Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Topics - Evie the Bird Mother 🌸 ☽

Pages: [1] 2 3 ... 33
1
Video Games Discussion / General/random game discussions
« on: Yesterday at 08:44:20 pm »
Recently I've been listening to the music from a game called Ihatovo Monogatari. It was composed by Tsukasa Tawada; the same person who worked on Pokémon Colosseum and Pokémon XD; so it has some lovely majestic sounding music. It received a Satellaview version as well.

I don't have much else to say however as I don't know much about the game yet; so I decided to start this as a general thread to chat about recent games we've gotten into.

Edit: More regarding that video game composer, if you have a Switch Online subscription and a Switch you may be able to easily play one of his other non-Pokémon games he's composed for, called Earth Defense Force for SNES on the selection of SNES games. I feel this one sounds quite like something from Pokémon Colosseum/XD. https://www.youtube.com/watch?v=EWc7TdV2b4w&list=PL04FE1288F70772BA&index=2
2
This thread will link to resources which reveal the pointers for things like 'out of bounds' item effects, move effects, and so on. The pointer tables are sorted by index number and pointer, so we can research them precisely and find arbitrary code executions.

(For now this thread is really short but I'm working on filling it up. Feel free to add any lists and would really appreciate ^^)

Using the SYM files (entrpntr's https://github.com/entrpntr/symfiles and my outdated ones https://sites.google.com/site/torchickens2/sym-files ) and the disassembly projects as a guide I'd like to cover as many 'glitch things' where the game does things like 'jp hl' or another means of accessing the pointer as possible.

For now, I'll only post pointers and past Pastebin dumps etc., but later I might post dumps of the actual code of the items and so on. Additionally in this thread, I'll post dumps of the Generation I (and later maybe other generations) base data structures for Pokédex No. 000-255. This should help with the unused glitch Pokémon families you need Game Genie/patching for, and any missing data for the other glitch Pokémon currently omitted on the wiki.

Generation I:

EN Red/Blue:

Pokédex base structure: Begins at $383DE in both EN Red and Yellow. 0x0383DE + (PkmnNo. − 1) × 0x1C will lead you to the offset for data for Pokémon (and glitch Pokémon) with the specified Pokédex number. The structure is documented at https://hax.iimarckus.org/files/missingno_explained.html and Bulbapedia http://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_base_stats_data_structure_in_Generation_I

(Dump of $100x$1C bytes: https://pastebin.com/yj0xLZFn (dumped by me))

Level up data and evolution data: Taken from the pointer table described with the data structure in this post https://forums.glitchcity.info/index.php?topic=5217.0 (to-do: add dump)

Item effect pointers: https://pastebin.com/KNBmC60Z (dumped by luckytyphlosion)
Type name pointers: https://pastebin.com/dYE9ZFNX (dumped by me)

Cry data by Pokémon index number (not Dex order): 0x39446 https://hax.iimarckus.org/topic/581/ (to-do: dump)

Menu sprite icon used (Pokédex order): $7190D one nybble per entry (source: https://hax.iimarckus.org/topic/637/ ) (to-do: dump)

Palette used for Pokémon on SGB: 0x725c8 (Pokédex order): Source: https://hax.iimarckus.org/topic/109/

Box SRAM pointers: (Add)

Encounter data by map pointers: (Add)

EN Yellow:

Pokédex base structure: Works like in EN Red.

(Dump of $100x$1C bytes: https://pastebin.com/KRUTtecC (dumped by me))

Level up data and evolution data: Taken from the pointer table described with the data structure in this post https://forums.glitchcity.info/index.php?topic=5217.0 (to-do: add dump)

Item effect pointers: https://pastebin.com/4Z9ygjcQ (dumped by luckytyphlosion)
Type name pointers: https://pastebin.com/dYE9ZFNX (dumped by me)

Cry data by Pokémon index number (not Dex order): 0x39462 https://hax.iimarckus.org/topic/581/ (to-do: dump)

Box SRAM pointers: (Add)

Encounter data by map pointers: (Add)

Palette used for Pokémon on SGB or GBC: (Add)

Generation II:

EN Gold:

(;These need documentation of the data structure)
Phone contact scripts: https://pastebin.com/cTPhrUpj (dumped by me)

