Party scrolling memory corruption: Difference between revisions
No edit summary |
|||
(6 intermediate revisions by the same user not shown) | |||
Line 1: | Line 1: | ||
'''Party scrolling memory corruption''' is a glitch in {{RGBY}} documented by TheZZAZZGlitch (and Evie for the |
'''Party scrolling memory corruption''' is a glitch in {{RGBY}} documented by TheZZAZZGlitch (and Evie for the cursor tile corruption). Note it may function differently in the Japanese versions.{{clarify}} |
||
If the player does not want to use the [[expanded party]], they can try the method described in [[no expanded party international Select glitching]] (currently allows for Pokémon 235-) even if the player doesn't have over 6 Pokémon, but without swapping the Pokémon. |
|||
==Description== |
==Description== |
||
Line 175: | Line 177: | ||
#CCDX |
#CCDX |
||
#CCEX |
#CCEX |
||
#CCFX |
|||
#C#CFX |
|||
#CD0X |
|||
#C#D0X |
|||
#CD1X |
|||
#C#D1X |
|||
#CD2X |
|||
#C#D2X |
|||
#CD3X |
#CD3X |
||
#CD4X |
#CD4X |
||
Line 273: | Line 275: | ||
#D2FX |
#D2FX |
||
==Placement of the cursor tile== |
|||
==HRAM manipulation== |
|||
{{incomplete}} |
|||
{{Researchneeded|1=More technical specifics}} |
|||
The game writes 0xED to C3B4 (slot 1), C3DC (slot 2), C404 (slot 3), C42C (slot 4), C454 (slot 5) and C47C (slot 6). Slots beyond slot 6 continue in this pattern (address +0x28) each time. |
|||
Altering the glitch by altering FF81 in HRAM (currently, the only ways known to do this are with [[arbitrary code execution]] and possibly [[connection copier]]) will corrupt the memory in a different way relative to the new upper address in the memory (which was previously C3). If for instance, the OAM DMA buffer starts at C4XX, the first Pokémon may touch C3B4, the second C3DC, the third C404, the fourth C42C, the fifth C454 and the sixth C47C; which allows altering memory addresses later than before (as the old C3 value cannot be used to corrupt beyond D2FX+), hence from this relationship of +0x28 for the next Pokémon, C3B4+(0x28*[n-1])=the address to corrupt where n is the desired Pokémon slot, or (address/0x28)}-(C3B3/0x28) is used to locate the cursor position the player was on (or needs to be on) before the corruption. |
|||
Details however are relative to the upper address chosen, and this same logic might not work for ones different to C4XX. |
|||
{{clr}} |
{{clr}} |
||
{{stub}} |
{{stub}} |
Latest revision as of 13:00, 5 December 2021
Party scrolling memory corruption is a glitch in Pokémon Red, Green, Blue, and Yellow documented by TheZZAZZGlitch (and Evie for the cursor tile corruption). Note it may function differently in the Japanese versions.[clarification needed]
If the player does not want to use the expanded party, they can try the method described in no expanded party international Select glitching (currently allows for Pokémon 235-) even if the player doesn't have over 6 Pokémon, but without swapping the Pokémon.
Description
Using this glitch, simply leaving the cursor on a Pokémon beyond slot 6 will attempt to animate its menu sprite and corrupt memory addresses; making it a useful application to change a good portion of RAM addresses, and potentially aid in setting up applied glitches (such as changing the moves of a party Pokémon).
The Pokémon will animate at a certain rate (perhaps depending on how much HP it has). Every time the Pokémon animates, the memory address representing its tile number will increase by 0x40 with respect to exceeding 0xFF will loop the value back to 0x00; so three different corruptions of the original are possible (+0x40, +0x80 or +0xC0) modulo 256 depending on when the player chose to exit the selected Pokémon.
If the desired memory address to corrupt is far away, the player can choose to scroll quickly to try not to corrupt memory addresses before it.
Corruptible memory addresses
Without modification, the addresses modified will always end in 2, 6, A, or E (changes to the address with 2, 6, A and E may occur all at once). The available memory addresses are as such.
To find the address without the list, do C2F+n where n=1 for the first Pokémon (ignoring the last digit) and then reconsider the last digit; so for instance, C2F+FF=D2E, which means Pokémon 255 will corrupt D2E2, D2E6, D2EA and D2EE.
