Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - TheZZAZZGlitch

Pages: [1]
In some unknown circumstances, checking the Lucky Number lottery in Goldenrod City seems to draw data from out of bounds Pokémon entries. There are multiple reports scattered across the Internet, where people got ID matches with Pokémon "in their PC box" which they never owned.

One of my old friends got this to happen too, a very long time ago - the game stated he had a ????? in his PC. I was a kid back then, so I didn't really think much about it. But now, I decided to revisit this curiosity.

I don't have any save files which reproduce the issue, so I had to go in blind. Lucky Number winners are determined by this CheckForLuckyNumberWinners subroutine in the disassembly.
Unfortunately, even after going through it line by line multiple times, I just can't seem to find the bug.

Boxed Pokémon data is read directly from SRAM. This behavior makes the lottery capable of drawing Pokémon data from previous save files. I wondered how the lottery would behave without any save file present. However, resetting a save file in G/S/C sets all bytes in SRAM to 0x00, not 0xFF. So all of the boxes are correctly considered empty, and there are no out of bounds reads. This seems like a dead end.

Anyone have some ideas?
Pokémon Discussion / Any text dumps of Japanese Gen I games?
« on: April 12, 2017, 07:17:45 am »
I really need to find a full text dump of any Japanese Gen I Pokemon game (don't ask why ;))

Any attempts of Googling it failed miserably, even when I entered the keywords in Japanese.
I also recall seeing such a text dump at least once in my life, so I'm sure it exists.

Normally I'd just attempt to make my own dump, but my knowledge of Japanese is really limited and I wouldn't really be able to separate the real ingame text from false-positives. If someone already made it, this would save me a lot of work.

The question is: are there any text dumps of Japanese Gen I Pokemon games? And where can I find them?
I planned to do this for a long time. In Gen I, we have a lot of glitches that exploit certain obscure details of the GB hardware or rely on undefined behavior, yet it still isn't exactly clear what behavior is exhibited by certain emulators and the real console. Thankfully, we have an easy way to execute any code we want with 8F. It's a good opportunity to test if everything works exactly as we think it works. I welcome everyone with working 8F setups on VC/console/mobile emulators/other devices to run the following 8F scripts and see if we have 100% accuracy for our glitching purposes.

If my request gets some interest, this table will be filled with data regarding the most important systems.
Also let me know if someone thinks of another relevant test to add.

Last updated 2016-07-22


1 - the emulator breaks into a debugger every time an undefined opcode is encountered
2 - brings up the infamous message "unknown opcode xx at yyyy"
3 - the result is 127 instead of 124 - this behavior needs to be more thoroughly investigated
4 - the game hangs without any message
5 - unknown opcodes are ignored, most likely because of the emulator hooking them to communicate with the hardware
6 - (probably) always returns 0
7 - displays a message: "The saved data has been corrupted, so it is impossible to CONTINUE. Please reset the game and choose NEW GAME", the save is not corrupted though
8 - (probably) always returns 255 - so VRAM access is enabled not during the V-Blank period, but during the V-Blank interrupt, which changes things dramatically
9 - some other data seems to be stored in the echo RAM area
10 - some corrupted stops work, some not - this is to be expected with undefined behavior

The tests themselves:


Self-explanatory. This is intended to test whether the target system ignores invalid opcodes, or crashes/halts when they are executed. This behavior could potentially affect any glitches that execute data as code (invalid sound banks, invalid item/move effect pointers).

TM27         x201

Code: [Select]

If the game continues running after executing the script - FAIL
If the system brings up an error message or the game hangs or crashes - PASS


This checks how the system handles switching to non-existent ROM banks. This determines the behavior of glitches that cause invalid bank switches - most commonly invalid sound banks or invalid predefined commands.

Lemonade     x65
Repel        x32
X Speed      x79
Ultra Ball   x198
Fire Stone   x71
Moon Stone   x35
Water Stone  x201

Code: [Select]
ld a,41
ld e,20
ld b,e
ld c,a
ld (bc),a
add 20
ld b,a
ld a,(bc)
inc hl
ldi (hl),a

The third item's quantity changes to 124 - PASS.
Third item's quantity changes to something other than 124, like 255 or 0 - FAIL.
Remember to reset item 3's quantity if you want to repeat the test.


VRAM data can only be read or written during V-Blank, H-Blank, or when the LCD screen is turned off. Otherwise, the write operation will be ignored, and all read operations will return FF. This test checks this behavior. Emulation of VRAM inaccessibility is essential for correct behavior of a lot of popular glitches, including Cooltrainer, Super Glitch, Brock Through Walls and any other glitches that attempt to "search through the entire address space".

