Main Menu
Main Page
Forums
Recent changes
Random page
Help

Databases
GlitchDex
AttackDex
AreaDex
DexDex
ItemDex
TMHMDex
TypeDex
More

Major Glitches
Trainer escape glitch
Old man trick
Celebi Egg trick
SRAM glitch
Buffer overflow techniques
Pomeg glitch data corruption (Glitzer Popping)
Tweaking
Pokémon cloning
Select glitches (Japan)
Time Capsule exploit
Arbitrary code execution
More

Other Glitch Categories
Glitches by generation
Japan-only/language specific glitches
Natural glitches
Non-core series glitches
Non-Pokémon glitches
Recurring glitches
More

References
Pokémon GameShark codes
The Big HEX List
GB programming
Curiosities
Debugging features
Error traps
Non-glitch exploits
Pokémon glitch terminology
Unused content and prerelease information
More

Useful Tools
8F Helper
GBz80 to Items
Old man trick name generator
PATH (Prama's Advanced Tweaking Heaven)
Save file editors
Special stat/Pokémon converter
Trainer escape Trainer Pokémon finder

Affiliates
Legendary Star Blob 2 (Hakuda)
Pokémon Speedruns wiki
PRAMA Initiative
Become an affiliate!

Technical
Site Source Code

Search Wiki

 

Search Forums

 

Author Topic: Non TM/HM pocket TM47 in Pokémon Gold  (Read 984 times)

0 Members and 1 Guest are viewing this topic.

Torchickens

  • Administrator
  • *****
  • Online Online
  • Gender: Female
  • The Torchic Princess 🌸🦋
    • View Profile
Non TM/HM pocket TM47 in Pokémon Gold
« on: December 18, 2016, 12:47:05 pm »
This is a 'TM/HM outside of the TM/HM pocket' glitch item that misaligns the player sprite and NPCs by two spaces. I'm not sure how best to describe it, but when you save and reset after using TM47, the changes you make on the map aren't just visual; so if you moved an NPC out of bounds (such as the Victory Road badge checker) to allow you to walk past them you could walk past them.

It was planned for Pokémon Gold catch 'em all (with glitches) but I'm not sure if anybody ever got around to running it. For non-speedrunning purposes you should just be able to force it into the wrong pocket with Coin Case arbitrary code execution.

The glitch item interests me as there are some cool videos of someone bypassing certain events with it; like being able to enter Mahogany Town gym before defeating the Rockets at Rocket Hideout which makes this and party overloading map corruption examples of useful glitches other than Coin Case ACE.

The videos can be found here (and I'd like to make a video of both getting TM47 and performing these exploits).
http://wiki.pokemonspeedruns.com/index.php?title=User:Entrpntr/Gold_251#Miscealleneous_TM47_vids

Does anybody who knows a lot about the speedrunning scene know who discovered it?
« Last Edit: December 18, 2016, 12:53:34 pm by Torchickens »
Hi! I identify as female.  She/her pronouns, please.

Online I most often use the username Torchickens or Chickasaurus.

Ah.. koucha ga oishii ♪





Thank you Captain Piika for my avatar.

Thanks too Aeriixion for the cute sprite above! :) Roelof also made different variations of the sprite (which I animated).

Contact:
If you like, please contact me by private message here on the forums as I no longer check other places very often.

YouTube: http://www.youtube.com/user/ChickasaurusGL

I like to collect interesting video games. ^_^
https://www.vgcollect.com/Torchickens

Always be yourself.

luckytyphlosion

  • Distinguished Member
  • *
  • Online Online
  • Gender: Male
  • JACK-flys are OP
    • View Profile
Re: Non TM/HM pocket TM47 in Pokémon Gold
« Reply #1 on: December 18, 2016, 02:37:19 pm »
The TM47 discovery was a semi-joint discovery by both entrpntr (Pokemon Speedrunner, although he does more routing stuff) and I. We knew that TMs and HMs could execute code from invalid addresses, so we went out and tested each and every one. Out of all the TMs and HMs, only 3 stuck out:

TM47: This item jumps to this subfunction , which increments the wOverworldMapAnchor. While using this only visually affects the map, reloading the map or crossing a connection applies the map changes to the loaded metatiles, allowing one to slowly clip through walls and access unintended parts of the map.

