View source for Glitzer Popping

{{cleanup}}
'''Glitzer Popping''' is a subglitch of the [[Pomeg_glitch#Access_Pok.C3.A9mon_beyond_slot_6|access Pokémon beyond slot 6]] subglitch of the [[Pomeg glitch]]. As with the latter subglitch, it can only be initially performed in {{game|Emerald}} (and can also be performed in {{2v2|FireRed|LeafGreen}} via [[trading]] with Emerald).

By scrolling past slot 255 and below in a player's party, it allows the player to corrupt Pokémon in the Pokémon Storage System's box 1 and 2. Most of the time these become Bad Eggs, which may have glitch moves with beneficial effects such as skipping battles.

The glitch is notable as a means of producing an glitched hatchable [[Egg]]. The player can manipulate the Egg to contain any valid Pokémon and many [[glitch Pokémon]]. Additionally, using a technique known as "double corruption", one can create an unhatched Pokémon in the Pokémon Storage System with multiple characteristics (Item, Moves, Species, IVs, Origin,...) that he or she desires.

In addition to Pokémon data, Glitzer Popping can corrupt [[Pokémon Day Care|Day Care]] data, [[Pokémon Contest|contest]] data, map data (NPCs with their location and script address), flag data (story, trainers, events), bag quantity data, PC item data, Battle Frontier data, Trainer data (name, ID, SID) and Secret Base items.

==Name==
The name Glitzer Popping does not have any meaning in itself, and was chosen by the speedrunner Werster because he didn't want the glitch to have a name that in his view would be 'too generic'.

==Method==
===Requirements===
#A Pokémon who gained 1 or more health points with a single HP Up. That would mean it would lose 1 of more HP when fed a Pomeg Berry; for example a level 100 Pokémon with 10 HP EVs or more would lose two health points when fed the Pomeg Berry, but a high level Pokémon (Sky Pillar, Victory Road, Artisan Cave, Legendaries,..) can work for that.
#At least three Pokémon, including a fainted one with Fly and another fainted Pokémon.
#A Pokémon with a suitable personality value that should preferably be [[Cloning glitches#Generation III|cloned]] multiple times. After the glitch, most of this Pokémon's data will be permuted depending on its personality value (e.g. EVs data becoming species data, species data becoming attacks data,..).

The in-game trade Pokémon "Seasor" the {{p|Horsea}} and "Dots" the {{p|Seedot}} are ideal for the glitch because they work and always have the same personality values; 0x0000007F and 0x00000084 respectively. These Pokémon may be used to convert 'EVs into Growth' (see article [[Pokémon data substructures in Generation III]], with the Attack EV representing the most significant byte of the [[List of Pokémon by index number (Generation III)|Pokémon's index number]] and the HP EV representing the least significant byte (e.g. 151 HP EVs and 0 Attack EVs would result in a {{p|Mew}}).

Alternatively, a Pokémon with a personality value that would convert 'Attacks into Growth' could be used for an exploit such as converting a Pokémon with {{m|Beat Up}} (move ID 251) into a {{p|Celebi}}.


