1 2 3 4 5
12 13
GoddessMaria
She/Her
Reviewer, Experienced player (868)
Joined: 5/29/2009
Posts: 519
Location: Hell...
Sorry for the wait! I couldn't figure out where I should stand after Route 110, but after this WIP. I'll probably be needing some assistance. Anyway, here you go! Encode: Link to video VBM
Current projects: failing at life
GoddessMaria
She/Her
Reviewer, Experienced player (868)
Joined: 5/29/2009
Posts: 519
Location: Hell...
Here is WIP #4! Enconde: Link to video VBM
Current projects: failing at life
Fortranm
He/Him
Editor, Experienced player (879)
Joined: 10/19/2013
Posts: 1122
GamingAori
Other
Joined: 1/26/2014
Posts: 35
https://www.youtube.com/watch?v=cFS6gsrD-9Y is a warping to hall of fame glitch.
I'm new and I'm german. My english isn't the best sry ^^
Skilled player (1743)
Joined: 9/17/2009
Posts: 4986
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Has there been any documentation on exactly what causes the game to mess up when simply looking at the glitched moves? Because it would be very useful if it allows you to change and capture an opponent's pokemon since that would mean no mass egg hatching in a catch em all.
Joined: 12/29/2007
Posts: 489
jlun2 wrote:
Has there been any documentation on exactly what causes the game to mess up when simply looking at the glitched moves? Because it would be very useful if it allows you to change and capture an opponent's pokemon since that would mean no mass egg hatching in a catch em all.
I believe it's the same reason that "Super Glitch" effects occur in Gen I - the move's name lacks a terminator and is so long that displaying it overwrites other memory areas. Exactly which bytes and memory areas these are, though, I believe is still undocumented.
Fortranm
He/Him
Editor, Experienced player (879)
Joined: 10/19/2013
Posts: 1122
GamingAori wrote:
https://www.youtube.com/watch?v=cFS6gsrD-9Y is a warping to hall of fame glitch.
It's finally here. Is it considered ACE?
Patashu
He/Him
Joined: 10/2/2005
Posts: 4045
Fortranm wrote:
GamingAori wrote:
https://www.youtube.com/watch?v=cFS6gsrD-9Y is a warping to hall of fame glitch.
It's finally here. Is it considered ACE?
This is classic ACE. The names of the pokemon in the box are executed as code.
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Skilled player (1743)
Joined: 9/17/2009
Posts: 4986
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
GamingAori wrote:
https://www.youtube.com/watch?v=cFS6gsrD-9Y is a warping to hall of fame glitch.
From the video comments:
TheZZAZZGlitch wrote:
1. Absolute jump instructions cannot be encoded in a Pokemon's nickname, so jumping anywhere far won't be possible unless a different method of executing arbitrary code is found. 2. GBA's input register has only 10 bits of controllable data, while a single valid ARM instruction should be 32 bits.
:/
Joined: 12/29/2007
Posts: 489
Patashu wrote:
Fortranm wrote:
GamingAori wrote:
https://www.youtube.com/watch?v=cFS6gsrD-9Y is a warping to hall of fame glitch.
It's finally here. Is it considered ACE?
This is classic ACE. The names of the pokemon in the box are executed as code.
Now all we need is a way to trigger this faster than actually beating the game.
Joined: 7/30/2013
Posts: 79
It certainly be faster than just corrupting the Fly locations flag into allowing you to fly to south Ever Grande, and dealing with further battles with a Bad Egg that knows the instant victory move. Doing both in one corruption should be doable in a TAS.
(◕‿◕)
GamingAori
Other
Joined: 1/26/2014
Posts: 35
does want anyone make a glitched run? I think this is to hard for my first tas :/
I'm new and I'm german. My english isn't the best sry ^^
Patashu
He/Him
Joined: 10/2/2005
Posts: 4045
GamingAori wrote:
does want anyone make a glitched run? I think this is to hard for my first tas :/
GoddessMaria is working on the glitched run. Check out the previous page.
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
GamingAori
Other
Joined: 1/26/2014
Posts: 35
i think he/she make an all gold symbols tas? not a glitched tas?
I'm new and I'm german. My english isn't the best sry ^^
Joined: 7/30/2013
Posts: 79
GamingAori wrote:
i think he/she make an all gold symbols tas? not a glitched tas?
GoddessMaria15 wrote:
I plan on doing both, but since glitched any% seem to be in high demand right now, I'll be doing that first.
