Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - Princess Torchic Owl Lover ☽ ❤

Pages: [1] 2 3 ... 29
In Pokémon Ruby, you can use code 0202FF5E:XXXX to modify Elite Four Sidney in the Pokémon League. 000 to 2B5 are valid, but can be glitchy and/or unused. 2B6+ and beyond however are glitch Trainers.

Post your finds here. :) Not sure if Pokémon other than Level 0 Decamarks are common as of now.

02B7: EAIAcRICKY CHARMANDER - Level 0 Decamark; Forces Safari Zone mode
Arbitrary Code Execution Discussion / ACE Requests thread
« on: June 28, 2019, 12:49:17 pm »
Submit all your arbitrary code execution requests here. :)

My request:
A program that can read the contents of every ROM bank with a GUI, based on TheZZAZZGlitch's/offgao's memory editor.

Reasons: 1. It would take many pages to print the Pokémon Red disassembly, if Internet was to die or it was taken down.
2. Reverse engineering is better legal appeal than piracy - like the cheat devices before it (i.e. GameShark/Xploder cheat search trainer tools etc.).

Talk about your broken game cartridges/discs/etc. here

1. My Qix Adventure Game Boy cartridge: No matter how many times I boot it and try to blow on it it always results in the same corrupted boot ROM logo. The corrupted logo is exactly the same between different Game Boy systems, suggesting it's not just one system's read error.

2. My rusted Stadium 2 cartridge. Someone sold me a Stadium 2 cartridge, but the contacts were rusted. I did a technique to clean the contacts; and it eventually worked. However, later the music would shift to noise and crackling sounds. Later it stopped working again. Unfortunately I could not return it and had to buy a new one which is sad considering they are quite valuable nowadays.

3. Black boxes/lines for sprites on rare occasions load on my Pocket Monsters Green cartridge(s). This however is not uncommon in terms of how many people have also experienced the same thing.

4. The various dead battery Pokémon Crystal, Gold/Silver, and an international (French/German or Italian) Red/Blue/Yellow (not sure which probably Red) cartridge  that deleted a completed save. Most of the time you may see it with the Generation II cartridges due to the save battery being linked with the real-time clock, especially now. It also affects my Telefang cartridge.

5. Sennen Kazoku (GBA) has a save battery. If it is dead you can't play the game at all due to an error message before the title screen. Many of them nowadays don't work, which is why it's a good idea to get it on Japanese Wii U Virtual Console instead.

6. A strange load error for Densetsu no Stafy at one time, where the file menus had corrupted progress. I thought I had lost my saves, but on a next reboot they were fine. So it may have just been a read error; although I read Densetsu no Stafy has a save battery rather (or along with) than flash memory too, maybe it could be dying.
Requires a cheating device but I wonder if a tile permissions glitch was found we could do it without cheats?

Note this is from memory and I only have access to my phone right now, so details are vague. I recorded it though so can share the video soon! :)

So basically, Pinball RS has a debug menu of sort. The debug menu allows you to move the ball with the d pad, and you can force it out of bounds too (but that's a different trick generally). Someone found it a long time ago and codes to enable it for the US version are on TCRF.

This may not be the full story but with steps like this, you can get messages that a specific glitch Pokemon was caught: It seems entering catch mode, catching the Pokemon then immediately moving the ball to the evolution building(?) in a certain way bypasses the choose which Pokemon to evolve menu and just uses the previous Pokemon as the one that is going to evolve. If you evolve Pokemon that can't normally evolve the glitch message may appear. When I evolved Solrock, the resulting glitch Pokemon had glitch characters for its name, I think glitch sounds played and a glitch sprite may(?) have shown too.

By going straight to evolution, you can try to evolve what seems to be hex 0000 as well (? as picture if I remember correctly), but interestingly it evolved into Treecko.

Hope people can have fun with this. ^^ ♡
I had a cool idea maybe we could challenge anyone interested in doing a ィ゙ゃゾA (00)  only run. :)

ィ゙ゃゾA (00) (at least in Red/Green v1.0) is among the weakest glitch Pokémon. Its back sprite can freeze the game (and apparently is more likely to do this on v1.0). Its base stats are: 0 HP, 1 Attack, 3 Defense, 0 Speed, 1 Special. Every level it will try to evolve into a Clefairy, which is an extra nuisance.

