Why the Kingdras and ?'s in the Bad Clone / Celebi glitch
41When we open a Pokemon box, the names of the Pokemon inside pass through the buffer at address D073. But the bad clone's name is just a bunch of 0x00 without any terminator character, so when its name is later read from that buffer, the game will keep on reading bytes as if they were characters until a random 0x50 byte is found, acting as the terminator character.
Knowing this, there is a very little routine that actually makes the whole trick possible, and that's the routine at 0:1383 in Pokemon Crystal. When a char is interpreted, it's first analyzed in case we are dealing with an identifier with an special function such as a new line, the 'POKÉ' symbol, or just a 0x00. If it's 0x00, the game is made to jump to 0:1383.
Function1383::
ld a, $e6
ld [hli], a
call PrintLetterDelay
jp NextChar
Function1383 writes 0xE6 -which is the '?' character- into the address pointed to by register hl, and then we move on the next char. Register hl happens to point to one tile in the tilemap (C4A0 - C607). The first tile that gets written is the tile that corresponds to the first letter of the bad clone's name (C599) but it will keep on corrupting the remaining tiles of the tilemap with '?', and eventually other ram addresses with 0xE6 as well. So, ironically what looks like some sort of error handling routine that converts unknown characters 0x00 into the '?' symbol, is what makes the bad clone glitch possible.
So we now where the all the '?' come from. But what about the Kingdras? The routine at 38:6DEF reads the pokedex number of the different Pokemon in the box from RAM address C800 + 3*PkmnPos. While C800 is also the start of the Overworld map it seems to store the species of the Pokemon in the box as well. Anywho, the species of FF/CANCEL necessarily has to be located between C800 and around C840 depending on the number of pokemon stored, and, for example, in one of my tests, I saw addresses up to C863 get corrupted. Thus, we have just had our Pokemon FF/CANCEL become a withdrawable E6/KINGDRA!
There is also a simple explanation to why the bad clone trick doesn't work unless you save and reset the game boy in front of the PC and perform the trick right away. There are a total of 4 string buffers, and the buffer at D073 is the first one, meaning that if any of the other 3 buffers has been used before, there will be a terminator character in it, stopping the corruption of 0xE6 bytes too early.