Why MissingNo Multiplies Items!
Vložit
- čas přidán 5. 09. 2024
- In this part two we investigate how encountering a glitch pokemon will cause the 6th item to multiply. For this we are using Ghidra and SameBoy to debug and reverse engineer the code.
Part 1: • Researching MissingNo ...
Want to understand how to catch Mew? • Exploring the Mew Glitch
Checkout the whole GameBoy hacking playlist with stacksmashing: • Game Boy Hacking
PwnAdventure Game Hacking Series: • Pwn Adventure 3: Pwnie...
GhidraBoy: github.com/Gek...
SameBoy: github.com/LIJ...
=[ 🔴 Stuff I use ]=
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-...
→ Camera#1 for streaming:* geni.us/sony-c...
→ Lens for streaming:* geni.us/sony-l...
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-k...
→ Old Microphone:* geni.us/mic-at...
US Store Front:* www.amazon.com...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
The fact, that we're in 2020 and people are still talking about Missingno makes me very happy
Missingno best pokemon,,,
Yeet, I'm playing on lakka pokemon red to get missingno, I got fly and all, I need surf and the island and I will get missingno
Quarantine my boi. Quarantine
Not only are we still talking about it, were still learning things about it
2021
this is beautiful. not only are you clever for coming to the conclusion you did, but very intelligent for your ability to communicate the behavior of the bug to an audience that knows way less about it than you do.
Literally this looked like magic to me, I hardly understood a thing but I still feel enlightened 😂
that's the reason I love his channel.
I like the "how you could've found it yourself" approach as it teaches beginners how to get started in reverse engineering / research! Great Video!
Every video is like watching a detective series.
This. I think it's on purpose, and he makes it work sooo well.
Ya
as my grandpa always said :always check for array out of bound
oh gramps
so.. this is basically a buffer overflow?
@@RussellTeapot yes but the conditions was not catched by anything !!! usually it will be stopped at runtime and caught there but a buffer overflow is wen it doesn't get caught by anything and it roams the memory freely
As a fluent Z80 programmer, I could follow along perfectly with the disassembly, but you still gave some insights I could not have gotten, thank you very much. This was definitely worth the 20 minute watch.
NERD
I remember hearing that the reason those right-side tiles spawn land pokemon is because the game only uses the bottom-left 8x8 graphics tile for the "is this water?" check
This is exactly correct and explains two other things:
1. There are patches of grass in veridian forest which speedrunners use all the time because no pokemon spawn there. This is because certain grass tiles have a different sprite in the bottom left for cosmetic reasons, but it is not read as a grass tile, so no pokemon spawn.
2. In some internationalized versions of the game, both checks are done on the same tile, so the missingno glitch is impossible in those versions.
@@Double-Negative you can get missingno in every version of the game, it's just a different process.
that is exactly why czcams.com/video/8PILbqZqaS4/video.html
Don't know if you plan on continuing this series but the "beat the game in 3 minutes" glitch is also pretty interesting from a technical standpoint :-)
You have to wonder about the speedrun community sometimes when they allow something that's quite literally hacking the game to get to the end to count as a valid run e.e
@@Keldor314 because it can be done without modification to the physical game... can be done by hand by only playing the game
@@Keldor314 overflowing the inventory through ACE or save corruption is within the bounds of the game, which is allowed. It takes a ton of skill and precision (navigating the inventory when it's overflowed requires you press A+B to scroll, it's extremely tight)
@@Keldor314 it almost doesn't really. There's no point trying to beat a time of 00:00, so it's not really run
You're a very smart guy and very informative and great personality, i enjoy your videos.
that's why I really enjoy his vids! :D
Same
Why the hell is he smart because he has experience in something? According to you everyone is smart who knows this stuff o.O. And why does he have "great personality" because of his knowledge? Your comment makes 0 sense.
@@aaggroberlin19 wow you went through 11 months of comments to get offended at someone random complementing another random person. I'm sorry that people can't have an interesting and fun way of providing content resulting in a good personality as well as being having the ability to hone his skills and knowledge on technology to be able to describe in detail to everyone that doesn't know how or why something is happening. I am really glad you are here to show us that you are probably the smartest man alive. Knowing everything possible that the world has to offer before even hearing about it because you're so smart. I apologize for hurting your feelings for me supporting another pea brained human like myself. We praise you all mighty watermelon brain. Show us the way, inform us with your superior brain power and knowledge. P.s. get a life and stop trying to take other people down with you, humble yourself and maybe you can provide the world some small amount of hope and further help the world more towards a better future.
