Glitch Pokédex sorting

From Glitch City Wiki
Jump to navigation Jump to search
Arbitrary code execution in the Pokémon series

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | Type 0xFF mail arbitrary code execution (Japanese Crystal) | ZZAZZ glitch Trainer FC


List of arbitrary code execution programs

(view, talk, edit)
This article is a summary page for different variations of a glitches, etc. when talked about as a whole.
PRAMA Initiative a également une page sur Glitch Pokédex sorting.

Glitch Pokédex sortings are invalid Pokédex listing sortings found in Pokémon Gold, Silver and Crystal.

The 2nd generation of pokémon games allow the player to select three different modes to order pokémon within the pokédex. These modes include "New Pokédex mode", "Old Pokédex mode" and "A to Z mode". When a specific mode is selected, the game will save the value of the last selected mode in memory.

When the pokédex is selected from the start menu, the game uses a jumptable to select which sorting function should be used. By changing the value of the last selected mode, it's possible to index this jumptable out of bounds. Because of this, certain modes are able to execute arbitrary code, such as glitch mode 09's execution of $FA20 (Echo RAM for $DA20) in Crystal.

Technical details

When opening the pokédex, the game will retrieve the last selected dex mode from wLastDexMode and use that to retrieve a pointer from Pokedex_OrderMonsByMode.Jumptable.

Game Applicable language wLastDexMode Pokedex_OrderMonsByMode.Jumptable
Gold & Silver English $D67E $10:4BF0
French $10:4BF8
German $10:4BEA
Italian $10:4C01
Spanish $10:4BF2
Japanese $D671 $10:4ABC
Korean $D731 $10:4AF1
Crystal English $01:D959 $10:4BF0
French $10:4BF8
German $10:4BE9
Italian $10:4C01
Spanish $10:4BF4
Japanese $01:D94C $10:4ABC

Accessing glitch Pokédex sortings

The address D67E in Pokémon Gold and Silver or D959 in Pokémon Crystal controls the current Pokédex sorting loaded for when the player opens the Pokédex.

This means the GameShark code 01xx7ED6 in Gold and Silver or 01xx59D9 in Crystal will change the Pokédex mode.

With glitches, the duplicate key items glitch can be used to set up the expanded Balls pocket, where the glitch Pokédex sorting can be modified from the balls beyond ball 12.

Another way of accessing arbitrary code in Pokémon Gold, Silver and Crystal is through the Coin Case glitch (in English Gold/Silver only) or TMs and HMs outside of the correct pocket. The glitch TM/HM method is ideal because TMs and HMs can be forced into the PC items; also available through the expanded Balls pocket.

In Gold and Silver, modifying address C6D8 on the option screen (list of available Pokédex modes) will allow the player to access glitch sortings in a different way to the above method.

(Thanks Pokechu22 for the C6D8 method)

This article or section is a stub. You can help Glitch City Wiki by expanding it.