Glitch City Laboratories Forums

Lab γ: Video Games and Glitches Discussion => Pokémon Glitch Discussion => Generation II Glitch Discussion => Topic started by: Torchickens on December 18, 2016, 12:47:05 pm

Title: Non TM/HM pocket TM47 in Pokémon Gold
Post by: Torchickens on December 18, 2016, 12:47:05 pm
This is a 'TM/HM outside of the TM/HM pocket' glitch item that misaligns the player sprite and NPCs by two spaces. I'm not sure how best to describe it, but when you save and reset after using TM47, the changes you make on the map aren't just visual; so if you moved an NPC out of bounds (such as the Victory Road badge checker) to allow you to walk past them you could walk past them.

It was planned for Pokémon Gold catch 'em all (with glitches) but I'm not sure if anybody ever got around to running it. For non-speedrunning purposes you should just be able to force it into the wrong pocket with Coin Case arbitrary code execution.

The glitch item interests me as there are some cool videos of someone bypassing certain events with it; like being able to enter Mahogany Town gym before defeating the Rockets at Rocket Hideout which makes this and party overloading map corruption examples of useful glitches other than Coin Case ACE.

The videos can be found here (and I'd like to make a video of both getting TM47 and performing these exploits).
http://wiki.pokemonspeedruns.com/index.php?title=User:Entrpntr/Gold_251#Miscealleneous_TM47_vids

Does anybody who knows a lot about the speedrunning scene know who discovered it?
Title: Re: Non TM/HM pocket TM47 in Pokémon Gold
Post by: luckytyphlosion on December 18, 2016, 02:37:19 pm
The TM47 discovery was a semi-joint discovery by both entrpntr (Pokemon Speedrunner, although he does more routing stuff) and I. We knew that TMs and HMs could execute code from invalid addresses, so we went out and tested each and every one. Out of all the TMs and HMs, only 3 stuck out:

TM47: This item jumps to this subfunction (https://github.com/pret/pokecrystal/blob/master/engine/player_step.asm#L264) , which increments the wOverworldMapAnchor. While using this only visually affects the map, reloading the map or crossing a connection applies the map changes to the loaded metatiles, allowing one to slowly clip through walls and access unintended parts of the map.

TM36: This item jumps here (https://github.com/pret/pokecrystal/blob/master/items/item_effects.asm#L269), which is in the middle of the Poke Ball function. While this could hypothetically allow you to catch whatever was the last loaded enemy mon, unfortunately the b register (used to store catch rate) is always 0 when entering this function (both through an invalid pocket and through select menu), so you'll end up with a 1/256 chance of catching the enemy mon, or 11/256 if the mon has a FRZ/SLP status.

HM03: I just found this out today while trying to figure out the interesting TM efffects, and it has a very useful application. This jumps here (https://github.com/pret/pokecrystal/blob/master/engine/move_mon.asm#L756), which is in the middle of the function called when withdrawing the stored daycare mon from the daycare lady. The function doesn't check whether a daycare mon is present (or clears the relevant data either, as it wouldn't be needed), so you can continually use HM03 to clone the daycare lady's stored mon. The only stipulation is that the new moves learned (by calculating level based on raw experience, which may not reflect the current level as the daycare step function does not recalculate level for every exp point gained) is based on the last loaded Pokemon, in 0xd004.
Title: Re: Non TM/HM pocket TM47 in Pokémon Gold
Post by: Torchickens on December 18, 2016, 03:15:18 pm
The TM47 discovery was a semi-joint discovery by both entrpntr (Pokemon Speedrunner, although he does more routing stuff) and I. We knew that TMs and HMs could execute code from invalid addresses, so we went out and tested each and every one. Out of all the TMs and HMs, only 3 stuck out:

TM47: This item jumps to this subfunction (https://github.com/pret/pokecrystal/blob/master/engine/player_step.asm#L264) , which increments the wOverworldMapAnchor. While using this only visually affects the map, reloading the map or crossing a connection applies the map changes to the loaded metatiles, allowing one to slowly clip through walls and access unintended parts of the map.

TM36: This item jumps here (https://github.com/pret/pokecrystal/blob/master/items/item_effects.asm#L269), which is in the middle of the Poke Ball function. While this could hypothetically allow you to catch whatever was the last loaded enemy mon, unfortunately the b register (used to store catch rate) is always 0 when entering this function (both through an invalid pocket and through select menu), so you'll end up with a 1/256 chance of catching the enemy mon, or 11/256 if the mon has a FRZ/SLP status.

HM03: I just found this out today while trying to figure out the interesting TM efffects, and it has a very useful application. This jumps here (https://github.com/pret/pokecrystal/blob/master/engine/move_mon.asm#L756), which is in the middle of the function called when withdrawing the stored daycare mon from the daycare lady. The function doesn't check whether a daycare mon is present (or clears the relevant data either, as it wouldn't be needed), so you can continually use HM03 to clone the daycare lady's stored mon. The only stipulation is that the new moves learned (by calculating level based on raw experience, which may not reflect the current level as the daycare step function does not recalculate level for every exp point gained) is based on the last loaded Pokemon, in 0xd004.

Ooh I see, nice!

Thanks for sharing the information about TM36 and HM03.

I successfully caught Will's Xatu after putting it to sleep, blacking out and using TM36 many times. The game asked if I wanted to give a nickname to "2U" (which made me wonder for a moment if it had an unterminated nickname like a fake bad clone), but it became a normal non-nicknamed Xatu after I chose to not give it a nickname.

Edit: You can catch Trainer House Pokémon too.
Title: Re: Non TM/HM pocket TM47 in Pokémon Gold
Post by: Yeniaul on December 19, 2016, 08:03:02 am
I had a question asked of me a few hours ago. Q: Will we as a species ever stop breaking games for fun?
My A: No. If it can be broken, it will be.
Title: Re: Non TM/HM pocket TM47 in Pokémon Gold
Post by: ISSOtm on December 19, 2016, 08:05:30 am
+1