153 Pokémon to use a move they will commonly disobey the trainer and use a different move; this is because the player's name changed, so the game thinks that you are now a different Trainer to the old Trainer. In other words, your Pokémon are now 'traded Pokémon'. This is the case even if the player owns all of the normal eight badges because the Earth Badge was never programmed to account for traded Pokémon over level 100.
Though ZZAZZ glitch Trainers have AI that can freeze the game, the player can easily escape the battle if he or she uses any type of Pokéball as the battle will suddenly end even after the Trainer blocks the ball.
The reason why using a type of Poké Ball will end the battle is because the memory address D11C (D11B in Yellow) is set to hex:99. This address is normally initialized to 0, and set to the index number of a wild Pokémon when it is caught. After an item is successfully used in battle (this just means that a turn is spent, so a blocked Poké Ball is still considered successfully used), the battle will end if this address is a non-zero value.
"Jacred" (Trainer C8)'s fifth and eighth rosters in Pokémon Red and Blue cause a much greater degree of corruption than regular ZZAZZ glitch Trainers (video). They replace the item count with 153, and set 153 to various other item bytes. This gives the player many "POKéTRAINER" glitch items, plus some item quantities get changed to 153. When the player exits battle via an item like a Master Ball the map will be corrupted.
Jacred's fifth roster is accessible by performing the Ditto glitch with a Special stat of 200 and lowering the last enemy Pokémon's Attack by one stage via the move Growl.
Effects outside of battle
If the player manages to escape the battle with the glitch trainer he or she will be left with a team of level 153 Bulbasaurs with the move Explosion. 'Pokémon' beyond the sixth slot will be changed and this affects unrelated bytes.
If the ZZAZZ Glitch changed the end Pokémon variable in the player's name (usually this corresponds to Charizard 'M or Q depending on the player's version) to a level 153 Bulbasaur with Explosion poison damage may occur, and this will decrease unrelated memory addresses by one every four steps the player takes.
If the player saves after performing this glitch, the save file will be erased if an end byte (0x50) is not present on the eleventh character of the player's name or less. However, the ZZAZZ glitch may corrupt your box-set, i.e. message box options used for things like saving.
In order to save the game, the player must restore their box-set ID back to a normal value. This can be done by talking to a Pokémon Center nurse then cancelling. The glitch boxset with an index number of hex:99 has a height of 250, so it corrupts memory addresses past the screen data due to the box being too large.
If the player battles another trainer after escaping a ZZAZZ glitch Trainer, they will actually battle a 'link battle' Trainer (nicknamed the 'death trainer'), which may have a Charizard 'M or Q with extremely high HP.
This is because after the ZZAZZ glitch corruption occurs, one of the values that is changed to hex:99 is memory address D12B (D12A in Yellow); which is responsible for whether the Trainer is a link battle Trainer or not.
Up to name and party changeFollow the steps for the Ditto Trick, using a Special stat and enemy attack stage for a ZZAZZ glitch compatible Trainer (examples described above) The player should encounter the glitch trainer.
Up to the ZZAZZ glitch TrainerUse any item. The battle should end. Battle any trainer to see the 'death Trainer'.
Party Pokémon box data shift glitchThe party Pokémon box data shift glitch is available with the ZZAZZ glitch and is closely related to the large storage box byte shift glitch. More information about it can be found here. It involves data between the Pokémon data and a certain point (most favorably the items terminator) being shifted upwards, with D164 (Pokémon 1) taking the first shifted up value.
It is possible to change the first item identifier to the number of items, the first item quantity to the first item identifier, etc. and this makes it possible to work with the 'post 20' item bytes that are actually unrelated data, and this way it is possible to do things like warp to the Hall of Fame.
The player needs to perform the ZZAZZ glitch to make all FF up to the items terminator (or the point they want) disappear. If they're on the right tracks, the game will freeze on opening the Pokémon menu because the game can't find a terminator.
Working values are one Pokémon (01 xx FF), three Pokémon (03 xx yy zz FF), four Pokémon (04 ww xx yy zz FF) and six Pokémon (06 uu vv ww xx yy zz FF). (the FFs will get replaced with hex:99)
The items changing glitch may become impossible after certain progress is made in the game (though the game still technically shifts the bytes above the first FF), due to the possibility of there being FF values before the items terminator. If the player has a Charizard 'M or Q in the party, it may prevent the party Pokémon box data shift glitch from working.
If you want to perform the items changing glitch, when you are confident that there will be no FFs other than the items terminator (this is only possible through memory viewer, unfortunately), perform the ZZAZZ glitch, choose an item identifier greater than hex:14 (dec:20), go to a PC, and deposit the first Pokémon. You may need to walk around for a few steps so that you don't get stuck in the Pokémon Center due to map corruption.