This said, ィ゙ゃゾA (00)  has a few qualities that save it. - It can learn Counter so it will be able to deal some damage. It can also learn Horn Drill (albeit at Level 127; I don't think that's a problem though because of Select glitches. You would need lots of X Speeds though, and if X Accuracies work exactly like the English version, one X Accuracy will always guarantee Horn Drill hits as long as you're faster and there is no type immunity). Hopefully its experience group does not keep it at Level 1. But if it does I guess it will be much much harder. -_-

Considering this as like a Nuzlocke run, you may have different preferences on the rules which is of course up to you:

1. I'm against Pokémon merge glitch and want to work on its 'natural' moves, but others may disagrees.
2. Given the nature of this glitch Pokémon, additional glitches to win may almost be a necessity. One example is exploiting infinite Rare Candies, another is using Select glitches and stat underflow (from Level 255 to 0) to temporarily top up its HP.
3. Some people may want to avoid battles and jump to credits, others win every battle. Some may want to abuse in-battle glitches like CoolTrainer to win.

In Japanese Yellow v1.0 (which features one of the 'steal Pokémon' glitch items), there are three (natural) glitch Trainers with rosters sourced from SRAM.

0B A5 ;glitch/f8
A5 A5 ;glitch/fc
0E A5 ;glitch/fe


Unlike TheZZAZZGlitch's video, I wasn't able to have the SRAM unlocked when encountering them. However, if you try to encounter their roster 5 (01053AD0) and then use the 01xx36D0 code, something interesting happens depending on the contents of RAM at C000, where audio data is stored.

Because presumably the music has to reset and then change to the Trainer battle music from the beginning, you possibly always get the same result; a Level 85 Omanyte, followed by Level 85 glitch Pokémon 0xE5, Jigglypuff, MissingNo. 0x45, and Eevee.

Something different can be said however if you are to force the sound bank to change to maps 1 (02), maps 2 (1F), Yellow only music (28). This can be done with codes 01xxEFC0, 01xxF0C0 but the effects are possibly achievable with arbitrary code execution to constantly write to those addresses.

02: Level 72 Omanyte, glitch Pokémon 0xDD, Jigglypuff, MissingNo. 0x3F, and Eevee.
1F: Level 75 Omanyte, glitch Pokémon 0xE3, Jigglypuff, Dragonite and Eevee.
28: Level 64 glitch Pokémon 0xF8, glitch Pokémon 0xDD, Jigglypuff, Venonat and Eevee.

Exploring invalid sound banks may also yield more results.

Unfortunately you may not be able to fight this glitch Trainer due to freezing AI without the code 010118D0 in the middle of the battle (you could also use an ACE item within battle to set it). ✿
Based on an article about video game localization.

Basically for Famicom owners, this could be a free GameShark.

Quote from: Clyde Mandelin
Fans quickly discovered another way to do this 256 Worlds trick: use Family BASIC to alter memory addresses directly. The trick for this was:

Connect the Famicom and the Famicom BASIC
Insert the backup cartridge and turn the power on
Bring up the menu screen using the keyboard, then press “1” on the keyboard to start BASIC
Enter the code written below
Press F8 to run the program
Where it says “WORLD=?”, type the number of the world you want to play and hit Return
Once it says “OK” on the screen, eject the backup cartridge with the system still on
Insert the Super Mario Bros. cartridge
Reset the game
Use the continue code at the title screen – hold A and press Start
You’re now at the world you selected!
The BASIC code is this:

20 POKE &H7FF,&HA5
40 POKE &H7FD,A+255AND255"

Found this from a buried submission to Unseen64 in 2010. I know TCRF is more of an authority now, but it may be worth checking as it could be a find lost to time.

The thing is; given they provided an offset (557AF0 presumably for Emerald unless attributed wrong) it's possible it does exist, but it could also be used by the game code just in a subtle way.

Thoughts? ✿
It seems a way to get Victini in Pokémon Black and White has been discovered (using Poké Transfer of a glitched Regigigas with a glitch held item obtained with Retire glitch). This sounds amazing, and I wonder if we can get the unused Lock Capsule item with a similar method, or perform sequence breaks by obtaining specific items. Discuss.

