Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - Krys3000

Pages: [1] 2
Hi folks,

Following my recent work on an easier Yellow ACE using the Day Care and the 4F item, I wanted to demonstrate that the not-so-well known Pikachu Off-Screen ACE can be improved to avoid the ~75 Pokémon battles.

If you don't know about POS Code Execution, see this video from Torchickens.

Anyway, instead of using the trained Pokémon, I suggest we use one of the three following configurations:

4 moves configuration

- 5th Pokémon would be a Nidorina or Nidorino. It has to have been traded to G/S/C, hold a Moon Stone there and then be traded back to Yellow.
- This Pokémon must have 2 'placeholder moves' (typically Bite and Fury Swipes, since it learns both) followed by Double Kick (also learned) and Bubblebeam (TM11).
- The 6th Pokémon can be anything but requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
- The code starts from item 3, so it is performed in a similar fashion than using 4F/wslm.

Code: [Select]
WRA1:D221 08 [cc execute]
WRA1:D222 2C inc l
WRA1:D223 9A sbc d
WRA1:D224 18 3D jr D263
WRA1:D263 C3 21 D3 jp D321

2 moves + HP/Box Level configuration

- 5th Pokémon would be a Nidorina or Nidorino. It has to have been traded to G/S/C, hold a Moon Stone there and then be traded back to Yellow.
- This Pokémon must have Double Kick (learned) as first move and Take Down (TM09) as second.
- The 6th Pokémon can be anything but must have 24 HP currently and also have been lvl24 last time it was stored in the PC.
- This Pokémon requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
- The code starts from item 3, so it is performed in a similar fashion than using 4F/wslm.

Code: [Select]
WRA1:D221 08 [cc execute]
WRA1:D222 18 24 jr D248
WRA1:D248 00 nop
WRA1:D249 18 18 jr D263
WRA1:D263 C3 21 D3 jp D321

4 moves + Glitch Pokémon configuration

- 5th Pokémon would the glitch Pokémon PKMN pゥぁ ゥぇ, that can be obtained via several glitches (although not the Ditto Trick - best is probably LOL Glitch), Equivalent Trade or Time Capsule Exploit.
- This Pokémon must have Ice Punch, DoubleSlap, Double Kick and BubbleBeam (all can be learned except Bubblebeam which is TM11)
- The 6th Pokémon can be anything but requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
- The code starts from item 3, so it is performed in a similar fashion than using 4F/wslm.

Code: [Select]
WRA1:D221 2D [not read]
WRA1:D222 08 [cc execute]
WRA1:D223 03 inc bc
WRA1:D224 18 3D jr D263
WRA1:D263 C3 21 D3 jp D321

Untrained Hitmonchan configuration

Since all previous setup require trading or glitching, here is the only tradeless/glitchless/trainless setup that will work most times.

- 5th Pokémon would be Hitmonchan
- This Pokémon must never have been trained, but must know Strength (HM), Agility, Fire Punch and Ice Punch. This requires rising it to lvl 38 with Rare Candies.
- This Pokémon must also have 00 PP currently at Strength, 24 at Agility, 14 at Fire Punch (Ice Punch doesn't matter)
- The 6th Pokémon can be anything but must be lvl25, requires currently 24 HP, 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
- The code starts from item 3, so it is performed in a similar fashion than using 4F/wslm.

The code can be broken at any time by Hitmonchan's IV. The best way is to reset the pick of Hitmonchan to make sure that yours work. For this setup to work, you must check that when converted into hexadecimal, Hitmonchan's trainer ID won't trigger invalid opcodes or many-bytes opcodes

Code: [Select]
WRA1:D221 2D [not read]
WRA1:D222 46 [not read]
WRA1:D223 61 [not read]
WRA1:D224 07 [not read]
WRA1:D225 08 [cc execute]
WRA1:D226 ?? depends on the trainer ID
WRA1:D227 ?? depends on the trainer ID
WRA1:D228-D234 00 nop
WRA1:D235 ?? depends on Hitmonchan's IV
WRA1:D236 ?? depends on Hitmonchan's IV
WRA1:D237 00 nop
WRA1:D238 18 0E jr D248
WRA1:D248 18 19 jr D263
WRA1:D263 C3 21 D3 jp D321

Underflow-based configuration

For informations about a way to use the expanded item pack for an easy setup, see here:

I wanted to adapt these to european non-english games, though the POS ACE does not seem to work in non-english games - or at least doesn't seem to read from $D221.
Well, here's a setup for english games that should do the job.

