Why MissingNo Multiplies Items!

In this part two we investigate how encountering a glitch pokemon will cause the 6th item to multiply. For this we are using Ghidra and SameBoy to debug and reverse engineer the code.
Part 1: • Researching MissingNo ...
Want to understand how to catch Mew? • Exploring the Mew Glitch
Checkout the whole GameBoy hacking playlist with stacksmashing: • Game Boy Hacking
PwnAdventure Game Hacking Series: • Pwn Adventure 3: Pwnie...
GhidraBoy: github.com/Gekkio/GhidraBoy
SameBoy: github.com/LIJI32/SameBoy
=[ 🔴 Stuff I use ]=
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-intuos
→ Camera#1 for streaming:* geni.us/sony-camera
→ Lens for streaming:* geni.us/sony-lense
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-keyboard
→ Old Microphone:* geni.us/mic-at2020usb
US Store Front:* www.amazon.com/shop/liveoverflow
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

[@Hex-DumpsterFire]

The fact, that we're in 2020 and people are still talking about Missingno makes me very happy

[@MysticIceFire]

Missingno best pokemon,,,

[@RedstoneHair]

Yeet, I'm playing on lakka pokemon red to get missingno, I got fly and all, I need surf and the island and I will get missingno

[@ieanenizedsalt3311]

Quarantine my boi. Quarantine

[@wayge]

Not only are we still talking about it, were still learning things about it

[@JesusSaves4real4real]

2021

[@StanleyDarsh22]

this is beautiful. not only are you clever for coming to the conclusion you did, but very intelligent for your ability to communicate the behavior of the bug to an audience that knows way less about it than you do.

[@TypicalSardine]

Literally this looked like magic to me, I hardly understood a thing but I still feel enlightened 😂

[@Egan466]

that's the reason I love his channel.

[@supportic]

Every video is like watching a detective series.

[@kebien6020]

This. I think it's on purpose, and he makes it work sooo well.

[@RedstoneHair]

Ya

[@fouzaialaa7962]

as my grandpa always said :always check for array out of bound

[@aytchemil]

oh gramps

[@RussellTeapot]

so.. this is basically a buffer overflow?

[@fouzaialaa7962]

@@RussellTeapot yes but the conditions was not catched by anything !!! usually it will be stopped at runtime and caught there but a buffer overflow is wen it doesn't get caught by anything and it roams the memory freely

[@ReturnRei]

I like the "how you could've found it yourself" approach as it teaches beginners how to get started in reverse engineering / research! Great Video!

[@OpenKeith]

I remember hearing that the reason those right-side tiles spawn land pokemon is because the game only uses the bottom-left 8x8 graphics tile for the "is this water?" check

[@Double-Negative]

This is exactly correct and explains two other things: 1. There are patches of grass in veridian forest which speedrunners use all the time because no pokemon spawn there. This is because certain grass tiles have a different sprite in the bottom left for cosmetic reasons, but it is not read as a grass tile, so no pokemon spawn. 2. In some internationalized versions of the game, both checks are done on the same tile, so the missingno glitch is impossible in those versions.

[@ElectTheMusic]

@@Double-Negative you can get missingno in every version of the game, it's just a different process.

[@proxy1035]

that is exactly why kzbin.info/www/bejne/boGsfZWnj9aUiZY

[@fghsgh]

As a fluent Z80 programmer, I could follow along perfectly with the disassembly, but you still gave some insights I could not have gotten, thank you very much. This was definitely worth the 20 minute watch.

[@Ice-fl9et]

NERD

[@lostmyplaintext7587]

Don't know if you plan on continuing this series but the "beat the game in 3 minutes" glitch is also pretty interesting from a technical standpoint :-)

[@Keldor314]

You have to wonder about the speedrun community sometimes when they allow something that's quite literally hacking the game to get to the end to count as a valid run e.e

[@SilphBoss]

@@Keldor314 because it can be done without modification to the physical game... can be done by hand by only playing the game

[@Aleuay]

@@Keldor314 overflowing the inventory through ACE or save corruption is within the bounds of the game, which is allowed. It takes a ton of skill and precision (navigating the inventory when it's overflowed requires you press A+B to scroll, it's extremely tight)

[@OatmealTheCrazy]

@@Keldor314 it almost doesn't really. There's no point trying to beat a time of 00:00, so it's not really run

[@some1fromthedark]

I believe you were unable to rename variables because even though you disassembled the data, it was set as an undefined function. If you selected the address of the start of the function in ghidra and press f, that will define the function. After that you should be able to rename the function, variables, etc.

