Arbitrary code execution

Major glitches of the Pokémon series

No further extensions

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)

Buffer overflow techniques

Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch

Bad clone glitch (Generation II)

Closed menu Select glitches (Japanese Red/Green)

Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch

Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)

2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch

Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)

Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick

Pikachu off-screen glitch

Trainer corruption glitch

SRAM glitches

Trainer escape glitch

Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls

Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))

(view, talk, edit)

Arbitrary code execution refers to a method that allows the player to force the game to run code written by the player.

It usually uses an invalid execution pointer (glitch items in Generation I, an incorrectly terminated string in English Pokémon Gold and Silver), which the player can manipulate to run custom assembly code.

This custom code is often spelled with items, as a stack of items uses only two bytes.

In Generation I

Via items

Both (glitch) items require a special setup for the item to run correct code.

For detailed info about these items, read this topic on GCL forums if playing R/B, or this post if playing Yellow.

It is a good idea to read all the topic messages for info.

Using てヘ (tehe) in JP Red/Green

Glitch item hex:7B has its execution script pointing to wild Pokémon data. However, by naming yourself (any character)てルぬ(any characters or nothing) and talking to the Old Man, the script jumps to item pack #3.

Using 8F (English Red/Blue)

The 8F item doesn't run arbitrary code in at least the French versions.

The player's party Pokémon must be in a certain order and have certain stats :

5 Pokémon
Pidgey as the first Pokémon
Parasect as the second Pokémon
Onix as the third Pokémon
Tentacool as the fourth Pokémon
Kangaskhan as the fifth Pokémon
Pidgey must have 233 HP

To obtain such a Pidgey, Rare Candy it up to Lv100, apply 5~6 HP Ups.

If needed get it poisoned, use a Max Potion (not Full Restore !), walk 4*(Pidgey's max HP-233) steps and cure the poison.

Another setup allows any Pokémon at the front of the party :

6 Pokémon
The first Pokémon does not matter
Pidgey as the second Pokémon
Parasect as the third Pokémon
Onix as the fourth Pokémon
Tentacool as the fifth Pokémon
Arbok as the sixth Pokémon
Pidgey must have 233 HP

When selecting Use on 8F, the game will run code depending on the item pack (starting from item #3)

The bootstrap code translates to the following ASM :

Initial hl = D163

$D163 <- 05 || dec b $D164 <- 24 || inc h ; h = D2 $D165 <- 2E || $D166 <- 22 || ld l, 22 ; hl = D222 $D167 <- 18 || $D168 <- 02 || jr 2 ; pc = D16B $D169 <- FF || $D16A <- FF || $D16B <- 24 || inc h ; h = D3 $D16C <- 00 || nop $D16D <- e9 || jp (hl) ; pc = D322 and, for the 6-Pokémon setup, $D163 <- 06 || $D164 <- ?? || ld b, ?? $D165 <- 24 || inc h ; h = D2 $D166 <- 2E || $D167 <- 22 || ld l, 22 ; hl = D222 $D168 <- 18 || $D169 <- 02 || jr 2D ; pc = D197 (...) $D197 <- 24 || inc h ; h = D3 $D198 <- 00 || nop $D199 <- E9 || jp (hl) ; pc = D322

To make 8F run code starting from item 1, replace the Onix with a Tangela.

Using 7eme etage / P7 / S7 (French & Italian / Spanish / German Red/Blue)

These items (which will be referred to as "7F" for this part) run code like 8F in English versions.

In these versions, 8F has the much less useful effect of returning to the overworld script even in-battle. This can be used when the Pokémon FF terminator is removed and the player is warped into a Glitch City every four steps, as this will return the player where they were.

The bootstrap code for 7eme etage, P7 or S7 must be slightly changed from the English version: whether using the 5- or 6-Pokémon setup, the player should replace the Onix with a Graveler.

When selecting Use on 7F, the game will run code depending on the item pack (starting from item #3).

