Main Menu
Main Page
Forums
Recent changes
Random page
Help

Databases
GlitchDex
AttackDex
AreaDex
DexDex
ItemDex
MetascriptDex
TMHMDex
TrainerDex
TypeDex
UnownDex
More

Major Glitches
Trainer escape glitch
Old man glitch
Celebi Egg glitch
SRAM glitch
Buffer overflow techniques
Pomeg glitch data corruption (Glitzer Popping)
Tweaking
Pokémon cloning
Select glitches (Japan)
Time Capsule exploit
Arbitrary code execution
More

Other Glitch Categories
Glitches by generation
Japan-only/language specific glitches
Natural glitches
Non-core series glitches
Non-Pokémon glitches
Recurring glitches
More

References
Pokémon GameShark codes
Pokémon Game Genie codes
Disassembly projects
The Big HEX List
GB programming
Curiosities
Debugging features
Error traps
Non-glitch exploits
Pokémon glitch terminology
Unused content and prerelease information
More

Useful Tools
8F Helper
GBz80 to Items
Old man trick name generator
PATH (Prama's Advanced Tweaking Heaven)
Save file editors
Special stat/Pokémon converter
Trainer escape Trainer Pokémon finder

Affiliates
Legendary Star Blob 2 (Hakuda)
Pokémon Speedruns wiki
PRAMA Initiative
Become an affiliate!

Technical
Site Source Code

Search Wiki

 

Search Forums

 

Author Topic: Using ledges to break collision, graphics and more  (Read 144 times)

0 Members and 1 Guest are viewing this topic.

RETIRE

  • Master of tilewriting
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • The Gen 4 dude
    • View Profile
Using ledges to break collision, graphics and more
« on: January 12, 2019, 11:54:01 am »
As some of you may know, in the void you can write tiles utilising graphic reloads to manipulate ram. One interesting tile that can be written is a ledgetile that moves the player 3 tiles. When you walk onto this ledge, the player is not restricted from opening menus or activating items.

When using an item you can buffer a textbox or even open a town map, but it won't stop the player from jumping. The fust particles might display after reloading the map. I have not yet tried all key items to see their results.

When opening the menu, the game stops you from jumping midair. Not only does this mean you are hovering, you also are in between two tiles. Now comes the fun stuff. This doesn't only move the model you are currently loading, it also puts the game in a state where it will not load any new mapmodels, meaning the current one is permanently loaded. Not only that, by ledgecanceling twice you can remove the barrier around sinnoh, which in combination with the models not loading until a graphic reload, gives you walk through walls. you can literaly walk up to shaymin or darkrai without even having to save at their area! Sadly, as with many glitches in gen 4, the tilewriting for this specific tile is ASLR bound. So, this route is very inconsistent and will only work if you
1) have extreme luck with your Variable pointer/ [Base] (confirmed working: 226d294)
2) manipulate the Base pointer.

If the latter can be done, this is a very useful alternative to getting to darkrai's area, as this is the first route that wouldn't require insane setups, or not require battle towers. This glitch clearly has some gamebreaking potential. Confirmation on hardware is still pending, as getting the right ASLR would be easier once we know how to manipulate it.

I made two videos, one showing the mapmodel, particles and npc's move and one showing the loadlines move:

https://youtu.be/N3OfTE_MVPc

https://youtu.be/Jzh2kDC9eU0

You can also move the graphics / camera so far that you can enter a different map in the void, and see the npc's you load in there.



Here are two pre-written routes for Darkrai and Shaymin I made today:

1 S
17 W
18 S bike (key item)
1 N graphic reload
415 W
Sr
33 E
383 N
14 E
graphic reload
128 N
1 E
graphic reload
479 S
273 E
256 S
21 E
1 S + Spam menu!
1 N
1 E
1 S + Spam menu!
1 N

choose route:
--------------
Darkrai:
213 E
14 S
graphic reload
1 N into tree => warp into darkrai’s area
--------------
Shaymin:

938 E
52 N
47 E

Save reset or press A => battle against shaymin
If press A:

6 S
1 E
south until Seabreak Path, fly/teleport (other movement may softlock)

in order to write the tile, you need to graphic in any outdoor map, with an uneven offset for it's subchunk, followed by a graphic reload
in a subchunk with an even offset with any of the following map ID's;
8-10, 19-22, 24-27, 29, 30,
38-40, 50-57, 59, 61-63, 72-80, 103-104, 107,
108-113, 143, 149,  192, 193, 201, 351, 374,  381, 389, 390, 398, 507, 517

In my route I use map 8 above mapdata, which I don't actually know what it corresponds to in RAM so this route might require some revision for non-english versions.
« Last Edit: January 15, 2019, 05:41:23 am by RETIRE »
Hey, I mainly focus on generation 4 glitches and specialise in voidspecific glitches.

