This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Topics - Torchickens
« on: Yesterday at 02:26:32 pm »
The data for glitch Pokémon Pokédex is retrieved from a specific location in the Game Boy address BUS. In Pokémon Red, this address should be the value of register de when a breakpoint is set to 10:436D and the Pokémon's Pokédex entry is loaded.
A good number of glitch Pokémon take their data from writable memory, including:
(You must have not set the glitch Pokémon's capture flag
to see its Pokédex entry)
Thanks to the Pokémon Red disassembly, we know the data is formatted like this.
*(Species string terminated by 50).
*Four bytes apparently affecting height and weight.
While the text code (usually?) begins with 17, which is apparently the "text far" command we could replace it with 08, which allows us to execute arbitrary code following the 08.
The addresses marked with an asterisk probably have the most potential to be abused. In particular D6 (B417) and DC (AA00), which is somewhere in the Hall of Fame data for SRAM bank 0.
When I caught a glitch Pokémon it appears that the SRAM was left open, so hopefully we may be able to add a bootstrap code here to items or a different location to execute arbitrary code, provided that we catch a 0xD6 or 0xDC with the LOL glitch.
Chances are if you are able to catch these glitch Pokémon using the LOL glitch you already have access to the expanded items pack, which sadly makes this glitch unnecessary as you could modify the map script in the expanded items pack or bring up an 8F for arbitrary code execution but it's still a nice glitch.
« on: April 13, 2017, 04:17:22 am »
As is known, the Japanese and English versions of Pokémon games cause communication errors when linked together.
However, something that got me wondering is it possible that we could abuse this to obtain a ?????, hence making the bad clone glitch easier for people who don't have Stadium 2 or don't want to use Coin Case/glitch TM/glitch Pokédex mode arbitrary code execution?
While I was linking up a Japanese Gold with an English Gold one of the versions interpreted some of the Pokémon as ?????. Sadly I couldn't trade it as it was deemed to be abnormal.
Thanks to the work of Háčky
however, we know that if a Pokémon is not a hybrid, is not over level 100 and has matching types it can be traded without being interpreted as abnormal. I don't know for sure if this applies to ?????, but I seem to remember it does apply so we could potentially trade over the ?????.
« on: April 11, 2017, 09:24:06 am »
This is a thread for noting errors/omissions in the GlitchDex that need to be resolved:
*The base 123 Defense for 4( h 4 ?
should be base 128 according to the data
*The base Attack for the Family 209
glitch Pokémon in Red/Blue (Base 255 Attack) is incorrect?
*Since some glitch Pokémon have ( in their names, this breaks the name system which thinks the bracket is part of the glitch Pokémon's family data (Pokédex number).
*Cries need to be added for glitch Pokémon due to the old links no longer working.
*Methods of obtaining glitch Pokémon need to be updated for a few remaining glitch Pokémon.
*TM/HM moves and Time Capsule exploit moves need to be added for a few remaining glitch Pokémon.
*Super Glitch moves should have their index numbers indicated in the data. Also a question worth raising is "are there any 'non-Super Glitch' moves which never cause Super Glitch corruption?".
*Add the index numbers for types for glitch Pokémon with glitch types and 'pseudo real' (is said to be a real type but is really a glitch type) types.
« on: March 23, 2017, 10:35:01 pm »
I'm considering recording all of the glitch Pikachu cries by ID.
If anyone else would like to help, you can enter the following code for ws m.
Valid values only range from 0x00 to 0x29, which leaves the rest of the values as glitch sound clips!
If we want to represent this with reasonable items, prepare:
Repel x (cry ID)
Poké Ball x 6
Fresh Water x 33
Master Ball x 64
Soda Pop x 45
TM05 x 132
Lemonade x 201
(1e 02 04 06 3C 21 01 40 3d 2d CD 84 3E C9)
Hope this comes useful for anyone else who would like to experiment!
Edit: (Some) may differ depending on the location you play them.
« on: March 22, 2017, 06:00:04 pm »
It looks like there is an obscure glitch involving the move Pursuit in Generation II that was documented by someone or a source named Uwasa Ishi (Japanese: 噂石). I'm unsure if it only works on the Japanese versions but from what I gather it seems like if you switch out a Pokémon with a status condition and it faints from Pursuit, the status condition will return upon reviving the Pokémon with a Revive.http://hakuda2.web.fc2.com/wario/poke3/n8.html
I haven't tested this glitch yet though. Thoughts?
