AreaDex/Y:254

From Glitch City Wiki
(Redirected from Map FE (English Yellow))
Jump to navigation Jump to search
Major glitches of the Pokémon series


Arbitrary code execution

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC


No further extensions

Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)


Buffer overflow techniques

99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)


Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch


Bad clone glitch (Generation II)

????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))


Closed menu Select glitches (Japanese Red/Green)

Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch


Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch


Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)


2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch


Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)


Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick


Pikachu off-screen glitch

Trainer corruption glitch


SRAM glitches

Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches


Trainer escape glitch

Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation


Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls


Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))

(view, talk, edit)
Town Map name: Blank name

Identifier (HEX) FE
Identifier (DEC) 254
Default track Sound 0x9E in glitch sound bank 0x49
(large number of warp entries overwrites music with Cycling Theme)

Tileset 00
Size 8x17 blocks
Map type Redirection glitch map,
Semi-freeze glitch map

More research is needed for this article.

Reason given: An explanation of why things get corrupted and how would be great. Research more things that get messed up by the glitch.



Map 0xFE from English Pokémon Yellow is a redirection glitch map and without proper set up, a freeze glitch map with an index number of 254 (FE).

One of map 254's appearances

When it is entered, it appears like a Glitch City. The appearance of this map may vary, for unknown reasons. The map's entrance point (which can be altered with the codes 01xxB4D3 01xxB0D3) apparently doesn't affect the appearance.

Entering map FE may result in a freeze due to its invalid level-script pointer (D36D-D36E), which is at DC0E in WRAM (12th stored Pokémon's experience byte 1).

It works almost the same in non-English European versions of Pokémon Yellow, although the level-script pointer is still DC0E, which would correspond with Pokémon 12's move 2 in those versions rather than Pokémon 12's experience byte 1.

Furthermore, Map FE in Japanese Yellow (another redirection glitch map) works significantly differently to the English and non-English European versions and has the same level-script pointer as other versions (DC0E).

Avoiding a freeze

Since DC0E is in WRAM, the player can easily hack in a C9 (ret) at DC0E using memory viewer to prevent map FE's freeze.

Furthermore, DC0E represents the 12th stored Pokémon in the current box's experience byte 1. While a current experience between 13172736-13238271 (C9 XX XX) is not viable, code like 00 00 C9 (an experience of 201) is. This means the player can simply place a Pokémon with 201 experience in the box as the 12th Pokémon to make map FE non-freezing. In this example, the 00s make the code fall through to the ret.

Effects of entering map FE

Entering map FE and avoiding the freeze has various side effects.

Easily noticeable effects

When the player enters map FE and avoids the freeze, the cycling music will play for a moment.

The player will be warped to map hex:99, which is a house in Fuchsia City with an NPC discussing the warden and two NPCs discussing Bill. Changing the value of D364 from FE (by tossing the quantity of item 36) to something else may be required to escape, otherwise the exit mats will take the player back to map FE.

The perpetual spinning effect will occur, with the effect of tiles having bits of arrow tiles on them.

The player's Pokédex will disappear, and the play time may become 255:59.

PC corruptions

  • The Prof. Oak's PC and the Hall of Fame options for a PC may disappear.
  • The player's stored PC items will become corrupted, and there may be more than 50 (the normal maximum amount of items) items stored.
  • The current Pokémon Storage System box in use may change, and the Pokémon data within boxes may change, even for boxes that aren't currently in use.

Fly-able locations corruption

The player's available fly destinations bytes (D70A, D70B) get corrupted to 42 42; which may allow the player to view the names of, or fly to glitch destinations. Making the exit mat warp to Viridian City does not change the value of D70A and D70B, and when unchanged, glitch fly destinations are possible; however, going to a place like Cerulean City (which changes the fly bytes to 4A 42) lets the player keep glitch fly destinations too.

Map problems

For unknown reasons, the scripts IDs (not the level-script pointers) of certain maps become corrupted and will freeze the game, meaning it is seemingly impossible to visit places such as the Hall of Fame. Saving and resetting does not fix this problem.

At least through cheating, it is possible to load the Hall of Fame script without the 'walking up to Oak' process by manipulating a level-script pointer of 16:6456 into D36D/E (as 5664). This can be done in Route 6, which has the 16 bank and may not freeze the game initially. Watching the credits and resetting the game will not fix the freezing problem, however, and the player would be forced to view the credits every time they load the save due to the level-script pointer not changing.

Corruption of Pallet Town events

Regardless of the whether the events near the beginning of the game were completed or not:

Professor Oak will appear outside of Pallet Town one tile west and one tile north of the sign from the player character's house. This is like a side effect of the dokokashira door glitch, except for the fact that the position he appears in that glitch may be different. Talking to Professor Oak here makes him say "Hey! Wait! Don't go out!" and an exclamation mark to appear above the player character's head, as if the player stepped in to the grass at the beginning of the game with no Pokémon, however, apparently nothing else happens.

If the player goes into Daisy's (Blue's sister's house), there will be two of her. One will be at a chair facing the Town Map, and the other will be wandering around the house. Both of her can be talked to normally, but the Town Map cannot be obtained.


If the player enters Oak's lab, there will be another copy of Oak standing near the entrance. Talking to him brings up a "?" mark on the screen for unknown reasons. The position of the ? mark depends on which position that Oak was spoken to, with higher positions having the ? mark higher up.

The rival will be in the lab and will say "Heh, my POKéMON looks a lot stronger." and one of the Pokédexes will be gone.

Talking to the northern-most Oak can have one or more effects:

  • If there is more than one Pokémon registered as 'own' in the Pokédex: The game makes it seems like he will rate the Pokédex as he says he will take a look at it, but the player has to talk to him again to have him rate it.
  • If there are less than two Pokémon registered as 'own' in the Pokédex: Professor Oak will tell the player they should talk to Pikachu to see how it feels, even if they didn't obtain the ball.