The bootstrap code translates to the following ASM :

Initial hl = D163

$D163 <- 05 || dec b $D164 <- 24 || inc h ; h = D2 $D165 <- 2E || $D166 <- 27 || ld l, 27 ; l = 27 $D167 <- 18 || $D168 <- 02 || jr 2 ; pc = D16B $D169 <- FF || $D16A <- FF || $D16B <- 24 || inc h ; h = D3 $D16C <- 00 || nop $D16D <- e9 || jp hl ; pc = D327 and, for the 6-Pokémon setup, $D163 <- 06 || $D164 <- ?? || ld b, ?? $D165 <- 24 || inc h ; h = D2 $D166 <- 2E || $D167 <- 22 || ld l, 22 ; hl = D222 $D168 <- 18 || $D169 <- 02 || jr 2D ; pc = D197 (...) $D197 <- 24 || inc h ; h = D3 $D198 <- 00 || nop $D199 <- E9 || jp (hl) ; pc = D322

To make "7F" run code starting with item 1, replace the Graveler with a Fearow.

Using "ws m" (Yellow)

The Pokémon in the current PC box must be in a certain order for the instruction pointer to be redirected to the item pack :

11 Pokémon in your current PC box
Seel as the 1st Pokémon in the current PC box
Parasect as the 2nd Pokémon in the current PC box
Growlithe as the 3rd Pokémon in the current PC box
Magikarp as the 4th Pokémon in the current PC box
Psyduck as the 5th Pokémon in the current PC box
Flareon as the 6th Pokémon in the current PC box
Tentacool as the 7th Pokémon in the current PC box
Female Nidoran as the 8th Pokémon in the current PC box
Three more Pokémon
Finally, Seel's HP must be 233

Much like 8F, the contents of the item pack (starting from item 3) will be read as ASM code. Optionally, Seel can be replaced by Butterfree or Mr. Mime.

The bootstrap code translates to the following ASM :

Initial hl = DA7F

$DA80 <- 3A || ldd a, (hl) ; a = 0B $DA81 <- 2E || $DA82 <- 21 || ld l, 21 $DA83 <- 85 || add l ; a = 2C $DA84 <- 2F || cpl ; a = D3 $DA85 <- 67 || ld h,a ; hl = D321 $DA86 <- 18 || $DA87 <- 0F || jr 0F ; pc = DA97 (...) $DA97 <- E9 || jp (hl) ; pc = D321

Useful item codes

All the following items lists begin from the first item pack slot.

Non-key item duplication

8F

The item to duplicate x1

X Accuracy x33

Revive x201

To obtain the 201 Revive stack, have Revive x73 in the sixth item pack slot, then encounter / capture MissingNo or 'M. It will be a stack of 201 Revives.

Upon using 8F, the quantity of item #2 will be decreased by one. If there was only one item, it will be a stack of zero items. Tossing one of these rolls the quantity back to 255.

Gameshark-like code

The following item list will work the same way a game-altering device does.

8F

Any item x Any qty

X Accuracy x(b2)

Carbon x(b3)

Max Revive x(b1)

Poké Ball x201

To obtain the 201 Poké Balls stack, have Poké Balls x73 in the sixth item pack slot, then encounter / capture MissingNo or 'M. It will be a stack of 201 Poké Balls. It is also possible to use the Non-key items duplication code.

This code aims to write code like the Gameshark code "01(b1)(b2)(b3)".

For example, the code 010138CD, which allows to walk through walls, can be transcripted into the following :

X Accuracy x(b2)

Carbon x(b3)

Max Revive x(b1)

Poké Ball x201

Via Pikachu off-screen glitch

By using the Pikachu off-screen glitch in the Vermilion City Fan Club and making specific movements to force the non-existing sign 04 to appear at coordinates x=1, y=1, it is possible for the player to read the signpost and execute arbitrary code beginning from D221; the catch rate/held item of party Pokémon 5.

Outside of speedrunning, a Graveler with 08 c2 (2242) HP stat experience and 1d d3 (7635) Attack stat experience may be used as an applicable Pokémon 5, preferably a Graveler from Victory Road.