Other than that she's been letting her "slave" pokés die in the WIPs, which hints Pomeg Glitch.
(◕‿◕)
Skilled player (1743)
Joined: 9/17/2009
Posts: 4986
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Since you can get bad eggs and possibly other glitched pokemon legit with this ACE/memory corruption, does this allow getting said glitched pokemon into d/p/pt with pal park?
Joined: 1/6/2012
Posts: 51
Location: France
GoddessMaria15 : If you reached Fortree City and Pomeg Glitch, or made some tests, could you tell me if you succeeded into corrupting Ever Grande Fly Location in a single corruption ? In Werster's case, he wasn't able to get it, and after some search, I saw that it shouldn't be possible with a single corruption because the value of some double words higher than the desired byte alter the pointer corrupting pattern, making it avoid Ever Grande Fly Location. The only way I found in my version to repair things was to fight Twins at Route 104 or 103 (only one of them). Thus, there would be a single adresses position that would allow it, so you would know which PC slots would be able to suffer from Move corruption, getting a convenient Glitch Move in the same time.
jlun2 wrote:
Has there been any documentation on exactly what causes the game to mess up when simply looking at the glitched moves? Because it would be very useful if it allows you to change and capture an opponent's pokemon since that would mean no mass egg hatching in a catch em all.
There are different reasons that makes the game freeze / reset with glitch moves. In a Pokemon summary, the main reason is the move's type : since its stored in a byte, there are 255 - 18 - 5 = 233 unknown move types, and a majority of them freeze the game when seen. The move name is well managed by the game, as really long names can be displayed if a move is Poison or Fighting type, for example. The move contest summary can also freeze because of the contest effect of the move (only a few exist, maybe a dozen, and its coded on a byte, so that makes a lot of unknown effects). In battle, there are some move names that are lethal : some make the game freeze just before the pokemon attacks other names contain a sort of "loop" with the oe symbol, and this makes the game freeze after a certain point. A ton of move animations can make the game freeze, but as I cut them off, I can't really tell significant things about it, except that they tended to be the most hazardous (with savestates, a single move could bring different effects). As for the effects, there also are unknown ones, and some of them make the game freeze, but this is rare, as there aren't that many unknown effects, and a lot of them are stable. However, the game seems to dislike loading a move name when Sketch is used, as many glitch moves freeze the game when they are sketched, even if they're inoffensive (when it happens, the different screen areas are scrambled). There are also moves that change the battle type, with other things, as soon as they are seen in battle. Some of them greatly mess with the data, making the game freeze after selecting a move, or at the end of the turn, but in general, they just create a mix of battle styles that can get you wrecked ( Dojo + Double + Palace combinations are harsh to deal : you have to kill the opponent before the game decides other things). The issue with stealing an opponent's Pokemon is that there's an anti-cheating script that turns the stolen Pokemon into a Bad Egg (I think its because the TID doesn't match), so unless you use an AR code to cut it, you won't be able to correctly steal Pokemon from trainers (but you can have some Bad Eggs like this, with defined moves)
Skilled player (1743)
Joined: 9/17/2009
Posts: 4986
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Well, if stealing pokemon won't work, how about corrupting wild pokemon to something else? Also, how many pokemon in the PC can be glitched into something else via corruption at the same time?
