Pomeg data corruption glitch: Difference between revisions
>Torchickens m Torchickens moved page Glitzer Popping to Pomeg corruption glitch over redirect |
>Torchickens No edit summary |
||
Line 3:
{{incomplete}}
{{bulbapedia}}
[[File:Jirachi Egg.png|frame|right|Jirachi hatching from an Egg obtained from
'''
It is particularly notable for allowing the player to hatch an Egg containing any Pokémon in the game as well as many [[glitch Pokémon]], by placing specific Pokémon in storage box 1 and 2.
The name
Due to a memory address location randomization mechanic known as [[DMA]], it can take many attempts for the player to get their desired corruption with the glitch.
Line 31:
'''Pokémon FireRed/LeafGreen''':
The initial steps for
==Exploits==
When the player scrolls past Pokémon beyond slot 6, to access Pokémon beginning from Pokémon 255 and working down, they will corrupt the data of unrelated data managed as a non-existing Pokémon.
In {{Emerald}}, the data which the player is able to corrupt with
{|
Line 70:
===Pokémon Storage Box corruption===
====Accessing Super Glitch moves====
Line 81:
====Decaswitch====
Decaswitch is a derivative of Pokémon Storage Box corruption discovered by voltage which is possible if one of the Pokémon in the Pokémon Storage System becomes an invisible Decamark Bad Egg.
Decaswitch allows a player to perform both Pomeg Glitch and
{{youtube|QB67-pKKY3Q|Metarkrai M}}
====Hatch any Pokémon====
This is a popular exploit of
In box 1 and 2 of the Pokémon Storage System, the player may place copies of Pokémon applicable for the glitch (obtained with cloning; ideally with the [[Battle Tower Pokémon cloning glitch (Emerald)|Battle Tower Pokémon cloning glitch]]) with attributes (e.g. Attack and HP EVs or a move) with an ID which would be converted into a species ID.
Line 92:
If the player is unsuccessful with the glitch after many attempts, they may attempt to place different Pokémon next to the Pokémon applicable for the glitch, referred to as [[corruption initiator]]s for example they could try random Pokémon or (if the glitch was successful before) they could try placing a specific Caterpie known as "[http://forums.glitchcity.info/index.php?topic=6868.msg198505#msg198505 Caterpie the perfect initiator]" next to SEASOR knowing Waterfall, Protect, Surf, Return (US)/no move (FR).
In order to know whether the Pokémon is applicable for the glitch and if so; which attribute needs to be converted into a species ID, the player must know the Pokémon's personality value and data substructure (determined by the Pokémon's personality value modulo 24). It is difficult to know a Pokémon's personality value (unless theoretically the Pokémon is a Spinda) without using an external device. For an illustration on how this works, see the [[
However, thanks to Emerald's RNG, it is possible to easily determine the PID of a Pokémon that was caught right after soft-resetting by calculating its IVs and finding back the frame that generated the Pokémon.
Line 149:
====Double corruption====
Double corruption is a method of obtaining a Pokémon in the Pokémon Storage System without hatching it. In order to exploit a double corruption, the player should attempt the steps to [[
During a double corruption, it is important that the player never picks up the Pokémon in the box with the glove otherwise the glitch will not work.
Line 156:
====Pokémon News Reporter corruption====
Pokémon News Reporter corruption is a derivative of using the [[
====="Guess Who?" glitch=====
Line 186:
{{youtube|HkKAmpz7_SY|ChickasaurusGL}}
=====Instant Pomeg glitch=====
Instant Pomeg glitch is a useful trick which allows the player to perform
Glitch Pokémon 0x96B4 and 0x29C2 are examples of glitch Pokémon which enable instant Pomeg glitch in US Pokémon Emerald.
