Main Menu
Main Page
New pages
Recent changes
Random page

Arbitrary code execution
Pokémon cloning
Pomeg glitch and Glitzer Popping
Tweaking and voiding
Glitches by generation
Other glitch categories

Disassembly projects
The Big HEX List
Interactive tools
Reference documents

Legendary Star Blob 2 (Hakuda) (日本語/Japanese)
Pokémon Speedruns wiki (English)
PRAMA Initiative (Français/French)
MissingNo. Glitch City (Italiano/Italian)
Become an affiliate!

Site source code

Search Wiki


Search Forums


Author Topic: Technical writeup of my new HoO route  (Read 517 times)

0 Members and 1 Guest are viewing this topic.


  • Master of tilewriting
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • The Gen 4 dude
    • View Profile
Technical writeup of my new HoO route
« on: March 20, 2019, 01:19:42 am »
Since wrongwarps were discovered and understood I had been wondering: is a faster Hall of Origin capture location route for Arceus possible?
I never attempted to make a faster one because any method I could think of would only save about 1500 steps. I needed some other section of ram that I could get to quickly that I could modify to give me a Pal Park map and a Hall Of Origin map. And I accomplished this using warpdata, coordinate data, two independent Wrong Warps and a Spear Pillar warp.
The new route is only 5551 steps, which is a 10 000 step improvement over the old route. It is also 1200 steps from startup, and allows for infinite captures with 'Jubilife City' as capture location. Therefore it's also the best shinyhunt route out there. It's also the first completely consistent route that works across all languages.
Here is a youtube video showing everything, if you'd like to follow along:
Here are all the locations for [base] in all releases of D/P.
DS games have randomised RAM layouts. The RAM layout can have 64 patterns, and is assigned on booting of the game.
Therefore all calculations for RAM offsets use [base], the value that shows the randomisation.
base = 0x02106FC0   US/EU
base = 0x02107100   DE
base = 0x02107140   FR
base = 0x021070A0   IT
base = 0x02108818   JP
base = 0x021045C0   KR
base = 0x02107160   ES
Expected knowledge is understanding the concepts in this Void Guide:
Route explanation:
All map IDs above 0x22E (558 in decimal), are forced to 3 due to an error handler.
When entering Poketch Co
Map Id read from [base] + 22ADA = Matrix_center = 0008 = Poketch Co.
1 S
17 W
22 S
use Bicycle (key item)
32 N
415 W
Map Id = over 558 => 0003 = Jubilife City
Save reset
Map width 1x1 => 30x30
380 E
Explorer kit, back out of message
This writes current Map Id followed by X and Y coordinates at [Base] + 1488
X = FFFF FFE1 but is written as 16 bit => FFE1
Y= 0000 0000 but is written as 16 bit => 0000
480 N
260 E
Map Id = 0007 = Jubilife City top floor pokémoncenter
Save reset
Map width 30x30 => 1x1
214 W
479 S
X = 0000 000C
graphic reload
Y coordinate is underflowed, collision is now read from a different part of ram, and due to update orders we can move 2 tiles down if we run or move at full speed with bike, into a wall
Y = 0000 0001
graphic reload
Y coordinate is positive, collision is fixed and we walk down into the room.
Y= 0000 0003
3 W
talk to NPC from this spot
Reset after the saving is done
By talking to the Union Room npc, a Map Id and coordinate check is performed. If it matches, it overwrites data at [base] + 1488 with those values.
It will then warp you to them if you would reset the console. But since the check fails (we are at a wrong Y value) we will warp to our earlier written Explorer kit values at [Base] + 1488
X = FFE1
Y = 0000
Since Explorer Kit is used in an Outdoor map
Matrix id 1x1 => 30x30
X ram change (65505/32*2) = 4094 = 0FFE
Y ram change (0/32*2*30) = 0 = 0000
We add 0FFE to [base] + 22ADA.