« on: March 22, 2017, 04:57:11 pm »
In Pokémon Crystal there is a character which I don't remember being used on any NPC, which I found listed on a list of character indices on the Pokémon Crystal disassembly (https://github.com/pret/pokecrystal/blob/master/constants/sprite_constants.asm
This character can be viewed on BGB (v1.5.2) with the code 013F54D1 but the code working may be due to a presumable emulation error (as I tried the code on an Xploder GB with Pokémon Crystal on a real Game Boy Advance SP and it didn't work).
These are his sprites with the male character's palette.
Video of the code in action:https://www.youtube.com/watch?v=9_oacF2y9pc
« on: March 17, 2017, 02:39:49 pm »
As Crystal_ documented (thread
), not every Pokémon's level-up and evolution data is taken from the ROM, and there are exactly four glitch Pokémon each in both Red and Yellow who actually take their evolution data from VRAM (graphics data).
This is the list of applicable glitch Pokémon, copy and pasted from the wiki article I have just written:http://glitchcity.info/wiki/Arbitrary_learnset_glitch_Pok%C3%A9monRed/Blue
Beginning of pointer table=$3B05C
A (0xEA) (VRAM $8124) — It learns certain moves when levelled up with Rare Candies but no moves when levelled up in battle.
Glitch (0xEB) (VRAM $992B)
G'Mp (0xF6) (VRAM $852C)
94 h (0xF9) (VRAM $9A20)Yellow
Beginning of pointer table= $3B1E5
'r ゥ (0xEA) (VRAM $8124)
4 h 4 (0xEB) (VRAM $992B)
ゥ ₽ A (0xF6) (VRAM $852C)
₽ (0xF9) (VRAM $9A20)
According to Okk and echinodermata, level up evolutions are read when there is data in the form "01 [level] Pokémon ID]".http://forums.glitchcity.info/index.php?topic=5217.0
In Yellow, after entering a map or saving and resetting, the location of $9A20 may be taken from one of the screen tiles.
Very fortunately, 01 01 15 can be represented by block 09 in Cinnabar Mansion, and when it is at the bottom-left corner of the screen in this spot on 2F you have a chance of evolving ₽ (0xF9) into Mew at Level 1 due to the VRAM data representing evolution code to evolve it into Mew. (You must save and reset the game at this spot with your ₽ (0xF9))
Sadly for unknown reasons it's only a chance and a rather low chance at that it seems; your ₽ (0xF9) may evolve into Q or Nidoran♂ many times but never Mew, until you reset and try again hopefully to get a successful attempt. I don't know why and wonder whether it's to do with VRAM banks.
What's left to do now is test the other locations and whether this works on Red/Blue.
Edit: OK, you should be able to do this with 0xEB too except the data has to be in this green block and I'm not sure how easy that is to do as I couldn't align the 01 tiles and then that tree in the aforementioned map here.
Edit 2: 0xF9 confirmed on Red in addition to Yellow.
« on: March 08, 2017, 07:08:12 pm »
« on: March 01, 2017, 02:09:32 pm »
I have a policy of owning every game I emulate. Does anybody know any Korean redirection services for buying Pokémon Geum and Eun on a Korean shopping/auction site?
I'm willing to invest some money to buy one even if the price is a little expensive.
Thanks in advance!
« on: March 01, 2017, 01:58:40 pm »
Although valid source Glitch Cities like those from the Safari Zone exit glitch
are well-known, not too much research has been into the 'pure' glitch maps with their own map IDs.
These are the current glitch maps with articles.http://glitchcity.info/wiki/Category:Glitch_areas
Practically it's probably not going to be viable to make an article about every non-freezing map, since there are a huge number of possible maps in Gold/Silver/Crystal (65536 for each version) unless a tool is created to find the glitch maps that do not freeze the game.
If you find a glitch map that doesn't freeze the game in any revision of Red/Blue/Yellow, Gold/Silver/Crystal let me know and I will make an article about it, and have fun glitching!
Do note these maps do not seem to be that common, although not many have been researched.
Codes to find glitch maps:Generation I
Activate in a Pokémon Center then step out.
EN Red/Blue: 01xx65D3
EN Yellow: 01xx64D3
Japanese versions: 01xxE4D2
Non-English European Red/Blue: 01xx6AD3
Non-English European Yellow: 01xx69D3
) for a list of real maps.Generation II
Activate before entering a door.