Line 192:
====New line arrow glitch====
The new line arrow glitch occurs when a Pokémon has a 'new line' (hex:FB) character in its nickname. This Pokémon may be obtained rarely by performing
The new line arrow character causes a number of effects depending on the version, incuding:
Line 217:
===Switch cloning===
A method of [[Pokémon cloning]] with the access Pokémon beyond slot six glitch was discovered by
===White Decamark effect===
Line 223:
===NPC corruptions===
====Script corruptions====
If the player performs
[http://forums.glitchcity.info/index.php?topic=6868.msg196959#msg196959 Reportedly] the NPC outside of the Winstrate family house on Route 111 can be corrupted to a shop vendor, where talking to them brings up a BUY/QUIT option and items can be purchased (possibly glitch decorations) that are sent to the player's PC.
Line 237:
Script corruption may be used in FireRed/LeafGreen to disable the guard to the S.S. Anne from checking if the player has a ticket, if the player performs the scrolling after fishing in Vermilion City. This may also be used to reboard the S.S. Anne or Surf in the harbour to where [[S.S. Anne Ship Truck|the truck]] is.
====Access behind the Day Care====
===Day Care corruption===
===Flag corruptions===
====Evergrande City Fly flag====
====Southern Island====
{{youtube|nNGMcLyrpAQ|Metarkrai M}}
====Faraway Island and Birth Island====
{{main|Access Faraway Island glitch}}.
{{main|Access Birth Island glitch}}.
In non-English versions of Pokémon Emerald including the French, German, Spanish and Italian versions of Emerald, it is possible for the player to use Pokémon News Reporter corruption with a specific glitch Pokémon (obtained with
===Overworld position corruption===
=====Surfing/Walking on Cycling Road=====
Rarely after [[
This will make the player go through a 'door' that leads into the water on Route 110 near the Cycling Road and the player is able to surf through Cycling Road. Going through the right-most door of the Cycling Road's entrance and out will allow the player to walk on Cycling Road.
Line 266:
===Secret Base decoration corruption===
''See also: [[glitch decoration]]''.<br>
===Arbitrary code execution===
It can be abused in two known ways:
Line 277:
{{Youtube|m9pvNYdhldo|TheZZAZZGlitch}}
2. With glitch move 0x27A2's animation and a specific stored item bootstrap code, which could theoretically be obtained with [[
{{Youtube|1pb-6hMDQBs|TheZZAZZGlitch}}
Line 288:
When the player selects a non-existing Pokémon from beyond slot 6, the game will attempt to verify the checksum of the Pokémon in what appears to be an anti-cheating mechanism. If it is found to be invalid, the game will corrupt it by setting bit 0 at offset 0x13, bit 1 at offset 0x13, and bit 6 at offset 0x07 from the 'Miscellaneous' data substructure).
Since the data for Pokémon beyond slot 6 corresponds with unrelated variables, it is possible (listed in the aforementioned [[
#An addition of +5 (hex:05) (bit 0 and bit 2 set).
#An addition of +64 (hex:40) (bit 6 set).
The variables which are corrupted during scrolling are random due to a mechanism known as [[DMA]]. DMA shifts the location of a memory address to one of 64 locations each time the player performs an action such as opening the Pokémon menu outside of battle, or entering battle. This is the reason why it can take many attempts for a successful
===Pokémon Storage System corruption===
When
However, sometimes{{clarify}} it is possible for
For example, the in-game trade Horsea named "SEASOR" has an initial personality value of 0x0000007F (substructure: AGME) ; and the in-game trade Seedot named "DOTS" has an initial personality value of 0x00000084 (substructure: EGAM). When the glitch sets bit 6 of its upper personality byte, the personality values become 0x4000007F (substructure: MEAG) and 0x4000084 (substructure: GMAE) respectively.
Line 307:
==Removing unwanted Eggs and Bad Eggs==
After filling the Pokémon Storage System with Eggs and Bad Eggs, any unwanted Eggs and Bad Eggs created from
==External links==
*[http://forums.glitchcity.info/index.php?topic=6868.0 Thread on Glitch City Laboratories forums].
Line 313:
Voltage first discovered the sub-glitch to send out a Decamark in early 2011.
