TheZZAZZGlitch
Pokemon Yellow: 4 4s true cry
updated
Chapter timestamps, to avoid Google putting their autogenerated bullcrap in
0:00 Intro
0:07 Completing the Dex without leaving Pallet Town
4:54 CFC4 freeze equivalent in Yellow
6:29 Number 152 seen but nothing caught crash
7:13 Bicycle music transition glitches
10:24 Memory corruption caused by glitch encounters in GS
11:20 Correction on STOP opcode
11:54 Meta stuff
All event-related links in user messages transcribed:
docs.google.com/spreadsheets/d/1Bco2q7_PMtXr4MOYt-Zv1gIrjFQUS0NKJTDtphYnU
https://eldred.fr/fools2022
https://blog.muzuwi.dev/posts/2022/04/10/fools2022
https://s.tranck.ovh/zLoa-kgL
https://s.tranck.ovh/gLIQjw4A
gitlab.com/vriska/fools2022
github.com/Kuruyia/zzazz2022
github.com/Darkshadows9/TheZZAZZGlitch2022Event
bit.ly/3LTaA7t
github.com/EuniverseCat/CTF-Writeups/tree/main/ZZAZZ/2022
youtube.com/watch?v=pvj38BqPoq0
Save file download and instructions:
zzazzdzz.github.io/fools2022
thezzazzglitch.itch.io/fools2022
All event-related links in user messages transcribed:
https://s.stranck.ovh/Y8mRtnTZ
github.com/Darkshadows9/TheZZAZZGlitch2021Bruterforcer
github.com/Muzuwi/fools21
Check out this post for more information:
zzazzdzz.github.io/fools2021
Explanation of the "Missingno. is trying to learn" effect:
archives.glitchcity.info/forums/board-107/thread-7518/page-0.html#msg200772
Truecrycoin miner (Windows only):
Install Python 3 for Windows.
Download truecrycoins.zip from sites.google.com/site/thezzazzglitch
Unzip somewhere with write access.
Get a US Pokémon Yellow ROM and save it inside the "helpers" directory as "yellow.gbc".
Run miner.py.
(This is definitely not a low-effort attempt to keep the channel alive.)
In order to make the game ignore all map connections, patch RO25:6877 (CheckTileEvent+0x0003) to 0x18 (hex edit the ROM and change byte at offset $96877 to 0x18).
About out of bounds in Gen I games: youtube.com/watch?v=xuEsiyyYwVk
PMD funky password generator: pastebin.com/raw/uhxw4hmh
(run it on: syphist.com/pmd/rt/wondermail.html)
ALL EVENT-RELATED LINKS TRANSCRIBED:
pastebin.com/rLQuSrWd https://eldred.fr/fools2019 github.com/Darkshadows9/TheZZAZZGlitch2019Event pastebin.com/KNBLRwGD imgur.com/a/MEo4W7c docs.google.com/spreadsheets/d/1-WcI9AK14uL-ZYaY95its6kDMk2hb_MuJ2c6fOHfFeg github.com/Muzuwi/fools19 thezzazzglitch.fandom.com
zzazzdzz.github.io/fools2019
About the Pokémon Gen I A Button Challenge:
docs.google.com/document/d/1L8-BrZAM4kdx_DfRs71l1Kk7P5nrszDqOBu-_Kf5bxg/edit?usp=sharing
The current Gen I ABC route:
docs.google.com/spreadsheets/d/14l8fTLXg6jnhCLQ6ZBKSl1wBb1nFEKEN4XpwQoWeIzs/edit?usp=sharing
Previous ABC video (44x A presses, almost): youtube.com/watch?v=XY5Yt-nYKGs
About half A presses:
The half A press notation is a special system used when counting A presses in segmented runs. If a specific segment of the run is started with the A button already held, such A press is counted as a "half A press". This is because in a complete playthrough, the half A press would just be held out and continued from an A press in an earlier segment, and it wouldn't necessitate pressing the A button. So the half A press is just a continuation of an A press that was performed earlier in the run. You can watch this video for a more detailed explanation (or you don't have to, because you've probably watched it already): youtube.com/watch?v=kpk2tdsPh0A&t=35s
Music from intro: The Happy Troll, by D1ofAquavibe
youtube.com/watch?v=UHTFCZgm6HU
PoC exploits + technical writeup: sites.google.com/site/thezzazzglitch/home/vba_elfexploit.zip
