Main Menu
Main Page
Forums
New pages
Recent changes
Random page
Help

Glitches
Arbitrary code execution
Pokémon cloning
Pomeg glitch and Glitzer Popping
Tweaking and voiding
Glitches by generation
Glitch categories

References/Resources
Databases
Disassembly projects
The Big HEX List
Pokémon cheat codes
Pokémon glitch terminology
Useful tools
More

Affiliates
Legendary Star Blob 2 (Hakuda) (日本語/Japanese)
Pokémon Speedruns wiki (English)
PRAMA Initiative (Français/French)
MissingNo. Glitch City (Italiano/Italian)
Become an affiliate!

Technical
Site source code

Search Wiki

 

Search Forums

 

Author Topic: Ultra Ball and Great Ball glitch, how does it work?  (Read 6402 times)

0 Members and 1 Guest are viewing this topic.

Evie the Mother Hen ☽ ❤

  • Head Administrator
  • *****
  • Offline Offline
  • Gender: Female
  • I love My Melody. 🦋 ✿
    • View Profile
Ultra Ball and Great Ball glitch, how does it work?
« on: June 01, 2014, 01:27:12 pm »
Copy and paste from my Youtube video:

Quote
In Pocket Monsters Blue, when you buy two sets of Ultra Ball x99 or Great Ball x99 it messes some data up.

If you bought two sets of Ultra Ball x99 the exit mat will no longer work, and if you save and reset you can see that what makes up the border has also changed.

If you bought two sets of Great Ball x99, your badges byte will be changed to something like 62h, which equates to having the Cascade Badge, Marsh Badge and Volcano Badge.

The cause is unknown. This glitch doesn't work on other versions, strangely not even in Red, Green or Pocket Monsters Pikachu.

Instead of another stack of x99, you can buy say 99 Great Balls and 1 Great Ball and get a different effect like no badges.

Do NOT save after buying the two sets of x99 Ultra Balls if you value your save file. You won't be able to escape Cinnabar Island PokéMart without blacking out, and there is no way to escape the Pokémon League at all, because loading the save file causes a freeze.

Relevant Poké Marts:

Lavender Town
Celadon Department Store - Great Ball section
Fuschia City
Cinnabar Island
Indigo Plateau

After some observation, the number of items you buy for the second stack directly influences the result.

With all badges, buy 99 Great Balls and then 1 Great Ball, and the number of badges address (D2D5) will change to 00 (no badges). With just the BoulderBadge (01), buy 99 Great Balls and then 1 Great Ball and it will change to 02 (just the Cascade Badge), suggesting it was a +1.

Another example; buy 99 Great Balls and then 50 Great Balls, and if you had FF in the badges byte it will change to 31h, which is 110001, so if you read the bits least significant first it means you have badge 1 (Boulder Badge), badge 5 (Soul Badge) and badge 6 (Marsh Badge). Notice that 31h is FFh + 32h (50, the number of balls for the second stack we bought) when modulo 256 is in effect.

The same logic applies to buying 99 Ultra Balls and another stack, but the address that changes is D2E7; the map's height in blocks, and changing this apparently means you can't use the exit mat to escape.

Why is it these addresses that change? They are notably close to D2C9; the 20th item quantity, if that matters.
« Last Edit: June 01, 2014, 01:29:54 pm by Torchickens »

✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿
Here have some free flowers on every post :)
✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿



(Images © Sanrio, Nintendo, Pokémon, HAL Laboratory)

✿ Hi, I'm Evie. Transgender woman but spiritually doesn't believe 'male'/'female' needs to be defined; lives more stereotypically like a woman/I'm a 'girly' nerd who discovered herself. Call me whichever pronouns you like. :)

Feel free to contact me here about anything regarding the site.

Forgiveness. I feel that the more people pray to our greatest source/God/mathematical equality for world peace, the more and more it manifests into reality (until our next spiritual death).

Thank you Nyapon for this lovely artwork. :3

coloradohugge

  • Wiki Contributor
  • *****
  • Offline Offline
  • Gender: Male
  • Retro Game Collector, Former Swedish Let's Player
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #1 on: June 01, 2014, 02:29:36 pm »
Soooo... should i go try this on my Jp Blue cartridge now, or will the save file be totally f*cked?

pokechu22

  • Member+
  • *
  • Offline Offline
  • Gender: Male
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #2 on: June 01, 2014, 04:23:30 pm »
Copy and paste from my Youtube video:

Quote
Relevant Poké Marts:

Lavender Town
Celadon Department Store - Great Ball section
Fuschia City
Cinnabar Island
Indigo Plateau

Why those specificaly?  That's weird. 