On April 9, 2014
In May 2014, Sanqui, TheZZAZZGlitch and werster analyzed the glitch, discovered its mechanics and how it can be used to hatch any Pokémon in the game.
|
Revision as of 00:00, 9 November 2016
0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC
Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)
Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)
99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)
Item stack duplication glitch (Generation I)
Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch
Bad clone glitch (Generation II)
????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))
Closed menu Select glitches (Japanese Red/Green)
Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch
Pomeg glitch (Generation III)
Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch
Voiding (Generation IV)
Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)
2x2 block encounter glitches (Generation I)
Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch
Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)
Large storage box byte shift glitch
Storage box remaining HP glitch | Generation I max stat trick
Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches
Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation
Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls
Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))
This article is incomplete. Please feel free to add any missing information about the subject. |
Bulbapedia also has an article about Pomeg data corruption glitch. |
![](http://static.miraheze.org/glitchcitywiki/a/aa/Jirachi_Egg.png)
Pomeg corruption glitch or Glitzer Popping is a glitch technique of the "sending out a ??????????" ("Decamark") sub-glitch of the Pomeg glitch for Pokémon Emerald, Pokémon FireRed and LeafGreen in which the player sends out the Decamark, views the summary of a Pokémon in the party and scrolls up to access Pokémon in the party beyond slot 6.
It is particularly notable for allowing the player to hatch an Egg containing any Pokémon in the game as well as many glitch Pokémon, by placing specific Pokémon in storage box 1 and 2.
The name Pomeg corruption glitch is assumed to have no meaning in itself. It was chosen by the speedrunner werster who was one of the early researchers of the glitch, because he did not want the glitch to have a name which in his opinion would be 'too generic'.
Due to a memory address location randomization mechanic known as DMA, it can take many attempts for the player to get their desired corruption with the glitch.
Set-up
Pokémon Emerald:
1. Prepare a party with a Pokémon to switch into ('switch Pokémon'), a Pokémon ('Pomeg Pokémon') with HP to be reduced using a Pomeg Berry which has a suitable number of EVs for its level (at least 10; e.g. a level 100 Pokémon with 10 or more HP EVs may drop 2 HP), and at least one fainted Pokémon (all of the Pokémon other than the switch Pokémon and the Pokémon to have its HP reduced must be fainted).
The Pokémon to have its HP reduced with a Pomeg Berry may have its HP reduced to 1 (or alternatively 2 if the Pomeg Berry would cause a drop of 2 HP) by poison and have its status healed with an item such as a Pecha Berry or Full Heal. Alternatively it can be a Pokémon with Curse (such as Banette) and an odd maximum HP value. This Pokémon may use Curse twice with full HP so that the player can attain 1 HP faster than the poison method.
2. Enter a battle and switch into the 'switch Pokémon', then run away.
3. Deposit the 'switch Pokémon' into the Pokémon Storage System.
4. Either use a Pomeg Berry on the Pomeg Pokémon to obtain negative HP and heal it to 'raise' its HP to 0, or have the Pokémon's HP drop to 0 without having to use a healing item (which method the player has to use will depend on the Pokémon's level and whether it had 1 or 2 HP).
5. Enter a battle to send out a Decamark.
6. Open the Pokémon menu and view the summary of the first (fainted) Pokémon.
7. Exit the summary screen and scroll up (or down) to access Cancel. From the Cancel menu scroll up to corrupt data and access Pokémon beyond slot six. Scrolling up too much may freeze the game.
Pokémon FireRed/LeafGreen:
The initial steps for Pomeg corruption glitch in Pokémon FireRed/LeafGreen are the same as in Pokémon Emerald, except that a Pokémon with negative HP must be traded over from Emerald to faint the party since the Pomeg Berry does not reduce HP EVs in these versions.
Exploits
When the player scrolls past Pokémon beyond slot 6, to access Pokémon beginning from Pokémon 255 and working down, they will corrupt the data of unrelated data managed as a non-existing Pokémon.