The April Fools video: youtube.com/watch?v=pvj38BqPoq0
All the event-related links from the video:
pastebin.com/jqzrNaw5
imgur.com/a/yErS8
docs.google.com/spreadsheets/d/1ENWGaJbHHkGdlujaCLvnzztIhA2pQUvFmcTN-ipwhIo/edit?usp=sharing
github.com/Darkshadows9/TheZZAZZGlitch2018Event
pastebin.com/pQhTWTmf
pastebin.com/Y6Yb9X4a
Download the save file here:
http://167.99.192.164:12709/static/fools2018/
Previous videos related to 4 4:
youtube.com/watch?v=1dQq6_xa8-U
youtube.com/watch?v=NAeswVNsfns
youtube.com/watch?v=Op0jFsZP5Q8
The Lua script:
sites.google.com/site/thezzazzglitch/home/techno.lua?attredirects=0&d=1
Raw, clean EXE for the demo:
sites.google.com/site/thezzazzglitch/home/techno.exe.zip?attredirects=0&d=1
Route 18 step counter map: https://i.imgur.com/WjJN8HA.png
TheZZAZZGlitch's memory editor:
Bytes: pastebin.com/raw/Lca1Bxn0
Code: pastebin.com/raw/yTWnbPMw (note: it's very messy)
My GCL posts about invalid sound banks:
http://forums.glitchcity.info/index.php?topic=7518.msg200772.html#msg200772
http://forums.glitchcity.info/index.php?topic=7538.msg200773#msg200773
The OR/AS remix of the SM64 File Select theme was created by bauerklos music@YT. Thank you for bringing us this high quality video game rip!
youtube.com/watch?v=mBpTBH5P9_A
About the Pokémon Gen I A Button Challenge:
docs.google.com/document/d/1L8-BrZAM4kdx_DfRs71l1Kk7P5nrszDqOBu-_Kf5bxg/edit?usp=sharing
The current Gen I ABC route:
docs.google.com/spreadsheets/d/14l8fTLXg6jnhCLQ6ZBKSl1wBb1nFEKEN4XpwQoWeIzs/edit?usp=sharing
Previous ABC video (47x A presses): youtube.com/watch?v=EGKiDywDjew
About half A presses:
The half A press notation is a special system used when counting A presses in segmented runs. If a specific segment of the run is started with the A button already held, such A press is counted as a "half A press". This is because in a complete playthrough, the half A press would just be held out and continued from an A press in an earlier segment, and it wouldn't necessitate pressing the A button. So the half A press is just a continuation of an A press that was performed earlier in the run. You can watch this video for a more detailed explanation (or you don't have to, because you've probably watched it already): youtube.com/watch?v=kpk2tdsPh0A&t=35s
On double/triple/quadruple Super Glitch corruptions:
youtube.com/watch?v=Q8zcf2qQo6w
RBMemViewer:
github.com/zzazzdzz/rbmemviewer
(To download the precompiled binaries, check the bin directory.)
About the Pokémon Gen I A Button Challenge:
docs.google.com/document/d/1L8-BrZAM4kdx_DfRs71l1Kk7P5nrszDqOBu-_Kf5bxg/edit?usp=sharing
The current Gen I ABC route:
docs.google.com/spreadsheets/d/14l8fTLXg6jnhCLQ6ZBKSl1wBb1nFEKEN4XpwQoWeIzs/edit?usp=sharing
The previous route (59x A presses):
youtube.com/watch?v=t_c302Zdki4
About half A presses:
The half A press notation is a special system used when counting A presses in segmented runs. If a specific segment of the run is started with the A button already held, such A press is counted as a "half A press". This is because in a complete playthrough, the half A press would just be held out and continued from an A press in an earlier segment, and it wouldn't necessitate pressing the A button. So the half A press is just a continuation of an A press that was performed earlier in the run. You can watch this video for a more detailed explanation (or you don't have to, because you've probably watched it already): youtube.com/watch?v=kpk2tdsPh0A&t=35s
The high quality rip of the Oak's Laboratory theme was created and provided to me by one of my viewers. Thank you!
