View Single Post
Old Oct 11th, 2009, 9:31:03 PM   #1
Arseus
is a Pre-Contributor
 
Join Date: Oct 2006
Posts: 869
Post RNG Manipulation in FireRed/LeafGreen: Wild Pokémon Supported in RNG Reporter 9.93

Table of Contents
12/20/11 Update: RNG Reporter now supports Method H, the method of Wild Pokémon generation supported in FireRed and LeafGreen.
09/14/11 Update: The technically inclined may see Bond697's latest posts on Method Determination and GBA Video Functions.


Preliminary Information
Abusing the Random Number Generator of FireRed and LeafGreen is very difficult in comparison to games such as Emerald or Diamond and Pearl. Many users have found success thanks to save states from emulators, though the goal of this topic is to facilitate this process for those using actual game paks.

One of the most important pieces of knowledge in the puzzle of RNG abuse is the "seed". A "seed" is a number that is initially plugged into the formula used to generate strings of pseudo-random numbers. If we know the seed, it is possible to determine the sequence of pseudo-random numbers it creates. In Emerald, we always know the seed, as it is 0 each time the game starts up. In Diamond and Pearl, we can manipulate the seed by starting the game at a certain time, and hitting a certain delay.

FireRed and LeafGreen operate in a different fashion than the abovementioned games, but they share certain similarities with all of them. They still make use of a seed, which generates a set of frames—simply put, a frame is the spot when the RNG generates a certain PID (a nature and IVs for Pokémon). User flovv has looked into the game's code and discovered the specifics of seeding for FireRed and LeafGreen:

Seed Creation


Frequent contributor mattj has summarized much information concerning seeding and the advancement of frames as follows:

Quote:
Originally Posted by Fat mattj View Post
1) It really is possible to hit reasonably consistent starting seeds in FR/LG: Been There Done That.
1) The moment the game "begins seeding": When you press A to make the "Venu/zard Scene" begin.
2) The moment the starting seed is chosen/calculated: [A few moments after Venusaur/Charizard's cry sounds, upon pressing A again to advance.]
3) The moment frames STOP rolling: When you press A the SECOND time on your pokemon and the battle actually begins.
It is important to note that "button mashing" is undesirable due to its effects on seed groupings. It is much better to be deliberate with button presses whenever you are booting up the game.

User NeoSyrex also has information concerning the FireRed/LeafGreen RNG, which he famously applied to capture a Zapdos for use in the Video Game Championsips. The information provided by NeoSyrex is as follows:

Quote:
Originally Posted by Fat NeoSyrex View Post
Basically the way to abuse FR/LG's RNG is to catch a Pokémon (for example Zapdos), check its IVs, and get the seed. Then go backwards through the RNG (using the reverse RNG formula on the seed) until you find your starting seed. I never figured out how the game creates it, but the starting seed is always going to be a 2 byte number so it doesn't really matter since the RNG rarely comes up with numbers that small (and when it does the offset is usually a giveaway as to whether its the starting seed or not). I made a program that can do this, its a simple DOS program I quickly made that I haven't had a chance to make look nice. (...)

Continue doing this until you find a seed you land on often. Once you find a particular seed that seems to work for you, use RNG Reporter to check if there are any spreads for the seed that you want. Finally, you need to correctly time the frame you enter the battle to match the corresponding spread.
This seed may be found manually by program FR/LG Seed Finder, which is attached to this post. NeoSyrex, the author of this program, says the following:

Quote:
Originally Posted by Fat NeoSyrex View Post
(...)it's pretty simple, just enter the seed you calculated and it will return possible starting seeds, and how many frames earlier they occurred. Usually the first one (the lowest number of frames backwards) will be the correct starting seed, although there are exceptions, especially if you waited a while to calculate your seed.
As mentioned earlier, it is possible to generate a list of upcoming spreads using mingot's RNG Reporter program. This is more reactive RNG manipulation than proactive, but this is the best we have at the moment.