- Place/withdraw at the Day Care a Female Nidoran with Bite, Fury Swipes, Double Kick and Growl (the first two moves are placeholders and can be something else)

- Store :
1. Any lvl25 Pokémon with currently 24 HP, 33 PP currently for the first AND second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
2. Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP

Hey there,

Here's an unusual setup for Yellow games only, using 2 Pokémon only (and a third one but temporarly and not in the PC), instead of 10.

You can use the celadon loop trick to get 4F / S3 (german) / P3 (italian) / 3EME ETAGE. You have to perform 4 steps less than for wslm. Original discovery of the behavior of the 4F item is from Tagada67 on PRAMA's board:

4F executes from Echo RAM $FA64. In English games, this is the catch rate of the last Pokémon that visited the Day Care (or the current one). In European non-english games, it's the first current HP byte of that Pokémon.

Note that if you never placed a Pokémon in the Day Care, this item nops until stored Pokémon, so it behaves EXACTLY like wslm, meaning the traditional setup works with 4F. Otherwise, placing (and immediately withdrawing) any lvl25 Pokémon (lvl29 in non-english games) with currently 24 HP will make it jump to stored Pokémon, so it will work also.

Now here's the setup:

English game

- Place and withdraw (or not) at the Day Care a Nidorina (that apparently should not be evolved from a Female Nidoran), with Bite, Fury Swipes, Double Kick and Growl (the first two moves are placeholders and can be something else, the last two are learned)

- Store in the active PC Box:
1. Any lvl25 Pokémon with currently 24 HP, 33 PP currently for the first AND second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
2. Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP

- Execute code with your items

Code: [Select]
WRA1:DA64 78 ld a,b
WRA1:DA65 2C inc l
WRA1:DA66 9A sbc d
WRA1:DA67 18 2E jr DA97
WRA1:DA97 18 19 jr DAB2
WRA1:DAB2 21 21 D3 ld hl,D321
WRA1:DAB5 00 nop
WRA1:DAB6 04 inc b
WRA1:DAB7 00 nop
WRA1:DAB8 E9 jp hl

European non-english game

- Place and withdraw (or not) a lvl80 Pokémon with currently 24 HP in the Day Care.

- Store in the active PC Box:
1. Any Pokémon with 33 PP currently for the first move, 38 PP currently for the second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
2. Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP

- Execute code with your items

Code: [Select]
WRA1:DA64 00 nop
WRA1:DA65 18 50 jr DAB7
WRA1:DAB7 21 26 D3 ld hl,D326
WRA1:DABA 00 nop
WRA1:DABB 04 inc b
WRA1:DABC 00 nop
WRA1:DABD E9 jp hl

This setup is still perfectible though so don't hesitate if you can improve it :D
Generation III Glitch Discussion / Hints in Gen III Trade Cloning
« on: May 29, 2017, 04:13:17 pm »
Hello everyone,

As you know, cloning by shutting down the console during a trade, which can be done in games from Generation I, II, IV, V and VI (still to be confirmed in VII, as far as I know) is largely considered to be not functional in Gen III, because of two reasons:
- GBA link cable can send and receive simultanously
- Data from unfinished trades are deleted

However, someone named Gary6318 now claims on PRAMA having successfully cloned by trade cloning under these conditions:
- Ruby and Firered
- Using the Game Boy Player (the GameCube thing)
- He didn't actually shut the game but the FR game froze for unknown reason right after the trade started, when you see the GBA on screen.

He has no video/picture proof as of now. Assuming he's not lying, could there be a frame where the trade is actually possible? Could this be related to the use of the Player, or the fact that it froze?

What do you think?
4G glitches are harder to explain because of we don't have the tools that we have in 1G/2G glitchology. However, I was wondering if someone has some explanations about the way the Rage Glitch and Acid Rain Glitch works.

I know that in 1G, the Rage move continues until the Pokémon faints, or until there is no opponent; and each time the attacker was hit, its ATK modifier rises up. From 2G on, Rage has to be reselected every turn and there is a specific Rage counter which has the same effect as if the ATK modifier was risen. Though, at this point, if you stop using Rage, the counter goes back to 0.

