Jump to content

Duplicate key items glitch: Difference between revisions

Expanded. I've decided to remove some of the TM33 ACE information to move into the arbitrary code execution article instead.
>Torchickens
No edit summary
>Torchickens
(Expanded. I've decided to remove some of the TM33 ACE information to move into the arbitrary code execution article instead.)
Line 1:
{{Major glitches}}
<!--Some information taken from ChickasaurusGL's TM33 arbitrary code execution video https://www.youtube.com/watch?v=BgCJxChdonc with permission-->
{{incomplete}}
This '''Duplicateduplicate Key Items glitch''' is a glitch in {{GSC}}, in which the player swaps two identical key items that(obtained allowsvia byte shifting from [[????? party overloading]]) in the itemKey pack,Items andpocket usingto aobtain moreitems precise(such setup,as infinite use Rare Candies) or allow the player to set up an expanded Balls pocket to containwith more than the maximum amount of items.
 
The reason the player obtains arbitrary items in the Key Items seems to be related to the facts that both: item quantities in the Key Items do not exist, and the game tries to merge the two stacks into one stack with a combined quantity.
 
Using the expanded Balls pocket, the player is able to use TMs and HMs from the wrong pocket for their own glitchy effects and [[arbitrary code execution]] (e.g. via TM33 in English Crystal, TM15 in English Crystal and TM25 in English Gold and Silver).
==Requirements==
* Two {{GSC}} games on two different Game Boys
* A link cable
* Access to the Cable Club on both games
* Machine Parts and SecretPotion on both games
 
These TMs run code from the enemy Trainer's fifth Pokémon's nickname character 3 (TM33) or somewhere in the expanded Balls pocket.
 
Furthermore, the player can also enable [[glitch Pokédex categories]] (such as glitch Pokédex mode 09 in English Crystal for arbitrary code execution in the expanded Balls pocket) as well.
 
==Via arbitrary code execution==
This trick requires being able to set up [[arbitrary code execution]] on {{RBY}}. You may use 8F or ws m in Generation I to change the catch rate of Pokémon to value(s) corresponding to key items. (see [[The Big HEX List]] to see which IDs correspond to which key items)
 
==Via [[bad clone glitch]] and [[????? party overloading]]==
Using tricks from ????? party overloading, the player can manipulate a key item as a held item on a Pokémon. This can be done in practise by using move PkMn w/o mail to obtain a seventh Pokémon, placing a Pokémon in slot 1 with a specific move then performing 1-4 shifts (depending on the position of the move) to shift the move ID into an equivalent held item ID. (see The Big HEX List to see which IDs correspond to which moves and held items)
 
 
==Infinite items examples==
Example 1:
 
If we have the following items:
 
Lost Item
 
Lost Item
 
Card Key
 
Basement Key
 
Cancel
 
Then swapping the first Lost Item with the second Lost Item will make us lose the original second Lost Item and Card Key but the second Lost Item will turn into a Master Ball with quantity 133 (Basement Key's index number). The Master Ball can be used infinitely because it is in the wrong pocket.
 
If we have the following items:
 
 
Lost Item (index no. 130)
 
Lost Item (index no. 130)
 
Card Key (index no. 127)
 
Basement Key (index no. 133)
 
Cancel (index no. 255)
 
If we swap the first Lost Item with the second, we lose the original second Lost Item and the Card Key, but the second Lost Item will turn into a Master Ball with quantity 133 (Basement Key's index number). The reason why the second item turns into a Master Ball in this example is because the Card Key is index number 127 (7F) and the Lost Item is index number 130 (82). Adding these together gives 257, but since items are defined by one byte, this becomes 257 modulo 256 or 1, which is Master Ball's index number.
 
Therefore we get:
 
Lost Item (index no. 130)
 
Master Ball (index no. 257 == 1) x133
 
CANCEL (index no. 255)
 
Example 2:
 
If the sum of the first Key Item's index number and the item below the second Key Item is greater than 100, then the third item is not lost, but becomes a BLK Apricorn (index no. 99). The second item identifier becomes equal to that of the sum of the first Key Item index number and the original third item minus 99. Its quantity is derived from the new third item identifier.
 
For example, consider the following Key Items pack:
 
Lost Item (index no. 130)
 
Lost Item (index no. 130)
 
Master Ball (index no. 1) x7
 
Bicycle (index no. 7)
Cancel
 
If we swap the first Key Item with the second this gives us:
 
Lost Item (index no. 130)
 
Rare Candy (index no. 32 [130+1-99] )
 
BLK Apricorn (index no. 99)
 
Bicycle (index no.7)
 
CANCEL (index no. 255)
 
===Expanded items pack===
If you want to set up the expanded Balls pocket, change the catch rate of two Pokémon to 128 and 67 each. When traded to a Generation II game they will be holding Machine Parts and Secretpotions.
 
==Performing the glitch==
# Give the Machine Parts to a Pokémon
# Trade it to the other game
# Take the Machine Parts off the traded Pokémon
# Repeat with the SecretPotion (you can use the same Pokémon as before)
# On the game with two SecretPotions and two Machine Parts
# Put both Machine Parts in the last two slots of the Key Items pocket
Line 25 ⟶ 97:
 
==Expanded Balls pocket==
Using specific duplicate key items, it is possible to enable the expanded balls pocket, which can later be used for memory corruption by swapping items in the pocket or arbitrary code execution via [[glitch item|TMs/HMs outside of the correct pocket]] or [[glitch Pokédex categories]].
If the item ID of the first ball in the Ball pocket will be written into the item counter, meaning that a Fast Ball (hex:A1) will give 161 items in the Balls pocket (which is far beyond the normal limit)
 
First the key items pocket must be filled with 25 items including two Machine Parts and two Secretpotions:
 
Then..
==Arbitrary code execution in {{C}}==
{{Youtube|BgCJxChdonc|ChickasaurusGL}}
===Requirements===
* Two Game Boys
* A {{RB}} or {{Y}} game
* A {{GS}} or {{C}} game
* Another {{C}} game, that has a TM33 in the first PC item slot
* A link cable
* Access on all games to a Cable Club
 
===Performing the glitch===
# Use 8F ({{RB}}) or ws m ({{Y}}) to obtain a Pokémon with the following nickname : (any character)x2, hex:C3, hex:F2, hex:D8, then whatever you want
# Trade it to one of the Gen II games
# On the other, perform the Expanded Balls pocket glitch
 
 
# Put both Machine Parts in the last two slots of the Key Items pocket
# Swap both items to create Iron x99 and Blk Apricorn x10
# Put both SecretPotions in the last two slots of the Key Items pocket
# Swap these, and all bytes up to the Cancel in the Balls pocket will be shifted upwards, with the ID of the first item becoming the number of Balls.
 
Note that this is not the only way to access the expanded balls pocket. The Pokémon Speedruns wiki [http://archive.is/IEmNE details a different method] involving two Itemfinders.
[[Category:Generation I glitches]]
[[Category:Generation II glitches]]
[[Category:Glitches between two generations]]
Anonymous user
Cookies help us deliver our services. By using our services, you agree to our use of cookies.