TM36: This item jumps here, which is in the middle of the Poke Ball function. While this could hypothetically allow you to catch whatever was the last loaded enemy mon, unfortunately the b register (used to store catch rate) is always 0 when entering this function (both through an invalid pocket and through select menu), so you'll end up with a 1/256 chance of catching the enemy mon, or 11/256 if the mon has a FRZ/SLP status.

HM03: I just found this out today while trying to figure out the interesting TM efffects, and it has a very useful application. This jumps here, which is in the middle of the function called when withdrawing the stored daycare mon from the daycare lady. The function doesn't check whether a daycare mon is present (or clears the relevant data either, as it wouldn't be needed), so you can continually use HM03 to clone the daycare lady's stored mon. The only stipulation is that the new moves learned (by calculating level based on raw experience, which may not reflect the current level as the daycare step function does not recalculate level for every exp point gained) is based on the last loaded Pokemon, in 0xd004.

Torchickens

  • Administrator
  • *****
  • Online Online
  • Gender: Female
  • The Torchic Princess 🌸🦋
    • View Profile
Re: Non TM/HM pocket TM47 in Pokémon Gold
« Reply #2 on: December 18, 2016, 03:15:18 pm »
The TM47 discovery was a semi-joint discovery by both entrpntr (Pokemon Speedrunner, although he does more routing stuff) and I. We knew that TMs and HMs could execute code from invalid addresses, so we went out and tested each and every one. Out of all the TMs and HMs, only 3 stuck out:

TM47: This item jumps to this subfunction , which increments the wOverworldMapAnchor. While using this only visually affects the map, reloading the map or crossing a connection applies the map changes to the loaded metatiles, allowing one to slowly clip through walls and access unintended parts of the map.

TM36: This item jumps here, which is in the middle of the Poke Ball function. While this could hypothetically allow you to catch whatever was the last loaded enemy mon, unfortunately the b register (used to store catch rate) is always 0 when entering this function (both through an invalid pocket and through select menu), so you'll end up with a 1/256 chance of catching the enemy mon, or 11/256 if the mon has a FRZ/SLP status.

HM03: I just found this out today while trying to figure out the interesting TM efffects, and it has a very useful application. This jumps here, which is in the middle of the function called when withdrawing the stored daycare mon from the daycare lady. The function doesn't check whether a daycare mon is present (or clears the relevant data either, as it wouldn't be needed), so you can continually use HM03 to clone the daycare lady's stored mon. The only stipulation is that the new moves learned (by calculating level based on raw experience, which may not reflect the current level as the daycare step function does not recalculate level for every exp point gained) is based on the last loaded Pokemon, in 0xd004.

Ooh I see, nice!

Thanks for sharing the information about TM36 and HM03.

I successfully caught Will's Xatu after putting it to sleep, blacking out and using TM36 many times. The game asked if I wanted to give a nickname to "2U" (which made me wonder for a moment if it had an unterminated nickname like a fake bad clone), but it became a normal non-nicknamed Xatu after I chose to not give it a nickname.

Edit: You can catch Trainer House Pokémon too.
« Last Edit: December 18, 2016, 03:24:04 pm by Torchickens »
Hi! I identify as female.  She/her pronouns, please.

Online I most often use the username Torchickens or Chickasaurus.

Ah.. koucha ga oishii ♪





Thank you Captain Piika for my avatar.

Thanks too Aeriixion for the cute sprite above! :) Roelof also made different variations of the sprite (which I animated).

Contact:
If you like, please contact me by private message here on the forums as I no longer check other places very often.

YouTube: http://www.youtube.com/user/ChickasaurusGL

I like to collect interesting video games. ^_^
https://www.vgcollect.com/Torchickens

Always be yourself.

Yeniaul

  • Guest
Re: Non TM/HM pocket TM47 in Pokémon Gold
« Reply #3 on: December 19, 2016, 08:03:02 am »
I had a question asked of me a few hours ago. Q: Will we as a species ever stop breaking games for fun?
My A: No. If it can be broken, it will be.