EN Crystal:

Pokédex sorting script pointers: https://pastebin.com/rJc54xsG (dumped by luckytyphlosion)

Phone contact script pointers: https://pastebin.com/amJbgb72 (dumped by me)

JP Crystal:

Wrong pocket TM/HM pointers: https://pastebin.com/vMa147xv (dumped by me)

Generation III:

(Empty for now)

Generation IV+:

(Also empty)

I don't know the Nintendo DS architecture enough to know how these work (if glitch things are generally from extrapolations like Generations I, II, [III?]).
3
Generation I Glitch Discussion / New(?) powerful non-ACE glitch
« on: June 20, 2020, 02:24:07 pm »
Not sure what to call this exploit, and wonder if anyone else knows it yet. Maybe I'll call it "box breaker". It's a little like the glitch mart pwner, because it's a customisable buffer overflow. You can corrupt your name and party Pokémon too, but with more freedom than Super Glitch as this data is taken from the last Pokémon data in the box.

Basically, this glitch involves bad storage boxes. There is a way to precisely access boxes beyond box 12, and that is by touching memory address D5A0 with dry underflow glitch but set up in the items PC. It will be one of the item quantities representing your box number, which for this glitch (but you can do many more things in theory!) you can change to 0D (x13) or 8D (x141), placing you in box 14. From there, changing the box to itself will update DA80 (current box contents).

In order to retrieve a PC box, the game grabs a pointer (which is meant to be in SRAM) and copies it into DA80. However, for box 14 hl is CD7A (in RAM, not SRAM! which soon contains things like the last mart items @cf7b) when de is DA80 so the game copies content beginning from CD7A, nice.

However, in the process there is a buffer overflow, and data around that afrea (CD7A, maybe actually starting somewhere else) is corrupted based on the last contents of the box. So you can start on a valid box with your own Pokémon, and use that to affect the result once you modify D5A0 to the invalid box. By setting a breakpoint in BGB debugger for a convenient address like D059 (the encounter once the box is closed) or D157 (player name), you can find the source (+1) in hl while the pointer (D059/D157 etc.) is in de.

In these cases, DD60 affects D059 (last character in Trainer name for 5th Pokémon, followed by first character for 6th Pokémon) and DE5E (nickname for 9th Pokémon first character) affects D157.  In other words, we can change our name to match the 9th Pokémon (which can be renamed with the Name Rater), including names over 7 characters (however, you can only have a maximum of 10 or 11+ will delete the save) and then use the new name to encounter different Pokémon with the old man glitch. Old man glitch is also more efficient in this case. Another idea might be to name yourself a glitch Pokémon with invalid characters, to get Pokémon like Mew (0x15 character)). You can do anything you want RAM write-wise with arbitrary code execution and connection copier already, so this is another means.

Additionally, Pokémon 18's Speed EV lower byte (DCDF) affects CFD8! Maybe with enough manipulation you can catch anything you want with this (and not restricted to IDs 1-199), unless the Pokémon's experience group freezes the game (only applies to a few glitch Pokémon in Yellow where I haven't tested porting the glitch to yet).

Another idea might be to simply directly change the Pokémon in your party. DE6B (nickname for 10th Pokémon 3rd character) seems to touch D164, however the name input characters are usually $80+, making some Pokémon inaccessible. However, somehow I was able to have a past Level 100 Mewtwo in my party and because the terminators were broken, I could keep depositing the top Mewtwo which filled over 7 boxes. So this is also a cartridge mass cloning glitch as an alternative to the Virtual Console Poké Transporter one.

Another use of this glitch is withdrawing the Pokémon in the glitch storage boxes (but you have to be careful to avoid freezes). So if the Pokémon were taken from RAM, maybe with enough luck there might be a glitch to convert an item quantity into a PC Pokémon or similar?


