Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Metarkrai

Pages: 1 [2] 3 4 ... 11
I noticed that the "turn bootstrap Pokémon into an egg" step in the guide is incomplete.  Is it something I need to do (possibly via Pomeg corruption)?

I'm currently working on the bootstrap Pokémon but I just can't get the double corruption on step 1.4 to work.  I followed your guide, but after turning the glitch Pokémon into an egg in the first step of the double corruption (the PID corruption), I can't get it to turn into another glitch Pokémon in the next step (the TID corruption).  I removed everything else from boxes of 1 & 2 after the PID corruption, placed heart Caterpie right before my egg, and am having no success.  Did I likely mess up on EVs?  I would think if I had, it would still double corrupt into something, albeit not what I want.

Also, will any of the following codes be added any time soon?
*redo TV roamer event in Emerald (or any other way to capture Latios on Southern Island if I've already captured Latias there) - as mentioned on previous page
*make Mewtwo / birds respawn in FR/LG

Yeah, turning a Pokémon into an Egg is supposed to be done via a Pomeg Glitch Data Corruption (corrupt the TID of the Pokémon), as it makes the Egg tradeable through any game easily.
Bus if you want to use this Bootstrap Pokémon for your own game, there's virtually no requirement for that part.

Well, the non-success in the second corruption in a double-corruption is in general the result of the "specific criteria" not being met, or the fact that you didn't use the right corruption initiator.
Here, for a second double-corruption, you indeed need the Heart Caterpie as a corruption initiator.
I don't have the time to check things now, so I don't know if this is due to a mistake in EVs/training or a mistake by my side (due to not managing 4th Move PPs or something like that, probably that).(yeah, I think it's probably due to that, so it's a mistake on my part)

I will be away for around ten days, so I will fix that upon my return.

I made the code for the TV roamer event in Emerald, but it didn't work for Tabbender and I don't know why yet (the code works in my save, so there must be another value messing things up, it's hard to say without a save to study).

Once I'll be done with codes on Emerald, I'll work on codes for Fr/Lg, don't worry ; )
Maybe it's possible to do like TheZZAZZGlitch did in gen 1 and write long codes somewhere in RAM (like in an otherwise unused PC box), then we'd just have to jp there ? I thought of something like writing, for example, the Box 3 Slot 1 pokemon's HP and / or ATK EV's as a byte

Areas like the storage of the code and picture of the event Berry could be used to a longer code, yeah.

With a "copy/paste and overwrite" code stored on a Pokémon, you would write a part of the code with Pyramid Bag Items, then copy/paste it on the area you want in order to build a bigger code.

But a longer code is needed first.
This is also technically possible, but that would require a way longer code than a simple "add this word to this word" code, because you would need to call the function and also feed it values in order to have the checksum recomputation on the right Pokémon.

However, if we knew such functions, then I would work on making codes that I can't do now, like giving 255 EVs in every stat, making a Pokémon learn a set move, call the Emerald Jpn sound debug menu, bring the Pokédex entry of a specific Glitch Pokémon,...
Well i already have my SID (56128) and my ID (44640) so i'm guessing the PID is DB40AE60 ?

In which case 3FFFFFFF encrypted would be 1609D608 (3FFFFFFF xor F2B68797 xor DB40AE60).

What bothers me is that i have quite a lot of pokemon i'd like to modify and, while they all come from the same frame, they have different movesets, species, etc. So the checksum would have to be hard-coded each time.

EDIT: After some calcs it seems what i have to do for the checksum to work is substract F7CA from it and then add EC11 (and set my pokemon's IV's to 1609D608 instead of 3FFFFFFF). Now the problems i have are:
- Is it possible to do all of this with a single ACE (even if it requires modifying the setup) ?
- What are the addresses i'm supposed to modify ? Since my pokemon's substructures are in the "MEAG" order, the Misc is what is read first, but i don't know at which address are the IV's specifically. I don't know where the checksum is, either. It would also be cool to target a pokemon in a specific PC slot so that it doesn't have to be KO'd each time. I have no idea if it's easy to do though.

