Anonymous user
Coin Case glitches: Difference between revisions
no edit summary
>Torchickens No edit summary |
>Torchickens No edit summary |
||
Line 1:
{{Collective Page}}
{{incomplete}}
[[Image:
The '''Coin Case
The Coin Case glitch was previously thought to be harmless, with things like [[Glitch Dimension]]s or 'glitchy coin counts' being the only things found, however, after Sanky and TheZZAZZGlitch researched the glitch, it was found that is possible to execute [[Arbitrary code execution|execute arbitrary code]] with it to do things such as, but not limited to:
*Causing a custom message to be displayed by the Coin Case.
*Getting a glitch phone number.
*Warping to Mt. Silver.
*Obtaining Celebi or a [[?????|????? (FF)]].
==Cause==
In the Japanese versions of Pokémon Gold and Silver, after the hiragana 'まい' in the dialog "あなたの コイン (n)まい" (your number of coins) appears, a hex:57 control character is used (at offset 0xF9FE, in both versions, and in both revisions v1.0 and v1.1), and it is valid as a terminator in these versions.
The hex:57 character is still used as a terminator for "Coins: (x)" in the English versions (at offset 01985B0), but it is no longer a valid terminator there. The game jumps into memory at echo RAM address E112, which is essentially C112 and executes arbitrary code from there. This section of the memory can be changed by listening to cries, but if the player didn't listen to any cry, it is mainly 00 <!--I can't find a ret and I found an invalid opcode eventually, why doesn't the game freeze?-->, so 'nothing happens'.
When the player listens to a certain Pokémon cry before using the Coin Case, the game will execute code that has a noticeable effect, including glitch dimensions are altered number of coins text, due to the data no longer being mainly 00.
Machop, Bellsprout and other Pokémon's cries are special because they put a hex:33 at ECHO:E117. This is read as the opcode 'inc sp' (increment stack pointer) causing the next 'ret' (return) to go elsewhere, specially to EB12, which contains overworld data. Even though there is no known way to predict the contents of this data, the results are consistent if you move in a specific pattern.
By having useful overworld data here, which can be manipulated by moving around, it is possible for the game to jump to an address that can reasonably be manipulated (i.e. to make the game jump to at least{{clarify}} ECHO:FA98 (essentially DA98), which is the second byte of the third Pokémon's attack stat experience.
This glitch was patched in foreign language versions other than the Japanese versions, which use the valid hex:50 terminator instead in at least the French, German, Italian and Spanish versions. It does not exist in English Pokémon Crystal, which also uses the correct 50 terminator (at offset 1C5C88).
(Thanks to Sanky from the forums for [http://forums.glitchcity.info/index.php/topic,6716.0.html the explanation], Wack0 for pointing out the changes to 50 in foreign non-Japanese versions and Torchickens for noticing there is a 57 as a terminator in the Japanese version)
==Get Celebi with Coin Case arbitrary code execution==
[https://www.youtube.com/watch?v=SpfgOVfGVTo Video].
This trick allows you to change the [[unstable hybrid glitch Pokémon|recipient byte]] of a Pokémon in Day-Care south of Goldenrod City to hex:FB, the same as Celebi. It was made by TheZZAZZGlitch.
Since withdrawing a Pokémon from Day-Care makes the game match to donor byte to the value in the recipient byte, it will be a perfectly stable Celebi when it is withdrawn.
===Requirements===
This glitch requires specific items in the player's item storage system (see below), and they need to be in the exact they appear in the table, from top to bottom. For this trick, when it is done correctly, the last jump the game makes will be to the address which governs the item storage system's quantity of the second item (D61A).
{| border="1"
!Item
!Quantity
|-
|[ANY ITEM]
|[ANY QUANTITY]
|-
|[ANY ITEM]
|x38
|-
|TM27
|x2
|-
|Fresh Water
|x42
|-
Lovely Mail
|x1
|-
|HM07
|x1
|-
|Poke Ball
|x65
|-
|Great Ball
|x4
|-
|Everstone
|x1
|-
|[ANY ITEM]
|x[ANY QUANTITY]
|-
|Surf Mail
|x51
|-
|Full Heal
|x18
|-
|Flower Mail
|x46
|-
|HM03
|x1
|-
|X Speed
|x1
|-
|TM06
|x1
|-
|[ANY ITEM]
|x[ANY QUANTITY]
|-
|TM41
|x1
|}
When the items above exist in the PC, the player will also need in the party:
*A freshly caught low level Pokémon.
*A Quagsire holding a HP UP, with Sleep Talk as the first move.
*Any Pokémon (this will become Celebi).