Joined: 1/6/2012
Posts: 51
Location: France
There are 54 Pokemon that can be corrupted into the PC in Emerald (60 in FrLg). The largest corruptions can affect 45-50 Pokemon I would say. But that's not the number that counts, its the type of corruption that will happen to the Pokemon, as there are different reasons for turning into a Bad Egg, or not. Usually, the pointer will corrupt a part of the Pokemon's data (Move 2, Move 4, PPs, Item, Species, Ball, EVs,..) and this corruption will turn it into a Bad Egg. The surname can also be affected, and the Pokemon won't turn into a Bad Egg. If the PID is corrupted, with a certain corruption (Bit 6 and not Bits 0&2), the Pokemon can turn in an Egg, and its data substructures will be swapped, as the PID manages their order. It will work if no other data is corrupted along with the Pokemon's PID, and if some values (Move 2, PPs of Move 4, Item, Onctuosity,..) respect a certain condition. Out of the 2*3*4 possible combinations of data substructures swap, only 10 can be obtained, but that's enough for cool corruptions. If the TID is corrupted, (with a Bit 6 corruption), and with the same conditions as the ones needed for the PID corruption, the Pokemon will turn into an Egg. However, its data substructures won't be swapped, since the PID manages it. Thus, the Pokemon inside the Egg will be the Pokemon that was before, with slight changes to certain values (Move 2, Move 4, Item, Exp, Onctuosity,...), but the change on moves is the only one that can be seen, as Exp, Item, EVs, Condition are all reset when an Egg hatch. And if we mix the last two corruptions (TID and PID), the Pokemon that was corrupted into an Egg will be corrupted again to transform into another Pokemon (the species depend on the data substructures swap), allowing us to have more control over the data of the corrupted Pokemon (Item, Exp, EVs, Condition, Moves), which allows the making of overpowered Pokemon. This is Double Corruption, the best use of Pomeg Glitch for altering Pokemon's data. But for a speedrun, the sole interest would be a Glitch Move that ends the battle directly, so a simple Move corruption would suffice to obtain it. There is a lot of Instant Battle Moves, but since the Move corruption has only 4 patterns (Move = Move xor 0x4000 or 0x500 or 0x400 or 0x100), only some of them can be reached. One of the easiest is Move 0x0537 obtained from Water Gun (0x0037). Move Corruption 0x4000 can be done on any Pokemon, but the 3 other corruptions depend on the Pokemon's data. Thus, the dummy that would suffer from corruption can't be any Pokemon, if it's in order to obtain a move like 0x0537. (Marill / Tentacool work well) I don't know any Instant Victory Move with an identifiant of 0x40xx, as it would be easier in terms of Pokemon choice. To have more sight about what's happening to a Pokemon, I made a script indicating the main data of a Pokemon (IVs, EVs, Condition, Pokerus, Item, PID, Moves, PPs, TID), with 3 modes : Seeing data of a wild Pokemon Seeing data of a Pokemon when its summary is opened Seeing data of a Pokemon when its held in PC The third mode is useful for Pomeg Glitch, as Bad Eggs frequently freeze/reset the game when their summary is seen. Download link (it's in French, but works for US versions of Emerald)
Skilled player (1743)
Joined: 9/17/2009
Posts: 4986
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
1. Up to 54 at once? For a 100% completion that doesn't involve arbitrary code execution, is it possible to change the pokemon and have it register in the pokedex without going to the egg stage? 2. For the purpose of 100%, is it possible to change a wild pokemon such that catching it would register as something else? 3. There's no way at this moment to bypass the anti-cheat script regarding stealing right? 4. In addition to my question regarding transferring glitched pokemon and/or moves to diamond/pearl/platinum, is there any effects on transferring them to colosseum/XD? 5. Are there any glitched items that can be obtained? 6. So far, I recall the pomeg glitch messing with pokemon data, fly data, bag data, and battle, but what else can be changed? Btw thanks for answering!
Joined: 1/6/2012
Posts: 51
Location: France
Oh, okay, you want to make mass corruptions to get the Pokedex as fast as possible. 1 ) To obtain the Pokemon in the Pokedex with Pomeg Glitch, you're forced to make a single corruption (PID corruption) to obtain your desired Pokemon into an Egg, and hatch it (256 steps or less before hatching). You can't directly register a Pokemon into Pokedex with Double Corruption. Also, even with 54 corruptible Pokemon in the PC, you would be able to have a PID corruption on 8-10 of them at a grand maximum, as the corruption pattern is the same (with slight changes) every 5 Pokemon. An issue would be dealing with these slight changes to ensure that a maximum of Pokemon have a PID corruption. Also, PID corruption will make the game read the Pokemon species on Move 1, HP+Atk EVs, or Pokerus + Met Location. The 3rd way would be too long, so let's forget it. Species read on Evs is a good deal if we only need to put like 1 Atk EV and 50 HP Ev. But for EVs like 126 HP Ev, it would be sometimes faster to get Move n°126 instead. So, you'd need two types of Pokemon : Ones that have their Growth read on EVs after corruption Ones that have their Growth read on Moves after corruption Smeargle would be optimal for that, since you can Sketch the move you want. Cloning would also greatly help as you would have more control over all your corruptible Pokemon. You could also clone these Smeargle during the EV process to diminish the number of HP Up needed and gain some time (same thing for Smeargles needing 1 Atk EV). You could also make a corruption to get Pokerus to fasten the EVs on Smeargles who would need even EVs. The first thing would be to check all the Pokemon that can be obtained through moves, get them, and obtain the rest with EVs. You would then need other corruptions to duplicate Rare Candies, HP Ups, get Exp Share (or just duplicate it) and Pomeg Berries. You would also need a Pokemon that would help your Smeargles to be rightly corrupted. This Pokemon should be placed just before every Smeargle in the PC. Each corruption would be the same, so you coud do 8-10 Smeargles per corruption. Here's how I see things (briefly) if you want to complete the Pokedex. The data for Pokedex entries is quite long, and in 3 or 4 distinct zones, so I don't know if 2-3 Abritrary Code executions could do the trick (if there's a command to iterate the writing on a value on a whole area). 