AreaDex/RB:231
Town Map name: ROCK TUNNEL.png) Identifier (HEX) E7 Identifier (DEC) 231 Default track Cinnabar Island (bank 02) Tileset 0x67 Size 32x14 blocks Map type Redirection glitch map Semi-freeze glitch map
|
Map 0xE7 from English Pokémon Red and Blue is a glitch map. It normally freezes the game without a specific method of preventing the freeze. It has a map script of EAF1, which is Echo RAM for CAF1; and is within the 'sprite state' data.
Accessing it without a freeze
To access map 0xE7 without a freeze, perform the following steps
1) (May be optional, see below) First get 202 Pokémon in the party (this is to place a C9 in memory at EC2B (CC2B) (wPartyAndBillsPCSavedMenuItem) for map 0xE7's level-script pointer at EAF1). Without arbitrary code execution, this should be possible by activating Super Glitch while on the deposit option of a Pokémon Center's PC, depositing the Pokémon to get 255 Pokémon and then withdrawing a PC4SH to get 202 Pokémon (the ID of PC4SH).
2) Stand in the spot below, save and reset then put the party cursor to Pokémon 202 and close the menu.
3) Depending on the console being used, the effects that follow might differ; but the variation seems to be rooted in the SRAM with effects varying if the SRAM has not been opened (by viewing the summary of a non-glitch Pokémon or hybrid glitch Pokémon of a valid Pokémon), or if the relevant portions of SRAM are altered to not be FF. Specifically, SRAM:BECD is written to D3AD (wMapBackgroundTile), SRAM:BECE is written to D3AE (wNumberOfWarps), SRAM:BECF is written to D3AF (wWarpEntries).
4) Change D36E/D36F to 4112 and D35E to E7. The player can do this with a TM31 x1 and X Attack x18 in the expanded items pack if they replace them with the Master Ball x199 (in item 33) and TM41 x79 (in item 41) respectively.
5) Multiple things can happen:
- If the player viewed the summary of a Pokémon to unlock SRAM and the above data was FF, then there may be a larger warp data related buffer overflow. While testing, BED0-C2CA controlled up to D3B0-D7AA and this may be the cause of the effect where the player may instead Fly away from the map into Pallet Town. (This has been called a redirection glitch map). The player will wait a long time watching Professor Oak (possibly with the message not to go into the tall grass) and with the controls locked until automatically spinning west into the grass. The requirement of having 202 Pokémon may not be required in this case.
- If SRAM was never unlocked, the corruption may not reach that far with the game returning a different value (0x2A while testing) from locked SRAM, and corruption reaching only until BF76>D456. The 0xC9 at EC2B may come useful here if the map script (level-script pointer) runs. If SRAM is unlocked, the glitch map may load with a short chance to quickly open the Start menu and Fly away by changing item 37 quantity (wCurMapTileset) to 00. The map may play the Cinnabar Island music, despite being located in Rock Tunnel according to the Town Map.
In order to avoid a freeze with a high chance of corrupting the save file and removing "continue" from the options box, one should always put the cursor on the 202nd Pokémon after entering the map before leaving the menu closed. There is fortunately a short time for the player to do this before the freeze occurs.
- A different save file may also give different results (e.g. if BECE is instead equal to 01), upon entering the map, the game might immediately freeze with a bar freeze with no time to open Start.
Hardware tests and history
This glitch to get map 0xE7 to load was first documented by Evie (Torchickens) forums post) on March 8, 2017 on the Glitch City Laboratories Forums. It was performed on the Game Boy Advance SP and 3DS Virtual Console version in which a behavior like the first bullet point above occurred. Additionally, a third testing session was done with the Game Boy Player (a GameCube peripheral) where the redirection effect did not occur and it was possible to explore the glitch map (though she cannot tell if it's simply because SRAM was locked).
On March 23, 2023 after revisiting the glitch on BGB emulator using Pokémon Red and the Game Boy Color boot ROM, the previously unknown details about how this glitch map depends on the SRAM were found.
It's also believed that the glitch will also work differently on Pokémon Stadium game's Game Boy Tower due to the different emulation of Echo RAM, but it hasn't been tested there yet.
Items beyond slot 20 represent unrelated memory addresses, which are really just extrapolated beyond the end of the list. Setting 0xD35E to 0xE7 with the TM31 x1 in item 33 sets W_CURMAP (D35E) to this glitch map, but this alone only changes the map number partially loading data such as the Town Map name and map bank. Therefore, the TM41 x 79 in item 41 sets W_MAPSCRIPTPTR (D36E-D36F) to pointer 41 12 (1241). This pointer was chosen because at 1241 is the routine LoadMapData, which is documented here in the Pokémon Red disassembly project and for some reason bypasses a freeze from entering the glitch map directly from an entrance or exit, or as a map connection.
When the new map script for this glitch map (EAF1 (Echo RAM for CAF1)) runs, typically the player is fortunate not to have the game freeze up to EC2B (Echo RAM for CC2B) where having the cursor on the 202th Pokémon beforehand writes 0xC9 to CC2B (EC2B). This address wPartyAndBillsPCSavedMenuItem stores the Pokémon -1, so the 202nd (0xCA) Pokémon is considered as 201 (0xC9). This is relevant because 0xC9 is the ret opcode; since the player hasn't adjusted the stack this will terminate the code.
External links
YouTube video
| |