Lemonade     xAny
Repel        x144
X Speed      x175
PP Up        x35
Moon Stone   x34
TM01         xAny

Code: [Select]
ld a,??
ld e,90
ld b,e
xor a
ld c,a
inc hl
ld a,(bc)
ldi (hl),a

Run the script multiple times in a row and observe the quantity of the third item.
If it changes seemingly randomly between 255 and any other value - PASS
If it never becomes 255, even after trying multiple times - FAIL


Because of how GB's address line works, RAM addresses $C000~$DDFF are mirrored at $E000~$FDFF. This repeated section of memory is called the echo RAM. Because this feature was hardly used by anyone, several emulators don't support it. This test is intended to verify whether echo RAM is emulated correctly. Emulation of this feature changes the behavior of glitches that cause extensive memory corruption, like Pokemon beyond the sixth slot, or Dokokashira Door Glitch. Also, Coin Case arbitrary code execution won't work without echo RAM emulation.

Lemonade     xAny
Repel        x241
X Speed      x44
Fresh Water  x175
TM06         x88
PP Up        x10
Water Stone  x201

Code: [Select]
ld a,00
ld e,f1
ld b,e
inc l
inc a
xor a
adc a,58
ld c,a
ld a,(bc)
ldi (hl),a

Run the script and check the quantity of item 3.
If it changes to the code of the first letter in the player's name - PASS
If it doesn't change, or changes to a wrong value, like FF or 00 - FAIL


This is to test how the system reacts to invalid STOP opcodes. This behavior could affect some of the non-ACE Coin Case glitches, along with all glitches that execute data as code (invalid sound banks, invalid item/move effect pointers)

Full Restore x??
TM01         xAny

Code: [Select]
stop ??

Start with an arbitrary amount of Full Restores.
Run the 8F script. If the game crashes/halts whenever the script is executed - PASS
If not, try running the script with a different amount of Full Restores and repeat the process.
If after several tries the game is still running - FAIL.
I might have gone too far. The game has become self-aware.
Save me from the grasps of MISSINGNO., the world's ultimate glitch creature.

This small game is something special I made for this year's April Fools' Day (original video). It's already 2nd of April, so I decided to publish the game here as a fun challenge.

I might have been a bit inconsiderate when researching Pokémon glitches. I was captured by MISSINGNO. and sent into his world. Now, you need to save me, and MISSINGNO. really wants you to answer a few questions in the meantime...

Oh, and there's also an online high score list - that's what the event is about.
All participants will have their names, scores and messages showcased in a special video on my channel.

  • You can rescue me.
  • Actually, I'm rescuing myself. You only keep MISSINGNO. busy in the meantime.
  • 30 questions with increasing difficulty.
  • Connected to an online high score list (at least for the next 2 days).
  • If someone plays this game, could you count the Undertale references for me? I'm not very good at it.


Note: For some unknown reason, Microsoft Security Essentials recognizes this game as a virus. It's most likely because of the code obfuscation techniques used to prevent people from examining the game too easily. To make things even worse, Chrome will also treat the executable as 'unsafe', since Chrome pretty much blocks any EXE that is not commonly downloaded. These are all just false-positives. A virus would make a really bad joke, don't you think? I miss the times when you could make shitty fangames in RPG Maker or something, send them to the Internet and no one would ever complain.

Also, people reported problems with running this game on 64-bit Windows 10 machines. The framework used to create this game was released 9 years ago - this was to be expected. But I didn't have anything better handy, and I had to code the game in a few days. The game runs fine on Wine - there may be some problems with sound, but they can be fixed by installing additional

High scores!

The high score list will be active for the next 2 days (until 4th of April 2016 14:30:00 GMT).
In Japanese versions, the tile responsible for the ID of Pokemon found during this glitch seems to be here:

In international releases the memory layout has changed and instead, the tile is located here:

In English versions the relevant tile happens to be constant - it's always the vertical textbox border tile ($7C). So no matter the location, the hooked Metapod will always appear.
General Discussion / Updating Bulbapedia's glitch articles
« on: October 25, 2013, 09:12:54 am »
Sometimes I look into Bulbapedia's articles regarding Pokemon glitches, and I feel like they are extremely outdated. So I'm thinking about updating Bulbapedia to include the most recent discoveries in glitchology. However, I have two questions I can't answer by myself, and I want the users to help me find the answers:

1. Is it OK for the GCL community to use/copy (and modify) research notes published by other users?
2. What do you think: Should Bulbapedia articles regarding glitches be updated?
Completed Projects/Dexes / Full list of all (14336) trainer rosters
« on: July 08, 2013, 05:50:46 am »
Inspired by Darkness_LordII's compilation of glitch trainers, I decided to write a small C++ program to make a full list of all possible (both normal and glitched) rosters in the game. Thought such a list might be useful someday.

List for Red/Blue version:

List for Yellow version:

List for JP Green version:

Warning: Those text files are quite big (70000 lines each) and standard text editors like Notepad may not open them.

I was recently doing research on JP versions' Dokokashira door glitch, and I noticed something very interesting.

Prior to today, people have been explaining this glitch as either "switching a Pokemon with an item" or "switching an item with the current warp location", which without select glitches sounded impossible to perform on English versions. However, I accidentally noticed while opening up the memory viewer screen, that the switched Pokemon data has nothing to do with item data, nor the warp location byte.

Investigating further, I decided to check exactly what happens while pressing Select on the Pokemon screen, and it looks like it's nothing more than switching the first Pokemon with the second. Or in this particular early-game case, switching the end of list marker (0xFF) to the first position. This confuses the subroutine which applies the poison damage in the overworld, causing it to check way too many "Pokemon" for poison damage, decrementing massive amounts of RAM addresses while thinking they are your Pokemon's health points.