===Steps===
#Move the Pokémon with the suitable personality value to box 2 slot 23 or box 2 slot 24 of the Pokémon Storage System, and preferably 4  clones of the Pokémon obtained with a [[Cloning glitches#Generation III|cloning glitch]] to other places of the box. Though it is not required, it is recommended to place the clones two spaces apart from each other (e.g. in slots 23, 21, 19, 17, 15 of Box 2), and to maximize the success rate (which is low) a good "corruption initiator" (a Pokémon to "absorb" unfavourable corruptions) should be placed at positions one space left of the Pokémon (e.g. slots 22, 20, 18, 16 of Box 2). Pluses the in-game trade Plusle, with all of its moves erased except for {{m|Growl}} is an example of a good corruption initiator. Without a corruption initiator, it may take a very long time for the glitch to work; if at all.
#Make a party with a fainted Pokémon, a fainted Pokémon with Fly, and the Pokémon that can lose HP with a Pomeg Berry.
#Decrease the HP of that Pokémon to 1, so that his HP can fall to 0 or below (underflow to 65535 or less) with a Pomeg Berry. A Banette with Curse and odd HP can come in handy to quickly decrease ths Pokémon's HP to 1.
#Once this party is made, the player may save the game here. If the glitch doesn't work the first time (quite likely), the player will be able to restart from this point.
#Enter a wild battle and flee.
#Deposit the first fainted Pokémon in the Pokémon Storage System.
#Use the Pomeg Berry on the Pokémon at 1 HP. If it receives 0 HP nothing else needs to be done. If it receives 65535 HP or less, a healing item such as a Potion should be used to faint it. The player should now has two fainted Pokémon.
#Enter a wild Pokémon battle to send out a ??????????.
#Open the Pokémon menu and view the summary of the first valid Pokémon in the party.
#Scroll up. The more that the player scrolls up, beginning from "Cancel", the more Pokémon in the storage system are corrupted. The first slot up from Cancel may affect the data of the Pokémon in box 2 slot 23 in English Emerald. The corruption of storage box Pokémon ends at around slot 215 (affecting the Pokémon in box 1 slot 1).
#Exit the Pokémon battle and check Pokémon in the Pokémon Storage System. If there is a regular "Egg" rather than a Bad Egg, withdraw it and send it into battle to see if it converted into a different Pokémon. Sometimes a regular Egg will appear as the original Pokémon, this is normal and if no ideal Eggs appear the player is free to reset the game and try the glitch again.
#Preferably hatch the Egg to obtain the converted Pokémon, which will be registered in the Pokédex.
#Preferably remove any unwanted Bad Eggs using the [https://www.youtube.com/watch?v=nESJ1KZMav8 inverse cloning glitch].

===Double corruption===
A double corruption allows the player to obtain the modified Pokémon in an Egg without hatching it. To cause a double corruption, the player should perform the usual steps to obtain a regular Egg, but leave the Egg in the storage system and corrupt it again. The Egg must not be picked up with the glove, or it will never corrupt again into the desired unhatched Pokémon (unless the Pokémon is specifically crafted to work around this; e.g. a "Dots" Egg that had Flash as the fourth move). Double corruption allows the player to obtain the Pokémon without going through hatching, which preserves the Held Item, EVs, Origin, Obedience, Ribbons, Experience, Contest Stats, PP Boosts,..
While a simple corruption slightly changes some of the Pokémon's value (Move 2 and Move 4 will always be Glitch Moves, for example), a double corruption leave the Pokémon's data intact (it only permutes the substructures), which also allows a complete manipulation of a Pokémon's moves.
Double Corruption is interesting to obtain Glitch Items, Glitch Pokémon that cannot be hatched, Glitch Moves, and many combinations (ex : a Lv 0 Magikarp with Sketch, Sketch, Hyper Beam, and caught in a Safari Ball)

The Eon Ticket, AuroraTicket and MysticTicket held by a storage box Pokémon alone cannot be taken and used to travel to an event island as the flag must also be set.

Some Key Items for Ruby/Sapphire/Emerald or FireRed/LeafGreen obtained this way can be traded and used during the main story to skip certain parts. (PokeFlute, Tea, Scope Sylph, Tm Cut, Rainbow Pass, Mach Bike & Acro Bike, Go-goggles,..)

====Notes====
{{incomplete|section|needs=Describe the means of obtaining obedient Mew and Deoxys.}}
In order to perform the same glitch in Pokémon FireRed and LeafGreen, trade a Pokémon with 65535 HP or less there and perform the same basic steps (switching to the last Pokémon and depositing it, healing the Pokémon with 65535 HP or less to faint it).

{{p|Mew}} and {{p|Deoxys}} obtained with this glitch likely will not obey the player due to them not being met in a "[[fateful encounter]]".

Due to Pokémon Emerald and FireRed/LeafGreen's "dynamic memory allocation" (DMA) in which the location of memory addresses are randomized after performing tasks such as opening the Pokémon menu, the game won't always alter the correct bit in the target Pokémon's personality value and will leave the Pokémon corrupted in an unfavourable way. Corruption initiators are used so that the corruption initiator and not the Pokémon to be manipulated for a species, item or move may receive a corruption that would turn it into a Bad Egg. The glitch generally has a low success rate and should be repeated until the player receives the corruption they desire.

The probability that the glitch corrupts a certain value or a certain PC Pokémon is generally of 1/32 or 0 (depending on the surrounding value and on the location of the value ). The success rate of Pokémon Corruption can be raised to 6/32 by using 5 clones and Corruption Initiators.

