Pikachu off-screen glitch
This article is a summary page for different variations of a glitches, etc. when talked about as a whole. |
Pikachu off-screen glitch, also Pikawalk, Pikachu's glitch ([1]) refers to a number of glitches in Pokémon Yellow, in which the player walks around while Pikachu is off the screen and data is corrupted from D438 onward, with values based on the steps that the player made.
It also refers to glitches to put Pikachu off the screen from glitch items such as Rival's effect and Lg- (hex:6E), or exploring a Glitch City, which allow the player to perform the glitch anywhere easily.
The glitch item and Glitch City methods were discovered by Paco81 and Torchickens, and the natural glitches later discovered by Sally. Pikachu off-screen glitch text box arbitrary code execution was discovered by stumpdotio. The Pikachu off-screen Trainer corruption glitch was discovered by LanceandMissingno.
Pikachu off-screen glitch is also an exploit from glitch items such as Rival's effect and Lg- (hex:6E), or exploring a Glitch City, which allow the player to perform the glitch anywhere easily.
Natural glitch exploits
You can trigger Pikachu off screen glitches without a glitch item or a Glitch City.
The off-screen glitches in this section only require an event in normal gameplay that makes Pikachu stay.
Events that make Pikachu stay
1) Talking to the Pewter City Pokémon Center Jigglypuff. (can be done at any point in game)
2) Two Bill's house "Poké-Bill" events.
3) Going into the Pokémon Fan Club in Vermilion City and having Pikachu fall in love with Clefairy.
Possible glitches
1) Getting stuck in a Glitch City, known as a Super Glitch City.
2) A freeze which may destroy the save data.
3) A Pikachu exclamation appearing and Pikachu getting stuck out of bounds (Bill event, Clefairy event).
4) Letting Bill give you the S.S. Anne ticket as a Pokémon. You have to write 02 to D4E4, so you need to walk up (up has a value of 02) after a certain number of steps with Pikachu off screen.
5) Causing NPCs to move when they shouldn't.
6) Achieve arbitrary code execution with a glitch text box.
Youtube Video:
| |
Via glitch items
Applicable glitch items for the Pikachu off-screen glitch include:
- The glitch item Lg- (hex:6E) - makes Pikachu stay.
- The item 9F, hex:5E - makes Pikachu stay but may cause a Glitch City in some places. Thanks EstebanZD Glitcher.
- A Rival's effect (Jack effect) item, such as hex:94 - doesn't make Pikachu stay but can put him off the screen and desync him. Thanks luckytyphlosion.
Lg- is available through item underflow glitch and pPkMnp' ' (special 194)'s mutation of the fifth item when it's a Super Rod.
Additionally, all glitch items are available through an item underflow glitch and the Celadon looping map trick.
Via Glitch Cities
The Sea Route 20 Glitch City from the Safari Zone exit glitch first has Pikachu off the screen when you appear on the map. Making two steps down and walking left/right will keep Pikachu off the screen and corrupt data from D438.
| |
Corruption details
The more steps the player takes the more values are corrupted from D438, and each value depends on how the player makes a step. After the game reaches D536 (address may vary) it is assumed no bytes further than it are corrupted and the corruption starts again from the beginning. To corrupt this far the player will likely need walk through walls enabled, either via a glitch or cheating.
The values are as follows:
- South=01
- North=02
- West=03
- East=04
Tricks
Set Pikachu's happiness (D46F) to a low value 01-05
Walk 56 steps with Pikachu off-screen.
Get 255:59 hours play time
This is for the Sea Route 20 Glitch City method, but may occur through other methods as well. With Pikachu off-screen, walk to the door in the Safari Zone exit Sea Route 20, then one tile west of the left-most of two "H"s, and repeat.
Cause a Super Glitch City
Walk 244 steps or so with Pikachu off-screen.
Make Pikachu do the winking emote. (D49B=01)
With Pikachu off-screen, step south after walking 99 steps (Lg- or 9F), then talk to Pikachu. If you're using the Rival's effect item this is much easier, because it forces the game to think all of Pikachu's movements are 01 if you use it when Pikachu is facing down and don't cancel out from the 'party sprites on screen out of menu' effect.
Make Pikachu do the fishing emote (D49B=02)
With Pikachu off-screen, step north after walking 99 steps (Lg- or 9F), then talk to Pikachu. If you're using the Rival's effect item this is much easier, because it forces the game to think all of Pikachu's movements are 02 if you use it when Pikachu is facing up and don't cancel out from the 'party sprites on screen out of menu' effect.
