🐾 flag3

This is a translation of the original article:

📄ポケットモンスター ピカチュウ バイナリエディタ レポートバグなし

It was mostly processed by Claude 4 Sonnet.

The RAM Writer is the ultimate arbitrary code execution tool for first generation Pokémon games. With this editor, you can read and write any value to any memory address. You can even write and execute entire programs, making it a potent tool that even allows you to play games like Tetris and Reversi.

This article serves as an accompanying guide for the following video:

This guide only works with the Japanese version of Pokémon Yellow. It does not work with Pokémon Red, Green, Blue, or non-Japanese versions. This guide assumes that you are starting a new game. This method does NOT use SRAM Glitch, which involves performing a hard reset at a specific timing during save operations. For methods using SRAM Glitch, or installing RAM Writer in Pokémon Red, Green, and Blue, please refer to the following articles. If you can do SRAM Glitch, it is recommended using this article to install the RAM Writer.

• 📄RAM Writer in Pokémon Yellow (JP)
• 📄RAM Writer in Pokémon Red/Green/Blue (JP)

Pokémon Yellow has four versions: v1.0, v1.1, v1.2, and v1.3. You can determine which version you have by examining the engraving on the lower right corner of the cartridge's package seal:

• Numbers only or numbers + A = v1.0.
• Numbers + B = v1.1.
• Numbers + C = v1.2.
• Numbers + D = v1.3.

Note that the 3DS Virtual Console uses the v1.3. You can also determine the version by checking the 23rd and 24th items in Step 8. If they show "ぬ゙のづ", you have v1.1, v1.2, or v1.3. If they show something else, you have v1.0. In this procedure, there are no differences between v1.1, v1.2, and v1.3.

Set the player's name to がんョぜメ and the rival's name to オオオオ. Progress through the game until you reach Pewter City. However, do not defeat the third Bug Catcher in Viridian Forest. The third Bug Catcher is the trainer shown in the image below.

Heal at the Pokémon Center so that using an Escape Rope later will return you to Pewter City. Also, use the PC to switch to Box 2. You need to switch to a different box because Box 1 will be used in later steps.

At the Poké Mart, purchase Poké Balls and an Escape Rope. You need at least 19 Poké Balls, so be careful with your money. In the reference video, with starting money (3000 yen), rival battle victory (175 yen), Bug Catcher battle victory (100 yen), and selling Potions x6 obtained along the way (900 yen), they had a total of 4175 yen and purchased 18 Poké Balls plus an Escape Rope for 4150 yen. If necessary, battle additional trainers to earn more money.

Give the first 5 Pokémon you catch specific nicknames and keep them in your party. The remaining 14 Pokémon can have any nicknames but should be sent to Box 2.

You can catch any Pokémon species, but be careful not to waste Poké Balls since money is limited. It is recommended to save after each capture. In the video, they avoided catching Metapod and Pidgeotto due to low catch rates and tried to weaken wild Pokémon to 1/3 HP or lower before throwing Poké Balls to increase capture rates.

Move to a position where taking one step left would trigger the third Bug Catcher in Viridian Forest (while the Bug Catcher is off-screen). This is the position shown in the image. It is recommended to save here.

Walk left one step while pressing START to open the menu and use the Escape Rope. This will cause the Bug Catcher to spot you while escaping from Viridian Forest to Pewter City. If you don't arrive in Pewter City, reset and heal at the Pewter City Pokémon Center before trying again.

Deposit your party Pokémon in the specified order so that Box 2 contains 19 Pokémon total, with the 15th through 19th Pokémon having the nicknames listed above in that order.

The menu will become unusable, so save by switching to Box 2 using the PC, then reset the game.

Talk to the NPC to the right of the Mart to get guided to the Pewter Museum. You do not need to enter the museum.

Enter the house at the bottom left of the Pokémon Center and view the Town Map on the wall. After viewing the map, do not open the menu and head to Viridian Forest. When you enter the forest, a text box will appear. If arbitrary code execution is successful, the item menu will be expanded and you can move the cursor below "やめる" (Cancel).

• Return to Pewter City Pokémon Center and ensure you have 6 Pokémon in your party, then switch to Box 1. Also confirm that Box 1 has no Pokémon stored.
• Enter the house at the bottom left of the Pokémon Center and open the item menu.
  • Swap the 24th item with the 34th ハイパーボール (Hyper Ball).
    • The 23rd and 24th items have the same name, and the 25th item should be ピーピーエイド (PP Up) ×80, which you can use as a guide.
• Exit the house to warp to the Celadon Mansion Rooftop.