In Pokémon Emerald, the data which the player is able to corrupt with Pomeg corruption glitch is as such:
|
In Pokémon FireRed and LeafGreen, the Pomeg glitch will corrupt Pokémon Storage System data beginning from box 3 slot 1 instead of box 2 slot 24. [citation needed] In Japanese versions of Pokémon Emerald, FireRed and LeafGreen, the Pomeg Glitch Corruption begins 6-7 PC Slots earlier than in the other versions. [citation needed]
Pokémon Storage Box corruption
Pomeg corruption glitch may be used to corrupt the attributes of Pokémon in the Pokémon Storage System. Below are some of the possible techniques for this.
Accessing Super Glitch moves
When Pokémon in the Pokémon Storage System or Day Care are corrupted, it is possible for them to know useful Super Glitch moves. When the player opens the Fight menu or attempts to use one of the Super Glitch moves, it can have effects such as finishing the battle (instant flee) or changing a Trainer battle into a wild Pokémon battle; allowing the player to steal other Trainer's Pokémon or escape from battle using a Fluffy Tail.
The Pokémon stolen fom other trainers will have their Trained ID changed to match the player's TID. If the initial TID of the Pokémon isn't the player's TID, the stolen Pokémon will turn into a Bad Egg. Pokémon from Battle Factory trainers are the only ones who have the player's TID.
| |
Decaswitch
Decaswitch is a derivative of Pokémon Storage Box corruption discovered by voltage which is possible if one of the Pokémon in the Pokémon Storage System becomes an invisible Decamark Bad Egg. Decaswitch allows a player to perform both Pomeg Glitch and Pomeg corruption glitch without needing Pomeg Berries.
| |
Hatch any Pokémon
This is a popular exploit of Pomeg corruption glitch that allows the player to hatch any Pokémon in the game, as well as glitch Pokémon which do not freeze the game after hatching.
In box 1 and 2 of the Pokémon Storage System, the player may place copies of Pokémon applicable for the glitch (obtained with cloning; ideally with the Battle Tower Pokémon cloning glitch) with attributes (e.g. Attack and HP EVs or a move) with an ID which would be converted into a species ID.
If the player is unsuccessful with the glitch after many attempts, they may attempt to place different Pokémon next to the Pokémon applicable for the glitch, referred to as corruption initiators for example they could try random Pokémon or (if the glitch was successful before) they could try placing a specific Caterpie known as "Caterpie the perfect initiator" next to SEASOR knowing Waterfall, Protect, Surf, Return (US)/no move (FR).
In order to know whether the Pokémon is applicable for the glitch and if so; which attribute needs to be converted into a species ID, the player must know the Pokémon's personality value and data substructure (determined by the Pokémon's personality value modulo 24). It is difficult to know a Pokémon's personality value (unless theoretically the Pokémon is a Spinda) without using an external device. For an illustration on how this works, see the section about the mechanics of Pokémon Storage System corruption below. However, thanks to Emerald's RNG, it is possible to easily determine the PID of a Pokémon that was caught right after soft-resetting by calculating its IVs and finding back the frame that generated the Pokémon.
Through SEASOR and DOTS
The in-game trade Pokémon "SEASOR" the Horsea and "DOTS" the Seedot are applicable for this glitch as their (constant) personality values of 0x0000007F and 0x00000084 respectively mean a successful corruption turns them into an Egg containing a Pokémon based on their Attack and HP EVs.
In order to obtain a desired Pokémon, the player must first know its index number. The upper two bytes of the four digit index number in decimal determines the number of Attack EVs required, while the lower two bytes in decimal determine the number of HP EVs required.
For example, in order to obtain a Mewtwo; the player can place copies of SEASOR or DOTS in the PC with an Attack EV of 0 and a HP EV of 150 (hex: 0096), and perform the glitch continually until one of the Pokémon in the Pokémon Storage System becomes a regular Egg containing Mewtwo. Often the Pokémon will become an Egg which still contains SEASOR or DOTS. This is normal, and if this occurs the player should reset the game and keep performing the glitch again until it works.
