Pokémon Crystal Any% Glitched Route (JP)

This is a translation of the original article:

It was mostly processed by Notion AI.

This article serves as an accompanying guide for the following video.

Rules cf.Route Step 1: Get Two Pokémon in Your Party Settings New Game New Bark Town Route 30 Cherrygrove City:New Bark Town:Route 29 Cherrygrove City:Step 2: Change Box Names Step 3: Reset During Save to Get an Unterminated Name Step 4: 0x1500 Control Code Arbitrary Code Execution Step 5: Talk to Red and See THE END Technical Notes Arbitrary Code Execution with 0x1500 Control Code Screen Data Box Names Explanation Binary Reference

Rules

Must clear save data using "B + Select + ↑" before starting the run.
Timing starts when selecting "New Game".
Timing ends when "THE END" appears after the Red battle.
Definition of defeating Red: Completing the event by talking to Red on Mt. Silver.
Prohibited: Using arbitrary code execution to trigger Red's event or modifying it to another event.

Note: While English version ends at the first white frame after Red is defeated, this route follows the Japanese version's timing which ends when THE END is shown.

cf.

For glitched categories, the following are the common requirements that must be met to qualify as "beating the game": (a) Being in Mt. Silver on the map Red is in.(b) Talking to Red and running his unaltered NPC scripts until the credits roll.

Pokémon GSC Category Extensions/Rules - Pokemon Speedruns

http://wiki.pokemonspeedruns.com

Pokémon Crystal - Forums - I don’t understand the definition of “Red is defeated”. - Speedrun.com

View Pokémon Crystal speedruns, leaderboards, forums and more on Speedrun.com

https://www.speedrun.com

Route

Step 1: Get Two Pokémon in Your Party

The first goal is to get two Pokémon and go to the second floor of Cherrygrove city’s Pokémon Center. Here are the detailed steps:

New Game

Gender: Male
Time: 10:00
Name: ア
Day: Sunday
Phone Settings: Yes

New Bark Town

Go to the Pokémon Lab. Get Cyndaquil. Take the Berry from Cyndaquil.
Get a Potion from the professor's aide.

Cherrygrove City:

In the rival battle, deliberately lose by using only Tackle.

New Bark Town:

Get 5 Poké Balls from the professor's aide.

Route 29

Enter Route 29 from the bottom.
Decline the catching tutorial.
Catch one Pokémon.

Cherrygrove City:

Enter the Pokémon Center and go to the second floor.

Step 2: Change Box Names

Change the following box names:

📦

Box 2: ゅョゥマわてエろ

Box 4: がわぜォひすよえ

Box 5: ヅそリひさデづヅ

Box 6: ろボにきデづゅの

Other box names don't need to be changed.

Step 3: Reset During Save to Get an Unterminated Name

Follow these steps to attempt to get a Pokémon with an unterminated name:

Switch to Box 2 and save.
Deposit a single Pokémon. Select "ボックスせいり／メールはずしてね", choose "はい" to "レポートにうえからかいてもいいですか？", and do a hard reset right after "でんげんをきらないでください" is fully displayed.
- The window to successfully perform this glitch is only 2 frames, which occurs 149-150 frames after pressing "はい".

Step 4: 0x1500 Control Code Arbitrary Code Execution

After restarting the game:

From in front of the PC, move 1 step left and 1 step down, then open the Pokédex. Make sure to open the Pokédex at this position in the image.
In the Pokédex, move the cursor to Spearow. The exact navigation depends on which Pokémon you've encountered:
- If you've encountered Caterpie, Weedle, or Hoppip: Right 2, Up 2.
- If you haven't met those 3 but have met Sentret: Right 2.
- If you haven't met those 4 but have met Rattata: Right 2, Down 2.
- If you haven't met any of those: Switch to old Pokédex mode, then Right 3, Down 1.
After closing the Pokédex, take 1 step to the right, 1 step up. Open the PC and display the unterminated name Pokémon’s name. Make sure to follow this movement order. It will fail if you don't follow this order.

If you see a Pokémon with an unterminated name, you've succeeded. If not, return to Step 3.

Step 5: Talk to Red and See THE END

After displaying the unterminated named Pokémon, go down the stairs. You'll be transported to Mt. Silver. From there, move up 3 steps and right 1 step to talk to Red.

Hold B through the staff roll until you see THE END to complete the run.

Arbitrary code execution using the 0x1500 control code is a method discovered in Pokémon Crystal and cannot be used in Pokémon Gold/Silver. It involves the combination of the 0x15 control character followed by 0x00 in a text string.

Reading the 0x15 control character causes the next character to be used as an argument to execute a mobile script. If the internal ID of the next character is 0x01-0x0F, it executes a mobile function, and if it is 0x10 or higher, it is supposed to end the mobile script. However, 0x00 is not handled properly and address CD46 is executed instead. Address CD46 is an address used by some mobile functions. Therefore, by finding a text combination of 0x15, and 0x00, you can execute address CD46.

Address	Function
D05B	Address where the names of Pokémon and items are buffered.
D296	Address for temporarily storing Pokémon species.
D297	Address failed to flee from battle.

When the game is reset, the contents of addresses D05B and onward become 0x00. The Pokémon with an unterminated name does not have the 0x50 that indicates the end of the name, so when trying to display its nickname, it tries to read the text until it outputs the 0x50 that indicates the end.

