Glitzer Popping

This article does not yet meet the quality standards of Bulbapedia. Please feel free to edit this article to make it conform to Bulbapedia norms and conventions.

Glitzer Popping is a subglitch of the access Pokémon beyond slot 6 subglitch of the Pomeg glitch. As with the latter subglitch, it can only be initially performed in Pokémon Emerald (and can also be performed in FireRed and LeafGreen via trading with Emerald).

By scrolling past slot 255 and below in a player's party, it allows the player to corrupt Pokémon in the Pokémon Storage System's box 1 and 2. Most of the time these become Bad Eggs, which may have glitch moves with beneficial effects such as skipping battles.

The glitch is notable as a means of producing an Egg. The player can manipulate the Egg to contain any valid Pokémon and many glitch Pokémon. Additionally, using a technique known as "double corruption", one can create an unhatched Pokémon in the Pokémon Storage System holding an item that he or she desires.

In addition to Pokémon data, Glitzer Popping can corrupt Day Care data, contest data, map data (NPCs with their location and script address), flag data (story, trainers, events), bag quantity data, PC item data, Battle Frontier data, Trainer data (name, ID, SID) and Secret Base items.

Name

The name Glitzer Popping does not have any meaning in itself, and was chosen by speedrunner Werster because he wanted the glitch to have a name that in his view would be 'too generic'.

Method

Requirements

1. A Pokémon with at least 10 HP EVs at a level that would mean it would lose at least one HP when fed a Pomeg Berry; for example a level 100 Pokémon with 10 HP EVs or more would lose two health points when fed the Pomeg Berry.
2. At least three Pokémon, including at least one fainted Pokémon.
3. Any Pokémon in the last position of the party to switch into, which may be referred to as the "switch Pokémon".
4. A Pokémon with a suitable personality value that should preferably be cloned multiple times. After the glitch, this Pokémon will be converted in a specific way depending on the personality value (e.g. EVs data becoming species data).

The in-game trade Pokémon "Seasor" the Horsea and "Dots" the Seedot are ideal for the glitch because they work and always have the same personality values; 0x0000007F and 0x00000084 respectively. These Pokémon may be used to convert 'EVs into Growth' (see article Pokémon data substructures in Generation_III, with the Attack EV representing the most significant byte of the Pokémon's index number and the HP EV representing the least significant byte (e.g. 151 HP EVs and 0 Attack EVs would result in a Mew).

Alternatively, a Pokémon with a personality value that would convert 'Attacks into Growth' could be used for an exploit such as converting a Pokémon with Beat Up (move ID 251) into a Celebi.

Steps

1. Move the Pokémon with the suitable personality value to box 2 slot 23 of the Pokémon Storage System.
2. Enter a wild Pokémon battle with at least three Pokémon, one should be the Pokémon that can lose HP with the Pomeg glitch, another should be the "switch Pokémon". The rest need to be fainted.
3. Switch to the bottom Pokémon in the party and run away. The player may save the game here if the glitch doesn't work the first time (which is highly likely).
4. Deposit the bottom Pokémon in the Pokémon Storage System.
5. Use the Pomeg Berry on the top Pokémon. If it receives 0 HP nothing else needs to be done. If it receives 65535 HP or less, a healing item such as a Potion should be used to faint it. The player should now have all fainted Pokémon.
6. Enter a wild Pokémon battle to send out a ??????????.
7. Open the Pokémon menu and view the summary of the first valid Pokémon in the party.
8. Scroll up. The more that the player scrolls up, beginning from "Cancel", the more Pokémon in the storage system are corrupted. The first slot up from Cancel may affect the data of the Pokémon in box 2 slot 23 in English Emerald. The corruption of storage box Pokémon ends at around slot 215 (affecting the Pokémon in box 1 slot 1).
9. Exit the Pokémon battle and check Pokémon in the Pokémon Storage System. If there is a regular "Egg" rather than a Bad Egg, withdraw it and send it into battle to see if it converted into a different Pokémon. Sometimes a regular Egg will appear as the original Pokémon, this is normal and if no ideal Eggs appear the player is free to reset the game and try the glitch again.
10. Preferably hatch the Egg to obtain the converted Pokémon, which will be registered in the Pokédex.
11. Preferably remove any unwanted Bad Eggs using the inverse cloning glitch.

