Glitch City Laboratories Forums

Lab γ: Video Games and Glitches Discussion => Pokémon Glitch Discussion => Generation I Glitch Discussion => Topic started by: TheZZAZZGlitch on April 02, 2013, 06:35:13 am

Title: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: TheZZAZZGlitch on April 02, 2013, 06:35:13 am
Well, I've been doing a lot of Super Glitch research for a year now, and I finally decided to show off some things that I found.
At the moment, Super Glitches are considered only as a fun little distraction without real use. And my goal is to turn things around and make them useful and predictable. Because if you think long enough, these moves have quite the power. They can write large numbers of values to the RAM by just displaying their names. You may also think "if there was a way to manipulate values or range of Super Glitch's memory corruption, that would be amazing".

OK, done with this boring foreword. Yes, there is a way to manipulate (and exploit) the way Super Glitch modifies the RAM. It worked on 4 different savefiles on emulator and on the actual cart, so I'm pretty sure it will work for everyone. But before we go into how to do it and before I show you some examples of useful "Super Glitch glitches", let's talk about some theory.

We all know Super Glitch heavily messes up the game's RAM. But from where it gets those values from? And where does it write? And why it even writes those values?
This is a subject worth a 10-page research document, but I will at least try to make this short and quick, presenting only a few facts needed. If you want a more detailed, technical explanation, read http://justpaste.it/2bbt

First of all, it's not the move that is real dangerous, it's the name of the move that makes the game go weird. Super Glitch's name pointer is read wrongly by the game, and it makes the game believe the name of this move resides in the RAM. Which is an absolute nonsense, RAM has no move names at all. And when the game tries to read a move name, it buffers it byte by byte until it encounters a terminator byte (0x50). The problem is, RAM most likely won't ever contain a terminating character. So the game copies way more data than it should, resulting in a buffer overflow. And this is why Super Glitches corrupt the RAM.
The data is copied from address $CD6D, the buffer for move loading subroutine. And it is copied to $D0E1, the moveset buffer if you activate Super Glitch by viewing stats/learning a move/opening the fight menu, or to $CF4B if you activate Super Glitch by selecting/using it in battle. The buffer overflow causes a huge number of bytes from $CD6D to be copied to either $D0E1 or $CF4B.

(http://i.minus.com/ivDgtkGBfktfB.png)

And if we look what does the $CD6D address contains, we will find out that there’s a full screen copy here!

(http://i.minus.com/ibvKjSqUAEVkbl.png)

What does it mean? By changing what's on the screen at the moment, we can manipulate the values Super Glitch writes! And by positioning 0x50 overworld tiles on the exact places on the screen, we can also manipulate the length of Super Glitch corruption! However, the screen information here isn’t just ordinary screen copy at the moment, it is refreshed only at certain times:

This is even more convenient for us! If you for example open up the item menu in overworld, close it immediately, and go into a battle, if you don’t open any menus while battling, the overworld screen copy will still be there as there was no need to overwrite it. By opening and closing the Pokemon menu in certain spots and not opening the start menu anymore, we can cause a single Super Glitch effect to happen almost 100% of the time.

Also, because $D0E1 is not a single move buffer but a move list, a number of characters the move names before the Super Glitch have can also affect the length and values of corruption, shuffling the corrupted address by around 1-10 bytes.

Examples:

Quote
Moveset: Agility, Agility, TM28, [Super Glitch]
Agility [7 chars] + Agility [7 chars] + TM28 [4 chars] = 18 chars
D0E116 + 1810 + 310* = D0F616   
The Super Glitch will start its corruption at address $D0F6

Quote
Moveset: Barrage, Clamp, [Super Glitch], Hi Jump Kick
Barrage [7 chars] + Clamp [5 chars] = 12 chars
D0E116 + 1210 + 210* = D0EF16   
The Super Glitch will start its corruption at address $D0EF

* - while calculating the resulting starting address you have to add number of moves before the Super Glitch, as they are separated within the code by an invisible whitespace line feed character 0x4E

Now we have some information on how to modify the values Super Glitch writes - so let's jump into some useful applications of it!

Harmless Super Glitch trick
Use: You can use this trick to learn/forget Super Glitches without any problem, view stats of Pokemon with Super Glitch moves, or swap/use Super Glitches in battle without crazy effects.
Statistics: Worked on all 5 tested saves on the first try.
Video: http://www.youtube.com/watch?v=Q2_aczBkpxM#t=8s
Prerequisites:
- A Pokemon with Super Glitch, obviously.
- Access to Celadon City.

Execution:

1. Go to the exact spot shown on the screenshot below (1st floor of Celadon Mansion). Open up your Pokemon menu while still standing on that spot.

(http://i.minus.com/ieB2Tly27VDEn.PNG)

2. Congratulations. You just now immune to Super Glitches' glitchiness. Now you can learn, forget, view stats with Super Glitches involved without risking your save file.
3. You can also carry this effect to your local patch of grass in order to swap or use Super Glitches in battle without risk. Just open your Pokemon menu again, close it, go into a patch of grass and fight.
Note: Do not open your start menu at all while going to the grass or while fighting. This will reset Super Glitch to its usual glitchness.

