Main Menu
Main Page
Forums
Recent changes
Random page
Help

Databases
GlitchDex
AttackDex
AreaDex
DexDex
ItemDex
MetascriptDex
TMHMDex
TrainerDex
TypeDex
UnownDex
More

Major Glitches
Trainer escape glitch
Old man glitch
Celebi Egg glitch
SRAM glitch
Buffer overflow techniques
Pomeg glitch data corruption (Glitzer Popping)
Tweaking
Pokémon cloning
Select glitches (Japan)
Time Capsule exploit
Arbitrary code execution
More

Other Glitch Categories
Glitches by generation
Japan-only/language specific glitches
Natural glitches
Non-core series glitches
Non-Pokémon glitches
Recurring glitches
More

References
Pokémon GameShark codes
Pokémon Game Genie codes
Disassembly projects
The Big HEX List
GB programming
Curiosities
Debugging features
Error traps
Non-glitch exploits
Pokémon glitch terminology
Unused content and prerelease information
More

Useful Tools
8F Helper
GBz80 to Items
Old man trick name generator
PATH (Prama's Advanced Tweaking Heaven)
Save file editors
Special stat/Pokémon converter
Trainer escape Trainer Pokémon finder

Affiliates
Legendary Star Blob 2 (Hakuda)
Pokémon Speedruns wiki
PRAMA Initiative
Become an affiliate!

Technical
Site Source Code

Search Wiki

 

Search Forums

 

Author Topic: Celadon Corner Glitch Metamap Script ACE could be used as a "Yellow gm- ACE"  (Read 167 times)

0 Members and 1 Guest are viewing this topic.

Krys3000

  • The frenchie
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • Head admin of the PRAMA Initiative
    • View Profile
    • PRAMA Initiative - Main french Pokémon glitch website
...or a 4F/ws m ACE without 4F/ws m.

Hello everyone,

Glitch Meta-map Script ACE is a rather poorly documentated ACE method in Pokémon Red, Blue and Yellow, which relies on using either the Trainer Escape Glitch or the Item Underflow Glitch in the PC (or any other ACE method) to change the value of the address controlling the script for a given map.

Indeed, some (all?) of these addresses can be changed directly by changing the nature or the quantity of the right item beyond the 50th slot using PC underflow.
But, as you probably all know, when performing the Trainer Escape Glitch, we change the escaped trainer's map script to 01 and change it back to 00 when coming back after facing a Pokémon and flashing the start menu (whose textbox ID on every map is 00). And, if reading another textbox than the start menu before getting back on the escaped trainer's map, we can attribute to the script address another value than 00 - the one matching the given textbox ID.

While working a bit on Glitch Metamap Script ACE I noticed that Glitch Script 0x12 of Celadon Corner in Yellow executes codes in both english and french games at $FA4C, an Echo RAM copy of $DA4C. This is the fifth character of the last Daycare Pokémon name in english games (and the safari balls count in french games, which could be noped as well as the following address controlling the presence of a Pokémon in the Daycare to reach the first character in that name).

Of course, I couldn't help but thinking about luckytyphlosion's extensive work on gm- glitch item ACE that I believe could be adapted to this. Executing code would not use gm- but just entering into the Corner!

As a proof of concept I have performed a setup that could be used aswell (of course, it should also work with gm- in R/B provinding that we adapt the jump) derived from the setup I invented for glitch item ACE using 4F. Note that similarly to 4F ACE, if your Daycare as never been used, you can use a 10/11-Stored Pokémon ws m setup and it will work with this method.

- If playing french games, make sure that during your last visit to the Safari Zone, you have come out of time or of Balls.
- Place at the Daycare an un-nicknamed Abra at lvl 80 with currently 24 HP. The O.T. of this Pokémon must be compatible with ACE (e.g.: AAAAAAA)
- If playing french games, take back that Pokémon. You can also do it if playing english games.
- Have in PC Slot 1 a Pokémon with 33 PP currently on first move, 33 PP currently on second move (38 if playing french games), 19 PP currently on third move (3 PP Up used) and no fourth move or no PP on it.
- Have in PC Slot 2 Clefairy, Male Nidoran or Spearow (or another Abra) with currently 233 HP.

This jumps to $D321 (english) or $D326 (french) which is item 3 of the pack. Enter in the Corner to execute the code.