Double corruption

A double corruption allows the player to obtain the modified Pokémon in an Egg without hatching it. To cause a double corruption, the player should perform the usual steps to obtain a regular Egg, but leave the Egg in the storage system and corrupt it again. The Egg must not be picked up with the glove, or it will never corrupt again into the desired unhatched Pokémon. Double corruption allows the player to obtain the Pokémon holding an item. The item is influenced by the data in its substructure.

The Eon Ticket, AuroraTicket and MysticTicket held by a storage box Pokémon alone cannot be taken and used to travel to an event island as the flag must also be set.

Notes

This section is incomplete. Please feel free to edit this section to add missing information and complete it. Reason: Describe the means of obtaining obedient Mew and Deoxys.

In order to perform the glitch in Pokémon FireRed and LeafGreen, trade a Pokémon with 65535 HP or less there and perform the same basic steps (switching to the last Pokémon and depositing it, healing the Pokémon with 65535 HP or less to faint it).

Mew and Deoxys obtained with this glitch likely will not obey the player due to them not being met in a "fateful encounter".

Due to Pokémon Emerald and FireRed/LeafGreen's "dynamic memory allocation" (DMA) in which the location of memory addresses are randomized after performing tasks such as opening the Pokémon menu, the game won't always alter the correct bit in the target Pokémon's personality value and will leave the Pokémon corrupted in an unfavourable way. This occurs very often and the glitch should be repeated until the player receives the corruption they desire.

Cause

This section is incomplete. Please feel free to edit this section to add missing information and complete it. Reason: Why does depositing the last Pokémon matter?

When the "??????????" or Decamark is sent out and the player opens and closes a Pokémon summary, the party Pokémon counter is refreshed.

The game counts 0 Pokémon (it counts Pokémon from first party slot until it finds an empty slot). This makes the party Pokémon selection pointer underflow, allowing it to select 256 party slots instead of 1-6. Selecting the "Quit" button moves the pointer to the 256th party slot.

When the player scrolls up from Quit, he or she is accessing Pokémon beyond slot 6. The first up press moves the selected Pokémon to party Pokémon 255, the second up press moves the selected Pokémon to party Pokémon 254, and so on.

Selecting Pokémon beyond slot 6 causes the game to select blocks of RAM data and treat them as party Pokémon data (with a size of 100 bytes). The 255th party slot ends up being over PC Pokemon data (around Box 2, Slot 23 for Emerald and Box 3, Slot 1 for FireRed/LeafGreen), and scrolling up will go over Day Care data, Pokémon Contest data, map data (NPCs with their location and script address), flag data (story, trainers, events), bag data, PC item data, Battle Frontier data, Trainer data (name, ID, SID...), and other data, in that order.

Each time the party Pokémon selection pointer selects a new party slot, an anti-cheating function is applied to the selected "Pokémon". If the checksum of the "Pokémon" is invalid, it is changed into a Bad Egg. This change is made by setting the Egg Status flag of the Pokémon to 1, and by setting two other bits to 1 in order to turn that Egg into a "Bad" Egg. As the blocks of data considered as party Pokémon aren't actually party Pokémon to begin with, the checksum of a selected "Pokémon" will nearly always be invalid if it isn't empty.

The Egg Status flag can be at 4 different locations in a Pokémon's data. It belongs to one of the 4 substructures of the Pokémon and these substructures are ordered depending on the Pokémon's PID (PID modulo 24); since these substructures are also crypted with the Pokémon's PID and TID, setting the Egg status flag to 1 can result in either a bit set to 1 or 0 (depending on TID xor PID). However, the two "Bad" Egg bits are at a fixed location and will always be set to 1 if the Pokémon's checksum is invalid. These bit changes are what corrupts RAM data, which can induce many good things - as this corruption only changes up to 3 bits on a block of 100 bytes, only a tiny portion of RAM data is corrupted in the process. Since one of these bits isn't on a set location and can be changed to either 1 or 0, the addresses and nature of the corruption won't be fixed too.

Another element of randomness is added by the DMA. The DMA is a cheat-prevention script that moves the RAM addresses of a good amount of data every time the player engages in battle, enters a door, opens their Bag, and so on. The DMA changes the RAM addresses of values by translating them from several double-words. A value affected by DMA can take 32 different addresses, each separated by a double-word (4 bytes). Party Pokémon aren't affected by DMA, which means that the addresses of every party slot is constant; however, the data read on party slots beyond slot 6 is affected by DMA. Since party Pokémon data is 25 double-words long, and since the DMA translation is at most 32 double-words long, every double-word on a party slot beyond slot 6 can end up on an address where one of the bit corruptions can occur. However, as both RAM values and the addresses where corruption occur can move, interferences can easily occur between these two, that can sometimes prevent a set double-word to be affected by the Egg Flag corruption. For example, the Ever Grande City Fly location can't always be corrupted because of such an interference.

Using different strategies, it is possible to manipulate the corruption of some values and ensure that no other value in an area near them has been corrupted, allowing for a somehow pinpointed corruption. With this glitch, the PID and/or TID of PC Pokémon can be corrupted, while leaving the rest of the Pokémon's data untouched. As PID and TID encrypt the 4 substructures of a Pokémon, corrupting them will heavily change the Pokémon's checksum. The two "Bad" Egg bits corruption won't preserve the checksum, making them unusable for Pokémon corruption, but the Egg State Flag corruption can easily preserve the checksum. The Egg State Flag corruption changes the checksum by a multiple of 0x4000; as a Pokémon's checksum is coded on a word, if that multiple is even, the checksum won't be changed. Only a few things can make that multiple odd, and they can be easily prevented, making Pokémon corruption viable.

As PID manages the order of the 4 substructures of a Pokémon, corrupting it changes that order, which means that the game will read the substructures of that corrupted Pokémon in a wrong order (for example, the Moves substructure gets read on the EVs substructure). This change of substructures order allows manipulation of many parts of the Pokémon's data (species, held item, experience, moves, EVs, origin, IVs, obedience, etc.) by giving it specific moves, EVs, Friendship, Held Items, and so on, before corrupting it. Out of the 24 theoretically possible changes of substructure order, only 10 can happen. These changes are called Corruption Types as they completely determine the effects of a PID corruption on a Pokémon.

Even if corrupting a Pokémon's PID with the Egg State flag corruption preserves its checksum and changes its substructure order, it also changes the encryption of these substructures (PID or TID changes). This change of encryption brings some changes to the decrypted values, and this can be a hindrance to the corrupted Pokémon. It will for example turn the Pokémon in an Egg, give it glitched moves 2 and 4, and/or affect its attributes. Having a corrupted Pokémon in an Egg is a hindrance as hatching it removes/resets its attributes; many Glitch Pokémon will also freeze the game when hatched, and always having moves 2 and 4 glitched can prevent you from using them, seeing them, swapping them, or changing them.

However, corrupting both PID and TID of a Pokémon in the course of two Glitzer Popping uses leaves the corrupted Pokémon with a valid checksum, a change of substructure orders, and a restored substructure encryption (PID or TID was changed back to its original value). This procedure can then be used for a precise corruption of nearly every Pokémon, leaving them without any residual glitched value.

Origin/Discovery

Key people

• Voltage (discovery of the "Decamark" sub-glitch of the Pomeg glitch) - early 2011.
• Luckytyphlosion (discovery that the "Decamark" sub-glitch of the Pomeg glitch can be used to create Bad Eggs and hatchable eggs) - April 9, 2014.
• Sanqui, Werster, TheZZAZZGlitch (analysis of the mechanics of the glitch) - May 2014.
• Metarkrai (further analysis and documentation of additional techniques, including ways to get obedient Mew and Deoxys).

History

The original Pomeg glitch was discovered many years before Glitzer Popping was found, from as early as 2006 or before. Later, various derivative tricks of the Pomeg glitch were researched and researched, including one which was found that allows the player to send out a ?????????? or "Decamark".

In early 2011, voltage discovered that the "Decamark" sub-glitch of the Pomeg glitch allows access to a hidden party of Pokémon beyond slot 6 if the player views the summary of their first fainted Pokémon first and then attempts to scroll through the party.

On April 9, 2014; luckytyphlosion (who is known in the Pokémon speedrunning community for his various discoveries) decided to experiment with voltage's hidden party glitch and documented an alternative cloning glitch involving sending out a Pokémon beyond slot six and duplicating the fifth Pokémon on Glitch City Laboratories Forums.

