-
Welcome to Smogon! Take a moment to read the Introduction to Smogon for a run-down on everything Smogon, and make sure you take some time to read the global rules.
-
Congrats to the winners of the 2023 Smog Awards!
Research Breeding RNG Quirk
- Thread starter JuryRigging
- Start date
Looking at the disassembly of sub_296154, there is no additional source of pseudorandomness called by the function, and it appears to have the same side effects as gfl2::math::Random::Next, which is to say it updates the values at the address it was passed in the same way. It differs only in what it returns and the format it expects of its input. As far as I can tell, yes sub_296154 is a second TinyMT function, but since it's called with the exact same input as every call to glf2::math::Random::Next (a copy of v6[3]), it's still the same TinyMT and not an additional one.
I continued from the save where I left off, picked up 4 more eggs and got these PIDs:
665AC165
41296480
3C0E73FE
FC4FF34E
Then I reset, picked up another 4 eggs and got these PIDs instead
6AF91645
DDC4F42A
9A4F1255
3FE523E1
Furthermore, if you look at all the frames of my egg seed F8299263F0EA89B2ECA4D98099C4E79C, you can see that none of the PIDs are anywhere to be found. The encryption constants for those four eggs, D829BC4D, CAD2C7D7, E17F3745, 6533F451 can be but that's it.
Code:
F8299263F0EA89B2ECA4D98099C4E79C 550FBDB9
8AA283A0849158F2F0EA89B2ECA4D980 678BE978
E692DB30620DD940849158F2F0EA89B2 204DB144
2F41AEA8BC20B800620DD940849158F2 AA0CD702
5725332AFB08E2D6BC20B800620DD940 342DD108
13D92E05F7AE6FA57478F338BC20B800 9952B595
DA2FD4A07F48EDA7F7AE6FA57478F338 9944157A
B29AADBE6F146B4E7F48EDA7F7AE6FA5 4A8729AE
43C0C0B5576D10CBE0647AA07F48EDA7 0BF367FD
3AE228BB2C189B4BD81D0125E0647AA0 EDE1467F
9B311DB478D4F1522C189B4BD81D0125 43A4CBA2
C3DA2E2A7DCB154478D4F1522C189B4B EF4C484A
D93EB8D881EAE1E77DCB154478D4F152 97FB9914
38BEEAA78ACD6D0C0E9AF0097DCB1544 7178F5E9
2E440737E6C1BBDC05BD7CE20E9AF009 21C5B6F3
0F4C5DF5FB25724669B1AA3205BD7CE2 09F4FFA1
B1909EB50778C6A5745563A869B1AA32 D829BC4D
C6FCC0AEDCA6A9410778C6A5745563A8 845D3700
551FB42D72355FCB53D6B8AF0778C6A5 52F54829
143D0C789F9C824372355FCB53D6B8AF 77D8A4B6
DCA2252DB66DE47610EC93AD72355FCB 99DA157D
CF2F4F8B3C9AAB2F391DF59810EC93AD DE0661D3
9704BF602D41D72E3C9AAB2F391DF598 99DC75F0
A5CD7A7BB0DA89B4A231C6C03C9AAB2F 9886FFC3
85B9EBAB69447FF23FAA985AA231C6C0 10B11D6B
5A047DC68C967BB869447FF23FAA985A 2DA0AEEC
198FE715AD6D0F2F03E66A5669447FF2 47EDF7EB
5D193B022CBD279DAD6D0F2F03E66A56 6E99E180
F5CF61AF47A48433A3CD3673AD6D0F2F 6FE82FE3
D42516C9332E1CAEC8D495DDA3CD3673 47B68FB9
D66F5CAD29528A1FBC5E0D40C8D495DD 29014935
DB30C57D59053C99A6229BF1BC5E0D40 6787D701
F32259BB3094ED67D6752D77A6229BF1 55716965
CBF699456758073CBFE4FC89D6752D77 1D2A1C3B
3D57AEA131980059E82816D2BFE4FC89 CAD2C7D7
090147F7D39A1D19BEE811B7E82816D2 D6690AE7
026FCA88B0C40E84D39A1D19BEE811B7 8A64E2B2
E58229B2EE7CCE7EB0C40E84D39A1D19 06994DAA
80245B4E860A5E25EE7CCE7EB0C40E84 316E43AC
29E1D5886E818361860A5E25EE7CCE7E F0997876
B6080A02AB313D4E6E818361860A5E25 30BD8560
A9C32F1DB40BAB0124412CA06E818361 C6F6A011
FE7FB5D301F2BE5F3B7BBAEF24412CA0 DA3CAA8D
A218170A4304503001F2BE5F3B7BBAEF AE3555CA
7983E10F796B3E9FCC7441DE01F2BE5F 4C7C356D
987452AA0C7CEB22796B3E9FCC7441DE 6367119C
9FEAC75AE0B9D4A50C7CEB22796B3E9F D232C2D6
6EEDA7DFF41580376FC9C54B0C7CEB22 639CA77D
E17A86D252FABAE2F41580376FC9C54B A6F5BB28
CAACC51914079BBDDD8AAB0CF4158037 3E8542CB
6953761F770952959B778A53DD8AAB0C B752C241
8FE6594E4B79AC5E770952959B778A53 23B6A74E
A11CE841E6D066B7C409BDB077095295 E17F3745
0FE306D78E1239A969A07759C409BDB0 FCE734C1
ECDE907C9E8DE5C08E1239A969A07759 86E19542
11F125124FD4B5509E8DE5C08E1239A9 9F932B4C
78D40CD031EEFB4B4FD4B5509E8DE5C0 D1F82594
E566F6D5C67B5772BE9EEAA54FD4B550 826E3B8D
CE8694364303C189C67B5772BE9EEAA5 70677A50
65EF5ACF8D3947FDCC73D067C67B5772 95743789
5E4AB690238801388D3947FDCC73D067 92DDEEF8
5628563E861F43E6238801388D3947FD DB97317E
84CE7244C03B1F65861F43E623880138 9715B3EC
685DADAB243AB5D24F4B0E8B861F43E6 D98D2ECF
EBC072BF4A010ADEAB4AA43C4F4B0E8B 93C680D5
6C21AB5B88D473A4C5711B30AB4AA43C F0612E0B
F1012B0EAF9C6DF888D473A4C5711B30 00B2616C
2FCAB13D70F704AB20EC7C1688D473A4 A68FDB95
D17EF48812833D2B70F704AB20EC7C16 C613F624
7E69407662A916BA12833D2B70F704AB 38A31048
403A9103175B8251EDD9075412833D2B 6533F451
582511F0AC450872175B8251EDD90754 B6A05DAC
0F7F0E917B0A2C862335199C175B8251 2F3A7F13Out of curiosity, how are you all checking your PIDs? Via save backups or via KeySAV or similar?
Last edited:
Okay, figured out why I didn't get the same PID behavior as everyone else.
In my previous tests, I was using two English-language parents, and I have no Shiny Charm. I swapped in a Japanese and a Chinese Gible parents, picked up another five eggs, reset and then picked up another 5.
THIS time, the PIDs were all the same for both sets, AND what's more, they are found in the sequence of egg RNG calls.
9952B595
29014935
70677A50
62754F2C
42D29637
So it looks like only the rerolled PIDs get picked up from the egg RNG, the first PID comes from somewhere else. Likely means that egg RNG manipulation for shininess is only possible if using different language parents and\or have a Shiny Charm.
Can everyone who has the repeating PID pattern behavior confirm that one of these conditions is true for them?
In my previous tests, I was using two English-language parents, and I have no Shiny Charm. I swapped in a Japanese and a Chinese Gible parents, picked up another five eggs, reset and then picked up another 5.
THIS time, the PIDs were all the same for both sets, AND what's more, they are found in the sequence of egg RNG calls.
9952B595
29014935
70677A50
62754F2C
42D29637
So it looks like only the rerolled PIDs get picked up from the egg RNG, the first PID comes from somewhere else. Likely means that egg RNG manipulation for shininess is only possible if using different language parents and\or have a Shiny Charm.
Can everyone who has the repeating PID pattern behavior confirm that one of these conditions is true for them?
Yes, I have both shiny charm and am using Masuda method. I am almost completely certain sub_296154 does not have any unexpected behavior--in fact immediately after generating IVs, BreedingMethod sets *outpkm = sub_296154(v6[3]), which should be the encryption constant (assuming it's still in the first four bytes). I did however notice that nowhere besides the rerolls does it call sub_296154 to set the PID (in fact, I don't even see where it sets the PID, *(outpkm+8), when there are no rerolls), which matches your observations.
This change also happens when you switch between "same ball parents/ditto" to "different ball same species parents", something worth noting is that at least between these 2 groups even if you swap parents the current egg's IVs/Ability/etc will still remain the same, however the next egg will follow their respective egg list.
What's interesting though is that this can be used to our advantage by advancing through the egg list until we find a spread that we like and then we swap the parents to the other type, since the current egg will be already locked in
To give a better example I compiled these two lists of spreads from my current save http://prntscr.com/djrj78
The first list was done using a HA female Gyarados in a Lure Ball + Male Gyarados in a normal Pokeball holding destiny knot.
Second list was done using a Ditto holding the destiny knot instead + the same HA gyarados.
So I was aiming for the Bold Nature spread on the first list but I wanted to use my ditto in order to inherit some specific IVs, since using ditto would only lead me into getting the results from the second list I decided to advance the list with the gyarados parents first.
As expected the first egg was the Jolly spread without it's HA. So what I did next was swapping the Male gyarados for Ditto, assuming the Bold spread had been locked at this point, and to my surprise it actually worked I managed to get the bold spread out of the ditto when it wasn't supposed to be.
But the other interesting part is that by doing this action, the following eggs came into a 3rd branch completely new until now (3rd line), meaning the game made a completely new roll overriding the previous lists getting me another Bold and Calm spreads which I didn't have before.
At first I thought this could lead into an easy way to make the eggs more random (like rejecting them back in gen6), however after performing the same actions this 3rd line kept appearing consistently, so this basically only gives you more options but pretty much all possible actions are anticipated by the game already and turned into these egg lists.
Ok, so I have no idea if this is useful or not; but was looking into this (because why not).
First number is the frame; then the RNG call (in `[` `]`); and finally that value under various modulae (in `<n: x>`; where n is the modulus).
I've tried to note down where various things came from based on zomigi's comment and the observed values from the offspring.I'm not sure I see how the inheritance is working from that though. Turns out I'm an idiot, and forgot java's '%' is signed... New values work as expected.
First number is the frame; then the RNG call (in `[` `]`); and finally that value under various modulae (in `<n: x>`; where n is the modulus).
I've tried to note down where various things came from based on zomigi's comment and the observed values from the offspring.
Ball came from male parent; but I don't know where that factors in...
Edit: Also; confirming that RNG state had advanced by 1 frame after reject egg and resave.
Edit2: So, turns out I should have done mod 100 too. Ability and Ball inheritance are done from this. For those who care:
Let r = RNG%100
For Ball;
For Ability
Code:
// Initial:
0000: [ef715831] <2: 1> <3: 0> <6: SpecialAttack> <25: Rash> <32: 17> <252: 117>
// Gender (Male for 50/50)
0001: [ddf7e075] <2: 1> <3: 2> <6: Speed> <25: Naive> <32: 21> <252: 209>
// Nature (Calm)
0002: [324c2a9d] <2: 1> <3: 1> <6: Attack> <25: Calm> <32: 29> <252: 205>
// Ability? (Swift Swim (2) | Both parents had HA)
0003: [ab22e654] <2: 0> <3: 0> <6: HP> <25: Quirky> <32: 20> <252: 144>
// IVs (F/F/F/7/F/F)
// Speed from F
0004: [f1d05487] <2: 1> <3: 2> <6: Speed> <25: Impish> <32: 7> <252: 71>
0005: [4b9748ad] <2: 1> <3: 0> <6: SpecialAttack> <25: Mild> <32: 13> <252: 117>
// Defense from F
0006: [d32f3e78] <2: 0> <3: 2> <6: Defense> <25: Timid> <32: 24> <252: 8>
0007: [8135bcdd] <2: 1> <3: 0> <6: SpecialAttack> <25: Gentle> <32: 29> <252: 249>
// Special Defense from F
0008: [5cb2c59e] <2: 0> <3: 1> <6: SpecialDefense> <25: Calm> <32: 30> <252: 106>
0009: [adc11685] <2: 1> <3: 2> <6: Speed> <25: Docile> <32: 5> <252: 17>
// Attack from F
0010: [32ac3b41] <2: 1> <3: 1> <6: Attack> <25: Hasty> <32: 1> <252: 205>
0011: [0a858931] <2: 1> <3: 2> <6: Speed> <25: Rash> <32: 17> <252: 89>
// HP from F
0012: [dbfdbd68] <2: 0> <3: 0> <6: HP> <25: Hardy> <32: 8> <252: 24>
0013: [422a3519] <2: 1> <3: 0> <6: SpecialAttack> <25: Hasty> <32: 25> <252: 93>
// Random for each stat (Special Attack used) [Note order matches usual IV listings; not Speed = 3]
0014: [c39a7071] <2: 1> <3: 1> <6: Attack> <25: Quirky> <32: 17> <252: 133>
0015: [71b037b2] <2: 0> <3: 0> <6: HP> <25: Brave> <32: 18> <252: 114>
0016: [c98a2576] <2: 0> <3: 2> <6: Defense> <25: Quirky> <32: 22> <252: 218>
0017: [b3c37a67] <2: 1> <3: 2> <6: Speed> <25: Rash> <32: 7> <252: 47> // Kept as uninherited
0018: [be092779] <2: 1> <3: 2> <6: Speed> <25: Rash> <32: 25> <252: 233>
0019: [45b7d868] <2: 0> <3: 2> <6: Defense> <25: Quieit> <32: 8> <252: 248>
// Encryption constant (e888ec00)
0020: [e888ec00] <2: 0> <3: 1> <6: SpecialDefense> <25: Quirky> <32: 0> <252: 76>
// PID (e9a152e0) [8 rerolls; 2 for Shiny Charm, 6 for Masuda parents]
0021: [70765d79] <2: 1> <3: 0> <6: SpecialAttack> <25: Rash> <32: 25> <252: 225>
0022: [aa048df3] <2: 1> <3: 0> <6: SpecialAttack> <25: Adamant> <32: 19> <252: 159>
0023: [5c3836c8] <2: 0> <3: 0> <6: HP> <25: Serious> <32: 8> <252: 144>
0024: [de958dac] <2: 0> <3: 0> <6: HP> <25: Lax> <32: 12> <252: 192>
0025: [b537c40c] <2: 0> <3: 0> <6: HP> <25: Naive> <32: 12> <252: 156>
0026: [42505048] <2: 0> <3: 1> <6: SpecialDefense> <25: Jolly> <32: 8> <252: 100>
0027: [fb1bfed9] <2: 1> <3: 2> <6: Speed> <25: Naughty> <32: 25> <252: 89>
0028: [e9a152e0] <2: 0> <3: 1> <6: SpecialDefense> <25: Modest> <32: 0> <252: 148>
// ? (Comment suggests ball, but this seems to be from the female...)
0029: [6f742721] <2: 1> <3: 2> <6: Speed> <25: Rash> <32: 1> <252: 77>
// Next save's egg seed (although another egg was available for collection here)
0030: [dc864660] <2: 0> <3: 1> <6: SpecialDefense> <25: Timid> <32: 0> <252: 220>Edit2: So, turns out I should have done mod 100 too. Ability and Ball inheritance are done from this. For those who care:
Let r = RNG%100
For Ball;
Code:
if (r < 50) return Female; return Male;
Code:
if (parentAbility == 0) {
if (r < 80) return 0;
return 1;
} else if (parentAbility == 1) {
if (r < 20) return 0;
return 1;
} else {
if (r < 20) return 0;
if (r < 40) return 1;
return 2; // Hidden Ability
}
Last edited:
This is covered in the "Finding Egg Seed" section of this guide (credit to author and researchers; just providing a link).