[@GrandpaGameHacker]

this is correct!

[@gcm4312]

yes. the grayed out box in the decompiler view means that a function was not defined.

[@Modslover]

You're a very smart guy and very informative and great personality, i enjoy your videos.

[@nikigameplay]

that's why I really enjoy his vids! :D

[@RedstoneHair]

Same

[@aaggroberlin19]

Why the hell is he smart because he has experience in something? According to you everyone is smart who knows this stuff o.O. And why does he have "great personality" because of his knowledge? Your comment makes 0 sense.

[@Modslover]

@@aaggroberlin19 wow you went through 11 months of comments to get offended at someone random complementing another random person. I'm sorry that people can't have an interesting and fun way of providing content resulting in a good personality as well as being having the ability to hone his skills and knowledge on technology to be able to describe in detail to everyone that doesn't know how or why something is happening. I am really glad you are here to show us that you are probably the smartest man alive. Knowing everything possible that the world has to offer before even hearing about it because you're so smart. I apologize for hurting your feelings for me supporting another pea brained human like myself. We praise you all mighty watermelon brain. Show us the way, inform us with your superior brain power and knowledge. P.s. get a life and stop trying to take other people down with you, humble yourself and maybe you can provide the world some small amount of hope and further help the world more towards a better future.

[@aaggroberlin19]

@@Modslover 🤨

[@Frick-bv6xt]

I have absolutely no idea whats going on but it makes sense to me idk.

[@charalampospapaioannou2371]

Exactly! Cant understand a single thing he just said but I love all of it

[@RubyPiec]

@@charalampospapaioannou2371 I do not understand it either but I still enjoy this. :)

[@jpobi9880]

This Is how I feel watching NileRed (chemistry) as a programmer.

[@rndargis0]

The first thing I think of when I see H & L register and then a HL load instruction is that H is the high part of the address register and L is the low part of the register for the jump

[@randomnerd4600]

Ecountered pokemon are based on pokemons pokedex id. And missingno points to sone crap that mods items... Thats what i think. I mean, i know abt dat from other vids.

[@DaenaMichelle]

As a pokemon fan and a software developer I must say you are an absolute madman and so admirable for exactly that, thanks for doing this!

[@NorthLaker]

Hearing you being satisfied with your findings makes me satisfied as well!

[@WilliamTresnon]

I love that both of you are doing this together. Collabs like this of this nature around similar subject need to happen more because the amount of content coming out of you two is great.

[@d0gkiller87]

7:58 The debuggers on Windows work the same way. Set a hardware breakpoint on memory access/write, causes the target be paused AFTER the access/write instruction did something to that memory (no IP register can be traced, so the debugger cannot determine what instruction is gonna do something to what memory without dynamic analysis).

[@ValseInstrumentalist]

Totally agree with your points about seemingly "pointless" research. I first used Cheat Engine by following a tutorial for how to use it with the game Dink Smallwood. That made me feel like a badass programmer, so I continued on to learn all kinds of other tech stuff like Python, Arduino, Raspberry Pi, and more.

[@Originalimoc]

There're so many glitches related to the workaround of hardware limitations back then, there's rarely such kind of bug now.

[@123gostly]

Used to use this hack all the time as a kid but with this video all of it is so beautiful. If only one thing had not gone wrong it would have never happened. Seems magical.

[@Chaos89P]

Let me paraphrase to you what one Vinesauce guy's dad once said to him: It IS magic.

[@Ziberac]

This made me think back to the first game I had made in C++ that had this exact problem and made the game do crazy stuff. Very cool to watch.

[@AnthonyHarrisTechrat]

You and StackSmashing breaking all this down is some of the most enjoyable content I've seen in a long time. Great analysis, thanks for making these!

[@1337GameDev]

I REALLY like that you show that you're not super knowledgeable about everything, and your process in figuring it out. Very fun to watch/listen.

[@over00lordunknown12]

You are the first person I’ve seen actually go into the code to explain the MissingNo glitch. I hadn’t even thought about why it duplicates items, I just knew it did. Keep up the good work!

