Submission Text Full Submission Page

Introduction

Hi there! In this exciting episode of 'Pokémon Gold: The Game', a young boy named 'A' is going to run around Johto buying and selling items he finds on his journey. Then, he will look in his Coin Case and will make a call to his best friend '999', who will make him a Pokémon Champion without ever fighting the Elite Four.

This run does not aim for the fastest possible time. It was made to show the people that Generation I isn't the only Pokémon game series that can be completed with pure glitches. I am also 100% sure that this run could be significantly improved, since I have no knowledge about how RNG works in Generation II. I was solving all my problems by inserting big amounts of delay between important actions, so that RNG gets a chance to cycle a couple of times. And, since it is my first TAS ever (excluding the tests), I may have made a bunch of obvious mistakes along the way.

Categories

  • Heavy glitch abuse
  • Heavy luck manipulation
  • Forgoes save data corruption
  • Low% completion
  • Uses a game restart sequence

Emulator/ROM

The movie was recorded on VBA-RR v23.6 svn480. Since VBA has problems with emulating the Real Time Clock while recording a movie, and correct RTC values are crucial for the run, the RTC emulation was turned off. All other settings were left at their defaults.
I used a standard UE Gold Version ROM found on the Interwebz. MD5: a6924ce1f9ad2228e1c6580779b23878, filename: Pokemon Gold Version (UE) [C][!].gbc

About the run

This run is abusing 3 different programming errors:
1. Pokémon cloning glitch
In order to buy all the items needed, a huge amount of money is required. Thankfully, using the Pokémon cloning glitch to clone a Pokémon holding an item duplicates the item too. So, to get that huge amount of money, 3 Pokémon holding 3 valuable items (Nugget, PP Up, Big Mushroom) are cloned, essentially doubling my amount of cash.
2. Coin Case glitch/glitch dimension
On Pokémon Gold/Silver, there is a popular glitch involving opening the Coin Case after listening to Machop/Machamp's cry. The Coin Case text script is improperly terminated, so the game tries to execute commands past the actual script, leading to arbitrary code execution.
This text script error causes the game to jump to address $E112. By listening to specific cries, manipulating the party Pokémon list and by standing in specific locations on the map, it is possible to redirect that accidental jump to a useful location - I chose my 4th boxed item as a location to store my code (more on that later).
3. Glitched Pokégear numbers
There exist only 36 different numbers a player can hold in their Pokégear contact list. However, the maximum value for a byte is 255, not 36. So there exist (255-36 equals... umm...) 219 numbers with no behavior assigned. Every number has a pointer, which tells the game where to look for the script to execute after calling a number.
All those script pointers are located in a table. Like with the glitch Pokémon in Gen I, requesting a script pointer for a number with ID bigger than 36 will cause the game to read a pointer from a memory area beyond the table. And by sheer luck, the number ID 255 (0xFF) happens to have a script pointer that triggers the Hall Of Fame sequence!
Creating the payload
So the goal of the run is to turn the Coin Case's bad habit of executing arbitrary code into our favor, by causing it to add a glitch person with ID 255 into the Pokégear. Then, by calling that newly added person - we complete the game.
I'm not going to describe the method how the Coin Case's arbitrary code execution works in much detail. If you're interested in the inner workings of this glitch, visit this link: http://forums.glitchcity.info/index.php/topic,6716.0.html
The address $E112, the initial jumping location, is a ECHO RAM section which contains several music/sound related addresses. By playing different sounds and cries it is possible to change the code flow and jump somewhere else. Machop's cry contains a sequence which will redirect the instruction pointer to $EB12.
Now at $EB12, a table of current color palettes is located. By standing in specific areas, it is again possible to redirect the code flow. The grassy area in front of Bill's lab is such a specific area - it contains a jump to $FA98.
After this jump, we're finally located somewhere more useful - in the middle of the third party Pokémon data. This is where the most manipulation potential is. But instead of trying to construct opcodes by catching Pokémon with specific IVs, I decided to use fourth Pokémon's moveset and ID number to create yet another jump to $F61D - 4th item in the PC box. Now, I can construct my own program inside my PC.
The code used to add the person only has to do two different things:
  • Add the actual person to the list (write 0xFF to any address between $D9C6 and $D9CF)
  • Clean up the stack and return control back to the game
So normally, this piece of machine code should look like this:
ld   a,$ff
ld   ($d9c6),a
inc  sp
ld   bc,$0134
push bc
jp   $12f5

