1. Welcome to Smogon Forums! Please take a minute to read the rules.
2. Welcome to Wi-Fi! Please remember to read the rules and do NOT create a new thread for simple trades or Friend Safari codes.

# Past Gen RNG Research

Discussion in 'Wi-Fi' started by mingot, Sep 12, 2009.

1. ### mingotfree agent

Joined:
Jun 15, 2008
Messages:
3,056
Ok, starting a pure research thread for PRNG abuse. As items in the help thread get moved over to the site and articlized technical information will be moved here about other games.

Rules

Only one, and you will be infracted if you break it.

- This is currently a pure research thread, not a help thread. Use the sticky for that. DON'T ask questions here that can be answered by any knowledgeable abuser.

Information

Black & White

Assorted 5th Generation RNG Information

Code:
```Definitions:
FullSeed = Entire 64 Bit Seed
u32 = Upper 32 bits of the 64 Bit Seed
L32 = Lower 32 bits of the 64 Bit Seed
Lowest Bit  =  Lowest Bit of the (64 Bit) Seed

FullSeed>>63 == 1   Pass Sync
FullSeed %4 == 0
give Pokemon
else give Item
FullSeed %5 == 0
give 'Not even a nibble...'
else give Pokemon

U32 ^ XOR  = PID
U32*6>>32           IV Passed
U32>>31             Parent Passing IV
U32*100>>32         Encounter Slot Value
Translate to Slot for Land/Water
U32*25>>32          Nature Calculation ([URL="http://www.smogon.com/forums/showpost.php?p=3229521&postcount=608"]Use Table[/URL])```
=====

Code:
```PID[1] = Undecided Generated PID
PID[2] =   Decided Generated PID
HB     = Highest Bit of PID
LB     = Lowest Bit of PID
LTSh   = Highest Bits XOR'd: L16(PID), TID, SID

===

Decision for 80000000 XOR

PID[1] = U32^0x10000
if      (HB+LB)%2 == (LTSh)%2
PID[2] == PID[1]^0x80000000
else    PID[2] == PID[1]```
Wild / Surf
Code:
```0    Initial
1    Sync
2    ESV - Land / Surf
3    Held Item
4    PID
5    Nature```
Water Spots (Fish / Surf)
Code:
```0    Initial
1    Sync
2    ESV - Water
3    Held Item
4    PID
5    Nature