[@vladimir520]

This is such an interesting approach! Although I am not much experienced with assembly (I have simply played with the basics in a CTF), this step-by-step process really helped show me both how to investigate glitches and understand what you were saying! Should the big reveal just have been given to me, I probably couldn't make out much of it! Really fun series, I have thoroughly enjoyed these past videos of yours! Keep doing this amazing stuff, LO!

[@Litronom]

The conclusion at the end is very satisfying and pleasing! Great video!

[@PicMus]

Loved the narrative and editing. Great skills of storytelling =)

[@laurinneff4304]

I like how everyone is doing game boy/Pokemon/missingno videos rn, you, stacksmashing and retro game mechanics explained

[@beeperonithe2nd73]

I really love videos like these even if I can barely understand them sometimes. But you do the best job at explaining without over-complicating things... Also Gen 1's spaghetti code is amazing to dissect lol.

[@XeZrunner]

Stunned! You made this so interesting! Thank you for your amazing work! I'm having lots of fun watching these videos!

[@MrJerohm]

I'm impressed by the details you time and time you must have spent working on this video, thanks a lot for sharing it !

[@hasancakir8932]

Summary at the end explains the missingno bug well. Great video!

[@AT-zr9tv]

Awesome video!! I'm so happy the time I've been spending these past two months learning about Gameboy assembly has enabled me to understand much of this video. I would have been completely lost otherwise. Really great video, thanks!!

[@revenevan11]

Absolutely fantastic video. So satisfying to be able to follow along with the *why* this historic bug does what it does. You've been slowly kindling my interest in picking apart software to learn about it. I loved picking apart electronics and some mechanical devices to learn how things work or some tricks I could use even if I didn't understand the whole device or what specific or odd components did. Now as my journey into learning to code is continuing, instead of having to pressure myself into committing far enough into a big project or building some arduino gizmo in order to actually get some coding practice in (now that I don't have any coding assignments and am strictly self teaching and using online tutorials), I can now get some practice and learn something by just casually fooling around! Even with games!

[@Squolly]

Awesome video. Enjoyed this and the corresponding MissingNo Video very much. Your explanation is very detailed and comprehensive and you really cheer one up to try to do similar research on other bugs or just simple game logic in old games. As someone who once wrote a gameboy emulator for learning purposes I can only recommend your videos for everyone who wants to become more emerged with this awesome piece of hardware.

[@James2210]

Just going to post a few more details here, don't mind me: JR LAB_rom3__76a0 is an unconditional relative jump. ADD L doesn't modify L. It adds L to A. The LD L, A does modify L, though. Yes, SRL is a logical shift right.

[@SergioEduP]

Loved this (and the previous) videos! Would love to see a similar one explaining the Super Mario Bros credits warp used in speedruns =P

[@evanjacoby7805]

I was trying to find a good answer to this the other day! thanks for the upload

[@djbvck]

I love how in depth you went into the reasons the glitch effects everything. A lot of people just say "it changes these values when you talk to the old man" and didnt go into the things you can do with for instance the safari zone. I wish I knew about that years ago, would have made getting a Dratini waaaaay easier lol

[@over00lordunknown12]

I don’t really know much with assembly (much less disassembling code), but you did a fantastic job explaining it, and the end conclusion makes sense.

[@basedfacistman]

im genuinely happy when i see live's new video

[@VampireJester]

I have no knowledge of coding but I feel like I understood everything you said in both videos. I have no idea why but you just made so much sense.

[@amirouchedz3896]

As always totally excellent videos ! Keep going !!!

[@standarrow9759]

I just discovered your channel even though i dont understand anything i still enjoy it

[@webentwicklungmitrobinspan6935]

Its so cool that you are able to analyse these old games by looking at their memory allocation.. must have been a cool time as a gamedev back then

[@strattissimo8223]

Great video! I have always wondered why it was the 6th item when I found missingNo. Thanks guys!!

[@trustyTankadin]

This was a lot of fun! Thank you!

[@carlisleee_]

This video makes me really want to learn assembly... Thank you for that

[@savagetheunicorn4555]

Awesome i was waiting for this video when i found the previous yesterday c:

[@666mrcrowley666]

same here

[@prestonduffield5393]

It’s crazy I’m working on a project right now in school where we have to reconstruct a program from assembly. Very relevant and applicable stuff. Good work on finding out this bug and satisfying all of the people who wanted to know the reason behind all this madness’

[@JDSacharok]

Amazing! Thank you so much for this!