When this was developed, a specific routine had to be done. Probably there is a flaw in the 4G version of it; for some reason, this routine probably requires a "refreshing" of the attacker's moves (maybe to check out if Rage was still used? I can't find out) and since the Pokémon is morphed during the glitch, it just copies the wrong moves.

Do you have some clues about this? As for the Acid Rain Glitch, I have no clue at all.
It works for Darkrai. That's truely amazing, thanks!
Generation II Glitch Discussion / Call glitch?
« on: December 11, 2016, 08:43:25 am »
Hello guys,

A while back, I've been told that in Cristal only, if you call a friend then ask your Mom to change the hour, there are good chances that someone will randomly call you immediately.

Could this be a glitch in subroutines or somewhat?

Generation IV Glitch Discussion / Destiny Bond glitch ?
« on: November 06, 2016, 08:03:54 am »
Hi everyone,

A guy named Guilz contacted me on Facebook to share a glitch with Destiny Bond in HG/SS. Apparently, if you use the move, then keep using items, Destiny Bond stays active as long as you use items. That means if someone beat your Pokémon after 3 turns in which you used items, Destiny Bond will affect the opponent.

I wasn't able to test this on HG/SS but Haxel did it on OR/AS and it didn't work. Is this known to someone? Was it a normal feature in 4G?
Hello there!

As you all probably know, the Tweaking Trick is a 4G glitch with many utilities. It involves moving on loading lines to generate "voids", and is rather limited in Platinum, Heartgold and Soulsilver, being most known for allowing, in Diamond and Pearl, the player to cross the void to reach Fake versions of Sinnoh that you can use to catch Shaymin and Darkrai.

While the tweaking process may cause some problems to users, the major limitation of this glitch is the time you need to reach a Fake-Sinnoh. Depending on your luck, you will be able to use your first Fake-Sinnoh to get the Pokémon you want, or you will have to continue searching for a usable Fake-Sinnoh, which can take literally forever.

A few months ago, a tweaker called Ankeraout developed a lua script for DeSmume to make all of this a piece of cake. Originally, it only worked on french games. Now, it is compatible with other european, US, and japanese games. What PATH (standing for "PRAMA's Advanced Tweaking Heaven") can do is:
- Display a joypad, your X/Y coordinates, matrix, centerpiece and map ID ; load lines on top screen ; your current position in Sinnoh on the bottom screen (which is very cool when you're in Fake-Sinnoh, when combined with the berry map)
- Automatic tweaking, accordingly to the way you need to tweak a line to generate whatever you need.
- Instant warp to any Fake-Sinnoh/Johto/Kanto of your choice, which makes the whole process useless and allows you to check a lot of Fake-Sinnoh for the ability to work with Shaymin/Darkrai in just minutes.
- Automatic steps because you're too lazy to press keys so the script will do that for you.

PATH is user-friendly but is in french, currently. This is why I post a translation of the menus here, if this helps someone.
UPDATE: PATH now includes english language. You can change to english using the menu.. I'll just let the explanations anyway.

How to run the script

Load your game, then go to Tools > Lua Scripting > New Lua Script Window > Browse. You only have to load path.lua in the archive. Stuff displays on the top screen, and you can now use the script.

Press your keyboard key assigned to the L key of the DS to display PATH's menu on the bottom screen. You can now use the keys assigned to A and B to validate and return. L again to close the menu.

Displaying stuff

"Affichage" (display) contains stuff to display:
- Joypad (speaks for itself)
- "Infos du jeu" (game informations). This displays all that I've mentioned before, and also gives you the X/Y coordinates of your current (Fake-)Sinnoh. X increases when you go East and decreases when you go West, Y increases when you go South and decreases when you go North. That means Fake-Sinnoh South-South-East is X=1 Y=2.

"Lignes de chargement" = load lines

As you can guess, "FS Map" is the option displaying your position in Fake-Sinnoh. This cannot be used in Heartgold and Soulsilver games.

Automatic tweak

You must use "Tweak automatique" for that. It then displays all the available tweaks for your loaded game and you have to choose.