The player also needs:
*The Coin Case
*A Pokémon including Bellsprout, Machop, Machoke or Omanyte registered in the Pokédex.
*Access to the Pokémon Day-Care on Route 34 and New Bark Town via Fly.
===Steps===
First confirm that you meet the requirements above.
#Put the low level Pokémon in your third slot. Put your Quagsire in your 4th slot. Put the chosen Pokémon (which will become Celebi) in your first slot.
#Fly to New Bark Town and enter Prof. Elm's lab. Save and reset.
#Step out of Prof. Elm's lab, take four steps right (so you are below the tree), then open the Pokédex and listen to either Bellsprout, Machop, Machoke or Omanyte's cry.
#Exit the Pokédex, and open the items pack and switch over to the Key Items pocket. Switching pockets before viewing the Coin Case after listening to the cry in the current session is important, otherwise the trick won't work properly.
#Use the Coin Case. If you followed the steps properly the game won't cause a glitch dimension or freeze.
#Fly over to Goldenrod City and walk south to the Pokémon Day-Care Center. Enter it.
#Deposit the chosen Pokémon (do not deposit another Pokémon) with the Day-Care man or lady and get it back to get Celebi. Its name will not be changed (e.g. it may be still called 'Rattata'), so you will have to rename it at the Name Rater in Goldenrod City north of the Magnet Train station. It will also have its old moves, but you can remove illegal moves at the Move Deleter in Blackthorn City at the house west of the Poké Mart.
==Get ????? (FF) with arbitrary code execution==
To get [[?????|????? (FF)]], you can do the exact same Celebi trick described above, but with two extra stacks of Great Ball x4 below the first one (item 8). This is because Great Ball x4 corresponds to two of the opcodes 'inc b' (as one address is for the item identifier, and another is for the quantity), and the opcode 'inc b' increases the register 'b' by one. Normally the result here is FB; Celebi's index number, but having two extra Great Ball x4 adds four inc b, and FB + 4 = FF, which is ????? (FF)'s index number.
=="Hello world" program==
{{factcheck}}
[https://www.youtube.com/watch?v=lB2ja6p-sjg Video]
This trick was made by TheZZAZZGlitch and lets the player change the 'number of coins' to a Pokémon's nickname.
===Requirements===
Like the Celebi trick described above, this trick requires certain items in the PC, and the order matters. They are listed below.
{| border="1"
!Item
!Quantity
|-
|[ANY ITEM]
|[ANY QUANTITY]
|-
|[ANY ITEM]
|x38
|-
|TM27
|x2
|-
|Nugget
|x1
|-
[ANY ITEM]
|[ANY QUANTITY]
|-
|Surf Mail
|x46
|-
|Charcoal
|x1
|-
|[ANY ITEM]
|[ANY QUANTITY]
|-
|Squirtbottle
|x1
|-
|[ANY ITEM]
|[ANY QUANTITY]
|-
|Leaf Stone
|x1
|-
|[ANY ITEM]
|[ANY QUANTITY]
|-
|Ice Heal
|x62
|-
|Revive
|x7
|-
|Lovely Mail
|x60
|-
|Ultra Ball
|x34
|-
|Flower Mail
|x51
|-
|Max Repel
|x43
|-
|TM37
|x1
|-
|[ANY ITEM]
|[ANY QUANTITY]
|-
|Full Heal
|x18
|-
|Portraitmail
|x46
|-
|HM03
|x1
|-
|[ANY ITEM]
|[ANY QUANTITY]
|-
|TM41
|x1
|}
Like the species changing trick described above, a freshly caught low level Pokémon is needed, as well as a Quagsire holding a HP UP with Sleep Talk as its first move. Other requirements include the stored items above, the Coin Case, access to the Name Rater in Goldenrod City and the ability to use Fly to Goldenrod City and New Bark Town.
===Steps===
#Put the low level Pokémon in the third slot.
#Put the Quagsire in the fourth slot.
#Go to the Name Rater north of the Magnet Train station and change the first Pokémon's nickname to something that is 10 characters ('AAAAAAAAAA' is used in the video).
#Afterwards, change the nickname of the first Pokémon to something nine characters long, which will be what you want the Coin Case to display.
#Fly to New Bark Town and enter Prof. Elm's laboratory, save the game and reset.
#Exit the lab, take four steps right (so you're below the tree), then open the Pokédex and listen to Machoke's cry (other cries like Bellsprout may work, but they are unconfirmed).
#Switch to the Key Items pocket (it is important that you do the switch after listening to the cry and before using the Coin Case), then use the Coin Case.