What happens when you buy other items?  And is it possible other data is corrupted too?

This almost sounds like the cause for the ZZAZZ glitch, where adition is breaking something.  But I'm not sure. 

Very weird. 
When I underline text, that usualy means I am using the [‍acroynm] tag to provide aditional information.  Hover over it to view.
My youtube channel

Evie the Mother Hen ☽ ❤

  • Head Administrator
  • *****
  • Offline Offline
  • Gender: Female
  • I love My Melody. 🦋 ✿
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #3 on: June 01, 2014, 04:37:27 pm »
Because those Poké Marts have Great Balls and/or Ultra Balls.

I started a new Pokémon Red, went to Cinnabar Island with just the Potion and got this after buying two stacks of 99 Ultra Balls, so apparently the glitch works in English versions! (but it stops working after a certain point, the same applies to Red/Green though I couldn't get it to work in Yellow):



Then when I checked my items, apparently the game thought I only bought one stack of Ultra Balls:



When buying a third stack of 99 Ultra Balls this happened:



Then when I checked my items pack I only got 1 extra, and my 'position' on the map and the 'positions' of NPCs on the map got shifted down.



From there, I could go off the map and get a freeze.

When I bought two stacks of 99 Great Balls nothing visible happened.

I came across this glitch by myself, so I don't know if it's already documented elsewhere.

Also:



Um... apparently yes it does.

Edit: Trying to buy more Ultra Balls (specifically Ultra Balls for some reason) when you have 99 may cause you not to get another stack. You can keep buying 1 (or more) and you can browse through D35D values 01 up to 63 (which is 99 in decimal!), e.g. buy 2 and D35D changes from 00 to (+)02. Changing D35D changes the 'brightness value', but that name isn't really accurate.
« Last Edit: June 01, 2014, 05:03:18 pm by Torchickens »

✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿
Here have some free flowers on every post :)
✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿



(Images © Sanrio, Nintendo, Pokémon, HAL Laboratory)

✿ Hi, I'm Evie. Transgender woman but spiritually doesn't believe 'male'/'female' needs to be defined; lives more stereotypically like a woman/I'm a 'girly' nerd who discovered herself. Call me whichever pronouns you like. :)

Feel free to contact me here about anything regarding the site.

Forgiveness. I feel that the more people pray to our greatest source/God/mathematical equality for world peace, the more and more it manifests into reality (until our next spiritual death).

Thank you Nyapon for this lovely artwork. :3

pokechu22

  • Member+
  • *
  • Offline Offline
  • Gender: Male
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #4 on: June 01, 2014, 05:20:36 pm »
This is simply amazing.  That this was never found...  Wow.

Very impressive.  And odd. 

I can confirm that this also happens in Edición Roja (Spanish red).  Also, with the upward scrolling of the mart when buying three: It persists after saving.  And if you walk to where the exit should be, you can exit. 
When I underline text, that usualy means I am using the [‍acroynm] tag to provide aditional information.  Hover over it to view.
My youtube channel

luckytyphlosion

  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • JACK-flys are OP
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #5 on: June 01, 2014, 06:21:43 pm »
When I tried with Item Underflow activated, I saw that it replaced the "Brightness Value" and the "X-Coord Value". The Brightness value are always Ultra Balls and the position that the character is in when it is on the left of the mart guy. So what must be happening is that the game places the Ultra Balls in those values, thinking that those values are part of the inventory. Don't know why this happens, though.

TheZZAZZGlitch

  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • Unknown opcode fc at 801a
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #6 on: June 02, 2014, 12:35:19 am »
The glitch is present in all Japanese releases and English R/B. It does not work in English Yellow.

When adding an item to the inventory, the game runs through every single item in the bag, executing the following algorithm:

1. See if the currently checked item is the one that is added to the inventory
2. If so, try to increase its quantity instead of adding a new stack. If it fails, advance to the next item and go back to step 1
3. See if the item after the checked item is an end terminator (0xFF). If so, stop.
4. Advance to the next item and go back to step 1

It works great for most situations. Some of the people may have spotted the error already: Once the game tries to increase the quantity of an item, it does not bother checking for the end terminator anymore. Because of that, things may start to get pretty bad if there's a 99 stack in the last inventory slot. Let's see how it works out in action - say we have the following inventory:

Potion           x1
Ultra Ball       x99
END_TERMINATOR   x0


Let's assume we're adding Ultra Balls to the inventory. The game will walk through every single item, to see if the newly added items can merge into any of the stacks in inventory. It will eventually check the 99 stack of Ultra Balls to see if any new Ultra Balls can be merged with this stack. They can't, since the stack is already full. So the game will move on to the next item, the end terminator.
But the game only tests for the end terminator on the following item, not the currently checked one. So the end terminator goes unnoticed - as the result, memory beyond the inventory data will be treated as items.

