I wonder if this glitch I came across would be suitable for a Japanese Ruby/Sapphire run? I do not know some specific details about it yet. You probably don't need to buy 40 dolls or those specific desks, and I know you can have two (maybe a significant amount) different types of dolls and get the glitch to work too. What I did was:
*Get 40 Pichu dolls
*Place 16 in your room
*Place 12 in your base using a Heavy Desk, Ragged Desk and Pretty Desk
This caused the first doll's name to become glitched. I tossed items below it and did some messing around, and I ended up accessing Secret Base items beyond Cancel. I selected one of them with an extremely long name to toss, and the screen turned mainly black and flashed colours.
The glitch: https://www.youtube.com/watch?v=qvoMpTlfPnU
Perhaps you can pull off helpful memory corruption or even arbitrary code execution using this glitch.
My Pocket Monsters Ruby (JP) save set up before the glitch. https://mega.co.nz/#!Y1FSwapD!zF2bLIs2Kn3LCUBY89Wvj3cyYkTZ5Godr6ViJzrqrC8
I wonder what this is? It's a Japanese Emerald "TAS" where the runner tries to escape from the Professor Birch battle eight times, then do some specific things in Birch's lab to warp to the Hall of Fame (including walking around in a certain way, menu flashing maybe to manipulate the memory address locations?). I hope it's not fake. They said that you need a specific Trainer ID, which in this video is 59368.
http://www.nicovideo.jp/watch/sm14023790
I've rediscovered an old glitch in Red/Green/JP Blue that lets you turn Trainers into Pokémon, and I did an analysis of it. I don't know how useful it would be because I'm not good with logistics. In theory, it would be most useful for catch 'em all.
See here for a detailed, but incomplete image that explains how it works.
To set it up, you press select on the 20th item, exit with B and then swap the 20th Pokémon with a Pokémon of your choice.
This messes up the Trainers to possibly give you Pokémon, and they are based on the old Pokémon data (that you switched). For now, I don't know what Pokémon data alters the desired bytes, but I'll work on it.
Unfortunately, the Trainer texts get messed up too, but if you just alter the bytes from D485 (text ID 1 yield) onward, you can alter the Pokémon (or Trainers, ha) that Trainers give.
I know that select glitches are basically swapping Pokémon past the end of the list; not swapping items with Pokémon. So I wonder if an expanded 6+ party via Super Glitch could be used to recreate a similar effect.
Edit:
These are results. Initial addresses are based on Pokémon 1.
Does not change: Trainer 01 turning data D463
Does not change: Trainer 01 text D464
Does not change: Trainer 02 turning data D465
Does not change: Trainer 02 text D466
Does not change: Trainer 03 turning data D467
Does not change: Trainer 03 text D468
Does not change: Trainer 04 turning data D469
Does not change: Trainer 04 text D46A
Does not change: Trainer 05 turning data D46B
Does not change: Trainer 05 text D46C
Does not change: Trainer 06 turning data D46D
Does not change: Trainer 06 text D46E
D12B Species byte 2 -> Trainer 07 turning data D46F
D12C Current HP byte 1 -> Trainer 07 text D470
D12D Current HP byte 2 -> Trainer 08 turning data D471
D12E Level? -> Trainer 08 text D472
D12F Status ailment -> Trainer 09 turning data D473
D130 Type 1 -> Trainer 09 text D474
D131 Type 2 -> Trainer 10 turning data D475
D132 Catch rate -> Trainer 10 text D476
D13F Attack experience byte 2->Pokémon 1 species D483
D140 Defense experience byte 1->Pokémon 1 level D484
D141 Defense experience byte 2->Pokémon 2 species D485
D142 Speed experience byte 1->Pokémon 2 level D486
D143 Speed experience byte 2->Pokémon 3 species D487
D144 Special experience byte 1 -> Pokémon 3 level D488
D145 Special experience byte 2 -> Pokemon 4 species D489
D146 Attack & Defense DV -> Pokémon 4 level D48A
D147 Speed & Special DV -> Pokémon 5 species D48B
D148 PP of move 1 -> Pokémon 5 level D48C
D149 PP of move 2 -> Pokémon 6 species D48D
D14A PP of move 3 -> Pokémon 6 level D48E
D14B PP of move 4 -> Pokémon 7 species D48F
D14C Pokémon level -> Pokemon 7 level D490
D14D Max HP byte 1 -> Pokémon 8 species D491
D14E Max HP byte 2 -> Pokémon 8 level D492
D14F Attack byte 1 -> Pokémon 9 species D493 (not verified)
D150 Attack byte 2 -> Pokémon 9 level D494 (not verified)
D151 Defense byte 1 -> Pokémon 10 species D495
D152 Defense byte 2 -> Pokémon 10 level D496
Did I make any errors?