For surfing, you have to surf into it, with frame advancement.
Surfing onto it uses the ESV for surfing spot,
fishing it uses the fishing spot.```
Fishing (No Spot)
Code:
```0    Initial
1    Sync
2    (No) Fish
3    ESV - Water
4    Level Calc
5    Held Item
6    PID
7    Nature```
Fishing (No Spot, Suction Cups in lead)
Code:
```0    Initial
1    (No) Fish - does not matter as Suction Cups guarantees a catch
2    ESV - Water
3    Level Calc
4    Held Item
5    PID
6    Nature```
Shaking Spots (Grass)
Code:
```0    Initial
1    Sync
2    -----
3    ESV - Land
4    Held Item
5    PID
6    Nature```
Shaking Spots (Cave / Bridge)
Code:
```0    Initial
1    Sync
2    Item or Pokemon Calc
3    ESV - Land
4    PID
5    Nature```
Cute Charm
Code:
```0    Initial
1    Cute Charm
2    ESV - Land / Surf
3    Held Item
4    PID
5    PID modification \ Nature (failed CC)
6    Nature (successful CC)```

Zekrom/Reshiram
Code:
```0    Initial
1    Sync
2    PID
3    Nature```
Code:
```0    Initial
1    PID
2    Nature```
High Link, some of the time. Zoroark has a weird way of PID generation, which we aren't completely certain how it works. It's really unnecessary to completely document, just like Zoroark because these buggers cannot be shiny.

Zoroark / Zorua cannot shine.

Wonder Cards
Code:
```0    Initial
22     HP IV
23    Atk IV
24    Def IV
25    SpA IV
26    SpD IV
27    Spe IV
30    PID
32    Nature```
There is something that can change the PID to make it give the opposite nature. Not sure, but it's noted here. Best bet is in between
Code:
```Frame 0    n-1             Initial Seed [Start]
Frame 1    n               nothing
Frame 2    n+1             nothing
Frame 3    n+2             Nature                   (r[n+1]*0x19) >>32, nature value
---        if Everstone, becomes Frame 4 [n+3] and all calls are shifted +1
Frame 4    n+3             DW                       (r[n+2] * 5) >>32 > 1, inherit DW
---        if Ditto parent, becomes Frame 5 [n+4] and all calls are shifted +1.  Not sure what is done here.
Frame 5    n+4        m    IV1-Place                r[m]*6>>64, return 0-5 for what IV (HABCDS)
Frame 6    n+5        m+1  IV1-Parent               r[m+1]>>63, return 0/1 for what parent (A=1, B=0)
Frame 7    n+6+2r     m+2  IV2-Place                r[m+2]*6>>64, return 0-5 for what IV (HABCDS)        ...r=rejected frames for 2nd iteration, each rejection is +1 to r value
Frame 8    n+7+2r     m+3  IV2-Parent               r[m+3]>>64, return 0/1 for what parent (A=1, B=0)
Frame 9    n+8+2r+2s  m+4  IV3-Place                r[m+4]*6>>63, return 0-5 for what IV (HABCDS)       ...s=rejected frames for 3rd iteration, each rejection is +1 to s value
[U]Frame 10   n+9+2r+2s  m+5  IV3-Parent[/U]               r[m+5]>>64, return 0/1 for what parent (A=1, B=0)
Frame 11   n+10+2r+2s      PID Generated            r[n+10+2r+2s] - 1 = PID
Frame 12   n+11+2r+2s      Pokemon placed in party. [End]

For >>32, assume using upper32
For >>6*, assume using full seed
"Rejected": 0-5 value calculated matches one from a previous iteration.
Discard and repeat calc until it does not match a previous 0-5, thus advancing 2 frames.```
Please refer to the other Breeding resources that are in the list at the top of this post.
Roaming Pokemon
Code:
```0    Initial
1    PID
2    Nature```
SID / ID
Code:
```Seed from Are you ready to enter the world of Pokemon
XXXXYYYY

XXXX = SID
YYYY =  ID```

HGSS

Seeding

Seeing is either exactly the same or extremely close, with the exception of the delay which can be much lower. Some more samples here would be welcome, but it seems like "normal" is probably somewhere around 490. RNG Reporter 7.01 has been released and has a checkbox to lower the minimum search delay on the seed finder to 400.

Walking in areas where there are no wild Pokemon is the same as in DPP. +1 for each Pokemon in the party per 128 steps.

PID Generation for Wild Pokémon

For the most part, PID generation is handled in the same manner described by X-Act in his article, but the process of getting the initial PID has changed in the 4th generation. In the 3rd generation, without a synchronizer present, the next two or three numbers from the RNG were taken and used directly to form a PID. In the 4th generation games this procedure has changed and there is an initial call to the RNG to get the nature and then the RNG is advanced until an appropriate PID (that is, one that has a matching nature) is found.