2) Nope, when catching a wild Pokemon, Pomeg Glitch doesn't intervene. Even if Battle Type is changed, the fought Pokemon. Pomeg Glitch can slightly alter some Pokedex entries, so you could try to have some of them this way, since its really fast, but I don't know if you could have the "seen" + "caught" entries for a large number of Pokemon. EDIT : I misunderstood things, and I made a test. A stolen Pokemon, even if it becomes a Bad Egg, gives a Pokedex entry. Thus you'd need a Glitch Move changing the Battle Type to allow you to throw Pokeballs, a stock of Poke / Hyper Balls, and you would quickly complete Hoenn's Pokedex. You could also fight some gym leaders again to gain some National Pokemon, but i don't know if this kind of Glitch Move, once used in Battle Frontier, unables the Bag again, as I don't have such Glitch Move on my files. But if that was the case, it would be really OP and fasten things a lot, since BF Pokemon are easily predictable (there's not all the Nat.Dex in there, I think, but a large part of it). EDIT 2 : I'm searching for a move that would change the Battle Type to enable Bag + enable throwing Balls, but I found out that Glitch Moves like this have different effects between FR and US Roms. In US Roms, the move 0x0400 (a frequen move appearing after Pomeg Glitch) is enough, while in FR Roms, I'm still searching for a convenient move. (EDIT 3 : 0x042B works for FR versions) The clear issue behind the Bad Egg formation is the TID of trainer Pokemon. Also, when a Pokemon is caught, the Battle ends, and its considered as a loss in Battle Frontier. I'm also testing some Glitch Moves to see if some of them truly give Instant Victory at Battle Frontier, instead of Instant Loss. Else, I'll search for moves that change the Battle type to Safari Zone (and not Dojo nor Palace), which will allow one to easily kill the opponent (I'm not sure, but if the Pokemon flees, it's also our loss). 3 ) But no, no way to prevent the stolen Pokemon from turning into a Bad Egg, so you can't use it for evolutions or Day Care. 4) Here, I don't know at all what Glitched Pokemon do, once transferred. I know that moves with the identifiant of a 4th gen move change into it when transferred, but I don't know what effects we can expect from the other glitch moves. But I saw before something called the "super glitch move" on 4th gen, so I think we can now obtain it easily through 3rd gen. Also, if we use a glitch move who has the identifiant of a 5th gen move, I don't know if it will change into it when transferred on 5th gen (but if should). And I don't know what we can do with glitch moves on 5th / 6th gen. 5) In 3rd gen, every unknown item has the same name and description : ??????? I didn't see any of these items having any effect. Item 0xFFFF has the look of Return Button, but there's nothing else I saw apart from that. But since items are transferred from 3rd gen to 4th gen, we may be able to obtain Azure Flute or some other Rare Items like this (it would have no great use, but it would be pretty cool). But items aren't transferred to 5th gen, so the Rare Item abuse stops to 4th gen. 6) Pomeg Glitch alters partially a ton of things (nearly every kind of data, since PC Pokemon are stored last). You can corrupt a lot of records in your trainer card, unlock Southern Island (the delivery guy appears in Pokemon Center), revive the roamer (or make a Lv 0 one appear if he wasn't already generated), corrupt Secret Base Decorations (useful to obtain the Regi Dolls), corrupt Pokeblocks (allows to have nearly max condition). Values like Feebas position, or Mirage Island ID may be corruptible, but it doesn't give anything, as we still can't know what it is. Trainer ID (or SID) can be altered (that's far higher than anything else). For the Bag, only quantities will be corrupted, and there's a 1/8 chance that Tm/Hm & Berry Pouches won't be corrupted (this chance increases if you fill these pouches). There are a few flags that are affected by corruption, but nothing relevant (except Ever Grande Fly Location). Pokedex and PokeNav can be slightly affected as well. 2 Silver symbols can be corrupted, and 1 Badge, but that's all. I don't think we can obtain any other event, like sales, swarms, other special Islands, Berry Master, with direct Pomeg Glitch Corruption. I also looked at things on FrLg, and that's pratically the same : Bag and PC corruption are the same you can alter some records no real interesting event corruptible (no special island) no trainer star can be get (with the records needed on island 2) Roamers can be brought back to life, or simply launched at Lv0. In a save before Nat Dex obtention, there may be an event like Roamers, Cerulean Cave, that could be corrupted, but I doubt it a little. Since there's a flag for special islands, having the Ticket isn't enough, so for now, there's only Southern Island that's available, as it's the sole event already fully coded into the cartridge (for the others, the delivery man script is added with Mystery Card).