Is it that necessary to reset and reject the Egg to move on with the seed? Couldn't we just keep getting and hatching Eggs and storing them on the PC until we reach the 127 hatchlings we need to get the Egg Seed?
EDIT: Oh, wait, I see. Taking an egg moves the seed more than just rejecting it.
Last edited:
No, you couldn't just deposit them all in your PC because each time you accept an Egg it advances your current frame by a certain number (usually between 25-50), whereas rejecting an egg only advances it by 1. In order to find out your Egg Seed you'll need a string of 127 consecutive 1's and 0's, not one from frame 1 and then frame 27 and then frame 52 etc.
Last edited:
Yes it's necessary. If you reset and reject an egg, you will only have advanced 1 RNG frame. If you accept the egg this advances the RNG by multiple frames.
So, with the resetting approach you see the result for frames 0, 1, 2, ... etc.
If you didn't reset, you'd see the result for (as an example) frames 0, 28, 55, 81, etc.
As long as you can keep track of your seed, you should only have to do the 127 Magikarps thing once. You'll just have to write it down somewhere and make sure you record where you're up to with your advancements.
Really interesting find, hopefully someone can replicate such app and translate it for convenience in the future.
I have a question about this egg seed. Since you're testing with magikarps do the obtained results also apply for the other kinds of eggs you generate? (genderless, 100% females, different balls, etc)
Yes, once you have discovered your Egg Seed it is then applicable to different Gender ratios, different balls, etc as per the image below:
The dropdown in the Red circle controls Gender Ratio and the dropdown in the Blue circle controls Ball
Seems to be no problem with translation as the program itself is shared on GitHub. Already trying as of now, using both the linked guide for what is mentioned there and Google Translate for what is not (>.<)
This is what I have so far. (also fixing a minor bug where setting an item as "Everstone" would write "Everstone" on the Ability column instead of the Nature column)
Is destiny knot not compatible with this?Seems to be no problem with translation as the program itself is shared on GitHub. Already trying as of now, using both the linked guide for what is mentioned there and Google Translate for what is not (>.<)
This is what I have so far. (also fixing a minor bug where setting an item as "Everstone" would write "Everstone" on the Ability column instead of the Nature column)
It's one of the items you can select in the "Item" drop down for each parent on the far left. It's just not bee selected in the provided screenshot.
Once you find your egg seed, does that just stay as it is without changing even if you go play other parts of the game? Someone said that you only have to do the 128 egg thing once. I know that in past games, everything was connected so doing other things would change your frames; is it different now?
Egg seed only changes when you accept or eject an egg. It's something saved to your save file (you can actually check it with PKHex, recommended to do it that way if you have the option) and is separate from the RNG for everything else. It's because the seed changes in a predictable way like that that this is even possible.
So as long as you have some idea of where your seed is at you won't have to hatch 128 eggs again. You'll want to figure out your new seed after each RNG project you do but you only need to hatch one egg for that.
This egg seed determining method, could it not hypothetically be done a lot faster by taking IVs from hatched eggs rather than nature?
127 eggs seems really cumbersome.
127 eggs seems really cumbersome.
You'd need a good number of Rare Candies + EV training every hatchling because there are multiple possible values per IV at low levels.
127 natures is the easiest.
Debateable, honestly (using 2x Rare Kitchens to quickly bump lv.33 then using rare candies with Metalkid can give you a good read on IVs). It's far easier to keep track of in any case, because it's very easy to miscount on 127 eggs including requiring a save and reject every time.
How many eggs does this exploit generate at a time? I want to know whether I should reset a shiny after 15-20ish eggs.