Starting from s[n], which can be thought as your current seed, when entering a battle with a Pokémon (wild or Synchronizable legend), the first seed used to generate the Pokémon is s[n+1].

This number is used to determine the nature of the Pokémon as follows:

s[n+1] mod 25

This operation will produce a number between 0 and 24, which is the target nature.

Next is the PID generation.

PID is [s[m]][s[m+1]]

where m starts as m = n+2 and is incremented by 2 until a PID is found with the target nature.

In the end the IVs, as usual, are formed with [s[m+2]][s[m+3]]

<insert complete example with pid generation>

Effect of Synchronize:

The low bit of s[n+1] acts as a trigger.

If it's 1, Synchronize has failed. In this case the method above is used, but s[n+1] is NOT recycled to determine nature. Instead another call is made to the RNG and that number is considered to be s[n+1].

If it's 0, the the target nature will be that of the first Pokémon in your party.

Next step is the PID generation.

PID is [s[m]][s[m+1]]

where m starts as m = n+2 and is incremented by 2 until a PID is found with the target nature.

In the end the IVs, as usual, are formed with [s[m+2]][s[m+3]]

<insert complete example with pid generation>

We can use phone calls to Professor Elm to verify or determine our initial seed. When called he will give one of the following responses:

"I expect there are some Pokémon in the Kanto region that I don't know. There are probably methods of evolution that I'm not familiar with yet. I should use that perspective and discover what I can."

"There are so many different ways that Pokémon evolve, aren't there?! Some Pokémon don't even evolve until they meet certain conditions first!"

"It seems that Pokémon that have been infected with Pokérus level up better. We're not quite sure why..."

We will refer to these messages as K, E, and P.

Each time the Elm is called the RNG is advanced by one.

The result is processed as follows:

result = seed % 3

0 = Evolution

1 = Kanto

2 = PKRS

FRLG

Information can be found in this thread.
2. ### LightningFusion

Joined:
Mar 3, 2009
Messages:
1,781
Some quick info.

I am trying to abuse for suicune, and save stated in front of it. Waiting to battle it and instantly battling it results in the same nature and IVs. This leads me to believe there is a new method "J" and it doesn't advance by time necessarily.

Since there is no journal, once I hit my seed, I will be trying a few things to advance the seed including: phone, walking 128 steps, and others.
3. ### VileTung

Joined:
Jul 25, 2008
Messages:
1,384
What if you wait 1 minute and battle it then? Does it still have the same IVs/Nature?
4. ### LightningFusion

Joined:
Mar 3, 2009
Messages:
1,781
Yes, waiting time then battling still results in the same IVs.

I walked 128 steps around suicune and DID get a different one. So it looks like a step counter to advance is still in the game. Is it 128 still, perhaps.

Edit: Called first number on my phone list, and it didn't advance the frame. It may depend on who you call and what is said, but whoever I called it didn't.
5. ### VileTung

Joined:
Jul 25, 2008
Messages:
1,384
So it doesn't tun at a fixed rate (or how mingot called it). Well I'm planning to help you tonight, I try to get a Sudowoodo.
6. ### ClikC

Joined:
Apr 21, 2009
Messages:
327
Okay, i'll document the little bit of information I have here. Like LF I'm working on Suicune.

SRing and making a save state on my cyclo I get this frame, even after leaving the game running for a few minutes. I am using the single save state on my Cyclo Ds, I'm NOT using a Synchronizer.

SRing at '2009 / 9 / 12 (16:11)' got me;

Seed: 811001FD
Offset: 146
Seconds: 10
Delay: 500
Quiet #245 Suicune: 19 / 16 / 22 / 22 / 4 / 18

After a certain amount of time, I got a phone call whenever I re-loaded the save state (assuming phone call activation is time based, as changing my clock back on the DS and reloading stoped me getting the phone call) got me this;

Offset: 135
Sassy #245 Suicune: 6 / 28 / 5 / 3 / 15 / 20

Walking exaclty 128 steps (party of 5) got me this;

Offset: 83
Quiet #245 Suicune: 31 / 28 / 11 / 4 / 11 / 14

EDIT: It's worth noting, during both mine and LF's primary tests. We both had two runner pokemon on the Jhoto map. It's likely they effected whatever results we gained. I'll be conducting some more tests now I have knocked them all out.
7. ### mingotfree agent

Joined:
Jun 15, 2008
Messages:
3,056
Good Job, guys.