The fact is that no select glitches are necessary to do it - the only thing necessary is a way to either switch the first Pokemon with a end-of-list terminator, or somehow remove the 0xFF terminator from the list - as was beautifully shown by Torchickens' "Forcing select button glitches to work on Pokémon Red and Blue".

So the overall plan to do this in English versions is to either:
1. Get more than 6 Pokemon
2. Swap the (NumberOfPokemon+1)th Pokemon with the first

...or just corrupt the memory so the end-of-list terminator gets erased.

This means that the Dokokashira door glitch still exists in English versions, but it's not available in early game.
How to do it without select glitches or cheating? Well, the easiest possible way to do this is with Super Glitch (I feel like doing everything with Super Glitch recently, lolz). I'm pretty sure it should be possible with the save abuse/save corruption in Yellow as well.

Unfortunately, because English versions have different RAM layout, only some of the effects from Japanese versions could be seen in English games. For example, during the glitch, the "changing map tiles" effect is present in all versions (JP Red/JP Green/EN Red/EN Blue/EN Yellow), but changing the warp destination every 4 steps happens only in Japanese editions (JP Red/JP Green).


1. Overwrite addresses D163-D2F6 (Red/Blue) or D162-D2F5 (Yellow) with any value matching a hex number of $X0, $X1, $X2, $X3, $X4, $X5, $X6, $X7.
2. Have fun.


- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 27 characters in total
     (for example: BODY SLAM [9 chars], MEGA KICK [9 chars], WATER GUN [9 chars])
- At least 1 Escape Rope in bag

1. Go to the nearest Pokemon Center, turn on the PC and turn it off. This will copy the correct screen data.
2. Walk (!) to the Diglett's Cave. Do not open your start menu while going there.
3. Once you arrive to the cave, encounter a wild Pokemon.
4. Open your fight menu a couple of times, and run away from the battle.
5. There's a slight chance that Super Glitch won't work as expected. If you end up in a glitched copy of Pallet Town, reset the game and start from the beginning.
6. Open up the save menu and cancel the glitched yes/no dialog. Use an Escape Rope afterwards.
7. The English version Dokokashira door glitch is active.

A video is worth a thousand words:


In Yellow it is a little bit trickier, but still possible.

- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 27 characters in total
     (for example: BODY SLAM [9 chars], MEGA KICK [9 chars], WATER GUN [9 chars])
- Access to Safari Zone

1. Do the standard Safari Zone reset trick to make the game count your safari steps in the overworld
2. Go to the Pokemon Center, land your second to last step in front of the PC
3. Go to the Pokemon Storage System and continuously view stats of your Super Glitch Pokemon until it changes into Slowbro. This may require a lot of tries.
4. Walk a step more and you will get teleported to the Safari Gate. Walk out and the Yellow version Dokokashira door glitch is active.

A video is worth a thousand words:


Here are some effects I noticed in English Red/Blue only:
 - If Clefable is owned/caught (Pokédex), Pokédex byte #3 (Capture flags for Pokédex numbers 17-24) will get decremented every 4 steps
 - Also, number of items decrements every 4 steps if the quantity of the first item in the bag matches a hex number of $X8, $X9, $XA, $XB, $XC, $XD, $XE, $XF
 - If the 4th Pokémon in the party has a hex identifier of $X8, $X9, $XA, $XB, $XC, $XD, $XE, $XF, the identifier of Pokémon #2 will get decremented every 4 steps
 - Some of the items in the PC (16th, 21st, 39th and 43rd to be exact) have their identifiers decremented every 4 steps
Here are some effects I noticed in Yellow only:
 - After walking a huge amount of steps (around 300) the map connection byte gets decremented once. This may cause weird effects like entering Lavender Town through Vermilion City's map connection.
 - The sprites will randomly teleport across the screen or change into Red sprites
 - Sometimes, after entering a new location, the music will take a lot more time to fade out
 - The walking speed becomes very slow
Those effects are present in both Red and Yellow:
 - Random Pokemon keep fainting even though nothing is poisoned
 - Sometimes artifacts appear on the screen
 - Some of the map tiles get changed around every 4 steps
 - In some locations (locations where music track ID matches a hex number of $X8, $X9, $XA, $XB, $XC, $XD, $XE, $XF) music gets screwed up after walking 4 steps
 - Some event flags also get reset or set every 4 steps. Not sure which ones.
 - If quantity of item #5 in bag matches a hex number of $X8, $X9, $XA, $XB, $XC, $XD, $XE, $XF, the quantity of item #4 will get decremented every 4 steps
 - Certain maps turn into a mess of illegible tiles after walking 4 steps in them (caves, Pokemon Centres, Celadon Mansion...)


If you're using VisualBoyAdvance for emulating, make sure you have the most recent version.
Anything Dokokashira-related doesn't work in early VBA versions, as versions before VBA RR v20.0 didn't emulate echo RAM correctly.
Newcomers: I highly recommend you read beyond this thread's first post. Thanks to the later posts you will learn how to do the described glitch on Yellow, Japanese Red/Green/Yellow or other international releases.


