Text pointer manipulation mart buffer overflow glitch
Text pointer manipulation mart buffer overflow glitch, informally known as Mart Pwner or Lucky Wins Again (LWA) is an extension of text pointer manipulation for Pokémon Red, Blue, and Yellow documented by luckytyphlosion.
It involves the player bringing up a corrupted Poké Mart which corrupts data from CF7B (Poké Mart total items) onward in RAM with data from a specific source.
Unlike corruption techniques from Super Glitch moves, items, Pokémon names the source can be controlled by the user and is specifically taken from the address which is the beginning of the Poké Mart list (manipulated by adjusting the text pointer table and text pointer).
It may be used to catch many Pokémon for the Pokédex and is the only known non-arbitrary code execution/cheating device method to trigger the unused battle system featuring the text "Hurry, get away!" in Pokémon Yellow.
This article documents non-speedrunning adaptions of the glitch.
Catch 'em all glitch (Yellow)
This glitch is a trick for Pokémon Yellow you can use that can be applied outside of speedrunning to capture any Pokémon you wish outside of battle (where you can throw a Master Ball from the items pack to capture the Pokémon), with the species depending on Pokémon 3's lower max HP byte.
We talk to the lady in Pallet Town to bring up the corrupted Poké Mart.
This trick requires an expanded items pack which can be obtained with a glitch such as "dry underflow" glitch.
1) Pokémon 1 must have a move 1 PP value of 254 (62 PP with all PP Ups applied) - enables glitch mart (possible with a PP underflow glitch).
2) The PP of Pokémon 6's move 2 must be 01 - makes the game think you're in a battle.
3) The PP of Pokémon 6's move 4 must be 00 - disables instant encounter (as instant encounter will reset our Pallet Town text pointer table back to normal) to easily capture many Pokémon quickly.
4) Pokémon 6's level must be 00 - disables automatic item selection as it would prevent you from catching more than two unique Pokémon (one Pokémon, and Ditto).
5) If you want opening the Poké Mart to disable Ditto (who normally appears if you throw the Master Ball twice), have the Original Trainer name letter 5 for first Pokémon as 00.
6) In the party, you must not have a Pokémon with a catch rate of 255, a Pokémon with FF in its experience bytes, a Pokémon with EVs/DVs containing FF in them, or a Pokémon with a Trainer ID containing FF or the mart may not be able to corrupt as far as it is meant to.
7) Repel x243 must be placed into item 40 (map's text pointer table) (a quantity of 211 might also work).
8) Item 2 must have a quantity of 135.
9) Item 3 must be a TM41 (a TM09 might also work).
They can also be obtained via a trade with another game (such as Red and Blue). Note that 'M (00) at level 0 sadly cannot be used for the glitch because it has FF values in its experience, but non-'medium slow' growth Pokémon (basically all Pokémon part of a three-stage evolution as well as Mew, except for Butterfree and Beedrill) can.
How to use the trick
1) Go to Pallet Town and place the Repel x243 into item 40.
2) Make sure that the PP underflow Pokémon is in slot 1, max HP of your choice Pokémon in slot 3, level 0 Pokémon in slot 6. Talk to lady in Pallet Town.
3) Close the mart, throw a Master Ball to get Pokémon ID=Pokémon 3 max HP modulo 256.
4) Save and reset so you can use HP Up, Rare Candy and talk to lady again, repeat step 2.
If you stocked up on many Repel x243 stacks, you can Fly away (the low HP music may continue for some reason) and switch boxes. Flying away will reset item 40 back to what it was, but the extra Repel x243 stack will let you repeat the glitch.
Multiple stacks can be obtained if you get Repel x255, then toss the item above it to create another stack of Repel x255. From then on, you can toss 12 from the individual stacks.
Pokémon and glitch Pokémon IDs can be found here.
Manipulating specific battle systems (Yellow)
This is a trick for Pokémon Yellow to encounter a Pokémon or Trainer in battle with a specific battle system (depending on the Pokémon 6's type 1 and type 2). We talk to the lady in Pallet Town to bring up the corrupted Poké Mart.
Like the any Pokémon trick, it requires an expanded items pack which can be obtained with a glitch such as "dry underflow" glitch (https://www.youtube.com/watch?v=ZyppANEvnh8).
Pokémon 1 must have a current HP of 254 for the trick to work. To enable a suitable glitch Poké Mart, a Repel x243 must be placed into item 40 (text pointer table) (a quantity of 211 might also work), item 2 must have a quantity of 108 and item 3 must be a TM41 (a TM09 might also work).
Additionally, there most be no 'FF' bytes in your party Pokémon data, so this means no Pokémon with a catch rate of 255, EVs or DVs with an FF byte in them, experiences with an FF byte, or a Pokémon with a Trainer ID with a FF byte in them.
The Pokémon ID is based on Pokémon 6's type 1. The battle system ID is based on Pokémon 6's type 2, so for example a Pokémon with Poison (hex:03) as type 2 will bring up the unused "Hurry, get away!" encounter system in Yellow. Pokémon with only one type are internally stored as having the same type for type 1 and 2.
Pokémon and Trainer ID numbers can be found on The Big HEX List.
Type index numbers
Battle systems index numbers
- General use:
- In luckytyphlosion's TAS: