Duration: 4:16

548 views

39

By locking the memory address CEAB with arbitrary code execution, you can trick the game into thinking you're nicknaming a different box (including glitch boxes 15-256). This allows you to corrupt up to eight memory addresses at a time based on the characters you use for the box name, plus a ninth with 0x50 (end box name).

This setup is for wrong pocket TM17 with Quagsire holding Lucky Egg w/ Attract as the first move in the second slot.

The following TM/HM quantities spell out this OAM DMA hjiacking code.

TM01 x33
TM02 x130
TM03 x255
TM04 x62
TM05 x213
TM06 x50
TM07 x 62
TM08 x 139
TM09 x 50
TM10 x 62
TM11 x 195
TM12 x 50
TM13 x 201
TM14 x 62
TM15 x XX (Replace XX with desired box number)
TM16 x 234
TM17 x 171
TM18 x 206
TM19 x 201

(21 82 FF 3E D5 32 3E 8B 32 3E C3 32 C9 3E XX EA AB CE C9)

Examples for XX,

TM15 x41 lets you corrupt DA27-DA2F (party Pokémon 5 species (byte 1) through to party Pokémon 1's moves). In this video, 559 gives us Celebi, Celebi, END, XX9 gives us Mew, Mew, END, AA9 gives us Tauros, Tauros, END)

TM15 x 93 lets you corrupt the last 9 own bytes in the Pokédex (so a total of 72 of the last Pokédex entries), "99999999(END)" will fill those except DC03 will be replaced with 0x50 (not own Lugia, Ho-Oh, Celebi, 252, 254, 000), own 253, 255 so if you had a full Pokédex it will say 250 (even though it's missing 3 valid Pokémon, because you also own 2 glitch Pokémon now).

TM15 x 18 lets you corrupt your room decorations at New Bark Town. Here we just rename the box to "AAAAAAAA(END)", heavily corrupting the room and leaving us with no way out, because the door back downstairs was replaced.