Full version: youtube.com/watch?v=Tj0zAmqrvHg
The author's channel: youtube.com/channel/UCfTqsRgs3ifYw0SK0PB6MUQ
The April Fools video: youtube.com/watch?v=ytychC3RpIQ
Community projects:
Wack0's missingno.sav Game Boy reversing challenge writeup:
gist.github.com/Wack0/1a84651e7e7e0c6f7d5fb5888e361123
kenoph's keygen:
pastebin.com/PfvWt7w1
NieDzejkob's full documented disassembly of the save ('missingno.sav reverse-engineered'):
pastebin.com/ykXv6ajC
ISSOtm's web based password generator:
issotm.github.io/pokexploits/fools2017/keygen.html
8F makes everything possible!
For people that say this was uploaded a day too early: Timezones are apparently a thing.
Download the save file here!
zzazzdzz.github.io/fools2017
You ARE supposed to use Gameshark and/or memory editing.
TROUBLESHOOTING:
Load the save in English Pokemon Blue, no exceptions! (won't work in Red/Yellow)
Use a good emulator with Echo RAM support (just don't use old versions of VBA)
(The static part of the service is hosted with Github Sites, and I used my friend's server space to host the backend database separately. Hopefully the highscore list will survive the load this year!)
The event ends on Wednesday (April 5th) 12:00 GMT.
The high quality rip of the G/S/C Game Corner/Lucky Channel theme was brought to you by one and only SiIvaGunner:
youtube.com/watch?v=6vQ71voOb-Q
GCL thread: http://forums.glitchcity.info/index.php?topic=7722.msg203355
Item list for the "game reboot" proof of concept:
8F
Any item
TM43 x22
Moon Stone x1
Master Ball x147
Antidote x121
Escape Rope x176
Fire Stone x250
Parlyz Heal x21
Guard Spec. x32
TM45 x175
Great Ball x111
Carbos x1
TM33 xAny
Byte sequences for other setups. Use any generic 8F/ws m RAM writer to get the byte sequences somewhere into memory, then execute them. An example setup for this can be seen in this video: youtube.com/watch?v=D3EvpRHL_vk
Force boot game in GB mode:
F3 16 0B 01 FF FF 0B 79 B0 20 FB 15 20 F5 C3 00
01
Force boot game in GBC mode:
F3 16 0B 01 FF FF 0B 79 B0 20 FB 15 20 F5 3E 11
C3 00 01
Infinite Master Balls in Pokemon Crystal:
F3 16 0B 01 FF FF 0B 79 B0 20 FB 15 20 F5 3E 0A
EA 00 00 AF EA 00 40 3E 01 EA E2 AB EA E4 AB 3E
11 C3 00 01
SML2 credits warp:
F3 16 0B 01 FF FF 0B 79 B0 20 FB 15 20 F5 21 00
D0 11 E5 01 0E FF 1A 22 13 0D 20 FA AF EA 30 D0
21 37 D0 3E 3E 22 3E 01 22 3E EA 22 3E D5 22 3E
A2 22 3E C3 22 3E 1C 22 3E 02 22 21 E0 D0 3E 21
22 AF 22 3E D1 22 3E 01 22 AF 22 3E 1F 22 3E AF
22 3E 22 22 3E 0B 22 3E 79 22 3E B0 22 3E 20 22
3E F9 22 3E C3 22 AF 22 3E D0 22 C3 E0 D0
First, run SML2 and turn it off at the title screen (this is to set the SRAM data to non-crashing values).
Afterwards run the above code with 8F or similar item, then swap the cartridges. SML2 will boot to a white screen - press Start and go to any stage to trigger the credits.
ASM code for the infinite Master Balls setup:
http://pastebin.com/raw/N5BLMdmg
ASM code for the SML2 credits warp setup:
http://pastebin.com/raw/FyQX676d
The any% NSC speedrunner community brought us Ditto strats - a new route that completely drops inventory underflow in favor of Super Glitch corruptions. This eliminates the need of heavy inventory management, which consumed a substantial amount of A presses in my previous A Button Challenge attempt. Let's attempt the Gen I ABC yet again and see if the new strategy will improve our previous score.