Screenshots from all 5 tested saves:
(http://i.minus.com/ibe0DqTdUAB9En.png)

Access Pokemon beyond the sixth slot
Use: With a corrupted Pokemon list and a corrupted item list (achievable using corrupted Pokemon list), you can make a lot of serious memory modifications - it's like having a memory viewer in your GB.
Statistics: Save #1,4,5 - Worked on the 1st try, Save #2,3 - Worked on the second try
Video: http://www.youtube.com/watch?v=Q2_aczBkpxM#t=145s
Prerequisites:
- Access to Celadon City.
- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 28 characters in total
     (for example: BODY SLAM [9 chars], DOUBLESLAP [10 chars], WATER GUN [9 chars])
- At least 5 Pokemon in your party, a party of 6 is recommended.
   
These moveset requirements aren't a real problem if you're using LM4, as its default starting moveset has 3 moves with 28 characters in total.
LM4 will have to learn no new moves till level 24, and at level 24 Hypnosis should be replaced with Super Glitch. Then you will be able to use previously described Harmless Super Glitch trick to switch the first move with the last.
Note: 4 first Pokemon in your party will change their species, but it isn't a problem as you're probably not going to save after this glitch anyways.

Execution:

1. Go to the exact spot shown on the screenshot below (second to last house on Celadon's south-east). Open up and close immediately your Pokemon menu while still standing on that spot.

(http://i.minus.com/ibxPoFRCenomoK.PNG)

2. Go into a patch of grass and encounter a wild Pokemon. Again, do not open your start menu while going there.
3. Open and close your fight menu a few times, the run from the battle.
4. Check your Pokemon list. Try to scroll past your 6th Pokemon. If you can't, repeat step 1. If you can - congratulations, you did it. If your game crashes, you obviously did something wrong.

Screenshots from all 5 tested saves:
(http://i.minus.com/ibo3DC4b9CQs1S.png)

Erase player's name
Use: This generates a perfectly blank properly terminated name, allowing you to save the game after you do something really game-breaking (Super Glitch, ZZAZZ, 2x2x2x2 after messing with 3906 for a while etc.), or you can just amaze your friends with an unobtainable name.
Statistics: Save #1,2,4 - Worked on the 1st try, Save #3,5 - Worked on the second try
Video: http://www.youtube.com/watch?v=Q2_aczBkpxM#t=322s
Prerequisites:
- Access to Cerulean City.
- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 28 characters in total
     (for example: BODY SLAM [9 chars], DOUBLESLAP [10 chars], WATER GUN [9 chars])
- Access to the field move Fly
- Balls of steel if you want to save afterwards

Execution:

1. Go to the exact spot shown on the screenshot below (south-west corner of Cerulean City). Open up and close immediately your Pokemon menu while still standing on that spot.

(http://i.minus.com/iLUYbTqCI7QX3.PNG)

2. Go into a patch of grass and encounter a wild Pokemon. Again, do not open your start menu while going there.
3. Open up and close your fight menu a few times, then run from the battle.
4. Your name should be now blank. However, it is still unsafe to save your progress.
5. Open up the start menu and select 'SAVE'. Don't freak out. When a glitched yes/no box appears, press B to cancel out.
6. You should end up in a glitch city. Fly away anywhere and you're now free to save. Saving is even recommended, as glitched trainers will now also appear instead of normal ones, and reloading the game will fix this problem. It shouldn't erase your game, I saved on 4 files (wasn't brave enough to do this on a cart) and the game was perfectly fine.

Screenshots from all 5 tested saves:
(http://i.minus.com/iX6rsueTFRLyD.png)

100% TMTRAINER
Use: Has no real use; It is here just to show how you can make Super Glitches predictable.
Statistics: Worked on all 5 tested saves on the first try.
Video: http://www.youtube.com/watch?v=Q2_aczBkpxM#t=474s
Prerequisites:
- A Pokemon with Super Glitch, obviously.

Execution:

1. Encounter a wild Pokemon.
2. Open your Pokemon menu (in-battle) and close it shortly afterwards.
3. Open the fight menu and select (don't have to use) the Super Glitch move.
4. TMTRAINER 100% guaranteed. If it doesn't work, back out, open your Pokemon menu again, go back and try again.

Screenshots from all 5 tested saves:
(http://i.minus.com/iBvprE7rzE79S.png)

Catch a level 82 Hitmonchan with (almost) infinite HP
Use: Making your way through E4, trolling people on link battles, having a partner for your 'Mew Smash'
Statistics: Save #1: 3 tries, Save #2: 1 tries, Save #3: 5 tries, Save #4: 7 tries, Save #5: 4 tries
Video: http://www.youtube.com/watch?v=Q2_aczBkpxM#t=525s
Prerequisites:
- Access to Celadon City.
- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 28 characters in total
     (for example: BODY SLAM [9 chars], DOUBLESLAP [10 chars], WATER GUN [9 chars])
- Access to Route 14

Execution:
   
1. Go to the exact spot shown on the screenshot below (Route 14's northmost field of grass). Open up and close immediately your Pokemon menu while still standing on that spot.

(http://i.minus.com/ibo4RK25H1yPg1.PNG)

2. Optional step: Save your game. This will help you out as you may need a few tries to get this to work. After reloading the save you have to open your Pokemon menu again to rewrite your screen data, just saying (testers have been shouting LOLZ IT DOESNT WORK!!!1 while they forgot about opening the Pokemon menu after reloading the save).
3. Go find a wild Pokemon
4. Open the fight menu and continuously try to select the Super Glitch move. It will eventually change its type to either the name of last trainer battled, or a blank space.
5. Press B to exit out. You should end up fighting a Pokemon named with a bunch of player name characters. If it crashes, you failed - try again.
6. Open your item menu and use anything you're not supposed to (a bicycle or something). It should say your name followed by usual "not the time to use that". If your name is glitched, you failed - try again.
7. Throw all the Pokeballs. After you succeed, the game will state you caught a Hitmonchan. Congratulations!

Note: A nice side effect is the fact your Super Glitcher (LM4 or whatever monstrosity you use) gains infinite HP too. Another not so nice side effect is that both Hitmonchan and Glitcher gain status ailments, and healing them in a Pokemon Center will get rid of their amazing HP. You may need to use a full heal or something.

Screenshots from all 5 tested saves:
(http://i.minus.com/ibbIs6iUNZNpjJ.png)

Some other remarks:
 - I already have another interesting idea: Super Glitch name, and the Old Man trick. Could be very interesting.
 - Sadly, all presented glitches (with exception of the first part of Harmless Super Glitch trick) do not work in Yellow. Newer versions handle battle screens a little bit differently, not allowing me to carry overworld screen data to a battle. However, the way of manipulating Super Glitch's written values remains the same. Maybe someone will find a workaround soon.
 - All this stuff is experimental. I am not responsible for your lost save files, you try this at your own risk.
 - This is my first GCL publication, don't rage very hard if I made some mistakes.

And that's all so far. But it isn't the end. I'm pretty sure either the people will come up with something amazing, or I will find some more stuff soon. I see a rosy future ahead for Super Glitch and its possibilities, my findings are only the beginning.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: camper on April 02, 2013, 08:23:52 am
Did you try the Cooltrainer move? Is there any relation between that move and Super Glitch?

Also, in the video around 09:55, I noticed the wild Bellsprout's HP bar keeps changing. Is that normal?

The TMTRAINER effect trick has some use, like catching Missingno. in the Diglett's Cave.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on April 02, 2013, 08:44:58 am
Wow, excellent work!

Some time ago, by chance I found a trick that makes your name all 00 characters except for the 11th character which becomes 18h but gives you 25 Pokémon.

The steps were as follows:

1) Level up a ゥL ゥM 4 (hex:C6) to Level 24. (addendum: LM4's first move is Hypnosis). Replace the second move with Super Glitch (hex:BE)
2) Deposit every Pokémon except ゥL ゥM 4
3) Enter a battle and choose Fight. If all attacks underneath the first move are hidden, you've triggered the glitch. If other attacks under the first move are visible, you need to press B and enter the fight menu again until they become invisible.
4) Run from the battle.
5) You now have 25 Pokémon and your name has become blank.

Video (http://www.youtube.com/watch?v=ZRgIPU7O-QI)

For some reason, that glitch causes the ID of the second Pokémon to decrease every 4 steps, so by walking enough steps, I could make it underflow to 255 and this let me open the Pokémon menu without a freeze/deposit Pokémon underneath it.

I didn't realize the length of the move names known by the Pokémon affect the glitch. The first move my LM4 knew was Hypnosis (which is 8 characters + the 4E). If I repeat the glitch with Doubleslap (10 characters +4E), the first two letters of my name become 08h and 08h instead and the number of Pokémon in the party (D163) become 00.

Since the number of Pokémon is 00, exiting and entering a battle causes the 'wild appeared' glitch to happen.

(http://i.minus.com/jOhRTYvpHPzlS.png)

Also for some reason, capturing the wild Pokémon or selecting 'save' causes the dialogue boxes to change from North/West. I checked the box-set address $D12C that you found and the value got changed to 01.

(http://i.minus.com/jbsESALw7kiPwJ.png)

Thanks to your work, I now know one of the reasons why I had to deposit Pokémon from the PC was because of the glitchy effects depending on what was on the screen. I still had to deposit Pokémon though to get exact same effects. I don't know why.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: TheZZAZZGlitch on April 02, 2013, 09:55:24 am
Reply time!

Quote
Did you try the Cooltrainer move? Is there any relation between that move and Super Glitch?

Well, the Cooltrainer move is something I like to call "half of a Super Glitch". It can't corrupt anything beyond $D0E1 because the moveset loading routine is programmed to display any index 0 moves as "--". But this programming does not apply to the actual move (not moveset) loading routine, which tries to request a name for move 0 anyway. Because it's a standard "subtract 1, check if 0, jump if not" loop, game tries to load move index 256 and reads beyond the move database, causing all the Super Glitch effects in battle.

Quote
Also, in the video around 09:55, I noticed the wild Bellsprout's HP bar keeps changing. Is that normal?

That's just video compression, the HP bar does not move in reality.