Sadly, it would be way too easy if it was possible with such a little bit of effort. The opcodes we can use are severely limited by the maximum quantity (99) and the item availability. The real code used to add the glitch ID 255 to the Pokégear is a lot more difficult to understand, and half of it are just elaborate ways of doing nothing, just to pad the opcodes and make them representable as items.
Below is the item list used in the run, and the code it evaluates to.
*** ANY ITEM, ANY QTY     
*** ANY ITEM, ANY QTY     
*** ANY ITEM, ANY QTY    
X Defend              x2   
TM49                  x1   
Hyper Potion          x5   
Burn Heal             x7   
Fresh Water           x1   
Surf Mail             x79  
PP UP                 x1   
TM34                  x1  
*** ANY ITEM, ANY QTY      
Antidote              x30  
TM28                  x1   
*** ANY ITEM, ANY QTY     
Carbos                x1   
*** ANY ITEM, ANY QTY      
Awakening             x29  
Blk Apricorn          x1   
*** ANY ITEM, ANY QTY      
Flower Mail           x46 
TM08                  x1   
Great Ball            x4   
Parlyz Heal           x10  
Big Mushroom          x1   
*** ANY ITEM, ANY QTY     
RageCandyBar          x1   
*** ANY ITEM, ANY QTY    
Flower Mail           x51  
Surf Mail             x51 
TM33                  x1   
*** ANY ITEM, ANY QTY      
TM41                  x1  
inc sp
db $02      ; item filler
pop af
ld bc,$0510 ; [$0510] == 0x4F
ld a,(bc)
rlca
ld l,$01
or l
ld c,a
ld a,$01
ld ($ff00+c),a
ld bc,$0000 ; 0000 - any item, any qty
db $09      ; item filler
ld e,$db
ld bc,$0000 ; 0000 - any item, any qty
dec e
ld bc,$0000 ; 0000 - any item, any qty
db $0c      ; item filler
dec e
ld h,e
ld bc,$0000 ; 0000 - any item, any qty
db $35      ; item filler
ld l,$c7
ld bc,$0404 ; [$0404] == 0xFF
db $0d      ; item filler
ld a,(bc)
ld d,a
ld bc,$0000 ; 0000 - any item, any qty
ld (hl),d
ld bc,$0000 ; 0000 - any item, any qty
db $b8      ; item filler
inc sp
db $05      ; item filler
inc sp
pop hl
ld bc,$0000 ; 0000 - any item, any qty
jp hl

Hard luck manipulations used:

  • Manipulating the trainer ID's high byte to be 0xD6 or 0xF6 (~0.78%)
  • Encountering a Paras holding Tinymushroom (~3.75%)
  • Encountering a Paras holding Big Mushroom (~1.2%)
  • And of course, long continuous critical hit streaks to speed up the battles

Explaining certain steps

At the game's very beginning (first 8 minutes of the game), all actions are delayed on purpose, most noticeably, by continuously mashing the A button, causing the text scrolling to be delayed. For some reason, with insufficient time delay, I wasn't able to successfully get the Coin Case to do what I wanted. Also, derping on the new game menu at the game start is required to get a proper trainer ID.
While travelling from town to town, I collect every possible valuable item I can find. The real problem with getting all the needed items is the lack of money. So I try to earn as much money as I can, so later only one item duplication round is needed to satisfy my needs.
The real time clock is very important to the trick. If the glitch person 255 is called after the morning has passed, the game would say that 'the number is out of the area'. Also, the lady who gives out TM21 (Frustration) comes only on Sundays.
Special thanks to Sanqui, for discovering the actual arbitrary code part of the coin case glitch.