About the Pokémon Gen I A Button Challenge:
docs.google.com/document/d/1L8-BrZAM4kdx_DfRs71l1Kk7P5nrszDqOBu-_Kf5bxg/edit?usp=sharing
The current Gen I ABC route:
docs.google.com/spreadsheets/d/14l8fTLXg6jnhCLQ6ZBKSl1wBb1nFEKEN4XpwQoWeIzs/edit?usp=sharing
My previous route (69x A presses):
youtube.com/watch?v=NoB1Z0QBLB4
About half A presses:
The half A press notation is a special system used when counting A presses in segmented runs. If a specific segment of the run is started with the A button already held, such A press is counted as a "half A press". This is because in a complete playthrough, the half A press would just be held out and continued from an A press in an earlier segment, and it wouldn't necessitate pressing the A button. So the half A press is just a continuation of an A press that was performed earlier in the run. You can watch this video for a more detailed explanation (or you don't have to, because you've probably watched it already): youtube.com/watch?v=kpk2tdsPh0A&t=35s
Movie (.BKM, Bizhawk 1.11.6):
sites.google.com/site/thezzazzglitch/home/a-button-challenge-movies/DittoStrats59xA.bkm?attredirects=0&d=1
The high quality rip of the Oak's Laboratory theme was created and provided to me by one of my viewers. Thank you!
Full version: youtube.com/watch?v=Tj0zAmqrvHg
The author's channel: youtube.com/channel/UCfTqsRgs3ifYw0SK0PB6MUQ
Full-sized map of OOB Pallet Town:
sites.google.com/site/thezzazzglitch/home/OOB_PalletTown.png
Full-sized map of OOB Sea Route 20:
sites.google.com/site/thezzazzglitch/home/OOB_SeaRoute20.png
To patch the game to ignore any map connections change the three following bytes at offset $07BA to 0xC3, 0xC6, 0x08. This hack only works on English Red/Blue.
The OOB diagram in full resolution:
sites.google.com/site/thezzazzglitch/home/OOB_Diagram.png
More about the "B1F" item: youtube.com/watch?v=JEEB41Lz59c :: youtube.com/watch?v=_-wVsN8rVks
Don't use VBA. Use mGBA or VBA-M instead.
(Read the description for more information)
DESCRIPTION FOR INFOSEC PEOPLE:
Just download the PoC+advisory here: sites.google.com/site/thezzazzglitch/home/VBA18_CodeExec.zip
DESCRIPTION FOR EVERYONE ELSE:
This is an arbitrary code execution vulnerability in the old and discontinued VBA emulator, including VBA-RR.
It's possible to run untrusted code on the computer by loading a specially crafted XPC cheatlist. You can imagine someone using this vulnerability to create a cheatlist that installs a virus, then giving it to you, disguised as an 'awesome cheat code for level 255 Arceus in Red/Blue'.
Remember how in the Pokémon games one could trigger a buffer overflow bug to execute his own code on the console? This is exactly the same thing, but on emulator level. An attacker can create a custom cheatlist that does whatever they want on your computer. In the video, I make it run calc.exe, because that's how I roll.
If you want to test it for yourself, here's an example exploit for VBA 1.8.0, along with a PDF explaining the technical side of the vulnerability: sites.google.com/site/thezzazzglitch/home/VBA18_CodeExec.zip
Additionally, I have received a lot of opinions that this feature is rarely used, so the vulnerability is of low severity. I don't believe that. Let's say I do a glitch video that presents an Arceus hack in Red/Blue, and I say you can try it yourself by running an EXE file. Not many people would try it, I assure you. Now, I instead tell you to try an XPC file, and tell you to import it through the 'Import Gameshark Code file' option. Works best on VBA. Now it sounds a lot better - it's a Gameshark code list, it can't be dangerous. Would you do it?
Code execution is always dangerous, because it breaks the basic security principle of "only executables can do anything to your computer".
GCL thread with 8F 'test-scripts': http://forums.glitchcity.info/index.php?topic=7559
Gen I is so awesome, even having more than 99 items can cause it to break. Here's a detailed analysis on the 99 item stack glitch, which turned out to be more useful and easy to pull off than everyone originally expected.