Quote
The TMTRAINER effect trick has some use, like catching Missingno. in the Diglett's Cave.

Never knew it was possible. Thanks for letting me know.

@Torchickens: Yeah, I watched this before, and your video inspired me to publish all this research.

Quote
Thanks to your work, I now know one of the reasons why I had to deposit Pokémon from the PC was because of the glitchy effects depending on what was on the screen. I still had to deposit Pokémon though to get exact same effects. I don't know why.

You do not need to deposit at all! You just need to open the PC and close it. Because again, all the game cares about is what was on the screen. Your trick relies on the fact that opening the PC refreshes the screen copy on $CD6D, and Pokemon Center map has a quite nice number of 0 tiles. This causes those effects to happen, and it has nothing to do with depositing.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on April 02, 2013, 11:52:09 am
@Torchickens: Yeah, I watched this before, and your video inspired me to publish all this research.

That's nice to know, I'm glad you found it useful. :)

You do not need to deposit at all! You just need to open the PC and close it. Because again, all the game cares about is what was on the screen. Your trick relies on the fact that opening the PC refreshes the screen copy on $CD6D, and Pokemon Center map has a quite nice number of 0 tiles. This causes those effects to happen, and it has nothing to do with depositing.

Ah, thanks. The screen-copy begins at $CD81 right? Memory viewer says the screen-copy is the same as long as you press A to open the PC. I think I know what I was doing wrong now. I viewed the Pokémon menu instead of opening the PC.

Viewing the Pokémon menu gave me this:

(http://i.minus.com/jbzdWj54iEgdSw.png)

Instead of this:

(http://i.minus.com/jiPJ28kwV7A2k.png)

Quote
The data is copied from address $CD6D, the buffer for move loading subroutine. And it is copied to $D0E1, the moveset buffer if you activate Super Glitch by viewing stats/learning a move/opening the fight menu, or to $CF4B if you activate Super Glitch by selecting/using it in battle. The buffer overflow causes a huge number of bytes from $CD6D to be copied to either $D0E1 or $CF4B.

If I'm understanding this right, basically the game copies more than the first 20 bytes from $CD6D, including copied screen data, because the game has now read past the 'move name table' to get Super Glitch's name, and there is no terminating $50 in those 20 bytes?
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: TheZZAZZGlitch on April 02, 2013, 01:00:27 pm
Quote
If I'm understanding this right, basically the game copies more than the first 20 bytes from $CD6D, including copied screen data, because the game has now read past the 'move name table' to get Super Glitch's name, and there is no terminating $50 in those 20 bytes?

Exactly.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: blahpy on April 02, 2013, 04:47:32 pm
Brilliant read! I'm sure there's still more to be found, too! I'd be willing to risk my blue cart save if necessary for the advancement of this project, if there's anything you want me to test on it.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on April 03, 2013, 09:00:30 am
Here are some notes:

The copy of the screen starts at the top-left most corner and works down to the to the bottom-east most corner, going one horizontal line at a time.

Take this example:

(http://i.minus.com/jbfkpFVRfv9k7E.png)

The first 10 tiles are the grass tiles, 52h, 52h, 52h, then the top-left corner of the start menu (79h), then it goes 7Ah, 7Ah, 7Ah, 7Ah, 7Ah, 7Ah, 7Ah, 7Ah, 7Bh.

We're now on to the next line which starts with the 52h grass tiles again.

The copy of the screen appears to start from $CD81 and finishes at $CEE8. Unfortunately I don't know what the second copy is though? (the glitchy one in TheZZAZZGlitch's Pokémon Mansion screenshot)

If Super Glitch is the first move, the corruption takes place exactly 20 bytes after $D0E1 ($D0F5). The game will write these 360 bytes, and the copied screen data finishes at D2FC.

Here are a list of useful memory addresses ranging from D0F5-D2FC:

D119: Teleport/Dig/Rope to room modifier - reverts back when the battle ends :/
D11E: Starter Pokémon
D127: Current enemy level - gets reverted back unfortunately if you catch the Pokémon, reverts back when you do the Ditto glitch, too.
D12B: Is enemy Trainer a Link Battle Trainer?
D12C: Current box-set
D13C: No wild battles?
D141: Game Corner Prize Slot 1 Price
D142: ''''
D143: Game Corner Prize Slot 2 Price
D144: ''''
D145: Game Corner Prize Slot 3 Price
D146: ''''
D158-D162: Player's name
D163: Number of Pokémon in Party
D164-D2FC: Pokémon (http://datacrystal.romhacking.net/wiki/Pokemon_Red:RAM_map#Player)
D2F7 - Own 1-8
D2F8 - Own 9-16
D2F9 - Own 17-24
D2FA - Own 25-32
D2FB - Own 33-40
D2FC - Own 41-48
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Wack0 on April 06, 2013, 01:15:16 pm
A simple buffer overflow? I should have realised myself that some part of Super Glitch smashed the stack.

I guess something about trainers FB, FC, FE and FF cause a buffer overflow too.