From here, it is possible to aim for a spread that you want by hitting its frame. Frames advance in realtime in a similar vein to Emerald, albeit with a catch. In a "quiet" area, such as outside Mt. Moon, the RNG advances at approximately 60 frames per second. However, this does not apply to all locations in the game. In certain locations, the RNG advances somewhat differently.

The RNG runs in an altered state in certain areas (many of which seem to be interior), cycling through either odd frames, or even frames. For example, if the game chooses odd frames, it will only cycle through frames 1, 3, 7, 9, 11, and so on. This creates the illusion that the RNG is advancing at 120 frames per second, when it is actually skipping over one type of frame. However, you can change whether the RNG will cycle through even or odd frames. This is achieved through opening up the menu, saving your game, and possibly other actions that have yet to be documented. This will cause the frames to switch to the opposite types; if the game was cycling through odd frames, it will now cycle through even frames, and vice versa. The specifics of quiet and noisy frame advancement are not yet known.

It would also seem that noisy and quiet areas are not necessarily consistent; noisy areas can be silenced through a technique described by flovv:
Quote:
Originally Posted by Fat flovv View Post
About the noisy areas:

Most of them can be turned to normal ones by saving there and reloading the game.
It also seems that sometime if you visit a noisy area and go to a normal the frames will remain noisy.
At the moment, you would look through the list of spreads generated by your recurring seeds until you found one you wanted.


Method 1 Pokémon

Much like Emerald, FireRed and LeafGreen

Bulbasaur, Charmander, Squirtle, Clefairyš, Abraš, Hypno˛, Voltorbł, Electrodeł, Hitmonlee, Hitmonchan, Scytherš, Pinsirš, Magikarp⁴, Lapras, Eevee, Porygon, Omanyte, Kabuto, Aerodactyl, Snorlax, Articuno, Zapdos, Moltres, Dratiniš, Mewtwo, Togepi, Lugia, Ho-Oh, and Deoxys

šOnly Clefairy, Abra, Scyther, Pinsir, and Dratini bought at the Game Corner are consistently generated by method 1. Scyther is exclusive to FireRed, whereas Pinsir can only be found in LeafGreen.
˛Only the Hypno encountered by Lostelle in the Berry Forest is consistently generated by method 1.
łOnly Voltorb and Electrode disguised as Poké Balls are consistently generated by method 1.
⁴Only Magikarp bought from the salesman in the Pokémon Center on Route 3 are consistently generated by method 1.

Note that as in Emerald, a Pokémon's spread is not necessarily selected at the precise moment you press A next to its overworld sprite. Rather, the RNG keeps cycling right up until the battle starts (or in the case of gift Pokémon, it is received), unless "spread selected" is indicated in the place of "last input". A list of where to save and the last inputs for each Pokémon is as follows:

Bulbasaur/Charmander/Squirtle: Save in front of the Poké Ball containing the starter of your choice. Spread selected upon pressing the A button after the message "This POKéMON is really quite energetic!" appears.
Abra/Clefairy/Dratini/Scyther/Pinsir/Porygon: Save in front of the Game Corner Prize Corner desk. Spread selected after pressing A when the message "So, you want the [ABRA/CLEFAIRY/DRATINI/SCYTHER/PINSIR/PORYGON]?" appears.
Hypno: Save in front of Lostelle in the Berry Forest. Last input is a press of the A button after Lostelle wails "Waaaaaaah! I want my daddy!"
Hitmonlee/Hitmonchan: Save in front of the Poké Ball which contains the Pokémon of your choice. Spread selected after pressing A when the message "You want the hard-kicking HITMONLEE?" or "You want the piston-punching HITMONCHAN?" appears.
Magikarp: Save in front of the salesman in the Route 3 Pokémon Center. Last input is a press of the A button after he asks "So you’ll buy it, am I right?"
Lapras: Save in front of the Silph employee nearest to your rival. Spread selected with a press of the A button after he says "I want you to have this POKéMON for saving us."
Omanyte/Kabuto/Aerodactyl: Save in front of the important doctor who revives Pokémon fossils. Spread selected after pressing A when he says "Your fossil is back to life! It was [OMANYTE/KABUTO/AERODACTYL] like I think!"
Snorlax: Save in front of the sleeping Snorlax. Last input is a press of the A button when the message "It attacked in a grumpy rage!" is displayed.
Articuno/Zapdos/Moltres: Save in front of the legendary bird. Last input is a press of the A button after it cries "Gyaoo!"
Mewtwo: Save in front of the Genetic Pokémon. Last input is a press of the A button when it says "Mew!"
Togepi: Save in front of the man in Five Island's Water Labyrinth. Spread selected upon pressing A when he says "Please, I'd like you to have this."
Ho-Oh: Save on the first space of the peak of the cliff. Last input is pressing up on the directional pad to place yourself on the second space of the cliff.
Other: Save directly in front of the Pokémon’s overworld sprite. Last input is a press of the A button to "activate" the battle. In the case of Deoxys, the red-hot rock serves as the overworld sprite. In the case of Eevee, the Poké Ball that houses it counts as its overworld sprite, and no battle is required.