Open the settings and set them as follows:

This will make the はやぶさバッヂ appear as the 26th item. From this point on, text speed will be slow, but you can speed up message display by holding the B button while text appears.

1. Obtain Eevee, a nickname ヅずゆデの, and use the はやぶさバッヂ. This will cause Eevee's Poké Ball to reappear.
2. Obtain Eevee, a nickname ゴづ, and use the はやぶさバッヂ. This will cause Eevee's Poké Ball to reappear once more.
3. Obtain Eevee, a nickname がやぜカ, and use the はやぶさバッヂ. This will allow you to obtain as many Eevee as you like.

If you are having trouble with the Japanese input method, please refer to the following page.

Vite Input for Game Boy Pokémon

https://flag3.github.io

Obtain Eevee and nickname them in the following order:

After nicknaming Eevee, using the はやぶさバッヂ will start the simplified RAM Writer.

From now on, using the はやぶさバッヂ should start the simplified RAM Writer each time.

D5E3 on the left is the memory address you are trying to write to, and 00 on the right is the current value at that address.

Use the simplified RAM Writer to input the RAM Writer program. When you are finished inputting, press the Select button to start the RAM Writer. It is recommended that you close the simplified RAM Writer and save the game before starting the full RAM Writer.

From now on, starting the simplified RAM Writer and pressing the Select button should start the RAM Writer each time.

By making the following changes using the RAM Writer, you can make it so that using the はやぶさバッヂ directly starts the RAM Writer.

0B C9 01 CA 01 CB 01 CC 01 CD 01 CE 01 CF 01 D0 01

Various side effects occur from installing the RAM Writer:

• Current location
• Player’s name
• Rival’s name
• Bag
• Eevee acquisition flag
• PC Box

By setting the contents of addresses D330, D331, D334, and D335 to 00 in the Celadon Mansion Rooftop and then leaving the room, you will exit out to Pallet Town. To exit out to Viridian City, set D331 and D335 to 01. To exit out to Pewter City, set D331 and D335 to 02.

Use the RAM Writer to change the contents of addresses D000 to D00D as follows:

After the change, place the cursor on address D000 and press the Select button to choose the player’s or rival’s name. To change both the player's and the rival's name, change D003 and execute again.

Use the RAM Writer to modify addresses D010~D029 as follows:

After the change, place the cursor on address D010 and press the Select button to execute the program. This program has the following effects:

• Set the Bag to contain only the はやぶさバッヂ.
• Removes Eevee from Pokédex caught data.
• Allows you to obtain Eevee again.

By setting the content of address D9B2 to 00 and the content of address D9B3 to FF, you can set the number of Pokémon deposited in the PC Box to 0. However, for v1.0, it is recommended to leave the Pokémon in the PC Box as is without setting it to 0.

Once you have installed a RAM Writer, see the following article to learn how to use it.

📄RAM Writer Usage Guide in Pokémon Red/Green/Blue/Yellow (JP)

Regardless of the version, do not edit addresses D5E9-D661 with the RAM Writer.

Content that overlaps with the following articles is omitted here.

📄RAM Writer in Pokémon Yellow (JP)

The Trainer escape glitch, also known as the Trainer-Fly glitch or fifth method, is a glitch in Pokémon Red, Green, Blue and Yellow that involves the player escaping from a "long-range Trainer" using Fly, Teleport, or an Escape Rope while being spotted by a trainer before battle begins. In Japan, the glitch is often referred to as fifth's method, named after "fifthヽ(´ー｀)ノ◆Fi3PJTZKLQ" who found it.

While the above RAM Writer installation doesn't use the typical Special stat encounter part of the glitch, it employs the Trainer escape glitch technique of moving locations using Fly, Teleport, or Escape Rope while being spotted by a trainer before battle begins.

In Step 4, using the Escape Rope while being spotted by the Bug Catcher sets bit 0 of address D6AF, which puts the map script into an inconsistent state. The map script in Viridian Forest also remains pointing to the function DisplayEnemyTrainerTextAndStartBattle. Entering Viridian Forest after clearing bit 0 of address D6AF causes the text box to open via Viridian Forest's map script. In Step 6, having the NPC guide you to the Pewter Museum clears bit 0 of address D6AF.

In Step 7, viewing the Town Map in the Pewter City house stores 41 in address CF0E, allowing addresses DED0 and beyond to be executed as text commands when entering Viridian Forest. Furthermore, setting the contents of address DED0 to 08 allows addresses DED1 and beyond to be executed as a program. Address DED0 stores the first character of the 19th Pokémon's nickname in the box, and setting it to internal number 08 (corresponding to the character ゲ) allows program execution starting from the 19th Pokémon's second nickname character.