There will be a ball with a Pikachu in it, and the player can obtain it, even if the player got Pikachu before. Trying to leave the lab causes the rival to go and battle you, but the 'battle' ends before it begins. When the rival is about to leave, the game will lock-up with the rival music playing.

Other effects

  • Inability to battle/the game locking up before a Trainer battle until a save and reset is done.
  • Corruption of a fossil in Cinnabar's Pokémon Lab.
  • Corruption of the number of coins in the Coin Case.
  • Two guards appearing outside the burgled Cerulean City house, with one of them blocking the door, and the other one tile right of the previously mentioned guard.
  • The Rocket who stole the TM28 - Dig reappearing, and giving out the TM without a battle.
  • Disappearance of a Pokémon in Day Care.
  • Reappearance of the Rocket guarding the poster in Celadon Game Corner. They will battle (again).

How to enter it without a freeze

With a cheating device like GameShark, the player can go into a building, enter the codes 01FE64D3, 01C90EDC, then disable them. Afterwards, walking down where the exit mat is will take the player to map FE and trigger the non-freezing effect.

No cheats method

  1. Put a Pokémon with 201 or 51456-51711 experience in the 12th position of the current Pokémon storage box; as to make the map 'non-freezing'.
  2. Prepare Master Ball x254 (e.g. by encountering one fossil/ghost Missingno. to get 129, then by tossing 2 to get 127, then encountering it again).
  3. Expand the number of items, preferably with item underflow glitch.
  4. Go to one of the exit mat tiles in a place like a Pokémon Center, and swap the Master Ball x254 with item 36. Make sure it is the item '(glitchblock)x(glitchblock)(glitchblock)'. If it isn't, then go to the other tile. This is important because trying to swap the Master x254 with another Master Ball seemingly doesn't work.
  5. Go through the exit mat, and if everything worked, the player will be taken to map FE and the game won't freeze


Data

Map 0xFE has a map script or "level-script pointer" of DC0E by default, so adding a C9 there (or having the right data) will allow the player to enter the map. The game grabs 20:4F50 (00) to define D3AC as 00. Additionally, 20:4F51 (wMapBackgroundTile) defines D3AD (wNumberOfWarps) as 0xEC, resulting in a large buffer overflow and coincidental warp upon arriving at the map that allows the player to escape to map 0x99 (a house in Fuchsia City). Without the large number of warps, the would attempt to use glitch sound bank 0x49, freezing the game.

The map uses valid tileset 00, has various interesting wild Pokémon including wild glitch Pokémon and Trainers (see below), and NPCs can be seen walking down the screen on arrival if the warps were disabled.

Usually however, a warp to map 0x99 takes the player away and the Bicycle music instead plays for some reason.

The map has a height of 8x17 blocks (D367/8: 0x08 0x11). The "map's data" (D369-D36A) reads 1F 88. The text-script pointer table is at 0089. It has some specific map connection data. (dump from D36F: CC 6E E6 DD DD B9 99 BB BB 67 63 6E 0E EC CC DD DC 99 9F BB B9 33 3E FF 4E 40 9E C7 09 14 F8 27 16 C7 FF 5D 42 B5 C7 09 23 F8 00 12 C7). Tileset bank: 0x19, pointer to blocks: 00 46 (4600), pointer to graphics: 00 40 (4000), pointer to collision data: C2 4A (4AC2), "talking over" tiles: FF FF FF, grass tile: 0x52.

Map 0xFE also causes a huge buffer overflow for D3AD (wNumberofWarps) and D3AE (wWarpEntries), where data from 20:4F51-20:5301 (seems to be in the Pikachu's Beach minigame code) is copied to D3AD-D75D (a corruption of 945 bytes). Not all of this data will change after leaving or other interactions in map 0xFE. In particular, map 0xFE corrupts many meta-map scripts, causing many locations to freeze the game with no easy solution to stop them from freezing the game when entering them without arbitrary code execution.

Below is a table of the corruptions:

Offset Pointer (bank 0x20) Address corrupted Byte
80F51 4F51 D3AD EC
80F52 4F52 D3AE 0
80F53 4F53 D3AF FE
80F54 4F54 D3B0 0
80F55 4F55 D3B1 FC
80F56 4F56 D3B2 0
80F57 4F57 D3B3 E1
80F58 4F58 D3B4 0
80F59 4F59 D3B5 C5
80F5A 4F5A D3B6 0
80F5B 4F5B D3B7 8B
80F5C 4F5C D3B8 0
80F5D 4F5D D3B9 85
80F5E 4F5E D3BA 0
80F5F 4F5F D3BB AF
80F60 4F60 D3BC 0
80F61 4F61 D3BD 37
80F62 4F62 D3BE 0
80F63 4F63 D3BF 7F
80F64 4F64 D3C0 0
80F65 4F65 D3C1 3F
80F66 4F66 D3C2 0
80F67 4F67 D3C3 87
80F68 4F68 D3C4 0
80F69 4F69 D3C5 A3
80F6A 4F6A D3C6 0
80F6B 4F6B D3C7 D1
80F6C 4F6C D3C8 0
80F6D 4F6D D3C9 A1
80F6E 4F6E D3CA 0
80F6F 4F6F D3CB F5
80F70 4F70 D3CC 0
80F71 4F71 D3CD EC
80F72 4F72 D3CE 0
80F73 4F73 D3CF FE
80F74 4F74 D3D0 0
80F75 4F75 D3D1 FC
80F76 4F76 D3D2 0
80F77 4F77 D3D3 E1
80F78 4F78 D3D4 0
80F79 4F79 D3D5 C5
80F7A 4F7A D3D6 0
80F7B 4F7B D3D7 8B
80F7C 4F7C D3D8 0
80F7D 4F7D D3D9 85
80F7E 4F7E D3DA 0
80F7F 4F7F D3DB AF
80F80 4F80 D3DC 0
80F81 4F81 D3DD 37
80F82 4F82 D3DE 0
80F83 4F83 D3DF 7F
80F84 4F84 D3E0 0
80F85 4F85 D3E1 3F
80F86 4F86 D3E2 0
80F87 4F87 D3E3 87
80F88 4F88 D3E4 0
80F89 4F89 D3E5 A3
80F8A 4F8A D3E6 0
80F8B 4F8B D3E7 D1
80F8C 4F8C D3E8 0
80F8D 4F8D D3E9 A1
80F8E 4F8E D3EA 0
80F8F 4F8F D3EB F5
80F90 4F90 D3EC 0
80F91 4F91 D3ED EC
80F92 4F92 D3EE 0
80F93 4F93 D3EF FE
80F94 4F94 D3F0 0
80F95 4F95 D3F1 FF
80F96 4F96 D3F2 0
80F97 4F97 D3F3 FF
80F98 4F98 D3F4 0
80F99 4F99 D3F5 FF
80F9A 4F9A D3F6 0
80F9B 4F9B D3F7 FF
80F9C 4F9C D3F8 0
80F9D 4F9D D3F9 FF
80F9E 4F9E D3FA 0
80F9F 4F9F D3FB FF
80FA0 4FA0 D3FC 0
80FA1 4FA1 D3FD FF
80FA2 4FA2 D3FE 0
80FA3 4FA3 D3FF FF
80FA4 4FA4 D400 0
80FA5 4FA5 D401 FE
80FA6 4FA6 D402 0
80FA7 4FA7 D403 F9
80FA8 4FA8 D404 0
80FA9 4FA9 D405 F7
80FAA 4FAA D406 0
80FAB 4FAB D407 F7
80FAC 4FAC D408 0
80FAD 4FAD D409 CD
80FAE 4FAE D40A 0
80FAF 4FAF D40B BB
80FB0 4FB0 D40C 0
80FB1 4FB1 D40D BF
80FB2 4FB2 D40E 0
80FB3 4FB3 D40F 7F
80FB4 4FB4 D410 0
80FB5 4FB5 D411 7F
80FB6 4FB6 D412 0
80FB7 4FB7 D413 9F
80FB8 4FB8 D414 0
80FB9 4FB9 D415 EF
80FBA 4FBA D416 0
80FBB 4FBB D417 EF
80FBC 4FBC D418 0
80FBD 4FBD D419 F3
80FBE 4FBE D41A 0
80FBF 4FBF D41B DD
80FC0 4FC0 D41C 0
80FC1 4FC1 D41D ED
80FC2 4FC2 D41E 0
80FC3 4FC3 D41F FE
80FC4 4FC4 D420 0
80FC5 4FC5 D421 7E
80FC6 4FC6 D422 0
80FC7 4FC7 D423 FB
80FC8 4FC8 D424 0
80FC9 4FC9 D425 DF
80FCA 4FCA D426 0
80FCB 4FCB D427 FF
80FCC 4FCC D428 0
80FCD 4FCD D429 EF
80FCE 4FCE D42A 0
80FCF 4FCF D42B BF
80FD0 4FD0 D42C 0
80FD1 4FD1 D42D FF
80FD2 4FD2 D42E 0
80FD3 4FD3 D42F D3
80FD4 4FD4 D430 FE
80FD5 4FD5 D431 AB
80FD6 4FD6 D432 FF
80FD7 4FD7 D433 0
80FD8 4FD8 D434 BF
80FD9 4FD9 D435 40
80FDA 4FDA D436 FF
80FDB 4FDB D437 0
80FDC 4FDC D438 FB
80FDD 4FDD D439 4
80FDE 4FDE D43A FF
80FDF 4FDF D43B 20
80FE0 4FE0 D43C FF
80FE1 4FE1 D43D 0
80FE2 4FE2 D43E FF
80FE3 4FE3 D43F 0
80FE4 4FE4 D440 BF
80FE5 4FE5 D441 40
80FE6 4FE6 D442 FF
80FE7 4FE7 D443 0
80FE8 4FE8 D444 FF
80FE9 4FE9 D445 4
80FEA 4FEA D446 FF
80FEB 4FEB D447 20
80FEC 4FEC D448 FF
80FED 4FED D449 0
80FEE 4FEE D44A F7
80FEF 4FEF D44B 8
80FF0 4FF0 D44C FF
80FF1 4FF1 D44D 0
80FF2 4FF2 D44E FF
80FF3 4FF3 D44F 1
80FF4 4FF4 D450 E0
80FF5 4FF5 D451 FE
80FF6 4FF6 D452 EE
80FF7 4FF7 D453 1F
80FF8 4FF8 D454 FF
80FF9 4FF9 D455 1
80FFA 4FFA D456 FF
80FFB 4FFB D457 80
80FFC 4FFC D458 FF
80FFD 4FFD D459 4
80FFE 4FFE D45A FF
80FFF 4FFF D45B 20
81000 5000 D45C FF
81001 5001 D45D 0
81002 5002 D45E FF
81003 5003 D45F 1
81004 5004 D460 0
81005 5005 D461 7E
81006 5006 D462 0
81007 5007 D463 FF
81008 5008 D464 C0
81009 5009 D465 FB
8100A 500A D466 F8
8100B 500B D467 1F