This discovery encouraged further discussion of the glitch, and luckytyphlosion later documented on April 19 that it is possible to corrupt Pokémon in the Pokémon Storage System, although he did not document the method until Torchickens noted the cause of the Bad Egg occurrence was scrolling through the Pokémon at position 255 and below. It is unclear whether the replication method was known prior to this.

It was also discovered by luckytyphlosion that sending out Bad Eggs into battle by having all fainted Pokémon in the party allows access to "Generation III Super Glitch" moves which can be used for tricks such as skipping Trainer battles and capturing Trainer Pokémon; and importantly that it is possible with the glitch to obtain regular Eggs which can be hatched.

The mechanics relating to what makes the regular Eggs appear, and what determines their species, moves and other attributes were not known until werster and Sanqui did additional research into the glitch in early May on Twitch and the Glitch City Laboratories forums. They concluded that it is not the Pokémon's main data that changes per se, but the personality value itself; and that the Bad Egg/Egg occurrences are related to a change of one bit in the Pokémon's personality value. Furthermore they discovered that data from the Pokémon's data substructure such as move IDs could be converted into species IDs, depending on the Pokémon's former personality value.

TheZZAZZGlitch documented on May 14 that the cause of the corruption after scrolling was ironically one of the game's anti-cheating mechanisms. In this mechanism, every time a Pokémon is selected, the game verifies its integrity and if the Pokémon is deemed invalid, then the game changes its data by setting bit 0, 1 and 6 at varies places in its "Miscellaneous" substructure but when the player selects Pokémon from beyond slot 6, the game attempts to validate the data of a non-existent "Pokémon"; hence altering 'out of bounds' data such as stored Pokémon in the PC.

Since its discovery, details related to Glitzer Popping have since been published on the Internet in different languages including French (in particular; Metarkrai has published much information related to the glitch in the French language), Japanese and Spanish

Video

By Werster

References

This article is a stub. You can help Bulbapedia by expanding it.

Glitches in the Pokémon games Multiple generations Transform glitches • Glitch Trainers • Cloning glitches • Error messages • Arbitrary code execution Generation I Glitches • Battle glitches • Overworld glitches -- • 0 ERROR • Broken hidden items • Cable Club escape glitch • Dual-type damage misinformation Experience underflow glitch • Fight Safari Zone Pokémon trick • Glitch City • Item duplication glitch • Item underflow Mew glitch • Old man glitch • Pewter Gym skip glitch • Pokémon merge glitch • Rhydon glitch • Rival twins glitch Select glitches (dokokashira door glitch, second type glitch) • Super Glitch Time Capsule exploit • Walking through walls • ZZAZZ glitch Generation II Glitches • Battle glitches Bug-Catching Contest glitch • Celebi Egg glitch • Coin Case glitches • Experience underflow glitch Glitch dimension • Glitch Egg • Teru-sama • Time Capsule exploit • Trainer House glitches • GS Ball mail glitch Generation III Glitches • Battle glitches • Overworld glitches Berry glitch • Dive glitch • Pomeg glitch • Glitzer Popping Generation IV Glitches • Battle glitches • Overworld glitches Acid rain • GTS glitches • Pomeg glitch • Rage glitch Surf glitch • Tweaking • Pal Park Retire glitch Generation V Glitches • Battle glitches • Overworld glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Frozen Zoroark glitch • Sky Drop glitch Generation VI Glitches • Battle glitches • Overworld glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Lumiose City save glitch • Symbiosis Eject Button glitch • Toxic sure-hit glitch Generation VII Glitches • Battle glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Toxic sure-hit glitch • Rollout storage glitch Generation VIII Glitches Charge Beam additional effect chance glitch • Charge move replacement glitch • Choice item lock glitch Toxic sure-hit glitch • Rollout storage glitch • Party item offset glitch Generation IX Glitches Glitch effects Game freeze • Glitch battle • Glitch song Gen I only: Glitch screen • TMTRAINER effect • Inverted sprite Gen II only: Glitch dimension Lists Glitches (GO • Mystery Dungeon • TCG GB • Spin-off) Glitch Pokémon (Gen I • Gen II • Gen III • Gen IV • Gen V • Gen VI • Gen VII • Gen VIII) Glitch moves (Gen I) • Glitch types (Gen I • Gen II)

This article is part of Project GlitchDex, a Bulbapedia project that aims to write comprehensive articles on glitches in the Pokémon games.