Noxxa: Judging.
Noxxa: While this run does well to showcase an arbitrary code execution glitch that can be used to enter the Hall of Fame, there are a number of issues that make it unsuitable for publication:
  • It is slower than the current unassisted any% record of 1:22:13 by Werster.
  • It is also not optimal for a TAS at some points, e.g. when walking around for a wild Pokémon encounter.
  • It also does not conform to the standard of what's considered finishing the game, which is triggering the credits through defeating Red, not through the Hall of Fame. (However, whether this is required for glitched completion may be debatable. Werster's unassisted run also uses major glitches and finishes the game by defeating Red. My personal opinion is that a glitched TAS should trigger the credits through Red.)
For these reasons, I'm rejecting the run for publication. Good luck on your future attempts!

TASVideoAgent
They/Them
Experienced Forum User, Moderator
Joined: 8/3/2004
Posts: 12499
Location: 127.0.0.1
Experienced Forum User, Skilled player (1592)
Joined: 9/17/2009
Posts: 4883
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
GBA TASer of 2010
Since VBA has problems with emulating the Real Time Clock while recording a movie, and correct RTC values are crucial for the run, the RTC emulation was turned off. All other settings were left at their defaults.
http://tasvideos.org/Bizhawk/ReleaseHistory.html#Bizhawk150
rtc is pegged to emulated elapsed time. maybe. don't know what to test it with. time at core restart is always 1970, or something like that, which isn't as bad as it sounds, because the GB rtc doesn't keep track of anything past days
Not sure if it's better, but hope it helps?
Editor, Experienced Forum User, Skilled player (1798)
Joined: 6/15/2005
Posts: 3151
Glitchy TAS of 2013Gameboy TAS of 2013PSX TASer of 2010
This is a pretty useful TAS to study how to use the coin case glitch. That being said, I really want to see another version. There seemed to be a lot of time-wasting, such as when going back and forth to get a random encounter, and backtracking to areas already visited just to get an item that could have been bought or obtained the first time. Also, I wonder if there is a way to glitch to the hall of fame without requiring so many items.
Experienced Forum User
Joined: 10/1/2013
Posts: 94
Location: My Basement
Haven't watched it, but if I could, I would vote no on principle. This TAS was does not beat all known records, nor was it submitted as a playaround.
Experienced Forum User, Skilled player (1592)
Joined: 9/17/2009
Posts: 4883
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
GBA TASer of 2010
FractalFusion wrote:
This is a pretty useful TAS to study how to use the coin case glitch. That being said, I really want to see another version. There seemed to be a lot of time-wasting, such as when going back and forth to get a random encounter, and backtracking to areas already visited just to get an item that could have been bought or obtained the first time. Also, I wonder if there is a way to glitch to the hall of fame without requiring so many items.
Since you have seen the TAS (and also have done one for this game), do you think using (only) the instant win glitch would be faster or a combination of both this glitch and the win glitch?
Patashu
He/Him
Experienced Forum User
Joined: 10/2/2005
Posts: 3868
I'm very interested to see this, although in its current state it cannot be accepted until it beats the real time record for pokemon gold glitched which uses different glitches ( 1h22m by werster ). Breaking pokemon in new ways is always exciting to me :)
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Experienced Forum User, Experienced player (555)
Joined: 2/23/2008
Posts: 264
Location: CA, USA
Gameboy TASer of 2012Funny TAS of 2012Gameboy TAS of 2012
The end glitch is sweet and very unexpected. It's a shame though that such a large portion of the game must be played to execute this command. Would the "bad clone" used in standard glitched speedruns be considered save data corruption? If so than you could say that this would be a different category then the current glitched route (which I'd love to see a TAS of). Won't vote because I haven't watched everything, but skimming over the sped up video it looked like it wasn't fully optimized.
Editor, Experienced Forum User, Publisher, Skilled player (1323)
Joined: 10/12/2011
Posts: 6053
Location: The land down under.
PSX TASer of 2016
Giving a no. Slower than RTA world record. Also dat re-record count: 5639