It looks like my task is to figure out whether the RNG is just quiet in some locations or if what I saw was a completely different RNG. I really hope it is just quiet in some areas, as the idea of two RNGs is a bit scary since it could be using one for part of an equation and then the other for the PID/IVs. Don't really want to consider that, though :/

And then there is the the task of figuring out the "new method J", which will probably get a new name.

I'll be pretty busy until next wednesday, but will try to squeeze in some time.
8. ### Equinox

Joined:
May 22, 2008
Messages:
1,185
Okay, mingot, I'm about to start the egg PID research.

Basically I need to get the time on my DS synched with my computer.
catch a pokemon, check seed, and then i should put the parents into the daycare and check to see if I get the correct nature, then I can try to get the next PID....I have a save state to make this easier, but how will I know which frame I am on if I dont know exactly how to advance the RNG?
9. ### LightningFusion

Joined:
Mar 3, 2009
Messages:
1,781
Just catch a poke to find the seed, then put pokes in the daycare and get like the 5 first eggs. Find out the natures of the egg and see if they match breeding pid dppt normal. Should be the first 5 in a row.

Raikou and Entei -

To abuse for raikou and entei, you should do it at your first encounter, because if you defeat them and beat e4 to battle them again, they are released as soon as you beat the e4, so you really can't abuse for the seed. We will being doing tests on this most likely. *Found out by ClikC*

When they are first released, Raikou is frame 1, and Entei is frame 6 of method 1. Just like the bird trio in platinum.
10. ### Equinox

Joined:
May 22, 2008
Messages:
1,185
Alright, sweet, thanks. Ill get started right now.
11. ### ClikC

Joined:
Apr 21, 2009
Messages:
327
Just to add-to LF's post, and to pop up some info for anyone wishing to help out with the testing, or are wanting to RNG abuse HGSS in the future.

Lugia - You HAVE to encounter lugia to forward in-game play. But I have tested and can confirm, that you can faint and re-encounter lugia at the same level, with none-set IV's and Nature after defeating the E4.

Ho-oh - Most likely the same as lugia, but as yet un-confirmed.

Dratini - Once you've answered the questions, you can come back for your Dratini at any time. The nature and IV's are not set until you start talking in order to collect.

Raikou & Entei - Thanks to LF for confirming and checking. Method 1, starting frames 1 and 6 respectively. They are best RNG'd when you encounter them, and unfortunately you have to encounter them to forward the game. Fainting them and defeating the E4 automatically re-spawns them, and likely not to be controllable.

Suicune - Unlike the the others, Suicune's Nature and IV's are set when you battle her the first time. Method "K" (as yet unknown).

Lati@s - Okay, these are like the two Dogs. You have to encounter them to forward the game, and they are going to be best RNG'd then and there. Fainting and defeating the E4 automatically re-spawns them, and likely not to be controllable.

Thats all the known ones so far, I STRONGLY recommend anyone with the ability to back-up HGSS saves, does so at these key moments, If you wish to obtain competitive versions of these pokemon.
12. ### Wild Eeppet pet pet

Joined:
Aug 2, 2006
Messages:
1,604
I really like the decision to separate the research from the help thread.

I took a look at the state of the RNG after a wild battle to help me figure out some information that would help me look at the Poke Radar.

I just did this in Platinum.

I got seed A4130259, and I did not use a synchronizer.

I used Sweet Scent in the grass of Lake Valor.

1. Expected Frame 2/Actual 129 was a Staravia that suicided with Take Down.
2. Frame 136 (Actual 147)
3. 154 (A 165)
4. 172 (A 233)
5. 240 (A 251)
6. 258 (A 283)
7. 290 (A 309)
8. 316 (A 387)
9. 394 (A 435)
10. 442 (A 523)
11. 530

When consecutively scenting in the grass, each Method J frame seems to be previous Actual + 7. So it appears that after a battle, the RNG picks up 6 calls after the actual frame.
13. ### Equinox

Joined:
May 22, 2008
Messages:
1,185
I decided I need to get further in the game to do this. im only at goldenrod and lack the ability to check IVs at a high level. When i get to somewhere further or get some rare candies or something I will continue research. I would prefer to do it, but if someone else would like to, go ahead D:
14. ### Wild Eeppet pet pet

Joined:
Aug 2, 2006
Messages:
1,604
Looked back at what determines what happens with step mechanics in Platinum, and it seems I am totally off base.