Also, if you want to discuss it outside of how it could be used in a speedrun, see my Glitch City Laboratories thread on it, or my new video.
MrWint, on one of my saves Dabomstew's setup (a certain Bulbasaur) worked, but for me and ThomazSDA the glitch didn't work for a Bulbasaur (position 1, no other Pokémon) with its required PPs obtained from a new game.
Do you have an idea why? This eludes me. It could be as simple as a copy of 24 10 existing before the PP data, but VBA's cheat searcher wouldn't bring one up, except one where a 'correct' pointer followed.
Now, on Glitch City Laboratories, Sanky said the coordinates need to be at an address ending with xxx2, xxx6, xxxA, or xxxE, but D189 (PP move 2) doesn't end in one of those values, and I didn't need data in D02E (in battle PP move 2 address) to get this to work on the save file it was working.
On both the save file it worked and the new game save, I noticed there was a copy of the relevant data in the SRAM, at AF52; an address that does end in one of those values. Yet the glitch didn't work on the new game save.
Also, after I was switching around Pokémon the glitch stopped working. Why might this be?
Hope you can help. Thanks.
I wrote a possible improvement on the 'temporary encode' Youtube video.
I think more people will probably be aware of it in this thread, though.
Instead of MrWint catching Tangela, Rattata, Pidgey and Raticate in the grass, maybe it would be quicker if he did it on the left-facing shore tile, which is closer to Pallet Town than the grass. Those left-facing shore tiles bring up Pokémon from the last list too, like the ones in Route 20 and Route 19 Glitch City and the grass data on that route is written to the list.
Has somebody given the link to a savefile with a pomeg glitched pkmn already here on the thread?
No.
Here's a ZIP folder with one save before you exploit the glitch (65535 HP Pokémon, all other fainted Pokémon except sixth) and another save where you have a Bad EGG with the hex:0400 glitch move (turn battles into doubles/Birch/wild) and all fainted Pokémon to send it out:
jlun2 wrote:
Since the glitch turns several pokemon to bad eggs, maybe manipulate it so that 2 or more eggs would have that glitched move?
Even if you set it up so you have all fainted Pokémon and two Bad EGGs, regardless of whether they have health, the twins Anna and Meg west of Mauville City won't battle you, as if you only have one Pokémon. This possibly means Liza and Tate or doubles Steven wouldn't, either.
According to luckytyphlosion you can't battle Tate & Liza or possibly do the doubles Steven battle with just the Bad EGG, so that's an obstacle for this run. Maybe you'd need at least two Pokémon with good HP EVs to repeat the glitch. You wouldn't have to do the scrolling again as after healing you could deposit the Bad EGG with the working glitch move and withdraw it again after performing the 'walk around with fainted Pokémon' part of the glitch.
Good luck on taking up the run GoddessMaria or mkdasher if he/she does it!
Luckytyphlosion has got two of the glitch moves that let you flee from a Trainer battle on a real console and without cheating, so it's definitely viable, yay! That's unless the game doesn't let you enter the Hall of Fame with Bad EGGs or you white out though.
The fact that luckytyphlosion got two good glitch moves may suggest they aren't that uncommon.