The following is a table of illusory Pokémon IDs and the required amount of Attack and HP EVs to force them into an Egg.
|
| |
Through other Pokémon
Instead of using SEASOR the Horsea or DOTS the Seedot, it is possible that a different Pokémon could have its first move ID converted into a species ID or EVs converted into species. For example, a Sneasel knowing Beat Up (move ID hex:00FD) might become an Egg containing Celebi (species ID hex: 00FD), depending on the corrupted Sneasel's original personality value.
|
| |
Double corruption
Double corruption is a method of obtaining a Pokémon in the Pokémon Storage System without hatching it. In order to exploit a double corruption, the player should attempt the steps to hatch any Pokémon with SEASOR until the Pokémon turns into a regular Egg that is either a different Pokémon to the original or remains as Horsea. Afterwards, the player should save the game and continue to make corruptions to the Pokémon in the Pokémon Storage System (resetting if unsuccessful) until SEASOR converts into an unhatched Pokémon.
During a double corruption, it is important that the player never picks up the Pokémon in the box with the glove otherwise the glitch will not work.
Double corruption may be used as a method of obtaining glitch Pokémon which would otherwise freeze the game upon hatching. It can also be used to obtain Pokémon holding an item chosen by the player, including unobtainable items. All the data rewritten when an Egg hatches (EVs, Contests stats, Exp, Ribbons,...) can also be kept.
Pokémon News Reporter corruption
Pokémon News Reporter corruption is a derivative of using the hatch any Pokémon to obtain a Decamark with an exceedingly long name. When the player speaks with the news reporter in the Pokémon Fan Club of Slateport City's Pokémon Fan Club with a specific Decamark in the first position of the party, it is possible to corrupt data after she mentions the Decamark's name.
"Guess Who?" glitch
The "Guess Who?" glitch allows the player to play as random NPCs after speaking to the news reporter with a specific Decamark in the first position of the party and stepping out of Slateport City's Pokémon Fan Club.
This is a table of "Guess Who?" Decamarks applicable for the glitch.
|
| |
Instant Pomeg glitch
Instant Pomeg glitch is a useful trick which allows the player to perform Pomeg corruption glitch from the Pokémon menu without having to enter a battle, by forcing the first Pokémon in the party to be empty.
Glitch Pokémon 0x96B4 and 0x29C2 are examples of glitch Pokémon which enable instant Pomeg glitch in US Pokémon Emerald.
| |
New line arrow glitch
The new line arrow glitch occurs when a Pokémon has a 'new line' (hex:FB) character in its nickname. This Pokémon may be obtained rarely by performing Pomeg corruption glitch when a Pokémon has the letter "A" as the fourth or eighth character in its nickname.
The new line arrow character causes a number of effects depending on the version, incuding:
Emerald:
- The text after the down arrow in the Pokémon's name is hidden.
- The down arrow is surrounded by the background in the party menu.
- Sending out a Pokémon with a new line character in its name causes a red screen with "--" in it. Additionally, "H" and blue down arrows can be seen in the text box area. The fight box menu will be changed to a "-" surrounded by red.
- Selecting the Pokémon or viewing its summary from another Pokémon causes the arrow's moving down animation to play once.
- The new line arrow forces you to press A in battle to see the rest of the name.
FireRed differences:
- The appearance of the arrow is different.
- Corruption of the appearance of the items menu.
Ruby differences:
- The red screen effect does not occur, but the press A to continue effect still occurs
- The Pokémon's name on the party screen is displayed as if there was no arrow.
| |
Bag item duplication
In Emerald, if the player stops the up button scrolling from Cancel after about 17 whole seconds there is a chance that an item in the player's bag will have been duplicated. Sometimes this trick may 'remove' everything in the player's TM and Berry pockets although this effect does not occur every time.
| |
Switch cloning
A method of Pokémon cloning with the access Pokémon beyond slot six glitch was discovered by luckytyphlosion in 2014 before it was known that scrolling past those Pokémon will corrupt data. Sometimes in the expanded party there will be a Pokémon that the player can send out. If the player sends this Pokémon into battle and whites out, it is possible for the player to clone the last Pokémon in their party.