8100C 500C D468 FC
8100D 500D D469 7
8100E 500E D46A F8
8100F 500F D46B 0F
81010 5010 D46C E0
81011 5011 D46D 3F
81012 5012 D46E 40
81013 5013 D46F F9
81014 5014 D470 FC
81015 5015 D471 7
81016 5016 D472 F0
81017 5017 D473 1F
81018 5018 D474 C0
81019 5019 D475 7F
8101A 501A D476 80
8101B 501B D477 FF
8101C 501C D478 C0
8101D 501D D479 7B
8101E 501E D47A E0
8101F 501F D47B 3F
81020 5020 D47C C0
81021 5021 D47D FF
81022 5022 D47E 0
81023 5023 D47F F3
81024 5024 D480 0
81025 5025 D481 F8
81026 5026 D482 0
81027 5027 D483 F4
81028 5028 D484 0
81029 5029 D485 D0
8102A 502A D486 0
8102B 502B D487 A8
8102C 502C D488 0
8102D 502D D489 D0
8102E 502E D48A 0
8102F 502F D48B B8
81030 5030 D48C 0
81031 5031 D48D 30
81032 5032 D48E 0
81033 5033 D48F 78
81034 5034 D490 0
81035 5035 D491 0
81036 5036 D492 0
81037 5037 D493 20
81038 5038 D494 0
81039 5039 D495 58
8103A 503A D496 0
8103B 503B D497 B8
8103C 503C D498 0
8103D 503D D499 50
8103E 503E D49A 0
8103F 503F D49B B8
81040 5040 D49C 0
81041 5041 D49D 10
81042 5042 D49E 0
81043 5043 D49F 28
81044 5044 D4A0 0
81045 5045 D4A1 6
81046 5046 D4A2 0
81047 5047 D4A3 1B
81048 5048 D4A4 0
81049 5049 D4A5 5F
8104A 504A D4A6 0
8104B 504B D4A7 BF
8104C 504C D4A8 0
8104D 504D D4A9 4F
8104E 504E D4AA 0
8104F 504F D4AB BF
81050 5050 D4AC 0
81051 5051 D4AD 1F
81052 5052 D4AE 0
81053 5053 D4AF 33
81054 5054 D4B0 0
81055 5055 D4B1 F5
81056 5056 D4B2 0
81057 5057 D4B3 FC
81058 5058 D4B4 0
81059 5059 D4B5 F8
8105A 505A D4B6 0
8105B 505B D4B7 F8
8105C 505C D4B8 0
8105D 505D D4B9 D0
8105E 505E D4BA 0
8105F 505F D4BB B8
81060 5060 D4BC 0
81061 5061 D4BD F0
81062 5062 D4BE 0
81063 5063 D4BF 78
81064 5064 D4C0 0
81065 5065 D4C1 0
81066 5066 D4C2 0
81067 5067 D4C3 0
81068 5068 D4C4 1C
81069 5069 D4C5 1C
8106A 506A D4C6 0E
8106B 506B D4C7 0E
8106C 506C D4C8 2
8106D 506D D4C9 2
8106E 506E D4CA 1F
8106F 506F D4CB 1F
81070 5070 D4CC 3B
81071 5071 D4CD 3B
81072 5072 D4CE 7
81073 5073 D4CF 7
81074 5074 D4D0 0
81075 5075 D4D1 0
81076 5076 D4D2 0
81077 5077 D4D3 0
81078 5078 D4D4 0
81079 5079 D4D5 0
8107A 507A D4D6 70
8107B 507B D4D7 70
8107C 507C D4D8 F8
8107D 507D D4D9 F8
8107E 507E D4DA 80
8107F 507F D4DB 80
81080 5080 D4DC E0
81081 5081 D4DD E0
81082 5082 D4DE 70
81083 5083 D4DF 70
81084 5084 D4E0 6
81085 5085 D4E1 6
81086 5086 D4E2 0E
81087 5087 D4E3 0E
81088 5088 D4E4 0E
81089 5089 D4E5 0E
8108A 508A D4E6 FF
8108B 508B D4E7 FF
8108C 508C D4E8 FF
8108D 508D D4E9 FF
8108E 508E D4EA FF
8108F 508F D4EB FF
81090 5090 D4EC FF
81091 5091 D4ED FF
81092 5092 D4EE FF
81093 5093 D4EF FF
81094 5094 D4F0 30
81095 5095 D4F1 30
81096 5096 D4F2 10
81097 5097 D4F3 10
81098 5098 D4F4 0
81099 5099 D4F5 0
8109A 509A D4F6 C0
8109B 509B D4F7 C0
8109C 509C D4F8 F8
8109D 509D D4F9 F8
8109E 509E D4FA FE
8109F 509F D4FB FE
810A0 50A0 D4FC FF
810A1 50A1 D4FD FF
810A2 50A2 D4FE FF
810A3 50A3 D4FF FF
810A4 50A4 D500 0
810A5 50A5 D501 0
810A6 50A6 D502 0
810A7 50A7 D503 0
810A8 50A8 D504 0
810A9 50A9 D505 0
810AA 50AA D506 0
810AB 50AB D507 0
810AC 50AC D508 0
810AD 50AD D509 18
810AE 50AE D50A 0
810AF 50AF D50B 7E
810B0 50B0 D50C 0
810B1 50B1 D50D FF
810B2 50B2 D50E 0
810B3 50B3 D50F FF
810B4 50B4 D510 C6
810B5 50B5 D511 C6
810B6 50B6 D512 FE
810B7 50B7 D513 BA
810B8 50B8 D514 FE
810B9 50B9 D515 82
810BA 50BA D516 FE
810BB 50BB D517 AA
810BC 50BC D518 FE
810BD 50BD D519 82
810BE 50BE D51A FE
810BF 50BF D51B 82
810C0 50C0 D51C 0
810C1 50C1 D51D FE
810C2 50C2 D51E 0
810C3 50C3 D51F 0
810C4 50C4 D520 0
810C5 50C5 D521 0
810C6 50C6 D522 0
810C7 50C7 D523 0
810C8 50C8 D524 0
810C9 50C9 D525 0