EDIT 2: I wonder, since the checksum is calculated each time there's a validity check, isn't it possible to calculate it via ACE after changing stuff and then overwrite the old one with the calculated one ? That would make changing pokemon attributes way easier, for IV's or anything else

Okay, so you already know all the information you need aside from the Pokémon's checksum.

I think that you got things wrong for the checksum : it is the sum of the uncrypted bytes, not the sum of the crypted bytes.

Thus, having 0x3FFFFFFF as uncrypted IVs adds 0x3FFE to the checksum, while your IV combination subtracts Idon'tknowhow to the checksum.

The IVs are the second word of the Miscellanous substructure, so the tenth double-word of a PC Pokémon data structure.

You can technically make a code that would add the required value to your Pokémon's checksum, which would allows you to perform this code on multiple Pokémon who have the same PID.
However, I don't know how to write a code that would add a double-word/word to a set adress.
The TID is the Secret ID and Trainer ID grouped together. (the Secret ID takes the 4 high bytes while the ID takes the 4 low bytes of the double-word).

You could technically make a code that would do all the computations itself, but it would be way longer than the existing ACE codes.

Here, you know the IVs of your Pokémon and its PID.

You only need to know its checksum and your Secret ID, make some computations, and you're good.

In the end, this consists of 3 ACE with Pyramid Bag Items, which is reasonable.
Well i got the address from this, but yeah i figured structure positions might be an issue here, though in the code they didn't seem to care about it for some reason. Also, how does modifying the checksum work ? I feel like that was the problem here.

Wasn't the issue that my Latias was already released due to some corruption ?

Their code was written in raw format and this one is completely non-working.

About checksum :
Take all double-words in a Pokémon substructures (their hexadecimal values as stored in RAM). That's 12 double-words.
Decrypt these double-words with : decrypted double-word = double-word xor PID xor Trained ID.

You end up with 12 decrypted double-words.
Take the 24 words composing your 12 double-words, and sum them.
A Pokémon's checksum is the 4 hexadecimal digits of this sum (or sum mod(0x10000) if you prefer).
This checksum is then compared to the checksum stored in the Pokémon's data.

If it matches, ok.
If it does not match, the Pokémon is turned into a Bad Egg.

Thus, in your case, to change a Pokémon's IVs to 31 :
You need first to know the exact IVs of your Pokémon in order to compute the decrypted double-words tied to these IVs. (don't forget to check the special ability too)
You need to know the value of the Pokémon's checksum (use an ACE to get this value)
You need to compute the new Pokémon's checksum if its IVs changed to full 31. (you add the words tied to the full 31 IVs to the checkum and you subtract the words tied to the current IVs of the Pokémon)
Determine the PID of the Pokémon (with an ACE)
Determine the TID of the Pokémon (with an ACE)
Use the PID to know where the IVs are stored in the Pokémon's data.
Then, compute the encrypted value of your full 31 IVs with : 0x3FFFFFFF xor PID xor TID

Perform an ACE to copy/paste the encrypted value for the new IVs at the right place, and to overwrite the checksum with the new checksum.

Okay, so i just tried my first ACE setup and it didn't work properly, though i feel like i'm on the right path.

It was a setup to give the pokemon in party slot 1 perfect 31 IV's.

01, Lv50 | 0x4805 (72 Spd, 5 Def, 1 PP Max) |
02, Lv50 | 0x4904 (73 Spd, 4 Def, 1 PP Max) |
03, Lv50 | 0x6008 (96 Spd, 8 Def, 1 PP Max) |
04, Lv50 | 0xBDF0 (189 Spd, 240 Def) |

01, Open Lv | 0x4534 (69 Spd, 52 Def, 1 PP Max) |
02, Open Lv | 0x0202 (02 Spd, 02 Def) |
03, Open Lv | 0xFFFF (See video) |
04, Open Lv | 0x3FFF (63 SPD, 255 DEF) |

Unfortunately, the pokemon in slot 1 turns into a Bag Egg upon use. Did i do something wrong or does the checksum detect modifications like this ?
Pokémon data is encrypted by a xor computation, so you need to take that into account when modifying a part of a Pokémon substructures. (else you will not get 31 IVs on your Pokémon)
Keep also in mind that the IVs are on the miscellanous substructure, whose position depends on the Pokémon's PID.
You also need to change the checksum accordingly in order to keep a valid checksum. (else you will obtain a Bad Egg)

These 3 things are the reason why it's very tough to manipulate Pokémon data with a direct code execution.

Also i noticed that having a 5 pokemon party and checking it in battle with the new setup will make the LAST pokemon disappear, so make sure to have the invisible bad egg there.

Oh, I didn't know that. I was testing with 4 Pokémon but didn't test with 5.
I will add that to the procedure.

Regarding the Lati@s thing, would redoing the TV event and picking Latias turn my stationary into Latios again ?

Yeah, redoing the TV news will release the roamer and set the species of the Southern Island Lati@s.

I also checked but it appears that the same var is used to manage this event on both trainer houses.
I will try doing a round at the league to see how this var behaves with both trainers, as this may be the issue.
Unless some flag shenanigas happened, i'm sure as hell i caught Latias around 9 years ago :p

But yeah, maybe that's the reason why i was unable to get the TV event again. Still extremely weird how both my roamer and my Southern Island pokemon are Latiases. My game hates Latios apparently

You may have revived your roamer Latias due to some Pomeg Glitch corruption (I think that giving it non-zero HP is enough).

Also, Pomeg Glitch corruptions affected the Southern Island Lati@s value (0 = Latios, non-zero = Latias), which means that you ended up with a Latias on it.

That's a common case for people who unlocked Southern Island.
... i just encountered Latias randomly while EV-training a pokemon. I was surprised as hell XD

So apparently the ACE worked, but i didn't have to trigger the event with the whole league thing. Weird. I'll try to make the stationary Lati@s repop again later to see if it's a Latios (because for now this save file only gave me Latiases).

Were you sure that you had no roamer alive before this ACE ?
Because the ACE for the roamers only changes the var tied to the player's house in order to trigger again the event with the tv news that generates a new roamer.

And thanks to that, I now know why it didn't work on your game.

There are two trainer houses, so there are two vars (one for each house).
Thus, there needs to be one code for male trainers, and one code for female trainers.
I'll fix this today.
Thanks for the info ! I think i'm going to try to create my own setups as well.

Regarding the roamers repop issue, sadly i'm on real hardware (i'm only using emulators when i attempt things that i really consider too dangerous to  perform on real hardware), so i can't give you the .sav file. However, there's the thing i noticed earlier with the Mystery Gift guy being corrupted. Maybe the issue comes from here ?

The delivery guy has nothing to do with the roamers event, so I don't think so.

To store the code in RAM, you can use the data there :  to help you.
For some other adresses, you can use the ones present in the codes. (bear in mind that adresses in the codes are taken with a DMA pattern of 18, which adds 0x48 to each adress)
Use an Anti-DMA code when trying to write RAM data in order to be sure that you are writing at the good spot, and then don't forget to disable it when trying to execute code.

Yesterday's idea about an alternative procedure to obtain a Bootstrap Pokémon paid off, and the issue with Emerald Jpn is now solved :
This adds one more double-corruption and some more training to the usual procedure, and uses a 176 exp gain to compensate for a 176 SpAtk EV training.

It was also possible to use Mail Glitch to obtain a similar result (with word 0x2402), but it was easier this way.
I'm currently trying to understand how these ACE codes work using the RAM addresses you linked earlier

I get that the first 2 items of the Open Lv Pyramid Bag are the highest and lowest bytes of the RAM address that is to be modified, and that the 3rd item is the value that's supposed to be set there.
However, what i don't get is why does the 3rd Lv 50 Bag item sometimes change from code to code ? Shouldn't it always be the same code since what it does is set [item 3] to [item 2][item 1] ?

