Gen III: Access Pokémon beyond the sixth slot sub-glitches.

[luckytyphlosion]

So I was playing Emerald and messing around with the "access pokemon beyond the 6th slot glitch" when while trying to switch to Bad EGSS, I somehow switched to my fainted Hariyama,I whited out, and when I checked my Pokemon Menu, all my Pokemon were still fainted, but my last Pokemon in the Menu was cloned! Sorry for the lack of details but I can't remember what exactly happened, but can anyone confirm or explain this?

[VaeporSage]

Very likely you've stumbled upon something noteworthy. For me, the glitch had great potential but I never managed to do anything major with it. While I'd love to celebrate the finding of a new important trick here, replicating this effect may prove difficult.

The detail of switching into a fainted Pokémon is a clear trigger in this instance, however. Did you have to pass by many Eggs/Decamarks in order to reach your Hariyama? Perhaps you could give a rough estimate of how many slots beyond the 6th you'd reached? It's very late now, but I'll give this a think over tomorrow and some tests and see where this gets me.

Immediately, my main hope is that a variant of this could be extrapolated to go further and distort party Pokémon into glitch data - though likely this is a pipe dream.

EDIT: Also, some extra information on your team itself might be helpful. For example, was it composed of any Eggs? How many fainted Pokémon? In particular, in what slot was your Hariyama at the time of the glitch?

[pokechu22]

Not necessarily too relevant, but in firered I noticed you can have Decamarks that are also eggs.  Bad Decamarks.  Yay.

[luckytyphlosion]

I tried doing the glitch again, and after many tries it worked. What you have to do is scroll up after seeing the summary screen, instead of scrolling down to the half cancel button. However, I think it's based on luck since it took a long time to replicate, and there is a possibility that you need to find the Fainted Pokemon first try.

My Hariyama was the one that had negative hp, so it was in the front. When I was scrolling up, first there was a decamark, then a supposed Bad EGG (no switch screen), then many "regular" eggs, and then Bad EGGs and Decamarks. I had four fainted Pokemon, as you need so you can perform the glitch. I can't remember well how many spaces I went up because I was mashing the UP button, but I feel it was about 10-20 spaces.

What I think is that, sometimes, the glitched party data can take Pokemon data from other places (eg. once I found my Tropius in my box), so it could be that the game sometimes takes party data and puts it into the glitched party.

EDIT: Forgot to mention, after the whiteout your Pokemon are still fainted, like in the "Messing with the 7th Pokemon" Video.

[VaeporSage]

Well, first off I can totally vouch for the validity of this glitch. After three tries yesterday, I was able to correctly attain the desired result twice in a row. 

For me, the Pokémon to switch into wasn't far from the Decamarks in the first slot. To give a guess, I'd say 4-8 spaces up.

However, as you've pointed out, there is likely a strong element of randomness here. For example, summary screens of all Eggs are developed differently each time, and as you've also noted, PC Pokémon will sometimes show up in summary screens (but with all stats in the 5 digits). Therefore, the correct switch option may only appear depending on luck.

I must disagree with you in that scrolling up is different to scrolling down: there never seems to be any difference in the options presented no matter which direction you've reached them from.

As a side-note, I would like to add also that the 'white Decamark' effect on the wild Pokémon can actually be triggered more easily. Instead of viewing the summary of the Pokémon 'inside the Poké ball' (I think you understand which I mean), you need only go as far as the 'Summary/Cancel' option, then return to battle.

Reviving a Pokémon and sending it out against the White Decamark causes the sent Pokémon to turn also into a White Decamark and the game freezes. I have not yet been able to test this in conjunction with your cloning effect, whereby the game may yield a different outcome (by switching out the current Pokémon first). I'm doubtful that may lead to anything, but it's worth testing.

Gotta say I'm impressed that the Pomeg glitch continues to deliver results. Great job on this find!  Once I'm able to repeat the process a number of times, I'll have a good look for my camera and get a video up whenever possible.