810CA 50CA D526 1A
810CB 50CB D527 1A
810CC 50CC D528 1A
810CD 50CD D529 1A
810CE 50CE D52A 1E
810CF 50CF D52B 1E
810D0 50D0 D52C 1A
810D1 50D1 D52D 1A
810D2 50D2 D52E 0
810D3 50D3 D52F 0
810D4 50D4 D530 0
810D5 50D5 D531 0
810D6 50D6 D532 0
810D7 50D7 D533 0
810D8 50D8 D534 0
810D9 50D9 D535 0
810DA 50DA D536 F0
810DB 50DB D537 F0
810DC 50DC D538 D4
810DD 50DD D539 D4
810DE 50DE D53A F0
810DF 50DF D53B F0
810E0 50E0 D53C C4
810E1 50E1 D53D C4
810E2 50E2 D53E 0
810E3 50E3 D53F 0
810E4 50E4 D540 0
810E5 50E5 D541 0
810E6 50E6 D542 0
810E7 50E7 D543 0
810E8 50E8 D544 0
810E9 50E9 D545 0
810EA 50EA D546 0
810EB 50EB D547 0
810EC 50EC D548 0
810ED 50ED D549 0
810EE 50EE D54A 0
810EF 50EF D54B 0
810F0 50F0 D54C 0
810F1 50F1 D54D 0
810F2 50F2 D54E 0
810F3 50F3 D54F 0
810F4 50F4 D550 0
810F5 50F5 D551 0
810F6 50F6 D552 0
810F7 50F7 D553 0
810F8 50F8 D554 0
810F9 50F9 D555 0
810FA 50FA D556 0
810FB 50FB D557 0
810FC 50FC D558 0
810FD 50FD D559 0
810FE 50FE D55A 0
810FF 50FF D55B 0
81100 5100 D55C 0
81101 5101 D55D 0
81102 5102 D55E 0
81103 5103 D55F 0
81104 5104 D560 0
81105 5105 D561 0
81106 5106 D562 0
81107 5107 D563 0
81108 5108 D564 0
81109 5109 D565 0
8110A 510A D566 0
8110B 510B D567 0
8110C 510C D568 0
8110D 510D D569 0
8110E 510E D56A 0
8110F 510F D56B 0
81110 5110 D56C 0
81111 5111 D56D 0
81112 5112 D56E 0
81113 5113 D56F 0
81114 5114 D570 82
81115 5115 D571 82
81116 5116 D572 82
81117 5117 D573 82
81118 5118 D574 82
81119 5119 D575 82
8111A 511A D576 FE
8111B 511B D577 FE
8111C 511C D578 82
8111D 511D D579 82
8111E 511E D57A 82
8111F 511F D57B 82
81120 5120 D57C 82
81121 5121 D57D 82
81122 5122 D57E 0
81123 5123 D57F 0
81124 5124 D580 FC
81125 5125 D581 FC
81126 5126 D582 82
81127 5127 D583 82
81128 5128 D584 82
81129 5129 D585 82
8112A 512A D586 FC
8112B 512B D587 FC
8112C 512C D588 80
8112D 512D D589 80
8112E 512E D58A 80
8112F 512F D58B 80
81130 5130 D58C 80
81131 5131 D58D 80
81132 5132 D58E 0
81133 5133 D58F 0
81134 5134 D590 80
81135 5135 D591 80
81136 5136 D592 80
81137 5137 D593 80
81138 5138 D594 80
81139 5139 D595 80
8113A 513A D596 80
8113B 513B D597 80
8113C 513C D598 80
8113D 513D D599 80
8113E 513E D59A 80
8113F 513F D59B 80
81140 5140 D59C FE
81141 5141 D59D FE
81142 5142 D59E 0
81143 5143 D59F 0
81144 5144 D5A0 0
81145 5145 D5A1 0
81146 5146 D5A2 0
81147 5147 D5A3 0
81148 5148 D5A4 3C
81149 5149 D5A5 3C
8114A 514A D5A6 42
8114B 514B D5A7 42
8114C 514C D5A8 7E
8114D 514D D5A9 7E
8114E 514E D5AA 40
8114F 514F D5AB 40
81150 5150 D5AC 3E
81151 5151 D5AD 3E
81152 5152 D5AE 0
81153 5153 D5AF 0
81154 5154 D5B0 0C
81155 5155 D5B1 0C
81156 5156 D5B2 12
81157 5157 D5B3 12
81158 5158 D5B4 10
81159 5159 D5B5 10
8115A 515A D5B6 7E
8115B 515B D5B7 7E
8115C 515C D5B8 10
8115D 515D D5B9 10
8115E 515E D5BA 10
8115F 515F D5BB 10
81160 5160 D5BC 10
81161 5161 D5BD 10
81162 5162 D5BE 0
81163 5163 D5BF 0
81164 5164 D5C0 0
81165 5165 D5C1 0
81166 5166 D5C2 10
81167 5167 D5C3 10
81168 5168 D5C4 7C
81169 5169 D5C5 7C
8116A 516A D5C6 10
8116B 516B D5C7 10
8116C 516C D5C8 10
8116D 516D D5C9 10
8116E 516E D5CA 10
8116F 516F D5CB 10
81170 5170 D5CC 0C
81171 5171 D5CD 0C
81172 5172 D5CE 0
81173 5173 D5CF 0
81174 5174 D5D0 0
81175 5175 D5D1 0
81176 5176 D5D2 0
81177 5177 D5D3 0
81178 5178 D5D4 3C
81179 5179 D5D5 3C
8117A 517A D5D6 40
8117B 517B D5D7 40
8117C 517C D5D8 3C
8117D 517D D5D9 3C
8117E 517E D5DA 2
8117F 517F D5DB 2
81180 5180 D5DC 7C
81181 5181 D5DD 7C
81182 5182 D5DE 0
81183 5183 D5DF 0
81184 5184 D5E0 FC
81185 5185 D5E1 FC
81186 5186 D5E2 82
81187 5187 D5E3 82
