Glitzer Popping

This article does not yet meet the quality standards of Bulbapedia. Please feel free to edit this article to make it conform to Bulbapedia norms and conventions.

Glitzer Popping is a subglitch of the access Pokémon beyond slot 6 subglitch of the Pomeg glitch. As with the latter subglitch, it can only be initially performed in Pokémon Emerald (and can also be performed in FireRed and LeafGreen via trading with Emerald).

By scrolling past slot 255 and below in a player's party, it allows the player to corrupt Pokémon in the Pokémon Storage System's box 1 and 2. Most of the time these become Bad Eggs, which may have glitch moves with beneficial effects such as skipping battles.

The glitch is notable as a means of producing a glitched Egg which can be hatched. The player can manipulate the Egg to contain any valid Pokémon and various glitch Pokémon. Additionally, using a technique known as "double corruption", one can create an unhatched Pokémon in the Pokémon Storage System with multiple characteristics (Item, Moves, Species, IVs, Origin, etc) that they desire.

In addition to Pokémon data, Glitzer Popping can corrupt Day Care data, contest data, map data (NPCs with their location and script address), flag data (story, trainers, events), bag quantity data, PC item data, Battle Frontier data, Trainer data (name, ID, SID) and Secret Base items.

Name

The name Glitzer Popping does not have any meaning in itself, and was chosen by the speedrunner Werster because he didn't want the glitch to have a name that in his view would be 'too generic'.

Method

Requirements

1. A Pokémon who gained 1 or more health points with a single HP Up. That would mean it would lose 1 of more HP when fed a Pomeg Berry; for example a level 100 Pokémon with 10 HP EVs or more would lose two health points when fed the Pomeg Berry, but a high level Pokémon (from Sky Pillar, Victory Road, Artisan Cave, any Legendary, etc) can work as well.
2. At least three Pokémon, one of which needs to be a fainted Pokémon with the move Fly, and a different fainted Pokémon.
3. A Pokémon with a suitable personality value that should preferably be cloned multiple times. After the glitch, most of this Pokémon's data will be permuted depending on its personality value (e.g. EVs data becoming species data, species data becoming attacks data, etc).

The in-game trade Pokémon "Seasor" the Horsea and "Dots" the Seedot are ideal for the glitch because they work and always have the same personality values; 0x0000007F and 0x00000084 respectively. These Pokémon may be used to convert 'EVs into Growth' (see article Pokémon data substructures in Generation III, with the Attack EV representing the most significant byte of the Pokémon's index number and the HP EV representing the least significant byte (e.g. 151 HP EVs and 0 Attack EVs would result in a Mew).

Alternatively, a Pokémon with a personality value that would convert 'Attacks into Growth' could be used for an exploit such as converting a Pokémon with Beat Up (move ID 251) into a Celebi.

Steps

1. Move the Pokémon with the suitable personality value to box 2 slot 23 or box 2 slot 24 of the Pokémon Storage System, and preferably 4 clones of the Pokémon obtained with a cloning glitch to other places of the box. Though it is not required, it is recommended to place the clones two spaces apart from each other (e.g. in slots 23, 21, 19, 17, 15 of Box 2), and to maximize the success rate (which is low) a good "corruption initiator" (a Pokémon to "absorb" unfavourable corruptions) should be placed at positions one space left of the Pokémon (e.g. slots 22, 20, 18, 16 of Box 2). Pluses the in-game trade Plusle, with all of its moves erased except for Growl is an example of a good corruption initiator. Without a corruption initiator, it may take a very long time for the glitch to work; if at all.
2. Fill the party with fainted Pokémon (one of which needs to know Fly), and a Pokémon that can lose HP with a Pomeg Berry.
3. Decrease the HP of said Pokémon to 1, so that it's HP can fall to 0 or below (underflow to 65535 or less) with a Pomeg Berry. A Banette with Curse and odd HP can come in handy to quickly decrease the Pokémon's HP to 1.
4. Once the process is complete, the player can save the game here. If the glitch doesn't work the first time (quite likely), the player will be able to restart from this point and try again.
5. Initiate a wild battle and flee from it.
6. Deposit the first fainted Pokémon in the Pokémon Storage System.
7. Use the Pomeg Berry on the Pokémon with 1 HP. If it receives 0 HP, then nothing else needs to be done. Though if it receives 65535 HP or less, a healing item such as a Potion should be used to faint it. The player should now have two fainted Pokémon.
8. Initiate another wild Pokémon battle to send out a ??????????.
9. Open the Pokémon menu and view the summary of the first valid Pokémon in the party.
10. After viewing the summary, exit back to the party menu and scroll up. The more that the player scrolls up, beginning from "Cancel", the more Pokémon in the storage system are corrupted. The first slot up from Cancel may affect the data of the Pokémon in box 2 slot 23 in English Emerald. The corruption of storage box Pokémon ends at around slot 215 (affecting the Pokémon in box 1 slot 1).
11. Exit the Pokémon battle and check Pokémon in the Pokémon Storage System. If there is a regular "Egg" rather than a Bad Egg, withdraw it and send it into battle to see if it converted into a different Pokémon. Sometimes a regular Egg will appear as the original Pokémon, this is normal and if no ideal Eggs appear, the player is free to reset the game and try the glitch again.
12. Hatch the Egg to obtain the converted Pokémon, which will be registered in the Pokédex.
13. Remove any unwanted Bad Eggs using the inverse cloning glitch. (Optional)