The program expands the item menu and overwrites address D4CA and beyond with C3 04 DE. This becomes the program for using the はやぶさバッヂ placed in the 26th item slot. The item menu expansion is also used to warp to Eevee's room.

Due to text command processing requirements, the hl register must be set to 50 before program termination, so the hl register is set to DED5 and its contents set to 50 before the ret instruction.

WRA1:DEB8 26 D4            ld   h,D4
WRA1:DEBA 2E CC            ld   l,CC
WRA1:DEBC 32               ldd  (hl),a
WRA1:DEBD 50               ld   d,b
WRA1:DEBE D6 DA            sub  a,DA
WRA1:DEC0 32               ldd  (hl),a
WRA1:DEC1 3E C3            ld   a,C3
WRA1:DEC3 50               ld   d,b
WRA1:DEC4 32               ldd  (hl),a
WRA1:DEC5 11 A1 D2         ld   de,D2A1
WRA1:DEC8 12               ld   (de),a
WRA1:DEC9 50               ld   d,b
WRA1:DECA 26 DE            ld   h,DE
WRA1:DECC 2E D5            ld   l,D5
WRA1:DECE C9               ret  
WRA1:DECF 50               ld   d,b
WRA1:DED0 08               db   08
WRA1:DED1 3E DE            ld   a,DE
WRA1:DED3 30 E3            jr   nc,DEB8
WRA1:DED5 50               ld   d,b

26 D4 2E CC 32 50
D6 DA 32 3E C3 50
32 11 A1 D2 12 50
26 DE 2E D5 C9 50
08 3E DE 30 E3 50

This program accomplishes the following:

• Sets the content of address CC36, which is wListScrollOffset, to 00 to set the scroll of the Bag to top.
• Clears bit 4 of address D28B to remove Eevee caught data from Pokédex.
• Sets address D2A1, which is wNumBagItems, to 00 to set item count to 0.
• Clears bit 5 of address D52D to initialize the flag related to obtaining Eevee.
• Sets the content of address D592 to 00 to fix the effect of the second use of the はやぶさバッヂ.
• Obtains the はやぶさバッヂ using GiveItem and sets the Bag to only contain the はやぶさバッヂ.

WRA1:D010 AF               xor  a
WRA1:D011 EA 36 CC         ld   (CC36),a
WRA1:D014 21 8B D2         ld   hl,D28B
WRA1:D017 CB A6            res  4,(hl)
WRA1:D019 EA A1 D2         ld   (D2A1),a
WRA1:D01C 21 2D D5         ld   hl,D52D
WRA1:D01F CB AE            res  5,(hl)
WRA1:D021 EA 92 D5         ld   (D592),a
WRA1:D024 01 00 65         ld   bc,6500
WRA1:D027 C3 38 3E         jp   3E38

AF EA 36 CC 21 8B D2 CB A6 EA A1 D2 21 2D D5 CB
AE EA 92 D5 01 00 65 C3 38 3E

fifth法による任意コード実行 - Wonderland Seeker

ポケモンをやっているはずなのにいっこうにポケモンバトルがうまくなりませんバグですか？ありすです みなさん、fifth法はご存知ですよね。第一世代ポケモントレーナーのなかではふぶきとはかいこうせんが強いくらい常識ですからね しかし第二世代以降から始めたトレーナーへ向けて一応簡単に解説しておきます A.fifth法とは まずトレーナーと会った場合のシステムについて トレーナーに見つかった時、ゲームは以下の4段階に分かれて処理を行います 1.トレーナーに発見される2.トレーナーが歩いてくる3.メッセージボックスを出す4.戦闘に入る fifth法では、この1と2の間にそらをとぶ・テレポート・あなをほる…

https://alice-wreath.hatenablog.com

【VC版対応】ポケットモンスターピカチュウ 任意コード実行下準備チュートリアル : 魚肉の雑記帳

概要巷で「5かいバグ」などと称されている”任意コード実行”を行うにあたっての下準備チュートリアルを解説していきます任意コード実行についての詳しい説明については割愛させて頂きます(他のサイト様の方が分かり易いから)簡単に説明すると、ニックネームや道具の種類を利用

http://blog.livedoor.jp

Trainer escape glitch - Glitch City Wiki

The Trainer escape glitch, also known as the Trainer-Fly glitch or Mew glitch (though the Mew glitch just refers to using the Trainer escape glitch to encounter…

https://glitchcity.wiki

User:TimoVM/JP Pikachu ACE Translation - Glitch City Wiki

This page is based on a translation/analysis of an ACE setup used in the Japanese version of Pokémon Yellow. The original article was written by flag3833753 and…

https://glitchcity.wiki