8F is a Red/Blue equivalent of JP Red/Green's 5かい - an item executing machine code starting from $D163 (Number of Pokemon) upon use. Its hex identifier is 0x5D, despite its hex-like name. 8F is treated by the game as a key item and it can't be tossed away or sold in the mart.

As address $D163 contains re-writeable data, it is possible to redirect the instruction pointer to the item list with relative jumps and easily run arbitrary code just by spelling the opcodes with items. With enough items, one could also make a program that reads key input continuously, writes it somewhere in the RAM and jumps to it after a while, allowing to even run your own homebrew software.




 - Access to any event that removes an item from your inventory (Saffron guards, handing out a fossil in Cinnabar Lab, etc.)
 - A following item list:
   Any item x[Any qty]
   X Special x255
   Item you need to give away x1

If you don't have access to any item-removing event, you can still do the "dry variation" of the glitch, by following the steps described here.


1. Toss the first item. It should change to X Special x255
2. Continue tossing the first item until the item menu "stops responding"
3. Trigger an event that removes the item from your inventory
4. Now, you should have 255 items with you. Go to the eastmost corner of Celadon City:

5. Toss 254 of your X Specials. Then swap the 'X Special x1' with 'Nugget x1' (35th item)
6. Try walking to the right - the map should now loop back to the left side of Celadon City. The amount of steps you take to the right determines the item you will get, so position yourself properly to obtain 8F. Swap it with the first item, then fly back to Celadon.
7. Store one of your newly acquired glitch items into the PC. Then buy any 3 items to bring your inventory back to normal.

A video of this method (makes it a lot easier to understand):



 - A Ditto with a Cooltrainer move, nicknamed "R:u"
 - At least 1 Escape Rope
 - Good Rod on your 4th item slot
 - Exactly 10 Pokemon in your current box (this tremendously increases the chances of Cooltrainer move working properly)
 - Preferably a Bicycle, to make things a little bit faster.


1. Heal your Pokemon in Fuchsia City's Pokemon Center.
2. Do the Safari Zone walk through walls glitch, with only Ditto in your party.
3. After you appear back at the Fuchsia City's Center with noclip activated, walk exactly:
 a) 19 steps west
 b) 28 steps north
 c) 1 step west
 d) 29 steps north
 e) 11 steps east
4. Open your Pokemon menu and close it (important). You may want to use bicycle now to travel faster - you won't be able to do this later.
5. Go 11 steps west and keep walking south until you find yourself back on Route 18. Do not open your Start menu from now on.
6. Walk/bike to Seafoam Islands and enter the cave.
7. Encounter a wild Pokemon, and continuously try to use the Cooltrainer move. If it does not work after about 15 tries, quit the battle and start a new one. Do not open your Pokemon menu, Item menu or Start menu at all!
8. Eventually, the music will fade out, the move typing will become blank, and name of the opponent will get changed. Catch the resulting Pokemon - the game will state you caught a "98", and your Good Rod will turn into an 8F.
9. Use an Escape Rope, as there's a slight chance the game will crash after exiting the cave normally.


This method is not recommended - it has a lot of side effects and is terribly complicated. Use it only when any other method does not seem to work for you.


 - A Pokemon on the first slot meeting very specific requirements:
    > It needs to have a Super Glitch as a 4th move
    > Its three moves besides the Super Glitch have to contain 25 characters in total
    > One of its three moves needs to be 4 characters long
    > This Pokemon needs to be able to learn Mega Kick through TM05
    An example: ?L ||?M 4 (hex C6) with moves Body Slam, TM50, Quick Attack, [Super Glitch]
 - Any Pokemon on the second slot you don't care about, nicknamed "cccccccc". It will be gone in the process, so don't use your L100 Charizard.
 - A Pokemon on the third slot knowing Fly.
 - Exactly 3 useless items in your Bag. They will get destroyed again, so don't pick anything important.
 - TM05 (Mega Kick), deposited in the PC
 - At least one free space in the PC to store your obtained 8F
 - An empty Pokemon box currently selected, most likely box 12


Sadly, those side effects are actually quite annoying. But also, happily enough, one can fix them with 8F's arbitrary code execution.

1. Your player name will become blank (the game will save just fine though). However, with 8F's arbitrary code execution capabilities, one can change his name back to something nice.
2. Lower 5 Pokedex bytes will become corrupted, displaying some yet unseen species as caught. There's no easy way to fix this, but it's not a big deal unless you care about your Pokedex progression.
3. Your Pokemon box may get to a state where trying to release the glitch Pokemon inside will crash the game. This side effect does not happen every time, but if it does, again, this can be fixed with 8F's arbitrary code execution.



8F won't do anything amazing by itself. In order to make it execute code from $D322 (third item), we need to use the party Pokemon to spell out a short program. This program will redirect the instruction pointer to the item pack, so that the effects of 8F become easier to control. This process is referred to as bootstrapping.