A Corruption Initiator ensures the good corruption of personnality values (and Trainer ID) whose hexadecimal value (in 32-bit format) have a leftmost character of 0,1,2,3,8,9,A,B or of 4,5,6,7,C,D,E,F. Thus, two different Corruption Initiators are required to cover every possible personnality values. Personnality values (and Trained ID) of in-game trade Pokémon in Emerald always have a leftmost hexadecimal character of 0. Thus, only one Corruption Initiator (in-game trade Plusle with Growl) is required to corrupt (or double corrupt) them. <ref>[https://www.youtube.com/watch?v=hBWkshUJv_8 Obtaining both corruption initiators]</ref>

While in-game trade Pokémon can be corrupted with the use of Corruption Initiators, this is not true for every possible Pokémon. A Pokémon can only have its personnality value corrupted if its data responds to a specific criteria. While it is easy to have a Pokémon that does not match this criteria, it is also easy to change some of its values to make it corruptible. <ref>[https://www.youtube.com/watch?v=65e-SKeE5Ec Specific criteria for Pokémon corruption]</ref>

Even though Pomeg Glitch can be transferred to Ruby and Sapphire, Glitzer Popping cannot be performed in these games because the game does not update the amount of party Pokémon when the player opens and closes the summary of a Party Pokémon (this step is necessary to access Pokémon beyond party slot 6).

==Cause==
{{incomplete|section|needs=Why does depositing the last Pokémon matter?}}
When the "??????????" or Decamark is sent out and the player opens and closes a Pokémon summary, the party Pokémon counter is refreshed.

The game counts 0 Pokémon (it counts Pokémon from first party slot until it finds an empty slot). This makes the party Pokémon selection pointer underflow, allowing it to select 256 party slots instead of 1-6. Selecting the "Quit" button moves the pointer to the 256th party slot.

When the player scrolls up from Quit, he or she is accessing Pokémon beyond slot 6. The first up press moves the selected Pokémon to party Pokémon 255, the second up press moves the selected Pokémon to party Pokémon 254, and so on.

Selecting Pokémon beyond slot 6 causes the game to select blocks of {{wp|Random-access memory|RAM data}} and treat them as party Pokémon data (with a size of 100 bytes). The 255th party slot ends up being over PC Pokemon data (around Box 2, Slot 23 for Emerald and Box 3, Slot 1 for FireRed/LeafGreen), and scrolling up will go over Day Care data, Pokémon Contest data, map data (NPCs with their location and script address), flag data (story, trainers, events), bag data, PC item data, Battle Frontier data, Trainer data (name, ID, SID...), and other data, in that order.

Each time the party Pokémon selection pointer selects a new party slot, an anti-cheating function is applied to the selected "Pokémon". If the checksum of the "Pokémon" is invalid, it is changed into a Bad Egg. This change is made by setting the Egg Status flag of the Pokémon to 1, and by setting two other bits to 1 in order to turn that Egg into a "Bad" Egg. As the blocks of data considered as party Pokémon aren't actually party Pokémon to begin with, the checksum of a selected "Pokémon" will nearly always be invalid if it isn't empty.

The Egg Status flag can be at 4 different locations in a Pokémon's data. It belongs to one of the 4 substructures of the Pokémon and these substructures are ordered depending on the Pokémon's PID (PID modulo 24); since these substructures are also crypted with the Pokémon's PID and TID, setting the Egg status flag to 1 can result in either a bit set to 1 or 0 (depending on TID xor PID). However, the two "Bad" Egg bits are at a fixed location and will always be set to 1 if the Pokémon's checksum is invalid. These bit changes are what corrupts RAM data, which can induce many good things - as this corruption only changes up to 3 bits on a block of 100 bytes, only a tiny portion of RAM data is corrupted in the process. Since one of these bits isn't on a set location and can be changed to either 1 or 0, the addresses and nature of the corruption won't be fixed too.

Another element of randomness is added by the DMA. The DMA is a cheat-prevention script that moves the RAM addresses of a good amount of data every time the player engages in battle, enters a door, opens their Bag, and so on. The DMA changes the RAM addresses of values by translating them from several double-words. A value affected by DMA can take 32 different addresses, each separated by a double-word (4 bytes). Party Pokémon aren't affected by DMA, which means that the addresses of every party slot is constant; however, the data read on party slots beyond slot 6 is affected by DMA. Since party Pokémon data is 25 double-words long, and since the DMA translation is at most 32 double-words long, every double-word on a party slot beyond slot 6 can end up on an address where one of the bit corruptions can occur. However, as both RAM values and the addresses where corruption occur can move, interferences can easily occur between these two, that can sometimes prevent a set double-word to be affected by the Egg Flag corruption. For example, the [[Ever Grande City]] Fly location can't always be corrupted because of such an interference.