Make Pikachu do the confused emote (D49B=03)
With Pikachu off-screen, step west after walking 99 steps (Lg- or 9F), then talk to Pikachu. If you're using the Rival's effect item this is much easier, because it forces the game to think all of Pikachu's movements are 03 if you use it when Pikachu is facing west and don't cancel out from the 'party sprites on screen out of menu' effect.
Make Pikachu do the disapproval emote (D49B=04)
With Pikachu off-screen, step east after walking 99 steps (Lg- or 9F), then talk to Pikachu. If you're using the Rival's effect item this is much easier, because it forces the game to think all of Pikachu's movements are 04 if you use it when Pikachu is facing east and don't cancel out from the 'party sprites on screen out of menu' effect.
Max out Pikachu's happiness (D46F=FF)
1) Activate a walk through walls glitch, such as the ledge method. The museum guy method might work too. 2) Go to this position a certain position[clarification needed] and step left. 3) Make 56 steps by walking one step up, and then one step down (i.e. go up, then down, then up, then down, then up, then down). 4) Make one step right so you're back in Fuchsia City and wait for a while. Bytes from D438-D46F will fill up with FFs, and since happiness is D46F, Pikachu happiness maxes out.
Pikachu off-screen glitch Trainer corruption glitch
This technique was discovered by LanceandMissingno.
Corrupting addresses D4E3 onward (making 171+ steps with Pikachu off the screen) corrupts NPC Trainer data for the current map in the format class of Trainer 1, text of Trainer 1, class of Trainer 2, text of Trainer 2, etc.
Addresses D503 onward control NPC Trainer data for the current map in the format class of Trainer 1, roster of Trainer 1, class of Trainer 2, roster of Trainer 2, etc. Unlike the earlier addresses if you change these class addresses it will actually change the Trainer class, and values below 200 (C8) do not result in Trainers but rather Pokémon. Plus you can change the roster (if Trainer) or level (if Pokémon).
At least some of the Trainer information addresses are in the range of corruption from the off-screen glitch.
So, by walking a specific number of steps with Pikachu off-screen and doing the last step in a certain direction, you can encounter Pokémon 01-04 (Rhydon, Kangaskhan, Nidoran♂ and Clefairy). If you're using Lg- this is easiest to pull off as long as you walk around with Pikachu off the screen after he stays and don't save and reset after.
But if you do save and reset it may cause problems for getting one of these Pokémon where Pikachu will start walking around and FF/other value corruption occurs.
There is a workaround to this via the Rival's effect item. You have to use the item when facing the direction/value you want (e.g. south=01). This would cause values to be written as 01 regardless of the direction you take when Pikachu is invisible, and make it so that the FF/other value corruption is minimal by making Pikachu invisible until only he is close to the Trainer you corrupt, and then quickly/without much steps talk to the Trainer.
You can battle an FF glitch Trainer if the FF corruption (caused by Pikachu walking around in unexpected ways after previously being on screen) happens in the right address and doesn't change. But if it's roster FF, it won't be a ZZAZZ glitch Trainer, just a regular FF glitch Trainer. Certain rosters for Trainer FF like roster 8 are ZZAZZ glitch Trainers however.
It is possible to battle level 255 Pokémon if you FF corrupt the roster/level with the Rival's item, somehow get Pikachu to re-appear by opening/closing the Pokémon menu after Pikachu is invisible, then start to walk around with Pikachu off the screen again just until corruption of a Trainer class (or Pokémon if less than C8) but not their roster (level).
| |
Glitch text box activation and arbitrary code execution
By using the Pikachu off-screen glitch and making specific movements to force the non-existing sign 04 to appear at coordinates x=1, y=1 in the Vermilion City Fan Club, it is possible for the player to execute arbitrary text commands beginning from $D221 (the catch rate/held item of party Pokémon 5). By putting a 0x08 byte (the text_asm
text command) either immediately at $D221 or after some "slide" text commands, the player can turn this into a full ACE exploit.
The steps to activate this glitch text box are:
- Trigger the Clefairy event in the Vermilion Fan Club.
- Go to the bottom-left walkable tile (putting Pikachu off the screen), then walk up to the top and down to the bottom of the left-most column 11 times, but for the 11th time step one tile short on the final way back down.
- Step right, step left, then walk up to the top and down to the bottom of the left-most column 10 times.
- Step right, then go the top-left tile you can walk to, face right and press A.
Explanation |
---|
This method assumes that the player enters the Vermilion Fan Club through the Vermilion City.
After these steps, the game recognizes sign 04 at (1, 1), and reading it will cause the game to try to display the text with ID 11 in Vermilion Fan Club (in text command mode, since that is the normal behavior for |
This technique was discovered by stumpdotio, originally for speedrunning Pokémon Yellow. A video of the route by Dabomstew's may be found here.
