The Quick Hit slot machine series by Bally and Scientific Games is proof that an online slot doesn’t need to be complicated to be engaging. Capitalizing on a simple game design with which most slot players are already familiar, the Quick Hit slot game brings a classic feel to modern slot gaming.
- Pokemon Gold Silver Slot Machine Third Wheel Skips A Frame Set
Gyms return in Pokemon Gold and Silver, and with a new crew of leaders to face the number of badges to collect has bumped up to sixteen. The first eight leaders are all new, mastering types the leaders of old hadn't. Like before, some gyms contain puzzles you must solve to get to the leader. A balanced team is key to getting all the badges, and depending on who you started with you'll have an easier or harder time. Reversing the rule of Red and Blue, the Fire-type starter Cyndaquil will make your trek through Johto an easy one, whereas the Grass-type starter Chikorita is recommended more for those who want a challenge. Allons-y!
Gym #1 - Violet City Gym |
Location: Violet City Gym Leader: Falkner Specialty: Flying-type Reward: Zephyr Badge, TM31, Can use HM05 - Flash Puzzle: The first leader in Johto is the young Flying-type master. His gym has no puzzle to complete, and can be challenged as soon as you get to Violet City. However, it is recommended you train in Sprout Tower before taking on the gym challenge. The S-shaped gym hosts two trainers before Falkner, both of whom use the Flying-type birds Pidgey and Spearow that you meet early in the game. Falkner himself isn't that much of a challenge; Cyndaquil or Totodile can take them out quickly. If you chose the former, watch for their special move Mud-Slap, which deals Ground-type damage and lowers your Pokemon's accuracy. Chikorita will need to call in assistance from another Pokemon like Geodude or Onix, who can be caught in the Dark Cave or traded for in Violet City respectively. The prizes for this match are TM31 Mud Slap, the Zephyr Badge, the ability to use Flash outside of battle, and a slight boost in your Pokemon's Attack stat. Gym Leader Falkner | Pidgey | Pidgeotto | Battle Type Single Battle Items
| Level 7 | Level 9 | Attacks: Tackle Mud-Slap | Attacks: Tackle Mud-Slap Gust |
|
Gym #2 - Azalea Town Gym |
Location: Azalea Town Gym Leader: Bugsy Specialty: Bug-type Reward: Insect Badge, TM49, Can use HM01 - Cut Puzzle: The gender ambiguous Bugsy is your next challenge in Azalea Town. Like in Violet City, there is no true gym puzzle - simply beat the trainers to get to the leader. The gym, of course, is packed with Bug-type users, and can only be accessed once Team Rocket is cleared out of the Slowpoke Well. Bugsy's first two Pokemon shouldn't be any trouble, as they have very weak attacks and low stats. Cyndaquil or a good Rock-type/Flying-type Pokemon can make quick work of them. Scyther, however, is a bit trickier. It will use the move Fury Cutter, which increases in power as it is used repeatedly. This can be very dangerous if you don't have a Pokemon who can resist it. Fortunately, since it is part Flying-type itself, a Flaaffy can best it with a strong Thundershock move. The prizes for besting the Bug-type trainee are TM49 Fury Cutter, the Hive Badge, the ability to use Cut outside of battle, and the full command of outsider Pokemon up to Level 30. Gym Leader Bugsy | Metapod | Kakuna | Scyther | Battle Type Single Battle Items
| Level 14 | Level 14 | Level 16 | Attacks: Tackle String Shot Harden | Attacks: Poison Sting String Shot Harden | Attacks: Quick Attack Leer Fury Cutter |
|
Gym #3 - Goldenrod City Gym |
Location: Goldenrod City Gym Leader: Whitney Specialty: Normal-type Reward: Plain Badge, TM45, Can use HM04 - Strength Puzzle: Goldenrod Gym's Clefairy maze shouldn't be that hard to navigate, although Whitney is a very frustrating Gym Leader in battle. Boasting the incredible Pokemon Miltank, the young lass will annoy you to no end with moves like Stomp, Metronome, Rollout, Mimic, Encore, and Milk Drink. Your best bet is to either use a Gastly you caught earlier in the game or trade for the Machop at the Department Store. Miltank's Attract can be very annoying, since it will more likely then not render your starter useless if