[luckytyphlosion]

I assume the glitch party data comes from the next portion data in RAM, but I don't know memory addresses for Emerald. It would certainly be helpful.
Although unrelated, I wanted to know what happens when a decamark gains exp. (Through use of Memento). Does anyone know?

[VaeporSage]

I know as little as it is possible to know about how the game functions. (With regard to addresses, hexes, flags, etc.) I interact with Pokémon only on its surface...

That being said, I have indeed tested Decamarks vs. Memento, and the conclusion is that Decamarks cannot ever gain experience points. 

[Evie Torchic the Glitch Scientist]

I decided to have a go at Emerald's glitch Pokémon beyond the sixth slot glitch for the first time using VBA. Unfortunately I couldn't replicate the cloning glitch, but I did some research.

I tracked 0203CED1 (switch cursor position) to see what the values are after performing certain steps:

1) Scrolling up immediately from 00 (current Decamark) will lead you to Cancel (07) and then if you scroll up from there, you'll get to the fourth Pokémon not in battle (04). If you scrolled down from there, you go back to 00. (other Decamarks not possible)

2) Scrolling down immediately from 00 will lead you to 01 (first Pokémon not in battle). Scroll down another four times and you get to Cancel (07). If you scroll up from there, you'll get to the fourth Pokémon not in battle (04). If you scrolled down from there, you go back to 00.  (other Decamarks not possible)

Notes for (1) and (2). It is not possible to view the sixth Pokémon with these step sets.

Viewing the summary of one of your four accessible valid Pokémon will make the shift screen work differently. It also lets you view the sixth Pokémon:

3) View the summary and go up, the cursor will go to 00 (current Decamark). Scroll up from there and you'll get to Cancel (07) but then scroll up again and you get to FF, and from there you can scroll to FE and lower values by going up.

4) View the summary and go down. This will take you take a half-lit Cancel button (06). If you go up, it leads you to FF and from there you can scroll to FE and lower values by going up. If you go down, it takes you to the normal Cancel (07). If you go up from there, you get to FF and from there FE, etc. by going up If you go down after the aforementioned 07, you get back to your current Decamark (00) again.

So after testing, you go to FF when you reach the normal Cancel (07) or the half-lit Cancel button (06) and go up, after viewing the status of one of your Pokémon. If you didn't view a status, it goes to 04 (fourth Pokémon not in battle) instead.

EDIT: I have a request. Vae, since you've been having good luck with the cloning glitch, can you try it again and tell me exactly how many times you have to press up from the Cancel or half-lit Cancel button, please? I can look into the data for that glitch Pokémon and see what causes it to change.
EDIT 2: One more queston, Vae: Were you using the US version of Emerald or another version like UK English? Apparently, the starting offset for the Pokémon data structure is different between US versions and other versions, and this may mean you can't use the same Pokémon in any other, significantly different version.
EDIT 3: But actually, apparently North American and Australian versions are exactly the same. I wonder if anyone has dumped the UK version and found differences?

[Evie Torchic the Glitch Scientist]

New discovery! The Pokémon at cursor position $ED (that's 19 up presses after Cancel or half-lit Cancel) has variable HP that is also used for data about  the last position of Box 1.  You can find $ED's HP using the equation 0x020244EC + (Pos.-1 * 0x64) + $56, so that's 0x020244EC + 0x5C30 + $56 =0x0202A172. If you have a Pokémon in that box position, $ED's "HP values" are used as a section of the data in the Pokémon data substructures for that Pokémon.

It's more complicated than having the right Pokémon though, sadly. Once you've had a Pokémon in that position at least once during the game session, the values are 'randomized' every time you open and close the Pokémon menu or enter/exit Oldale Town's Pokémon Center and likely other warps. Furthermore, the values are randomized again just before battle starts.