81188 5188 D5E4 82
81189 5189 D5E5 82
8118A 518A D5E6 FC
8118B 518B D5E7 FC
8118C 518C D5E8 88
8118D 518D D5E9 88
8118E 518E D5EA 84
8118F 518F D5EB 84
81190 5190 D5EC 82
81191 5191 D5ED 82
81192 5192 D5EE 0
81193 5193 D5EF 0
81194 5194 D5F0 0
81195 5195 D5F1 0
81196 5196 D5F2 0
81197 5197 D5F3 0
81198 5198 D5F4 38
81199 5199 D5F5 38
8119A 519A D5F6 4
8119B 519B D5F7 4
8119C 519C D5F8 3C
8119D 519D D5F9 3C
8119E 519E D5FA 44
8119F 519F D5FB 44
811A0 51A0 D5FC 3E
811A1 51A1 D5FD 3E
811A2 51A2 D5FE 0
811A3 51A3 D5FF 0
811A4 51A4 D600 2
811A5 51A5 D601 2
811A6 51A6 D602 2
811A7 51A7 D603 2
811A8 51A8 D604 2
811A9 51A9 D605 2
811AA 51AA D606 3E
811AB 51AB D607 3E
811AC 51AC D608 42
811AD 51AD D609 42
811AE 51AE D60A 42
811AF 51AF D60B 42
811B0 51B0 D60C 3E
811B1 51B1 D60D 3E
811B2 51B2 D60E 0
811B3 51B3 D60F 0
811B4 51B4 D610 0
811B5 51B5 D611 0
811B6 51B6 D612 0
811B7 51B7 D613 0
811B8 51B8 D614 3C
811B9 51B9 D615 3C
811BA 51BA D616 22
811BB 51BB D617 22
811BC 51BC D618 22
811BD 51BD D619 22
811BE 51BE D61A 22
811BF 51BF D61B 22
811C0 51C0 D61C 22
811C1 51C1 D61D 22
811C2 51C2 D61E 0
811C3 51C3 D61F 0
811C4 51C4 D620 FE
811C5 51C5 D621 FE
811C6 51C6 D622 10
811C7 51C7 D623 10
811C8 51C8 D624 10
811C9 51C9 D625 10
811CA 51CA D626 10
811CB 51CB D627 10
811CC 51CC D628 10
811CD 51CD D629 10
811CE 51CE D62A 10
811CF 51CF D62B 10
811D0 51D0 D62C 10
811D1 51D1 D62D 10
811D2 51D2 D62E 0
811D3 51D3 D62F 0
811D4 51D4 D630 0
811D5 51D5 D631 0
811D6 51D6 D632 0
811D7 51D7 D633 0
811D8 51D8 D634 3C
811D9 51D9 D635 3C
811DA 51DA D636 42
811DB 51DB D637 42
811DC 51DC D638 42
811DD 51DD D639 42
811DE 51DE D63A 42
811DF 51DF D63B 42
811E0 51E0 D63C 3C
811E1 51E1 D63D 3C
811E2 51E2 D63E 0
811E3 51E3 D63F 0
811E4 51E4 D640 10
811E5 51E5 D641 10
811E6 51E6 D642 10
811E7 51E7 D643 10
811E8 51E8 D644 10
811E9 51E9 D645 10
811EA 51EA D646 10
811EB 51EB D647 10
811EC 51EC D648 10
811ED 51ED D649 10
811EE 51EE D64A 10
811EF 51EF D64B 10
811F0 51F0 D64C 10
811F1 51F1 D64D 10
811F2 51F2 D64E 0
811F3 51F3 D64F 0
811F4 51F4 D650 0
811F5 51F5 D651 0
811F6 51F6 D652 10
811F7 51F7 D653 10
811F8 51F8 D654 0
811F9 51F9 D655 0
811FA 51FA D656 10
811FB 51FB D657 10
811FC 51FC D658 10
811FD 51FD D659 10
811FE 51FE D65A 10
811FF 51FF D65B 10
81200 5200 D65C 10
81201 5201 D65D 10
81202 5202 D65E 0
81203 5203 D65F 0
81204 5204 D660 0
81205 5205 D661 0
81206 5206 D662 0
81207 5207 D663 0
81208 5208 D664 0
81209 5209 D665 0
8120A 520A D666 0
8120B 520B D667 0
8120C 520C D668 7E
8120D 520D D669 7E
8120E 520E D66A 0
8120F 520F D66B 0
81210 5210 D66C 0
81211 5211 D66D 0
81212 5212 D66E 0
81213 5213 D66F 0
81214 5214 D670 78
81215 5215 D671 78
81216 5216 D672 84
81217 5217 D673 84
81218 5218 D674 80
81219 5219 D675 80
8121A 521A D676 7C
8121B 521B D677 7C
8121C 521C D678 2
8121D 521D D679 2
8121E 521E D67A 82
8121F 521F D67B 82
81220 5220 D67C 7C
81221 5221 D67D 7C
81222 5222 D67E 0
81223 5223 D67F 0
81224 5224 D680 0
81225 5225 D681 0
81226 5226 D682 0
81227 5227 D683 0
81228 5228 D684 3C
81229 5229 D685 3C
8122A 522A D686 42
8122B 522B D687 42
8122C 522C D688 40
8122D 522D D689 40
8122E 522E D68A 42
8122F 522F D68B 42
81230 5230 D68C 3C
81231 5231 D68D 3C
81232 5232 D68E 0
81233 5233 D68F 0
81234 5234 D690 0
81235 5235 D691 0
81236 5236 D692 0
81237 5237 D693 0
81238 5238 D694 4E
81239 5239 D695 4E
8123A 523A D696 50
8123B 523B D697 50
8123C 523C D698 60
8123D 523D D699 60
8123E 523E D69A 40
8123F 523F D69B 40
81240 5240 D69C 40
81241 5241 D69D 40
81242 5242 D69E 0
81243 5243 D69F 0
81244 5244 D6A0 0