@@Modslover 🤨
I believe you were unable to rename variables because even though you disassembled the data, it was set as an undefined function. If you selected the address of the start of the function in ghidra and press f, that will define the function. After that you should be able to rename the function, variables, etc.
this is correct!
yes. the grayed out box in the decompiler view means that a function was not defined.
As a pokemon fan and a software developer I must say you are an absolute madman and so admirable for exactly that, thanks for doing this!
I REALLY like that you show that you're not super knowledgeable about everything, and your process in figuring it out. Very fun to watch/listen.
This made me think back to the first game I had made in C++ that had this exact problem and made the game do crazy stuff. Very cool to watch.
I have absolutely no idea whats going on but it makes sense to me idk.
Exactly! Cant understand a single thing he just said but I love all of it
@@charalampospapaioannou2371 I do
not understand it either but I still enjoy this. :)
This Is how I feel watching NileRed (chemistry) as a programmer.
The first thing I think of when I see H & L register and then a HL load instruction is that H is the high part of the address register and L is the low part of the register for the jump
Ecountered pokemon are based on pokemons pokedex id. And missingno points to sone crap that mods items... Thats what i think. I mean, i know abt dat from other vids.
Totally agree with your points about seemingly "pointless" research. I first used Cheat Engine by following a tutorial for how to use it with the game Dink Smallwood. That made me feel like a badass programmer, so I continued on to learn all kinds of other tech stuff like Python, Arduino, Raspberry Pi, and more.
You are the first person I’ve seen actually go into the code to explain the MissingNo glitch. I hadn’t even thought about why it duplicates items, I just knew it did. Keep up the good work!
Hearing you being satisfied with your findings makes me satisfied as well!
7:58 The debuggers on Windows work the same way.
Set a hardware breakpoint on memory access/write, causes the target be paused AFTER the access/write instruction did something to that memory
(no IP register can be traced, so the debugger cannot determine what instruction is gonna do something to what memory without dynamic analysis).
Just going to post a few more details here, don't mind me:
JR LAB_rom3__76a0 is an unconditional relative jump.
ADD L doesn't modify L. It adds L to A. The LD L, A does modify L, though.
Yes, SRL is a logical shift right.
Used to use this hack all the time as a kid but with this video all of it is so beautiful. If only one thing had not gone wrong it would have never happened. Seems magical.
Let me paraphrase to you what one Vinesauce guy's dad once said to him: It IS magic.
There're so many glitches related to the workaround of hardware limitations back then, there's rarely such kind of bug now.
I love how in depth you went into the reasons the glitch effects everything. A lot of people just say "it changes these values when you talk to the old man" and didnt go into the things you can do with for instance the safari zone. I wish I knew about that years ago, would have made getting a Dratini waaaaay easier lol
I like how everyone is doing game boy/Pokemon/missingno videos rn, you, stacksmashing and retro game mechanics explained
@3:30 OMG I literally had to pause the video, I was laughing so hard. Can totally relate to that moment on so many levels - both in game and in debugging. 😆
I wish I could thumbs up this video multiple times. That little rant about playful research is really important for people to understand! If you're learning something, it's not a waste of time!
Totally agree!
I don’t really know much with assembly (much less disassembling code), but you did a fantastic job explaining it, and the end conclusion makes sense.
For anybody else who has the source code for Pokémon gen 1 and are following along: You can find the code shown at 11:18 in Tools.dmg at around line 3925. It's in the "bit_control" routine.
The code at 13:58 seems to be in FIGHT.DMG, around line 8629.
Comment on 20:14: Yes, this is correct. If you look at the call instruction right before the call to the "setNthBit" routine (called "bit_control" internally), it's calling the routine that fetches Pokémon IDs. Again, if you have the source, you can find this routine (get_order_no) in ZUKAN.DMG (zukan = "picture book", or Pokédex, as it as later named) at around line 1220. It fetches the Pokémon ID from the table in monsdata/order.dat. Here, missingno's ID is 0x00, and as you said, all IDs found in the order table are decremented before they're used.
Loved the narrative and editing. Great skills of storytelling =)
This is awesome work. Using a scientific approach to game hacking, you figured out exactly why a bug occurs.
I didnt know about the memory bank system, thats very cool.