At this point, getting a working Bad EGG is a matter of luck, but now we know we must have a Pokémon in the last position of box 1 with this particular slot. Also, I've noticed that even seemingly working HP values will cause the game to say "Bad EGG has no energy left to battle!" but use the code 0202A172:01, 0202A173:01, 0202A174:01, 0202A175:01 before battle and it will apparently always work. You will send out one of your Pokémon (probably always the first), get whited out and then your second to last Pokémon will be cloned! Note that using these codes will turn your last Box 1 Pokémon into a Bad EGG, though because according to Bulbapedia, the game generates a checksum for all the values of the 'data' substructure and compares it to the value dictated by the checksum word.

Edit: Unfortunately when I set up the glitch again the game thinks $ED is an Egg and won't let me battle with it, as it says "An EGG can't battle!"

[VaeporSage]

I'll be looking into your findings in a little more depth later, but first I'll address your questions. 

The amount of up-presses required varies each time, unfortunately. Since the point at which I replicated the effect twice in a row, the exact slot necessary to switch has seemed to change with every new attempt.

However, I have found - so far without exception - that constantly searching upwards through all possible options eventually will lead to the right one. This could range from 30 up-presses (sometimes less) to as far as 80 or so.

With regard to my version, mine is a European version (Irish, if that matters). I have also tested the glitch as a whole on my friend's Emerald on VBA. There, I found that the seventh Pokémon doesn't seem to be able to produce the same 'White Decamarks' effect as in mine. I don't know for sure, but I assume his would be a North American ROM.

[Evie Torchic the Glitch Scientist]

The amount of up-presses required varies each time, unfortunately. Since the point at which I replicated the effect twice in a row, the exact slot necessary to switch has seemed to change with every new attempt.

However, I have found - so far without exception - that constantly searching upwards through all possible options eventually will lead to the right one. This could range from 30 up-presses (sometimes less) to as far as 80 or so.

OK thanks. That's unfortunate, but actually, if there are many Decamarks with the Shift option, you're probably bound to find one that has the right HP and isn't an Egg, eventually.

With regard to my version, mine is a European version (Irish, if that matters). I have also tested the glitch as a whole on my friend's Emerald on VBA. There, I found that the seventh Pokémon doesn't seem to be able to produce the same 'White Decamarks' effect as in mine. I don't know for sure, but I assume his would be a North American ROM.

Oh. What is the white Decamarks effect?

[VaeporSage]

The White Decamarks effect is produced by clicking on the icon of FF (whose name I know only just now thanks to you ).

By going to its 'Summary/Cancel' option and then exiting, a wild Pokémon (the effect is never manifested in trainer battles, unfortunately) will have its sprite become that of a Decamarks with inverted colour scheme.

Reviving a Pokémon and sending it out against the White Decamarks causes a game freeze akin to that of óË {é Áî.

Throwing a Poké ball at the White Decamarks causes the result of the ball throw (Aw! The Pokémon appeared to be caught! etc) to be instantly displayed, while the ball will continue to wiggle. If the wild Pokémon proceeds to hit your Decamarks (00), its HP bar will display with ??/0. Glitched pixels will gradually build up on the screen over a 20-30 minute period.

If the wild Pokémon instead uses a non-attacking move such as Growl, a coloured circle will appear above the still-wiggling Poké ball, and you will then white out. However, none of your Pokémon will be healed, and at this point the glitch may be repeated.

I've explained it all in a poor quality, unenthusiastically narrated video here: https://www.youtube.com/watch?v=1rz7Nq04pFM

[Evie Torchic the Glitch Scientist]

Thanks. When I viewed the summary of position 255 nothing happened when I exited it. That's odd. If only things were more predictable...

Edit: Let me work out 255's starting address. OK, it's in Box 2, and part of position 21. Do you have a Pokémon there?

[VaeporSage]

I'm afraid I can't really help you there, as over time I've renamed all of my boxes and none of them have their original names. However, in response to your question, only one of them doesn't have a Pokémon in the 21st slot, so I'd have to say yes.

[voltage]

Could this work in FRLG?