Edit: So the pointers that get corrupted can vary by the invalid box you choose. There are some quite interesting ones in Red, from my notes

10 get "trainer" glitch mon in day care
15 write to cd38 based on db3a(?)
1a f622 (interesting, event flags) also 1e
1b dc43 mew from afe2? [3:b1a4]
27 fa7a
28 c050
29 ffcc  (pokemon 1 speed ev lower byte must be 00 daae so fff9 not set disabling controls]
2b cdd6
2d 8012 (vram corruption; break some sprites)
2e disables buttons
32 cd3e freeze
34 7e14 touches vram 8000+
35 cd13 freeze
3c cdb7
3f another wtw enabling can open start but cursor broke
42 e551 - tile corruption bgmap2?
4b cd05
52 cd1b freeze
55 cdbb
5d cb8f semi freeze
68 facd
69 d5a1 [find map warp address source]
6a 7fe7 touches vram
6d cc2b
71 cd0a
73 d422
74 cd7a
79 cd08
7b f622
7c afe2/??
7f c122

I did a few extra tests for those indices and the box data was again sourced as the data to write to the pointer (i.e. like in 15). Maybe all of them take the box data and write it to the pointer. The ones above D3/F3 like f622 are interesting, and other than through glitch meta map scripts/other glitch map related things you don't see corruption of event flags very often. Of note is also 29 (ffcc), which writes to the HRAM. If FFF9 is 00, the buttons won't be disabled, but other than text boxes all bringing up the Pokémon Center text there were only a few graphical glitches.

4
Hi. I've been wondering about this as currently the only way I know how to do it is to use an emulator's Game Genie. Note the original physical Game Genie supports these versions in a sense, but boots the game in a way that it's hard to play (such as a white screen but with audio playing if I remember rightly in Gold/Silver). It might also fail with no DMG mode games like Crystal and Korean Gold/Silver.

Ideas:

*Remake something like the Game Genie that fixes the errors and supports GBC mode.
*Make a custom device with a Game Boy slot attachment or Game Genie slot attachment that fixes the bugs in the original Game Genie. So Game Genie>custom cart>Pokémon cart or custom cart>Game Genie>Pokémon cart however there may be troubles related to getting it all to fit, as when I tried it I can't have a Pokémon cart in an Xploder (another cheating device) in a Game Genie)
*Enter a Game Genie code in addition to the other codes to remove the white screen
*Try the Game Genie on Super Game Boy in case SGB mode works and fixes the white screen?
*Do https://glitchcity.info/wiki/Cart-swap_arbitrary_code_execution arbitrary code execution somewhere.
*Do a Glitch Dimension while it's all off screen to fix the white screen? Machop cry Coin Case is the classic one that works but Glitch Dimension Unown may need a little less memorisation of inputs once you get one. It may also still not fix the problem.
In extension, the physical Game Genie only allows for three codes. I wonder if there is an ideal way to have it support more? Thanks.
*Do a non-cart swap ACE code to fix the screen?

Edit: News! In Gold, if you open the Pokédex on the white screen, you can get a slightly playable version of the game once you close the menu again, where the people sprites/OAM objects are green, but it seems everything else is still white. I tried a Glitch Dimension with a Glitch Unown but it didn't work.



Edit 2: Yay! You can just run the in cart-swap ACE F3 16 0B 01 FF FF 0B 79 B0 20 FB 15 20 F5 3E 11 C3 00 01 (Can probably just cut off the first bit to get rid of the delay). I entered some codes and the Bicycle is now working as Fly once I make the wild glitch Unown codes for Gold/Silver I'll see if they work, but you've got to remember the last digits you enter in on the Game Genie menu as they're only visible when moving into the code line.
5
Usually, since wild Unown are determined by DVs, and all DVs presumably give normal Unown, seeing glitch Unown in battle (outside of the Unown Dex) would be impossible.

However, I found a method to force it to happen in English Crystal v1.0 using Game Genie codes:

Front sprite of Unown modifier:

3E0-E5A-081
XX0-E6A-3BA
000-E7A-A21

Back sprite of Unown modifier:

3E1-77A-081
XX1-78A-3BA
001-79A-A21

Here is an example:

Unown 0x1F front and back, the back sprite plays glitch music ('Unown 0x1F true cry') wouldn't load however.




0x1B's back sprite loaded here, but the front sprite freezes so I encountered Unown A instead.