Also high five to Ghidra for making hobbyist's lives easier
I love that both of you are doing this together. Collabs like this of this nature around similar subject need to happen more because the amount of content coming out of you two is great.
Wow, I got nerd chills when listen to this great explaintion! Thank you!
Hey, would you like to do a follow up, that shows why the Save data gets corupted, when catching a missingno and saving the game.
But doesn't only the hall of fame get corrupted for MissingNo.?
Well, for now I can explain why the save data gets corrupted - but not as detailed as this video.
Basically, have you noticed that Missingno's sprite is not a square? This is because it has invalid dimensions.
When decompressing the sprite, the game expects that the sprite be a maximum of 7x7 tiles - but Missingno is larger. (11xsomething I believe.) This causes it to do a similar out-of-bounds array access which attempts to decompress the Hall of Fame data. But that is not compressed, so you just get gibberish.
Edit: There's also a glitch Pokemon called "4 4" that has a sprite so large it decompresses into the RAM so far that it corrupts the sound system, which corrupts even more things. The game barely survives at that point (in fact, it usually crashes if not for special conditions)
There a LOT of interesting glitches in this game. Like Super Glitch (yes, it's actually called that!), various glitch textboxes, a lot of interesting glitch items (there's one that makes the screen blank for example), the out-of-bounds is interesting, I could go on like this for a LOOONG time.
Also why capturing missingo and putting it in your bank causes issues? Based on my memory from around 20 years ago.
@@TheRen0gade It doesn't actually have to; it may've been that you've already caught a Cubone before and needed to put it in for it to register.
Hey, at 01:16 there's on the screen that 0xff = 256, but 0xff = 255, just wanted to point that out :)
Some people are gonna eat this up. I'm reminded why I hate assembly.
Great video and good job explaining it. It's a bit hard to follow at times because I'm not up to snuff with pointers, memory, addresses and their concepts.
Always good to see people with a lots of patience and competence.
I'm tore between "this is awesome" and "how could you ever let this release unnoticed", but it's still a 25+ years old game so maybe not that odd... thanks for the insight, this was really interesting!
I have no knowledge of coding but I feel like I understood everything you said in both videos. I have no idea why but you just made so much sense.
I really love videos like these even if I can barely understand them sometimes. But you do the best job at explaining without over-complicating things...
Also Gen 1's spaghetti code is amazing to dissect lol.
I'm impressed by the details you time and time you must have spent working on this video, thanks a lot for sharing it !
did he mention that he has never seen this assembly
You and StackSmashing breaking all this down is some of the most enjoyable content I've seen in a long time. Great analysis, thanks for making these!
IIRC the game will place the ending "1" into the item slot, essentially adding 128 items to item stacks that do not have 128+ items in them already. The glitch will not work on any item stack that is greater than 128, and using it on an item with a stack of 127 makes that item into a stack of 255. 255 also has the same properties as the CANCEL button which lead to some of the old Pokemon Blue any% NSC routes before easy ace with maps was discovered.
The conclusion at the end is very satisfying and pleasing! Great video!
Absolutely fantastic video. So satisfying to be able to follow along with the *why* this historic bug does what it does. You've been slowly kindling my interest in picking apart software to learn about it. I loved picking apart electronics and some mechanical devices to learn how things work or some tricks I could use even if I didn't understand the whole device or what specific or odd components did. Now as my journey into learning to code is continuing, instead of having to pressure myself into committing far enough into a big project or building some arduino gizmo in order to actually get some coding practice in (now that I don't have any coding assignments and am strictly self teaching and using online tutorials), I can now get some practice and learn something by just casually fooling around! Even with games!
That's a beautiful bug, it's so involved and has so many steps; that's what old school programming was all about!
This is such an interesting approach! Although I am not much experienced with assembly (I have simply played with the basics in a CTF), this step-by-step process really helped show me both how to investigate glitches and understand what you were saying! Should the big reveal just have been given to me, I probably couldn't make out much of it!
Really fun series, I have thoroughly enjoyed these past videos of yours! Keep doing this amazing stuff, LO!
So just to add to this; arithmetic functions generally use the accumulation register (a) so that's why that add doesn't have , a there. Also, HL spans two registers; H and L, the gameboy has mainly 8-bit registers but also shares those to make 16-bit registers so it can do stuff with addresses.