EN Gold/Silver: 01xx44D0, 01xx45D0
JP Gold/Silver: 01xx3ED0, 01xx3FD0
KO Gold/Silver: 01xxFFD0, 01xx00D1
Non-English European Gold/Silver: (Unknown)
Activate in a Pokémon Center, go the floor 2 and down the stairs again.
EN Crystal: 01xxB5DC, 01xxB6DC
JP Crystal: 01xx7BDC, 01xx7CDC
Non-English European Crystal: (Unknown)
for a list of real maps.
Walk through walls (for stepping out of bounds into glitch maps)
Non-English European Gold/Silver:
« on: January 26, 2017, 05:53:31 am »
Apparently there are a number of bugs in how Pokémon Bank works, according to this post
Discovered so far:
In Generation 2, shininess is determined by IVs - specifically, Speed/Defense/Special must be equal to 10, and Attack must be 2/3/6/7/10/11/14/15. (Note that IVs only go up to 15 in the Game Boy games). Pokebank attemps to take this into account, but gets the role of the Attack and Defense IVs exactly backwards. Meaning, Pokemon that would be shiny in GSC lose their shininess, and other pokemon will gain shininess.
Pokemon will not be allowed to transfer if they have moves that can be learned in one Gen 1 game, but not another. For example, your friend can transfer his Charizard with Fly that he taught it in Yellow, but if he trades it to your copy of Red it cannot be transferred.
Gender when transferring is completely random, rather than based on the Attack IV like in gen 2. Considering the above (failed attempt at) shiny compatibility, they obviously are trying to keep everything consistent with GSC, but random genders mean that - once GSC is released for VC - a Pokemon traded from gen 2 to gen 1 to gen 7 will lose its gender.
There's also a few other... oddities, shall we say, with how the conversion is done. Ones that aren't outright bugs like the above, but are surprising.
Nature is generated from - of all things - the Pokemon's EXP. This means that 1) catching the same Pokemon at the same level and immediately transferring will always get you the same nature, and 2) it is simple to choose the nature you want by only transferring when the experience is right.
EVs are simply set to zero, the Pokemon's previous stat exp is ignored entirely. This is actually the only thing on the list that makes sense, since the two systems are fundamentally incompatible.
The original IVs are also ignored entirely. After being used for the (incorrect) shiny calculation mentioned above, they are simply regenerated from scratch. All Pokemon will automatically have 3 perfect IVs, except for Mew which will automatically have 5.
Kudos to SciresM for discovering most of this.
Zai Redwinters also stated in a comment on my latest video
that legal moves are based on a Yellow version whitelist. This goes against the claim that Charizard knowing Fly cannot be transferred over from a Red/Blue, but they give the example of Mewtwo knowing Pay Day (in all Generation I games except for Yellow) being unable to be transferred over in a certain version (or possibly both versions).
« on: January 26, 2017, 03:38:21 am »
I've been looking into glitch stages in Balloon Fight GB, the Japanese enhanced version of the Game Boy game Balloon Kid. I feel it is a change to something like for example Super Mario levels in which glitch levels have been researched relatively well (which makes me wonder what glitch Kirby's Dream Land, Trip World stages there might be).
Years ago I got at least one of these to work in Balloon Kid as well. I don't know anything about glitch worlds in Hello Kitty World for Famicom (based on Balloon Kid but with Hello Kitty instead) however.
To access a glitch world use 01XX07C0 on the stage select screen and press A.
A glitchy Vs. Stage. Samm appears.
A glitchy Vs. Stage. A glitchy Samm appears.
Another glitchy Vs. Stage with a glitchy Samm.
0D (Stage-| ||):
Balloon Trip mode but you get multiple attempts. You don't get a Game Over screen however, just the 'failed' jingle from the original Balloon Fight and are sent back to the title screen.
0E (Stage-|| ||):
Takes you to the bonus room where you have to get balloons from pipes. Later you are warped to a glitchy exit. The game said Stage 1 cleared and unlocked Stage 2.
0F (Stage 'right side of a blue zero on the left and white space on the right'):
A sound effect for getting knocked out plays. The game loads a glitchy screen and freezes.
I've looked into the Stages up to $50 and there were no more Stages that actually load something and keep it, unless the memory could be adjusted for the Stages which execute RAM. Hopefully there will be more Stages which do and are worth noting.
Perhaps all of the aforementioned Stages are technically used but they were loaded in the wrong way.