Edit: It also works on summary screens. ^^ Time to go through them all again. Will port the codes to EN Gold/Silver soon unless someone beats me to it.
6
In Pokémon Crystal EN (v1.0) the pointer table is at 11:4378 (offset 0x44378). Note that the banks are not all the same, for example Bulbasaur has its entry at bank 0x60, and Celebi has it at bank 0x74. The banks are from 11:4351 (offset 0x44351) and are $60 ("Pokedex Entries 001-064"), $6E ("Pokedex Entries 065-128"), $73 ("Pokedex Entries 129-192") and $74 ("Pokedex Entries 193-251"). Following that is $CD, which is beyond the end of the ROM so I'm unsure how that works, but apparently there is a design flaw in the code anyway. I wonder if that means for a glitch Pokémon like ????? (FC), since the marker byte is 0x81 it would be Magikarp's bank or $73? However, this can probably be found out later in writing from testing.


Now, Celebi is at 74:58CC, which reads "TIMETRAVEL" as expected (and possibly the rest of the data follows). CC 58 is at 0x4456C and now the cheetahmen

No. 252: 013E
No. 253: 17CD
No. 254: 5639
No. 255: 2E3E
No. 000 (256): 7621

The banks here only matter for the 4000-7FFF region; as 0000-3FFF is unbanked/bank 0, so No. 254 and No. 000 (and theoretically banked RAM but unfortunately there are no RAM/'naturally' customisable dex entries, at least in this version of Crystal (and GSC in general)).

Catching the glitch Pokémon in battle (without its unused flag set; which is set after catching it at least once or modifying your Pokédex seen/own data directly) is a good way to see the Pokédex entry (all of which have been documented in the past). You can't normally see the dex entry by opening the Pokédex even with 251-255 and 0 registered, though. Other ways in theory include just locking the relevant dex entry memory addresses, and I think I've done this before; so with arbitrary code execution that would likely be possible too; or maybe using ACE to bring up the entry directly.

With a debugger, you can set a breakpoint to when de=your dex entry pointer. Although No. 252's Dex entry usually freezes the game, you can actually adjust the de pointer, and then check if what may be page 2 from the original pointer (after A button) is results in a freeze. In this case, it didn't and for some reason I got a different ????? sprite that may not have been documented before (if it's consistent). However, the buttons locked up afterwards.



253 (Egg) is documented before, but it can still vary for some reasons (possibly as it uses control characters as one reason; giving a name based on previous Trainer encountered data). You can encounter for instance, Elite Four Will, change D22D to 01 (wild battle) and catch the Egg, to see "Elite Four Will" printed in the Pokédex entry. This makes me wonder if you can cause a buffer overflow in the Pokédex with unterminated Trainer name data (though it might already occur with some of the freezing entries).





254 seems to be from 74:5639  (which is where " 's magma " comes from). So my theory was wrong (the marker byte is 0x91 and this would be 73 if true, so I'm still unsure what the disassembly meant).




255 : From 2E3E as expected. I noticed Entei was in the name this time, previously on the image it was Mewtwo. Entei was my currently battling Pokémon.




000 : 74:7621. This region is full of all 00 bytes and the game freezes. Changing de to D000 in RAM with the previous method, it loads (but as you're changing it, the category and text will be changed to where you set it to). The sprite is plain white (and it has the footprint with 256 in it) as expected.

Later I may document all the pointers for every Gold/Silver/Crystal in each language, but I'm going to do a quick search to see if any are in RAM (allow 'naturally' for fully custom Pokédex entries). Setting a breakpoint to 11:434F will give you the pointer as the value of register pair de. A surrounding area of this code, which doesn't use any changing RAM addresses; looks like 5f 19 46 d1 e1 , so maybe we can use that to find the equivalent routines. (As it turns out, this is helping for Crystals but not Gold/Silver which probably have different code for this. For Gold/Silver you can instead set a breakpoint to 11:4334.

Lucky for us, No. 252 has it's Pokédex entry in EN Gold from D5E5, which is your fourth key item ^^. So with enough bad inventory shenanigans/ACE, you can write a custom Pokédex entry. However, for some reason you may still get 99999(...)s on the first page; the effects only apply on the second page.