Note that freezing or changing certain values in an emulator can alter a Pokémon's generation and lead to an illegal result. Due to a phenomenon known as vBlank (detailed in Bond697's posts on GBA Video Functions), "Method 1" Pokémon can also be generated through methods 2 and 4, but this is not the default behaviour; know if you get an abnormal spread for a method 1 Pokémon, this is the factor at work.



Wild Pokémon: Method H

FireRed and LeafGreen use a method known as Method H (which comes before the "Method J" and "Method K" with which you may be familiar if you have done RNG manipulation in the fourth generation) to generate their wild and Pokémon. This is the same method used in Ruby and Sapphire, and is now supported in the latest version of RNG Reporter (9.93). More technical information is available below in HIDE tags. What you need to know is that all wild Pokémon are generated using Method H, but with a bias towards the Method 2 variant.

Old Technical Information



Practical Applications

As for the practical side of RNG manipulation, in light of recent (12/20/11) Method H information, OmegaDonut has proposed a method of manipulating gift and wild Pokémon that is simpler than ever. Read his post here for a quick breakdown:

Quote:
Originally Posted by Fat OmegaDonut View Post
[B]uy a cheap Method 1 Abra at the Game Corner, note the IVs and calculate the "seed" for that Abra.

You could then plug that seed into RNG Reporter, generate a list of upcoming spreads, and look for spreads of interest. If you have a timer synchronized with the button press of the moment you obtained Abra, it shouldn't be too difficult to hit your target. Much easier than dealing with a 16 MHz Timer1.

[...]

My method gives you one chance to hit a spread, and no opportunity to re-calibrate if Method H messed you up and you didn't know it. But it's still easier than dealing with a 16 MHz timer AND the 60 frames\sec advancements.
In the event that you wish to have the luxury of recalibration, NixHex's original method can be found below:

Quote:
Originally Posted by Fat NixHex View Post
Requirements:
  • A Pokemon who knows Sweet Scent
  • (2) Master Balls
  • 2 empty team slots
  • 10 or so Rare Candies
  • Metalkid's IV Calculator (www.metalkid.info)
This will only work if you are shooting for a very large frame, because you need to allow yourself a great deal of time to check IV's and to verify what seed you are on.

Calibration:
  1. Start the game normally. Start a stopwatch the moment the game seeds.
  2. At the first chance you get, use Sweet Scent, catch whatever insanely high-leveled Cerulean Cave Pokemon appears.
  3. Check its IVs and verify seed. [Note that wild spreads are [usually] generated using method 2, so [...] use method 2 to verify the seed.]
  4. Stop the stop watch
For the lack of creativity, I'll call this time TCheck. You only really need to do this a few times if you're shooting for high enough of a frame.
Now, make sure that your target frame satisfies:
Code:
Eq. 1 TF >> TCheck (in seconds) * 60

Now, let's say, completely hypothetically, I start the stop watch as the game seeds, use Sweet Scent, catch, say, a Wobbuffet, and check its IVs. As soon as I find my seed from FRLGSeedFinder, I hit STOP. Let's say this time is 5:45. Converting to seconds, I get 5*60 + 45 = 345 seconds. Now, I go back to Equation 1.