Double corruption

A double corruption allows the player to obtain the modified Pokémon in an Egg without hatching it. To cause a double corruption, the player should perform the usual steps to obtain a regular Egg, but leave the Egg in the storage system and corrupt it again. The Egg must not be picked up, or it will never corrupt into the desired unhatched Pokémon (unless the Pokémon is specifically crafted to work around this; e.g. a "Dots" Egg that had Flash as the fourth move).

Double corruption allows the player to obtain the Pokémon without going through hatching, which preserves the Held Item, EVs, Origin, Obedience, Ribbons, Experience, Contest Stats, PP Boosts, etc. While a simple corruption slightly changes some of the Pokémon's values (Move 2 and Move 4 will always be Glitch Moves, for example), a double corruption leave the data intact (it will only permute the substructures), which allows a complete manipulation of said Pokémon's moves.

The Eon Ticket, AuroraTicket, and MysticTicket, if held by a storage box Pokémon, cannot be taken and used to travel to an event island, as the flag must also be set.

Some Key Items for Ruby/Sapphire/Emerald or FireRed/LeafGreen obtained this way can be traded and used during the main story to skip certain parts. (PokeFlute, Tea, Scope Sylph, HM01 Cut, Rainbow Pass, Mach Bike & Acro Bike, Go-goggles, etc)

Notes

In order to perform the same glitch in Pokémon FireRed and LeafGreen, a Pokémon with 65535 HP or less just be traded over there and the same basic steps should be performed (switching to the last Pokémon and depositing it, healing the Pokémon with 65535 HP or less to faint it).

Mew and Deoxys obtained from Horsea or Seedot with this glitch will not obey the player due to them not being met in a "fateful encounter". However, by catching multiple Smeargle with a certain personality value and giving them certain Moves, EVs, Contests stats, and performing double corruption on them, it is possible to obtain an obedient Mew or Deoxys from their original location.

It is also possible to trigger Glitzer Popping with an Invisible Bad Egg (a corrupted empty slot produced with Glitzer Popping or with a Glitch Pokémon) instead of a Pokémon who gained 1 HP or more with HP Ups and whose current HP is at 1, making the procedure a bit easier to perform. This trick discovered by Voltage is called Decaswitch.

By making the journalist at Slateport Poké Fan Club read the species name of a certain Glitch Pokémon, it is possible to overwrite party Pokémon data and to have an empty slot in the party. This empty slot allows the player to perform Glitzer Popping just by opening the party from the start menu and by pressing Up. This third way to perform Glitzer Popping, called Instant Pomeg Glitch, is significantly faster from the two others.

Due to Pokémon Emerald and FireRed/LeafGreen's "dynamic memory allocation" (DMA) in which the location of memory addresses are randomized after performing tasks such as opening the Pokémon menu, the game won't always alter the correct bit in the target Pokémon's personality value and will leave the Pokémon corrupted in an unfavourable way. Corruption initiators are used so that the corruption initiator and not the Pokémon to be manipulated for a species, item or move may receive a corruption that would turn it into a Bad Egg. The glitch generally has a low success rate and should be repeated until the player receives the corruption they desire.

The probability that the glitch corrupts a certain value or a certain PC Pokémon is generally 1/32 or 0 (depending on the surrounding value and on the location of the value ). The success rate of Pokémon Corruption can be raised to 6/32 by using 5 clones and Corruption Initiators.

A Corruption Initiator ensures the good corruption of personality values (and Trainer ID) whose hexadecimal value (in 32-bit format) have a leftmost character of 0,1,2,3,8,9,A,B or of 4,5,6,7,C,D,E,F. Thus, two different Corruption Initiators are required to cover every possible personality values. Personality values (and Trained ID) of in-game trade Pokémon in Emerald always have a leftmost hexadecimal character of 0. Thus, only one Corruption Initiator (in-game trade Plusle with Growl) is required to corrupt (or double corrupt) them.

While in-game trade Pokémon can be corrupted with the use of Corruption Initiators, this is not true for every possible Pokémon. A Pokémon can only have its personnality value corrupted if its data responds to a specific criteria. While it is easy to have a Pokémon that does not match this criteria, it is also easy to change some of its values to make it corruptible.

Even though Pomeg Glitched Pokémon can be transferred to Ruby and Sapphire, Glitzer Popping cannot be performed in these games because the game does not update the amount of party Pokémon when the player opens and closes the summary of a Party Pokémon (this step is necessary to access Pokémon beyond party slot 6).

Cause

This section is incomplete. Please feel free to edit this section to add missing information and complete it. Reason: Why does depositing the last Pokémon matter?

When the "??????????" or Decamark is sent out and the player opens and closes a Pokémon summary, the party Pokémon counter is refreshed.

The game counts 0 Pokémon (it counts Pokémon from first party slot until it finds an empty slot). This makes the party Pokémon selection pointer underflow, allowing it to select 256 party slots instead of 1-6. Selecting the "Quit" button moves the pointer to the 256th party slot.

When the player scrolls up from Quit, they are accessing Pokémon beyond slot 6. The first up press moves the selected Pokémon to party Pokémon 255, the second up press moves the selected Pokémon to party Pokémon 254, and so on.

Selecting Pokémon beyond slot 6 causes the game to select blocks of RAM data and treat them as party Pokémon data (with a size of 100 bytes). The 255th party slot ends up being over PC Pokemon data (around Box 2, Slot 23 for Emerald and Box 3, Slot 1 for FireRed/LeafGreen), and scrolling up will go over Day Care data, Pokémon Contest data, map data (NPCs with their location and script address), flag data (story, trainers, events), bag data, PC item data, Battle Frontier data, Trainer data (name, ID, SID...), and other data, in that order.

Each time the party Pokémon selection pointer selects a new party slot, an anti-cheating function is applied to the selected "Pokémon". If the checksum of the "Pokémon" is invalid, it is changed into a Bad Egg. This change is made by setting the Egg Status flag of the Pokémon to 1, and by setting two other bits to 1 in order to turn that Egg into a "Bad" Egg. As the blocks of data considered as party Pokémon aren't actually party Pokémon to begin with, the checksum of a selected "Pokémon" will nearly always be invalid if it isn't empty.

The Egg Status flag can be at 4 different locations in a Pokémon's data. It belongs to one of the 4 substructures of the Pokémon and these substructures are ordered depending on the Pokémon's PID (PID modulo 24); since these substructures are also crypted with the Pokémon's PID and TID, setting the Egg status flag to 1 can result in either a bit set to 1 or 0 (depending on TID xor PID). However, the two "Bad" Egg bits are at a fixed location and will always be set to 1 if the Pokémon's checksum is invalid. These bit changes are what corrupts RAM data, which can induce many good things - as this corruption only changes up to 3 bits on a block of 100 bytes, only a tiny portion of RAM data is corrupted in the process. Since one of these bits isn't on a set location and can be changed to either 1 or 0, the addresses and nature of the corruption won't be fixed too.

Another element of randomness is added by the DMA. The DMA is a cheat-prevention script that moves the RAM addresses of a good amount of data every time the player engages in battle, enters a door, opens their Bag, and so on. The DMA changes the RAM addresses of values by translating them from several double-words. A value affected by DMA can take 32 different addresses, each separated by a double-word (4 bytes). Party Pokémon aren't affected by DMA, which means that the addresses of every party slot is constant; however, the data read on party slots beyond slot 6 is affected by DMA. Since party Pokémon data is 25 double-words long, and since the DMA translation is at most 32 double-words long, every double-word on a party slot beyond slot 6 can end up on an address where one of the bit corruptions can occur. However, as both RAM values and the addresses where corruption occur can move, interferences can easily occur between these two, that can sometimes prevent a set double-word to be affected by the Egg Flag corruption. For example, the Ever Grande City Fly location can't always be corrupted because of such an interference.

Using different strategies, it is possible to manipulate the corruption of some values and ensure that no other value in an area near them has been corrupted, allowing for a somehow pinpointed corruption. With this glitch, the PID and/or TID of PC Pokémon can be corrupted, while leaving the rest of the Pokémon's data untouched. As PID and TID encrypt the 4 substructures of a Pokémon, corrupting them will heavily change the Pokémon's checksum. The two "Bad" Egg bits corruption won't preserve the checksum, making them unusable for Pokémon corruption, but the Egg State Flag corruption can easily preserve the checksum. The Egg State Flag corruption changes the checksum by a multiple of 0x4000; as a Pokémon's checksum is coded on a word, if that multiple is even, the checksum won't be changed. Only a few things can make that multiple odd, and they can be easily prevented, making Pokémon corruption viable.

As PID manages the order of the 4 substructures of a Pokémon, corrupting it changes that order, which means that the game will read the substructures of that corrupted Pokémon in a wrong order (for example, the Moves substructure gets read on the EVs substructure). This change of substructures order allows manipulation of many parts of the Pokémon's data (species, held item, experience, moves, EVs, origin, IVs, obedience, etc.) by giving it specific moves, EVs, Friendship, Held Items, and so on, before corrupting it. Out of the 24 theoretically possible changes of substructure order, only 10 can happen. These changes are called Corruption Types as they completely determine the effects of a PID corruption on a Pokémon.

Even if corrupting a Pokémon's PID with the Egg State flag corruption preserves its checksum and changes its substructure order, it also changes the encryption of these substructures (PID or TID changes). This change of encryption brings some changes to the decrypted values, and this can be a hindrance to the corrupted Pokémon. It will for example turn the Pokémon in an Egg, give it glitched moves 2 and 4, and/or affect its attributes. Having a corrupted Pokémon in an Egg is a hindrance as hatching it removes/resets its attributes; many Glitch Pokémon will also freeze the game when hatched, and always having moves 2 and 4 glitched can prevent you from using them, seeing them, swapping them, or changing them.

However, corrupting both PID and TID of a Pokémon in the course of two Glitzer Popping uses leaves the corrupted Pokémon with a valid checksum, a change of substructure orders, and a restored substructure encryption (PID or TID was changed back to its original value). This procedure can then be used for a precise corruption of nearly every Pokémon, leaving them without any residual glitched value.

Origin/Discovery

Key people

• Voltage (discovery of the "Decamark" sub-glitch of the Pomeg glitch) - early 2011.
• Luckytyphlosion (discovery that the "Decamark" sub-glitch of the Pomeg glitch can be used to create Bad Eggs and hatchable eggs) - April 9, 2014.
• Sanqui, Werster, TheZZAZZGlitch (analysis of the mechanics of the glitch) - May 2014.
• Metarkrai (further analysis and documentation of additional techniques, including ways to get obedient Mew and Deoxys).

History

The original Pomeg glitch was discovered many years before Glitzer Popping was found, from as early as 2006 or before. Later, various derivative tricks of the Pomeg glitch were researched and researched, including one which was found that allows the player to send out a ?????????? or "Decamark".

In early 2011, voltage discovered that the "Decamark" sub-glitch of the Pomeg glitch allows access to a hidden party of Pokémon beyond slot 6 if the player views the summary of their first fainted Pokémon first and then attempts to scroll through the party.

On April 9, 2014; luckytyphlosion (who is known in the Pokémon speedrunning community for his various discoveries) decided to experiment with voltage's hidden party glitch and documented an alternative cloning glitch involving sending out a Pokémon beyond slot six and duplicating the fifth Pokémon on Glitch City Laboratories Forums.