GamingAori
Other
Joined: 1/26/2014
Posts: 35
does gives a new progress of the emerald TAS?
I'm new and I'm german. My english isn't the best sry ^^
Joined: 1/6/2012
Posts: 51
Location: France
I didn't have any answer on it, but it should run fine, since only one corruption from Pomeg Glitch will be involved. Swampert can be the dummy that will have an Instant Flee Glitch Move (from Surf in Pos.2 and Ice Beam in Pos.4), but I don't know if the Swampert GoddessMaria used will be able to have it's data corrupted as the same time as Ever Grande Flying Location (EGFL), since there are only 5 different corruptions happening to PC Pokemon at a time, and the one needed here is a Bits 0&2 set, which always happen at the same adresses, contrary to Bit 6 set / unset that can happen at 4 different adresses on an area (and with only set or unset), all of this depending on the value of a fix adress. Castform can also do the trick, so it can be manipulated instead of Swampert for being a good dummy (because redoing the run juste for Swampert would be a bit long). I'll look and see which data is corrupted with EGFL to clear things a little bit.
Skilled player (1743)
Joined: 9/17/2009
Posts: 4986
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Metarkrai wrote:
Since there's a flag for special islands, having the Ticket isn't enough, so for now, there's only Southern Island that's available, as it's the sole event already fully coded into the cartridge (for the others, the delivery man script is added with Mystery Card).
I've been playing around with emerald, and it appears changing 020322E4 before entering rooms cause you to appear somewhere else. I once accidentally went to Far Away Island while messing with it, and mew was there even though I don't have the ticket. Maybe there's a way to somehow warp yourself there directly?
Joined: 1/6/2012
Posts: 51
Location: France
0x020322E4 stores the Map identifiant in Emerald (this adress is used to make warp cheat codes). However, to warp, you need to change the value while entering a door (when you start entering, the identifiant of the new map is stored at this adress, and there's a bit of time before the game reads this identifiant to load graphical data), so you can't perform a direct teleportation like that with Pomeg Glitch. TheZzAzzGlitch was able to warp to Hall of Fame by obtaining a certain Glitch Pokemon with Pomeg Glitch, and viewing the Summary of this Pokemon can make the game execute code by reading Nicknames of Box 3 Pokemon (I don't know if it's possible to make it read code on Bag items for example). Thus, he made a code to rewrite the saved data to change the identifiant of the Map he was on, but he needed for this to know the checksum for the save file. Also, with a direct corruption via Pomeg Glitch, you can only corrupt by going Up, and not down. You start at Place 24 Box 2 (Place 1 Box 1 is around 0x0202980C, so it should be in 0x0202BXXX or something like that), and it stops around 0x02023XXX if my memories are right (you hear the sound of the pointer going up, but no other data is shown corrupted in Memory Viewer. The pointer maybe jumped to another area, but I didn't see any effect). Thus, you can't directly corrupt Map Identifiant with Pomeg Glitch. Furthermore, you can only corrupt the leftmost byte of every double-word, and Map Identifiant is stored in the right part of a double word. The only way to unlock the other Event Islands would be by making a code setting up flags for these events, and obtaining the Tickets with Item Corruption (an application of Pomeg Glitch). But I have no information at all about the effects of all the different Glitch Pokemon and Glitch Move, because we would need one that doesn't make the game reset, but that makes it read some adress (PC items adress would be perfect) as code. (Without reset because you'd need to corrupt saved data, and this couldn't be done on console). There are some glitch move that seem to make the console execute code without making the game crash (only some of them, and in general you have to finish the battle in 1 turn, as the game freezes at the start of 2nd turn), but I have no clue about what the console do at this time.
1 2 3 4 5
12 13