This stays theorical. It seems impossible to Trainer Escape the Rocket in Celadon Corner (except with a glitch item maybe, Evie may know more about this), and I don't know if $D65E, which is the address for the Corner's script, is accessible through the underflow in the PC. If not, then this ACE method would be exclusively limited to the ability to use another ACE Method to setup the script!

If anyone of you has some time to work on this, don't hesitate to do it  :)
« Last Edit: September 03, 2018, 03:08:59 pm by Krys3000 »

Admin of the PRAMA Initiative, the main french Pokémon glitch website
http://www.prama-initiative.com
“Anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that 'my ignorance is just as good as your knowledge.'” - Isaac Asimov

Evie Torchic the Glitch Scientist

  • Administrator
  • *****
  • Offline Offline
  • Gender: Female
  • Thank you for this lovely artwork Nyapon!
    • View Profile
This sounds really interesting. Awesome find Krys3000. :) Unfortunately I'm not sure if this will work for reasons below without another arbitrary code execution (or connection copier which is like ACE and debatably is), so we may have to settle for an earlier meta-map script.

This stays theorical. It seems impossible to Trainer Escape the Rocket in Celadon Corner (except with a glitch item maybe, Evie may know more about this), and I don't know if $D65E, which is the address for the Corner's script, is accessible through the underflow in the PC. If not, then this ACE method would be exclusively limited to the ability to use another ACE Method to setup the script!

I think from what has been found unfortunately you can only escape from long-range Trainers, otherwise Trainers who spot you with the help of a Rival's effect item. I feel it may not be out of the question though with the complexity of glitch items and it would be cool to be able to do something like that.

This is the method I use to find the item.

First assume:

D53A (number of items) + (x) + (x-1)

Then take D65E (desired address) and minus D53A on Windows Calculator (programmer mode) and divide by two to get 0x92.

Now assume 0x92 to be x:

D53A + 92 + 91
=D65D

This way we find that D65D is item 0x92 (which is item 146), so because quantities follow items, D65E is the quantity of item 146.

However it seems sadly it may still be impossible due to it being an item beyond slot 127. I remember Dabomstew telling me regarding the usual expanded items pack that items 128-255 are regarded by the game as earlier items in the pack (unsure of the specifics but they appear and function as if they were something such as -128 of the original or item 0-127. I've confirmed many items past slot 127 are repeats but it confuses me because I don't know what item 0 would be.). It may be then that the expanded PC covers the same rule.

I hope you success in finding a working meta-map script method!
« Last Edit: September 04, 2018, 06:18:36 am by Evie Torchic the Glitch Scientist »
Hi!

I'm Evie.

I'm a transgender person, but any pronouns are fine. She/her preferred.

Unfortunately due to legal concerns I won't be using emulators and unauthorised copies of ROMs anymore, just real hardware with official cartridges and a cheating device (Xploder) to aid research, sorry.

Online I most often use the username Torchickens or Chickasaurus.

Ah.. koucha ga oishii ♪





Thanks Aeriixion for the cute sprite above! :) Roelof also made different variations of the sprite (which I animated).




Contact:
If you like, please contact me by private message here on the forums as I no longer check other places very often.

YouTube: http://www.youtube.com/user/ChickasaurusGL

I like to collect interesting video games. ^_^
https://www.vgcollect.com/Torchickens

Faith (which doesn't have to be religious) and a positive attitude/optimism is half the battle for well-being.

Fun times come and go, we may argue what is the point if nothing in this world is permanent; and all energy is believed to be subject to transformation. I guess in the temporary absence of it though, we value those times more and even though some things seem to be lost, they return in other forms.

Krys3000

  • The frenchie
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • Head admin of the PRAMA Initiative
    • View Profile
    • PRAMA Initiative - Main french Pokémon glitch website
Ok Evie, thanks!

Apparently yes, it seems that this item cannot be reached in the Expanded PC. If we want this method to replace the necessity for a glitch item, we could be using Pikachu Off-Screen ACE to setup $D65E to 12. This way, there would be no need for a glitch item nor performing the annoying Pikachu Off-Screen process to execute code: entering the corner would do the job. I will work more on this soon if possible :)
« Last Edit: September 04, 2018, 07:32:23 am by Krys3000 »

Admin of the PRAMA Initiative, the main french Pokémon glitch website
http://www.prama-initiative.com
“Anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that 'my ignorance is just as good as your knowledge.'” - Isaac Asimov

Evie Torchic the Glitch Scientist

  • Administrator
  • *****
  • Offline Offline
  • Gender: Female
  • Thank you for this lovely artwork Nyapon!
    • View Profile
Ok Evie, thanks!