This discovery encouraged further discussion of the glitch, and luckytyphlosion later documented on April 19 that it is possible to corrupt Pokémon in the Pokémon Storage System, although he did not document the method until Torchickens noted the cause of the Bad Egg occurrence was scrolling through the Pokémon at position 255 and below. It is unclear whether the replication method was known prior to this.

It was also discovered by luckytyphlosion that sending out Bad Eggs into battle by having all fainted Pokémon in the party allows access to "Generation III Super Glitch" moves which can be used for tricks such as skipping Trainer battles and capturing Trainer Pokémon; and importantly that it is possible with the glitch to obtain regular Eggs which can be hatched.

The mechanics relating to what makes the regular Eggs appear, and what determines their species, moves and other attributes were not known until werster and Sanqui did additional research into the glitch in early May on Twitch and the Glitch City Laboratories forums. They concluded that it is not the Pokémon's main data that changes per se, but the personality value itself; and that the Bad Egg/Egg occurrences are related to a change of one bit in the Pokémon's personality value. Furthermore they discovered that data from the Pokémon's data substructure such as move IDs could be converted into species IDs, depending on the Pokémon's former personality value.

TheZZAZZGlitch documented on May 14 that the cause of the corruption after scrolling was ironically one of the game's anti-cheating mechanisms. In this mechanism, every time a Pokémon is selected, the game verifies its integrity and if the Pokémon is deemed invalid, then the game changes its data by setting bit 0, 1 and 6 at varies places in its "Miscellaneous" substructure but when the player selects Pokémon from beyond slot 6, the game attempts to validate the data of a non-existent "Pokémon"; hence altering 'out of bounds' data such as stored Pokémon in the PC.

Since its discovery, details related to Glitzer Popping have since been published on the Internet in different languages including French (in particular; Metarkrai has published much information related to the glitch in the French language), Japanese and Spanish

Video

By ChickasaurusGL

By Werster

References

Glitches in the Pokémon games Multiple generations Transform glitches • Glitch Trainers • Cloning glitches • Error messages • Arbitrary code execution Generation I Glitches • Battle glitches • Overworld glitches -- • 0 ERROR • Broken hidden items • Cable Club escape glitch • Dual-type damage misinformation Experience underflow glitch • Fight Safari Zone Pokémon trick • Glitch City • Item duplication glitch • Item underflow Mew glitch • Old man glitch • Pewter Gym skip glitch • Pokémon merge glitch • Rhydon glitch • Rival twins glitch Select glitches (dokokashira door glitch, second type glitch) • Super Glitch Time Capsule exploit • Walking through walls • ZZAZZ glitch Generation II Glitches • Battle glitches Bug-Catching Contest glitch • Celebi Egg glitch • Coin Case glitches • Experience underflow glitch Glitch dimension • Glitch Egg • Teru-sama • Time Capsule exploit • Trainer House glitches • GS Ball mail glitch Generation III Glitches • Battle glitches • Overworld glitches Berry glitch • Dive glitch • Pomeg glitch • Glitzer Popping Generation IV Glitches • Battle glitches • Overworld glitches Acid rain • GTS glitches • Pomeg glitch • Rage glitch Surf glitch • Tweaking • Pal Park Retire glitch Generation V Glitches • Battle glitches • Overworld glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Frozen Zoroark glitch • Sky Drop glitch Generation VI Glitches • Battle glitches • Overworld glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Lumiose City save glitch • Symbiosis Eject Button glitch • Toxic sure-hit glitch Generation VII Glitches • Battle glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Toxic sure-hit glitch • Rollout storage glitch Generation VIII Glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Toxic sure-hit glitch • Rollout storage glitch • Party item offset glitch Generation IX Glitches Glitch effects Game freeze • Glitch battle • Glitch song Gen I only: Glitch screen • TMTRAINER effect • Inverted sprite Gen II only: Glitch dimension Lists Glitches (GO • Mystery Dungeon • TCG GB • Spin-off) Glitch Pokémon (Gen I • Gen II • Gen III • Gen IV • Gen V • Gen VI • Gen VII • Gen VIII) Glitch moves (Gen I) • Glitch types (Gen I • Gen II)

This article is part of Project GlitchDex, a Bulbapedia project that aims to write comprehensive articles on glitches in the Pokémon games.