it's of the male gender. Bayleef may actually come in handy here, as it resists Rollout. Rollout, like Fury Cutter, increases in damage as momentum is built, though it is much more powerful. If you beat Whitney, you'll receive TM45 Attract, a slight bump in the Speed of your Pokemon, the Plain Badge, and the ability to use Strength outside of battle. You will also be able to get the Squirtbottle in the flower shop next door to spray Sudowoodo with. Whitney will try and refuse to give you the badge at first, but if you talk to the trainer below her, you'll find out how to change her mind. Gym Leader Whitney | Clefairy | Miltank | Battle Type Single Battle Items
| Level 18 | Level 20 | Attacks: Doubleslap Mimic Encore Metronome | Attacks: Rollout Attract Stomp Milk Drink |
|
Gym #4 - Ecruteak City Gym |
Location: Ecruteak City Gym Leader: Morty Specialty: Ghost-type Reward: Fog Badge, TM30, Can use HM03 - Surf Puzzle: Morty's gym features the first true puzzle: there is a path in the dark field you must navigate or else you'll be sent back to the front. It might take some practice, but if you make sure to face every trainer you'll get it eventually. The trainers in the gym all use Ghost-type Pokemon, which can't be hit by Normal-type or Fighting-type moves. Conversely, they cannot hit Normal-type Pokemon. Use that to your advantage with a Noctowl or Togetic that can hit back with Flying-type or Psychic-type attacks. Alternatively, bring a Gastly of your own in to get the job done, or win an Abra at the Goldenrod City Game Corner. Morty is just more of the same; he has a Gastly, two Haunters, and a Gengar. Assuming you're using a Normal-type, the first three can only put you to sleep or try and Mimic your own attacks. They can also use Curse, which takes away half their health in exchange for removing a quarter of yours each turn. These can be used to your advantage by switching out, as long as they haven't locked you in with Mean Look. Gengar is a bit more tricky but anything with a strong Dark, Psychic, or Ground-type move can take it out. It will try and put you asleep with Hypnosis, then use Dream Eater to heal itself. Switch out if you can when it does this. Shadow Ball is kind of useless on it as it has terrible Attack. When you win, you receive TM34 Shadow Ball, the Fog Badge, the ability to use Surf outside of battle, and command of Pokemon up to Level 50. Go check out the Ecruteak Theatre now to try and get HM03 Surf. Gym Leader Morty | Gastly | Haunter | Haunter | Gengar | Battle Type Single Battle Items
| Level 21 | Level 21 | Level 23 | Level 25 | Attacks: Lick Spite Mean Look Curse | Attacks: Hypnosis Mimic Curse Night Shade | Attacks: Spite Mean Look Mimic Night Shade | Attacks: Hypnosis Shadow Ball Mean Look Dream Eater |
|
Gym #5 - Cianwood City Gym |
Location: Cianwood City Gym Leader: Chuck Specialty: Fighting-type Reward: Storm Badge, TM01, Can use HM02 - Fly Puzzle: Chuck's gym requires Strength, found in the Olivine City Cafe. Other than that there is no puzzle: just fight the trainers. They use Pokemon like Hitmonchan and Mankey and shouldn't be that hard if you have a Psychic, Flying, or Ghost-type. Chuck's Primeape can't even hit a Ghost-type, though watch for Poliwrath's Surf. A good Pokemon here would be Xatu, who double resists Fighting-type moves and can hit back with Psychic. Poliwrath likes to use Mind Reader then DynamicPunch, which always confuses you and deals massive damage. Again, a Ghost-type like Gengar would have nothing to fear. If you win, you'll get the Storm Badge, the use of Fly outside of battle (Chuck's wife gives you HM02), command of Pokemon up to Level 70, and TM01 DynamicPunch. Gym Leader Chuck | Primeape | Poliwrath | Battle Type Single Battle Items
| Level 27 | Level 30 | Attacks: Leer Rage Karate Chop Fury Swipes | Attacks: Hypnosis Mind Reader Surf Dynamicpunch |
|
Gym #6 - Olivine City Gym |
