Why MissingNo Multiplies Items!

In this part two we investigate how encountering a glitch pokemon will cause the 6th item to multiply. For this we are using Ghidra and SameBoy to debug and reverse engineer the code.
Part 1: • Researching MissingNo ...
Want to understand how to catch Mew? • Exploring the Mew Glitch
Checkout the whole GameBoy hacking playlist with stacksmashing: • Game Boy Hacking
PwnAdventure Game Hacking Series: • Pwn Adventure 3: Pwnie...
GhidraBoy: github.com/Gek...
SameBoy: github.com/LIJ...
=[ 🔴 Stuff I use ]=
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-...
→ Camera#1 for streaming:* geni.us/sony-c...
→ Lens for streaming:* geni.us/sony-l...
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-k...
→ Old Microphone:* geni.us/mic-at...
US Store Front:* www.amazon.com...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

[@StanleyDarsh22]

this is beautiful. not only are you clever for coming to the conclusion you did, but very intelligent for your ability to communicate the behavior of the bug to an audience that knows way less about it than you do.

[@TypicalSardine]

Literally this looked like magic to me, I hardly understood a thing but I still feel enlightened 😂

[@Egan466]

that's the reason I love his channel.

[@ReturnRei]

I like the "how you could've found it yourself" approach as it teaches beginners how to get started in reverse engineering / research! Great Video!

[@NancysSpankBank]

The fact, that we're in 2020 and people are still talking about Missingno makes me very happy

[@MysticIceFire]

Missingno best pokemon,,,

[@RedstoneHair]

Yeet, I'm playing on lakka pokemon red to get missingno, I got fly and all, I need surf and the island and I will get missingno

[@ieanenizedsalt3311]

Quarantine my boi. Quarantine

[@wayge]

Not only are we still talking about it, were still learning things about it

[@NoCommentaryPlug]

2021

[@supportic]

Every video is like watching a detective series.

[@kebien6020]

This. I think it's on purpose, and he makes it work sooo well.

[@RedstoneHair]

Ya

[@lostmyplaintext7587]

Don't know if you plan on continuing this series but the "beat the game in 3 minutes" glitch is also pretty interesting from a technical standpoint :-)

[@Keldor314]

You have to wonder about the speedrun community sometimes when they allow something that's quite literally hacking the game to get to the end to count as a valid run e.e

[@SilphBoss]

@@Keldor314 because it can be done without modification to the physical game... can be done by hand by only playing the game

[@Aleuay]

@@Keldor314 overflowing the inventory through ACE or save corruption is within the bounds of the game, which is allowed. It takes a ton of skill and precision (navigating the inventory when it's overflowed requires you press A+B to scroll, it's extremely tight)

[@OatmealTheCrazy]

@@Keldor314 it almost doesn't really. There's no point trying to beat a time of 00:00, so it's not really run

[@some1fromthedark]

I believe you were unable to rename variables because even though you disassembled the data, it was set as an undefined function. If you selected the address of the start of the function in ghidra and press f, that will define the function. After that you should be able to rename the function, variables, etc.

[@GrandpaGameHacker]

this is correct!

[@gcm4312]

yes. the grayed out box in the decompiler view means that a function was not defined.

[@fouzaialaa7962]

as my grandpa always said :always check for array out of bound

[@aytchemil]

oh gramps

[@RussellTeapot]

so.. this is basically a buffer overflow?

[@fouzaialaa7962]

@@RussellTeapot yes but the conditions was not catched by anything !!! usually it will be stopped at runtime and caught there but a buffer overflow is wen it doesn't get caught by anything and it roams the memory freely

[@fghsgh]

As a fluent Z80 programmer, I could follow along perfectly with the disassembly, but you still gave some insights I could not have gotten, thank you very much. This was definitely worth the 20 minute watch.

[@Ice-fl9et]

NERD

[@Modslover]

You're a very smart guy and very informative and great personality, i enjoy your videos.

[@nikigameplay]

that's why I really enjoy his vids! :D

[@RedstoneHair]

Same

[@aaggroberlin19]

Why the hell is he smart because he has experience in something? According to you everyone is smart who knows this stuff o.O. And why does he have "great personality" because of his knowledge? Your comment makes 0 sense.

