Party scrolling memory corruption
Party scrolling memory corruption is a glitch in Pokémon Red, Green, Blue, and Yellow documented by TheZZAZZGlitch (and Evie for the HRAM modification method). Note it may function differently in the Japanese versions.[clarification needed]
If the player does not want to use the expanded party, they can try the method described in no expanded party international Select glitching (currently allows for Pokémon 235-) even if the player doesn't have over 6 Pokémon, but without swapping the Pokémon.
Description
Using this glitch, simply leaving the cursor on a Pokémon beyond slot 6 will attempt to animate its menu sprite and corrupt memory addresses; making it a useful application to change a good portion of RAM addresses, and potentially aid in setting up applied glitches (such as changing the moves of a party Pokémon).
The Pokémon will animate at a certain rate (perhaps depending on how much HP it has). Every time the Pokémon animates, the memory address representing its tile number will increase by 0x40 with respect to exceeding 0xFF will loop the value back to 0x00; so three different corruptions of the original are possible (+0x40, +0x80 or +0xC0) modulo 256 depending on when the player chose to exit the selected Pokémon.
If the desired memory address to corrupt is far away, the player can choose to scroll quickly to try not to corrupt memory addresses before it.
Corruptible memory addresses
Without modification, the addresses modified will always end in 2, 6, A, or E (changes to the address with 2, 6, A and E may occur all at once). The available memory addresses are as such.
To find the address without the list, do C2F+n where n=1 for the first Pokémon (ignoring the last digit) and then reconsider the last digit; so for instance, C2F+FF=D2E, which means Pokémon 255 will corrupt D2E2, D2E6, D2EA and D2EE.
To find the cursor position of the Pokémon needed from an address without the list, subtract the address (with the last digit (X) removed) from C2F.
- C30X
- C31X
- C32X
- C33X
- C34X
- C35X
- C36X
- C37X
- C38X
- C39X
- C3AX
- C3BX
- C3CX
- C3DX
- C3EX
- C3FX
- C40X
- C41X
- C42X
- C43X
- C44X
- C45X
- C46X
- C47X
- C48X
- C49X
- C4AX
- C4BX
- C4CX
- C4DX
- C4EX
- C4FX
- C50X
- C51X
- C52X
- C53X
- C54X
- C55X
- C56X
- C57X
- C58X
- C59X
- C5AX
- C5BX
- C5CX
- C5DX
- C5EX
- C5FX
- C60X
- C61X
- C62X
- C63X
- C64X
- C65X
- C66X
- C67X
- C68X
- C69X
- C6AX
- C6BX
- C6CX
- C6DX
- C6EX
- C6FX
- C70X
- C71X
- C72X
- C73X
- C74X
- C75X
- C76X
- C77X
- C78X
- C79X
- C7AX
- C7BX
- C7CX
- C7DX
- C7EX
- C7FX
- C80X
- C81X
- C82X
- C83X
- C84X
- C85X
- C86X
- C87X
- C88X
- C89X
- C8AX
- C8BX
- C8CX
- C8DX
- C8EX
- C8FX
- C90X
- C91X
- C92X
- C93X
- C94X
- C95X
- C96X
- C97X
- C98X
- C99X
- C9AX
- C9BX
- C9CX
- C9DX
- C9EX
- C9FX
- CA0X
- CA1X
- CA2X
- CA3X
- CA4X
- CA5X
- CA6X
- CA7X
- CA8X
- CA9X
- CAAX
- CABX
- CACX
- CADX
- CAEX
- CAFX
- CB0X
- CB1X
- CB2X
- CB3X
- CB4X
- CB5X
- CB6X
- CB7X
- CB8X
- CB9X
- CBAX
- CBBX
- CBCX
- CBDX
- CBEX
- CBFX
- CC0X
- CC1X
- CC2X
- CC3X
- CC4X
- CC5X
- CC6X
- CC7X
- CC8X
- CC9X
- CCAX
- CCBX
- CCCX
- CCDX
- CCEX
- C#CFX
- C#D0X
- C#D1X
- C#D2X
- CD3X
- CD4X
- CD5X
- CD6X
- CD7X
- CD8X
- CD9X
- CDAX
- CDBX
- CDCX
- CDDX
- CDEX
- CDFX
- CE0X
- CE1X
- CE2X
- CE3X
- CE4X
- CE5X
- CE6X
- CE7X
- CE8X
- CE9X
- CEAX
- CEBX
- CECX
- CEDX
- CEEX
- CEFX
- CF0X
- CF1X
- CF2X
- CF3X
- CF4X
- CF5X
- CF6X
- CF7X
- CF8X
- CF9X
- CFAX
- CFBX
- CFCX
- CFDX
- CFEX
- CFFX
- D00X
- D01X
- D02X
- D03X
- D04X
- D05X
- D06X
- D07X
- D08X
- D09X
- D0AX
- D0BX
- D0CX
- D0DX
- D0EX
- D0FX
- D10X
- D11X
- D12X
- D13X
- D14X
- D15X
- D16X
- D17X
- D18X
- D19X
- D1AX
- D1BX
- D1CX
- D1DX
- D1EX
- D1FX
- D20X
- D21X
- D22X
- D23X
- D24X
- D25X
- D26X
- D27X
- D28X
- D29X
- D2AX
- D2BX
- D2CX
- D2DX
- D2EX
- D2FX
HRAM manipulation
More research is needed for this article.
| |
Reason given: More technical specifics |
Altering the glitch by altering FF81 in HRAM (currently, the only ways known to do this are with arbitrary code execution and possibly connection copier) will corrupt the memory in a different way relative to the new upper address in the memory (which was previously C3). If for instance, the OAM DMA buffer starts at C4XX, the first Pokémon may touch C3B4, the second C3DC, the third C404, the fourth C42C, the fifth C454 and the sixth C47C; which allows altering memory addresses later than before (as the old C3 value cannot be used to corrupt beyond D2FX+), hence from this relationship of +0x28 for the next Pokémon, C3B4+(0x28*[n-1])=the address to corrupt where n is the desired Pokémon slot, or (address/0x28)-(C3B3/0x28) is used to locate the cursor position the player was on (or needs to be on) before the corruption. Echo RAM may come into place, for example; the EB64 from slot 255 should touch CB64 on an accurate platform/emulator.
Details however are relative to the upper address chosen, and this same logic might not work for ones different to C4XX.
This article or section is a stub. You can help Glitch City Wiki by expanding it. |