Copy this into D5E5 80 96 84 92 8e 8c 84 50 B6 04 26 11 50 8e 8c 86 7f 87 80 97 57

In other words, you need to have Item 5: Machine Part x150  Item 6: Star Piece x146 (...) and so on; only just filling the key items pocket. You can probably use Coin Case glitch to fill your TM/HM pocket with x255, then adjust the quantities and copy them over to D5E5 to get all the items straight away. Then use Coin Case glitch to encounter No. 252, either directly or as a roaming Pokémon and catch it.




The others for EN Gold:
No. 000's Dex entry is sourced from 0000
No. 253 (Egg)'s Dex entry is sourced from AFC5 (unsure of bank, SRAM may be closed)
No. 254 - A7EA (unsure of bank, SRAM may be closed)
No. 255 - 11C1
7
Originally called the "Linear" (Motorcar) ((Maglev train)) glitch or just "Linear Bug". An old Nicovideo video from 2008 shows that somehow you're able to walk in the train reserved area by immediately reboarding back to Goldenrod City after taking the train to Saffron City. https://www.nicovideo.jp/watch/sm4074945 You can then do a number of tricks like muting the music and speaking to the train staff from the wrong way/above him; causing you to follow a bad path and walk through some walls on the way.

While I'm not sure of the veracity of this glitch (which is by Nico Kuriya) it might have been an obscure overlooked glitch. It might have been performed on Pokémon Stadium 2's GB Tower. In order to replicate the glitch then, it may be worth taking that and the revision (as Pocket Monsters Kin/Gin had two revisions probably distinguishable from a minor marking on the cartridge like the others; Red/Green, Japanese Yellow and English Crystal (which also has a newly documented Australia centric revision) into consideration; or it might just work regardless of these factors.

Translation of description: "The player doesn't seem to be able to leave (the train area). Please forgive the video quality. I'd like a high resolution version but I don't know how to do it."
8
Generation VIII Glitch Discussion / Drilbur with Hydro Pump
« on: April 29, 2020, 03:54:28 am »
According to Joe Merrick (Serebii) in an April 28, 2020 tweet this was possible at some point, via 1-Star Drilbur Raids in Shield. Apparently this no longer occurs. https://twitter.com/JoeMerrick/status/1255034405489434629


Quote
Did you know? Possibly due to a coding bug, it's currently possible to get a Drilbur with Hydro Pump.

The 1 Star Drilbur raids in Shield presently have the move Hydro Pump. The Wash Rotom 1 Star raids presently lack Hydro Pump, making me think it was an offset entry
Quote
Just a note for people only seeing this tweet, they have since rectified the issue
9
Pokémon Discussion / Shared Game Freak song elements
« on: April 29, 2020, 03:39:50 am »
Game Freak's composers have a lot of shared melodies in their games. Discuss. I know a few of these, but there are likely to be a lot more.


Mendel Palace:

https://www.youtube.com/watch?v=UR29Fa0wWE0 @7:11   (and Blue appears theme https://www.youtube.com/watch?v=PFZAcOcE2No )

Yoshi:

https://www.youtube.com/watch?v=E6Zt_0BnCP0 - The first few notes of Music C Starman reminds me of RBY Game Corner https://www.youtube.com/watch?v=e4v6XqG81jA

Click Medic:

https://www.youtube.com/watch?v=XZv2TfbBSsA (You can hear something like the Pokémon low health noise in the background, though in general it may just be based on a warning signal)

Pulseman:

https://www.youtube.com/watch?v=q33lVJIHrVE - Neo Tokyo @0:34

; and
https://www.youtube.com/watch?v=hv8g5u55QFA  - Pokémon Diamond/Pearl Barry's theme @0:37


Wario's Woods:

https://www.youtube.com/watch?v=vOl73d8Yhdo - Sky

; and https://www.youtube.com/watch?v=3hEu2zgduwE - Pokémon Red/Blue Route 24/25 music