The shortest codes are codes that overwrite a double-word/word/byte.
In certain cases I opted for a word/byte overwrite as there was other data in the double-word that I didn't want to touch because it could take different values or I didn't want to seach what every flag did to find an optimal thing for it.

This is why there is this little change on the Item 3 of Lv 50 Pyramid Bag, to tell if a double-word/word/byte must be overwritten.

Here you have the main list of codes that I use : (See 5.4) )
Although they are written in 8-bit format so you need to rewrite that in 16-bit to see which items are needed.

The codes in Pyramid Bag Items also differ by some margin as the values stored for destination adresses or for the value to be overwritten are a few double-words away from the rest of the code (in order to put them on Open Lv and leave the rest of the code in Lv 50).

- Other codes copy/paste a string of words.
This is useful when more than a double-word needs to be overwritten (for one teleport code, for example), or when you want to move a value at a certain adress to another position (copy/paste the Secret ID of a Pokémon onto the Attack of a party Pokémon, for example).

- Other codes are "copy/paste and overwrite".
They copy/paste a string of words to an area that is unaffected by DMA (0x0200D084), and then overwrite the script adress of a certain NPC (usually the girl below day care) to point it towards the area where the string of words was stored (0x0200D084).
This way, by talking to the NPC, it will execute script commands like givepokemon, special, or things like that.

If the script commands that the NPC must read are a bit too long, they need to be stored in PC Items (with the code to get back Battle Factory Pokémon, for example).

This type of code is shorter than the initial code that calls a subroutine, so I prefer using this one to execute overworld scripts.

- One or two codes are an "overwrite and copy/paste".
For a few codes, I need a string of double-words to have a fixed value (like 0xFFFF for perfect Pokéblocks).
To do that, I overwrite a double-word with 0x0000FFFF at the target adress, and then use a copy/paste code that will copy the words stored at "target adress" and paste them at "target  adress +2".
Due to hos the copy/paste code works, this copies the 0xFFFF word to the next word, then copies another 0xFFFF to the next word, etc...

To have a complexe Pokédex, you would need 5 codes like this.

Seeing that you said the roamer tv news wasn't there a second time, there must be something else that prevents it.
If you're on emulator, can I have a copy of your save to study it ?
Isn't it essentially a JP adaptation of TheZZAZZGlitch's first ACE glitch move setup ?

Yeah, he is using an animation pointer on save file data in order to execute his code.
This method doesn't require any DMA check, but it isn't console friendly as you can't easily check the order of the save partitions, and as the possible permutations are determined at the beginning of a save.

Minus this choice of amination pointer, the rest of the procedure is exactly a PC Items Code Execution, with a Bootstrap code also stored in PC Items.

I prefer prioritizing a Bootstrap code stored on Pokémon data and code stored on Pyramid Bag Items because this makes the procedure faster (you can store 10 Pyramid Bag Items at a time, whereas you need 1-2 corruptions to duplicate a single PC Item) with a weaker potential for mistakes (although mistakes can be made).

For FrLg, storage of a part of the code with PC Items is inevitable, but I would like to draw the maximal profit out of a "copy/paste and overwrite" Pokémon that I haven't finished calculating yet. (Once this Pokémon would be done, you would store the target adresses onto other PC Pokémon data with some EV training, and store the remaining part of the code with PC Items, a part that would be quite small).

As for Emerald Jpn, I need to find something to patch the issue I have regarding the fact that the current procedure for a Bootstrap Pokémon makes me unable to make a Bootstrap Pokémon for Pyramid Bag Items Code Execution.

But by writing that I had a potential idea that I need to test. (if the final glitch Pokémon has a good glitch curve, it could still gain exp and then obtain an Exp amount that would reduce the amount of EVs needed and make it go below the 510 bar).