This glitch is actually 2 years old, but back then, it didn't get too much attention. You can visit these links for more technical information about how the glitch works:
http://forums.glitchcity.info/index.php?topic=6953
youtube.com/watch?v=R5o_t_ddsy0
The "warp with Master Balls" effect was also previously discovered, but was only performed using the Yami Shop glitch:
youtube.com/watch?v=6PxBIzRY4eg
Given that the glitch does not require actually buying the items in a mart, all of the effects in the video can be caused as early as you can get a stack of 99 items of a proper kind (so possibly even in Viridian City).
This is an unpolished TAS, made only to satisfy my curiosity. I'm not planning to continue the ABC challenge with much dedication, unless people want me to.
Movie (.BKM, Bizhawk 1.11.6):
sites.google.com/site/thezzazzglitch/home/PokemonBlue69xA.bkm
Lua script used for RNG frame searches:
sites.google.com/site/thezzazzglitch/home/RNG_Beast.lua
About half A presses:
The half A press notation is a special system used when counting A presses in segmented runs. If a specific segment of the run is started with the A button already held, such A press is counted as a "half A press". This is because in a complete playthrough, the half A press would just be held out and continued from an A press in an earlier segment, and it wouldn't necessitate pressing the A button. So the half A press is just a continuation of an A press that was performed earlier in the run. You can watch this video for a more detailed explanation (or you don't have to, because you've probably watched it already): youtube.com/watch?v=kpk2tdsPh0A&t=35s
There are currently no cases where holding A is important in Pokémon games. However, it might become useful in any time, and thus, the half A press notation is mentioned and allowed in advance.
My previous video about B1F: youtube.com/watch?v=JEEB41Lz59c
Also, my previous video about glitch trainer 0xFC and its first roster: youtube.com/watch?v=wjXQqZTYJco
All of the code used in this video can be downloaded at: sites.google.com/site/thezzazzglitch/home/SRAM_Corruption_Emulator.zip
Moar details: http://forums.glitchcity.info/index.php/topic,7490.msg200311.html#msg200311
Glitch moves have glitch animations. Some glitch animations point to RAM, some point to save data. What could go wrong?
"?????????? used t". The universe breaks.
Item lists:
Bootstrap (animation script):
Item $D103 x3860
Item $FF0E x2048
Warp to any map (Birth Island is ID 0x1A3A):
Item $20[lower byte of ID] x512
Item $30[higher byte of ID] x18689
Item $6008 x48624
Item $3C5A x518
Set any memory address to anything:
Item $[byte to write]20 x18689
Item $7008 x48624
Item $[address, 3rd byte][address, 4th byte] x$[address, 1st byte][address, 2nd byte]
Full high score list: 7ca416125463a781eac798865c1b8430444d4ca7.googledrive.com/host/0B_s2K4TDOCSTc0pycmhCZlM5QzQ/index.htm
Current link (obviously high score list doesn't work anymore):
sites.google.com/site/thezzazzglitch/home/MissingnoEXETotallyNotAVirusTrustMeM9.zip
Older links:
http://zzazz.ml/zzazz/fools2016/
(mirror: http://s000.tinyupload.com/index.php?file_id=17605576689048736431)
Who decided that this game is ready for release, anyway?
The script in question: http://pastebin.com/raw.php?i=umfUukHU
Obviously it's not production-quality code. For the script to work correctly, Hearthstone must be set to run in windowed mode, with a non-standard resolution of 1026x630. Requires PyWin32 and Python 3.
Control the application through hotkeys: Alt+R starts sending mouse inputs, Alt+P ends the turn and stops sending mouse inputs.
(Twitch Plays Hearthstone anyone?)
Item list (starting from box item 15):
Any Item x2
Lemonade x10
Ultra Ball x4
Potion x10
X Speed x2
Awakening x99
Parlyz Heal x81
X Accuracy x1
Fresh Water x2
Soda Pop x2
TM02 x12
Guard Spec. x2
We can use Missingno. Hall of Fame data corruption just to see some glitchy wonderful things, or cleverly manipulate the Hall of Fame data to execute arbitrary code. The choice is yours.