BUSHI Seiryuuden:


https://www.youtube.com/watch?v=sXleqIOolIs - Battle with Earthshaker

; and https://www.youtube.com/watch?v=s9uLs8tz49I - Team Rocket HQ


https://www.youtube.com/watch?v=UGdsFnU8DQM - Battle with Madake

; and https://www.youtube.com/watch?v=GFGCRxmqMkA - Pokémon Yellow unused theme


https://www.youtube.com/watch?v=ZobOoj9sz7I - Boss Battle with Shionchou

https://www.youtube.com/watch?v=xXaU-atsItg - A Bird's Flight

; and https://www.youtube.com/watch?v=Bd-1aXffkfA - Pokémon Ruby Maxie/Archie music   (this one felt very apparent with Shionchou, like the Wario's Woods and Pulseman example)


Related: Electivire's cry and a guitar sample

https://twitter.com/VGMResources/status/1107708218426515457


Cross-Pokémon game:


https://www.youtube.com/watch?v=z_TPXbH7ee4 - Bede's theme from Sword/Shield (@0:45-1:10)

; seems to have recycled elements from

https://www.youtube.com/watch?v=uUY5KjHwczY - Black 2/White 2 Pokémon World Tournament final battle music (particularly at 1:13)

Other notes:

I thought @0:46 below sounded similar to another song, but can't find it, so my memory may have been wrong.

https://www.youtube.com/watch?v=llnXhrCn9Yo - Pokémon Black Elite Four music (@0:46)


https://www.youtube.com/watch?v=1BtIz40YN5E @0:20-0:27 - I thought these few notes sounded familiar too, but I'm unsure why.

Looking at the comments they compared it to Join Avenue from Black 2/White 2 as well https://www.youtube.com/watch?v=1NRe8DEzd10

https://www.youtube.com/watch?v=2gd_7QJTWSU - This is one of the Bazaru de Gozaru songs (another Game Freak game). I noticed a small similar elements  0:06-0:08 notes being a descending part of the Pokémon main theme https://www.youtube.com/watch?v=XRCqAFnodI4 (@0:06) however, it may be a common thing to have.

https://www.youtube.com/watch?v=jrpoqgIG28I - Drill Dozer 3rd Gear Music sounds very RSE

https://www.youtube.com/watch?v=TyPfhFwc5cI - I always thought this radio jingle sounded like something from Wario Land, but I'm unsure if it ever was (and Wario Land is not developed by Game Freak)

https://www.youtube.com/playlist?list=PLirSddeMOYZ7Q1520LTuTIfwdMQv0CVbm - Magical Taluluto-kun's playlist.  This song has elements similar to Pokémon https://www.youtube.com/watch?v=6qh9F6FqRT8

HarmoKnight actually has a few Pokémon bonus songs

Pocket Card Jockey music was composed by Go Ichinose too. The title song has similar parts to Pokémon songs too. https://www.youtube.com/watch?v=uTqBa73ey24&list=PL47vq3g0IDNI1_A1PG9I0u5hUEVXzauJv&index=2&t=0s
10
Quote from: Black White Hidden Tricks and Bugs (pente.koro)[/quote
【13番道路のキャモメに配達物を届けるイベントでフリーズするバグ】
13ばんどうろのキャモメに配達物を届けるイベントにおいて、13ばんどうろに大雨が降っているときに配達物を届けると、キャモメが飛んで行くときに画面が暗転してフリーズしてしまう。この場合も全く操作できなくなってしまうため、リセットしないとゲームに戻れない。

https://pente.koro-pokemon.com/bw/urawaza-bug.shtml

(A) glitch involving a freeze when you deliver mail to the Wingull on Route 13. If a package is delivered when there is heavy rain, the screen fades to black(?) and freezes. You can't do anything at this point, so you have to reset the game.

I haven't tested this and wonder if true if it's on video yet.
11
General Discussion / Math videos you find interesting
« on: April 10, 2020, 06:45:22 pm »
Post some here if you like. :) https://www.youtube.com/watch?v=sj8Sg8qnjOg
12
Generation I Glitch Discussion / Making a little corruption experiment
« on: April 10, 2020, 04:57:59 pm »
With one glitch item: Basically the concept is one arbitrary code item calls CopyData to copy the sprite of a Pokemon of your choice into RAM (so it's there to corrupt as ROM is read only). Ideally you view the Dex entry, then use it.

With the other: It asks if you want corrupt it and increase the intensity of the corruption. In theory, you corrupt 1 byte of the sprite, then it doubles to 2 and so on; until say the sprite of Bulbasaur is indistinguishable from the real one.