On the previously presented Pokemon Blue example, the address that got corrupted was $D35D, because it was treated as an item quantity for $D35C. In Pokemon Blue, $D35C seems to always be 0x02 - the hex ID of Ultra Ball. Since it is the closest "Ultra Ball stack" the game could find, it will store the newly bought items there.

It's important to note that the glitch works with every item, not just Ultra Balls. The balls are just the most convenient items, since their hex IDs are very low and happen to exist in many memory locations.
Also it's the inventory adding subroutine that's faulty, not the Pokemon Mart selling mechanics. So the same glitch should be possible with item boxes or other inventories (if there are any).
« Last Edit: June 02, 2014, 12:37:29 am by TheZZAZZGlitch »
qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF qÁF

Wack0

  • Coder, reverser, beta collector [BetaArchive staff]
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • cBRH - Doing nothing since 2k7
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #7 on: June 02, 2014, 05:10:13 am »
So, we can essentially write arbitrary bytes in RAM (following those conditions, of course)? Could this be exploitable?
C H E C K E D . B U I L D S . A R E . A W E S O M E N E S S

BetaArchiveSoftHistory Forumsirc.rol.im #galaxy,#softhistory

Also known as The Distractor.

Shane, please stop telling children that there's a Mew outside under the delivery trucks. - Management

Pokémon: arbitrary code execution 1996-2016

SM

  • 14239
  • GCLF Member
  • Offline Offline
    • View Profile
    • Saver Mlog
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #8 on: June 02, 2014, 08:24:41 am »
with yami shop glitch we can change other memory adress, too.
for example, buying master ball by yami shop glitch can change d365(warp location) to mart's town ~ 63(99) S.S.Anne Deck

http://youtu.be/6PxBIzRY4eg

D358 was 01 so I needed to make d359 63(99)
I bought 30 master ball because D359(Player ID?) was 45(69)
« Last Edit: June 02, 2014, 08:32:31 am by SM »

luckytyphlosion

  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • JACK-flys are OP
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #9 on: June 02, 2014, 02:34:00 pm »
So, we can essentially write arbitrary bytes in RAM (following those conditions, of course)? Could this be exploitable?
Doesn't matter, an inventory with at least 40 slots cover most of the important ram bytes, shown in this post here: http://forums.glitchcity.info/index.php/topic,6914.0.html
The rest of the slots (40+ slots) don't affect the game, but that's just me testing.

pokechu22

  • Member+
  • *
  • Offline Offline
  • Gender: Male
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #10 on: June 02, 2014, 04:10:01 pm »
When I have text Underlined, hover over it for additional notes.

The glitch is present in all Japanese releases and English R/B. It does not work in English Yellow.

When adding an item to the inventory, the game runs through every single item in the bag, executing the following algorithm:

1. See if the currently checked item is the one that is added to the inventory
2. If so, try to increase its quantity instead of adding a new stack. If it fails, advance to the next item and go back to step 1
3. See if the item after the checked item is an end terminator (0xFF). If so, stop.
4. Advance to the next item and go back to step 1

It works great for most situations. Some of the people may have spotted the error already: Once the game tries to increase the quantity of an item, it does not bother checking for the end terminator anymore. Because of that, things may start to get pretty bad if there's a 99 stack in the last inventory slot. Let's see how it works out in action - say we have the following inventory:

Potion           x1
Ultra Ball       x99
END_TERMINATOR   x0


I think I also see why it stops working after progressing in the game: Rather than being something like this as it is at the start of the game:


Hex1Hex2||Item nameCount
1401||Potionx01
FF00||End of listx00
0000||Nothing0
0000||Nothing0
0000||Nothing0
0000||Nothing0
0000||Nothing0
0000||Nothing0

But later in the game, you have this, assuming you bought and sold stuff (but not the potion):

Hex1Hex2||Item nameCount
1401||Potionx01
FF00||End of listx00
FF00||End of listx00
FF00||End of listx00
FF00||End of listx00
FF00||End of listx00
0000||Nothing0
0000||Nothing0

So the game skips the first FF, but hits the next.