(also, I wonder if every invalid roster of every trainer should be documented?)
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: camper on April 06, 2013, 11:52:10 pm
I guess something about trainers FB, FC, FE and FF cause a buffer overflow too.
I think it's the winning money (99h 99h).
(also, I wonder if every invalid roster of every trainer should be documented?)
Only the rosters after Lance 01h are invalid.
The other "invalid" rosters are actually valid rosters from another trainer class.
e.g. Prof. Oak has 3 valid rosters, and Chief has none. Therefore Prof. Oak 04h draws data from the Scientist class roster 01h instead.
Agatha Ultima = Agatha 07h = Lance 06h = Channeler 17h = Lorelei 18h, since there are 16 Channeler rosters.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Kelvinv on May 12, 2014, 11:26:09 pm
I'm sorry for bumping this topic, but I want to know if there also is a fix for the super glitch-like items.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: camper on May 13, 2014, 08:16:00 am
The tile in Celadon makes it completely safe. Also any screen with the $50 tile (lower-left part of a bush in the main map) in the first few rows.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: LanceAndMissingNo. on May 15, 2014, 06:36:23 am
Now I just saw the image of North / West, I went something like talking to Oak ZZAZZ with glitch activated:
(http://i.gyazo.com/28ffcd5847739ecb37d501bd402a38ce.png)

Instead of giving me a nickname for Pikachu and instead put Yes / No put me North / West. Someone knows why that happens?
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on May 15, 2014, 07:04:14 am
Now I just saw the image of North / West, I went something like talking to Oak ZZAZZ with glitch activated:
(http://i.gyazo.com/28ffcd5847739ecb37d501bd402a38ce.png)

Instead of giving me a nickname for Pikachu and instead put Yes / No put me North / West. Someone knows why that happens?

The ZZAZZ glitch changes many values to hex:99, with the amount of addresses affected depending on the Trainers' potential win money (it caps at 9999 but this is actually a cause of the glitch, see this (http://forums.glitchcity.info/index.php/topic,36.msg194432.html#msg194432)). At address $D12C is the box-set ID; the ZZAZZ glitch may change this to a glitch box-set with the value $99, but I haven't seen this as North/West.

Did you try viewing a Super Glitch move? North/West is value 01, and it is possible for Super Glitch to write that value to $D12C.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: pokechu22 on May 15, 2014, 04:36:52 pm
Now I just saw the image of North / West, I went something like talking to Oak ZZAZZ with glitch activated:
(http://i.gyazo.com/28ffcd5847739ecb37d501bd402a38ce.png)

Instead of giving me a nickname for Pikachu and instead put Yes / No put me North / West. Someone knows why that happens?

What happened when you chose "North" or "West"? 

Those message boxes are interesting; especially with the screen wrapping. 

It is important to note that in cases where the "Yes/no" message box would appear, the game doesn't try to set the value for what will appear.  It assumes that it will be set to "Yes/no", and if it isn't, it will display whatever value is there. 
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: LanceAndMissingNo. on May 16, 2014, 02:45:57 am
Now I just saw the image of North / West, I went something like talking to Oak ZZAZZ with glitch activated:
(http://i.gyazo.com/28ffcd5847739ecb37d501bd402a38ce.png)

Instead of giving me a nickname for Pikachu and instead put Yes / No put me North / West. Someone knows why that happens?

The ZZAZZ glitch changes many values to hex:99, with the amount of addresses affected depending on the Trainers' potential win money (it caps at 9999 but this is actually a cause of the glitch, see this (http://forums.glitchcity.info/index.php/topic,36.msg194432.html#msg194432)). At address $D12C is the box-set ID; the ZZAZZ glitch may change this to a glitch box-set with the value $99, but I haven't seen this as North/West.

Did you try viewing a Super Glitch move? North/West is value 01, and it is possible for Super Glitch to write that value to $D12C.
All I did was do the trick of the glitch ZZAZZ team, ZZAZZ altered my game so that, when they had spent the entire game, Pikachu back to me, and I got it from North / West, which in truth is Yes / No .

Also appeared when I was going to keep at a time, it happened to me ZZAZZ glitch.

Now I just saw the image of North / West, I went something like talking to Oak ZZAZZ with glitch activated:
(http://i.gyazo.com/28ffcd5847739ecb37d501bd402a38ce.png)

Instead of giving me a nickname for Pikachu and instead put Yes / No put me North / West. Someone knows why that happens?

What happened when you chose "North" or "West"? 

Those message boxes are interesting; especially with the screen wrapping. 

It is important to note that in cases where the "Yes/no" message box would appear, the game doesn't try to set the value for what will appear.  It assumes that it will be set to "Yes/no", and if it isn't, it will display whatever value is there. 
It's like you should choose Yes / No, only instead it appears North / West.
Maybe it is a curiosity and nothing more.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on May 16, 2014, 08:00:33 am
Yeah, I think the direction options are just a curiosity, unfortunately. Just to confirm, they are unused option choices, though "NORTH" and "EAST" alone are referenced in the Safari Zone (though I don't know if the game gets the text from the same place).

The only thing that changes are the option names. This means if the options were originally Yes/No and they got changed to No/Yes (box-set ID=07), 'No' would act like 'Yes' and 'Yes' would act like 'No'.