There are several bootstrapping configurations that are easier or harder to set up. Below I listed the most commonly used ones.

Pigdevil2010's Pokémon Red/Blue 8F 5-Pokémon 233 HP bootstrap (recommended)

1.  Exactly 5 Pokémon in the party                                    [0xD163 = 0x05]
2.  Pidgey as the first Pokémon                                       [0xD164 = 0x24]
3.  Parasect as the second Pokémon                                    [0xD165 = 0x2E]
4.  Onix as the third Pokémon                                         [0xD166 = 0x22]
5.  Tentacool as the fourth Pokémon                                   [0xD167 = 0x18]
6.  Kangaskhan as the fifth Pokémon                                   [0xD168 = 0x02]
7.  First Pokémon's current HP has to be exactly 233                  [0xD16D = 0xE9]

TheZZAZZGlitch's Pokémon Red/Blue 8F 6-Pokémon 233 Attack bootstrap (outdated, but still popular)

1.  Exactly 5 Pokémon in the party                                    [0xD163 = 0x05]
2.  Onix as the first Pokémon                                         [0xD164 = 0x22]
3.  Pidgey as the second Pokémon                                      [0xD165 = 0x24]
4.  Tentacool as the third Pokémon                                    [0xD165 = 0x18]
5.  Meowth as the fourth Pokémon                                      [0xD166 = 0x4D]
6.  24 PP left on the second Pokémon's second move w/ 0 PP Ups used   [0xD1B5 = 0x18]
7.  21 PP left on the second Pokémon's third move w/ 1 PP Up used     [0xD1B6 = 0x55]
8.  36 PP left on the fourth Pokémon's first move w/ 0 PP Ups used    [0xD20C = 0x24]
9.  24 PP left on the fourth Pokémon's second move w/ 0 PP Ups used   [0xD20D = 0x18]
10. 20 PP left on the fourth Pokémon's third move w/ 0 PP Ups used    [0xD20E = 0x14]
11. Double Team as the fifth Pokémon's first move                     [0xD223 = 0x68]
12. Double Kick as the fifth Pokémon's second move                    [0xD224 = 0x18]
13. Strength as the fifth Pokémon's third move                        [0xD225 = 0x46]
14. Sixth Pokémon's attack stat has to be exactly 233                 [0xD26C = 0xE9]

Super-compressed 3-Pokémon setup (problematic because of hex D3 glitch Pokémon, which can be difficult to obtain; also, some item lists do not work with this setup)

1.  Exactly 6 Pokémon in the party                                    [0xD163 = 0x06]
2.  Hex C3 glitch Pokémon as the first Pokémon                        [0xD164 = 0xC3]
3.  Onix as the second Pokémon                                        [0xD165 = 0x22]
4.  Hex D3 glitch Pokémon as the third Pokémon                        [0xD166 = 0xD3]

There are other versions of the game (Yellow and foreign language localizations of R/B) where items similar to 8F exist. Most notable is the 'ws m' item in Yellow, which executes code starting from the current PC Pokémon storage box. For your convenience, here are several bootstrapping setups for Yellow:

Pigdevil2010's Pokémon Yellow 'ws m' 10-Pokémon 233 HP bootstrap (recommended)
TheZZAZZGlitch's Pokémon Yellow 'ws m' 20-Pokémon 233 HP bootstrap (also recommended, since a lot of the Pokémon on the list are Geodudes and Slowpokes, which are easy to catch)
Pigdevil2010's Pokémon Yellow 'ws m' 19-Pokémon bootstrap


Well, now we're done with all those preparations, let's try to actually do something with this item! Below I present some examples of what is possible.


This is just K)ry's ASM for JP Red/Green ported on the international release. With those items, 8F will act like an item that forces a Pokemon encounter based on the quantity of item #1, allowing to catch all 151 Pokemon easily.


ITEM LIST (starting from the first slot):
* Preferably Master Balls
* 8F
TM50                 x31
TM11                 x4
TM34                 x89
TM08                 x201

Code: [Select]
WRA1:D322 FA 1F D3         ld   a,(D31F)
WRA1:D325 04               inc  b
WRA1:D326 EA 59 D0         ld   (D059),a
WRA1:D329 C9               ret 


This version of the Catch 'Em All script requires more items, but gives the Pokemon instead of forcing an encounter (like: BLUE got EEVEE!), and allows for getting normally unobtainable glitch Pokemon without trading. The given Pokemon depends on the quantity of the 3rd item.

Remark: Avoid obtaining Missingno with this method. It will duplicate your 6th item and screw the opcodes up.


ITEM LIST (starting from the first slot):
* Any item
* 8F
Repel                x[SpeciesIndex]
X Speed              x14
Ultra Ball           x64
TM05                 x72
Lemonade             x201

Code: [Select]
WRA1:D322 1E 20            ld   e,[SpeciesIndex]
WRA1:D324 43               ld   b,e
WRA1:D325 0E 02            ld   c,02
WRA1:D327 40               ld   b,b
WRA1:D328 CD 48 3E         call 3E48
WRA1:D32B C9               ret


With this setup, you can change your name to the nickname of your first Pokemon. Using 8F will copy one letter from your first Pokemon's nickname to your player name. Use 8F (length of the name+1) times to copy all the name characters.
Warning: This code is self modifying, it will increase quantities of items #3 and #5 every use - remember to set those quantities back to 181 and 88 if you want to reset this. Also use carefully, as there's no memory protection implemented and you may cause save corruption if you're not careful.


ITEM LIST (starting from the first slot):
* Any item
* 8F
TM50                 x181
TM10                 x64
TM34                 x88
TM09                 x46
Calcium              x52
X Accuracy           x35
Full Heal            x201

Code: [Select]
WRA1:D322 FA B5 D2         ld   a,(D2B5)
WRA1:D325 40               ld   b,b
WRA1:D326 EA 58 D1         ld   (D158),a
WRA1:D329 2E 27            ld   l,27
WRA1:D32B 34               inc  (hl)
WRA1:D32C 2E 23            ld   l,23
WRA1:D32E 34               inc  (hl)
WRA1:D32F C9               ret 


This easy code uses only 3 basic items, and it increases the first item's index by 1 every time 8F is used. You can obtain normally unobtainable items, glitch items or TMs so you can do other item configurations described.


ITEM LIST (starting from the first slot):
* 8F
* Item you want to morph
Burn Heal            x43
Ice Heal             x43
Full Heal            x201

Code: [Select]
WRA1:D322 0C               inc  c
WRA1:D323 2B               dec  hl
WRA1:D324 0D               dec  c
WRA1:D325 2B               dec  hl
WRA1:D32A 34               inc  (hl)
WRA1:D32B C9               ret


Jump off a ledge after using 8F to walk through walls.

ITEM LIST (starting from the first slot):
* Any item
* 8F
TM34                 x20
TM15                 x201

Code: [Select]
WRA1:D322 EA 14 D7         ld (d714),a
WRA1:D325 C9               ret


This turns 8F into an item which allows escaping from any battle, including trainer battles.

ITEM LIST (starting from the first slot):
* Any item
* 8F
TM34                 x120
TM08                 x201

Code: [Select]
WRA1:D322 EA 78 D0         ld (d078),a
WRA1:D325 C9               ret


When 8F was first discovered, the method of obtaining it had a slight chance to corrupt Pokemon at the PC box, causing crashes when trying to release/withdraw them. One can either deal with it and switch to another box, or make the box empty with this item configuration.

Switch to the corrupted box, use 8F, done. Be careful though, you don't probably want to clear the box with your L100 legendaries.


ITEM LIST (starting from the first slot):
* Any item
* 8F
Lemonade             x1
Soda Pop             x64
TM34                 x128
TM18                 x201

Code: [Select]
WRA1:D322 3E 01            ld a,01
WRA1:D324 3D               dec a
WRA1:D325 40               ld b,b
WRA1:D326 EA 80 DA         ld (da80),a
WRA1:D329 C9               ret


Possibilities with 8F are unlimited. Here are some other item lists, posted by different people throughout the years (wow, this glitch is 3 years old now? I didn't realize).

Pseudo-GameShark (aka change any byte in RAM to any value) (by Wack0)
Instant Hall of Fame (by Wack0)
Pokémon Yellow US - play Pikachu's Beach (by Wack0)
Change OT of the first slot Pokémon (by blahpy)
Perpetually resetting save file (by Wack0)
Max stat Exp and DVs (by eironeia)
Set debug mode flag (by Rena)
Get 255 of second item (by lowena)
Daycare Pokémon cloning (by Skeef)
Set/unset badges (by Skeef)
Change a Pokémon's typing (by hashtag)
Reusable RAM writer (by Torchickens)
Make Pokémon shiny when traded to Gen II (by Krys3000 & thelinekioubeur)

List last updated on: 2016-07-04


All of those item lists will have at least one item with quantity bigger than 99. Obviously, it's possible to obtain those big quantities using the Missingno. item duplication glitch (duplicating a 99 item stack will result in a 227 item stack).
However, the numbers bigger than 9 are represented with glitch blobs, so it's normally impossible to read how many items you actually have. This short image guide below will help you with reading quantities of those big item stacks.

* This image uses the Pokemon Center tileset
Well, I've been doing a lot of Super Glitch research for a year now, and I finally decided to show off some things that I found.
At the moment, Super Glitches are considered only as a fun little distraction without real use. And my goal is to turn things around and make them useful and predictable. Because if you think long enough, these moves have quite the power. They can write large numbers of values to the RAM by just displaying their names. You may also think "if there was a way to manipulate values or range of Super Glitch's memory corruption, that would be amazing".

OK, done with this boring foreword. Yes, there is a way to manipulate (and exploit) the way Super Glitch modifies the RAM. It worked on 4 different savefiles on emulator and on the actual cart, so I'm pretty sure it will work for everyone. But before we go into how to do it and before I show you some examples of useful "Super Glitch glitches", let's talk about some theory.

