Research Pokémon: Emerald - Glitzer Popping

[Joseph Page]

I am sure that this is an older subject for most, but I have only recently began my adventure into the third generation. Now, after beating the Hoenn Elite Four and playing around at the Battle Frontier, my achievement hunter urge kicked in and I wanted to complete the Pokédexes. Seeing how I only have the Emerald cartridge, over a decade after Nintendo events, and no hacking devices, glitches seem to be the only chance I have at doing this.
After doing quite a bit of research I found out about Glitzer Popping (a pleasant sounding term Werster created to avoid cliché "mew glitch/celebi glitch" titles), a sub-glitch of the Pomeg Berry glitch. Theoretically, by using Glitzer Popping, a player is able to corrupt the data of Pokémon within the first two PC boxes, altering the Pokémon substructures, essentially allowing any Pokémon, any item, and/or any move to be generated. It is a very touchie process and, as Werster stated in a video, seemingly random. However, as most of us know, Pokémon RNGs aren't actually random. Although I am no programming genius, it would seem that there would be a way to manipulate the corruption accurately. Which finally brings me to the point of this post: a collection of information, inquiries, and experiences using Glitzer Popping to more accurately create Pokémon. As a side note, I am not interested on the ethnicity of this glitch. I have no interest in transferring my Pokémon to future generations I don't even own. And I have no intentions of using them for competition either. With all that out of the way, let's start the discussion.
So far, my experience with Glitzer Popping started off promising and then halted abruptly. The first corruption managed to yield a "good" egg, except the moves had switched with the growth making limited creation options. Thus, the brick wall occured. After trying multiple different Pokémon, in multiple different box slots, I got nowhere. So, I decided to stop flailing around in the dark and try to gain so foundation to work on. This actually complicated things even more, furthering my frustration.
Doing more research I came across articles stating that the traded Horsea is guaranteed to have the proper PID for Growth and EV exchange, another stating DOTS has the proper PID. Multiple attempts yielded bad eggs almost every time with these two. When a good egg did appear it only contained an exact copy of the Pokémon that was corrupted. The few other good eggs from other corrupted Pokémon I managed to get only yielded clones as well.
After trying to control as many variables as I can only speculate on, I feel as though I am backtracking. So I decided to reach out to the Smogon community to pool research and information.
Because all of my tests failed I can't be sure of anything, however it does seem some variables can be predicted. Such as, accessing just one slot beyond the party Pokémon usually only corrupts the 22nd slot of box 2. Many times the corruptions made a diagonal pattern. On very few of those occurances every egg directly to the left of a non-corrupted Pokémon were good eggs, albeit only containing clones of the Pokémon which was corrupted. There were also quite a few occurances where every single Pokémon was turned into a bad egg. This definitely threw a wrench into the works because all the articles and videos I've reviewed never mention any kind of pattern, much less every slot being corrupted.
Now, I know this post is rather lengthy, and I don't expect the very next post to have all of my answers in it(as nice as that would be), but I do hope this thread could produce some more, solid, information about the subject than is already out on the web. I am confident that Glitzer Popping is not random and could be manipulated as a player sees fit.

 

[Zowayix]

Just hopping in here to say kudos for making this thread; this glitch deserves much more research as it's pretty much the only big game breaker ever discovered in Gen III. I created the Glitzer Popping article on Bulbapedia just a few weeks ago and it's still very, VERY barren.

 

[Joseph Page]

Just hopping in here to say kudos for making this thread; this glitch deserves much more research as it's pretty much the only big game breaker ever discovered in Gen III. I created the Glitzer Popping article on Bulbapedia just a few weeks ago and it's still very, VERY barren.

Thank you. Maybe this will generate some more information for the Bulbapedia article. Have you experienced any patterns that are note worthy?

 

[Metarkrai]

- If you want to find data about Pomeg Glitch research and understandings, you'll find most of the known data here : http://forums.glitchcity.info/index.php/topic,6868.0.html

- As you said, the Pokemon corruption doesn't depend that much in RNG.
The only RNG part in there is the DMA, an anti-cheating procedure that moves RAM adresses when you do something (entering a door, making a battle,...) in order to prevent you from modifying a specific value accurately.
After that, the "effects" of the corruption only depend on the data that the Pokemon Selection pointer reads.
That pointer reads blocks of data and tries to interprete them as party Pokemon data, but since they aren't party Pokemon data from the beginning, the checksum validity check oftenly fails, and the game changes the selected "Pokemon" into a Bad Egg. And that slight change is the corruption that PC Pokemon (and other values) can suffer from.