If you follow the steps above after reopening the game, the content of address D296 is 0x15, and the content of address D297 is 0x00.When trying to read the content 0x15 of address D296 as text, it executes address CD46 by using the content 0x00 of the next address D297 as an argument for the mobile script.

By opening the Pokédex at the specified location, moving 1 step to the right, and moving 1 step up, it changes the contents of addresses CD64 onward to C2 9B C4 (jp nz, C49B). Since addresses CD46 to CD63 contain 0x00, after executing address CD46, it will execute address C49B.

Screen Data

Addresses C49B to C49F contain 00. Address C4A0 onward contains screen data as follows:

WRA0:C4A0 7F               ld   a,a
WRA0:C4A1 7F               ld   a,a
WRA0:C4A2 7F               ld   a,a
WRA0:C4A3 7F               ld   a,a
WRA0:C4A4 7F               ld   a,a
WRA0:C4A5 7F               ld   a,a
WRA0:C4A6 7F               ld   a,a
WRA0:C4A7 7F               ld   a,a
WRA0:C4A8 7F               ld   a,a
WRA0:C4A9 79               ld   a,c
WRA0:C4AA 7A               ld   a,d
WRA0:C4AB 7A               ld   a,d
WRA0:C4AC 7A               ld   a,d
WRA0:C4AD 7A               ld   a,d
WRA0:C4AE 7A               ld   a,d
WRA0:C4AF 7A               ld   a,d
WRA0:C4B0 7A               ld   a,d
WRA0:C4B1 7A               ld   a,d
WRA0:C4B2 7A               ld   a,d
WRA0:C4B3 7B               ld   a,e
WRA0:C4B4 7F               ld   a,a
WRA0:C4B5 7F               ld   a,a
WRA0:C4B6 7F               ld   a,a
WRA0:C4B7 7F               ld   a,a
WRA0:C4B8 7F               ld   a,a
WRA0:C4B9 7F               ld   a,a
WRA0:C4BA 7F               ld   a,a
WRA0:C4BB 7F               ld   a,a
WRA0:C4BC 7F               ld   a,a
WRA0:C4BD 7C               ld   a,h
WRA0:C4BE 7F               ld   a,a
WRA0:C4BF 7F               ld   a,a
WRA0:C4C0 7F               ld   a,a
WRA0:C4C1 7F               ld   a,a
WRA0:C4C2 7F               ld   a,a
WRA0:C4C3 7F               ld   a,a
WRA0:C4C4 7F               ld   a,a
WRA0:C4C5 7F               ld   a,a
WRA0:C4C6 7F               ld   a,a
WRA0:C4C7 7C               ld   a,h
WRA0:C4C8 7F               ld   a,a
WRA0:C4C9 7F               ld   a,a
WRA0:C4CA 7F               ld   a,a
WRA0:C4CB 7F               ld   a,a
WRA0:C4CC 7F               ld   a,a
WRA0:C4CD 7F               ld   a,a
WRA0:C4CE 7F               ld   a,a
WRA0:C4CF 7F               ld   a,a
WRA0:C4D0 7F               ld   a,a
WRA0:C4D1 7C               ld   a,h
WRA0:C4D2 E1               pop  hl
WRA0:C4D3 AF               xor  a
WRA0:C4D4 EA 9D DC         ld   (DC9D),a
WRA0:C4D7 C3 83 DB         jp   DB83

Box Names

Explanation

The arbitrary code execution using the 0x1500 control code utilizes the names of Box 2, 4, 5, and 6. Address C4D2 onward contains screen data related to the name of the current Box, and if you follow the steps, it will be the name of Box 2.

This arbitrary code execution is intended to write specific values to memory addresses that control various game states and flags.

Sets the number of Pokémon in party to 0 (address DC9D)
Changes the Pokémon Center stairs destination to Red's location on Mt. Silver (addresses DC73 and DC74)
Enables credits roll fast-forward with B button by marking the Hall of Fame as previously viewed (address D83F)
Makes Red appear on Mt. Silver by modifying event flags (address DB51)

WRA0:C4D2 E1               pop  hl
WRA0:C4D3 AF               xor  a
WRA0:C4D4 EA 9D DC         ld   (DC9D),a
WRA0:C4D7 C3 83 DB         jp   DB83

WRA1:DB83 26 DC            ld   h,DC
WRA1:DB85 2E F4            ld   l,F4
WRA1:DB87 CB BD            res  7,l
WRA1:DB89 D6 B4            sub  a,B4
WRA1:DB8B 50               ld   d,b
WRA1:DB8C 11 BF D8         ld   de,D8BF
WRA1:DB8F CB BB            res  7,e
WRA1:DB91 12               ld   (de),a
WRA1:DB92 32               ldd  (hl),a
WRA1:DB93 11 50 DB         ld   de,DB50
WRA1:DB96 1C               inc  e
WRA1:DB97 C6 B7            add  a,B7
WRA1:DB99 12               ld   (de),a
WRA1:DB9A 32               ldd  (hl),a
WRA1:DB9B E1               pop  hl
WRA1:DB9C C9               ret  
WRA1:DB9D 50               ld   d,b

Binary

C4D2:
E1 AF EA 9D DC C3 83 DB 

DB83:
26 DC 2E F4 CB BD D6 B4 50 
11 BF D8 CB BB 12 32 11 50 DB 
1C C6 B7 12 32 E1 C9 50

Reference

https://glitchcity.wiki/wiki/Pokémon_Crystal_any%25_speedrun_route