Seed AA150259

Expect encounters on first, second, fifth, and seventh step, but the first encounter happens on the tenth step, producing frame 12.

There's definitely something wrong with my previous algorithm...
15. ### Romsstar

Joined:
May 9, 2009
Messages:
596
I don't really know if it matters but synchronizers seem to have still the same about 50% rate that having it in the first place in your team the pokemon you are fighting will have most likely the nature of the synchronizer.
however, this doesn't work on the Extremespeed Dratini though (as you are not fighting it of course).
Sucks somehow:D
Have 14 badges so far so I gonna start today or tomorrow with the Egg PID research if I can^^
16. ### Equinox

Joined:
May 22, 2008
Messages:
1,185
Im already starting the Egg PID research, I just need to get in touch with LightningFusion, it really probably doesnt need more than 1 person to do =/
Be my guest if you want to though, im noone to tell you not to :P
17. ### Romsstar

Joined:
May 9, 2009
Messages:
596
Ah I see well if there is no need I'll just play along and see what I can find out. Btw would be also interesting if breeding with an international and a native game one still will raise the chance having a shiny egg?
as it was like 1:2048 in Platinum as I recall. Though it would be damn nice to have it like 1:1 again. I hope the research will be succesfull;)
18. ### LightningFusion

Joined:
Mar 3, 2009
Messages:
1,781
I tested the inserting GBA cartridge and to add 1 to the delay changing it from always even to odd and still worked. No other news for now.
19. ### ClikC

Joined:
Apr 21, 2009
Messages:
327
Okay some further notes here, I'm testing Dratini in the Dragons Den. Which is Method 1, starting frame 1.

SRing at '2009 / 9 / 14 (11:29)' got me;

Seed: A50B01F1
Offset: 1
Seconds: 10
Delay: 488
Hasty #147 Dratini: 19 / 26 / 2 / 24 / 13 / 8

So I went out side of the building, moved around on the steps outside for a bit and then back in and got the same frame. Then I went outside and spoke to my pokemon, it gave me the option to answer yes or no, I tried with both answers then collected Dratini (This appeared to be the option to collect and item, i received something for speaking and answering yes). This jumped me to Frame 35 (Impish, 27 / 12 / 29 / 0 / 9 / 17).

To i repeated the above again, only this time, I spoke to my pokemon again afterwards (This time getting 3 dots in a speech bubble). This got me Frame 49 (Jolly, 30 / 15 / 28 / 10 / 17 / 12) both times.

So then I went back, and walked 128 steps exactly with a party of 5, which gained me Frame 6 (Sassy, 4 / 8 / 20 / 25 /1 / 25). So that seams unchanged.
__________________

So step two, collected the item from my pokemon. Then saved and SRing at '2009 / 9 / 14 (12:21)' got me;

Seed: 9E0C01F1
Offset: 1
Seconds: 11
Delay: 488
Modest #147 Dratini: 8 / 8 / 21 / 24 / 15 / 25

Agian checking to see if I cross my step counter threshold (which I didn't), I then spoke to my pokemon (a green musical note in a speech bubble and bouncing 2 times), got me Frame 71 (Docile, 15 / 3 / 29 / 10 / 27 / 19).

On the same seed, I started messing around with the radio. Previously, I was tuned to the channel to wake snorlax up, changing the tuning using the bottom Right button got me Frame 2 (Relaxed, 25 / 24 / 15 / 25 / 2 / 27). Top Right button got me Frame 15 (Naughty, 22 / 7 / 7 / 2 / 25 / 15). Bottom Left hand button got me Frame 5 (Careful, 7 / 4 / 31 / 9 / 18 / 5) and the Top Left hand Button failed to advance the frame.

The top right button, followed by the bottom left button got me Frame 18 (Relaxed, 22 / 15 / 4 / 31 / 7 /18).
__________________

So, we may have some VERY inconsistent methods of frame advancement. If we can figure out exactly which kind of reactions obtained from speaking to a pokemon advances the frame by such an amount, and the same for the radio, we might get somewhere.

I'm now going to attempt to get a Flawless XSpeed Dratini, and perhaps work on egg PID's shortly there after.
__________________

EDIT 17.15

I may have found a way to reliably advance frames on HGSS. HOWEVER, this needs considerable amounts of testing.

Using the PokéGear's radio function, I alternated between clicking the bottom right hand button, and using the stylus to de-tune the radio (moving the circle to the center) and then clicking the lower right hand button again. This advanced the frame 1 at a time once I was close enough to my target frame using save states. However, as I previously showed, different stations may advance the RNG at different rates, so we need to test and see if a reliable way to advance frames can be found. It should be noted, when de-tuning the radio that accidently touching another station will advance the RNG, so be very careful.