- The Bad Egg transformation is done by changing (or trying to change) 3 specific bits in a Pokemon's data : 1 of them for the Egg state (this bit can be set to 1 or 0) and the 2 other for the "Bad" state (these bits are set to 1).

In order to "corrupt" a Pokemon into another valid Pokemon using that glitch, you need to corrupt a Pokemon's PID or TID (ID/SID couple), and the Pokemon's checksum needs to not become invalid after the corruption.
Thus, only the first bit corruption I mentioned can fit, based on the location of that bit in a double-word and based on how how PID and TID encrypt the rest of a Pokemon's data (the rest of its data, except nickame + trainer name, is stored into 4 substructures, and these substructures are crypted with the Pokemon's PID and TID).

You also need the corruption of the 2 other bits to not alter another part of the Pokemon's data, or else he'll become a Bad Egg.
Here, you can either "manipulate" the corruption in order to make the corruption of these 2 bits fall after the Pokemon's data, or you can pray for a Pokemon that will have the concerned bits already set to 1.
Due to the data encryption from PID and TID, and the fact that you casually don't know the PID and SID of a Pokemon, you don't know anything about the hexadecimal values of your Pokemon, which makes it a rough 1/4 chance to have both these bits already set to 1 on a certain Pokemon.


- There is also another rule to respect if you want to keep the ckecksum valid after a PID/TID corruption, but it's harder to explain.
It will only manifest in certain specific cases : Pokemon caught in certain Balls, having "too much" Speed EVs, having "too much" Coolness, having "too much" Onctuosity, and can be easily prevented with simple actions.

That first "bit corruption" I spoke of, which can be a bit set to 0 or a bit set to 1, is also a bit tricky since the bit set to 0 or 1 is chosen depending on data located above the PC Pokemon that's getting corrupted (if the PID/TID of a PC Pokemon is about to get corrupted by that corruption, the values that will make the game decide for a bit set to 0 or to 1 will be from the data of the PC Pokemon one slot above this one).
Thus, if you try to corrupt multiple Pokemon with the same Pokemon one slot before them (an empty slot for example), the Glitzer Popping corruption will not work at all on certain Pokemon because of that (you will for example need a bit set to 0 to corrupt the PID, but the game will only do a bit set to 1).


- This lead to the creation of Pokemon designed to "manipulate" this effect, called corruption initiators.
This corruption initiators allow you to be sure that a bit set to 0 / bit set to 1 corruption is possible on the TID or PID of the PC Pokemon that will be located one slot after them.
They also manipulate things so that when the first "bit corruption" affects the PID/TID of the PC Pokemon one slot after them, the two other bit corruptions will not touch that PC Pokemon (but the PC Pokemon one slot after them).

Since in-game traded Pokemon have a PID of 0x0000xxxx and a TID of 0x0000yyyy, a single of these bit sets is enough to corrupt them, and it's easy to create a corruption initiator for them. (Take the in-game traded Plusle, don't give it any EVs, make it forget every move except Growl, and you have your initiator).

But for Pokemon you would catch yourself, you can't guarantee that (unless you know your SID and the TID of your Pokemon beforehand), so two initiators are required to take care of both bit sets. These need more preparations to be made, but they can be made, which is a really useful thing.


- The Pokemon corruption is really interesting and powerful because PID also has another anti-cheat function in a Pokemon's data.
The main part of a Pokemon's data is stored into 4 substructures (Growth, Attacks, EVs and Condition, Miscellanous), and these 4 substructures are stored in an order that depends of the Pokemon's PID. (There are 4! = 24 possible orders, and the games uses PID (mod 24) to choose one of these orders)
When the PID is corrupted, the order of these substructures is changed, and the game will misread them (for example, reading the Attacks substructure on the EVs substructure), which will cause great changes, and allow you to easily manipulate species, held item, moves, EVs, IVs,... using a single corruption (and Smeargles with specific moves/EVs/..)

- But this also means that for each PID, there's a single substructure swap possible, so you can't corrupt a Pokemon into really everything like this (if its Attack substructure is read on the EVs substructure when corrupted, you can't change that fact since it's tied to the Pokemon's PID).
But this also means that if you know the Pokemon's PID, you know its substructure order,and how it will become once corrupted. This change of substructures is called a Corruption Type, and there are 10 different Corruption Types for Pokemon.
Using a table I made, it's easy to find the corrupti type of a Pokemon (as long as you know its PID), and know what you can do with it using Glitzer Popping.



- Regarding the diagonal patterns or occurances you've seen, this comes from the lenght of PC Pokemon data and Party Pokemon data.
A PC Pokemon data is 80 bytes long, whereas a Party Pokemon data is 100 bytes long.
Thus, if the Pokemon Selection Pointer corrupts the PID of a PC Pokemon, the next Up push will corrupt something different on the Pokemon above him due to that difference of sizes.
But, after 4 Up pushes, the Pokemon Selection pointer will have moved through 400 bytes, and 400 bytes is also equal to the 5 PC Pokemon data.
Thus, the PC Pokemon that's 5 slots before the one that suffered a PID corruption is likely to suffer a PID corruption too.
There's a sort of "5-periodicity" with PC Pokemon corruption that induces the patterns you've seen, (diagonals of Pokemon that aren't affected by the corruption, or that are all changed into an Egg, or that all became Bad Eggs).(They are diagonals because PC boxes have lines of 6 slots.)

This "periodicity" is really useful since it allows us to corrupt up to 5 Pokemon at the same time with really good corruption chances.



- This represents a good amount of data that becomes really helpful in managing a Glitzer Popping corruption on multiple ways (know what you will obtain, be sure that the corruption will work, have a high chance to get a successful corruption, avoid having residuals of glitched data)

And I also have trouble to sum some things up, as the good understanding of the mechanics isn't required to perform Pomeg Glitch and make corruptions.

- If you want to start with this, I recommend you to watch Chickasaurus GL videos, as he shows well how to perform a good amount of Pomeg Glitch procedures.
About Pokemon Corruption, I made a pastebin for a "quick" method that allows you to obtain every Pokemon/Item/Move : http://pastebin.com/2kJpBQCr
It uses the most optimized procedure to make things work as nicely as possible. (I don't have a video of it being done as the procedure has been updated since I made the video)
That pastebin also indicates interesting Pokemon/Items/Moves to obtain, as some Glitch Pokemon/Moves are really interesting for diverse reasons.

If you're interested about corrupting any Pokemon, then I redirect you to that page : http://forums.glitchcity.info/index.php/topic,6868.420.html
Where I tried to explain things about a form of Glitzer Popping called Double Corruption, the reason why corruption initiators are needed, and how to use them.
(You can skim through and only read the parts explanining how to use it as it's really long).

The procedure to obtain corruption initiators has also been optimized, and you'll find the lastest one here : http://forums.glitchcity.info/index.php/topic,6868.msg199696.html#msg199696


The correspondance table between PID and corruption types is here : http://www.petit-fichier.fr/2016/02/15/precisions-sur-les-sous-structures-de-la-gen-iii-en/
I only translated the tables, so the textual parts explaining how to use the different tables are still in French, but the main information has been translated.


Unfortunately, there isn't really a post/link where you could find a summed up version of the glitch and things, as it streched itself in a lot of directions, and as the way to perform Glitzer Popping in itself stayed without any main procedure for a long time, so if you have a question or an issue about something, drop a post on the glitchcity topic, or in one of my videos about Pomeg Glitch, and I'll try to help you as best as I can.

I started to write a folder that sums up the explanations and procedures for every uses of Pomeg Glitch and Glitzer Popping in Gen III, but it quickly ended up being really huge, and the updated knowledge/strategies forced me to rewrite a lot of parts. As to now, I'm still rewriting some parts, and a good part of the folder hasn't been written yet, so it won't be out before a good amount of time.



Here's the structure of that file, if you want to have a clearer view of the current state of Pomeg Glitch :

Pomeg Glitch
/Introduction + Explanations
/Battling with an Egg Trick
-Hatch an evolved Pokemon
-Evolve an Egg using a trade
-Shedinja Egg

Glitzer Popping
/Introduction + Explanations

-Pokemon Corruption
/Introduction + Explanations
--//Obtain every Pokemon/Item/Move
--//Interesting Glitch Pokemon
---///Quick cloning
---///Quick Anti-Cloning
---///Decaswitch
---///OP Glitch Pokemon
---///Funny corruptions
---///Miscellanous things
--//Interesting Moves
--///Ditto + Smeargle combo
--//Interesting Items
--///Give Rare Items to a Pokemon
--//Cleaning the PC
--///Obtain obedient Mew/Deoxys


-Ingame corruptions
/Introduction + Corruption of various data
--//Safety measures
--//Unlock Southern Island
--//Item duplication
--//Corrupting Pokeblocks
--//Corrupting Hidden Base items
--//Make a speedrun
--//NPC disappearance
--//Walk on cycling road