Location: Olivine City Gym Leader: Jasmine Specialty: Steel-type Reward: Mineral Badge, TM23 Puzzle: The gym is very straightforward, although you will need to bring Jasmine the Secretpotion from Cianwood Pharmacy at the top of the Glitter Lighthouse before she'll fight you. No trainers, just Jasmine. The former Rock-type user is proficient in Steel-types like Steelix, so bring a Fire-type. Quilava or Typhlosion works incredibly well here, and although Feraligatr might seem like a good choice too, it needs to watch out for Magnemite. Steelix will try to hit your Fire-type with a Rock Throw, though if you're faster you should be able to take it out in one hit. Growlithe, Flareon, or Magmar all do the job very well if you didn't start with Typhlosion, and a Sandslash can hit hard with Ground-type moves if its Attack is strong. Defeat Jasmine for TM23 Iron Tail, a boost in your Pokemon's Defense stat, and the Mineral Badge. Gym Leader Jasmine | Magnemite | Magnemite | Steelix | Battle Type Single Battle Items
| Level 30 | Level 30 | Level 35 | Attacks: Thunderbolt Supersonic Sonicboom Thunder Wave | Attacks: Thunderbolt Supersonic Sonicboom Thunder Wave | Attacks: Screech Sunny Day Rock Throw Iron Tail |
|
Gym #7 - Mahogany Town Gym |
Location: Mahogany Town Gym Leader: Pryce Specialty: Ice-type Reward: Glacier Badge, TM16, Can use HM06, Waterfall Puzzle: This gym has a very annoying ice sliding puzzle. Use the rocks as stopping points, fight the trainers, and navigate your way to Pryce. To battle the senior Ice-type master, use a Fire-type. Don't worry about Dewgong and Seel - they don't have any Water-type moves to extinguish you with. They can use Rest to heal all damage but will be unable to move for two turns so try and strike them then. If you have a good Water-type Piloswine will fall before STAB moves and can't hit very hard with its own. When defeated, Pryce will cough up the Glacier Badge, a boost in your Pokemon's Special Attack and Special Defense, the ability to use Whirlpool outside of battle, and TM16 Icy Wind. Gym Leader Pryce | Seel | Dewgong | Piloswine | Battle Type Single Battle Items
| Level 27 | Level 29 | Level 31 | Attacks: Headbutt Icy Wind Aurora Beam Rest | Attacks: Headbutt Icy Wind Aurora Beam Rest | Attacks: Icy Wind Fury Attack Mist Blizzard |
|
Gym #8 - Blackthorn City Gym |
Location: Blackthorn City Gym Leader: Clair Specialty: Dragon-type Reward: Rising Badge, TM24, Can use HM07, Whirlpool Puzzle: The final gym. Lance's cousin is the hardest leader in the game. Her gym is no cakewalk either; you must fight several trainers and complete a puzzle involving Strength to build bridges across lava. Many trainers use Dratini or Horsea so bring a Pokemon who can wield Ice-type and Electric-type moves. Perhaps look for something that can learn the elemental punches. When you face Clair, you will need to use something that can survive Paralysis and has good Ice-type attacks. Luckily, you can catch a Swinub in the Ice Path and evolve it into the powerful Piloswine. Piloswine can take the Ice-type and Electric-type moves the first two Dragonair like to use, and hit with either Ice Beam or Icy Wind to lower Speed. The other Dragonair, however, has Surf, so watch out. Lanturn is also a great choice as it resists the three elemental moves the Dragonairs use. Kingdra is a very annoying Pokemon as its only weakness is Dragon-type. To beat it, try inflicting status on it and whittle its health down slowly. It's a very tricky Pokemon to defeat, especially because of Smokescreen. Upon defeating Clair, you'll have the first set of Gym Leaders under your belt. To get the badge, though, you must retrieve the Dragon's Fang from deep in the Dragon's Den. This requires the use of Surf and Whirlpool. Upon claiming the fang, Clair will bestow on you the Rising Badge, TM24 Dragonbreath, and the ability to use Pokemon of any level in battle. It is recommended you give TM24 to a Kingdra for use during the Champion battle. Now you are ready for the Pokemon League! Gym Leader Clair | Dragonair | Dragonair | Dragonair | Kingdra | Battle Type Single Battle Items
| Level 37 | Level 37 | Level 37 | Level 40 | Attacks: Thunder Wave Surf Slam Dragonbreath | Attacks: Thunder Wave Thunderbolt Slam Dragonbreath | Attacks: Thunder Wave Ice Beam Slam Dragonbreath | Attacks: Smokescreen Surf Hyper Beam Dragonbreath |
|
After beating the Elite Four you'll get a ticket to ride the S.S. Aqua to Kanto. Here you'll be able to fight a different set of leaders, and they might look familiar...