[@Modslover]

@@aaggroberlin19 wow you went through 11 months of comments to get offended at someone random complementing another random person. I'm sorry that people can't have an interesting and fun way of providing content resulting in a good personality as well as being having the ability to hone his skills and knowledge on technology to be able to describe in detail to everyone that doesn't know how or why something is happening. I am really glad you are here to show us that you are probably the smartest man alive. Knowing everything possible that the world has to offer before even hearing about it because you're so smart. I apologize for hurting your feelings for me supporting another pea brained human like myself. We praise you all mighty watermelon brain. Show us the way, inform us with your superior brain power and knowledge. P.s. get a life and stop trying to take other people down with you, humble yourself and maybe you can provide the world some small amount of hope and further help the world more towards a better future.

[@aaggroberlin19]

@@Modslover 🤨

[@Ziberac]

This made me think back to the first game I had made in C++ that had this exact problem and made the game do crazy stuff. Very cool to watch.

[@OpenKeith]

I remember hearing that the reason those right-side tiles spawn land pokemon is because the game only uses the bottom-left 8x8 graphics tile for the "is this water?" check

[@Double-Negative]

This is exactly correct and explains two other things: 1. There are patches of grass in veridian forest which speedrunners use all the time because no pokemon spawn there. This is because certain grass tiles have a different sprite in the bottom left for cosmetic reasons, but it is not read as a grass tile, so no pokemon spawn. 2. In some internationalized versions of the game, both checks are done on the same tile, so the missingno glitch is impossible in those versions.

[@ElectTheMusic]

@@Double-Negative you can get missingno in every version of the game, it's just a different process.

[@proxy1035]

that is exactly why kzbin.info/www/bejne/boGsfZWnj9aUiZY

[@Frick-bv6xt]

I have absolutely no idea whats going on but it makes sense to me idk.

[@charalampospapaioannou2371]

Exactly! Cant understand a single thing he just said but I love all of it

[@RubyPiec]

@@charalampospapaioannou2371 I do not understand it either but I still enjoy this. :)

[@jpobi9880]

This Is how I feel watching NileRed (chemistry) as a programmer.

[@rndargis0]

The first thing I think of when I see H & L register and then a HL load instruction is that H is the high part of the address register and L is the low part of the register for the jump

[@randomnerd4600]

Ecountered pokemon are based on pokemons pokedex id. And missingno points to sone crap that mods items... Thats what i think. I mean, i know abt dat from other vids.

[@James2210]

Just going to post a few more details here, don't mind me: JR LAB_rom3__76a0 is an unconditional relative jump. ADD L doesn't modify L. It adds L to A. The LD L, A does modify L, though. Yes, SRL is a logical shift right.

[@DaenaMichelle]

As a pokemon fan and a software developer I must say you are an absolute madman and so admirable for exactly that, thanks for doing this!

[@d0gkiller87]

7:58 The debuggers on Windows work the same way. Set a hardware breakpoint on memory access/write, causes the target be paused AFTER the access/write instruction did something to that memory (no IP register can be traced, so the debugger cannot determine what instruction is gonna do something to what memory without dynamic analysis).

[@ValseInstrumentalist]

Totally agree with your points about seemingly "pointless" research. I first used Cheat Engine by following a tutorial for how to use it with the game Dink Smallwood. That made me feel like a badass programmer, so I continued on to learn all kinds of other tech stuff like Python, Arduino, Raspberry Pi, and more.

[@fliptech]

Hey, would you like to do a follow up, that shows why the Save data gets corupted, when catching a missingno and saving the game.

[@willofthewind]

But doesn't only the hall of fame get corrupted for MissingNo.?

[@Mabi19]

Well, for now I can explain why the save data gets corrupted - but not as detailed as this video. Basically, have you noticed that Missingno's sprite is not a square? This is because it has invalid dimensions. When decompressing the sprite, the game expects that the sprite be a maximum of 7x7 tiles - but Missingno is larger. (11xsomething I believe.) This causes it to do a similar out-of-bounds array access which attempts to decompress the Hall of Fame data. But that is not compressed, so you just get gibberish. Edit: There's also a glitch Pokemon called "4 4" that has a sprite so large it decompresses into the RAM so far that it corrupts the sound system, which corrupts even more things. The game barely survives at that point (in fact, it usually crashes if not for special conditions) There a LOT of interesting glitches in this game. Like Super Glitch (yes, it's actually called that!), various glitch textboxes, a lot of interesting glitch items (there's one that makes the screen blank for example), the out-of-bounds is interesting, I could go on like this for a LOOONG time.