Edit: You can defeat and enter the Hall of Fame with a Bad EGG.
0_o
The thread also mentioned cloning in FireRed/LeafGreen. :o
Also wondering can it be used to glitch yourself event pokemon.
Edit: How about the gamecube games? Can this be done there? Can you trade bad egg to there?
Cloning in FireRed/LeafGreen requires trading a glitched HP over from Emerald (or another version, but you can exploit the Pomeg glitch in Emerald), unfortunately. When you enter the trade center, your Pokémon's HP isn't changed. Pomeg Berries can only be ground up into Berry Powder in FireRed/LeafGreen, not used to reduce HP EVs.
Once you've got a glitch HP Pokemon on FireRed/LeafGreen it's the same basic method though, and it also opens up another glitch that's probably not as useful.
I'm not sure if you can glitch yourself event Pokémon, but box data is shared for cursor positions D7-FF. Unfortunately this is also randomized before you enter battle and when you open/close the Pokémon menu, enter warps, etc. To get that cloning glitch to work it's a good idea to have data for most positions in box 1/2 in your session, because otherwise the values will stay at 0 and that can affect the HP of the Pokémon you send out (if so, the game won't let you send them out due to them having no HP). Theoretically, and only in theory, you could force one of the 'post-6' Pokémon to be a legendary, but it would be far fetched. It would require having to force the species as a legendary in the 48 byte data structure but you'd also need the right checksum, and then to make things worse, the values would be randomized.
At this point, I don't know the slightest about how the Bad EGG corruptions work, other than the cursor values for corruption ranging from D7-FF.
It's probably not possible to trade Bad EGGs to the GameCube games, because I remember there was an error handler for 'hacked' Pokémon, something like "illegal Pokémon can't be traded?"
Edit: Forgot to answer the whole of your questions. I don't know if the Pomeg glitch or trading glitched HP Pokémon over there is possible on the GameCube games, sorry. That's an interesting question though.
There is new potential for a glitched run. Using this glitch (a Pomeg Glitch sub-glitch) originally found by voltage, it's recently been discovered by luckytyphlosion and I that you can corrupt box 1/2 and get Bad EGGs with glitch moves, which you can battle with by having one in the last position of your party.
Is it possible for certain glitch moves to allow you to warp? Maybe just by scrolling up we can corrupt important data earlier than the box data and save time.
Video.
Yes I know about Paco, I used his findings to do this long ago (and I did credit him :)):
http://www.youtube.com/watch?v=BnSEbS2vk-4
Thanks for the addresses, anyone that knows more post away, I suppose rom hackers should.
Oh, I saw that! I remember you posted that on the (offline) Glitch City Laboratories forums as 'advanced Celebi Trick' :).
These RAM addresses might be useful[?], but it looks like its just a matter of changing them, i.e. is it possible to withdraw enough Pokémon to access them without the game freezing, or change them by withdrawing corrupted mail... or even reach some important RAM?
Dig room modifier:
DCAA - byte 1
DCAB - byte 2
Teleport room modifier:
DCB2 - byte 1
DCB3 - byte 2
Badges:
D84A - first byte
D84B - second byte
Collisions (no clipping):
C2FA-C2FD
p4wn3r wrote:
RingRush wrote:
1. Get a level 0 bad clone (involves the classic cloning glitch, resetting at the exact right time...there is more on this on plenty of sites).
Do you have a vbm getting this bad clone?
I tried many times, but couldn't get a lvl0 bad clone on VBA-rr no matter which frame I reset.
In Pokémon Crystal, it is around (well popularly believed to be) after the word 'POWER.' is written (after the full stop), did you try resetting around there?
http://www.youtube.com/watch?v=BIz1RAg25yM
This is of an unrelated note, but it would be interesting if a Red/Green "catch 'em all" run was done alongside the Red/Blue one, by combining the dokokashira door glitch with other select button glitches, such as this one.
Link to video
I assumed something like this was possible but since I didn't have a ram map of the game I didn't bother, do you have one, or was all your work just by chance?