[@warpster7656]

Epic videos my dude. You have just educated my inner child. Thank you

[@Matt23488]

It's such an elegant bug... Thanks for this extremely enjoyable explanation!

[@flamemonger2]

First video I found of yours and insta subbed.

[@juliasteam2077]

just noticed this video was 20 minutes.. felt like 3. Amazing work.

[@GrandpaGameHacker]

This is awesome work. Using a scientific approach to game hacking, you figured out exactly why a bug occurs. I didnt know about the memory bank system, thats very cool. Also high five to Ghidra for making hobbyist's lives easier

[@Neoplasie1900]

Oh boy. So far, my personal coding was some data organisation with Python and converting a few hundred text files into an Excel sheet. Still you made me (kind of) understand what was going on here. Pretty cool stuff! And pretty fascinating reverse engineering work.

[@BlackHermit]

Great video, very well explained. Thank you so much! Greetings from Sweden!

[@sywei-vn2te]

You can configure your assembly listing window to show Ghidra's IR by clicking on that window's configuration, choosing PCode ops, and "enable field". The breakdown can help you figure out what the labeled mnemonics mean without resorting to a manual. You can also right-click on the mnemonic and jump to the instruction specification in the processor manual included with Ghidra.

[@BatteryAcid1103]

I wish I could thumbs up this video multiple times. That little rant about playful research is really important for people to understand! If you're learning something, it's not a waste of time!

[@AT-zr9tv]

Totally agree!

[@arnevaneycken2878]

This is amazing. Hits right in the childhood

[@cigils1567]

Just finished watching the first one to see this, amazing work man. Keep it up, gained a sub from me

[@tr1bute411]

This was great! I know it's a while ago you did this, but I would LOVE more research-perspective game bug investigations. Perhaps you could consider doing something similar with the Ocarina of Time Wrong Warp bug? It's also pretty crazy.

[@Ben-ix8yb]

This was excellent. Thank you.

[@GodKido]

I'm tore between "this is awesome" and "how could you ever let this release unnoticed", but it's still a 25+ years old game so maybe not that odd... thanks for the insight, this was really interesting!

[@tartas1995]

Because of this serie, I started looking at the Pokemon disassembly from Pokemon red (pokered on github) and I started to learn assembly for the GB. Gbz80 assembly.

[@craig47721]

Nice I was searching for the answer to this yesterday.

[@gart__]

Awesome video! I learned a lot!

[@BGroothedde]

That's a beautiful bug, it's so involved and has so many steps; that's what old school programming was all about!

[@sagacious03]

Pretty interesting! I wonder if you'll "tackle" some of the less well-known Glitch Pokemon! Nonetheless, thanks for uploading!

[@SiIverDragon]

I understand the concept of it , but I don't understand all this programming stuff , but still I love that kind of videos Thank you :)

[@woodchucksquirrel]

Thank you. This video was a great tutorial!

[@Levi_OP]

“The seventy tooth bit”

[@ArloMathis]

You have to admit our system is kinda bad, it should be standardized.

[@animowany111]

It is, and ordinal 72 is called seventy-second. English is actually one of the simpler languages when it comes to ordinals, and number kinds in general. 1st, 2nd, 3rd, 4-20th, 21st, 22nd, 23rd, 24-30th, ...

[@RussellTeapot]

@@animowany111 The seventy secondth bit

[@eyede7994]

Really good Video! Keep it up!

[@shupik]

Yay! A continuation!

[@m4gmu5hell]

I just started learning 6502 assembly like a week ago and am amazed, on how much I could follow with the code xD

[@Chaos89P]

6502 and z80, especially a modified one to include 8088 instructions, are different chips, but ASM tends to be similar in appearance.

[@KidPrarchord95]

I've been fearing and neglecting starting for years and I am also amazed at how well I could follow

[@ScrombIo]

IIRC the game will place the ending "1" into the item slot, essentially adding 128 items to item stacks that do not have 128+ items in them already. The glitch will not work on any item stack that is greater than 128, and using it on an item with a stack of 127 makes that item into a stack of 255. 255 also has the same properties as the CANCEL button which lead to some of the old Pokemon Blue any% NSC routes before easy ace with maps was discovered.

[@morwar_]

You guys are great. Amazing video.