81245 5245 D6A1 0
81246 5246 D6A2 66
81247 5247 D6A3 66
81248 5248 D6A4 66
81249 5249 D6A5 66
8124A 524A D6A6 66
8124B 524B D6A7 66
8124C 524C D6A8 66
8124D 524D D6A9 66
8124E 524E D6AA 0
8124F 524F D6AB 0
81250 5250 D6AC 66
81251 5251 D6AD 66
81252 5252 D6AE 66
81253 5253 D6AF 66
81254 5254 D6B0 0
81255 5255 D6B1 0
81256 5256 D6B2 7E
81257 5257 D6B3 7E
81258 5258 D6B4 7E
81259 5259 D6B5 7E
8125A 525A D6B6 6
8125B 525B D6B7 6
8125C 525C D6B8 6
8125D 525D D6B9 6
8125E 525E D6BA 6
8125F 525F D6BB 6
81260 5260 D6BC 7E
81261 5261 D6BD 7E
81262 5262 D6BE 7E
81263 5263 D6BF 7E
81264 5264 D6C0 0
81265 5265 D6C1 0
81266 5266 D6C2 FE
81267 5267 D6C3 FE
81268 5268 D6C4 FE
81269 5269 D6C5 FE
8126A 526A D6C6 6
8126B 526B D6C7 6
8126C 526C D6C8 3E
8126D 526D D6C9 3E
8126E 526E D6CA 3C
8126F 526F D6CB 3C
81270 5270 D6CC 70
81271 5271 D6CD 70
81272 5272 D6CE 20
81273 5273 D6CF 60
81274 5274 D6D0 0
81275 5275 D6D1 0
81276 5276 D6D2 66
81277 5277 D6D3 66
81278 5278 D6D4 66
81279 5279 D6D5 66
8127A 527A D6D6 66
8127B 527B D6D7 66
8127C 527C D6D8 66
8127D 527D D6D9 66
8127E 527E D6DA 0
8127F 527F D6DB 0
81280 5280 D6DC 66
81281 5281 D6DD 66
81282 5282 D6DE 66
81283 5283 D6DF 66
81284 5284 D6E0 5
81285 5285 D6E1 5
81286 5286 D6E2 7D
81287 5287 D6E3 7D
81288 5288 D6E4 5
81289 5289 D6E5 5
8128A 528A D6E6 0
8128B 528B D6E7 0
8128C 528C D6E8 0
8128D 528D D6E9 0
8128E 528E D6EA 0
8128F 528F D6EB 0
81290 5290 D6EC 80
81291 5291 D6ED 80
81292 5292 D6EE 7C
81293 5293 D6EF 7C
81294 5294 D6F0 3C
81295 5295 D6F1 3C
81296 5296 D6F2 0
81297 5297 D6F3 0
81298 5298 D6F4 3C
81299 5299 D6F5 3C
8129A 529A D6F6 42
8129B 529B D6F7 42
8129C 529C D6F8 2
8129D 529D D6F9 2
8129E 529E D6FA 2
8129F 529F D6FB 2
812A0 52A0 D6FC 4
812A1 52A1 D6FD 4
812A2 52A2 D6FE 18
812A3 52A3 D6FF 18
812A4 52A4 D700 2
812A5 52A5 D701 2
812A6 52A6 D702 42
812A7 52A7 D703 42
812A8 52A8 D704 5F
812A9 52A9 D705 5F
812AA 52AA D706 42
812AB 52AB D707 42
812AC 52AC D708 42
812AD 52AD D709 42
812AE 52AE D70A 42
812AF 52AF D70B 42
812B0 52B0 D70C 62
812B1 52B1 D70D 62
812B2 52B2 D70E 0C
812B3 52B3 D70F 0C
812B4 52B4 D710 0
812B5 52B5 D711 0
812B6 52B6 D712 44
812B7 52B7 D713 44
812B8 52B8 D714 42
812B9 52B9 D715 42
812BA 52BA D716 42
812BB 52BB D717 42
812BC 52BC D718 42
812BD 52BD D719 42
812BE 52BE D71A 42
812BF 52BF D71B 42
812C0 52C0 D71C 42
812C1 52C1 D71D 42
812C2 52C2 D71E 20
812C3 52C3 D71F 20
812C4 52C4 D720 0
812C5 52C5 D721 0
812C6 52C6 D722 0
812C7 52C7 D723 0
812C8 52C8 D724 0F
812C9 52C9 D725 0F
812CA 52CA D726 1F
812CB 52CB D727 10
812CC 52CC D728 3F
812CD 52CD D729 20
812CE 52CE D72A 3F
812CF 52CF D72B 23
812D0 52D0 D72C 3C
812D1 52D1 D72D 24
812D2 52D2 D72E 3C
812D3 52D3 D72F 24
812D4 52D4 D730 0
812D5 52D5 D731 0
812D6 52D6 D732 0
812D7 52D7 D733 0
812D8 52D8 D734 F0
812D9 52D9 D735 F0
812DA 52DA D736 F8
812DB 52DB D737 8
812DC 52DC D738 FC
812DD 52DD D739 4
812DE 52DE D73A FC
812DF 52DF D73B C4
812E0 52E0 D73C 3C
812E1 52E1 D73D 24
812E2 52E2 D73E 3C
812E3 52E3 D73F 24
812E4 52E4 D740 3C
812E5 52E5 D741 24
812E6 52E6 D742 3C
812E7 52E7 D743 24
812E8 52E8 D744 3F
812E9 52E9 D745 23
812EA 52EA D746 3F
812EB 52EB D747 20
812EC 52EC D748 1F
812ED 52ED D749 10
812EE 52EE D74A 0F
812EF 52EF D74B 0F
812F0 52F0 D74C 0
812F1 52F1 D74D 0
812F2 52F2 D74E 0
812F3 52F3 D74F 0
812F4 52F4 D750 3C
812F5 52F5 D751 24
812F6 52F6 D752 3C
812F7 52F7 D753 24
812F8 52F8 D754 FC
812F9 52F9 D755 C4
812FA 52FA D756 FC
812FB 52FB D757 4
812FC 52FC D758 F8
812FD 52FD D759 8
812FE 52FE D75A F0
812FF 52FF D75B F0
81300 5300 D75C 0
81301 5301 D75D 0

