Glitch item

From Glitch City Wiki
Jump to navigation Jump to search
Arbitrary code execution in the Pokémon series

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | Type 0xFF mail arbitrary code execution (Japanese Crystal) | ZZAZZ glitch Trainer FC


List of arbitrary code execution programs

(view, talk, edit)

Glitch items are invalid items in the Pokémon games. Unavailable items such as Pokémon FireRed and LeafGreen key items in Pokémon Emerald may also be considered to be glitch items, as well as unused/unavailable items such as ????? (hex:07) and BoulderBadge (hex:15) — see unused items.

Glitch items may have special uses (in Generations I and II), different names (in Generation I and to an extent Generation II) and Poké Mart buy and sell price data.

Some glitch items such as "9F" (hex:5E) in Pokémon Red and Blue or Pokémon Yellow, or "RIVAL'S" (hex: A2) in Red and Blue, or "o" (hex:94) in Yellow always have the same use(s).

Other glitch items execute data in writable memory, with a select few glitch items such as such as "8F" in Pokémon Red and Blue (hex:5D) and "ws m" in Pokémon Yellow (hex:63) being ideal for arbitrary code execution.

In Pokémon Red, Green, Blue, and Yellow

Glitch items occupy index numbers hex:00, hex:54 through to hex:C3 and hex:FB through to hex:FF.

Types of glitch items:

  • Unterminated name glitch items: These are items without a 0x50 byte in the first 20 characters of their name. They can be used for various buffer overflow techniques with specific tiles on the screen. When the A-Button is pressed on them without a 0x50 sub-tile present on the screen, it is most likely the game will freeze.
  • Lag name glitch items: These cause the items list to temporary freeze until the player taps A or B a specific number of times while scrolling up/down. It is advised to tap B instead of A due to the risk of a game freeze from an unterminated name glitch item, which could freeze the game, and potentially destroy the save data, especially on Nintendo 3DS Virtual Console versions.
  • Rival's effect glitch items: These glitch items are capable of causing the Rival's effect; an effect that opens a menu and allows the player to walk through impassable tiles once it is closed with B.
  • String printing glitch items: These may include a variable string in the item's name
  • Map distortion glitch items: Documented by TheZZAZZGlitch, these glitch items have the capability of corrupting the map when their name is shown, in an area with a lot of grass. A player name that is four characters long or more is also required.
  • Arbitrary code execution glitch items: These glitch items do not have hard coded effects; instead the effects are sourced from a pointer in rewritable memory, such as RAM. Depending on the source pointer, it is possible to manipulate the item to do almost anything in game. 8F (0x5D) and ws m (0x63) are infamous examples in the English versions.

How to obtain glitch items:

All glitch items:

Some glitch items:

Many glitch items are available with the Celadon looping map trick, Item creation glitch (a Select glitch in Red/Green/Blue), Yami Shop glitch and other Poké Mart vendor glitches.

Examples of particularly useful glitch items include:

Name Index number (hexadecimal) Index number (decimal) Game Uses
j. 00 0 Pokémon Red and Blue One of the most common glitch items, which can be sold for a high price of 414925 Pokédollars.
#×## 00 0 Pokémon Yellow One of the most common glitch items, which can be sold for a high price of 414925 Pokédollars.
CascadeBadge 16 22 Pokémon Red, Blue, Yellow Throw a rock and double a wild Pokémon's catch rate.
4F 59 89 Pokémon Red, Blue, Yellow Arbitrary code execution (initially runs FA65 in the Echo RAM region, equivalent to DA65 in Day Care data)
5かい 5A 90 Pokémon Red, Green, Blue (Japanese) Arbitrary code execution (initially runs D123; Pokémon data)
8F 5D 93 Pokémon Red and Blue Arbitrary code execution (initially runs D163; Pokémon data)
9F 5E 94 Pokémon Yellow Reload a map and bring graphics back to normal after a Super Glitch induced Glitch City.
9F 5E 94 Pokémon Red and Blue Restart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch). Overflowing the stack.
かいがらバッヂ (Shell Badge) 63 99 Pokémon Yellow (Japanese) Arbitrary code execution (initially runs D9B2; stored Pokémon data).
ws m 63 99 Pokémon Yellow Arbitrary code execution (initially runs DA7F; stored Pokémon data).
はやぶさバッヂ (FalconBadge) 65 101 Pokémon Yellow (Japanese, v1.1+) Causes arbitrary code execution at 0xD4CA (ninth PC item).
なかよしバッヂ (FriendBadge) 67 103 Pokémon Red, Green, and Pokémon Blue (Japanese) Arbitrary code execution (initially runs D983, number of Safari Balls and the Day Care data, stored Pokémon data which follows. A special Day Care Pokémon name can be used to redirect the code directly to a location of the player's choice, otherwise if there is no Safari Ball/Day Care data, stored Pokémon data can be used like English Yellow's ws m and English Red/Blue's -g m.
ゴールドバッヂ (GoldBadge) 6A 106 Pokémon Red and Green (Japanese, v1.0) May act as a Poké Mart with 240 items. Can be used to buy Rare Candies (with specific data in RAM) and Master Balls.
ゴールドバッヂ (GoldBadge) 6A 106 Pokémon Yellow (Japanese, v1.1+) Acts as a Pokémon Center nurse.
-g m 6A 106 Pokémon Yellow Restart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch)
-g m 6A 106 Pokémon Red and Blue Arbitrary code execution (initially runs DA47; in which Safari Zone data and Day Care data follows. If this is blank; code will 'fall through' to DA80; stored Pokémon data).
Lg- 6E 110 Pokémon Yellow Restart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch). Make walking Pikachu stay (useful for Pikachu off-screen glitch).
????? 07 07 Pokémon Red, Blue, Yellow Acts outside of battle like using the field move Surf. Can also be used to change to the wrong music bank inside of a battle if used in a battle facing water.
(blank) 78 120 Pokémon Red and Blue Restart the music. Change to an overworld (02, 1F) sound bank from the sound bank (08). Play the music with ID at D35B with bank at D35C (D35B, D35C can be manipulated with expanded items pack).
てへ 7B 123 Pokémon Red and Green Arbitrary code execution (initially runs D806; wild Pokémon data or temporary player name storage for the old man battle) and an unterminated name glitch item.
がつ円れにギぅ ぶ ぐどべぇ べあ゙ザ (etc.) 7B 123 Pokémon Blue (Japanese) Unterminated name glitch item. Arbitrary code execution (initially runs D806; wild Pokémon data or temporary player name storage for the old man battle).
♀へん 7C 124 Pokémon Yellow (Japanese, v1.0) Steal other Trainer's Pokémon.
8 8 7C 124 Pokémon Red and Blue Create encounter chains from a Trainer escape glitch encounter by using it when the menu pops up in a specific map. Must be used indirectly via unterminated name glitch item, or in combination with a unterminated name glitch item, to avoid a freeze when CFC4 is odd.
PC 80 128 Pokémon Red and Blue Unterminated name lagless glitch item (useful for LOL glitch). Hex:00 item effect freeze.
2pゥ 92 146 Pokémon Yellow Unterminated name lagless glitch item (useful for LOL glitch). Acts as an Ultra Ball.
o 94 148 Pokémon Yellow Activate the Rival's effect. Otherwise if used on a Pokémon may act like a Lemonade.
RIVAL'S A2 164 Pokémon Red and Blue Activate the Rival's effect. Otherwise if used on a Pokémon may acts like an item with no noticeable effect.

In Pokémon Gold, Silver and Crystal

Glitch items in Pokémon Gold, Silver and Crystal occupy a number of index numbers, as such:

Hex ID Dec ID Item
00 0 ?
06, 19, 2D, 32, 38, 46 (G/S only), 5A, 64, 73 (G/S only), 74 (G/S only), 78, 81 (G/S only), 87, 88, 89, 8D, 8E, 91, 93, 94, 95, 99, 9A, 9B, A2, AB, B0, B3, BE 5, 19, 45, 32, 38, 46 (G/S only), 90, 100, 115 (G/S only), 116 (G/S only), 120 (G/S only), 129 (G/S only), 135, 136, 137, 141, 142, 145, 147, 148, 149, 153, 154, 155, 162, 171, 176, 179, 190 Teru-Sama
C3 195 TM04 (useless)
DC 220 TM28 (useless)
FA 250 HM08 (Generation II glitch item)
FB 251 HM09 (Generation II glitch item)
FC 252 HM10 (Generation II glitch item)
FD 253 HM11 (Generation II glitch item)
FE 254 HM12 (Generation II glitch item)
FF 255 HM13/CANCEL/Berry

Note that Teru-Sama items which are not Teru-Sama in Crystal are the key items "Clear Bell" (hex:46), "GS Ball" (hex:73), "Blue Card" (hex:74) and "Egg Ticket" (hex:81) respectively.

TMs and HMs outside of the correct pocket

Main article: Wrong pocket TMs and HMs

In addition to the regular glitch items in Gold, Silver, Crystal, all of the normal TMs and HMs will serve as glitch items when used outside of the TM/HM pack, due to having invalid execution pointers.

Below are a number of useful TMs and HMs to use outside of the relevant pocket.

(Sources: [1], [2], [3])

Hex ID Dec ID Item Version Use
CE 206 TM15 Crystal (Japanese) Executes arbitrary code from FA10 (Echo RAM for DA10, which is somewhere in the expanded Balls pocket. If "(item) x195", "Star Piece x 252" (represents C3 84 FB - a jump to FB84, box 4 name character 2) are stored at DA0F, then this will serve as a bootstrap code to stored box Pokémon names.
CE 206 TM15 Crystal (English) Executes arbitrary code from FA10 (Echo RAM for DA10, which is somewhere in the expanded Balls pocket.
D0 208 TM17 Crystal (English) Executes arbitrary code from FA47 (Echo RAM for DA47, which is somewhere in the expanded Balls pocket.
D0 208 TM17 Gold/Silver (English) Executes arbitrary code from FA47 (Echo RAM for DA47, which is the caught data for party Pokémon 1. The player can make a jump to somewhere more useful (via C3 yy xx), using Pokémon 1 as a slide Pokémon if necessary.
D4 212 TM21 Crystal (English) Executes arbitrary code from FA69 (Echo RAM for DA69, which is somewhere in the expanded Balls pocket; like TM21.
D8 216 TM25 Crystal (English) Executes arbitrary code from FA69 (Echo RAM for DA69, which is somewhere in the expanded Balls pocket; like TM25.
D8 216 TM25 Gold/Silver (English) Executes arbitrary code from FA6A (Echo RAM for DA6A, and DA6A is the least significant Defense EV byte of the second Pokémon in the party. The Speed EVs word follows, and the player can make a jump to somewhere more useful (via C3 yy xx). This may be possible without trading, but getting the exact EVs would be tedious and it would be hard to keep track of them without a memory viewer. Through arbitrary code execution in Pokémon Red, Blue, and Yellow, the second Pokémon may be manipulated to have Defense and Speed EV values that the player desires.
E1 225 TM33 Crystal (English) Executes arbitrary code from F418 in Echo RAM (essentially D418); the third character of the fifth enemy Pokémon's nickname. Through arbitrary code execution in Pokémon Red, Blue, and Yellow, the player may rename this Pokémon to include a jump instruction (e.g. to C3 F2 D8 bytes which reads jp D8F2, i.e. jumps to the first item in the item storage system).
EF 239 TM47 Gold/Silver (English) Allows the player to offset their position on the map, as documented here.

In Pokémon Ruby, Sapphire and Emerald, Pokémon FireRed and LeafGreen

There are many glitch items in these games named "????????" with no apparent use other than for arbitrary code execution setup. The hex:FFFF "????????" can be distinguished for having the 'return to menu' sprite as its sprite.

In Pokémon Diamond, Pearl and Platinum, Pokémon HeartGold and SoulSilver

These games feature a hex:0000 glitch item which is referred to as "None" when forced as a Poké Mart gift. There are also glitch items with index numbers between hex:0071 and hex:0086, and a large number of other glitch items which may be nameless.

External links

See also