I hypothesize that one could avoid this by buying enough items that the bag is almost full save for one FF.  Maybe. 
When I underline text, that usualy means I am using the [‍acroynm] tag to provide aditional information.  Hover over it to view.
My youtube channel

blahpy

  • Yeah! Pomeg Berry!
  • Member+
  • *
  • Offline Offline
  • Gender: Female
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #11 on: June 02, 2014, 10:44:41 pm »
I hypothesize that one could avoid this by buying enough items that the bag is almost full save for one FF.  Maybe. 

Yes, certainly, unless the game checks for the number of items in the bag as well before letting you buy anything.

I find it somewhat interesting that the FF entries remain there after items have been added and removed, but I suppose there would be no legitimate reason to change them back to 00 if the method didn't have a bug.

Instead of removing the warp, is it possible to change the warp to somewhere else?

Evie the Mother Hen ☽ ❤

  • Head Administrator
  • *****
  • Offline Offline
  • Gender: Female
  • I love My Melody. 🦋 ✿
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #12 on: June 05, 2014, 11:10:57 am »
Thanks for your replies and research guys while I've been away. I'll play around with this glitch to do cool things like what SM did at some point.

I find it somewhat interesting that the FF entries remain there after items have been added and removed, but I suppose there would be no legitimate reason to change them back to 00 if the method didn't have a bug.

Stuff like that probably happens in several cases. Here, usually the FF entries are for item identifiers, not item quantities though. Example - an 'empty' items pack that had 3 items max: FF 00 FF 02 FF 02 FF.

FF permanence is also the case with your boxed Pokémon, and when you get 20 boxed Pokémon you can never take the FF out of the end byte (DA94 position 21) which is why the storage box data shift glitch (involving shifting bytes upward) no longer works after having a full box 1 at any point without you having to reset the game, and boxes other than box 1 are apparently filled with FF by default on real hardware.

I bought 30 master ball because D359(Player ID?) was 45(69)

Yes, D359 is byte 1 of the player ID word.

I've found that although the game will stop at the next FF other than a checked one according to TheZZAZZGlitch's explanation, FFs for item quantities rather than identifiers don't matter (i.e. odd addresses)

If you have ever had 20 items, you may never able to pull off this glitch without other tricks (maybe it's possible to enable again with something like item underflow glitch or 8F?) Getting a 20th item places an FF on D346, and say you had 99 Ultra Balls in position 19 and bought more Ultra Balls, the game will add a 20th Ultra Ball stack (with correct quantity) but wrongly say your items pack is full when you try to buy more. If you have 19 items but removed the FF in D346 with memory viewer, the glitch can indeed work with 19 items and buying a 20th.

« Last Edit: June 05, 2014, 01:15:51 pm by Torchickens »

✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿
Here have some free flowers on every post :)
✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿



(Images © Sanrio, Nintendo, Pokémon, HAL Laboratory)

✿ Hi, I'm Evie. Transgender woman but spiritually doesn't believe 'male'/'female' needs to be defined; lives more stereotypically like a woman/I'm a 'girly' nerd who discovered herself. Call me whichever pronouns you like. :)

Feel free to contact me here about anything regarding the site.

Forgiveness. I feel that the more people pray to our greatest source/God/mathematical equality for world peace, the more and more it manifests into reality (until our next spiritual death).

Thank you Nyapon for this lovely artwork. :3

blahpy

  • Yeah! Pomeg Berry!
  • Member+
  • *
  • Offline Offline
  • Gender: Female
    • View Profile
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #13 on: June 05, 2014, 04:48:41 pm »
Well, you could always just use 8F to rewrite those bytes that were changed to FF... It would be a hassle of course though

Blaziken257

  • Member+
  • Offline Offline
  • I am Error!
    • View Profile
    • Tulunk Village
Re: Ultra Ball and Great Ball glitch, how does it work?
« Reply #14 on: July 04, 2014, 09:11:38 pm »
This glitch is news to me; I hadn't heard of it until I read this thread. It amazes me that glitches like these don't get caught during testing and make their way into the final game.

I am wondering a couple of things though:
  • Why does the glitch work only in JP Blue, as well as international Red/Blue? Why doesn't it work as well in JP Red, or Green? (This intrigues me since they came out earlier than Blue.) What about the code is different in these games?
  • It is possible to move items around with Pokémon Stadium and Pokémon Stadium 2. What happens if you use one of these games? Does moving a second stack of Great/Ultra Balls under a first one trigger the glitch? If you move several items at once from your pack to another location (either the GB cartridge's PC, the N64 cartridge's Color Case, another GB cartridge, or tossing the items), do these get replaced with FF bytes as they do on the Game Boy itself?
« Last Edit: July 04, 2014, 09:20:28 pm by Blaziken257 »