White Decamark effect
Sometimes after viewing the status of a Pokémon in the expanded party it is possible to have the game lockup with the foe becoming a white Decamark. Additionally, the HP bar may become glitched and be filled in beige.
NPC corruptions
Pomeg corruption glitch may be used to sometimes corrupt NPCs on the map if the player escapes from battle using a Fluffy Tail instead of through whiting out.
Script corruptions
If the player performs Pomeg corruption glitch on a route with Trainers it can cause corruption of the player's challenge music, and/or corruption of their text (often long instances of "qÁF" in their text) or cause a full red screen. Sometimes after closing the text box (it may take a very long time for to finish printing it) it can cause a battle with a glitch Trainer to begin.
Reportedly the NPC outside of the Winstrate family house on Route 111 can be corrupted to a shop vendor, where talking to them brings up a BUY/QUIT option and items can be purchased (possibly glitch decorations) that are sent to the player's PC.
The same NPC may be used to trigger a 'super corruption glitch' in which the player's Pokémon, name, items, Pokédex data, play time and gender according to the save box is corrupted and saving may break the save, causing a black screen upon loading.
It is also possible to bring up the Game Corner slots with a script corruption.
| |
Reboarding the S.S. Anne
Script corruption may be used in FireRed/LeafGreen to disable the guard to the S.S. Anne from checking if the player has a ticket, if the player performs the scrolling after fishing in Vermilion City. This may also be used to reboard the S.S. Anne or Surf in the harbour to where the truck is.
Access behind the Day Care
Pomeg corruption glitch may be used in Emerald and FireRed/LeafGreen to change the coordinates of NPCs on the map. This is useful for accessing behind the Day Care on Route 117 and Four Island in both versions, by encountering a Pokémon in the grass in Route 117 or fishing for a Pokémon in Four Island before scrolling up past Pokémon 255.
Day Care corruption
Pomeg corruption glitch may corrupt the data of Pokémon in the Day Care in Emerald if the player scrolls beyond stored box data (Pokémon 255-215) while scrolling up.[clarification needed]
Flag corruptions
Pomeg corruption glitch can be used to corrupt in-game flags either directly through scrolling up past Pokémon 255 or with a derivative trick which involves a glitch Pokémon obtained with the hatch any Pokémon trick.
Evergrande City Fly flag
Pomeg corruption glitch may rarely set the Fly flag that allows the player to Fly to Evergrande City (where the entrance to Victory Road is and not outside of the Pokémon League) if the player hasn't unlocked it already.
Southern Island
Pomeg corruption glitch may rarely set the flag for an NPC to appear on the second floor of the Pokémon Center and give the player an Eon Ticket. This allows the player to access Southern Island and capture Latios or Latias.
| |
Faraway Island and Birth Island
- Main article: Access Faraway Island glitch.
- Main article: Access Birth Island glitch.
In non-English versions of Pokémon Emerald including the French, German, Spanish and Italian versions of Emerald, it is possible for the player to use Pokémon News Reporter corruption with a specific glitch Pokémon (obtained with Pomeg corruption glitch) to change an address telling the game which Pokémon to send out in battle and activate the flag for access to Faraway Island or Birth Island. More information (in French) may be found here.
Overworld position corruption
Pomeg corruption glitch may rarely affect the player's overworld position and place them in the wrong location (such as in the middle of trees) after escaping with a Fluffy Tail.
Surfing/Walking on Cycling Road
Rarely after instant Pomeg glitch is set up, it is possible for the player to Surf on Seaside Cycling Road of Route 110 if they perform the scrolling from one step out of Mauville City's Pokémon Center and walk up.
This will make the player go through a 'door' that leads into the water on Route 110 near the Cycling Road and the player is able to surf through Cycling Road. Going through the right-most door of the Cycling Road's entrance and out will allow the player to walk on Cycling Road.
| |
Secret Base decoration corruption
See also: glitch decoration.
Pomeg corruption glitch may rarely affect the Secret Base decorations they have in their PC. For example, TheZZAZZGlitch changed Thunder Mat (0x3C) into a 'ÛË ▼ÛË ÀÀÚËÔÀ ÀÀCAN' (0x7C) glitch decoration which acts like a portable two-square hole.