Arbitrary code execution setups
Multiple setups has been found to use this glitch text box for arbitrary code execution. To do arbitrary code execution, do one of the following setups with party Pokémon 5 and prepare the payload in the item pack, before doing the above steps to activate the glitch text box.
The below setups all jump to item 1 in the pack.
Luckless setups
5 different setups to use for this trick have been made by Krys3000 and Torchickens/ChickasaurusGL in this thread. They all execute code from item 3 in the pack, similarly to ws m or 4F setups.
- The 4 moves setup involves as 5th Pokémon in the party a Nidorina or Nidorino. It has to have been traded to G/S/C, hold a Moon Stone there and then be traded back to Yellow. This Pokémon must have 2 'placeholder moves' (typically Bite and Fury Swipes, since it learns both) followed by Double Kick (also learned) and Bubblebeam (TM11). Also, the 6th Pokémon can be anything but requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
- The 2 moves + HP/Box Level setup involves as 5th Pokémon a Nidorina or Nidorino. It has to have been traded to G/S/C, hold a Moon Stone there and then be traded back to Yellow. This Pokémon must have Double Kick (learned) as first move and Take Down (TM09) as second. Also, the 6th Pokémon can be anything but must have 24 HP currently and also have been lvl24 last time it was stored in the PC. This Pokémon requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
- The 4 moves + Glitch Pokémon setup involves as 5th Pokémon the glitch Pokémon PKMN pゥぁ ゥぇ (0xCE), that can be obtained via several glitches, such as Rival LOL glitch (no trading needed), equivalent trade or Time Capsule exploit. This Pokémon must have Ice Punch, DoubleSlap, Double Kick and BubbleBeam (all can be learned except Bubblebeam which is TM11). Also, the 6th Pokémon can be anything but requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
- The Untrained Hitmonchan setup is also a tradeless/glitchless setup. 5th Pokémon would be Hitmonchan and this Pokémon must never have been trained, but must know Strength (HM), Agility, Fire Punch and Ice Punch (it requires rising it to lvl 38 with Rare Candies). This Pokémon must also have 00 PP currently at Strength, 24 at Agility, 14 at Fire Punch (Ice Punch doesn't matter). Also, 6th Pokémon can be anything but must be lvl25, requires currently 24 HP, 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also). The code can be broken at any time by Hitmonchan's IV. The best way is to reset the pick of Hitmonchan to make sure that yours work. For this setup to work, you must also check that when converted into hexadecimal, Hitmonchan's trainer ID won't trigger invalid opcodes or many-bytes opcodes
- The underflow-based setup is described here.
A video of the Hitmonchan setup has been made by ChickasarusGL
| |
Luck-based setup
A Graveler with 08 c2 (2242) HP stat experience and 1d d3 (7635) Attack stat experience may be used as an applicable Pokémon 5, preferably a Graveler from Victory Road.
If you are using level 44 Graveler, make note that since you can't really predict its total exp. you may not be able to get your result dictated by items. However, saving before the last few Krabby to get different levels or keeping Rare Candies, saving before talking to the text box and using one if it didn't work last time may fix this.
To get these specific EVs, your Pokémon needs to have encountered the following Pokémon (and no more):
71 Krabby, 1 Farfetch'd, 1 Dugtrio, and 1 Magnemite.
(Thanks FMK for working out what Pokémon to battle).
Example codes (all from item 1)
Notice that since text box based ACE happens on a different code path than glitch item based ACE, item codes for the latter may not be immediately usable for the former. In particular, the game will try to continue to display text from hl, so to avoid complications, it is necessary to point hl somewhere near a 0x50 terminator.
Obtain 255 items
The following code gives you an expanded item pack. This allows you to do 20+ items related glitches and get more complicated item set ups if you have items like multiple X Special x1 spare.
- Protein x1
- Repel x1
- X Accuracy x28
- Lemonade x1
- Poké Ball x61
- Antidote x61
- Water Stone x37
- X Accuracy x97
- TM01 x1
Note: This code may be unstable.
Encounter a Pokémon
- Iron x37
- X Accuracy x88
- Lemonade x(species you want, 21=Mew)
- Water Stone x4
- Protein x4
- TM01 x1
| |
- ↑ RAM layout for the variable
wNumSigns
, and the arrayswSignCoords
andwSignTextIDs
- ↑ Definition of sign 04 in Vermilion City (the text ID is the third number in
bg_event 12, 3, 11
) - ↑ Definitions of texts in the Vermilion Fan Club map
- ↑ This out-of-bound text pointer falls in the first two bytes of this instruction.
FanClubText1.yellowtext
is $16:53D2, so this instruction translates to "21 D2 53".