Awesome video. Enjoyed this and the corresponding MissingNo Video very much. Your explanation is very detailed and comprehensive and you really cheer one up to try to do similar research on other bugs or just simple game logic in old games. As someone who once wrote a gameboy emulator for learning purposes I can only recommend your videos for everyone who wants to become more emerged with this awesome piece of hardware.
im genuinely happy when i see live's new video
I just discovered your channel even though i dont understand anything i still enjoy it
Awesome i was waiting for this video when i found the previous yesterday c:
same here
I just started learning 6502 assembly like a week ago and am amazed, on how much I could follow with the code xD
6502 and z80, especially a modified one to include 8088 instructions, are different chips, but ASM tends to be similar in appearance.
I've been fearing and neglecting starting for years and I am also amazed at how well I could follow
Awesome video!! I'm so happy the time I've been spending these past two months learning about Gameboy assembly has enabled me to understand much of this video. I would have been completely lost otherwise. Really great video, thanks!!
Its so cool that you are able to analyse these old games by looking at their memory allocation.. must have been a cool time as a gamedev back then
Summary at the end explains the missingno bug well. Great video!
You can configure your assembly listing window to show Ghidra's IR by clicking on that window's configuration, choosing PCode ops, and "enable field". The breakdown can help you figure out what the labeled mnemonics mean without resorting to a manual.
You can also right-click on the mnemonic and jump to the instruction specification in the processor manual included with Ghidra.
Loved this (and the previous) videos! Would love to see a similar one explaining the Super Mario Bros credits warp used in speedruns =P
I personally found a bug along time ago to give your pokemen unlimited hp. It could be used to further this research, if you're interested. And this bug has possibly never been released, until now. As I'm the one whobpersonally discovered this bug by pure accident back in grade 6. Though I'm not sure, this bug is probably already, but here it is; I can't remember exactly how to do it because it was like 2 decades ago, but I think the trick was a Lil sumthin like this. 1. You need to start by doing this same missing no glitch (as most of us know each save file gets its own randomly selected pokemen that can be a lvl that is over 100.) 2. Catch the bugged lvl pokemen. 3. Lvl the bugged pokemen to max lvl. (THIS IS WHERE EVERYONE THOUGHT THE GLITCHES STOPPED) 4. (this next part is the part I accidentally discovered) After steps 1-3 are done: trade the pokemen to a different game via the ol link cable, then trade it back. The pokemon will lose lots of lvls after the trades, but the hp will remain as if it didn't unlvl. 5. Lvl the pokemon back to max lvl then repeat step 4... Everytime you lvl then do the trade and trade back it allows you to infinitly?? Keep increasing the hp everytime steps 4+5 are repeated. I never knew this random bug I found 20 years ago could possibly be useful for awesome research like this my dude..
“The seventy tooth bit”
You have to admit our system is kinda bad, it should be standardized.
It is, and ordinal 72 is called seventy-second.
English is actually one of the simpler languages when it comes to ordinals, and number kinds in general. 1st, 2nd, 3rd, 4-20th, 21st, 22nd, 23rd, 24-30th, ...
@@animowany111 The seventy secondth bit
Just on a side note: Pokémon red/ blue had Pokémon from gen 2 (gold/ silver) in the Code but they were never really put in. No sprites etc. There is a list online that shows you every Pokémon that’s in the code and where it’s placed. Early on in the video, you said that you hit the value 135. That’s probably the actual Pokédex number (or shifted by one because of starting from zero) but it is a Pokémon that never made it into the game, so showing a missing no. I’m not a nerd in this coding stuff but I’m a nerd for Pokémon :D ps: most of these gen 2 Pokémon are above the index of 100 for some reason
The internal IDs are the order Pokemon were added to the game. Scrapped Pokemon IDs were blanked out with a OO, or missing number. Pokemon scrapped from Gen 1 were recycled for Gen 2, leading to them being in the data.
Oh boy. So far, my personal coding was some data organisation with Python and converting a few hundred text files into an Excel sheet. Still you made me (kind of) understand what was going on here. Pretty cool stuff! And pretty fascinating reverse engineering work.
17:28 "Seventy-twoth" :P
...Or is "Seventy-Tooth" a new Pokemon? :O
Seventy second
@@matthewboyd1834 You don't say!
@@germancubesolveryolo4524 forty four
Forty fourth
Clever analysis. I'd just assumed it was decoding the garbage sprite and cry data that resulted in the 6th item quantity being corrupted.