Using different strategies, it is possible to manipulate the corruption of some values and ensure that no other value in an area near them has been corrupted, allowing for a somehow pinpointed corruption. With this glitch, the PID and/or TID of PC Pokémon can be corrupted, while leaving the rest of the Pokémon's data untouched. As PID and TID encrypt the 4 substructures of a Pokémon, corrupting them will heavily change the Pokémon's checksum. The two "Bad" Egg bits corruption won't preserve the checksum, making them unusable for Pokémon corruption, but the Egg State Flag corruption can easily preserve the checksum. The Egg State Flag corruption changes the checksum by a multiple of 0x4000; as a Pokémon's checksum is coded on a word, if that multiple is even, the checksum won't be changed. Only a few things can make that multiple odd, and they can be easily prevented, making Pokémon corruption viable.

As PID manages the order of the 4 substructures of a Pokémon, corrupting it changes that order, which means that the game will read the substructures of that corrupted Pokémon in a wrong order (for example, the Moves substructure gets read on the EVs substructure). This change of substructures order allows manipulation of many parts of the Pokémon's data (species, held item, experience, moves, EVs, origin, IVs, obedience, etc.) by giving it specific moves, EVs, Friendship, Held Items, and so on, before corrupting it. Out of the 24 theoretically possible changes of substructure order, only 10 can happen. These changes are called Corruption Types as they completely determine the effects of a PID corruption on a Pokémon.

Even if corrupting a Pokémon's PID with the Egg State flag corruption preserves its checksum and changes its substructure order, it also changes the encryption of these substructures (PID or TID changes). This change of encryption brings some changes to the decrypted values, and this can be a hindrance to the corrupted Pokémon. It will for example turn the Pokémon in an Egg, give it glitched moves 2 and 4, and/or affect its attributes. Having a corrupted Pokémon in an Egg is a hindrance as hatching it removes/resets its attributes; many Glitch Pokémon will also freeze the game when hatched, and always having moves 2 and 4 glitched can prevent you from using them, seeing them, swapping them, or changing them.

However, corrupting both PID and TID of a Pokémon in the course of two Glitzer Popping uses leaves the corrupted Pokémon with a valid checksum, a change of substructure orders, and a restored substructure encryption (PID or TID was changed back to its original value). This procedure can then be used for a precise corruption of nearly every Pokémon, leaving them without any residual glitched value.

==Origin/Discovery==
===Key people===
*Voltage (discovery of the "Decamark" sub-glitch of the Pomeg glitch) - early 2011.
*Luckytyphlosion (discovery that the "Decamark" sub-glitch of the Pomeg glitch can be used to create Bad Eggs and hatchable eggs) - April 9, 2014.
*Sanqui, Werster, TheZZAZZGlitch (analysis of the mechanics of the glitch) - May 2014.
*Metarkrai (further analysis and documentation of additional techniques, including ways to get obedient Mew and Deoxys).<ref>[http://forums.glitchcity.info/index.php?topic=6868.msg199729#msg199729 Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Post with corruption details for obtaining obedient Mew and Deoxys]</ref><ref>[https://www.youtube.com/watch?v=BNvi05UH9zk <nowiki>[Pomeg Glitch]</nowiki> Obtain any Pokemon/Item/Move]</ref>

===History===
The original Pomeg glitch was discovered many years before Glitzer Popping was found, from as early as 2006 or before.<ref>[http://www.serebiiforums.com/showthread.php?150005-The-Official-Pomeg-Glitch-Thread The Official Pomeg Glitch Thread - Serebii Forums]</ref> Later, various derivative tricks of the Pomeg glitch were researched and researched, including one which was found that allows the player to send out a ?????????? or "Decamark".