SLOW and FAST indicates whether you have to be on slow bike or fast bike (using B button).
"Bas" = Down
"Haut" = Up
"Droite" = Right
"Gauche" = Left

What you need to know here is where you need to move the chunk. For example, here in Jubilife, in the standard tweak used for Shaymin and Darkrai, to move Route 203 from the upper-right corner to the upper-left corner, you need to select "(SLOW) Haut-droite -> Haut-gauche".

Warping to Fake-Regions

This ultimate time-saving option is in the "Teleportation" menu. You then have two choices:
- "Retour à la position normale" (back to normal position) brings you back to Sinnoh/Kanto/Johto.
- "Bouger d'un Fake-région ou bâtiment" (move of one Fake-Region or building) allows you to move to the next Fake-Region in a wanted direction. "Aller au Nord" means go North, "Aller au Sud" means go South, "Aller à l'Est" means go East and "Aller à l'Ouest" means go West.

You then just have to jump from Fakes to Fakes. Aside from the obvious use in getting legendaries in D/P, HG/SS voids being impossible to cross without cheating, this is a quick way to visit Fake-Kanto and Fake-Johto.

Note that from all tests I have done on french games, it seems West-West-West-South Fake-Sinnoh always has a usable location for Newmoon Island (Jubilife or a Route). It seems to be also the case of WN, WWSS, ESS, EEESS, OOSSS and OSSS as long as you have the bike and the first two badges. All other tested FS can either have a good location or not. Remember, tweaking trick is safe as long as you don't f**k up. Once you're there, don't save: just do XABB to refresh the screen, and if it DBSoD, you can restart the game and try another FS.

Programming a path to perform

The last option, "Trajet Automatic", starts the execution of a pre-registered path. To edit it, you have to edit "run.lua" using a text editor (notepad). Find this line:

Write the number of steps, then the direction, then the following instruction. E = East, N = North, S = South, O = West. Save and reload the script and use the option to start the process. PATH automatically detects walls in the void and bypass them if possible. If PATH is not able to finish exactly where it's supposed to, it will tell you.

You can stop at any time using "Arrêter" (stop).

Download link

PATH v.1.2.2
Support (french) :

Have fun!
Generation I Glitch Discussion / Anything about glitch types?
« on: March 24, 2016, 11:13:23 am »
Hey everyone,

As you know, gen 1 games had 15 types.

Normal     00
Fighting   01
Flying     02
Poison     03
Ground     04
Rock       05
Bug        07
Ghost      08
Fire       14
Water      15
Grass      16
Electric   17
Psychic    18
Ice        19
Dragon     1A

There are missing numbers in the list of hex IDs for types (no 06, 09->13) and I suddenly realize I don't know much about potential glitch types. When you change a Pokémon's type using Gameshark/Memory Viewer/ACE, the new type, while active, is not shown in the stat view. Do you guys know if every missing slot and everything from 1B to FF matches a "null type" with no effect at all or if someone has tested every slot against every real type to check for resistance and super-effectiveness?

No, and that's the point of the glitch - when you receive
Generation I Glitch Discussion / Expanded Experience Underflow
« on: October 08, 2015, 03:07:55 am »
Hey there,

You probably know the Experience Underflow Glitch that allows Pokémon from the Medium-Slow Experience group to jump from Lvl 1 to Lvl 100 by gaining less than 54 xp.

I discovered this glitch may be used on any other Experience group - meaning any Pokémon. At first, I wanted to do that with the International DKD Glitch but it appeared to be a dead end. So instead, here's two methods that both work.

Super Glitch method:

1. Get a Medium-Slow Pokémon at level 1 (with either Ditto Trick, Cooltrainer/LOL, or any other method) and place it in 6th position of your team.

1. Get a Pokémon with 27 letters combined in the 3 first moves, and Super Glitch as 4th move. There are actual ways to get a normal Pokémon with a Super Glitch move. For example, trade a lvl48 Haunter to a G/S/C game (it will learn Destiny Bond) then send it back to get the hex:C2 Super Glitch move instead. You can also use a glitch Pokémon.

2. Go here:

R/B - Open/close the Pokémon menu once then get into a fight and open/close the attack menu several times until the corruption appears. Something like that must happen:

Leave the fight.