Gym #9 - Vermilion City Gym |
Location: Vermilion City Gym Leader: Lt. Surge Specialty: Electric-type Reward: Thunder Badge Puzzle: The electrifying Lt. Surge is probably the first leader you'll meet in Kanto. You can use Cut or Surf to get to the gym. Lt. Surge's gym has an interesting novelty - you need to check for two switches hidden in the garbage cans to open the automatic doors. The second is always next to the first, be it the can north, south, east, or west, but will be difficult anyways to find as the locks reset if you click on the wrong can. The trainers are all fairly easy to beat, however you may need to heal a few times should your Pokemon become paralyzed. Surge has a new team with buffed up Electric-type moves like Zap Cannon and Thunderbolt. Zap Cannon, like DynamicPunch, has a low accuracy but high base damage, and will always cause a status ailment, in this case paralysis. Magneton will use Lock-On to make sure it hits. A Ground-type Pokemon like Nidoking or Steelix is great here as it can wipe the floor with the team and have very little used against it. The prize for this match is the Thunderbadge. Gym Leader Lt. Surge | Raichu | Electrode | Electrode | Magneton | Electabuzz | Battle Type Single Battle Items
| Level 44 | Level 40 | Level 40 | Level 40 | Level 45 | Attacks: Thunder Wave Quick Attack Thunderbolt Thunder | Attacks: Screech Double Team Swift Explosion | Attacks: Screech Double Team Swift Explosion | Attacks: Lock-On Double Team Swift Zap Cannon | Attacks: Quick Attack Thunderpunch Light Screen Thunder |
|
Gym #10 - Saffron City Gym |
Location: Saffron City Gym Leader: Sabrina Specialty: Psychic-type Reward: Marsh Badge Puzzle: Sabrina's gym is back with a network of teleporters. Have fun trying to navigate through this mess. Again, a hint - you will need to battle a few of the trainers, who use Psychic-types like Exeggcute. Sabrina has a new team this time, composed of Pokemon that are completely useless against Dark-types like Houndour and Umbreon. The infamous female Mr. Mime will try and set up reflects to aid her team mates, and Baton Pass any Barriers it has up in the process. Ghost-type Pokemon are great here, just like with Will. Defeat her for the Marsh Badge. Gym Leader Sabrina | Espeon | Mr. Mime | Alakazam | Battle Type Single Battle Items
| Level 46 | Level 46 | Level 48 | Attacks: Sand-Attack Quick Attack Swift Psychic | Attacks: Barrier Reflect Baton Pass Psychic | Attacks: Recover Future Sight Psychic Reflect |
|
Gym #11 - Celadon City Gym |
Location: Celadon City Gym Leader: Erika Specialty: Grass-type Reward: Rainbow Badge, TM19 Puzzle: The Celadon Gym is home to the nature-loving princess Erika. Bring a lot of Full Restores because of status moves the gym trainers like to inflict. Erika has a new lineup featuring Bellossom and Jumpluff. Instead of Mega Drain though, the move of choice is now Giga Drain, which does the same thing but with more damage. Her team likes to use Sunny Day to drench the field, which makes Solarbeam hit in one turn instead of two and Synthesis heal much more HP. However, this will also buff your Fire-type attacks which is fantastic. Defeat her for TM19 Giga Drain and the Rainbow Badge. Gym Leader Erika | Tangela | Jumpluff | Victreebel | Bellossom | Battle Type Single Battle Items
| Level 42 | Level 41 | Level 46 | Level 46 | Attacks: Vine Whip Bind Giga Drain Sleep Powder | Attacks: Mega Drain Leech Seed Cotton Spore Giga Drain | Attacks: Sunny Day Synthesis Acid Razor Leaf | Attacks: Sunny Day Synthesis Petal Dance Solarbeam |
|
Gym #12 - Fuchsia City Gym |
Location: Fuchsia City Gym Leader: Janine Specialty: Poison-type Reward: Soul Badge, TM06 Puzzle: With her father now a member of the Elite Four, Janine has taken over as the new leader of Fuchsia City's Pokemon Gym. She is also the weakest, and shouldn't be that hard to beat if Koga wasn't. The gym still uses the invisible walls, and this time everyone is dressed up like Janine, making her tricky to spot in a crowd. Psychic and Ground-type moves will be your greatest help here, though pretty much any neutral move gets the job done considering the levels of her Pokemon. Defeat Janine for the Soul Badge and TM06 Toxic. Gym Leader Janine | Crobat | Weezing | Weezing | Ariados | Venomoth | Battle Type Single Battle Items
| Level 36 | Level 36 | Level 36 | Level 33 | Level 39 | Attacks: Screech Supersonic Confuse Ray Wing Attack | Attacks: Smog Sludge Bomb Toxic Explosion | Attacks: Smog Sludge Bomb Toxic Explosion | Attacks: Scary Face Giga Drain String Shot Night Shade | Attacks: Foresight Double Team Gust Psychic |
|
Gym #13 - Cerulean City Gym |