To find the cursor position of the Pokémon needed from an address without the list, subtract the address (with the last digit (X) removed) from C2F.
- C30X
- C31X
- C32X
- C33X
- C34X
- C35X
- C36X
- C37X
- C38X
- C39X
- C3AX
- C3BX
- C3CX
- C3DX
- C3EX
- C3FX
- C40X
- C41X
- C42X
- C43X
- C44X
- C45X
- C46X
- C47X
- C48X
- C49X
- C4AX
- C4BX
- C4CX
- C4DX
- C4EX
- C4FX
- C50X
- C51X
- C52X
- C53X
- C54X
- C55X
- C56X
- C57X
- C58X
- C59X
- C5AX
- C5BX
- C5CX
- C5DX
- C5EX
- C5FX
- C60X
- C61X
- C62X
- C63X
- C64X
- C65X
- C66X
- C67X
- C68X
- C69X
- C6AX
- C6BX
- C6CX
- C6DX
- C6EX
- C6FX
- C70X
- C71X
- C72X
- C73X
- C74X
- C75X
- C76X
- C77X
- C78X
- C79X
- C7AX
- C7BX
- C7CX
- C7DX
- C7EX
- C7FX
- C80X
- C81X
- C82X
- C83X
- C84X
- C85X
- C86X
- C87X
- C88X
- C89X
- C8AX
- C8BX
- C8CX
- C8DX
- C8EX
- C8FX
- C90X
- C91X
- C92X
- C93X
- C94X
- C95X
- C96X
- C97X
- C98X
- C99X
- C9AX
- C9BX
- C9CX
- C9DX
- C9EX
- C9FX
- CA0X
- CA1X
- CA2X
- CA3X
- CA4X
- CA5X
- CA6X
- CA7X
- CA8X
- CA9X
- CAAX
- CABX
- CACX
- CADX
- CAEX
- CAFX
- CB0X
- CB1X
- CB2X
- CB3X
- CB4X
- CB5X
- CB6X
- CB7X
- CB8X
- CB9X
- CBAX
- CBBX
- CBCX
- CBDX
- CBEX
- CBFX
- CC0X
- CC1X
- CC2X
- CC3X
- CC4X
- CC5X
- CC6X
- CC7X
- CC8X
- CC9X
- CCAX
- CCBX
- CCCX
- CCDX
- CCEX
- CCFX
- CD0X
- CD1X
- CD2X
- CD3X
- CD4X
- CD5X
- CD6X
- CD7X
- CD8X
- CD9X
- CDAX
- CDBX
- CDCX
- CDDX
- CDEX
- CDFX
- CE0X
- CE1X
- CE2X
- CE3X
- CE4X
- CE5X
- CE6X
- CE7X
- CE8X
- CE9X
- CEAX
- CEBX
- CECX
- CEDX
- CEEX
- CEFX
- CF0X
- CF1X
- CF2X
- CF3X
- CF4X
- CF5X
- CF6X
- CF7X
- CF8X
- CF9X
- CFAX
- CFBX
- CFCX
- CFDX
- CFEX
- CFFX
- D00X
- D01X
- D02X
- D03X
- D04X
- D05X
- D06X
- D07X
- D08X
- D09X
- D0AX
- D0BX
- D0CX
- D0DX
- D0EX
- D0FX
- D10X
- D11X
- D12X
- D13X
- D14X
- D15X
- D16X
- D17X
- D18X
- D19X
- D1AX
- D1BX
- D1CX
- D1DX
- D1EX
- D1FX
- D20X
- D21X
- D22X
- D23X
- D24X
- D25X
- D26X
- D27X
- D28X
- D29X
- D2AX
- D2BX
- D2CX
- D2DX
- D2EX
- D2FX
Placement of the cursor tile
This article is incomplete. Please feel free to add any missing information about the subject. It is missing: {{{1}}}. |
The game writes 0xED to C3B4 (slot 1), C3DC (slot 2), C404 (slot 3), C42C (slot 4), C454 (slot 5) and C47C (slot 6). Slots beyond slot 6 continue in this pattern (address +0x28) each time.
This article or section is a stub. You can help Glitch City Wiki by expanding it. |