Glitch item

From Glitch City Wiki
Revision as of 16:25, 19 December 2017 by >Torchickens
Arbitrary code execution in the Pokémon series

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Serial interrupt ACE | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | Type 0xFF mail arbitrary code execution (Japanese Crystal) | ZZAZZ glitch Trainer FC


List of arbitrary code execution programs

(view, talk, edit)
Major glitches of the Pokémon series


Arbitrary code execution

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC


No further extensions

Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)


Buffer overflow techniques

99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)


Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch


Bad clone glitch (Generation II)

????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))


Closed menu Select glitches (Japanese Red/Green)

Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch


Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch


Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)


2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch


Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)


Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick


Pikachu off-screen glitch

Trainer corruption glitch


SRAM glitches

Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches


Trainer escape glitch

Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation


Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls


Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))

(view, talk, edit)

Glitch items are invalid items in the Pokémon games. Unavailable items such as Pokémon FireRed and LeafGreen key items in Pokémon Emerald may also be considered to be glitch items, as well as unused/unavailable items such as ????? (hex:07) and BoulderBadge (hex:15) — see unused items.

Glitch items may have special uses (in Generations I and II), different names (in Generation I and to an extent Generation II) and Poké Mart buy and sell price data.

Some glitch items such as "9F" (hex:5E) in Pokémon Red and Blue or Pokémon Yellow, or "RIVAL'S" (hex: A2) in Red and Blue, or "o" (hex:94) in Yellow always have the same use(s).

Other glitch items execute data in writable memory, with a select few glitch items such as such as "8F" in Pokémon Red and Blue (hex:5D) and "ws m" in Pokémon Yellow (hex:63) being ideal for arbitrary code execution.

In Pokémon Red, Green, Blue, and Yellow

Glitch items occupy index numbers hex:00, hex:54 through to hex:C3 and hex:FB through to hex:FF.

Many glitch items are available with the Celadon looping map trick, Item creation glitch (a Select glitch in Red/Green/Blue), Yami Shop glitch and other Poké Mart vendor glitches.

Examples of particularly useful glitch items include:

Name Index number (hexadecimal) Index number (decimal) Game Uses
j. 00 0 Pokémon Red and Blue One of the most common glitch items, which can be sold for a high price of 414925 Pokédollars.
#×## 00 0 Pokémon Yellow One of the most common glitch items, which can be sold for a high price of 414925 Pokédollars.
CascadeBadge 16 22 Pokémon Red, Blue, Yellow Throw a rock and double a wild Pokémon's catch rate.
4F 59 89 Pokémon Red, Blue, Yellow Arbitrary code execution (initially runs FA65 in the Echo RAM region, equivalent to DA65 in Day Care data)
5かい 5A 90 Pokémon Red, Green, Blue (Japanese) Arbitrary code execution (initially runs D123; Pokémon data)
8F 5D 93 Pokémon Red and Blue Arbitrary code execution (initially runs D163; Pokémon data)
9F 5E 94 Pokémon Yellow Reload a map and bring graphics back to normal after a Super Glitch induced Glitch City.
9F 5E 94 Pokémon Red and Blue Restart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch). Overflowing the stack.
かいがらバッヂ (Shell Badge) 63 99 Pokémon Yellow (Japanese) Arbitrary code execution (initially runs D9B2; stored Pokémon data).
ws m 63 99 Pokémon Yellow Arbitrary code execution (initially runs DA7F; stored Pokémon data).
はやぶさバッヂ (FalconBadge) 65 101 Pokémon Yellow (Japanese, v1.1+) Causes arbitrary code execution at 0xD4CA (ninth PC item).
なかよしバッヂ (FriendBadge) 67 103 Pokémon Red, Green, and Pokémon Blue (Japanese) Arbitrary code execution (initially runs D983, number of Safari Balls and the Day Care data, stored Pokémon data which follows. A special Day Care Pokémon name can be used to redirect the code directly to a location of the player's choice, otherwise if there is no Safari Ball/Day Care data, stored Pokémon data can be used like English Yellow's ws m and English Red/Blue's -g m.
ゴールドバッヂ (GoldBadge) 6A 106 Pokémon Red and Green (Japanese, v1.0) May act as a Poké Mart with 240 items. Can be used to buy Rare Candies (with specific data in RAM) and Master Balls.
ゴールドバッヂ (GoldBadge) 6A 106 Pokémon Yellow (Japanese, v1.1+) Acts as a Pokémon Center nurse.
-g m 6A 106 Pokémon Yellow Restart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch)
-g m 6A 106 Pokémon Red and Blue Arbitrary code execution (initially runs DA47; in which Safari Zone data and Day Care data follows. If this is blank; code will 'fall through' to DA80; stored Pokémon data).
Lg- 6E 110 Pokémon Yellow Restart a Trainer battle. Partially escape from a wild battle (useful for LOL glitch). Make walking Pikachu stay (useful for Pikachu off-screen glitch).
????? 07 07 Pokémon Red, Blue, Yellow Acts outside of battle like using the field move Surf. Can also be used to change to the wrong music bank inside of a battle if used in a battle facing water.
(blank) 78 120 Pokémon Red and Blue Restart the music. Change to an overworld (02, 1F) sound bank from the sound bank (08). Play the music with ID at D35B with bank at D35C (D35B, D35C can be manipulated with expanded items pack).
てへ 7B 123 Pokémon Red and Green Arbitrary code execution (initially runs D806; wild Pokémon data or temporary player name storage for the old man battle) and an unterminated name glitch item.
え゙円にグぅ4えやけぼ 7B 123 Pokémon Blue (Japanese) Unterminated name glitch item in Red/Green v1.1. Arbitrary code execution (initially runs D806; wild Pokémon data or temporary player name storage for the old man battle).
♀へん 7C 124 Pokémon Yellow (Japanese, v1.0) Steal other Trainer's Pokémon.
8 8 7C 124 Pokémon Red and Blue Create encounter chains from a Trainer escape glitch encounter by using it when the menu pops up in a specific map. Must be used indirectly via unterminated name glitch item, or in combination with a unterminated name glitch item, to avoid a freeze when CFC4 is odd.
PC 80 128 Pokémon Red and Blue Unterminated name lagless glitch item (useful for LOL glitch). Hex:00 item effect freeze.
2pゥ 92 146 Pokémon Yellow Unterminated name lagless glitch item (useful for LOL glitch). Acts as an Ultra Ball.
o 94 148 Pokémon Yellow Activate the Rival's effect. Otherwise if used on a Pokémon may act like a Lemonade.
RIVAL'S A2 164 Pokémon Red and Blue Activate the Rival's effect. Otherwise if used on a Pokémon may acts like an item with no noticeable effect.

In Pokémon Gold, Silver and Crystal

Glitch items in Pokémon Gold, Silver and Crystal occupy a number of index numbers, as such:

Hex ID Dec ID Item
00 0 ?
06, 19, 2D, 32, 38, 46 (G/S only), 5A, 64, 73 (G/S only), 74 (G/S only), 78, 81 (G/S only), 87, 88, 89, 8D, 8E, 91, 93, 94, 95, 99, 9A, 9B, A2, AB, B0, B3, BE 5, 19, 45, 32, 38, 46 (G/S only), 90, 100, 115 (G/S only), 116 (G/S only), 120 (G/S only), 129 (G/S only), 135, 136, 137, 141, 142, 145, 147, 148, 149, 153, 154, 155, 162, 171, 176, 179, 190 Teru-Sama
C3 195 TM04 (useless)
DC 220 TM28 (useless)
FA 250 HM08 (Generation II glitch item)
FB 251 HM09 (Generation II glitch item)
FC 252 HM10 (Generation II glitch item)
FD 253 HM11 (Generation II glitch item)
FE 254 HM12 (Generation II glitch item)
FF 255 HM13/CANCEL/Berry

Note that Teru-Sama items which are not Teru-Sama in Crystal are the key items "Clear Bell" (hex:46), "GS Ball" (hex:73), "Blue Card" (hex:74) and "Egg Ticket" (hex:81) respectively.