If you can help building a ram map I can help with whatever I can :P
If you are going to do this, please accredit Paco81, who made this all possible in the first place. There are various methods of memory corruption, which Paco81 very nicely told me about. One of them is a derivative of withdrawing 7 or more Pokémon.
One of these only occurs in Gold/Silver, whilst another is exclusive to Crystal.
Withdrawing more than 6 Pokémon (both versions):
1) This is done using a ????? (hex:00). Use the Move w/o Mail to withdraw a seventh Pokémon, and then withdraw extra Pokémon to affect RAM addresses beyond the range of normal Pokémon. Data for the 6th Pokémon in Crystal ranges from DCDD-DE82. (per expanded version of Matthew Robinson's code archive http://web.archive.org/web/20090504212827/http://glitchcity.info/docs/gameshark/pokemonccodes.txt) The 'step' between one byte associated with (x)th Pokémon and (x+1)th Pokémon is +0x30.
Corrupted Mail Box (Gold/Silver):
This allows you to 'obtain' lots of glitch Mail in the PC, unfortunately I don't know how far the list of mail extends to. Something around 240+ mail will also corrupt the map when you view the Mail Box (see below), but you don't obtain that much Mail with this method.
Whilst this may occur in Crystal, on the glitch forums I post to we haven't found a method of replicating it on Crystal yet.
1) Using ????? (hex:00), withdraw an eleventh Pokémon to corrupt the first Unown in the UnownDex. Certain glitch Unown when viewed corrupt the Mail Box.
I have compiled a RAM list for Gold/Silver for the Mail Box structure, because I couldn't find one anywhere. (Crystal's RAM map has an offset of +2B5)
1st Mail item:
First mail:
A835 = first character
A836 = second character
A837 = third character
A838 = fourth character
A839 = fifth character
A83A = sixth character
A83B = seventh character
A83C = eighth character
A83D = ninth character
A83E = tenth character
A83F = eleventh character
A840 = twelfth character
A841 = thirteenth character
A842 = fourteenth character
A843 = fifteenth character
A844 = sixteenth character
A845 = seventeenth character
A846 = eighteenth character
A847 = nineteenth character
A848 = twentieth character
A849 = twenty-first character
A84A = twenty-second character
A84B = twenty-third character
A84C = twenty-fourth character
A84D = twenty-fifth character
A84E = twenty-sixth character
A84F = twenty-seventh character
A850 = twenty-eighth character
A851 = twenty-ninth character
A852 = thirtieth character
A853 = thirty-first character
A854 = thirty-second character
A855 = thirty-third character
A856 = author of first mail (first character)
A857 = author of first mail (second character)
A858 = author of first mail (third character)
A859 = author of first mail (fourth character)
A85A = author of first mail (fifth character)
A85B = author of first mail (sixth character)
A85C = author of first mail (seventh character)
A85D = author of first mail (eighth character)
A85E = author of first mail (ninth character)
A85F = author of first mail (tenth character)
A860 = author of first mail (end character)
A861 = ?
A862 = Pokémon shown in portrait mail
A863 = type of mail (item id). 'Purple oddish mail' for invalid ids.
A864 = ?
Second mail:
A865 = first character of second mail
(continue until a certain amount of Mail, I can't remember the maximum, but its not high. :( )
Map corruption (2):
In addition to RingRush and westerlobe's method, viewing the status of a ????? (00) in Pokémon Crystal and exiting its summary will cause a 'glitch city'. Paco81 managed to get to the PokéCommunication Center in Crystal without Gameshark in Goldenrod City by corrupting the Goldenrod Pokémon Center map. I don't know what RAM values are affected unfortunately.
Also, this is relatively well known but after a battle with a ????? in Pokémon Crystal, escaping will escort you to an actual glitch map, unfortunately I don't know of the mechanisms behind that.
Edit: Odd, this post appeared invisible for some reason :( ? I had to disable BBcode to get it to work, and for some reason it is now perfectly visible with BB code.