20. ### Syberia[custom user title]

Joined:
Jun 22, 2005
Messages:
5,070
Well I just discovered something that sucks

The radio doesn't work in Lugia's cave, and no amount of messing with it advanced its offset at all. Neither does the cell phone. And there's not even any pokemon following you. The only way to reliably advance Lugia's frame might be to go after it with only a Lanturn in your party, knowing Surf, Whirlpool, and Flash (the necessary HMs), and manually advance the frame with the 128 steps thing.

Or walking on the path outside his room, since I have access to save states.
21. ### Dance Soldier

Joined:
Jun 23, 2009
Messages:
13
Hey Guys I would love to join your Team testing with you, can someone break for me down how I determine the later frame after any advancement that may occur? I know that the safest way to control the advancement would be in a place with no NPC movement and right now I'm standing in front of Mewtwo on which I would love to test that out.

So just in short Waht amount of Delay should I be expecting when rushing for the "Get-into-the-Game-A-Button-click" :P and how shall I afterwards check the Initial seed (Just by capturing a wild?). Thx beforehand and let's fight the power (=RNG) XD

PS: I Only have acces to the normal game via flashcart.
Hope that is enough though :X
22. ### LightningFusion

Joined:
Mar 3, 2009
Messages:
1,781
Unfortunately only access to a cart and not an emulator is bad. If your flashcart is a cyclo, you can use save states which would help. If not, you can put your game on your computer and play on an emulator with save states.

The Average delay is 480 - 510 about. You would find your seed by catching a method 1 pokemon. Any pokemon that go by the new method "k", you can't do until the alogorithim is found. Don't save after, obviously. You would capture a method 1 (raikou, entei, latias, which I think you are passed them all), use RNG reporter with the HG/SS delay option selected in initial seed finder. Do a couple of tests to see your delay and find the seed. With save states, you can test new things that advance it.
23. ### Dance Soldier

Joined:
Jun 23, 2009
Messages:
13
Well as for now my average Delay is exactly 490
and the seconds are something like 14
The Thing is I'm landing of Different Frames when I enter the Game
and the Method 1 Poke are like the Last one Frame 83 and what is
Crazy If I check Method J and like that I captured the Mewtwo to
see on which Frame I land then it dispalys me Frame 83 Actual 92
and the Frame 92 is exactly what with Method 1 the Spread would look
like so. I tried to calculate what makes the 9 Frames:
I did Turn+Steps+Turn = 3 (probably) + Encounter Frame 1 (hope that's right) and 1 Runner left so +1
so I come through on +6 = 83 + 5 = 88 so 4 Frames left.
So where are those Frames generated from is it the Encounter-Frame that is set to 5 for Mewtwo or is it something else?

Maybe I'm completely wrong but correct me If so.
The DPPt Rng was too easy but that here freaks me out.
wbr
DS

Edit: 16:10
Well it seems to me that There is no actual Method J anymore
Now I caught a wild one to find the seed and (luckily) standed exactyl before Mewtwo
so I landed on Frame 10 with the Method 1 and Mewtwo was for Method J (Frame 40 Actual 49)
so Frame 49 for Method 1. So what Causes these undefinable "Jumps" to a Frame that is nowhere
near or even just like random? Only good thing it doesnt Jump Backwards hahahahah XD SOB
24. ### ClikC

Joined:
Apr 21, 2009
Messages:
327

Mewtwo is NOT Method 1. It is a Method K pokemon, which is yet unknown but similar in function to Method J from D/P/Pt. Both are just Method 1 spreads, but J or K determine the order you will find them.

Likely your immediate spreads for mewtwo are both offset 1 for Method K. But untill we know more about it, you cannot know how they frames will progress.

In simple terms, you cannot RNG abuse mewtwo yet.
25. ### mingotfree agent

Joined:
Jun 15, 2008
Messages:
3,056
Guys, I am going to ask that we don't ask general questions about emulation, flash carts, save states, etc here. That sort of personal research needs to be handled outside of this topic (and really outside of the forums). I'd suggest asking a helpful member via PM or using the #smogonwifi IRC channel for this sort of thing.