I got Yes/No box to work and text, but the code is still broken so far.
13
Writing / Pulseman and The Fiery Neutrino
« on: April 10, 2020, 04:25:42 pm »
"Water can destroy Pulseman" as his nightmare wrote. Little did Pulseman know he himself was part of a simulation. Pulseman: "Does not compute! Does not compute!" Well to be fair he couldn't escape that fact, he was by nature a game character; epistemologically he couldn't be real? Or could he? To cope Pulseman switched to bank 2; the Negative Zone. Pulseman:Waaah my enemy neutralises me I'm evil, life is evil. :( Pulseman then in a twist of events met Mr. Gimmick (SunSoft character). "Cheer up Pulseman!" said the dinosaur. "I'm just a line of code. :(" said Pulseman. Mr. Gimmick then produced a heart; here take it. "Infinite can heal Pulseman" :) then said Pulseman with a beautiful grin on his face. It wasn't that Pulseman was bad, nor even his enemies, he was just afraid of himself.
14
You may know that getting your Pokédex rating with 152 owned (possible without arbitrary code execution) will result in a glitch text box. Curiously, there are actually more glitch text boxes that you can get by altering the script 11:4169 (DisplayDexRating) with Game Genie. Theoretically, you can run a modified version of the script with arbitrary code execution to access the others as well.

At 11:41D1 is the DexRatingsTable; which is stored for each entry as (Number of Pokémon needed) followed by what appears to be the text pointer.

Game Genie codes:

XX1-80B-A2D
3E1-7FB-912 (Note: In Yellow it's 3E1-7FB-91E)
001-7EB-081

DexRatingsTable:
   db 10
   dw PokedexRatingText_44201
   db 20
   dw PokedexRatingText_44206
   db 30
   dw PokedexRatingText_4420b
   db 40
   dw PokedexRatingText_44210
   db 50
   dw PokedexRatingText_44215
   db 60
   dw PokedexRatingText_4421a
   db 70
   dw PokedexRatingText_4421f
   db 80
   dw PokedexRatingText_44224
   db 90
   dw PokedexRatingText_44229
   db 100
   dw PokedexRatingText_4422e
   db 110
   dw PokedexRatingText_44233
   db 120
   dw PokedexRatingText_44238
   db 130
   dw PokedexRatingText_4423d
   db 140
   dw PokedexRatingText_44242
   db 150
   dw PokedexRatingText_44247
   db NUM_POKEMON + 1
   dw PokedexRatingText_4424c


EN RB:

152-216 Pokémon : The same rating(?) 2559
217-249 Pokémon: C322
250-254 Pokémon: 0407
255 Pokémon: Unknown (Freeze before text)


EN Y:

152-227 Pokémon : The same rating(?) 2A54
228-254 Pokémon: A917
255 Pokémon: Unknown (Freeze before text)

JP G v1.0 11:42B9/XX2-A5B-A29 3E2-A4B-6E5 002-A3B-081

152 : 5630
(incomplete)


Notes:

RB - C322 is part of the C300 OAM buffer. You can have this have 08 at the beginning with extra glitching, and proceed to write your own custom rating script. As this is for OAM, codes like 01xx22C3 might not work.

Y - A917 is in SRAM, but unfortunately SRAM may be locked. If there is no way to unlock it before getting the dex rated, theoretically you could use OAM DMA hijacking to open SRAM too.

Below is a dump of 3 x 256 checks ([id][number of Pokémon; 1 byte][text pointer; 2 bytes]). (However, something different controls the glitch text boxes. By setting a breakpoint to 11:4194, you can find the text pointer from hl.)