In early 2011, voltage discovered that the "Decamark" sub-glitch of the Pomeg glitch allows access to a hidden party of Pokémon beyond slot 6 if the player views the summary of their first fainted Pokémon first and then attempts to scroll through the party.<ref>[https://www.youtube.com/watch?v=0nDwHEoqPhM Hidden team glitch/Access beyond 6th slot (FR/LG/E)]</ref>

On April 9, 2014; luckytyphlosion (who is known in the Pokémon speedrunning community for his various discoveries) decided to experiment with voltage's hidden party glitch and documented an [https://www.youtube.com/watch?v=SXVLVP4Ij7M alternative cloning glitch] involving sending out a Pokémon beyond slot six and duplicating the fifth Pokémon on [[Glitch City Laboratories|Glitch City Laboratories Forums]].<ref>[http://forums.glitchcity.info/index.php?topic=6868.0 Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Glitch City Laboratories forums.]</ref>

This discovery encouraged further discussion of the glitch, and luckytyphlosion later documented on April 19 that it is possible to corrupt Pokémon in the Pokémon Storage System, although he did not document the method until Torchickens noted the cause of the Bad Egg occurrence was scrolling through the Pokémon at position 255 and below. It is unclear whether the replication method was known prior to this.<ref>[http://forums.glitchcity.info/index.php?topic=6868.msg194538#msg194538 Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Glitch City Laboratories forums - Bad Egg occurrence post by luckytyphlosion].</ref><ref>[http://forums.glitchcity.info/index.php?topic=6868.msg194544#msg194544 Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Glitch City Laboratories forums - Replication details by Torchickens.]</ref>

It was also discovered by luckytyphlosion that sending out Bad Eggs into battle by having all fainted Pokémon in the party allows access to "[[Super Glitch (move)|Generation III Super Glitch]]" moves which can be used for tricks such as skipping Trainer battles and capturing Trainer Pokémon; and importantly that it is possible with the glitch to obtain regular Eggs which can be hatched.

The mechanics relating to what makes the regular Eggs appear, and what determines their species, moves and other attributes were not known until werster and Sanqui did additional research into the glitch in early May on Twitch and the Glitch City Laboratories forums. They concluded that it is not the Pokémon's main data that changes per se, but the personality value itself; and that the Bad Egg/Egg occurrences are related to a change of one bit in the Pokémon's personality value.<ref>[http://forums.glitchcity.info/index.php?topic=6868.msg195147#msg195147 - Glitch City Laboratories forums - Personality value change details by Sanqui]</ref> Furthermore they discovered that data from the Pokémon's data substructure such as move IDs could be converted into species IDs, depending on the Pokémon's former personality value.<ref>[http://forums.glitchcity.info/index.php?topic=6868.msg195144#msg195144 - Gen III: Access Pokémon beyond the sixth slot sub-glitches. - Glitch City Laboratories forums - Conversion and substructure modification details.]</ref>

TheZZAZZGlitch documented on May 14 that the cause of the corruption after scrolling was ironically one of the game's anti-cheating mechanisms. In this mechanism, every time a Pokémon is selected, the game verifies its integrity and if the Pokémon is deemed invalid, then the game changes its data by setting bit 0, 1 and 6 at varies places in its "Miscellaneous" substructure but when the player selects Pokémon from beyond slot 6, the game attempts to validate the data of a non-existent "Pokémon"; hence altering 'out of bounds' data such as stored Pokémon in the PC.

Since its discovery, details related to Glitzer Popping have since been published on the Internet in different languages including French (in particular; Metarkrai has published much information related to the glitch in the French language), Japanese<ref>[http://archive.is/xrhPw 第3世代バグ技スレ [転載禁止©2ch.net]</ref> and Spanish<ref>[https://www.youtube.com/watch?v=poVy2U3yXTk CONSEGUIR CUALQUIER POKÉMON/OBJETO EN ESMERALDA + EVENTOS MEW Y DEOXYS - Youtube video by MikaCookies].</ref>

==Video==
{{YouTubeEmbed|6hJeA6i26VU|channel/UCZz2ixp-5T6VeAPtAMQ5v5Q|name=ChickasaurusGL|Cool}}
{{YouTubeEmbed|nOEwPnv2TFM|channel/UCO_0coJ_V8PFPaXRtLlHNhw|name=Werster|Cool}}

==References==
{{reflist}}

{{-}}
{{Stub|glitch}}
{{Glitches}}<br/>
{{Project Glitchdex notice|no}}

[[Category:Glitches]]

[[zh:整个盒子的坏蛋（漏洞）]]