TF >> 345 * 60, or TF >> 20700

In other words, this method can only be used for HIGH frames. In fact, it wouldn't even be worth it to use this method for lower frames, as you would probably overshoot your target frame just by doing the calibration.

Now that we're done with that, we can get to the cool part. Let's say you can consistently hit the seed 9AA0. So, you decide to search the [method 1] frames on this seed and you find this admittedly lame spread:


Frame 44586 Brave 30/30/14/30/25/30

Is this frame high enough to warrant using this method? Plugging 44586 into equation 1 yields 44586 >> 20700, which is obviously true. Now we're set.
  1. Now, create an emloop/pikatimer for a frame of 44586, and Soft-reset.
  2. The moment the game seeds, start the timer
  3. Quickly Sweet Scent, catch, and check seed of the wild pokemon.
  4. If your seed is, in fact, 9AA0, let the timer run its course, then encounter Mewtwo
  5. If the seed is incorrect, you can restart now and save yourself the trouble of waiting another 7 minutes just to get a bad seed
User Zari has taken the information we have right now and created a method of RNG manipulation that makes RNG manipulation in FireRed/LeafGreen more accessible to the average user, even if it is not entirely possible to manipulate the seed at will. As NixHex has put it, try thinking of this method as a variant of Emerald, albeit one with more options from which to choose. Zari's post below describes his method:

Quote:
Originally Posted by Fat Zari View Post
Important Info

This is a reactive-proactive method; you find groupings of seeds that you can hit, then search for spreads within those ranges that are of interest. NixHex and I have hit similar groupings of seeds independently, leading me to the conclusion that it *should* be possible for any user to hit those seeds/the spreads within them as well.

The [combined] data we have collected is as follows:

Seed [Hex] groupings (an "X" indicates a variable value)

54XX (XX usually ranges from the values c0 to d4/d5)

30XX (XX: 82 to a0)

0bXX/0cXX (XX: ef to 07 [latter value has 0c at the forefront])

9eXX (XX: 0c to 17)

There are other groupings, but these are the most common. Now onto the method itself!

The "Skipping" Method

Basically, what we need to do is skip the intro and charizard/venusaur "flash" sequence entirely. We do this by button mashing, but it requires some timing as well.

I don't have the exact/close approx. time length nailed (working on this as I find the time), but you need to begin button mashing the "A" button after the credits/nintendo junk, but directly before the screen opens up from the center with a deep blue (this is the background screen which the Game Freak star passes over).

Directly after the introduction finishes (or would finish, if you let it run its entire course) there is the zard/venu "flash" as I like to call it, where the pokemon's sprite appears white, then forms a grey version of itself, and then becomes full color after that subsequence finishes. What we want to do is press "A" fast enough so that we skip this "flash" entirely.

The final part of this method is to press "A" fast a third time, after skipping both of those sequences. If done correctly, the cry of venusaur/charizard should sound within 1 to 2 notes of the pokemon theme's beginning.

Warning: this may take a lot of tries to get correct; the desired time length between button presses is ideally zero, but, since that's physically impossible, you want to aim for as small as you can make it. The smaller the time length between button presses, the more consistent results you will get.

That's basically it for the method. After all of that is complete, do the usual by catching mewtwo (or another high level legend/mon), finding the PID via RNG reporter, then inputting that seed into NeoSyrex's FRLG Seed Finder.

Notable spreads within the given groupings:

For Mewtwo:

Seed: 54cc, F:1838, Naive 27 / 28 / 30 / 30 / 27 / 31

Seed: 54de, F:42197, Timid 28 / 31 / 30 / 31 / 30 / 31

Seed: 3081, F: 22538, Hasty 30 / 30 / 26 / 30 / 30 / 31 -- note, I have not been able to hit this seed yet, though I have hit ones around it many times.