« on: January 26, 2017, 01:21:36 am »
[quote author=ScorelessPine link=topic=7809.msg203967#msg203967 date=1485412388]
I am looking if anyone knows of a way to do what they did [url=https://www.reddit.com/r/pokemon/comments/5q4meg/how_to_trick_pokebank_into_thinking_your_gen_1/]here[/url] in pokemon Yellow instead of pokemon red/blue? I have heard that there is a similar arbitrary code execution glitch item in yellow besides 8F, but I do not know how to do it by myself. If at all possible, I would also like to know how to edit the pokemon's DV's to make it 10/15/10/10 so that when it transfers it will become shiny. Thank you if you are able to help me.
Hi, the glitch item is known as "ws m" (hex:63). This runs on stored Pokémon first instead of party Pokémon, so you need [url=http://forums.glitchcity.info/index.php?topic=6638.msg194861#msg194861]specific Pokémon in the storage system[/url] for it to work.
The fastest way to set it up is probably via unstable stable Missingno. from a save file erased with Up+Select+B (if the sixth item was a Potion, you use two of them after getting 129 and then catch unstable stable Missingno. which should have 100% catch rate due to the corruption). It's wise to pick up as many items as possible to fill the items pack.
Then you can use [url=http://glitchcity.info/wiki/Expanded_item_pack]dry underflow[/url] to get the expanded items pack. From here consult [url=http://forums.glitchcity.info/index.php?topic=6914.0]luckytyphlosion's guide[/url] for what the items beyond slot 20 pertain to.
Video tutorial: https://www.youtube.com/watch?v=DDkema91-vo
Or if you want to do it later you can encounter a Fossil/Ghost MissingNo. with Trainer-Fly, either via the [url=http://glitchcity.info/wiki/Trainer_escape_glitch#Ditto_trick]Ditto trick[/url] with a Special stat between 182-184 or a [url=https://www.youtube.com/watch?v=73fAlzIbi9k]double Trainer-Fly; you talk to a Cubone trade girl to encounter a level 80 Starmie and use it's Special for a low chance of stable MissingNo.[/url] (I think the latter option is better personally).
Then you can warp to Celadon and use [url=http://glitchcity.info/wiki/Celadon_looping_map_trick]Celadon looping map trick[/url] to dig up items like "ws m" and the other items you need from your x-coordinate (and if x-block or the quantity is 0 you can toss from 0 to get any quantity as it is essentially a x256), teleporting back to Celadon for every item you obtain.
Then you can use [url=http://glitchcity.info/wiki/Rival LOL glitch]Rival LOL glitch[/url] to get the stored Pokémon you need (you will still need to dig up Rare Candies from Celadon to adjust Tangela's HP to 233), or just trade them over from another Red/Blue/Yellow.
I will try to port over the Red/Blue codes for event Mew and Shiny Mew in the Reddit, one moment..
[color=#ff1493]Edit: The only adjustment you need for the Mew OT and ID change code is to have X Accuracy x118 instead of X Accuracy x119.
Here is a code dump from D31D as it's useful for fast editing with a memory viewer:
For the Shiny Mew code you'd need to deposit Mew as the first stored Pokémon, and use X Accuracy x177/ x176 where you must use ws m twice, tossing from the X Accuracy before the second time. The only problem is that ws m runs from stored Pokémon and you need a specific set up, not Mew there. So will rewrite this to work for party Pokémon.
I haven't tested this myself yet but there should be a significantly easier way. If you name yourself "GF", save the Slowpoke Trainer for later, set up dry underflow glitch
, change item 30 quantity to 89 and item 31 to Burn Heal when you catch Mew it should have the same details as the event Mew (ID 22796) and be valid. Not sure if giving it a nickname will make it invalid but it's best not to to be safe. This works because 22796 in hexadecimal is 590C. hex:59 as an item quantity is x89 and hex:0C as an item is Burn Heal.
« on: January 23, 2017, 06:05:51 pm »
This glitch was already documented on Japanese websites but I'm unsure if it has ever been discussed in English before.https://www23.atwiki.jp/pkmnbw/pages/95.htmlhttps://www.youtube.com/watch?v=ZZh6g3FQQaQ
The glitch is there is a spot in Opelucid Gym one step above the picture below you can Surf on. Surfing into this spot will trap you and it seems like if you save and reset the game you are stuck forever(?).
This glitch is similar to the Opelucid Gym air walk oversight
but unlike the Opelucid Gym air walk oversight (which occurs in both Japanese and English versions) the Surf glitch seems to be Japanese only.
I plan on uploading a video of this glitch tomorrow.