Anonymous user
Meta-map script activation: Difference between revisions
→Map 0xFE corruption
>Bbbbbbbbba (Needless to say, I found this video too late.) |
|||
| (18 intermediate revisions by 3 users not shown) | |||
Line 2:
{{Bulbapedia2|0 ERROR}}
'''Meta-map script activation''' refers to a set of [[glitch]]es in {{RBY}}. These glitches will modify the "meta-map script" (also known as GameProgressFlags in the Pokémon disassembly projects<ref>[https://github.com/pret/pokered/blob/master/ram/wram.asm Pokémon Red disassembly project WRAM]</ref><ref>[https://github.com/pret/pokeyellow/blob/master/ram/wram.asm Pokémon Yellow disassembly project WRAM]</ref>) associated with a certain map, which is a special map script used to execute code on particular maps (one byte for each map). An example of a meta-map script is one that sets the event in Pallet Town where Professor Oak stops the player from walking into the grass. It is disabled later thanks to the game changing the ID of the meta-map script later.
Several variations of the [[Trainer escape glitch]] can modify the meta-map script in unintended ways on the location that the player escaped from the Trainer.
One of the most characteristic effects of meta-map script activation is the '''[[#"Walking_lag" effect|walking lag effect]]''', also known as '''0 ERROR''', or '''Zero Error''' (due to an error code that appears in a text box when the player brings up the start menu). Apart from making the player wait a long time between steps (hence the name "walking lag") and the error code, glitchy sound effects and game freezes may also happen, depending on the player's coordinates and time spent on the map.
<!-- If the player loses, a text box may appear before the player is sent back to their black out location. --> <!-- Without context it's hard to understand what this is trying to say. -->
Certain invalid meta-map scripts also allow for [[arbitrary code execution]].
==Activation==
The glitch can be pulled off by three variations of the [[Trainer escape glitch]].
Line 84 ⟶ 77:
[[Image:Zeroerror9.png]]
=== Manually setting up a glitch script with stored PC items ===
Setting up the dry underflow glitch with stored PC items allows the player to manipulate certain meta-map scripts by modifying the item past item 50.
For example, item 100's quantity controls the map script for Route 8 (address D601 in Red/Blue, D600 in Yellow). Though a quantity of 1 for this item will set up a CD2D/Special-stat encounter (as if activating the Trainer escape glitch), out of bounds values are glitch scripts associated with this glitch. As in the usual Trainer escape glitch, bit 0 of $CD60 and $D730 must not be set for the CD2D/Special-stat encounter to appear. If the encounter doesn't occur even after preparing the Special stat/or CD2D, the player still has to reset them by changing boxes and resetting the game, and pushing a Strength boulder/having another Trainer walk up to the player [[Trainer escape glitch#Special stat encounter|etc.]]
This method is ideal for altering a meta-map script at ease, especially if it corresponds to an item quantity. The player may also be able to manipulate all 256 meta-map scripts for the map (but if the script corresponds with an item, manipulating a Cancel (0xFF) for script 255 might be harder). Furthermore, as there are only 256 item/quantity pairs in the expanded PC and the addresses after item 128 quantity are a mirror of items 1-128 again, it is usually only possible to corrupt up to D63A (W_MANSION1CURSCRIPT) in Red/Blue or D639 (both W_CINNABARISLANDCURSCRIPT and W_MANSION1CURSCRIPT) in Yellow this way.
The first meta-script address in both Red/Blue and Yellow is W_OAKSLABCURSCRIPT (Red/Blue, D5F0/ Yellow, D5EF) and is PC item 91's quantity. The last accessible ones W_MANSION1CURSCRIPT (Red/Blue, D63A) and W_CINNABARISLANDCURSCRIPT/W_MANSION1CURSCRIPT (Yellow, D639) are PC item 128's quantity.