If you are using level 44 Graveler, make note that since you can't really predict its total exp. you may not be able to get your result dictated by items. However, saving before the last few Krabby to get different levels or keeping Rare Candies, saving before talking to the text box and using one if it didn't work last time may fix this.

To get these specific EVs, your Pokémon needs to have encountered the following Pokémon (and no more):

71 Krabby, 1 Farfetch'd, 1 Dugtrio, and 1 Magnemite.

(Thanks FMK for working out what Pokémon to battle).

Steps

Once you have the correct EVs, put your Pokémon in the 5th position of the party, prepare your items from item 1, get the Clefairy event in the Vermilion Fan Club, then do the following steps:

1) Go to the bottom-left walkable tile (putting Pikachu off the screen), then walk up to the top and down to the bottom of the left-most column 11 times, but for the 11th time step one tile short on the final way back down.

2) Step right, step left, then walk up to the top and down to the bottom of the left-most column 10 times.

3) Step right, then go the top-left tile you can walk to, face right and press A.

Example codes (all from item 1)

Obtain 255 items:

This allows you to do 20+ items related glitches and get more complicated item set ups if you have items like multiple X Special x1 spare.

Protein x1
Repel x1
X Accuracy x28
Lemonade x1
Poké Ball x61
Antidote x61
Water Stone x37
X Accuracy x97
TM01 x1

Note: This code may be unstable.

Encounter a Pokémon:

Iron x37
X Accuracy x88
Lemonade x(species you want, 21=Mew)
Water Stone x4
Protein x4
TM01 x1

This technique was discovered by stumpdotio, originally for speedrunning Pokémon Yellow using a different method. A video of the route by Dabomstew's may be found here.


YouTube video by ChickasaurusGL

Via ZZAZZ Trainer hex:FC

Video by TheZZAZZGlitch

This method will make the ZZAZZ trainer hex:FC (encountered via the Trainer escape glitch) to run code based on the data of the Pokémon in the current PC box.

Requirements :

No Pokémon must ever have been deposited info the Daycare (even on a previous save file)
Knowing and being able to perform the Trainer-Fly glitch
A Pokémon with a Special stat of 252

One must perform the Trainer escape glitch using a Special stat of 252 (hex:FC)
Aside from the ZZAZZ effects, upon selecting an attack, code based on the data of the Pokémon that was last deposited into the Daycare will be run. If no Pokémon was ever deposited, the script will "fall" to boxed Pokémon data.

In Generation II

Main article: Coin Case glitch

The English versions of Pokémon Gold and Silver use a hex:57 character as a terminator for the Coin Case's "Coins: (x)" text, like in the Japanese versions.

While this is a valid control character for the Japanese version, it isn't for the English versions, causing the game to jump into the memory at echo RAM address E112 and execute code there.

Bellsprout, Machop and Machamp's cries make the coin case run a "inc sp" which changes the game into running code based on a palette table. Standing at certain places makes the code jump to data regarding party Pokémon data, and finally to the PC items.

In Generation III

The method is extremely complicated, but can be achieved.

To learn how, watch this video by TheZZAZZGlitch.

Arbitrary code execution

Contents

In Generation I

Via items

Using てヘ (tehe) in JP Red/Green

Using 8F (English Red/Blue)

Using 7eme etage / P7 / S7 (French & Italian / Spanish / German Red/Blue)

Using "ws m" (Yellow)

Useful item codes

Non-key item duplication

Gameshark-like code

Via Pikachu off-screen glitch

Steps

Example codes (all from item 1)

Via ZZAZZ Trainer hex:FC

In Generation II

In Generation III

Related articles

Navigation menu

Arbitrary code execution

In Generation I

Via items

Using てヘ (tehe) in JP Red/Green

Using 8F (English Red/Blue)

Using 7eme etage / P7 / S7 (French & Italian / Spanish / German Red/Blue)

Using "ws m" (Yellow)

Useful item codes

Non-key item duplication

Gameshark-like code

Via Pikachu off-screen glitch

Steps

Example codes (all from item 1)

Via ZZAZZ Trainer hex:FC

In Generation II

In Generation III

Related articles

Navigation menu

Search