Edit: PRAMA have a guide. I may try to record this in English. ✿

Umm actually it may be an April's Fool joke. I'm sorry.


Should I lock this?
Writing / How our carnal desires never left us
« on: June 03, 2019, 09:35:37 am »
Basically this philosophy is about human nature. Before we were humans, we may have been monkeys, and previously other animals such as fish. In fact some societies believe we all have one common ancestor; and I have read at some point neither male/female sexuality existed.

Now think of a male wolf; the wolf finds love by the sword/fighting. And a female hen; she finds love by receptiveness and through waking dreaming; embracing she doesn't know with nurture. It may be because the female hen is tasked with protecting her children; where as the male wolf is tasked with being the animus (sunshine) to the woman's animus.

But slowly it feels times are changing; our sexuality will be less relevant in the future. I hate to blasphemise the words of my own religion, but it feels something has to change. It feels like men are manipulating women into submission; because knowledge is power. In other words, science is the new sword; the new gnashing of teeth, and we do this with things that aren't even scientific (such as psychological "facts"). The carnal urge never left the man, its through the knowledge of apparent "truth"; but science is slowly revealing a greater answer with time. Now, think of Christianity; this was created for men. If you notice, many animals are dying; religion is human-centric. Times need to change so that we no longer abuse our fellow animal friends, but "men are becoming more like women" and "women more like men", where society is either focusing a little too much on labels and double-sided concepts (take Brexit and democracy) or blatant faith without science (take politicians' denial of climate change as a significant issue). The answer perhaps should be a combination of both; the so-called "toxic masculinity" and femininity; until gender no longer matters.

What we need to do based on gender stereotypes:

For men - respect women's menstrual cycles (in the very process of living as a woman I've been through this). Truth is both men and women get angry. If a woman feels you are wrong, don't give her logic; open your heart. We do this by letting all of our thoughts pass through, not only that but through humbleness that you may not know the answer.

For women - respect logic

This way this causes a chemical reaction; and our carnal desires slowly pass away. Yet if conservation of energy is true, there will be new challenges in transformation we need to address with science and self-discovery. Conservation of energy may not even be true. It may be that society is getting worse; bluntly said - as at first bacteria could multiply by themselves without the need of sex (some form of splitting).

The middle-way:

When you practise this form of self-help (if you believe in it, I may be wrong), try to remember male/female gender (rather than sex) are matters of the heart, and depending on how you feel; there is no male/female (paradoxically there is if you feel that way) with acknowledgement of both sides. Its.. like, I don't want to say either, "transgenderhood is real", "transgenderhood is philosophically incorrect" ; spiritually it is (as spirituality is feeling - this doesn't have to be magical thinking: simply because say, inspiration to watch a movie inspires us). Constant thinking may lead us to illness, whereas constant imagination can lead to delusion. However, both ways cognitive bias never leaves us.

If you feel abused, don't be afraid to speak up. See:

We Are All Just Monkeys

At the same time, don't feel afraid to imagine and believe there may be a purpose or god that we create ourselves (even if it's faith in our friends).
Is there a way to print a 0x50 sub-tile on the screen that stays after opening the menu? Alternatively, are there ways to bypass the need of a 0x50 sub-tile on the screen altogether? (e.g. data past the screen buffer?)

If possible, via 9F (RB)/-g m (Y), etc. to save the screen, this could allow for many more LG/CoolTrainer results, without Rival LOL glitch.

By extension; is there a way to print other sub-tiles (e.g. 0x00) that are normally impossible with text bytes due to loading control characters instead?

Not looking for:

*Arbitrary code execution methods: As you can do most things with these, and it would disqualify for a lot of potential speedrun categories.
*RAM Glitch Cities: As you could redirect the game's tileblock pointer (D35E/D35D in RB or D35D/D35E in Y) to say stored items in which you could have your own data (including the necessary 0x50 sub-tile), and access all species outputs supported by tile blocks/glitch tile blocks, without having to find the locations or Glitch Cities from wrong warping (D365/D364 method or maybe the warps structure later in the expanded inventory) yourself. ✿
Arbitrary Code Execution Discussion / Where to get started
« on: April 25, 2019, 11:52:39 am »
When I was originally first trying to make ACE codes, the following links helped.