=== Triggering mechanism with the Trainer escape glitch ===
Line 96 ⟶ 93:
Of course, when the Trainer escape glitch is active, everything becomes a mess. First, the meta-map script ID is already 1 (DisplayEnemyTrainerTextAndStartBattle), so the text box sets it to 3 (usually already out of bounds). Furthermore, if this text box itself is displayed by the meta-map script, DisplayEnemyTrainerTextAndStartBattle, then the script will increase the meta-map script ID again to 4. All of this happens before the fight (which will always be against the trainer, since the text box sets the enemy data, overwriting any special stats/attack stages last encountered) actually begins.
What happens after the fight will depend on what the meta-map script ID 4 (or 3 if the trainer is talked to directly) points to.
==Common effects==
Concrete examples of the effects below can be found in the [[Pokémon Blue any% No Save Corruption speedrun route|Blue any% run]].
===Repeated trainer fights===
On most maps with meta-map scripts, what comes after the table of script pointers is a table of text pointers. In particular, the first few glitch meta-map scripts are likely to be trainer's texts.
As mentioned before, trainer's texts are all text scripts that may initiate the battle, and they follow the same pattern:
TX_ASM ; 08
ld hl, SomeTrainerHeaderAtXXYY ; 21 yy xx
call TalkToTrainer ; CD CC 31
Here TX_ASM is a byte of 0x08 that signifies script in text. When this pointer is executed as a meta-map script, the game tries to interpret the 0x08 itself as code instead, which leads to:
ld [$
call TalkToTrainer ; CD CC 31
jp TextScriptEnd ; C3 D7 24
Since trainer headers are on switchable ROM Banks, the high byte of the address of one of them (xx) is always between 0x40 and 0x7F, and those values happen to all correspond to relatively "safe" (i.e. not jumps) one-byte assembly instructions.
In the grand scheme of things, the most important instruction is calling TalkToTrainer, which takes hl as the address of the trainer header. In particular, if the instruction denoted as <xx> doesn't change hl, then hl will be the address of the glitch meta-map script itself. This leads to more nonsense interpretation for the same piece of data, this time as a trainer header.
db $08 ; bit of "trainer beaten" event flag
db $21 ; trainer's view range
dw $
dw $CCCD ; pointer to text before battle
dw $C331 ; pointer to text when talked to after defeated
dw $24D7 ; pointer to text when defeated
Hence the game checks "bit 8 of $
Unlike the [[Trainer escape glitch#Special stat encounter|special stat encounter]], on this code path, the trainer class and the roster number depends on the "last text box ID". In particular, if the meta-map script is arrived by fighting a trainer, then the fight it triggers is still against the same trainer, since TalkToTrainer itself never changes this ID.
==="Walking lag" effect===
In the above case, the "trainer defeated" flag is some unrelated data, so another possibility is that it is 1 ("already defeated"). In this case, the script just displays the "text when talked to after defeated". However, since this is a piece of glitch text on a glitched code path, instead of a text box, glitches happen.
* When actually talking to a trainer, the text script is executed through DisplayTextID, which sets up a lot of things to transition from "overworld mode" to "text box mode". The glitch meta-map script directly executes TalkToTrainer without setting up all that, which means any text is printed on an invisible screen buffer, and cannot be seen normally.
** The text can be seen by bringing up the Start menu, but due to the "lag" effect explained below, it may be necessary to mash the Start button.
* However, the game will still try to hide any sprites behind the text box, which leads to sprites near the bottom of the screen disappearing without apparent reasons.
* The "text" is taken from $C331, which is actually the the second byte of the fourth sprite in the OAM buffer.
** If there has never been at least four sprites on the screen since the last fight (exiting a fight clears OAM), then the address will begin with two bytes of 0x00. The first 0x00 is interpreted as a text command to display what follows as a text string, and the second 0x00 is interpreted as a control character, which triggers an [[error trap]], printing "%d ERROR." and ending the text display. Here "%d" is a temporary variable in HRAM that is supposed to be the ID of the current text displayed by DisplayTextID, but since we didn't come from that code path, it is usually the ID of the last text displayed.
** If there has been more than four sprites on the screen, then the address may contain several glitch text commands. Since glitch text commands are usually interpreted as sounds, glitchy sounds will play.
* Since DisplayTextID usually takes care of the last button press to close a text box, this glitch text box will close without an input.
