PP copier glitch

This article is incomplete. Please feel free to add any missing information about the subject. It is missing: Mechanics for specific corruptions.

The PP copier glitch is a buffer overflow glitch which occurs in Generation I when the game attempts to draw "PP" on the screen over four times, due to corruption of CD6C (wNumMovesMinusOne). Though this situation is usually impossible, it can occur when:

• CD6C is corrupted (e.g. with a specific Brock Through Walls)
• The player has a Pokémon with - as the top move (e.g. with Ditto and the swapping Transform moves glitch). This makes the game skip changing CD6C to the usual number of moves.

This glitch appears to write "PP" in unrelated memory addresses, allowing for side effects like the corruption of Pokémon nicknames (which could potentially be used to get an unterminated name Pokémon and stats, without corrupting the player's name.

Note that this glitch might not be safe with high values for CD6C if it corrupts meta-map scripts.

In Pokémon Red/Blue

The following method is an example.

Requirements

• D322 (item 3) must read 0F 23 E7 DA (Paralyze Heal x 35, TM31 x 218).
• The player must have a Rival's effect item such as ItemDex/RB:148. To do that, a glitch such as item duplication glitch for a x255 stack and dry underflow glitch is necessary.
• The Pewter Gym guide must be preserved (the player can skip him with the Pewter Gym skip glitch).
• The player's PC box should have no 0xFF bytes for the first 5 Pokémon (so Pokémon with 255 as the catch rate by default such as Pidgey and Rattata should be avoided).
• The sixth Pokémon in the PC box must have specific PP for move 3, corresponding with the desired number of PPs to copy on the screen. A PP underflow glitch can be used to get a value of 255 (then 254 after one use of the move).
• The player must have the Pokémon with - as the top move.
• The expanded item pack and an Escape Rope may be needed to escape a Pokémon Center Glitch City.

Steps

• Use the Rival's effect item to appear one step above the Pewter Gym guide.
• Talk to the gym guide to enable Brock Through Walls; corrupting CD6C, then terminate it e.g. by entering a building.
• Though the Start menu is disabled, the player can interact with the PC at a Pokémon Center and use it to view the status of the Pokémon with - as the top move.
• Many "PPs" will be printed on the screen, and various memory is corrupted; such as the levels and nicknames of Pokémon in the party and PC.
• Change boxes to save the game, then reset the game to avoid a freeze.
• Manipulate wCurMapTileset (D367; item 37 quantity) to a value that allows leaving the map with Escape Rope (e.g. 03). Though the animation might be glitched and lag, this can be used to escape the map. If Fly flags were corrupted, attempting to Fly away may be impossible due to the unterminated Fly destinations glitch.

Explanation

The relevant subroutine in the Pokémon Red disassembly is StatusScreen2:

ldh a, [hTileAnimations]
	push af
	xor a
	ldh [hTileAnimations], a
	ldh [hAutoBGTransferEnabled], a
	ld bc, NUM_MOVES + 1
	ld hl, wMoves
	call FillMemory
	ld hl, wLoadedMonMoves
	ld de, wMoves
	ld bc, NUM_MOVES
	call CopyData
	callfar FormatMovesString
	hlcoord 9, 2
	lb bc, 5, 10
	call ClearScreenArea ; Clear under name
	hlcoord 19, 3
	ld [hl], $78
	hlcoord 0, 8
	ld b, 8
	ld c, 18
	call TextBoxBorder ; Draw move container
	hlcoord 2, 9
	ld de, wMovesString
	call PlaceString ; Print moves
	ld a, [wNumMovesMinusOne]
	inc a
	ld c, a
	ld a, $4
	sub c
	ld b, a ; Number of moves ?
	hlcoord 11, 10
	ld de, SCREEN_WIDTH * 2
	ld a, "<BOLD_P>"
	call StatusScreen_PrintPP ; Print "PP"
	ld a, b
	and a
	jr z, .InitPP
	ld c, a
	ld a, "-"
	call StatusScreen_PrintPP ; Fill the rest with --
.InitPP
	ld hl, wLoadedMonMoves
	decoord 14, 10
	ld b, 0
.PrintPP
	ld a, [hli]
	and a
	jr z, .PPDone
	push bc
	push hl
	push de
	ld hl, wCurrentMenuItem
	ld a, [hl]
	push af
	ld a, b
	ld [hl], a
	push hl
	callfar GetMaxPP
	pop hl
	pop af
	ld [hl], a
	pop de
	pop hl
	push hl
	ld bc, wPartyMon1PP - wPartyMon1Moves - 1
	add hl, bc
	ld a, [hl]
	and $3f
	ld [wStatusScreenCurrentPP], a
	ld h, d
	ld l, e
	push hl
	ld de, wStatusScreenCurrentPP
	lb bc, 1, 2
	call PrintNumber
	ld a, "/"
	ld [hli], a
	ld de, wMaxPP
	lb bc, 1, 2
	call PrintNumber
	pop hl
	ld de, SCREEN_WIDTH * 2
	add hl, de
	ld d, h
	ld e, l
	pop hl
	pop bc
	inc b
	ld a, b
	cp $4
	jr nz, .PrintPP

YouTube video

YouTube video by ChickasaurusGL

This article or section is a stub. You can help Glitch City Wiki by expanding it.