-Completing Pokédex
/Stealing Pokemon
/Generating Pokemon

-Complete Double Corruption
/Introduction + Expllanations
--//Obtaining corruption initiators
--//Obtaining dummies
--//Choosing a corruption type
---Make wonderful combinations
---Obtain every Item
---Ovtain Lv0 Pokemon
---Obtain Pokemon with full IVs
---Obtain special ribbons
--//Training and corruption of Dummies

-Shinyhunt with Pomeg Glitch
-/Shinyhunt Eggs
-/Shinyhunt Jirachi/Celebi/Every non-breedable Pokemon
-/Shinyhunt in Battle Pike
-/Shinyhunt in Battle Pyramid
-/Shinyhunt in RS Trainer Tower
-/Shinyhunt at SS Anne
-/Shinyhunt GHOST
-/Shinyhunt with Safari Balls

-YOP Glitch

-Charm Glitch


-Transfer Pomeg Glitch
-/On Fire Red and Leaf Green
-/On RS

On Fire Red and Leaf Green
-/Pomeg Glitch
-YOP Glitch & Charm Glitch
-/Glitzer Popping
--Obtain any Pokemon/Item/Move
--Interesting Pokemon/Item/Move

/On Ruby and Sapphire
-YOP Glitch
-Charm Glitch

 

[WideTomato]

Metarkrai Did you just lurk on smogon for 5 years before finally finding the right thread to share your massive knowledge of Glitzer popping?

 

[Metarkrai]

I made a Smogon account years ago for some reason that I don't remember, but I think I never really went on the forum.
And no, I didn't know there were Smogon threads about Glitzer Popping, I only knew of glitchcity and PRAMA's topics on that matter.

But I have recently been searching for threads/posts about glitzer popping (and more generally Pomeg Glitch), and google pointed me this one.

That important list of uses is the result of a year and a half of research on the glitch by several people, and has come through multiple main changes (the techniques about PC Pokemon corruption were heavily revisited a few times).
It is still under construction, as some changes/new things come from time to time (some parts of the PC Pokemon corruption strategies were updated 2-3 weeks ago).

And as it's big and not really written in a single block somewhere for now, it you have any question/issue regarding it, I will gladly try to answer it.
Because there's a good amount of possible uses of Pomeg Glitch (out of the already listed ones) that you could think of that end up not working because of a certain thing, and these "not really working" ideas aren't really displayed too.


The "current" research topic on Glitzer Popping is Arbitrary Code Execution (using a Glitch Pokemon/ Glitch Move in some way), as it would allow us to cover nearly all the potentially interesting things to do (unlock special islands for everyone, Mirage Island, Feebas Tiles, teleport to Safari Zone, steal Battle Factory Pokemon,...)

The main lead was brought by Wack0 : http://forums.glitchcity.info/index.php/topic,6868.msg199627.html#msg199627
Glitch Move animations could provide a good ACE, allowing us to make a code execution without crashing the game. (TheZzazZGlitch already did an ACE before, but lots of data were corrupted in the process and quickly made the game crash. Thus, he was forced to corrupt saved data, which makes its procedure emulation only as you need to predict the encryption value and checksum of your save file. He was also using Pokemon nicknames who limited the values he could use to build its code.)

Here, if the Glitch Move animations can indeed allow for a working code execution, we would use PC Pokemon data, PC Items, and Battle Bag Items (Lv 50 and Open Lv) to write a code to be executed. (They are the 3 main things you can almost completely mainpulate.)
Techniques to manipulate parts of a Pokemon's data, and manipulate almost every bytes of PC Items and Battle Bag Items were already thought, so the only missing part is the trigger of the Code Execution.

If Glitch Move Animations don't work well, other elements like Glitch Pokemon species name (loaded in PC, or said by a NPC), Glitch Move names (when forgotten), Glitch Type Sprites, glitch effects, could be the way to go.



Other than that, the main ways to use Glitzer Popping or Glitch Pokemon/Moves/Items were quite heavily searched, and it becomes harder to see shadowy areas where a nice Pomeg Glitch use could bring you interesting results (as most of the mechanics behind the glitch were understood, and as most of the in-game mechanics were tested to see if there could be a way to abuse them, or if the current techniques can't affect them at all).
But again, if you have questions about it feel free to post them, because that glitch has so many uses that it's hard to talk about everything in a condensed form.

 

[gvmgvm40]

Creating Pokemon, Pokemon stealing, glitch Pokemon and moves, visual glitches, changing swarms, unlocking event islands? This deserves more attention. This is glorious.