* '''The above process happens on every overworld frame as long as the player isn't in the middle of a step.''' Since displaying text takes time (depending on the player's text speed option), the player will only be able to move or interact in-between those invisible glitch text boxes, resulting in an apparent "walking lag".
* Finally, in this case, the above-mentioned instruction "ld [$yy21], sp" may also show an effect. The effect depends on the value of yy, which in turn depends on the map and the script ID. For example, if $yy21 is in the OAM buffer, then the top left quarter of some sprite on the screen may be flickering.
Under this state, trainers won't see the player (because that is handled by the normal meta-map script), but the player can still talk to trainers to initiate a fight, which will advance the meta-map script ID by 2.
== Map 0xFE corruption ==
After the player enters [[map 0xFE (English Yellow)|Pokémon Yellow's map 0xFE]] without a freeze using a safe level-script pointer for DC0E, they will be warped to map 0x99 (a house in Fuchsia City).
After using the expanded items pack to escape this map (as the exit by default will link back to the house), the player will be able to access maps with invalid meta-map scripts.
The scripts written by map 0xFE corruption are always the same, as the corruption for D5EF+ is due to the game copying ROM data from 20:5193 onward into that portion of RAM (possibly in the middle of 20:4F14 SurfingPikachu1Graphics1).
{| class="wikitable"
! Address !! Label !! New script ID (HEX) !! Source of corruption
|-
| D5EF || W_OAKSLABCURSCRIPT || 0 || 20:5193
|-
| D5F0 || W_PALLETTOWNCURSCRIPT || 0 || 20:5194
|-
| D5F1 || || 0 || 20:5195
|-
| D5F2 || W_BLUESHOUSECURSCRIPT || 0 || 20:5196
|-
| D5F3 || W_VIRIDIANCITYCURSCRIPT || 0 || 20:5197
|-
| D5F4 || || 38 || 20:5198
|-
| D5F5 || || 38 || 20:5199
|-
| D5F6 || W_PEWTERCITYCURSCRIPT || 4 || 20:519A
|-
| D5F7 || W_ROUTE3CURSCRIPT || 4 || 20:519B
|-
| D5F8 || W_ROUTE4CURSCRIPT || 3C || 20:519C
|-
| D5F9 || || 3C || 20:519D
|-
| D5FA || W_VIRIDIANGYMCURSCRIPT || 44 || 20:519E
|-
| D5FB || W_PEWTERGYMCURSCRIPT || 44 || 20:519F
|-
| D5FC || W_CERULEANGYMCURSCRIPT || 3E || 20:51A0
|-
| D5FD || W_VERMILIONGYMCURSCRIPT || 3E || 20:51A1
|-
| D5FE || W_CELADONGYMCURSCRIPT || 0 || 20:51A2
|-
| D5FF || W_ROUTE6CURSCRIPT || 0 || 20:51A3
|-
| D600 || W_ROUTE8CURSCRIPT || 2 || 20:51A4
|-
| D601 || W_ROUTE24CURSCRIPT || 2 || 20:51A5
|-
| D602 || W_ROUTE25CURSCRIPT || 2 || 20:51A6
|-
| D603 || W_ROUTE9CURSCRIPT || 2 || 20:51A7