I understand the concept of it , but I don't understand all this programming stuff , but still I love that kind of videos Thank you :)
I'm a Java code architect. Recently, I've been working with systems that involve working with files containing raw data. This series has inspired me to jump into the ROM modding community. Keep up the excellent work 👍 Have any recommendations for those interested in studying assembly?
This video makes me really want to learn assembly... Thank you for that
It’s crazy I’m working on a project right now in school where we have to reconstruct a program from assembly. Very relevant and applicable stuff. Good work on finding out this bug and satisfying all of the people who wanted to know the reason behind all this madness’
So depending on your player name you can decide what valid pokemon shows up instead of MissingNo
Correct. This is also why Missingno. is so common because the default ASH name happens to contain the necessary letters to call one of its many IDs. With different names you can summon different Pokémon and at different levels, such as a lv 255 Mewtwo.
@Lilith does stuff Mew wasnt in Gen 1, Mewtwo was.
@@undead890
Mew also was!
@@undead890 Mew also was
This is also how you can unlock that strange Prof. Oak battle, by using one of the "Pk" or "Mn" symbols as the 7th letter of your name (iirc). Scykoh explained it a bit better in his final episode of Gen I glitch quest.
Pretty interesting! I wonder if you'll "tackle" some of the less well-known Glitch Pokemon! Nonetheless, thanks for uploading!
If you also want to read the assembly for the mentioned functions (in a commented and somewhat structured form), here are some links to PokeRed:
LoadEnemyMonData: (handles the pokemon encounter, calls the Flag function below)
github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/battle/core.asm#L6200
here's the code that handles the IndexToPokedex-conversion and set's the flag:
github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/battle/core.asm#L6337
IndexToPokedex:
github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/menu/pokedex.asm#L649
Flagging-Function (also takes in a 3rd input value, the B register, which contains clear, set or read)
github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/flag_action.asm#L1
predef seems to be the bank-switching function, which is structured as a macro (?) in Pokered:
github.com/pret/pokered/blob/6ba3765c5932996f5da6417ae703794ff10bb1cb/home/predef.asm
Thanks for these two great videos! I had a lot of fun watching and now reading the assembly.
The Game Boy (and Game Boy Color) uses an instruction-set that is mostly like the 8080 and z80. This family uses 8-bit registers (except PC and SP, which are 16-bit), but for some instructions you can use 16-bit pairs (AF, HL, ...)
This is so cool to see in action! If you didn't know, it's actually possible to duplicate TWO sets of items by replacing the already duped item with another item that has yet to have it's bit flipped during battle. When you catch missingno, that same function must be performed in the process of updating it's Pokedex entry, but instead of listing it as "seen", it gets listed as "caught". The game then forgets that you even saw missingno since the data for that would normally be referenced in the Pokedex data, which explains why this can be repeated multiple times through various wild encounters with missingno.
That's probably not 100% correct, but that's my educated guess :)
man I'm actually really glad for my computer organization and architecture class now. I actually understand what's going on for the most part
Stunned! You made this so interesting!
Thank you for your amazing work! I'm having lots of fun watching these videos!
I think you should check out Zelda Ocarina of Time related glitches, there are a ton of really interesting glitches like inventory manipulation or abusing cutscene pointers to warp to unintended locations.
Even a few months ago, they discovered how to execute arbitrary code and functions in the game to basically do anything they like.
I think it'd be really amazing if you took a look at this game!
Having done some SNES, N64, and PS2 ASM hacking in the past, this was an absolute joy. I audibly said... "Oh...!!" When you put together the pieces at the end. All of this time it was a simple out of bounds array, with the idea that they never intended to have 32 bytes for all possibilities of Pokemon. This was a fun mystery that you broke down. Hopefully it inspires others to follow your lead.
I was trying to find a good answer to this the other day! thanks for the upload
This is amazing. Hits right in the childhood
Because of this serie, I started looking at the Pokemon disassembly from Pokemon red (pokered on github) and I started to learn assembly for the GB. Gbz80 assembly.
My Brain crapped out at 16:00. But amazing video
You explain this very well, you lost me in parts, but I sort of understand what's going on. I lasted until around 18:00 before I couldn't follow anymore. GG
So one thing i remember, is if you got to the east side of seafoam islands coming from fuchsia city it does the same thing. While it does take longer to reach. It does work as well
I went down the right shore of the route south of Pallet Town and found a Raticate.
10:51 I think you weren't able to rename symbols because the function was undefined. You should be able to define a function in the disassembly window by right clicking the start of the function and clicking "Create Function" :-)
This was a lot of fun! Thank you!
