Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Krys3000

Pages: [1] 2 3 ... 46
Arbitrary Code Execution Discussion / Re: Safe code for ace
« on: Today at 02:37:10 am »
I never use b in any code so I Inc b dec b etc. a lot
Nooooo you did the mistake to clone in box 1 hahaha

Anyway a while back someone had this issue on Prama's Discord and issotm made that process to help him. I still have the tm code version of it and will post it asap

EDIT: I made this in form of a TM code.

Use a code to get 255 TMs of all TMs (or at least 1 to 20) then store/toss all the following TMs
- 80 TM01 (you now have x175)
- 168 TM02 (you now have x87)
- 160 TM03 (you now have x95)
- 193 TM04 (you now have x62)
- 245 TM05 (you now have x10)
- 237 TM06 (you now have x18)
- 193 TM07 (you now have x62).
- 254 TM08 (you now have x1)
- 21 TM09 (you now have x234)
- 254 TM10, then, the last TM10 (don't store 255 as once)
- 191 TM11 (you now have x64)
- 222 TM12 (you now have x33)
- 239 TM13 (you now have x16)
- 82 TM14 (you now have x173)
- 80 TM15 (you now have x175)
- 221 TM16 (you now have x34)
- 194 TM17 (you now have x61)
- 136 TM18 (you now have x119)
- 237 TM19 (you now have x18)
- 54 TM20 (you now have x201)

Organise stored items this way:
TM04 x89 (not the real TM04 but the fake one, that you can obtained with a 'get any item' code)
TM25 x4
TM10 x(any quantity)

Execute code from items.
About the corruption induced by Bad Clones, you can read this:
I guess changing the Bad Clone and the clones used is the best move if you don't manage to get the corruption.

Also, would it be possible to use the gameshark/memory editor-item code to get the right tm in the wrong pocket, instead of using the bellsproud/mystery egg method? Or do you need to do the mystery egg method?

Of course this is possible but then it requires another ACE method to do it :)
Yes it will stay a Totodile once in daycare and be able to breed indeed  :)

Just make sure to understand that any movement of the Bad Clone is made at your own risks. Withdrawing, Moving, Storing or Depositing at the Day care a Bad Clone may or may not corrupt stuff :)
About this, it should also be said that since Bad Clones can corrupt the active box (sometimes not allowing you to place new Pokémon in it anymore), placing a Bad Clone in box 1 is an act of faith: if this box gets corrupted you will never be able to use the Pokétransfer to send your 2G Pokémon to the bank, since it only accepts box 1.
Corruption induced by Bad Clone unterminated names are based on hard-to-predict things (somewhat similarly to Cooltrainer corruptions); mostly the content of buffers. You might not have any issues with your game, but then someday you play with your Bad Clone and your game start freezing  ;)

Also you appear to be confusing two Bad Clones characteristics here. Every Bad Clone has an unterminated name, but this characteristic has no utility in G/S because the game doesn't read that name :( Any glitch that relies on the unterminated name (Crystal-only glitches, then), such as the original Bad Clone Trick, Bad Clone ACE, etc. can be performed with any Bad Clone because ALL Bad Clones have unterminated names. Aside from this, we can distinguish two classes of Bad Clones:
- Incomplete Bad Clones, which is a normal clone but with some missing data (at least an unterminated name, but it can also be lvl0, has no ID, no moves, etc.)
- Full Bad Clones, which always are unstable hybrids of the Pokémon used for cloning and the absence of Pokémon - as a result every single data from this Pokémon, including its Pokédex number, is missing; and if this Bad Clone is given to the Daycare, it will stabilize into Glitch Pokémon hex:00.
The only distinguishable marker between Incomplete and Full BCs is the Pokédex number in the profile. The fact that it is lvl 0, female and stuff is not sufficient - if the Pokédex number is not 0, the Pokémon won't turn into a Glitch Pokémon hex:00  :)

Having a Full Bad Clone is not important for Crystal glitches relying on unterminated name, because this is a different thing that is shared by every Bad Clone. However, if you intend to use a glitch that requires a Glitch Pokémon hex:00 (such as the modern Bad Clone Trick) then you will need a Full Bad Clone.

It is important to note that this is rarely done in Crystal because using unterminated name-based glitches are as powerful as Glitch Pokémon hex:00-based glitches; but using the aforementioned corruption in Crystal, you can turn any Incomplete Bad Clone into an hybrid, which gives him the possibility to turn into a Glitch Pokémon hex:00 and enjoy any glitch anyway without having to specifically generate a Full Bad Clone  ;D. To that extent, Crystal is a good game for Bad Cloning.

In G/S, Bad Clone's unterminated name is displayed as "empty", resulting in the game not reading it, and therefore it doesn't cause any harm. In Crystal versions however, Bad Clone's unterminated name, when displayed (as a bunch of "?" because of some obscure subprogram), keep being read until eventually finding the end of the name (known as a "terminator" - an ingame character which is supposed to end a name but in this case is absent).

This eventually corrupts pretty much everything in the way to the next terminator and can result in freezes or Pokémon box or party corruptions. It is the basis for many glitches, because if you save/reset just before opening the PC box containing the Bad Clone, you can manage to corrupt the sprites of the other Pokémon in this box into Kingdra (because the buffer for Pokémon sprite gets corrupted by the Bad Clone's name) and this allows you to transform these Pokémon into another Pokémon (based on its moves for example) - it's called the Bad Clone Trick.