We all know Super Glitch heavily messes up the game's RAM. But from where it gets those values from? And where does it write? And why it even writes those values?
This is a subject worth a 10-page research document, but I will at least try to make this short and quick, presenting only a few facts needed. If you want a more detailed, technical explanation, read

First of all, it's not the move that is real dangerous, it's the name of the move that makes the game go weird. Super Glitch's name pointer is read wrongly by the game, and it makes the game believe the name of this move resides in the RAM. Which is an absolute nonsense, RAM has no move names at all. And when the game tries to read a move name, it buffers it byte by byte until it encounters a terminator byte (0x50). The problem is, RAM most likely won't ever contain a terminating character. So the game copies way more data than it should, resulting in a buffer overflow. And this is why Super Glitches corrupt the RAM.
The data is copied from address $CD6D, the buffer for move loading subroutine. And it is copied to $D0E1, the moveset buffer if you activate Super Glitch by viewing stats/learning a move/opening the fight menu, or to $CF4B if you activate Super Glitch by selecting/using it in battle. The buffer overflow causes a huge number of bytes from $CD6D to be copied to either $D0E1 or $CF4B.

And if we look what does the $CD6D address contains, we will find out that there’s a full screen copy here!

What does it mean? By changing what's on the screen at the moment, we can manipulate the values Super Glitch writes! And by positioning 0x50 overworld tiles on the exact places on the screen, we can also manipulate the length of Super Glitch corruption! However, the screen information here isn’t just ordinary screen copy at the moment, it is refreshed only at certain times:
  • While opening the Pokemon menu (both overworld and in-battle)
  • While opening the Item menu (both overworld and in-battle)
  • While opening the Pokedex menu
  • While opening the trainer card screen
  • While opening the Save menu
  • While opening the Options menu
  • While accessing the PC
  • While watching the title screen
  • Every time the game has to display a full screen message and needs to cloak the overworld map

This is even more convenient for us! If you for example open up the item menu in overworld, close it immediately, and go into a battle, if you don’t open any menus while battling, the overworld screen copy will still be there as there was no need to overwrite it. By opening and closing the Pokemon menu in certain spots and not opening the start menu anymore, we can cause a single Super Glitch effect to happen almost 100% of the time.

Also, because $D0E1 is not a single move buffer but a move list, a number of characters the move names before the Super Glitch have can also affect the length and values of corruption, shuffling the corrupted address by around 1-10 bytes.


Moveset: Agility, Agility, TM28, [Super Glitch]
Agility [7 chars] + Agility [7 chars] + TM28 [4 chars] = 18 chars
D0E116 + 1810 + 310* = D0F616   
The Super Glitch will start its corruption at address $D0F6

Moveset: Barrage, Clamp, [Super Glitch], Hi Jump Kick
Barrage [7 chars] + Clamp [5 chars] = 12 chars
D0E116 + 1210 + 210* = D0EF16   
The Super Glitch will start its corruption at address $D0EF

* - while calculating the resulting starting address you have to add number of moves before the Super Glitch, as they are separated within the code by an invisible whitespace line feed character 0x4E

Now we have some information on how to modify the values Super Glitch writes - so let's jump into some useful applications of it!

Harmless Super Glitch trick
Use: You can use this trick to learn/forget Super Glitches without any problem, view stats of Pokemon with Super Glitch moves, or swap/use Super Glitches in battle without crazy effects.
Statistics: Worked on all 5 tested saves on the first try.
- A Pokemon with Super Glitch, obviously.
- Access to Celadon City.


1. Go to the exact spot shown on the screenshot below (1st floor of Celadon Mansion). Open up your Pokemon menu while still standing on that spot.

2. Congratulations. You just now immune to Super Glitches' glitchiness. Now you can learn, forget, view stats with Super Glitches involved without risking your save file.
3. You can also carry this effect to your local patch of grass in order to swap or use Super Glitches in battle without risk. Just open your Pokemon menu again, close it, go into a patch of grass and fight.
Note: Do not open your start menu at all while going to the grass or while fighting. This will reset Super Glitch to its usual glitchness.

Screenshots from all 5 tested saves:

Access Pokemon beyond the sixth slot
Use: With a corrupted Pokemon list and a corrupted item list (achievable using corrupted Pokemon list), you can make a lot of serious memory modifications - it's like having a memory viewer in your GB.
Statistics: Save #1,4,5 - Worked on the 1st try, Save #2,3 - Worked on the second try
- Access to Celadon City.
- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 28 characters in total
     (for example: BODY SLAM [9 chars], DOUBLESLAP [10 chars], WATER GUN [9 chars])
- At least 5 Pokemon in your party, a party of 6 is recommended.
These moveset requirements aren't a real problem if you're using LM4, as its default starting moveset has 3 moves with 28 characters in total.
LM4 will have to learn no new moves till level 24, and at level 24 Hypnosis should be replaced with Super Glitch. Then you will be able to use previously described Harmless Super Glitch trick to switch the first move with the last.
Note: 4 first Pokemon in your party will change their species, but it isn't a problem as you're probably not going to save after this glitch anyways.


1. Go to the exact spot shown on the screenshot below (second to last house on Celadon's south-east). Open up and close immediately your Pokemon menu while still standing on that spot.