But there is a use for glitch boxsets. For with really large widths and heights, such as hex:F9 (https://www.youtube.com/watch?v=ypZT_4TpuQg)'s height of 250 (source (http://forums.glitchcity.info/index.php/topic,6629.msg189356.html#msg189356)), memory corruption can occur due to the box stretching off the screen and addresses past the screen data being overwritten, even though the effects of the options shouldn't change.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: MrGlitch on July 02, 2014, 07:42:24 pm
Huh. Looks like there are two ways to get a free Hitmonchan.

http://youtu.be/t2KtU6_C7Ho?t=2m42s

Great research, it is certainly useful. :)
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on July 07, 2014, 01:48:41 pm
Is there a way to optimize the chances of the CoolTrainer♀ move causing corruption?

On this save file I'm using, and in BGB there is always a 50h inclusively between CD6D and CD80, meaning there's no buffer overflow after the copy to $CF4B. Its no longer working here, but I was able to get this glitch to work in the past various times. Not sure why.

I want to try and get as many glitch Pokémon as possible to verify which ones are possible with this trick (https://www.youtube.com/watch?v=Sst_5kAX2y4).

I understand it may be hard to predict though, because of the fact that you often have to 'scroll' or open/close the fight screen many times.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: TheZZAZZGlitch on July 07, 2014, 02:19:03 pm
Cooltrainer move's name pointer pretty much always ends up in the middle of boxed Pokemon data, RAM address $DA80 and beyond (BTW: this is also why Cooltrainer move sometimes takes the nicknames of Pokemon in the current box as its name).
Addresses beyond $DA80 contain a lot of 0x50 bytes, as this is where the Pokemon nicknames and Original Trainer names are stored.

The easiest way to increase the chances of the Cooltrainer move working is to try and change the number of Pokemon in current PC box. If it still doesn't work, change the number of boxed Pokemon once more and try again.

There is no clear pattern - every save file needs a different number of boxed Pokemon for the Cooltrainer move to work properly. On my main save on an emulator, I needed 7 Pokemon in the box for the move to work. On my save on the cartridge the move works only if there are no Pokemon in the box. My different, older save file required 16 or 15.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Kelvinv on July 07, 2014, 02:25:01 pm
Wonder if it ever can be used for arbitrary code.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on July 07, 2014, 03:22:13 pm
Cooltrainer move's name pointer pretty much always ends up in the middle of boxed Pokemon data, RAM address $DA80 and beyond (BTW: this is also why Cooltrainer move sometimes takes the nicknames of Pokemon in the current box as its name).
Addresses beyond $DA80 contain a lot of 0x50 bytes, as this is where the Pokemon nicknames and Original Trainer names are stored.

The easiest way to increase the chances of the Cooltrainer move working is to try and change the number of Pokemon in current PC box. If it still doesn't work, change the number of boxed Pokemon once more and try again.

There is no clear pattern - every save file needs a different number of boxed Pokemon for the Cooltrainer move to work properly. On my main save on an emulator, I needed 7 Pokemon in the box for the move to work. On my save on the cartridge the move works only if there are no Pokemon in the box. My different, older save file required 16 or 15.

Thanks TheZZAZZGlitch. I'll try a box with no Pokémon.

Wonder if it ever can be used for arbitrary code.

Arbitrary code execution and buffer overflow are two different things, because buffer overflow involves memory corruption, while arbitrary code execution involves forcing the game to jump to somewhere helpful (meaning to execute code there).

But if it is possible to corrupt D36E/D36F; the map's level script pointer (a map script like make you walk up and activate the Hall of Fame menu) to something helpful with Super Glitch, then the code will be executed all the time when you return to the map, until you leave it.

From what I understand, this pointer can either be in memory if it is 8000-FFFE (so you could set up custom code there) or to a ROM address (0000-7FFF).

Each map uses its own ROM bank for the level script pointer. (Relevant if you're using a ROM bank that isn't 0, i.e. it's relevant for 4000-7FFF) A list can be found here (http://freetexthost.com/bsy42cst51).

But a problem if you're planning on executing existing code is having the game not freeze after Super Glitch. The place that typically doesn't Diglett's Cave has a ROM bank of 18, so you could theoretically execute code from a pointer in ROM bank 18.

This relies on there being no $50 character after the name of the Super Glitch move (which was cut to 20 characters long), where the adjacent data that was from CD81 onward including the screen data is found, and you having control over what address to put into the level script pointer (D36E/D36F). There's also a chance you'll corrupt something important that will cause a freeze or corrupt the memory to a degree it's not worth the trouble.

Edit: This was a rushed reply as I've got to go soon, so some of what I say may be wrong. I haven't tested this. Sorry if it is.
Edit 2: Rival's name is at D34A so I guess it's impossible without corrupting that, because that's bound to have a 50.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Charmy on September 10, 2016, 12:59:20 pm
Why does Cooltrainer not work for me on official Blue VC? There's no corruption ever and that's bad because...  AxXDao needs to fill his dex. And He doesn't want to waste trainers for the Mew trick. ACE also i won't do as I don't want the risk of my save being killed, just like the two previous ones.
Also, were you camping on this thread? I just went back and replied to something and you posted.