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Non TM/HM pocket TM47 in Pokémon Gold
« Reply #4 on: December 19, 2016, 08:05:30 am »
+1
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

entrpntr

  • GCLF Member
  • Offline Offline
  • $FF The Police
    • View Profile
Re: Non TM/HM pocket TM47 in Pokémon Gold
« Reply #5 on: February 04, 2018, 02:53:16 am »
As lucky mentioned, there were originally two methods for applying the map changes to the loaded metatiles (reloading the map or crossing a connection). Back in August, gifvex realized a third way: using the GB Printer function. This is specifically done by attempting to print either a Pokédex entry (select the PRINT option) or a Pokémon's mail (press START while reading the mail).

An initial demonstration video can be seen here: https://www.youtube.com/watch?v=9mtrq5T43Wg. This method largely replaces the need for S&Q, which is convenient because it is so much faster. Being forced to reset over and over again just to skip different parts of the map isn't much fun in a casual setting or a speedrun setting.

I made use of this to a great degree in Gold "No ACE" speedruns back in August. I had created a highlight of going from Goldenrod to Indigo Plateau to give another taste for how this looks: https://www.twitch.tv/videos/170151642. I also saw mention on Torchic's recent video of the disappearance of old TM47 videos, so I reuploaded them to a youtube playlist for posterity: https://www.youtube.com/playlist?list=PLQpdNvoYOPZxUp6IdnkRv5QqoAigFdmnc.

gifvex also found two other TMs in Gold/Silver with interesting functions. First, TM14, which lets you instantly tag the "last loaded species" as "seen and caught":
Code: [Select]
TM14 (0xCD) in Pokemon Gold - when used from another pocket outside of battle, it jumps to the following code:
https://github.com/PikalaxALT/pokegold/blob/dff855fedfd7632a24340c4e36df2810edb8db83/engine/move_mon.asm#L879

looking at lines 923-925 you will find:

ld a, [wd004]
dec a
call SetSeenAndCaughtMon

notes:
* wd004 is "the last loaded species"
* wd004 can be set by scrolling over pokemon marked as seen in the pokedex

Also, TM46 - calls GetMovementPermissions, which is the function that updates wTileDown - wTileRight, the values used for collision, based on wPlayerStandingMapX and Y. This didn't seem to have much practical usage, but I think there was one instance of using it in combination with TM47 in a semi-useful way.
« Last Edit: February 04, 2018, 03:45:05 am by entrpntr »

Torchickens

  • Administrator
  • *****
  • Online Online
  • Gender: Female
  • The Torchic Princess 🌸🦋
    • View Profile
Re: Non TM/HM pocket TM47 in Pokémon Gold
« Reply #6 on: February 04, 2018, 08:44:35 am »
Awesome. Thanks entrpntr. :)
Hi! I identify as female.  She/her pronouns, please.

Online I most often use the username Torchickens or Chickasaurus.

Ah.. koucha ga oishii ♪





Thank you Captain Piika for my avatar.

Thanks too Aeriixion for the cute sprite above! :) Roelof also made different variations of the sprite (which I animated).

Contact:
If you like, please contact me by private message here on the forums as I no longer check other places very often.

YouTube: http://www.youtube.com/user/ChickasaurusGL

I like to collect interesting video games. ^_^
https://www.vgcollect.com/Torchickens

Always be yourself.

Krys3000

  • The frenchie
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • Head admin of the PRAMA Initiative
    • View Profile
    • PRAMA Initiative - Main french Pokémon glitch website
Re: Non TM/HM pocket TM47 in Pokémon Gold
« Reply #7 on: February 04, 2018, 10:20:22 am »
That's cool! Could be very useful. Thanks for sharing all these data guys, and for the work discovering it. I'm clearly not into speedrunning, so I don't catch up with interesting glitches used there if they are not posted here  ;)

Admin of the PRAMA Initiative, the main french Pokémon glitch website
http://www.prama-initiative.com
“Anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that 'my ignorance is just as good as your knowledge.'” - Isaac Asimov