2. Go into a patch of grass and encounter a wild Pokemon. Again, do not open your start menu while going there.
3. Open and close your fight menu a few times, the run from the battle.
4. Check your Pokemon list. Try to scroll past your 6th Pokemon. If you can't, repeat step 1. If you can - congratulations, you did it. If your game crashes, you obviously did something wrong.

Screenshots from all 5 tested saves:

Erase player's name
Use: This generates a perfectly blank properly terminated name, allowing you to save the game after you do something really game-breaking (Super Glitch, ZZAZZ, 2x2x2x2 after messing with 3906 for a while etc.), or you can just amaze your friends with an unobtainable name.
Statistics: Save #1,2,4 - Worked on the 1st try, Save #3,5 - Worked on the second try
- Access to Cerulean City.
- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 28 characters in total
     (for example: BODY SLAM [9 chars], DOUBLESLAP [10 chars], WATER GUN [9 chars])
- Access to the field move Fly
- Balls of steel if you want to save afterwards


1. Go to the exact spot shown on the screenshot below (south-west corner of Cerulean City). Open up and close immediately your Pokemon menu while still standing on that spot.

2. Go into a patch of grass and encounter a wild Pokemon. Again, do not open your start menu while going there.
3. Open up and close your fight menu a few times, then run from the battle.
4. Your name should be now blank. However, it is still unsafe to save your progress.
5. Open up the start menu and select 'SAVE'. Don't freak out. When a glitched yes/no box appears, press B to cancel out.
6. You should end up in a glitch city. Fly away anywhere and you're now free to save. Saving is even recommended, as glitched trainers will now also appear instead of normal ones, and reloading the game will fix this problem. It shouldn't erase your game, I saved on 4 files (wasn't brave enough to do this on a cart) and the game was perfectly fine.

Screenshots from all 5 tested saves:

Use: Has no real use; It is here just to show how you can make Super Glitches predictable.
Statistics: Worked on all 5 tested saves on the first try.
- A Pokemon with Super Glitch, obviously.


1. Encounter a wild Pokemon.
2. Open your Pokemon menu (in-battle) and close it shortly afterwards.
3. Open the fight menu and select (don't have to use) the Super Glitch move.
4. TMTRAINER 100% guaranteed. If it doesn't work, back out, open your Pokemon menu again, go back and try again.

Screenshots from all 5 tested saves:

Catch a level 82 Hitmonchan with (almost) infinite HP
Use: Making your way through E4, trolling people on link battles, having a partner for your 'Mew Smash'
Statistics: Save #1: 3 tries, Save #2: 1 tries, Save #3: 5 tries, Save #4: 7 tries, Save #5: 4 tries
- Access to Celadon City.
- A Pokemon meeting very specific moveset requirements:
   a) It needs to have a Super Glitch as a 4th move,
   b) Its three moves besides the Super Glitch have to contain 28 characters in total
     (for example: BODY SLAM [9 chars], DOUBLESLAP [10 chars], WATER GUN [9 chars])
- Access to Route 14

1. Go to the exact spot shown on the screenshot below (Route 14's northmost field of grass). Open up and close immediately your Pokemon menu while still standing on that spot.

2. Optional step: Save your game. This will help you out as you may need a few tries to get this to work. After reloading the save you have to open your Pokemon menu again to rewrite your screen data, just saying (testers have been shouting LOLZ IT DOESNT WORK!!!1 while they forgot about opening the Pokemon menu after reloading the save).
3. Go find a wild Pokemon
4. Open the fight menu and continuously try to select the Super Glitch move. It will eventually change its type to either the name of last trainer battled, or a blank space.
5. Press B to exit out. You should end up fighting a Pokemon named with a bunch of player name characters. If it crashes, you failed - try again.
6. Open your item menu and use anything you're not supposed to (a bicycle or something). It should say your name followed by usual "not the time to use that". If your name is glitched, you failed - try again.
7. Throw all the Pokeballs. After you succeed, the game will state you caught a Hitmonchan. Congratulations!

Note: A nice side effect is the fact your Super Glitcher (LM4 or whatever monstrosity you use) gains infinite HP too. Another not so nice side effect is that both Hitmonchan and Glitcher gain status ailments, and healing them in a Pokemon Center will get rid of their amazing HP. You may need to use a full heal or something.

Screenshots from all 5 tested saves:

Some other remarks:
 - I already have another interesting idea: Super Glitch name, and the Old Man trick. Could be very interesting.
 - Sadly, all presented glitches (with exception of the first part of Harmless Super Glitch trick) do not work in Yellow. Newer versions handle battle screens a little bit differently, not allowing me to carry overworld screen data to a battle. However, the way of manipulating Super Glitch's written values remains the same. Maybe someone will find a workaround soon.
 - All this stuff is experimental. I am not responsible for your lost save files, you try this at your own risk.
 - This is my first GCL publication, don't rage very hard if I made some mistakes.

And that's all so far. But it isn't the end. I'm pretty sure either the people will come up with something amazing, or I will find some more stuff soon. I see a rosy future ahead for Super Glitch and its possibilities, my findings are only the beginning.
Pages: [1]