Location: Cerulean City Gym Leader: Misty Specialty: Water-type Reward: Cascade Badge Puzzle: To battle Misty, you'll have to go to Cerulean Cape just above the city and interrupt her date. Furious at this, she'll gladly battle you back at the gym. You can skip all the trainers by using Surf in the water, though they don't have very strong teams anyways. Meganium's time to shine is here, where it can sap health from everything using Giga Drain or slice up foes with Razor Leaf. Keep an eye on Lapras and Starmie though as they both use Ice-type moves. If you didn't pick Meganium, an Ampharos or Raichu also does great work here. Misty shouldn't be that hard making the Cascadebadge is an easy prize to win. Gym Leader Misty | Golduck | Quagsire | Lapras | Starmie | Battle Type Single Battle Items
| Level 42 | Level 42 | Level 44 | Level 47 | Attacks: Surf Disable Psych Up Psychic | Attacks: Surf Amnesia Earthquake Rain Dance | Attacks: Surf Perish Song Blizzard Rain Dance | Attacks: Surf Confuse Ray Recover Ice Beam |
|
Gym #14 - Pewter City Gym |
Location: Pewter City Gym Leader: Brock Specialty: Rock-type Reward: Boulder Badge Puzzle: Brock's gym hasn't change in simplicity. Defeat the lone trainer then go up against the Rock-type master. He's evolved his Geodude, caught a Rhyhorn, and resurrected the two fossil Pokemon from the first games. Meganium works well here as its Grass-type moves do 4x super effective damage. Alternatively, try a Water-type for the first three and Electric-type moves for the fossils. Contrary to popular belief Electric-type moves do hit Rock-types so make full use of them. Brock will give you the Boulderbadge upon defeat. Gym Leader Brock | Graveler | Rhyhorn | Omastar | Onix | Kabutops | Battle Type Single Battle Items
| Level 41 | Level 41 | Level 42 | Level 44 | Level 42 | Attacks: Defense Curl Rock Slide Rollout Earthquake | Attacks: Fury Attack Scary Face Earthquake Horn Drill | Attacks: Bite Surf Protect Spike Cannon | Attacks: Bind Rock Slide Bide Sandstorm | Attacks: Slash Surf Endure Giga Drain |
|
Gym #15 - Seafoam Islands Gym |
Location: Seafoam Islands Gym Leader: Blaine Specialty: Fire-type Reward: Volcano Badge Puzzle: Poor Blaine's gym was totalled in the Cinnabar Island volcanic eruption, and he's now stuck in the Seafoam Island cave. He's still insistent on the need for a Burn Heal, and with moves like Fire Punch, Flamethrower, and Fire Blast in his arsenal you better have one. Magmar has Thunderpunch to fight back against your Water-types, but the rest of his triad are sitting ducks. If you can't use a good Water-type for whatever reason, Rock and Ground-type moves are fantastic too. Defeat Blaine for the Volcano Badge and move onto Viridian City. Gym Leader Blaine | Magcargo | Magmar | Rapidash | Battle Type Single Battle Items
| Level 45 | Level 45 | Level 50 | Attacks: Curse Smog Flamethrower Rock Slide | Attacks: Thunderpunch Fire Punch Sunny Day Confuse Ray | Attacks: Quick Attack Fire Spin Fury Attack Fire Blast |
|
Gym #16 - Viridian City Gym |
Location: Viridian City Gym Leader: Blue Specialty: None Reward: Earth Badge Puzzle: Since Giovanni's departure, the gym has been under new management. However, this old foe will 'smell ya later' until you collect the other seven Kanto badges. This Lego-built gym doesn't have any puzzle and is a straight up challenge against Blue. He has a very diverse team and is probably just as tricky to beat as he was at the end of Red and Blue. With the classic core of Grass/Fire/Water, you should probably bring a Dragon-type if you can to resist their powerful moves. Alakazam has the very powerful Psychic but can be taken out by anything faster than it with a physical attack. Pidgeot can get zapped with Electric-type moves, stoned with Rock-type moves, or chilled with Ice-type moves. The latter of those can also be used for Rhydon, or with Grass-type and Water-type moves instead. Bring lots of potion and a well balanced team for this match and you shouldn't have too much issue. Win, and you'll get the Earth Badge, which gives you access to Mt. Silver after you talk to Professor Oak. There, the ultimate trainer awaits... Gym Leader Blue | Pidgeot | Alakazam | Rhydon | Gyarados | Exeggutor | Arcanine | Battle Type Single Battle Items
| Level 56 | Level 54 | Level 56 | Level 58 | Level 58 | Level 58 | Attacks: Quick Attack Whirlwind Wing Attack Mirror Move | Attacks: Disable Recover Psychic Reflect | Attacks: Fury Attack Sandstorm Rock Slide Earthquake | Attacks: Twister Hydro Pump Rain Dance Hyper Beam | Attacks: Sunny Day Leech Seed Egg Bomb Solar Beam | Attacks: Roar Swift Flamethrower Extremespeed |
|
We're updating our policies! Please read the Message from the Editor for more.
Check BulbaNewsNOW for up-to-date Pokémon news and discuss it on the forums or in the Bulbagarden Discord server.
From Bulbapedia, the community-driven Pokémon encyclopedia.
Jump to: navigation, search
This article is incomplete. Please feel free to edit this article to add missing information and complete it. Reason: needs loads of links to documented examples of exploits, images, much more explanation of what's going on, possible links to TASvideos, etc.. |
Arbitrary code execution is an advanced glitch present in various Pokémon games that, when performed, allows the player to theoretically run any code they desire on the console.