001 0A0142
002 140642
003 1E0B42
004 281042
005 321542
006 3C1A42
007 461F42
008 502442
009 5A2942
010 642E42
011 6E3342
012 783842
013 823D42
014 8C4242
015 964742
016 984C42
017 175858
018 255017
019 935825
020 5017CC
021 582550
022 170359
023 255017
024 3D5925
025 50176D
026 592550
027 17B859
028 255017
029 D95925
030 501703
031 5A2550
032 172E5A
033 255017
034 605A25
035 5017A8
036 5A2550
037 17D95A
038 255017
039 0A5B25
040 501739
041 5B2550
042 176F5B
043 255006
044 0407DF
045 406342
046 5D4200
047 7742CD
048 FA22C3
049 3C3C6B
050 426C42
051 714276
052 42FF17
053 A15B25
054 5017E8
055 5B2550
056 F60002
057 070300
058 FF0704
059 00FF00
060 042905
061 07FFD0
062 011009
063 0EFE01
064 020707
065 08FFFF
066 032A06
067 0FFFD0
068 041EC7
069 07031F
070 C70704
071 160E0F
072 FE432C
073 43AF42
074 00A443
075 CDC542
076 CD3C3C
077 213443
078 112643
079 FA3AD6
080 CD6031
081 EA3AD6
082 C92126
083 D1CB6E
084 CBAEC8
085 FA96D7
086 CB4720
087 18010C
088 06CD0B
089 430108
090 03CD04
091 43010A
092 08CD04
093 43010D
094 0DC304
095 43010C
096 06CD04
097 430108
098 03CD0B
099 43010A
100 08CD0B
101 43010D
102 0DC30B
103 433E2D
104 EA9FD0
105 18053E
106 0EEA9F
107 D03E17
108 CD6D3E
109 C9FA09
110 C1FE04
111 C0AFE0
112 B43E04
113 E08CC3
114 202919
115 324C32
116 753241
117 43F424
118 F4245A
119 430130
120 98D74B
121 435543
122 504350
123 43FF08
124 213443
125 CDCC31
126 C3D724
127 17A847
128 285017
129 D54728
130 5017DC
131 472850
132 082195
133 43CD49
134 3CCDEC
135 35FA26
136 CCA720
137 223E01
138 EA3CCC
139 2126D1
140 CBEE21
141 9A43CD
142 493C3E
143 ADCDB1
144 232196
145 D7CB46
146 CBC628
147 0ACB86
148 180621
149 9F43CD
150 493CC3
151 D72417
152 0A4828
153 501726
154 482850
155 173448
156 28502E
157 081B04
158 00FF1B
159 0500FF
160 1B0600
161 FF1B07
162 00FF0A
163 0500D6
164 171500
165 D81B1A
166 00FF1B
167 1B00FF
168 000320
169 1515FF
170 D241E4
171 043D07
172 12FFFF
173 821D3D
174 1916FF
175 FF8326
176 11C81B
177 0411C8
178 1B0512
179 C81B06
180 12C81B
181 0769C7
182 0A05EF
183 C71715
184 1CC81B
185 1A1CC8
186 1B1B40
187 414141
188 414141
189 414141
190 414141
191 41425C
192 060E0E
193 530E11
194 111111
195 110E0E
196 0E5D5C
197 770E47
198 460E0E
199 0E0E0E
200 0E4063
201 0E5D44
202 0E430E
203 460E53
204 580E57
205 58550E
206 0E4650
207 494958
208 060746
209 0E0E0E
210 063847
211 0E5D44
212 113A3B
213 0A0E46
214 0E4343
215 31380E
216 315D44
217 113F3B
218 0A534A
219 494949
220 58060E
221 575144
222 113F3B
223 0A460E
224 0E0E06
225 070E0E
226 0E5D44
227 113F3B
228 0A460E
229 0E0E48
230 0E580E
231 575144
232 113F3B
233 0A460E
234 0B0B0B
235 0E0652
236 075D44
237 113F3B
238 0A460E
239 0E0E0E
240 0E0E44
241 0E4644
242 113F3B
243 0A460E
244 0B0B0B
245 4E0E44
246 0E4644
247 113F3B
248 0A460E
249 0E0E0E
250 0E0E06
251 0E4648
252 583F3B
253 574A49
254 494949
255 494906
256 0E0611



15
Generation I Glitch Discussion / Weird Pokémon Yellow artifact
« on: March 23, 2020, 06:52:55 am »
Got this when directly loading SRAM into BGB via Debugger>File>Load SRAM. I don't know why..  Edit: It seemed to appear again for a different reason?
Pages: [1] 2 3 ... 33