#The first Pokémon's nickname will be displayed under 'Coins:' instead of the current amount of coins.
==Known 'random' but consistent effects==
This section lists effects that happen randomly, but may happen consistently after a player listens to a Pokémon's cry.
A Pokémon listed under any of these effect headers does not mean it will always cause the effect, but simply that it may without further manipulation.
The effects here happen for:
Saving the game and resetting next to the Machop in Vermilion City, and not moving before or after listening to the Pokémon's cry. But they commonly happen in other circumstances.
===Glitch Dimension===
{{main|Glitch Dimension}}
This was one of the first known applications of the glitch, and the described requirements were talking to the Machop flattening out the land in Vermillion City and then using the Coin Case.
However, the player does not need to talk to that particular Machop; the cry of any Machop may cause the same effect (not when following one of the arbitrary code execution steps described in earlier sections).
The cries of the following Pokémon in the Pokédex can be used to start a [[Glitch Dimension]].
#Bulbasaur{{fact}}
#Caterpie{{fact}}
#Metapod{{fact}}
#Weedle{{fact}}
#Kakuna{{fact}}
#Beedrill{{fact}}
#Pidgey{{fact}}
#Arbok{{fact}}
#Pikachu{{fact}}
#Raichu{{fact}}
#Nidoran♀{{fact}}
#Nidorina (without switching item pockets)
#Nidorino{{fact}}
#Clefairy (may require not having switched items pockets)
#Clefable (may require not having switched items pockets)
#Vulpix{{fact}}
#Ninetales{{fact}}
#Jigglypuff{{fact}}
#Wigglytuff{{fact}}
#Zubat{{fact}}
#Oddish{{fact}}
#Paras{{fact}}
#Diglett{{fact}}
#Dugtrio{{fact}}
#Psyduck{{fact}}
#Mankey{{fact}}
#Poliwhirl{{fact}}
#Abra{{fact}}
#Machop
#Machoke
#Machamp{{fact}}
#Bellsprout (works like Machop)
#Tentacool{{fact}}
#Geodude{{fact}}
#Magnemite{{fact}}
#Farfetch'd (after switching item pockets)
#Doduo{{fact}}
#Seel{{fact}}
#Drowzee{{fact}}
#Krabby{{fact}}
#Voltorb{{fact}}
#Hitmonlee{{fact}}
#Horsea
#Meganium (without switching item pockets)
#Cyndaquil{{fact}}
#Totodile{{fact}}
#Croconaw{{fact}}
#Natu{{fact}}
#Xatu{{fact}}
#Mareep{{fact}}
#Flaaffy{{fact}}
#Miltank{{fact}}
#Celebi
==
This effect is also known as the 'Dratini glitch'. It will cause the text 'Coins:Which move?PP of.' to pop up after viewing a certain cry and using the Coin Case. This text is long enough to go outside of the text box border.
The following cries have been confirmed to work:
#Charmander
#Charmeleon
#Squirtle
#Wartortle
#Butterfree
#Ekans
#Sandshrew
#Gloom
#Dratini
#Articuno
#Moltres
#Larvitar
==
This effect will cause the text 'Coins:Which move?PP of.' to pop up after viewing a certain cry, not switching item pockets, and using the Coin Case.
The cries of the following Pokémon
#Venusaur
#Dragonair
#Ho-oh
Line 43 ⟶ 327:
#Pupitar
===Other effects===
Other Coin Case glitch effects include game freezes and 'random' tiles being placed on the screen. The effects may depend on whether the player switched item pockets before viewing the Coin Case.
Here is a list of Pokémon that can cause effects other than a Glitch Dimension or the effects 'which move?he PP of.' or 'Which move?':
#Clefairy{{fact}}
#Clefable{{fact}}
#Paras (switching pockets before viewing the Coin Case may cause a different effect, including a tile being placed on the screen)
#Dodrio (may require not switching item pockets)
#Nidorina (
#Farfetch'd (without switching item pockets, it may freeze the game)
#Meganium (after switching item pockets the game may print a glitch character after the number of coins)
==See also==
#[[Arbitrary code execution]].
#[[Glitch Dimension]] - One of the effects which can be caused by a Coin Case Glitch.
#[[Game freeze]]
==External Links==
*[
*[https://www.youtube.com/watch?v=lB2ja6p-sjg Youtube: Pokémon Gold/Silver: Arbitrary code execution with Coin Case (hello world program)].
*[https://www.youtube.com/watch?v=SpfgOVfGVTo Youtube: Pokemon Gold/Silver: Yet another Celebi glitch, using Coin Case arbitrary code execution].
| |||