Cause
Data storage on any standard machine consists of two fundamental types, ROM (read-only memory) and RAM (random-access memory). In the context of a game console, ROM consists of the game code which cannot be modified (short of physically tampering with the cartridge), while RAM consists of any data that may change on a continuous basis, such as the contents of the save file (SRAM), the contents of the screen/video display (VRAM), and other variables (such as whether or not the player is currently in a battle, or the current sound(s) that are playing, or anything that needs to be temporarily stored such as numbers in the middle of a formula calculation or routine). (Notably, all data stored in RAM, except for SRAM, is deleted whenever power to the machine is cut.)
One temporary value that exists in any standard machine is the processor's program counter, which points to the memory location where the next line of code is to be read and executed. Normally, the program counter automatically increments by 1 each time a line of code is read, such that individual lines of code are read sequentially; however there are many cases where a line of code will tell the program counter itself to jump forward or back (such as when some lines of code must only be executed under certain conditions and must be skipped otherwise, or when the game must wait for a certain condition to be true before progressing, and must continuously check that condition until it is true). Commands that cause the program counter to do this are known as jump instructions. Naturally, as all game code exists in ROM, all proper jump instructions must point to a location in ROM. The program counter just blindly reads in and executes code at whatever memory location it is pointing to (and then increments itself by 1); thus faulty jump instructions may cause the program counter to start reading in garbage values from an unexpected place and attempt to interpret them as code, making this one possible source of glitches.
Arbitrary code execution is fundamentally caused whenever faulty code contains a jump instruction that causes the program counter to jump to a RAM location instead of ROM. From here, as RAM values can be controlled by the player unlike ROM values, it becomes possible for the player to modify these values, and values stored just after it, in order to spell out specific lines of code that are desirable or exploitable.
Sources of arbitrary code execution can include various glitch items, moves, etc., whose effects are never intended by the developers and are thus faulty code by definition. For example, a normal item would likely instruct the program counter to jump to some predetermined location that contains code for the correct behavior of that item, while a glitch item may instruct the program counter to jump to an unexpected location, thus running faulty code.
As arbitrary code execution literally enables the player to do anything the console's hardware is capable of, it has enormous potential and can be thought of as 'jailbreaking' the console; extremely elaborate setups have been performed and documented where players have coded new graphics, music, or even entire new games onto the platform.
Methods
After discovering a glitch that causes the program counter to jump to RAM, it is often the case that the initial location jumped to is hard for the player to control (such as sound bank data). Thus, it is common for most arbitrary code execution setups to first spell out only a small amount of code there, forming another jump instruction that will lead to a second location in memory that is easy for the player to modify. Examples of such locations can include party or PC data, Bag contents, Box names, and Pokémon nicknames. Once this has been done, the player may readily fill the second memory area with arbitrary code for the console to execute, and then perform the initial jump (by using the glitch item, glitch move, etc.), which will perform the second jump to the filled code and cause it to be run.
For more complex exploits, the above 'two-stage' jump setup may not be enough as the game will eventually run out of space in the easily modifiable second location (the Bag/Box/etc.) to continue spelling out code. It is possible to extend the setup to three stages by writing code in the second location whose effect is to write more code to a third location that contains more space but is hard for the player to modify directly. Once enough code has been written to the third location, the player may substitute the second location's code for code that jumps to the third location, then perform the glitch which will execute three jumps and run the desired code.[1]
Even more advanced setups may jump the program counter to controller input[2], allowing a theoretically unlimited amount of code to be entered and run on the fly without having to store it all beforehand. Current demonstrations of this type of setup have so far been TAS-exclusive (as controller input is polled on and can change every frame, 60 times per second, as well as due to the very large amount of code that must be desired for such a setup to be worthwhile unassisted); however as the setup code can be arbitrary, it is no doubt possible to program an input loop that is slow enough to be performed in real time.
Performing an arbitrary code execution glitch (i.e. using a particular glitch item, etc.) without any setup beforehand can be highly dangerous, as the program counter will jump to RAM and then begin to execute potentially numerous lines of completely unpredictable code (depending on whatever changing values happen to be there in RAM at the time) before a stop command happens to be reached. Such lines of unpredictable garbage code may happen to include, for example, code whose effect is to fail the save file's verification check, destroying it.
Generation I
Using the glitch item 8FRB or 5かいRG causes the program counter to jump to the RAM location that stores the number of Pokémon in the player's party. This value (as well as values stored just after it, such as the contents of the player's party and their Bag) is particularly easy to modify right off the bat, and as such this may be considered one of the easiest arbitrary code execution setups to perform once the item has been obtained.[3][4]
To have maximum possible control over the values in memory corresponding to the Bag, heavy use of the item duplication glitch is recommended.