Apparently yes, it seems that this item cannot be reached in the Expanded PC. If we want this method to replace the necessity for a glitch item, we could be using Pikachu Off-Screen ACE to setup $D65E to 12. This way, there would be no need for a glitch item nor performing the annoying Pikachu Off-Screen process to execute code: entering the corner would do the job. I will work more on this soon if possible :)

You're welcome. That's true. OK, good luck and have fun! :)
Hi!

I'm Evie.

I'm a transgender person, but any pronouns are fine. She/her preferred.

Unfortunately due to legal concerns I won't be using emulators and unauthorised copies of ROMs anymore, just real hardware with official cartridges and a cheating device (Xploder) to aid research, sorry.

Online I most often use the username Torchickens or Chickasaurus.

Ah.. koucha ga oishii ♪





Thanks Aeriixion for the cute sprite above! :) Roelof also made different variations of the sprite (which I animated).




Contact:
If you like, please contact me by private message here on the forums as I no longer check other places very often.

YouTube: http://www.youtube.com/user/ChickasaurusGL

I like to collect interesting video games. ^_^
https://www.vgcollect.com/Torchickens

Faith (which doesn't have to be religious) and a positive attitude/optimism is half the battle for well-being.

Fun times come and go, we may argue what is the point if nothing in this world is permanent; and all energy is believed to be subject to transformation. I guess in the temporary absence of it though, we value those times more and even though some things seem to be lost, they return in other forms.

Krys3000

  • The frenchie
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • Head admin of the PRAMA Initiative
    • View Profile
    • PRAMA Initiative - Main french Pokémon glitch website
According to your method, Pallet Town script, $D5F0, can be manipulated from the expanded PC. Pallet Town Glitch Script 0x13 executes code from current player x-position ($D361) which also can be manipulated from an expanded pack.

This of course is rather hard to use in routine, but do you think that, similarly to what you said about Viridian Glitch script 0x11, it is possible to put a code at this position that would change the Celadon's Corner script to 0x12 and execute it, then go on with the Corner ACE?

Thanks  :)
« Last Edit: September 04, 2018, 03:03:23 pm by Krys3000 »

Admin of the PRAMA Initiative, the main french Pokémon glitch website
http://www.prama-initiative.com
“Anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that 'my ignorance is just as good as your knowledge.'” - Isaac Asimov

Evie Torchic the Glitch Scientist

  • Administrator
  • *****
  • Offline Offline
  • Gender: Female
  • Thank you for this lovely artwork Nyapon!
    • View Profile
According to your method, Pallet Town script, $D5F0, can be manipulated from the expanded PC. Pallet Town Glitch Script 0x13 executes code from current player x-position ($D361) which also can be manipulated from an expanded pack.

This of course is rather hard to use in routine, but do you think that, similarly to what you said about Viridian Glitch script 0x11, it is possible to put a code at this position that would change the Celadon's Corner script to 0x12 and execute it, then go on with the Corner ACE?

Thanks  :)

Yes. That's right. :) According to my description on my old dry underflow video, this is the item ID of stored PC item 92, and 0x13 is a Super Potion is reasonable and can easily go in that slot (with some good counting).

I'm unsure however whether there are safe Pallet Town normal initial x-coordinates (and the data that follows) which will not freeze the game.

If this is not the case however, perhaps changing D35D (item 32 quantity) to 0x00, setting up the desired x-position/y-block (ideally a relative jump back to 21 D3) and using 9F to refresh the map is possible. At D321 would be your code to set up the Game Corner script (or whichever ACE method you like).

This as bytes would be 18 BE. D361 is item 34's quantity and D362 is item 35. Hence item 34 should be any item x24 (hex:18) and the glitch item # ...# (hex:BE) in slot 35. If this is possible, it may actually be simpler than a method involving entering Pallet Town normally. The only other potential problem is if D36D ("level-script pointer" map script, which I wrote about in an earlier thread) is an address in the range of 4000-7FFF and you are switching to a map which is from another bank (as listed here), so to be safe it may be that only certain maps should be used with the 9F method, such as Viridian City (bank 6; the same as Pallet Town), however not all old D36D-D36E values would freeze the game.

Hope this helps for now! It's late and unfortunately I don't have time to experiment with this with you sorry, but I can try to verify the 9F method tomorrow with you if you like.
« Last Edit: September 04, 2018, 03:46:51 pm by Evie Torchic the Glitch Scientist »
Hi!