Yellow - Open the Pokémon menu then visualize the moves of your Pokémon with the Super Glitch move several times until the corruption appears:

This is also what you get in R/B after the fight, because you now have 16 Pokémon.

3. Talk to a Pokémon Center nurse, but refuse to heal your Pokémon. This is to fix text boxes.

4. Switch Pokémon 6 (medium-slow) and 10. The HPs of Pokémon 1 become the decimal ID of your medium-slow Pokémon (e.g. 21 for Mew). Use healing items/HP Up/Whatever to change that number to the decimal ID of the Pokémon you would like to perform the Experience Underflow on. For example, I set the first Pokémon's HP to 131 to get Mewtwo.

5. Then switch back both Pokémon. Your lvl1 medium-slow Pokémon is now the wanted Pokémon at level 1. Gain less than 54 exp points and you will gain the levels. HOWEVER, using this method, because it only changes the memory address for the Pokémon's ID in the "list of Pokémon" section but doesn't change the address for the Pokémon's ID in the data of the given Pokémon (which contains the exp group) you won't reach level 100:

- Slow Group (ex: Mewtwo) => 105
- Medium-Slow Group (normal group for the glitch) => 100
- Medium-Fast Group (ex: Caterpie) => 98
- Fast Group (ex: Clefairy) => 91

If you want to reach lvl 100 precisely you must use the other method.

6. To fix the game, Store/Release every Pokémon beyond the 6th. To get rid of the corruption that affected some of your Pokémon, use the daycare. If your name is messed up by Super Glitch, you can reset it (although not in Yellow) by going there:

And doing another corruption (open/close the Pokémon menu, Pokémon encounter, open/close the attack menu).

8F Method

Cleaner method, but of course, 8F allows you to change a Pokémon's level without this glitch. Put your Pokémon at first position, then use this code that changes both bytes to the value of the wanted Pokémon. Because of this, your new Pokémon will fit to its own experience group and you will reach level 100 by gaining less than 54 exp points.

Any Item
8F / ws*l’||lm||
ThunderStone x100
TM09 x82
Lemonade x(dec ID of the wanted Pokémon)
Ether x119
X Accuracy x107
X Attack x119
TM01 x(any quantity)

Have fun!

Hey guys. This is something I started following my previous thread in which I discuss and show an example of using Glitch City regions matching with RAM data to perform the Cooltrainer Trick (based on TheZZAZZGlitch's previous discovery of a region matching with the items).

I decided to explore a little more of this and to "map" this specific Out-of-Bounds Glitch City by matching it with RAM data. The results are, I think, worth the try.

More importantly, I decided to work on an English version, since RAM addresses are +5 in other European versions like the french one I normally use

What is this about?

You can view most, if not all, the values of the game's RAM addresses by going to a specific glitch city, in form of 4x4 tile blocks. By doing this, you are literally WALKING on RAM. Basically, having the item whose hex ID is 3C in first position will make the tile block matching with the first item in this glitch city to appear as the tile block whose hex ID is 3C.

This is a tileblockdex for which you must note that some characters are different in english versions so it might lead to differences in some blocks :

It first was ISSOtm from our website PRAMA Initiative who developped a way to use the blocks generated by stored items to perform an item-custom cooltrainer as shown in the other thread.

Here I will explain how to visualise a lot more RAM data, so you can perform the Cooltrainer with, but also how to change the values directly through glitch city for other useful or entertaining purposes.

How to access to this Glitch City?

Using a glitch to walk through walls (e.g. the ledge method which is easy and doesn't require anything), you can access this OoB Glitch City by walking, starting from here (south of Fuschia City):

And walking 104 steps left then 95 steps up. This is an example entry point I use on my grid below:

Matching RAM with blocks

If you followed the steps above, you will be as indicated on a block matching with RAM address $D524. The GC is organized in rows of 56 blocks matching with 56 addresses, then you go back to block 1 of the following row for the following address. In this grid, I voluntarly skip the first three and last three addresses of each row.
You can visualize them but I don't recommand it, because their behaviour is random; they will turn into something else when you hit start (e.g. water, even though the value of this address does not match with water blocks). This makes them unusable for the Cooltrainer Trick, and also, you will not be able to manipulate their value anyway.