 

[Metarkrai]

Here is a list of links that will provide more information :

It is really useful to use a Pokémon with Curse and HP Ups like Banette in order to quickly put it at 1 HP and kill it with a Pomeg Berry.
Pomeg Glitch can be exported to RS and FrLg by trading Pokémon with HP "below 0" (they lost 2 or more HP with one Pomeg Berry), but there aren't many interesting uses of it for now. (Glitzer Popping can't be performed in RS, and wouldn't be useful if it could due to party Pokémon being located far away from the rest of the loaded data)

- Item Duplication and Tm/Berry Pouches Restauration :

There's a list of precautions for Glitzer Popping data corruption too. They make Glitzer Popping useable without any main issue.

- Unlock Southern Island :

There isn't an english description here, but the method is pretty simple.
Perform Glitzer Popping and hold Up for 14-15 seconds. Then go to a Pokémon Center and check if the delivery man appeared or not. Try until he appears. (1-2/32 chances to happen)

- Secret Base Item corruption :

Not translated yet. Specific item placements allow to obtain the event Regi dolls and 7 glitch decorations.

- Decaswitch :

A really nice improvement of Pomeg Glitch that removes the need of Pomeg Berries. Also helpful to perform it in FrLg without relying on trades anymore.

- Obtain every Pokémon/Item/Move : http://pastebin.com/2kJpBQCr /

It contains a list of interesting Glitch Pokémon/Moves at the end, along with their purpose.
The explanative video uses an outdated corruption method, but it's still nice to see one.
Since you can obtain every Glitch Pokémon/Move with Glitzer Popping, you can glitch up to your heart contents with them.

- Breed every non-breedable Pokémon (and shinyhunt them) :

Really useful to shinyhunting. One of the few glitches that uses Pomeg Glitch in FrLg.

- Catch Battle Pyramid Pokémon :

/ http://pastebin.com/R5ppR91x

- Unlock Faraway and Birth Islands :

It doesn't work for US and Jap versions, but works for Fr,Ita,Spa versions (hence the lack of english explanations)
But if you have a Fr,Ita,Spa version, I can translate the explanations if you're interested.

- Glitched Battle Animations :

The RS ones are really cool.
- Arbitrary Code Execution (emulator only) :

- Fast cloning :

The method has been a bit improved, but this one is already really useful.
- Reverse cloning :

Cloning Glitch Pokémon also perform reverse cloning, which is quite useful.
- Charm Glitch :

Tiny glitches tied to this : https://www.youtube.com/user/VaePomegGlitch/videos
- NPC disappearance :

/

- Walk on cycling road : https://www.youtube.com/watch?v=R71ISQSKpUY

- Obtain the Caterpie perfect initiators : http://forums.glitchcity.info/index.php?topic=6868.msg199696#msg199696
I haven't written the rest of the procedure in English yet, but you can still ask if you want something as an obedient Mew/Deoxys, or a Magikarp with Judgement.
You can see them used with an older procedure here : https://www.youtube.com/watch?v=HhHlANrnOCI (even if the procedure has been optimized, it's sill nice to see it being performed)

- Informations about a potential Code Execution way : http://forums.glitchcity.info/index.php/topic,6868.msg199627.html#msg199627
- A 3/4 stars speedrun route : http://pastebin.com/GjPxMXGu
The 3 star route has been completed (it only needs some cleaning about items management), and the 4th Star (Hoenn Pokédex) routing hasn't been is on hold.
The route also introduces an optimized team for Battle Palace, which was quite tough to create and set up.

I also updated the bulbapedia page about Glitzer Popping to include the chain of mechanics that are used to obtain a data corruption, and some specificities of that data corruption : http://bulbapedia.bulbagarden.net/wiki/Glitzer_Popping


Nearly all of the remaining sections I mentioned in my previous post were written somewhere (mainly glitchcity) at some point of time, but they need some updates to become nice and clean procedures.

It is always useful to use Pomeg Glitch and try to do funny things with it because a good amount of interactions weren't thoroughly tested yet.

Again, if you have a question about a Pomeg Glitch/Glitzer Popping use, an issue, or if you want the translation of a certain method, don't hesitate to contact me.

 

[The Great Roydinho]

good to see someone still playing the old hoenn games. i also always wanted to do this method to get jirachi deoxys etc. but i really cant be assed to understand all the nerdy thinking that goes into it. one day though. on a side note how the hell does someone just stumble upon this shit?