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. These colours are pretty neato, and also these.
Active player, Experienced Forum User (264)
Joined: 2/5/2012
Posts: 1512
Location: Brasil
I plan on TASing whatever simple games you don't want to. TAS i'm interested: megaman series: mmbn1 100%, bn3456, mmx3 any% psx glitched, pokemon series : colosseum and XD, emerald 7symbols, maximum carnage, mmx command mission mortal kombat series: UMK3, MKT, MKA, MKD and MKDA fighting games with speed goals in general
Editor, Experienced Forum User, Publisher, Skilled player (1323)
Joined: 10/12/2011
Posts: 6053
Location: The land down under.
PSX TASer of 2016
grassini wrote:
encode hue brbrbr http://www.youtube.com/watch?v=6MYSwy2_PUU
"This is only a preview video, with the first 125 minutes sped up 20x." Therefore it's not a full encode.
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. These colours are pretty neato, and also these.
Editor, Experienced Forum User, Skilled player (1798)
Joined: 6/15/2005
Posts: 3151
Glitchy TAS of 2013Gameboy TAS of 2013PSX TASer of 2010
jlun2 wrote:
Since you have seen the TAS (and also have done one for this game), do you think using (only) the instant win glitch would be faster or a combination of both this glitch and the win glitch?
I think that the Coin Case glitch is faster, if it can be arranged so that you don't have to go to Ecruteak City and beyond. However, if there is a way to perform arbitrary execution with a bad clone (without having to glitch the way to the E4 and use the instant win glitch), then that would definitely be faster.
Spikestuff wrote:
"...with the first 125 minutes..."
There is not even 91 minutes in this TAS. Anyway, I don't think it does any good to link such encodes here. The TAS at 20x speed moves too fast to be taken seriously.
Experienced Forum User, Player (118)
Joined: 8/18/2013
Posts: 109
Location: location, location!
Voted no on the basis of it being slower than the current unassisted world record.
I might finish another TAS some day...
Editor, Experienced Forum User, Publisher, Skilled player (1323)
Joined: 10/12/2011
Posts: 6053
Location: The land down under.
PSX TASer of 2016
FractalFusion wrote:
Spikestuff wrote:
"...with the first 125 minutes..."
There is not even 91 minutes in this TAS. Anyway, I don't think it does any good to link such encodes here. The TAS at 20x speed moves too fast to be taken seriously.
Yay quoting videos... It does say preview in the title so I'm just going to guess a serious encode will be showing up from ZZAZZ
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. These colours are pretty neato, and also these.
Sanqui
Any
Experienced Forum User
Joined: 4/25/2011
Posts: 33
Hi, I'm the person who figured out and documented the coin case exploit. I still think that using it, werster's glitched speedrun can be beaten, but I haven't gotten around playing with different vectors than the one in New Bark yet (which is obviously undesirable).
ovo
Editor, Experienced Forum User, Skilled player (1384)
Joined: 7/9/2010
Posts: 1312
Glitchy TAS of 2015NES TASer of 2014Speedy TAS of 2014NES TAS of 2013
I am also voting no, because it's much slower than the RTA WR. I think a TAS would maybe a hour long. You sure know how the game works, but you didn't know how to handle TASing very well. I hope you make an improved version.
Favorite animal: STOCK Gt(ROSA)26Sortm1.1(rtTA,EGFP)Nagy Grm7Tg(SMN2)89Ahmb Smn1tm1Msd Tg(SMN2*delta7)4299Ahmb Tg(tetO-SMN2,-luc)#aAhmb/J YouTube Twitch
Patashu
He/Him
Experienced Forum User
Joined: 10/2/2005
Posts: 3868
Ideally, with all the people interested in pokemon gold glitchhunting ATM we'll see some collaboration arise and curbstomp the game into oblivion.
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Joined: 9/30/2013
Posts: 1
OK, I understood. I wasn't aware of the unassisted record time, and after gathering some more information, I found out that big amounts of time were wasted in certain parts of this run. I would expect that from my first TAS. I will try to better understand the concept of TASing and optimize this run. Hopefully, I will get this under an hour.
Experienced Forum User
Joined: 11/21/2006
Posts: 94
This does personally bring up a question: What ending should a glitched run go for? This glitches straight to the Hall of Fame, but that's not where normal Gold runs usually end; they go up to beating Red.
Experienced Forum User
Joined: 5/14/2007
Posts: 507
Location: Pisces-Cetus filament