This puts us at [base] + 23AD8.
This us really close to warp coordinates, sprite coordinates, sprite Id's, events, flagdata,... which we will now abuse heavily.
Register Town Map
Town map will be used to refresh graphics, which will unload models in Fake Sinnoh that block our path
100 E
320 S
We have reached warp coordinates, sprite coordinate, Id's, events, flags... which all get loaded when entering a Map.
Since their written values are read as Map Id, you can chain entering Maps and writing new ones.
32 E
Map Id =  0002 = Underground
Writes 0188 and 002D
191 S
32 E
1 S
Map Id =  0188 = route 221
Writes 0132 , 0189 and 0028
32 E
1 N
192 E
Town Map
65 S
96 E
Map Id =  0028 = Canalave City Library - 03
Writes 01D4
1 N
128 W
Town Map
8 W
14 N
Map ID = 01D4 = route 223
X = FFFF 0138
Y = 0000 0232
Explorer Kit
Back out of message
Writes to [base] + 1488
X = 0138
Y = 0232
In the overworld, this equals to above the door of Eterna city's gym
56 W
Town Map
1 W
47 S
Map Id = 0132 = Galactic HQ
Clears a path through ram
Writes 0010
1 N
32 E
Town Map
1 E
1 S (cutscene if first time entering)
Map Id = 0189 = inside Pal Park
Writes 00FB
32 N
Town Map
32 N
64 E (63 if cutscene played)
Town Map
96 N
1 N
Map Id = 00FB = outdoors Pal Park
Grants the Pal Park menu with RETIRE function
1 S
96 W
Map Id =  0010 = Jubilife City Jubilife TV-06
Writes 0006
97 N
Map Id = 0006 = Jubilife City Pokemon Center
Writes 0004
Map Id = 0004 = Jubilife City Mart
Writes 0002
1 W
Go through map 0002 = Underground
Writes 00B9
1 E
Go through 00B9 = Cynthia's room
Mapscript runs to start battle
Lose battle (except for dig, this is the fastest way to leave the void with the Pal Park menu without overwriting [base] + 1488)
We are now in a Pokémoncenter with the Pal Park menu
Take some strong Pokémon from a box
Walk up left elevator
Mapscript pushes you into void
4 W
15 N
6 E
graphic reload
full speed south
graphic reload
2 S
2 E
talk to NPC from this spot
Reset after the saving is done
This is all the same as earlier, we warp to the values written earlier at [base] + 1488, above Eterna City Gym's door
Graphic reload
1 S
enter warp
Map Id read from [base] + 22ADA = Matrixcenter = 0043 = Eterna City Gym
Has matrix ID 00DC
1 S
243 E
332 N
Map ID read from [base] + 22AD6 = Matrix ID
= 00DC = Spear Pillar
X = 0000 00FB
When we pressed RETIRE we activated a cutscene that stores our
Map id = 00DC
X = 0000 00FB but is written as 16 bit => 00FB
Y = FFFF FFC1 but is written as 16 bit => FFC1
And warps us back to the void of spear pillar and 16 bit equivalent of the coordinates. This does the following
X ram change: (251/32*2) = 14 = 000E
Y ram change: (65217/32*2*2) =  8152 = 1FD8
We add 1FE6 to [base] + 22ADA.
This puts us at [base] + 24AC0.
This is really close to coordinate, warp, animation, sprite... data. (the thing is a mess)
We will be abusing coordinates, and warpdata.
Writes 00FB = Outdoor Pal Park as the X value of a warp
479 N
259 E
Adds 0103 to 00FB => X = 01FE
64 N
Enter X coordinate data = 01FE = Hall of Origin
HoO Arceus runaway:
RETIRE (runaway)
1 N
3 S
repeat until you capture an Arceus
65 N
Enter X value of warp = 00FB = Outdoor Pal Park
Jubilife Arceus infinite capture:
1 N
RETIRE (capture/runaway)
2 S
repeat until you have captures all Arceus you’d like
64 N
Enter X value of warp = 00FB = Outdoor Pal Park

If you have any questions, shoot them! I am not the best at writing technical writeups but I tried, and had some feedback from ISSO a while ago.
Hey, I mainly focus on generation 4 glitches and specialise in voidspecific glitches.

If you'd like to see progress on gen 4 research you can watch my videos here:

Feel free to send me pms on the forum or add me on discord by tagging me in the glitchcity laboratories server ^•^