Seed: 9e0c, F: 25054, Naive 28 / 31 / 31 / 27 / 23 / 31

Seed: 0bf0, F: 30980, Hasty 31 / 30 / 25 / 31 / 25 / 31

Seed: 0bff, F: 20091, Hasty 28 / 31 / 30 / 27 / 30 / 31

Seed: 0c00, F: 6208, Naive 29 / 31 / 24 / 29 / 31 / 31

For those who might like to play ADV sometime again:

Seed: 54c6, F: 8631, Calm 31 / 31 / 30 / 31 / 28 / 31

Seed: 3082, F: 6403, Naughty 31 / 30 / 30 / 30 / 22 / 31

Seed: 9e14, F: 35262, Naughty 30 / 29 / 27 / 30 / 27 / 31

Seed: 0c02, F: 11279, Rash 30 / 30 / 31 / 27 / 31 / 31

Seed: 9e10, F: 63361, Jolly 28 / 31 / 29 / 1 / 31 / 31

---


There's most likely more, but that's just an example of what you can find with a few groupings of seeds. All but the last jolly one are under 10 minutes; most are under 4.
Note that triggering the advance to the start screen at the right instant will yield better results than mashing buttons either to a beat or as quickly as possible. Zari notes that three button presses are needed to execute the skipping method.

Zari has also kindly compiled a list of the different seeds found:

Code:
By groupings:

9eXX [02 - 2d]

9e02 * 2
9e03
9e0a * 2
9e0b * 4
9e0c * 2
9e0d
9e0f * 4
9e13 * 8
9e14 * 10
9e18
9e1c
9e1d * 2
9e29 * 2
9e2d

54XX [c2 - f3]

54c2 * 2
54c3
54ca * 2
54cb * 6
54cf * 2
54d2 * 2
54d3 * 3
54d4 * 10
54d7
54d8
54db
54de * 2
54e0
54ed * 2
54f3

30XXv1 [82 - a8]

3082
3083
308a
308b * 5
308e
3093
3098
309c
30a0
30a8

30XXv2 [3d - 5a]

303d
3045 * 2
3046 * 2
3047
3048
304b
304c * 5
304d * 2
304f * 2
3050
3056 * 2
305a

e7XX [42 - 72]

e742
e749
e747
e74b * 9
e74f * 5
e753
e758 * 3
e75c * 2
e75d * 3
e769
e771
e772 * 3
Here is Zari's success story in which he details how he caught his Mewtwo in Kanto:

Quote:
Originally Posted by Fat Zari View Post
For as fast as FRLG seeds, a 33.3% ratio of hitting a target seed is quite good. Now, I've hit this seed before, but what made this different from previous tests was that I only hit the A button 3 times per attempt. As such, I got even more consistent results when I used the skipping method (3 presses is the minimum needed to do the skipping method).


As for how I got my new mewtwo....well, it took a lot of attempts, a lot of luck, and the right kind of target frame. What I mean by that is, well, choose a low target frame; you'll be hitting quite a few groupings of seeds, so select a frame from one of them that's somewhere under a minute (I used frame 2051 for my mewtwo).

Basically, to RNG in frlg you first need to find what you can hit; in my case on my lg, it was the groupings 4cXX, 7aX, 9a9X, and f4dX. Notice that, as opposed to those I hit earlier on my fr in the first post, there's mostly only 1 X variable (4cXX is right on the split point). This is due to the groupings being smaller, like Kaphotics has mentioned. Anyways, once I found what I could hit, I looked through the groupings for low frames with good spreads. I chose one out of the 7aX grouping because it was the smallest grouping that I could easily hit (7a4 - 7a7), thus increasing my chances of hitting my target seed when timer0 selected that grouping. After that, it just took using eontimer to find my lag for that particular frame (-517), and then a few more resets and....






/ Hasty / Pressure / Genderless
28 / 31 / 7 / 29 / 24 / 31



....became mine. :)


If you guys have any more questions I'll try my best to answer them, but that was the main process for which I used to get my mewtwo. Obviously there was a lot of luck involved in the capture, but when it comes to frlg, you don't really have any other choice since timer0 moves so fast.