Here, I indicate which block match with which address using informations from datacrystal. As you can see, you can visualise the data from some Pokémon (stats, moves, names etc.), money, items, Pokédex, rival's name and much more. The big white space between player's ID and stored items is audio and tileset data. I don't know much on how to use them so I will not talk about this.

I personnally never went further the 5th Pokémon data but I assume you can continue to go up to find new data, such as you can go down and reach event flags or stored Pokémon.

If you intend to perform the cooltrainer trick, since you will need a block containing a tree below the block with the good tile for the Pokémon you want, the best thing is to use Pokémon data (since you can change stats) or stored items (using, for example, item 1 and 29 as I did in the video of the other thread). Of course, you can use "bag" items, and generate a tree from Badges data - this is what we did first at PRAMA before ISSOtm finds the stored items region.

Manipulating the data

Now what is really awesome here is that we can manipulate this data. This is very limited and certainly is not an in-game memory viewer. But you will be able to get 8F and ws||'lm|| with this, allowing you to execute code without MissingNo. or any form of corruption.

The only way for the player to change a tile block from one to another is this tile block having grass or a cuttable tree and cut it. There are 7 tiles block you can Cut (hex values 0B, 32, 33, 34, 35, 60, D5). This means if a value on ANY address you can reach is one of those, you can manipulate it.

- 0B is a grass block. Once cut, it will turn into block 0A. This lowers a value by 1, meaning if you wanted to have a special stat of 10 but unfortunately got 11, you can fix that.
- 32 is a block containing a cuttable tree in the upper right corner. Once cut, it becomes block 6D. This is a good way, for example, to turn a stat of 50 to 109.
- 33 has a cuttable tree in the down-right tile. Once cut, it becomes 6C.
- 34 has one in the upper-left corner and turns to 6F. This is the highest available value by GC RAM Manipulation.
- 35 has one in the upper-right corner too, and turns to 4C.
- 60 has one in the down-left corner and turns to 6E.
- 5D is a glitched block. Cutting the tree won't change anything to the tile, who will still have a tree and a hex value of 5D.

Outside from obvious uses of getting more money, more casino chips, or better stats for your Pokémon easily, this is also important because of hex value matching with items, moves and Pokémon.

Here is another excel table:

As you can see this is useless for player's name manipulation. So bad. About Pokémon, probably the only useful thing here is to change Lickitung for Exeggutor... and if you have the good MissingNo. I guess it's an easy way to get Poliwrath.
Then you can learn Solar Beam to any fire-type Pokémon which previously know Flamethrower. Considering this is a powerful attack you could use on a ground or rock-type foe.

But it becomes even more fun when you deal with items (besides having a whole lot of moon stones) as you can use this to get glitch items without the need for ACE or expanded item pack! Probably glitch items 6D and 6E are not realistic because you can't have the prototype PP Plus or 11F (floor) item in game.

Item 6C reads $3DED (ROM data) so it's probably useless, however using Item 6F execute code from $CDD1 which is inside a tile buffer ; this address particularly is a tile from the Start menu when it is open. The code here jumps to $9C60 which is a screen tile. I don't know is this can lead a code execution but I'll check that some day. It's not the most important part of this glitch.

Trigger a PC overflow and taking advantage of it

Now this is the most recent and maybe the major breakthrough here. You can have a maximum of 50 items inside the PC. 50 is hex:32, so it's a cuttable tile! If you cut the tree in it, it will turn into 6D... which is 109 stored items. You just activated an overflow.

Use the PC overflow to trigger an inventory underflow (and execute code)

The most complete form of using this is also very easy. You will have a lot of items x0 in this overflow. Just toss 1 item of one stack and withdraw the remaining x255. You don't need anything else to perform a regular dry underflow and get an expanded item pack.

Now you can use this to manipulate bytes and also get 8F / ws*l’||lm||. Click here to read more about 8F Code Execution.

Use the PC overflow to directly get glitch items such as ws*l’||lm||

If you play Yellow, you might wanna do this trick with 63 casino chips. Doing so, once the PC is at 109 items, your 52nd item will be ws*l’||lm||, which is the item you need to execute code. You don't even need to underflow your item menu anymore.

I'm working on a R/B adaptation of this but you can't have 5E (hex for the item 8F used in R/B code execution) chips. Maybe some addresses after can be used but they are indicated as "Missable Object Flags" and I don't know what that means.