[@asediffaafa2854]

U madman, your videos teach a lot dude

[@qbasic16]

Wonderful rabbit hole! 😎

[@DoYouKnowWhoKnew]

My Brain crapped out at 16:00. But amazing video

[@happinson]

did he mention that he has never seen this assembly

[@Demonslay335]

@3:30 OMG I literally had to pause the video, I was laughing so hard. Can totally relate to that moment on so many levels - both in game and in debugging. 😆

[@thatguy147]

A video on your enviornments and go-to toolchains would be great!

[@Innosos]

Some people are gonna eat this up. I'm reminded why I hate assembly. Great video and good job explaining it. It's a bit hard to follow at times because I'm not up to snuff with pointers, memory, addresses and their concepts. Always good to see people with a lots of patience and competence.

[@Wkterr]

For anybody else who has the source code for Pokémon gen 1 and are following along: You can find the code shown at 11:18 in Tools.dmg at around line 3925. It's in the "bit_control" routine.

[@Wkterr]

The code at 13:58 seems to be in FIGHT.DMG, around line 8629.

[@Wkterr]

Comment on 20:14: Yes, this is correct. If you look at the call instruction right before the call to the "setNthBit" routine (called "bit_control" internally), it's calling the routine that fetches Pokémon IDs. Again, if you have the source, you can find this routine (get_order_no) in ZUKAN.DMG (zukan = "picture book", or Pokédex, as it as later named) at around line 1220. It fetches the Pokémon ID from the table in monsdata/order.dat. Here, missingno's ID is 0x00, and as you said, all IDs found in the order table are decremented before they're used.

[@joemck85]

Clever analysis. I'd just assumed it was decoding the garbage sprite and cry data that resulted in the 6th item quantity being corrupted.

[@Letalight]

I like that after all of this desassembly you make me feel like a nerd knowing that arrays start at 0.

[@BitterMonday]

You are a great story teller

[@angryman9333]

thanks bro , keep it up

[@spiritcore1]

Another great video! I wonder how the save and restart glitch is working on Gold, Silver and Crystal. Do you mind making a video about it? Thanks!

[@HighPriestFuneral]

Having done some SNES, N64, and PS2 ASM hacking in the past, this was an absolute joy. I audibly said... "Oh...!!" When you put together the pieces at the end. All of this time it was a simple out of bounds array, with the idea that they never intended to have 32 bytes for all possibilities of Pokemon. This was a fun mystery that you broke down. Hopefully it inspires others to follow your lead.

[@nielsbishere]

So just to add to this; arithmetic functions generally use the accumulation register (a) so that's why that add doesn't have , a there. Also, HL spans two registers; H and L, the gameboy has mainly 8-bit registers but also shares those to make 16-bit registers so it can do stuff with addresses.

[@marcoroth_]

Super interesting stuff :)

[@SakiiR]

Hey buddy, nice vid, for the grey decompiler window. This is because de function is not defined, you have to create a function here with the F keybind :) Cya

[@maxfeist9105]

This was awesome!

[@masternerd64]

man I'm actually really glad for my computer organization and architecture class now. I actually understand what's going on for the most part

[@dervolker]

As always great analysis, couldn't agree more with you, that time spent fiddling around with something is worth it, since you learn so many things on your way, that otherwise only seem like abstract ideas. Nothing explains raceconditions better than injecting code into some process and having it crash hard ...sometimes... Keep it up

[@tommyluco]

when you were talking about gaining knowledge i was so damn sure you were going to make a segway to skillshare :D

[@Manawyrm]

If you also want to read the assembly for the mentioned functions (in a commented and somewhat structured form), here are some links to PokeRed: LoadEnemyMonData: (handles the pokemon encounter, calls the Flag function below) github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/battle/core.asm#L6200 here's the code that handles the IndexToPokedex-conversion and set's the flag: github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/battle/core.asm#L6337 IndexToPokedex: github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/menu/pokedex.asm#L649 Flagging-Function (also takes in a 3rd input value, the B register, which contains clear, set or read) github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/flag_action.asm#L1 predef seems to be the bank-switching function, which is structured as a macro (?) in Pokered: github.com/pret/pokered/blob/6ba3765c5932996f5da6417ae703794ff10bb1cb/home/predef.asm Thanks for these two great videos! I had a lot of fun watching and now reading the assembly.

[@DHIRAL2908]

15:30 you are a great editor!!!!!

[@jambosuss]

You explain this very well, you lost me in parts, but I sort of understand what's going on. I lasted until around 18:00 before I couldn't follow anymore. GG