Edit by Torchickens: Merged into this thread.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on September 10, 2016, 01:10:00 pm
Why does Cooltrainer not work for me on official Blue VC? There's no corruption ever and that's bad because...  AxXDao needs to fill his dex. And He doesn't want to waste trainers for the Mew trick. ACE also i won't do as I don't want the risk of my save being killed, just like the two previous ones.

That can happen and for some reason it seems CoolTrainer is likely not to work after a certain point. Changing the number of hex:50 in the memory is said to help, so you can try various things such as: lengthening or shorten the nicknames of your Pokémon in the party or the number of Pokémon in the current box, adding items with quantities of x80 to the inventory and hopefully CoolTrainer will start to work.

Also, were you camping on this thread? I just went back and replied to something and you posted.

No, but I suppose it could be that I loaded the main page of the forums about the same time you posted while creating the new child boards.

Edit by Torchickens: Merged into this thread.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Charmy on September 10, 2016, 01:13:56 pm
That can happen and for some reason it seems CoolTrainer is likely not to work after a certain point. Changing the number of hex:50 in the memory is said to help, so you can try various things such as: lengthening or shorten the nicknames of your Pokémon in the party or the number of Pokémon in the current box, adding items with quantities of x80 to the inventory and hopefully CoolTrainer will start to work.
I forgot about that... *derp*... Trying this right now.

Edit by Torchickens: Merged into this thread.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on September 10, 2016, 01:16:36 pm
That can happen and for some reason it seems CoolTrainer is likely not to work after a certain point. Changing the number of hex:50 in the memory is said to help, so you can try various things such as: lengthening or shorten the nicknames of your Pokémon in the party or the number of Pokémon in the current box, adding items with quantities of x80 to the inventory and hopefully CoolTrainer will start to work.
I forgot about that... *derp*... Trying this right now.

OK, good luck! I will split this discussion off into another thread.

Edit by Torchickens: Merged into this thread.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Charmy on September 10, 2016, 01:28:31 pm
You can later move this somewhere...
My Ditto has a nickname of "CT" which stands for CoolTrainer and my Fearow (flyer) has a nickname of "h".
Also, my current box has 11-13 Pokémon in it and my other box has 4 Pokémon in it. The rest are empty.
Now I'll try CoolTrainer. If that doesn't work then items.
BUT:I forgot something, I managed to get CoolTrainer to work but the game "00 39 00 39"'d my right away.

EDIT:Around 50 UP presses later, nothing. Trying items now.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on September 10, 2016, 01:32:23 pm
You can later move this somewhere...
My Ditto has a nickname of "CT" which stands for CoolTrainer and my Fearow (flyer) has a nickname of "h".
Also, my current box has 11-13 Pokémon in it and my other box has 4 Pokémon in it. The rest are empty.
Now I'll try CoolTrainer. If that doesn't work then items.
BUT:I forgot something, I managed to get CoolTrainer to work but the game "00 39 00 39"'d my right away.

I see, happy that it worked that time. You likely already know this but would like to share just in case you weren't aware, the reason why it may have froze is because you need to open the items menu or Pokémon menu at a specific place first and then never open it afterwards until you do the corruption; for example opening the items menu in battle before doing the corruption allows you to force a Missingno. on the opponent's side.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Charmy on September 10, 2016, 01:36:19 pm
I see, happy that it worked that time. You likely already know this but would like to share just in case you weren't aware, the reason why it may have froze is because you need to open the items menu or Pokémon menu at a specific place first and then never open it afterwards until you do the corruption; for example opening the items menu in battle before doing the corruption allows you to force a Missingno. on the opponent's side.
Yes, I knew that, and so i opened it somewhere in Diglett's Cave, then got into a encounter. It's because of backup onscreen data, right?

EDIT:Goddammit Spearow... I can encounter 'M, Normal Missingno., and Areodactyl Fossil Missingno on that goddamn coast but i got you... as well as Sandshrew's. Oh, and level 151 Mewtwo's too.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Evie the Mother Hen ☽ ❤ on September 10, 2016, 01:48:24 pm
I see, happy that it worked that time. You likely already know this but would like to share just in case you weren't aware, the reason why it may have froze is because you need to open the items menu or Pokémon menu at a specific place first and then never open it afterwards until you do the corruption; for example opening the items menu in battle before doing the corruption allows you to force a Missingno. on the opponent's side.
Yes, I knew that, and so i opened it somewhere in Diglett's Cave, then got into a encounter. It's because of backup onscreen data, right?

EDIT:Goddammit Spearow... I can encounter 'M, Normal Missingno., and Areodactyl Fossil Missingno on that goddamn coast but i got you... as well as Sandshrew's Oh, and level 151 Mewtwo's too.