Exploring Map 0xFE with arbitrary code execution

The warp to map 0x99 can be avoided by manipulating the right script at DC0E, in particular forcing the game to save will let you explore the map upon reset like with the following code which will bring up an invisible save menu, add the Pokédex option back, enable walk through walls and disable the perpetual spinning side effect that normally disables encounters:

ld b,04 ld h,61 ld l,95 call 3e84 ld a,01 ld [cd38],a xor a ld [d735],a ld h,d3 ld l,6e ldd [hl],a ld a,7a ld [hl],a xor a dec a ld [d74a],a ret

Memory editor code:

06 04 26 61 2E 95 CD 84 3E 3E 01 EA 38 CD AF EA 35 D7 26 D3 2E 6E 32 3E 7A 77 AF 3D EA 4A D7 C9

This code could in theory be represented with more viable storage box Pokémon (and possibly item data), but can be written with ws m (hex:63) using the Yellow port of [ https://forums.glitchcity.info/index.php?topic=7773.0 offgao's memory editor] (3831 changed to 381E from the Red/Blue version).

In order to set up the bytes for offgao's memory editor, you should be able to use the ChickasaurusGL's reusable RAM writer, but set up things so that the code at the end ends up at DA7F (ws m's initial location), possibly by writing most of the code, writing a jump to more code at DA7F (e.g. to Day Care Pokémon data), and in that code performing CopyData to move it to DA7F and finish the code.

In map 0xFE the Bicycle music continues to play. Its real theme may be a glitch song that freezes the game (confirmed but may not always happen) if you use the Bicycle and dismount, so you should avoid doing this.

In map 0xFE you can find the following Pokémon, glitch Pokémon and Trainers, so its fun to go hunting there.

Land Pokémon Surf Pokémon Rods
Rival (sprite 1) (0xF1) Lass (0xCB) Magikarp Level 5 (Old Rod)
Scyther Level 218 Jr. Trainer (0xCE) Poliwag Level 10 (Good Rod)
ゥ ( Z4 Level 5 (0xC3) Sabrina (0xF0) Goldeen Level 10 (Good Rod)
Kangaskhan Level 66 MissingNo. (0xAF)
Bug Catcher (0xCA) Voltob Level 76
Beauty (0xDA) Sandshrew Level 33
Slowbro Level 46 Fearow Level 28
X ゥ- xゥ, Level 234
Growlithe Level 207

Different Pokémon may be found while Surfing, but it seems no Pokémon can be found with the Super Rod and Old Rod and Good Rood give Level 5 Magikarp, Level 10 Poliwag, Level 10 Goldeen. Interestingly you can get encounters out of the grass, which may mean the encounters in the map functions like a cave.

Whenever a battle finishes, the save prompt should be brought up again and you can save the game. You will be warped to map 0x99 but upon resetting you are able to explore map 0xFE again like when you first entered.

You are able to Fly away from map 0xFE, but it corrupts the Fly locations including a glitch option back to map 0xFE. Viewing the name of the glitch option can cause effects similar to Super Glitch, such as changing the palette of the screen, causing a battle with a ZZAZZ glitch Trainer or making the start menu and storage box menus invisible.

After you Fly away from map 0xFE, you should find that the 'meta-map scripts' of various locations like Celadon City and Hall of Fame were corrupted, and many can freeze the game.

In order to fix this, prepare the following code at D31D before the glitch, and then swap the Escape Rope x211 into item 41 to run the code as a custom map script.

ld hl, d5ef ld bc, 007a xor a call 166e ld h, d7 ld l, 0a ld a,ff ld [hli],a ld [hl],a ld a,c3 ld h,da ld l,7f ld [hli],a ld a,21 ld [hli],a ld a,d3 ld [hl],a ret

Memory editor code: 21 EF D5 01 7A 00 AF CD 6E 16 26 D7 2E 0A 3E FF 22 77 3E C3 26 DA 2E 7F 22 3E 21 22 3E D3 77 C9 63 01 01 63 1E 63 1D D3

(63 01) (01 63) (1E 63) (1D D3)

(Includes Master Balls and Repels for catching Pokémon you want in map 0xFE. The Repels are useful for catching Pokémon higher than the level of the first Pokémon in the party).

This calls the FillData routine to fill bytes D5EF to D668 with 00 and also fixes your Fly list to include all valid destinations and no glitch destinations.

For some reason using the code may remove the Pokédex option again. You can fix this with the following code at item 3 (as the code above makes ws m jump to item 3 after its data was corrupted, breaking the memory editor GUI) to patch D74A.
Lemonade x255

TM34 x74

TM15 x201

YouTube video by ChicaksaurusGL


See also