Another clever use of the Bad Clone is to view a Max Elixer in the Bag (WITHOUT SELECTING IT) before opening a PC Box containing a Bad Clone, which results (if correctly done) in arbitrary code execution.

The more things you do before opening a box or party with a Bad Clone inside, the more chances you have it will cross a terminator instantly and won't corrupt anything. The safest way to keep you Bad Clone quiet is to save/reset in front of a PC, view a Ice Berry in your bag and then open the PC Box containing the Bad Clone. This process will insert a terminator right after the unterminated name.

If you intend to use the Bad Clone for glitching purpose, maybe in the future, keep that clone around in an unused box until you're ready. If you don't wan't to, I advise you to release it asap.
No worries  :)

We're here to help; but please guys, do some researching effort sometimes. You can read this to learn how to use a gameshark code or RAM Map with arbitrary code execution. The only difference is that RAM addresses in Yellow are shifted by one (encounter address is $CFDD in R/B, $CFDC in Y; as a result, the gameshark code will be 01XXDDCF in R/B and 01XXDCCF in Y)
Thanks for that code, that's very helpful!

The good thing with mail codes is that just like item codes, they are international and can be used in every localization. Box charset in German G/S/C and French Crystal doesn't allow coding, unfortunately; so we have to translate everything into another type of code everytime for international members, and this takes a lot of time  :(
Thanks Torchic  ;)

Why is this not pinned. I was about to create a thread for bad clone ACE and then found out this existed.

Also, this is a much better setup for bad clone ACE:

(Note that you will have to pop something one additional time before returning, or else values in the range of (HL) will be corrupted after returning)

That setup is already in the guide in section IV.2 (B). Indeed it's a very cool setup because it allows mail box codes, which is not allowed by Crystal_'s setup in section IV.2 (A). I use items codes quite often so I don't mind doing Crystal_'s setup but I think it would be very cool to have a lot of mail box codes to use with lucky's setup :)
There is an explanation of the differences between Coin Case and TM codes in a few replies to the newcomers guide to G/S/C ACE. You will basically read there what is needed in a Coin Case code compared to TM codes so you can see if a code is designed for Coin Case.

Also, I wonder why people keep doing the TM25 setup. Preparing TM17 for ACE is easier...
Generation II Glitch Discussion / Re: Glitch weather conditions
« on: February 24, 2018, 10:42:29 am »
Cool! It's always interesting to find new ACE vectors. This one requires ACE to be setup but it could be an interesting alternative to WPTM.

In Crystal, the corresponding address is $C70A. I wonder if glitch weather executes code also in this game, because if so, we could use it as a good source of ACE instead of using BC-ACE to set up WPTM.

PS: I've researched a lot RAM addresses using maps and disasm on G/S/C lately, to build the 2G Gameshark section of PRAMA. So I may want to add a lot of Gameshark codes to GCL's pages soon :)
That's very interesting! Thanks Crystal_ for the work, and ISSOtm for the report.

It's cool to see that we can still learn about yet another quirk that only gets discovered 20 years after the game gets released  :P
Very cool!

I've tried all glitches contact (either as the caller of receiver) in french games lately. hex:AF was among those who didn't answer and never called, but I don't think I tried it in the morning so maybe it's possible to get the Master Ball x42 in other localizations too. There are however differences between localizations for at least some glitch contacts, as I wasn't able to replicate some known english results of glitch contacts in my french game.

That being said, in french games (and possibly english?) hex:46 and hex:C6 in G/S, as well as hex:D3 and hex:E9 (when called) and hex:69 (when calls) in Crystal, give TMs to the player before freezing. Although I wouldn't probably be very helpful, I wonder if there's also a way to get them without freeze.

Since we're talking about it, some glitch contacts in french games have very unlikely effects.
- Hex:3E (G/S, called) displays a "you don't have enough space in party" message (I did not try with less than 6 Pokémon)
- Hex:38 (C, called) displays a message that could translate into "no window for apparition" with a weird music. Then freezes.
- Hex:84 (G/S, called) starts the Team Rocket theme, but then freezes.
- Hex:E0 (G/S, when calls) asks you to choose between YES and NO, but whatever your answer is, hangs up. Lol.
- Hex:5F and hex:DB (C, when calls) asks you to choose a Pokémon, but nothing happens.
- Hex:9B (G/S, when calls) and hex:AC (C, when calls) asks you to choose a Pokémon, but then freezes suddently.
- Hex:B0 and hex:BD (C, called) asks you to choose a Pokémon, then displays a glitched map. If you exit, it will ask you again to choose, but this time it will freeze.
- Hex:2A (C, called) gives a Forretress for some reason, but then it freezes the game.
- Hex:2A and hex:E2 (G/S, called) start the game credits (but doesn't finish the game).
- However, hex:B8 (G/S, when calls) does indeed finish the game instantly, registering you to the HoF, but when the game restarts, it freezes after a few steps.
- Interestingly, this works well with hex:54 and hex:E8 (C, when calls) as it will register you to HoO and finish the game, and then you will be able to continue it.
- Also very interestingly, hex:57, hex:D8 and hex:FB (G/S, when calls) triggers a fight against Glitch Pokémon hex:00.

If we were able to stabilize the side-effects from these, preventing the freezes, it could be cool :)
Pages: [1] 2 3 ... 46