The current simplest known way to obtain the 8F item is through the item underflow glitch. A possible alternate method, though much more time-consuming, involves the glitch Pokémon 94 and 94 h whose invalid Pokédex number of #213 corrupts the fourth item in the player's Bag, increasing its index number by 16 upon encountering it (similar to how encountering any Pokémon with a Pokédex number of #000 increases the quantity of the sixth item by 128). This allows transforming a Good Rod into 8F. An even older method which uses the heavy corruption effects of Super Glitch also exists.
Outside of 8F and 5かい, numerous other arbitrary code execution exploits also exist in these games, such as situational use of the glitch move -- or turning Pallet Town into Twinleaf Town.
Pokémon Yellow
Similarly, to 8F and 5かい, the glitch item ws# #m# causes the program counter to jump to the RAM location which stores the list of Pokémon in the current PC box upon use, enabling easy arbitrary code execution[5]. Like 8F and 5かい, ws# #m# can be obtained using the item underflow glitch or with pPkMnp' '.
Additionally, a separate arbitrary code execution method exists exclusive to Yellow, which can be started by any event that causes the player's following Pikachu to stand off-screen (such as the singingJigglypuff in Pewter City's Pokémon Center, the Clefairy in the Pokémon Fan Club, or a number of Glitch Cities). Walking while Pikachu is off-screen will in fact slowly cause memory corruption to the current map and nearby areas in memory (such as the current save file's gameplay timer as well as Pikachu's happiness value)[6] as the game runs buggy code that attempts to keep track of Pikachu's off-screen position[citation needed]; it is possible to walk around in specific patterns to eventually create an arbitrary code execution setup by corrupting the map to place an invalid signpost on the map whose routine points to RAM rather than ROM[7].
Pokémon Gold and Silver
This section is incomplete. Please feel free to edit this section to add missing information and complete it. Reason: grammatical cleanup/organization/paragraph breakup, more explanation, maybe transfer some stuff from one article into the other (either direction) or even merge the two articles together. |
In English releases of Pokémon Gold and Silver, the Coin Case glitches are a subset of arbitrary code execution glitches.
In the Japanese versions, the Coin Case executes code at a certain place (which tells the player how many coins they have) and terminates that with a hex:57 terminator. This causes the code to stop. However, in English releases that terminator is not valid and causes the code to jump to echo RAM at E112 and run code at that spot. The reason this was not caught in the testing of the game is because this section is typically made up of mostly 00, so nothing visible occurs. But if the player has listened to a certain cry, the address executes code that actually has a visible effect, such as 'which move?he PP of' or a glitch dimension. When the cry is of a Bellsprout, Machop, Machoke, or Omanyte, this effect makes the code jump again, to address EB12. This address can be modified by using specific party Pokémon, such as a level 23 Quagsire holding an HP Up with Sleep Talk as its first move in the fourth party slot, to send the code to the PC items. The Quagsire can be given a Protein instead to jump to the Box names. That data is then modified along with certain movement patterns to achieve an effect, such as obtaining Celebi or ????? (FF), going to Mt. Silver with no Pokémon (causing the player to win automatically), or coding an entire new game onto the console.
Pokémon Crystal
This section is incomplete. Please feel free to edit this section to add missing information and complete it. Reason: Look up more detailed explanation from PokemonSpeedruns.com, Pokemon Crystal any% category. |
A variant of the Celebi Egg glitch allows the player to control the held item in addition to the species of the Pokémon obtained. This can be manipulated to cause the held item to be a Key Item, something that is not normally possible.
Pokemon Gold Silver Slot Machine Third Wheel Skips A Frame Set
Removing a held Key Item from its holder while another copy of the item is already in the Bag will cause the duplicate copies to appear as two separate, identical stacks. The two stacks must then be placed next to each other and a third normal Key Item placed below them. At this point, swapping the two identical stacks (with the Select button), behavior unaccounted for by the developers, will corrupt the second stack and either corrupt or destroy the third stack.[8] From here, as the number of stacks in the inventory has now unexpectedly decreased, it is possible to achieve a similar effect to the dry item underflow glitch in Generation I, giving the player access to 255 items in the Key Items Pocket; the underflow effect can then be spread to other pockets via item swapping.
As with Generation I, precise out-of-bounds item manipulation can be used to either place a certain TM outside of the TM/HM Pocket, or corrupt the player's current Pokédex sort mode, depending on the language version of the game. Either way, attempting to use the TM in an invalid way or open the Pokédex in its glitched state will execute faulty code and cause the game to jump to RAM, enabling arbitrary code execution.