TMs and HMs outside of the correct pocket

In addition to the regular glitch items in Gold, Silver, Crystal, all of the normal TMs and HMs will serve as glitch items when used outside of the TM/HM pack, due to having invalid execution pointers.

Below are a number of useful TMs and HMs to use outside of the relevant pocket.

(Sources: [1], [2], [3])

Hex ID Dec ID Item Version Use
CE 206 TM15 Crystal (Japanese) Executes arbitrary code from FA10 (Echo RAM for DA10, which is somewhere in the expanded Balls pocket. If "(item) x195", "Star Piece x 252" (represents C3 84 FB - a jump to FB84, box 4 name character 2) are stored at DA0F, then this will serve as a bootstrap code to stored box Pokémon names.
CE 206 TM15 Crystal (English) Executes arbitrary code from FA10 (Echo RAM for DA10, which is somewhere in the expanded Balls pocket.
D0 208 TM17 Crystal (English) Executes arbitrary code from FA47 (Echo RAM for DA47, which is somewhere in the expanded Balls pocket.
D0 208 TM17 Gold/Silver (English) Executes arbitrary code from FA47 (Echo RAM for DA47, which is the caught data for party Pokémon 1. The player can make a jump to somewhere more useful (via C3 yy xx), using Pokémon 1 as a slide Pokémon if necessary.
D4 212 TM21 Crystal (English) Executes arbitrary code from FA69 (Echo RAM for DA69, which is somewhere in the expanded Balls pocket; like TM21.
D8 216 TM25 Crystal (English) Executes arbitrary code from FA69 (Echo RAM for DA69, which is somewhere in the expanded Balls pocket; like TM25.
D8 216 TM25 Gold/Silver (English) Executes arbitrary code from FA6A (Echo RAM for DA6A, and DA6A is the least significant Defense EV byte of the second Pokémon in the party. The Speed EVs word follows, and the player can make a jump to somewhere more useful (via C3 yy xx). This may be possible without trading, but getting the exact EVs would be tedious and it would be hard to keep track of them without a memory viewer. Through arbitrary code execution in Pokémon Red, Blue, and Yellow, the second Pokémon may be manipulated to have Defense and Speed EV values that the player desires.
E1 225 TM33 Crystal (English) Executes arbitrary code from F418 in Echo RAM (essentially D418); the third character of the fifth enemy Pokémon's nickname. Through arbitrary code execution in Pokémon Red, Blue, and Yellow, the player may rename this Pokémon to include a jump instruction (e.g. to C3 F2 D8 bytes which reads jp D8F2, i.e. jumps to the first item in the item storage system).
EF 239 TM47 Gold/Silver (English) Allows the player to offset their position on the map, as documented here.

In Pokémon Ruby, Sapphire and Emerald, Pokémon FireRed and LeafGreen

There are many glitch items in these games named "????????" with no apparent use other than for arbitrary code execution setup. The hex:FFFF "????????" can be distinguished for having the 'return to menu' sprite as its sprite.

These items are available through a double corruption with the Pomeg corruption glitch to force a Pokémon holding one. It is also possible to obtain a ???????? with the Mail and Trick glitches in Japanese Pokémon Ruby and Sapphire.

One way of obtaining them with the Pomeg corruption glitch is through corrupting the in-game trade Pokémon DOTS the Seedot with Defense and Speed EVs spelling out the index number of the desired items with at least 1 HP EV (so it isn't corrupted into an empty space).

In Pokémon Diamond, Pearl and Platinum, Pokémon HeartGold and SoulSilver

These games feature a hex:0000 glitch item which is referred to as "None" when forced as a Poké Mart gift. There are also glitch items with index numbers between hex:0071 and hex:0086, and a large number of other glitch items which may be nameless.

External links