|-
| D604 || W_ROUTE10CURSCRIPT || 2 || 20:51A8
|-
| D605 || W_MTMOON1CURSCRIPT || 2 || 20:51A9
|-
| D606 || W_MTMOON3CURSCRIPT || 3E || 20:51AA
|-
| D607 || W_SSANNE8CURSCRIPT || 3E || 20:51AB
|-
| D608 || W_SSANNE9CURSCRIPT || 42 || 20:51AC
|-
| D609 || W_ROUTE22CURSCRIPT || 42 || 20:51AD
|-
| D60A || || 42 || 20:51AE
|-
| D60B || W_REDSHOUSE2CURSCRIPT || 42 || 20:51AF
|-
| D60C || W_VIRIDIANMARKETCURSCRIPT || 3E || 20:51B0
|-
| D60D || W_ROUTE22GATECURSCRIPT || 3E || 20:51B1
|-
| D60E || W_CERULEANCITYCURSCRIPT || 0 || 20:51B2
|-
| D60F || || 0 || 20:51B3
|-
| D610 || || 0 || 20:51B4
|-
| D611 || || 0 || 20:51B5
|-
| D612 || || 0 || 20:51B6
|-
| D613 || || 0 || 20:51B7
|-
| D614 || || 3C || 20:51B8
|-
| D615 || || 3C || 20:51B9
|-
| D616 || W_SSANNE5CURSCRIPT || 22 || 20:51BA
|-
| D617 || W_VIRIDIANFORESTCURSCRIPT || 22 || 20:51BB
|-
| D618 || W_MUSEUM1FCURSCRIPT || 22 || 20:51BC
|-
| D619 || W_ROUTE13CURSCRIPT || 22 || 20:51BD
|-
| D61A || W_ROUTE14CURSCRIPT || 22 || 20:51BE
|-
| D61B || W_ROUTE17CURSCRIPT || 22 || 20:51BF
|-
| D61C || W_ROUTE19CURSCRIPT || 22 || 20:51C0
|-
| D61D || W_ROUTE21CURSCRIPT || 22 || 20:51C1
|-
| D61E || W_SAFARIZONEENTRANCECURSCRIPT || 0 || 20:51C2
|-
| D61F || W_ROCKTUNNEL2CURSCRIPT || 0 || 20:51C3
|-
| D620 || W_ROCKTUNNEL1CURSCRIPT || FE || 20:51C4
|-
| D621 || || FE || 20:51C5
|-
| D622 || W_ROUTE11CURSCRIPT || 10 || 20:51C6
|-
| D623 || W_ROUTE12CURSCRIPT || 10 || 20:51C7
|-
| D624 || W_ROUTE15CURSCRIPT || 10 || 20:51C8
|-
| D625 || W_ROUTE16CURSCRIPT || 10 || 20:51C9
|-
| D626 || W_ROUTE18CURSCRIPT || 10 || 20:51CA
|-
| D627 || W_ROUTE20CURSCRIPT || 10 || 20:51CB
|-
| D628 || W_SSANNE10CURSCRIPT || 10 || 20:51CC
|-
| D629 || W_VERMILIONCITYCURSCRIPT || 10 || 20:51CD
|-
| D62A || W_POKEMONTOWER2CURSCRIPT || 10 || 20:51CE
|-
| D62B || W_POKEMONTOWER3CURSCRIPT || 10 || 20:51CF
|-
| D62C || W_POKEMONTOWER4CURSCRIPT || 10 || 20:51D0
|-
| D62D || W_POKEMONTOWER5CURSCRIPT || 10 || 20:51D1
|-
| D62E || W_POKEMONTOWER6CURSCRIPT || 0 || 20:51D2
|-
| D62F || W_POKEMONTOWER7CURSCRIPT || 0 || 20:51D3
|-
| D630 || W_ROCKETHIDEOUT1CURSCRIPT || 0 || 20:51D4
|-
| D631 || W_ROCKETHIDEOUT2CURSCRIPT || 0 || 20:51D5
|-
| D632 || W_ROCKETHIDEOUT3CURSCRIPT || 0 || 20:51D6
|-
| D633 || W_ROCKETHIDEOUT4CURSCRIPT || 0 || 20:51D7
|-
| D634 || || 3C || 20:51D8
|-
| D635 || W_ROUTE6GATECURSCRIPT || 3C || 20:51D9
|-
| D636 || W_ROUTE8GATECURSCRIPT || 42 || 20:51DA
|-
| D637 || || 42 || 20:51DB
|-
| D638 || || 42 || 20:51DC
|-
| D639 || W_CINNABARISLANDCURSCRIPT/W_MANSION1CURSCRIPT || 42 || 20:51DD