Good luck with the improvement, TheZZAZZGlitch! I look forward to it.
Miles wrote:
This does personally bring up a question: What ending should a glitched run go for? This glitches straight to the Hall of Fame, but that's not where normal Gold runs usually end; they go up to beating Red.
That question has an easy answer: The run should finish when it reaches the credits.
AzumaK wrote: I swear my 1 year old daughter's favorite TASVideo is your R4MI run :3 xxNKxx wrote: ok thanks handsome feos :D Help improving TASVideos!
Editor, Experienced Forum User, Publisher, Skilled player (1323)
Joined: 10/12/2011
Posts: 6053
Location: The land down under.
PSX TASer of 2016
Final input after beating Red, as in after talking to him "..."
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. These colours are pretty neato, and also these.
Experienced Forum User
Joined: 11/21/2006
Posts: 94
Zeupar wrote:
That question has an easy answer: The run should finish when it reaches the credits.
But the game plays the credits twice. Regular runs don't end the first time they play.
Editor, Experienced Forum User, Publisher, Skilled player (1323)
Joined: 10/12/2011
Posts: 6053
Location: The land down under.
PSX TASer of 2016
Miles wrote:
But the game plays the credits twice. Regular runs don't end the first time they play.
Spikestuff wrote:
Final input after beating Red, as in after talking to him "..."
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. These colours are pretty neato, and also these.
Experienced Forum User, Experienced player (943)
Joined: 7/24/2013
Posts: 175
TAS of 2017Glitchy TAS of 2017Gameboy TAS of 2017Gameboy TASer of 2016Gameboy TAS of 2016Gameboy TASer of 2014Lucky TAS of 2014Gameboy TAS of 2014Lucky TAS of 2013
Sanky wrote:
Hi, I'm the person who figured out and documented the coin case exploit. I still think that using it, werster's glitched speedrun can be beaten, but I haven't gotten around playing with different vectors than the one in New Bark yet (which is obviously undesirable).
I looked into the coin case glitch a little, it isn't the position that decides where your jump goes, but the window location of the background tile buffer. The details are somewhat technical, I probably post a more in-depth explanation in the glitch city forum thread when I have more time for it, but basically you get the jump from virtually anywhere on the map, not just New Bark, which makes the glitch far more useful and in particular would make this run faster.
Patashu wrote:
Ideally, with all the people interested in pokemon gold glitchhunting ATM we'll see some collaboration arise and curbstomp the game into oblivion.
I havn't had much time lately, but as I said, I'm up for improving the Gen II time as well. I'm currently working on the disassembly, as it has proven useful for Gen I and allows for better understanding of game and glitch mechanics (I found both the Inventory underflow glitch and the application of the Transform glitch by actually reading the assembly, and not by randomly playing around). Maybe something interesting comes up in Gen II as well.
Experienced Forum User, Experienced player (943)
Joined: 7/24/2013
Posts: 175
TAS of 2017Glitchy TAS of 2017Gameboy TAS of 2017Gameboy TASer of 2016Gameboy TAS of 2016Gameboy TASer of 2014Lucky TAS of 2014Gameboy TAS of 2014Lucky TAS of 2013
Regarding the actual submission, I see the same problems that where already mentioned:
  • The movie is not optimized
  • The movie does not beat all existing records
  • The movie does not complete the game
Game completion in GSC is commonly defined by beating Red and not by beating the Elite Four or reaching the credits, since beating Red is the last story element in the game. With glitched endings however, this is a tricky definition, we may need to define more precisely what is required. For example, would it be allowed to skip fighting Red and jump directly to the text when he lost? Would it be allowed to do it outside Mt. Silver, without even seeing Red ever? Sadly, I found no useful indication in the game's memory that shows beating Red, all there is is one flag that determines whether Red is hidden, which is initially set, unset by beating the elite four and then again set after beating Red.
Editor, Experienced Forum User, Publisher, Skilled player (1323)
Joined: 10/12/2011
Posts: 6053
Location: The land down under.
PSX TASer of 2016
Fight skipping should be allowed as it's a major glitch to skip the fights...
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. These colours are pretty neato, and also these.