Yep, that's right.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Charmy on September 10, 2016, 01:54:21 pm
Nope, still nothing.
Do all boxes matter or just the current one?
Also a little off-top. What do you think my avatar looks like?
EDIT:Another off-top, my first Pokémon in the HoF has a name of Q...BuN h# ;

POKé BALL  TMTRAINER  TMTRAINER

#- that JP thingy
... - that dot thingy
I didn't even have a Poké Ball in my inventory to begin with.
EDIT2:This is a very quality picture.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: lukazoid on February 07, 2017, 03:53:08 pm
Hey i'm new here
I used superglitch in pokemon tower (on the purified protection zone floor) without a silph scope by opening and closing the fight menu and then running from battle. I used an escape rope to get to a pokemon centre and withdrew one pokemon from the pc i could then view my pokemon menu without a crash as i had 6 only to view. (photo attached no 1 ). i also used it in a different  location (cant remember where) and got an interesting restart to the game with messed up colours (went to title screen) 2nd photo . another interesting effect was talking to oak as he told me i had seen/caught  more pokemon than i actually had. hope this is posted in the correct place.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Yeniaul on February 07, 2017, 05:26:31 pm
The "withdraw Pokemon with PC" thing is known. The party is due to the corruption. The colors are due to how the Gameboy works internally. :P
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: lukazoid on February 08, 2017, 03:30:41 am
Thanks for the reply I got the idea that people are trying to document where different effects are found. my main info source is missingnoxperts videos which arent very in depth on superglitch. I also have a question are different effects due to where the move is learned or where it is used as i saw differences in effects from both of these conditions.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: ISSOtm on February 10, 2017, 07:14:17 am
Some of the data copied around by Super Glitch names are taken from a screen buffer. So yes, effects depend on where you are... but actually, unless you have screen data that makes the copy end there, Super Glitch will also copy other data from RAM.
Essentially, the answer to your question is "Yes".
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: lukazoid on February 10, 2017, 03:32:24 pm
yeah I have been trying all sorts of different areas for learning the move and using it( even glitch city which always crashes) just got excited i found a 3trainerpoke in my pc after doing superglitch
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Tabbender on March 19, 2018, 04:26:27 pm
My game reacts oddly to the Cooltrainer move. Its type isn't even Cooltrainer, it's garbage data. Is this because it's the french version of the game ?

Also, i'm trying all i can to do the Cooltrainer glitch, and i actually did it once, but the game softlocked by repeatedly telling me Oak's "This isn't the time to use that" text as soon as i got in the bag, forcing me to reset without catching the pokemon.

Since then i absolutely can't trigger the corruption again. I tried changing the current box to an empty one and switching my 3rd and 5th party pokemon, nothing changed
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: ISSOtm on March 19, 2018, 05:12:57 pm
Yeah, the type is different in French versions.
Make sure your current box is an empty one, preferably one you never used (or the one which contained the least amount of Pokémon).
Also empty your party, preferably by depositing Pokémon 1 over and over, which will duplicate the remaining Pokémon's data in the party (thus, if it's a CT-friendly Pokémon, all stlos will contain its data).
The enemy Pokémon may also prevent the glitch from fulfilling itself ; I never got the corruption to work against Dugtrios.

The softlock was caused by an invalid battle mode, which forced you to use your first item constantly. This is usually caused by corrupting too much data, so ensure you have a $50 tile in a proper spot on-screen.
You can also mitigate such a softlock by placing your Balls in the first pack slot, so if it happens again, you'll capture the Pokémon like normal.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Tabbender on March 20, 2018, 01:15:24 pm
Weird, because i'm pretty sure i did everything right with the starting position, it does have some 50's at the end of the zone unless i missed something

http://image.noelshack.com/fichiers/2018/12/2/1521573060-20180320-200449.jpg (http://image.noelshack.com/fichiers/2018/12/2/1521573060-20180320-200449.jpg)

Also i did change the first item in the bag to a ball in case it happens again, and there's quite a lot of boxes i never used in my game, however i don't really get what you're saying about my party, are you saying i should deposit all pokemons besides my Ditto and the pokemon with Fly ?

EDIT: Just realized the 50's are probably too low, hm... the thing is, i was trying to have a 45 as the pokemon species in order to have a MissingNo, since encountering him in french versions will freeze the game
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: ISSOtm on March 20, 2018, 08:18:42 pm
To encounter Missingno in EU R/B, just perform Cooltrainer while having the last menu opened being the in-battle PkMn or Item menu, and Pokémon sprites are not flipped (if so, watch a Pokédex entry to cancel sprite flipping).
This will consistently give you a Missingno to capture.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Tabbender on March 21, 2018, 11:25:00 am
Thanks for the info, but won't the 50 be missing then ? Is the glitch actually dangerous if there's no 50 ?
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: ISSOtm on March 21, 2018, 01:02:49 pm
The 50 is on-screen in the battle menu. You just can't see it.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Tabbender on March 21, 2018, 03:55:10 pm
Oh, alright then.
Title: Re: Making "Super Glitch" moves useful (Red/Blue/Green)
Post by: Tabbender on March 23, 2018, 12:36:16 pm
Okay, so something really weird happened to me.

I switched to a box with exactly 9 Pokemon in it and since i did, the glitch started to work really well. I caught 6 MissingNo's and a Mankey. However, i then tried to load Pokemon 255 (Charizard 'M). When i tried to get to my Ditto's moves the game froze. Then i reseted, and since then i'm back to the state where i seemingly can't perform the glitch.

That's weird. I'll try to have less Pokemon in the current box and see what happens. Also, do you think the freeze might have anything to do with this or was it just a coincidence ?