|-
| D63A || || 42 || 20:51DE
|-
| D63B || W_MANSION2CURSCRIPT || 42 || 20:51DF
|-
| D63C || W_MANSION3CURSCRIPT || 3C || 20:51E0
|-
| D63D || W_MANSION4CURSCRIPT || 3C || 20:51E1
|-
| D63E || W_VICTORYROAD2CURSCRIPT || 0 || 20:51E2
|-
| D63F || W_VICTORYROAD3CURSCRIPT || 0 || 20:51E3
|-
| D640 || || 10 || 20:51E4
|-
| D641 || W_FIGHTINGDOJOCURSCRIPT || 10 || 20:51E5
|-
| D642 || W_SILPHCO2CURSCRIPT || 10 || 20:51E6
|-
| D643 || W_SILPHCO3CURSCRIPT || 10 || 20:51E7
|-
| D644 || W_SILPHCO4CURSCRIPT || 10 || 20:51E8
|-
| D645 || W_SILPHCO5CURSCRIPT || 10 || 20:51E9
|-
| D646 || W_SILPHCO6CURSCRIPT || 10 || 20:51EA
|-
| D647 || W_SILPHCO7CURSCRIPT || 10 || 20:51EB
|-
| D648 || W_SILPHCO8CURSCRIPT || 10 || 20:51EC
|-
| D649 || W_SILPHCO9CURSCRIPT || 10 || 20:51ED
|-
| D64A || W_HALLOFFAMEROOMCURSCRIPT || 10 || 20:51EE
|-
| D64B || W_GARYCURSCRIPT || 10 || 20:51EF
|-
| D64C || W_LORELEICURSCRIPT || 10 || 20:51F0
|-
| D64D || W_BRUNOCURSCRIPT || 10 || 20:51F1
|-
| D64E || W_AGATHACURSCRIPT || 0 || 20:51F2
|-
| D64F || W_UNKNOWNDUNGEON3CURSCRIPT || 0 || 20:51F3
|-
| D650 || W_VICTORYROAD1CURSCRIPT || 0 || 20:51F4
|-
| D651 || || 0 || 20:51F5
|-
| D652 || W_LANCECURSCRIPT || 10 || 20:51F6
|-
| D653 || || 10 || 20:51F7
|-
| D654 || || 0 || 20:51F8
|-
| D655 || || 0 || 20:51F9
|-
| D656 || || 10 || 20:51FA
|-
| D657 || W_SILPHCO10CURSCRIPT || 10 || 20:51FB
|-
| D658 || W_SILPHCO11CURSCRIPT || 10 || 20:51FC
|-
| D659 || || 10 || 20:51FD
|-
| D65A || W_FUCHSIAGYMCURSCRIPT || 10 || 20:51FE
|-
| D65B || W_SAFFRONGYMCURSCRIPT || 10 || 20:51FF
|-
| D65C || || 10 || 20:5200
|-
| D65D || W_CINNABARGYMCURSCRIPT || 10 || 20:5201
|-
| D65E || W_CELADONGAMECORNERCURSCRIPT || 0 || 20:5202
|-
| D65F || W_ROUTE16GATECURSCRIPT || 0 || 20:5203
|-
| D660 || W_BILLSHOUSECURSCRIPT || 0 || 20:5204
|-
| D661 || W_ROUTE5GATECURSCRIPT || 0 || 20:5205
|-
| D662 || W_POWERPLANTCURSCRIPT/W_ROUTE7GATECURSCRIPT || 0 || 20:5206
|-
| D663 || || 0 || 20:5207
|-
| D664 || W_SSANNE2CURSCRIPT || 0 || 20:5208
|-
| D665 || W_SEAFOAMISLANDS4CURSCRIPT || 0 || 20:5209
|-
| D666 || W_ROUTE23CURSCRIPT || 0 || 20:520A
|-
| D667 || W_SEAFOAMISLANDS5CURSCRIPT || 0 || 20:520B
|-
| D668 || W_ROUTE18GATECURSCRIPT || 7E || 20:520C
|}
== Fixing the glitch ==
Line 138 ⟶ 408:
==List of meta-map script addresses==
''See [[MetascriptDex]]. There are also some differences between the Red/Blue and Yellow layouts.''
== YouTube video ==
{{Youtube|f0tx96EkkrM|Crystal_}}
== References ==
<references/>
[[Category:Generation I glitches]]
| |||