I'm Evie.

I'm a transgender person, but any pronouns are fine. She/her preferred.

Unfortunately due to legal concerns I won't be using emulators and unauthorised copies of ROMs anymore, just real hardware with official cartridges and a cheating device (Xploder) to aid research, sorry.

Online I most often use the username Torchickens or Chickasaurus.

Ah.. koucha ga oishii ♪





Thanks Aeriixion for the cute sprite above! :) Roelof also made different variations of the sprite (which I animated).




Contact:
If you like, please contact me by private message here on the forums as I no longer check other places very often.

YouTube: http://www.youtube.com/user/ChickasaurusGL

I like to collect interesting video games. ^_^
https://www.vgcollect.com/Torchickens

Faith (which doesn't have to be religious) and a positive attitude/optimism is half the battle for well-being.

Fun times come and go, we may argue what is the point if nothing in this world is permanent; and all energy is believed to be subject to transformation. I guess in the temporary absence of it though, we value those times more and even though some things seem to be lost, they return in other forms.

Krys3000

  • The frenchie
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • Head admin of the PRAMA Initiative
    • View Profile
    • PRAMA Initiative - Main french Pokémon glitch website
Sorry for the time before getting back on this. I was busy these days  ;D

So, I actually wrote a setup for it that uses the connection copier, which in my opinion is indeed an underrated subglitch of the item underflow, to copy 12 to $D65E. With these items and once saved and reset, the game can execute code from item 3 as long as you have the good setup, everytime you enter the Game Corner.

Item 1 ($D31D) = Hyper Potion ($12)
Item 37 quantity ($D367) = 127 ($7F)
Item 38 quantity ($D369) = 250 ($FA)
Item 43 ($D372) = Escape Rope ($1D)
Item 43 quantity ($D373) = 211 ($D3)
Item 44 ($D374) = 9F ($5E)
Item 44 quantity ($D375) = 214 ($D6)
Item 45 ($D376) = Master Ball ($01)
Item 45 quantity ($D377) = 0 ($00)

However, it still needs a glitch item (9F). If one has a series of 6 still unused slots in its regular bag (meaning 12 bytes with a value of 00), he could place the Hyper Potion right after them and use connection copying to move the 13 bytes from $D652 to $D65E. This way, we avoid the glitch item because $52 is Elixer, but it would require adapting the Item 43 to point to this data block (Super Repel if the blank spots are Item 14 to 19).
« Last Edit: September 15, 2018, 04:10:36 pm by Krys3000 »

Admin of the PRAMA Initiative, the main french Pokémon glitch website
http://www.prama-initiative.com
“Anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that 'my ignorance is just as good as your knowledge.'” - Isaac Asimov

Evie Torchic the Glitch Scientist

  • Administrator
  • *****
  • Offline Offline
  • Gender: Female
  • Thank you for this lovely artwork Nyapon!
    • View Profile
Nice!

Actually it seems Connection Copier could be a convenient way to bootstrap 4F for you.

If you place in an item quantity slot: Item x195, followed by Water Stone x211, (or jp 22D3) and then copy that data to FA65 (or FA64 for Yellow) (in Day Care), you can set up 4F ACE easily, for any item 3 configuration (including reusable RAM writer). This may be quicker than the D36E/reusable RAM writer method I put together earlier.
Hi!

I'm Evie.

I'm a transgender person, but any pronouns are fine. She/her preferred.

Unfortunately due to legal concerns I won't be using emulators and unauthorised copies of ROMs anymore, just real hardware with official cartridges and a cheating device (Xploder) to aid research, sorry.

Online I most often use the username Torchickens or Chickasaurus.

Ah.. koucha ga oishii ♪





Thanks Aeriixion for the cute sprite above! :) Roelof also made different variations of the sprite (which I animated).




Contact:
If you like, please contact me by private message here on the forums as I no longer check other places very often.

YouTube: http://www.youtube.com/user/ChickasaurusGL

I like to collect interesting video games. ^_^
https://www.vgcollect.com/Torchickens

Faith (which doesn't have to be religious) and a positive attitude/optimism is half the battle for well-being.

Fun times come and go, we may argue what is the point if nothing in this world is permanent; and all energy is believed to be subject to transformation. I guess in the temporary absence of it though, we value those times more and even though some things seem to be lost, they return in other forms.