Pokémon Emerald
Viewing the summary of at least one ?????????? glitch Pokémon is known to cause the program counter to jump to the location in RAM where nicknames of Pokémon in the PC are stored. The only currently known method to obtain this glitch Pokémon is through Glitzer Popping, a sub-glitch of the Pomeg glitch. Due to the limited set of data values that nicknames can hold, applications of arbitrary code execution using this method are limited.[9]
At least one glitch move's animation script is also known to point to SRAM, specifically address $0E0F14C0 which can be manipulated to redirect the animation pointer to the 11th pc item and then the 15th item. Again, Glitzer Popping is the only currently known method to obtain a Pokémon with this glitch move (Move 27a2 (E! E! ho!)). Arbitrary glitch items and quantities can be obtained through another subglitch of the Pomeg glitch currently undocumented on Bulbapedia, making this method much more viable to spell out code compared to using nicknames, however, because of the nature of save data, the file always shifts 2 nibbles and therefore, if your save file has an odd number at address 0E0F14C0 at the beginning, the save file can not be properly manipulated and that save file is not viable for this method of arbitrary code execution[10]
History/Other

This section is incomplete. Please feel free to edit this section to add missing information and complete it. Reason: discuss history of how ACE was discovered; iirc it was first done in Super Mario World with the Yoshi's Island 3 spinning platform stack overflow credits warp, and then the full extent of its arbitrariness demonstrated rather spectacularly in Pokémon Yellow; link to TASvideos; maybe even link to AGDQ demonstrations. |
References
- ↑https://www.youtube.com/watch?v=D3EvpRHL_vk
- ↑http://tasvideos.org/2187M.html
- ↑http://forums.glitchcity.info/index.php/topic,6638.0.html
- ↑http://forums.glitchcity.info/index.php/topic,6573.0.html
- ↑http://glitchcity.info/wiki/index.php/Arbitrary_code_execution#Using_.22ws_m.22_.28Yellow.29
- ↑http://forums.glitchcity.info/index.php?topic=7130.0
- ↑http://wiki.pokemonspeedruns.com/index.php/User:Stump/Yellow_NSC_Pikachu_Offscreen_Stat_XP_ACE_Route#Pikachu_Offscreen
- ↑https://www.youtube.com/watch?v=FZrFMi6B0jQ
- ↑https://www.youtube.com/watch?v=m9pvNYdhldo
- ↑https://www.youtube.com/watch?v=1pb-6hMDQBs
External links
Main | Multiple generations: | Cloning glitches • Glitch Pokémon • Glitch Trainers Error messages • Arbitrary code execution |
---|
Generation I: | -- • 0 ERROR • Broken hidden items • Cable Club escape glitch • Experience underflow glitch Fight Safari Zone Pokémon trick • Glitch City • Item duplication glitch • Item underflow • Mew glitch Old man glitch • Pewter Gym skip glitch • Pokémon merge glitch • Rhydon glitch Select glitches (dokokashira door glitch, second type glitch) • Super Glitch • Time Capsule exploit • ZZAZZ glitch |
---|
Generation II: | Bug-Catching Contest data copy glitch • Celebi Egg glitch • Coin Case glitches • Experience underflow glitch Glitch dimension • Glitch Egg • Sketch glitch • Teru-sama • Time Capsule exploit • Trainer House glitches • GS Ball mail glitch |
---|
Generation III: | Berry glitch • Dive glitch • Pomeg glitch • Glitzer Popping |
---|
Generation IV: | Acid rain • GTS glitches • Mimic glitch Pomeg glitch • Rage glitch • Surf glitch • Tweaking • Pal Park Retire glitch |
---|
Generation V: | Sky Drop glitch • Frozen Zoroark glitch • Choice item lock glitch • Charge move replacement glitch |
---|
Generation VI: | Lumiose City save glitch • Symbiosis Eject Button glitch • Choice item lock glitch • Charge move replacement glitch |
---|
Generation VII: | Choice item lock glitch • Charge move replacement glitch |
---|
Generation VIII: | Charge move replacement glitch |
---|
Glitch effects: | Game freeze • Glitch battle • Glitch song Gen I only: Glitch screen • TMTRAINER effect • Inverted sprites Gen II only: Glitch dimension |
---|
Lists: | Glitch moves • Glitch types Glitch Pokémon (Gen I • Gen II • Gen III • Gen IV • Gen V • Gen VI • Gen VII • Gen VIII) Glitches (Gen I • Gen II • Gen III • Gen IV • Gen V • Gen VI • Gen VII • Gen VIII • Spin-off) |
---|
|
|
This article is part of Project GlitchDex, a Bulbapedia project that aims to write comprehensive articles on glitches in the Pokémon games. |
Retrieved from 'https://bulbapedia.bulbagarden.net/w/index.php?title=Arbitrary_code_execution&oldid=3110481'