Great video! I have always wondered why it was the 6th item when I found missingNo. Thanks guys!!
This was great! I know it's a while ago you did this, but I would LOVE more research-perspective game bug investigations. Perhaps you could consider doing something similar with the Ocarina of Time Wrong Warp bug? It's also pretty crazy.
It's always the array out of bounds that gets ya
Could you possible name yourself in the begin of the game to match the Mew ID and make it spawn instead of MissingNo?
I was hoping that he would check out the lookup table to solve exactly this scenario!
too bad this sort of glitch doesnt exist in newer versions, what a fun and silly way to get arceus to show up, like some sort of crazy stardew valley crossover :P
If memory serves that was the older method to get Mew before people discovered the equally wacky Delayed Encounter "technique".
Unfortunately the ID for Mew doesn't match any of the available letters. D gives Mewtwo though.
@@renakunisaki I stand corrected.
Fighting a certain Super Nerd on the glitched Route 8 (Lavender Town-Saffron City) of my German copy of Yellow causes the first item to be changed into a TM of Dragon Rage, IIRC, and to have an out of bounds inventory. It got glitched because I did the Mew glitch incorrectly and saved. It has glitched music, slower movement (I have to press A or B often there), crashes, etc. Sometimes I can't even reach the Super Nerd to do the glitch, since he's at the more unstable Saffron side. For his battle, the first one is normal but it does the battle again.
As always totally excellent videos ! Keep going !!!
It's such an elegant bug... Thanks for this extremely enjoyable explanation!
Nice luck I'm having. This got uploaded when I finished watching part 1!
Who here is old enough to have played Pokemon Red and Blue when it first came out and use the Missingno item duplication glitch to duplicate rare candies to level all of your pokemon to max level?
I played it, but European versions were patched :(
I don’t know anything about coding, or about pokemon... but this is fascinating
Epic videos my dude. You have just educated my inner child. Thank you
The old man glitch was incredibly strange and interesting to me as a child. I knew about game genie and understood that it changed the data of the game, so that wasn't mysterious or strange at all, it only got a bit fascinating when random codes sometimes would do unexpected things to the game. But talking to the old man, rewatching his tutorial, flying to some arbitrary yet specific locale, and then surfing, but only on the ledge, and then weird encounters would start, and somehow a single item slot would get multiplied? That was so frikkin weird. I'm not an expert of processors or programming at all, but I have a certain interest and I think it stems from that very glitch
First video I found of yours and insta subbed.
I like that after all of this desassembly you make me feel like a nerd knowing that arrays start at 0.
That border in the beginning made me think my screen was broken lol
Hello. I am currently reverse engineering and annotating minish cap in ghidra. These are some of the methods I use to analyze the program :)
Gb and gba use a lot of bitwise functions since space was so tight back then; bitfields are used all the time! It can be frustrating trying to understand all of the shifts ands and ors etc.
Does this mean that a second memory area is written to out of bounds when you actually catch a pokemon?
If you switch what item is in the sixth slot before catching missingno. the new item will also be duplicated. that might have something to do with what you're talking about.
It would be when you catch the missing no, but this should happen, yeah :D
Yes it does absolutely mean that. If I recall correctly, the supposed "caught" flag for Missingno is at the same location as the "seen" flag for Rhydon.
No wait, I think that was Cubone.
@@ilonachan It's Rydon if I remember. It has an internal index of hex 01 which makes sense.
My reasoning is as follows:
The "caught/seen" flags aren't based on internal IDs, but on Pokedex Numbers. That's why all Missingnos count as Entry 0, or 0xff (because unsigned byte). Rhydon has Pokedex Entry 112, or 0x6f, which lines up with the bit position, but look: Rhydon needs to be 0xD bytes after start of the "seen" table, and Missingno would have to be 0x1f bytes after start of the "caught" table. But the difference is 0x12, or 18 bytes, leaving room for 18*8=144 flags; not enough room for all ~152 Pokemon. So the "caught" table would be smaller than it has to be to hold flags for all Pokemon.
Cubone, on the other hand, has Entry 104, or 0x67. So it's 0xC bytes into the table, and 0x1f-0xC=0x13, one byte more than before. And that's enough space for the flag table.
tl;dr: If Missingno's flag overlaps that of Rhydon, we see that the "caught" table would be shorter than it actually has to be. Cubone, on the other hand, is a plausible candidate.