If the Bootstrap works with a way lower priority (TheZzAzz used a priority of 0xFF and I used a priority of 0xB4), then the newfound Mail Glitch could potentially be useful here.
Thank you Metarkrai!

I'll try to see if I can upload the Celebi and 0x19D I got with double corruption and if I'm able to do it I'll send them asap. I don't have a flash card or hacked Wii to do that yet (both Hacky and Zowayix talked about it here), but next time I experiment with the Pomeg glitch I'll consider setting things up to do that as it saves a lot of time for experimenting, and in theory could manually edit those Pokémon on the emulator detail by detail and import them on to the cartridge.

If you have ACE set up on your game, you could also use a code to generate a Celebi/0x019D/0x019E and see if they can be transferred. (of course, on emulator this is easily done by editing the pointer of a npc script and writing the script somewhere in ram, or just by editing the data of a Pokémon).

If, in the end, there are still many unknown things blocking the successful transfer, we could maybe ask TuxSH if he knows some things about that (he made a save editor for Colo/XD, so he maybe came across conditions regarding trades or Pokémon legality).
I will and see what happens. Also, i remembered that i have hatched a few glitch pokemon. Could there be an issue with their pokedex pointer like in gen 1 ?

That's weird, because i very clearly remember getting 110 Spd and 160 Def EV's (via the "250 EV" technique), as well as putting a Great Ball there. Unless i managed to put in 0x6008 instead of 0x6EE8 ? I'll check it out later.

EDIT: Wow, i just watched a TV and a guy read the species name of one of my glitch pokemon o_o i reseted because i was scared of what might have happened to my RAM data lol

EDIT 2: Okay so i checked and apparently i didn't do anything wrong with my EV training. I'm going to check if i put 0x6008 instead of 0x6EE8.

EDIT 3: I apparently got the item positions right as well. I have no idea what caused the code to not work.
Anyway i'm gonna try again with the new method.

Have you tried redoing the ACE and directly entering your house ?

Else, there may be another value needed to make things work, and it wasn't clear on my saves.
If this ACE still doesn't work, I'll have to look back at it because this will be the most likely answer.

Also, as you will change Glitch Pokémon, could you make more clones of your PC Pokémon in order to fill most of the boxes ? (aside from a few slots near the nicknamed Pokémon)

Because the corruption you saw at Box 6 could happen somewhere else due to this change of Glitch Pokémon.
The Box 6 corruptions happen each time i perform ACE, and sometimes during other fights following this. Though i now always let them empty. But yeah, there are definitely corruptions going on in my game. I didn't do anything special other than sending out multiple bad eggs and wait for the one with the right level and max HP, then use a Revive and switch. The corruptions are probably due to the bad egg losing HP due to the opponent's attack and the poison / burn. I also did quite a lot of GP in order to make the Safari Park guy depop. Back then i also did the route to unlock Faraway Island and Birth Island on french games. Other than that, i don't know what could have caused these corruptions.

By the way, i just executed the code to make the roamers reappear and re-did the league, it doesn't seem to work for some reason.

If you try another ACE, could you place fresh Pokémon clones at the slots where Bad Eggs usually appear, and then make some pauses while seaching for the right wild battle to check if they become corrupted ?
This could give me a lead to what's causing that. (because the issue is that this behaviour may be different on other games due to the Glitch Pokémon species name used being different, or because it depends on some data that is different from trainer to trainer if not manipulated).

Well, I tried the code and it worked.
So it's either due to the league resetting the var value to 0x0005 (instead of 0x0003 which triggers the roamers), or due to an error in the code.

If you can redo this ACE quickly, try to enter your house right after executing the code to see if the event appears (this will lock you in the house and you'll have to reset, but this will move the league out of the equation).

Else, regarding the code, it may be the Open Lv Items that have a tiny issue (0x6EE8 or Great Ball).
A mistake like this would make the code valid, but wouldn't give you the roamers tv news.

Also, check if the event does not occur in the neighbours' house, in case you had sex changes or things like that.
Pages: 1 [2] 3 4 ... 11