Anyway, using the chips, you can get pretty much any item or glitch item whose hex value contains no letters. This includes a lot of "xF" and "x||lm||" items but I still need to watch if they are documented. Also Surfboard, Master Ball, etc. are easy to get.

Use the PC overflow to directly get the 8F item (or others items you could not get with the casino chips trick

From item 55 onwards, items match with the fact that you did or did not picked visible items on Routes (see posts below) with one address/item matching with the current status of 8 items (one per bit). Therefore, there is a way to use this to get some items, including the 8F item (hex:5D) for code execution.

if you have picked :
- Hp Up on Route 2
- TM04 on Route 4
- TM30 on Route 9
- TM16 on Route 12

But haven't picked :
- Moon Stone on Route 2
- Iron on Route 12

And the Snorlax in Route 12 is still sleeping, then 8F will appear as the 56th item in the PC.

Delete an item

Well this is a more a side trick but it can be useful if, for some reason, you wanna get rid of a rare, untossable item, or a glitch item. Then, just have 11 items (PC or held) with the last being this item. Then go to the number of items spot in Glitch City (the one according whether you chose to do that in the stored items or not) and cut the grass. The item will be deleted as the number of items drops to 10.

Sorry for the long post, I think it comes to an end now (for now). Next step is the dex. Don't hesitate to tell me what you think about all this!
Generation I Glitch Discussion / "Item Cooltrainer Trick" Manipulation
« on: August 31, 2015, 08:40:47 am »
Hello guys,

Here is a new video I made for PRAMA in which I show a new way to generate Pokémon with the Cooltrainer Trick using the stored items. This comes from TheZZAZZGlitch's video about Out-of-Bounds glitch city item manipulation, but it has been readapted by our tester ISSOtm that you probably know for being a wiki contributor here.

I don't think it has been researched or discussed previously by TheZZAZZGlitch or anybody else. Because of Youtube description limitations and because I want to provide this video an English description, I will post that translated description here, and put a link in the video's description, as I did with my previous one. This will lead people directly in this thread.


[EN]: This video is made by Krys3000 of the PRAMA Initiative
It shows a new variation of the Cooltrainer Trick in which you generate Pokémon from the stored items in the PC. This method involves a Glitch City and the Noclip Trick (aka Walk through walls glitch. I consider this name to be irrelevant, because you don't walk "through" walls at all, you walk over them).

Since you probably don't read french, here are some useful Glitch City Labs pages :

Our previous (though french speaking) video about Noclip trick :

The Cooltrainer Trick is a glitch allowing you to catch a Pokémon based on tiles, discovered by TheZZAZZGlitch:

An extension discovered by luckytyphlosion and documented by ChickasaurusCL/Torchickens allows to generate a Pokémon from the second letter of your Pokémon:

TheZZAZZGlitch then discovered a region in OoB Glitch City matching with the items :

THIS METHOD WORKS IN ENGLISH VERSIONS - But the video shows a french game. In English games you will need to go 10 steps left after going up to reach the "Number of stored items" address.

To generate the Pokémon you want using this new method, you must:

- Get a Ditto to know the Cooltrainer Move. To do this, catch a Ditto, get him to fight a Pokémon with more than one move. Transform into it, and switch move 1 and 2. End the fight, and your Ditto now has an empty move in the first slot. This is the Cooltrainer Move.

- Be able to use the Cooltrainer Corruption. This depend on several RAM parameters. You have a good english post from TheZZAZZGlitch with indications to make it to work on GCLF:,6992.msg198569.html#msg198569

- Know the hex value of the 4x4 tile block containing the tile you need to face this Pokémon using this trick. The tile must be well-placed within the block as you can see in the video. We have established a tileblockdex to help you with this :
But note some characters are different in English versions, which might lead to differences in some blocks.

- You can generate Pokémon of any of the 12 first stored items. To use the first item, its hex value must match the hex value of the determined 4x4 tile block (see above). The item which is 28 positions after (meaning the 29th item if you use the first, 30th if you use the second etc.) will be used to generate a tile block containing the tree (hex:50 tile) necessary for this glitch to work. There are many items you can use, for example a Full Heal if your Pokémon's tile is in the lower half of the 4x4 block, and a Pokédoll if not.