If you'd like to see progress on gen 4 research you can watch my videos here:
https://www.youtube.com/c/RETIREglitch

Feel free to send me pms on the forum or add me on discord by tagging me in the glitchcity laboratories server ^•^

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Moving loadlines and graphics using ledges
« Reply #1 on: January 12, 2019, 12:15:59 pm »
What are the potential applications of this? Better RAM manipulation?
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

RETIRE

  • Master of tilewriting
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • The Gen 4 dude
    • View Profile
Re: Moving loadlines and graphics using ledges
« Reply #2 on: January 12, 2019, 12:51:46 pm »
What are the potential applications of this? Better RAM manipulation?

well I guess better ram manipulation for writing tiles is an option, although the only real functuonality in that regard is moving 16 steps less for a graphic reload. One other use is that when activated, you ignore all collision in your current subchunk, this can be seen in the video as I step through the collision of the walls to get to the npc's. this means more maps that were previously thought to require a fake sinnoh to enter, now can be entered using this instead.
Hey, I mainly focus on generation 4 glitches and specialise in voidspecific glitches.

If you'd like to see progress on gen 4 research you can watch my videos here:
https://www.youtube.com/c/RETIREglitch

Feel free to send me pms on the forum or add me on discord by tagging me in the glitchcity laboratories server ^•^

Parzival

  • Buyer beware: House comes with 3 free skeletons in a closet of your choice.
  • GCLF Member
  • *
  • Offline Offline
  • Gender: Male
  • This box intentionally left blank. ...wait...
    • View Profile
    • (null)
Re: Moving loadlines and graphics using ledges
« Reply #3 on: January 12, 2019, 10:37:01 pm »
Does this actually shift the map data in RAM or is it just graphical?
Ask me about betrayal.
Ask me about depression.
Ask me about death.
Ask me about destruction.
Ask me about hardship.
I've been through s**t.
If you need to talk to someone, my PM inbox is always open.

RETIRE

  • Master of tilewriting
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • The Gen 4 dude
    • View Profile
Re: Moving loadlines and graphics using ledges
« Reply #4 on: January 13, 2019, 06:32:32 am »
Does this actually shift the map data in RAM or is it just graphical?

It actually can move the barrier of sinnoh, which means we can walk through walls inside sinnoh and get anywhere. Here is a (sadly ASLR based) route that works with base = 226d294 (there might be more base values that write the tile with this route)

1 S
17 W
18 S bike (key item)
1 N graphic reload
415 W
Sr
33 E
383 N
14 E
graphic reload
128 N
1 E
graphic reload
479 S
273 E
256 S
21 E
1 S + Spam menu!
1 N
1 E
1 S + Spam menu!
1 N

choose route:
--------------
Darkrai:
213 E
14 S
graphic reload
1 N into tree => warp into darkrai’s area
--------------
Shaymin:

938 E
52 N
47 E

Save reset or press A => battle against shaymin
If press A:

6 S
1 E
south until Seabreak Path, fly/teleport (other movement may softlock)

« Last Edit: January 13, 2019, 07:39:51 am by RETIRE »
Hey, I mainly focus on generation 4 glitches and specialise in voidspecific glitches.

If you'd like to see progress on gen 4 research you can watch my videos here:
https://www.youtube.com/c/RETIREglitch

Feel free to send me pms on the forum or add me on discord by tagging me in the glitchcity laboratories server ^•^

Parzival

  • Buyer beware: House comes with 3 free skeletons in a closet of your choice.
  • GCLF Member
  • *
  • Offline Offline
  • Gender: Male
  • This box intentionally left blank. ...wait...
    • View Profile
    • (null)
Re: Using ledges to break collision, graphics and more
« Reply #5 on: January 14, 2019, 08:05:12 am »
So it does move some RAM around... that might be useful for memory corruption! If it can be shifted anywhere and then back, we could potentially use it to inject a small amount of data into anywhere we want (move to items, change values, move somewhere else, things of that nature)

Of course, if it's bound to map data, we're kinda boned, but still...
Ask me about betrayal.
Ask me about depression.
Ask me about death.
Ask me about destruction.
Ask me about hardship.
I've been through s**t.
If you need to talk to someone, my PM inbox is always open.