You can start with simple instructions like

Code: [Select]
ld a, 15
ld [$d059] ,a
(3E 15 EA 59 D0 C9) to encounter Mew, and other 'RAM write' codes and modify them. The tables linked also tell you what a byte / opcode / operand maps to which item / quantity. In Yellow, a lot of addresses are shifted by 1, so in that example you would use ld [$d058], a instead for Yellow Mew.

If you use BGB's debugger, you can compile opcodes without doing it by hand, and see their byte representation. (right-click the screen, Other -> Debugger, use Ctrl+G to reach destinations quickly)
You can also set a breakpoint (double-click a location in the code panel, or use F2) at address $D322 (which corresponds to item 3's ID), or wherever your bootstrap code is, to see how it affects the registers and the memory. The step into (F7) and step over (F3) commands allow stepping through the execution one line at a time.

The game will keep running fine if you alter the value of all registers except sp, so feel free to use "padding" instructions such as "inc b" (maps to a Poké Ball) to make your code easier to set up and avoid rare/glitch items.

Later you can start reading the document ISSOtm posted for things like calling other addresses and setting conditions in your code. For example, when you want to call other functions, you can use the "call" instruction with the pointer (based on above memory map link) of your choice. Some functions in the ROM can be found here and require certain conditions. One of the most common, the bank switch (located at address $35d6) requires b and hl to be set to a specific value (which you can do with "ld b, xx" etc.), then when you use call 35d6 the address at b:hl is executed.

Hope this helps. ^_^ ✿

(EDIT by ISSOtm: fixed and clarified wording, changed resource links.)
Generation II Glitch Discussion / Glitch cry bases
« on: April 23, 2019, 10:38:51 pm »

1. Play English Pokémon Crystal
2. Choose Chikorita
3. Enter XXB-119-2AE XXB-129-E6A where XX on the first code is above 0x43 (or you can use real IDs below 0x44 (first code) and equal to 0x00 (second code) for a safer genetically modified, Chikorita)
4. Listen to Chikorita's cry
5. ????

(Modifies 3C:6B11 and 6B12 or offsets 0xF2B11 and 0xF2B12)

Here are the first ten:

I haven't got codes for English Gold/Silver yet but may make them soon. :)

I'm wondering, if anyone knows if you can access that unused cry base the incorrect way this way please? (or any method of playing it for that matter). Do we also know where it is in Generation I? Not sure where it is on the disassembly. Thanks. ✿

Edit: After a little bit of research, found this at $E91B0:

3C 7D 74 3C 86 74 3C 8F 74 3C 98 74 3C A1 74 3C AA 74 3C B3 74 3C BC 74 3C C5 74 3C CE 74 3C D7 74 3C E0 74 3C E9 74 3C F2 74 3C FB 74 3C 04 75 3C 0D 75 3C 16 75 3C 1F 75 3C 28 75 3C 31 75 3C 3A 75 3C 43 75 3C 4C 75 3C 55 75 3C 5E 75 3C 67 75 3C 70 75 3C 79 75 3C 82 75 3C 8B 75 3C 94 75 3C 9D 75 3C A6 75 3C AF 75 3C B8 75 3C C1 75 3C CA 75 3C 81 6D 3C 96 6D 3C 8A 6D 3C DE 6D 3C 9F 6D 3C C0 6D 3C 90 6D 3C A8 6D 3C B1 6D 3C B7 6D 3C C6 6D 3C CF 6D 3C 35 6E 3C D8 6D 3C 3E 6E 3C E7 6D 3C ED 6D 3C 6B 6E 3C F6 6D 3C 74 6E 3C 08 6E 3C 11 6E 3C 1A 6E 3C 23 6E 3C 2C 6E 3C 62 6E 3C 47 6E 3C 50 6E 3C 59 6E 3C FF 6D

Seems to be the pointer table to the base cry data, which goes:

3C:747D Cry_Nidoran_M
3C:7486 Cry_Nidoran_F
3C:748F Cry_Slowpoke
3C:7498 Cry_Kangaskhan
3C:74A1 Cry_Charmander
3C:74AA Cry_Grimer
3C:74B3 Cry_Voltorb
3C:74BC Cry_Muk
3C:74C5 Cry_Oddish
3C:74CE Cry_Raichu
3C:74D7 Cry_Nidoqueen
3C:74E0 Cry_Diglett
3C:74E9 Cry_Seel
3C:74F2 Cry_Drowzee
3C:74FB Cry_Pidgey
3C:7504 Cry_Bulbasaur
3C:750D Cry_Spearow
3C:7516 Cry_Rhydon
3C:751F Cry_Golem
3C:7528 Cry_Blastoise
3C:7531 Cry_Pidgeotto
3C:753A Cry_Weedle
3C:7543 Cry_Caterpie
3C:754C Cry_Ekans
3C:7555 Cry_Fearow
3C:755E Cry_Clefairy
3C:7567 Cry_Venonat
3C:7570 Cry_Lapras
3C:7579 Cry_Metapod
3C:7582 Cry_Squirtle
3C:758B Cry_Paras
3C:7594 Cry_Growlithe
3C:759D Cry_Krabby
3C:75A6 Cry_Psyduck
3C:75AF Cry_Rattata
3C:75B8 Cry_Vileplume
3C:75C1 Cry_Vulpix
3C:75CA Cry_Weepinbell
3C:6D81 Cry_Marill
3C:6D96 Cry_Spinarak
3C:6D8A Cry_Togepi
3C:6DDE Cry_Girafarig
3C:6D9F Cry_Raikou
3C:6DC0 Cry_Mareep
3C:6D90 Cry_Togetic
3C:6DA8 Cry_Hoothoot
3C:6DB1 Cry_Sentret
3C:6DB7 Cry_Slowking
3C:6DC6 Cry_Cyndaquil
3C:6DCF Cry_Chikorita
3C:6E35 Cry_Totodile
3C:6DD8 Cry_Gligar
3C:6E3E Cry_Cleffa
3C:6DE7 Cry_Slugma
3C:6DED Cry_Ledyba
3C:6E6B Cry_Entei
3C:6DF6 Cry_Wooper
3C:6E74 Cry_Mantine
3C:6E08 Cry_Typhlosion
3C:6E11 Cry_Natu
3C:6E1A Cry_Teddiursa
3C:6E23 Cry_Sunflora
3C:6E2C Cry_Ampharos
3C:6E62 Cry_Magcargo
3C:6E47 Cry_Pichu
3C:6E50 Cry_Aipom
3C:6E59 Cry_Dunsparce
3C:6DFF Cry_Donphan

So it seems like now with Game Genie, we can recreate that unused cry base at 3C:75D3 or even make our own custom cries, by modifying one of the existing cry base pointers either to ROM or RAM (arbitrary cry). Neat. ^^ But how would we simulate that with ACE with the cry data in SRAM?

Edit: I found out how to play that cry with Game Genie codes for EN Crystal, replacing Marill's cry and posted it on TCRF and YouTube:

XXB-D09-E6E (upper length value)
XXB-CF9-6EA (lower length value)
XXB-CE9-E6E (echo value)
XXB-CD9-806 (pitch value)
Thanks to Metarkrai, TheZZAZZGlitch and others, we have documented that Pokémon Emerald arbitrary code execution exists and is viable, however, these methods may be subject to Dynamic Memory Allocation (DMA) and may take a lot of patience to succeed.

When I checked the memory of Pokémon Ruby however, it seemed that DMA was not present (at least at certain regions of the memory), hence in theory; an ACE executing glitch move will always give the same result, without the luck factor. Patience would still be needed to initially obtain the glitch Pokémon (or if there is not a way to transfer it, possibly the glitch Pokémon Egg) in Pokémon Emerald or FireRed/LeafGreen however, once traded, a non-DMA influenced ACE method could save much time in the future.

Pokémon Ruby ACE would also have an additional advantage, namely that the sound test in North American and Japanese Ruby (otherwise exclusive to Japanese Emerald) may be accessible in a reliable and persistent way.

However, I'm unsure whether this subject has been discussed in terms of putting it into practice before. What are our thoughts on this? ✿

Notes: In Pokémon Emerald, the glitch items that may be necessary for this can be duplicated; including access of glitched quantities (over 999?) with Pomeg glitch data corruption. I don't know whether this is possible in EN Pokémon Ruby and if there is a viable solution (at least as of now). I wonder whether we can use something else.
Pages: [1] 2 3 ... 29