Trainer ID and Secret ID Generation

The RNG is constantly running during Professor Oak's introduction to the player, and the point at which the player's ID, or visible Trainer ID is created has been found, as well as the moment when the invisible Secret ID is generated. Our knowledge of the TID/SID generation process will hopefully allow manipulators to obtain custom ID combinations for use in the capture of shiny Pokémon, or general aesthetic purposes.

Quote:
Originally Posted by Fat Kaphotics View Post
FireRed/LeafGreen TID/SID Generation

Code:
The moment you press OK and the screen fades out completely, 
       the 0x04000104 timer value gets set as the new seed.
The game then takes that seed and considers it the initial, 
       and that initial seed is your TID.
Code:
The SID is set later in the process, but is still related to the seed. 
It is taken from the frame you are on when you end the miniaturization, 
       taking the seed on that frame (and using the upper16).

"Frequently Asked" Questions
As implied by the quotation marks in the header, not all of these questions are frequently asked. However, I do anticipate them coming up, so I'll try to provide some help here:

Q: How are Eggs/shiny Eggs generated?
A: Information on the generation of Eggs can be found in this post of the RNG Research thread. Similarly, Egg availability and generation is elaborated upon in a subsequent post in the thread. In both cases, the information has been provided by Kaphotics.

Q: There were two runs of FireRed/LeafGreen cartridges. Does the RNG work the same on both?
A: As far as we are aware, there are no differences between the runs of the games as far as the RNG is concerned.

Q: Do these findings apply to other games, such as Ruby/Sapphire, or just FireRed/LeafGreen?
A: As mentioned above, all Pokémon handheld games share some similarities as far as RNG mechanics go, but they also have their own nuances. This thread is made specifically dealing with FireRed/LeafGreen mechanics. Ruby and Sapphire share wild Pokémon generation Method H, so that research may be applied there.

Research Questions

As you have likely gathered, we do not have enough information to create a streamlined RNG manipulation experience in FireRed/LeafGreen at this time. This is why your help is needed. Here is a list of all the things that need researching at the moment (that I can think of):
  • What areas have a "quiet" RNG, and what areas are "noisy"?
    • It is unclear at the moment just where (and when) the RNG goes into the "noisy" pseudo-120 FPS mode. We need users to test in different areas to see where the RNG is "noisy" and where it is not. Bear in mind that the RNG can be silenced, as described by flovv earlier in the post.
      Quote:
      Originally Posted by Fat Negator View Post
      That "fast mode" as we call it showed up also on a Sevii Island, it would really be helpful if some real cartridge owner can figure out if it appears even there:

      The how to should be very easy, since the tester should just get their seed, aim for a 10/15 minutes far spread, and at the supposed time, check if their outcome is close at the aimed target, or if it's far away (double the time far).

      This should be done after changing location, for example, starting the game outside Cerulean Cave, going inside, and only then do the scenting.
  • What actions cause the RNG to switch from even to odd?
    • It is known that opening the menu and saving both cause the RNG to switch to the opposite type of frame. However, the full range of actions which cause this switch are not known as of yet.

Helpful Links

General Resources
Applications*PokéRNG does not provide accurate seeds for FR/LG at this time.

Credits

I would be remiss to not give credit to the various users that have made this information available. Of course, where the RNG is concerned, loadingNOW and X-Act did the pioneering research that has made all RNG manipulation possible. =Jonny=, Syberia, Equinox, and Negator contributed to early tests and research concerning the FireRed/LeafGreen random number generator, and the program used to find FireRed and LeafGreen seeds was crafted by NeoSyrex. Additionally, user NixHex has made several significant contributions, including a series of updates. Similarly, Kaphotics and Bond 697's work in the RNG Research thread has proven useful in illuminating some of the outstanding technical aspects of the RNG, and they have posted many new developments in this thread. Many other users such as chrish, mattj, flovv, andZari made consistent or large contributions. Many other users have contributed to this cause.
Attached Files
File Type: zip FRLGSeedFinder.zip (72.9 KB, 397 views)

Last edited by Arseus; Dec 24th, 2011 at 1:16:21 PM. Reason: OmegaDonut update.
Arseus is offline