Arbitrary code execution
Pomeg corruption glitch ultimately allows for arbitrary code execution if the player has favourable DMA.
It can be abused in two known ways:
1. By viewing the summary of Decamark 0x097D with a specific nickname Pokémon from the bottom-right corner of box 3 after saving twice. This trick may not work with certain save files.[why?] (See video; below)
| |
2. With glitch move 0x27A2's animation and a specific stored item bootstrap code, which could theoretically be obtained with double corruption. (See video; below)
| |
Mechanics
Pokémon Ruby, Sapphire and Emerald introduced encryption for Pokémon in the party and storage box system, as well as a four byte value known as the personality value which determines a Pokémon's attributes such as its gender, ability, nature and shininess.
Pokémon have a stored checksum and calculated checksum, and a data substructures split into four sections, referred to as "Growth", "Attack", "EVs & Condition" and "Miscellaneous". The order that the sections appear is determined by a value that is calculated from the Pokémon's personality value modulo 24.
When the player selects a non-existing Pokémon from beyond slot 6, the game will attempt to verify the checksum of the Pokémon in what appears to be an anti-cheating mechanism. If it is found to be invalid, the game will corrupt it by setting bit 0 at offset 0x13, bit 1 at offset 0x13, and bit 6 at offset 0x07 from the 'Miscellaneous' data substructure).
Since the data for Pokémon beyond slot 6 corresponds with unrelated variables, it is possible (listed in the aforementioned exploits section) to corrupt data in a limited number of ways which include:
- An addition of +5 (hex:05) (bit 0 and bit 2 set).
- An addition of +64 (hex:40) (bit 6 set).
The variables which are corrupted during scrolling are random due to a mechanism known as DMA. DMA shifts the location of a memory address to one of 64 locations each time the player performs an action such as opening the Pokémon menu outside of battle, or entering battle. This is the reason why it can take many attempts for a successful Pomeg corruption glitch corruption.
Pokémon Storage System corruption
When Pomeg corruption glitch touches a Pokémon's data, it will become a Bad Egg if its calculated checksum and stored checksum do not match.
However, sometimes[clarification needed] it is possible for Pomeg corruption glitch to alter a Pokémon's personality value without the Pokémon becoming a Bad Egg.
For example, the in-game trade Horsea named "SEASOR" has an initial personality value of 0x0000007F (substructure: AGME) ; and the in-game trade Seedot named "DOTS" has an initial personality value of 0x00000084 (substructure: EGAM). When the glitch sets bit 6 of its upper personality byte, the personality values become 0x4000007F (substructure: MEAG) and 0x4000084 (substructure: GMAE) respectively.
This causes data from one substructure to be moved into another, for example; Seasor or Dot's "EVs & Condition" (E) data is moved into "Growth" (G) in which the species ID is stored; meaning that the Pokémon's Attack and HP EVs become the ID of the Pokémon inside of the Egg.
During a double corruption, both the Pokémon's personality value and Trainer ID is corrupted, and this causes the Pokémon to become a valid unhatched species as long as the player doesn't pick it up with the glove when it becomes an Egg.[why?]
Removing unwanted Eggs and Bad Eggs
After filling the Pokémon Storage System with Eggs and Bad Eggs, any unwanted Eggs and Bad Eggs created from Pomeg corruption glitch can easily be removed with the Battle Tower inverse cloning glitch or fast inverse cloning.
External links
Credits
Voltage first discovered the sub-glitch to send out a Decamark in early 2011.
On April 9, 2014 luckytyphlosion discovered that the glitch could be used to create both Bad Eggs and hatchable Eggs.
In May 2014, Sanqui, TheZZAZZGlitch and werster analyzed the glitch, discovered its mechanics and how it can be used to hatch any Pokémon in the game.
Metarkrai has thoroughly researched the glitch and has published many tricks such as information on methods to enter event islands, obtain obedient Mew and Deoxys and arbitrary code execution.