Glitch City RAM manipulation (Cut abuse)

From Glitch City Wiki
Revision as of 13:36, 26 October 2016 by >ISSOtm (→‎Possible values: Added a decimal conversion table. It's more useful.)
Major glitches of the Pokémon series


Arbitrary code execution

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC


No further extensions

Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)


Buffer overflow techniques

99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)


Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch


Bad clone glitch (Generation II)

????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))


Closed menu Select glitches (Japanese Red/Green)

Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch


Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch


Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)


2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch


Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)


Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick


Pikachu off-screen glitch

Trainer corruption glitch


SRAM glitches

Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches


Trainer escape glitch

Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation


Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls


Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))

(view, talk, edit)


Glitch City RAM manipulation is a glitch that allows the player to edit RAM by cutting trees in a specific Glitch City, named RAM City. This allows the player to change a value in RAM from a specific set to another specific value.


Uses

Using this glitch, the player is able to edit arbitrary bytes in RAM. However, there are restrictions :

  • Only a few fixed values can be changed.
  • Each of these values change to another fixed value.
  • Not every byte can be changed this way.


General pattern

The glitch is essentially three steps :

  1. Accessing the RAM City
  2. Finding the correct place
  3. Cutting the tree.

The only true requirement is the ability to CUT. The current methods of accessing the Glitch City currently require the player to access Fuchsia City, but a method only requiring Pewter City will maybe be developed.


Accessing the Glitch City

TheZZAZZGlitch's method

This method is simple to perform, and only requires the player to have enough money to access the Safari Zone and the ability to SURF. Its downsides are that the player has less options when it comes to choosing their RAM address, and also has to have beaten Koga and found the Secret House.

  1. The player must perform the Safari Zone exit glitch, being called by the PA on Sea Route 20 (the place the player is when being recalled does not matter).
  2. Upon exiting the Safari Zone gate, the player should be standing in the Sea Route 20 Glitch City.
  3. The player should step south once, the go left until they are two steps above a cave. Going any further left will trap the player in a glitched area.
  4. The player should be stuck. If so, press Up to face north.
  5. Then, open the START menu. If done correctly, the map should be flooded with water.
  6. The player should SURF, then move right.
  7. The player will be in the RAM City, at coordinates ($6C ; $63)

Krys' method

This method offers a wide range of manipulable addresses, but it requires the player to perform Walk through walls.

  1. Perform any method of Walk through walls.
  2. The player should stand here :
     
  3. The RAM City can be accessed by walking left until the player is standing on water ; the player will be at coordinates ($DC ; $63).


Reaching the correct place

Each method place the player at different coordinates ; any coordinates correspond to a 2x2 tiles block, which correspond to a byte in RAM. Here is the formula :

Target address = $C721 + $38 * (floor(Vpos / 2) + 2) + (floor(Hpos / 2) + 2)

Note that the same address is targeted by moving 1 step up or 38 steps left !

Coordinates are given like so : (Vpos ; Hpos).

To get the optimal coordinates of address A, do the following :

  1. Subtract $C721 from A ; call that B.
  2. Divide B by $38, rounding down ; call that C.
  3. Multiply C by $38 ; call that D.
  4. Subtract D from B ; call that E.
  5. Your destination coordinates are (C*2 ; E*2) !
Actually, these aren't the optimal coordinates... you can sometimes save some walking left by going one less time up. Oh well.


Cutting the tree

The player should find a cuttable tree in one of the following coordinates : (C*2 ; E*2), (C*2+1 ; E*2), (C*2 ; E*2+1) and (C*2+1 ; E*2+1). Cutting it will change the byte in RAM, and that's it !

Side note : the player may find, instead of a cuttable tree, a patch of wild encounter grass. Did you know this grass can be CUT in Gen 1 ? Now you do.

Possible values

Obviously, we need the value of the byte we want to change to spawn a cuttable tree. Good news, there is a few values that do just that. All values in the following table are hexadecimal. Refer to The Big HEX List for corresponding Pokémon, Items and Attacks.

Hexadecimal conversion table :

Value... 0B 32 33 34 35 60
will become... 0A 6D 6C 6F 4C 6E

Decimal conversion table :

Value... 11 50 51 52 53 96
will become... 10 109 108 111 76 110

Applications