You can also use any item at both slots, if their quantities matches the decimal conversion of the hex values. In my example, the Bicycle (hex:06) and the Full Heal (hex:34) can easily be replaced by a Pokéball x6 and a Potion x52, provided that you place yourself differently in the Glitch City (see below).

You also have to be careful because some items generate trees and can break the glitch. Avoid having as the two following items of the two chosen ones (here, positions 2, 3, 30 and 31) : Pokédoll, Full Heal, Revive, Max Revive, X Defense and Old Rod (and the prototype version of PP Up) unless you know what you're doing. Also avoid that item quantity of both the chosen items (and the following one, in each case) is 50, 51, 52, 53, 54, 66 or 76.

GCL's list for Pokémon/Item/Hex/Dec matching:

Tile positions in this region of Glitch City:

Steps :
1/ Store both items at the right position. All the items between them can be anything, but avoid any hex:3X item close to your two used items because this might generate tree tiles.
2/ Have an Escape Rope (optionnal), Potions and Balls in your item bag, and a Pokémon knowing Fly.
3/ Perform the Noclip Trick:
3.1/ All your Pokémon must be fainted but one, which must be poisoned. Go to Fuchsia City inside the Pokémon Center, then go out and enter Safari Zone.
3.2/ Exit immediately, answer NO to get back inside the Zone, and walk a few steps.
3.3/ Note your remaining steps, save and reset. Exit the Zone counting your steps. You must jump a ledge with your 500th step including those made before the reset and those to exit the Safari Zone. You will be called back in the Hall with the ability to walk above walls. The poisoned Pokémon must not faint during this step, so heal it when needed.
3.4/ Allow your poisoned Pokémon to faint by walking inside the hall without exiting the map. You will be back in Fuchsia's Pokémon Center with the glitch active.
4/ Place Ditto in first position.
5/ Place yourself above the wall in the intersection with Sea Route 19 (as in the video). Do 44 steps left and 93 steps up to reach the Glitch City region generated from stored items ; in English versions, do an extra ~10 steps left to reach the good zone.
6/ Place yourself one step beneath and 4 step right to the 2x2 tile containing your tile in its right superior corner. The tree must be in the row located one 2x2 tile beneath you and not lower (see image above !)
7/ Open the start menu and Fly to Vermillion City. DO NOT OPEN THE START MENU ANYMORE.
8/ Perform the Cooltrainer Trick:
8.1/ Go inside Diglett's Cave and encounter a Pokémon.
8.2/ Open the FIGHT menu and close it. Sound slowly fades, changes, and the screen gets glitched. If it didn't work, try again several times. If you need to, run away and try another Pokémon. If it still doesn't work, see TheZZAZZGlitch's post above to help yourself getting this to work. NEVER OPEN ANY OTHER MENU.
8.3/ Catch the Pokémon using balls. He will be changed to the Pokémon you wanted!
8.4/ Leave the cave with an Escape Rope or by Open/Closing the Start Menu then taking the normal exit. Don't forget to heal both Ditto and the Pokémon you just got to clean them from the corruption.
Generation I Glitch Discussion / Super Glitch corruption questions
« on: August 01, 2015, 05:33:56 am »
Hey there,

I'd like to understand more about how Super Glitch behave, most particularly how do we control it as we do in Fossil Conversion ou Doko-Kashira Door Glitch for example. I have read GCL's wiki page about it, Bulbapedia's too, but still have some questions.

I basically understand the fact that the move takes his name from somewhere in the RAM, and that it corrupts data starting from D0E1. But that's a starting point right, is the number of addresses affected by the corruption always the same or totally random ?

What particularly I don't get is why for some glitches in which we use SG as the trigger, we put three moves with a total of 27 or 28 letters before the move. I mean, I saw this on bulbapedia :

StartingLocation = D0E1 + MoveLengths + NumberOfMovesBeforeSuperGlitch

So I understand the idea is to change the starting location, but I don't get how and why this gives you access beyond the sixth slot. If the idea is just to change the "7th slot" FF to something else, is it really necessary to shift this location using a precise number of characters ? I'm not sure to understand what gets corrupted and how this equation works.

Thanks a lot for the help !
Pages: [1] 2