[@TheRen0gade]

Also why capturing missingo and putting it in your bank causes issues? Based on my memory from around 20 years ago.

[@Mabi19]

@@TheRen0gade It doesn't actually have to; it may've been that you've already caught a Cubone before and needed to put it in for it to register.

[@letsrobocraft7282]

Hey, at 01:16 there's on the screen that 0xff = 256, but 0xff = 255, just wanted to point that out :)

[@Wkterr]

For anybody else who has the source code for Pokémon gen 1 and are following along: You can find the code shown at 11:18 in Tools.dmg at around line 3925. It's in the "bit_control" routine.

[@Wkterr]

The code at 13:58 seems to be in FIGHT.DMG, around line 8629.

[@Wkterr]

Comment on 20:14: Yes, this is correct. If you look at the call instruction right before the call to the "setNthBit" routine (called "bit_control" internally), it's calling the routine that fetches Pokémon IDs. Again, if you have the source, you can find this routine (get_order_no) in ZUKAN.DMG (zukan = "picture book", or Pokédex, as it as later named) at around line 1220. It fetches the Pokémon ID from the table in monsdata/order.dat. Here, missingno's ID is 0x00, and as you said, all IDs found in the order table are decremented before they're used.

[@Originalimoc]

There're so many glitches related to the workaround of hardware limitations back then, there's rarely such kind of bug now.

[@123gostly]

Used to use this hack all the time as a kid but with this video all of it is so beautiful. If only one thing had not gone wrong it would have never happened. Seems magical.

[@Chaos89P]

Let me paraphrase to you what one Vinesauce guy's dad once said to him: It IS magic.

[@Levi_OP]

“The seventy tooth bit”

[@ArloMathis]

You have to admit our system is kinda bad, it should be standardized.

[@animowany111]

It is, and ordinal 72 is called seventy-second. English is actually one of the simpler languages when it comes to ordinals, and number kinds in general. 1st, 2nd, 3rd, 4-20th, 21st, 22nd, 23rd, 24-30th, ...

[@RussellTeapot]

@@animowany111 The seventy secondth bit

[@happinson]

did he mention that he has never seen this assembly

[@AleXannon92]

Ahh, so it's like that huh, I understand everything now.

[@RussellTeapot]

MMMH YES THE BYTES ARE MADE OF BYTES

[@black_platypus]

17:28 "Seventy-twoth" :P ...Or is "Seventy-Tooth" a new Pokemon? :O

[@matthewboyd1834]

Seventy second

[@germancubesolveryolo4524]

@@matthewboyd1834 You don't say!

[@Retrenorium]

@@germancubesolveryolo4524 forty four

[@Retrenorium]

Forty fourth

[@rijaja]

I'm getting annoyed at the fact that during the whole intro you only mention MISSINGO but you only show M. It was already like that in the first video.

[@stroo_]

Rijaja It doesn't really matter... Also you spelt MissingNo. wrong.

[@RokeJulianLockhart.s4eb2q]

@@stroo_ It doesn't really matter, and also you put an unnecessary full stop after 'MissingNo'.

[@Gameboygenius]

@@RokeJulianLockhart.s4eb2q it's not an unnecessary full stop. The full stop is included verbatim in the name of the glitch Pokémon as shown in the game.

[@RokeJulianLockhart.s4eb2q]

@@Gameboygenius Reagrdless, it is indisputable that should be a comma after the 'also'. Just accept that what you said was unnecessary, and we shall not need to discuss this further.

[@Gameboygenius]

@@RokeJulianLockhart.s4eb2q *regardless *that THERE should be And don't mind me. I'm here all day to discuss unnecessary things.

[@Manawyrm]

If you also want to read the assembly for the mentioned functions (in a commented and somewhat structured form), here are some links to PokeRed: LoadEnemyMonData: (handles the pokemon encounter, calls the Flag function below) github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/battle/core.asm#L6200 here's the code that handles the IndexToPokedex-conversion and set's the flag: github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/battle/core.asm#L6337 IndexToPokedex: github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/menu/pokedex.asm#L649 Flagging-Function (also takes in a 3rd input value, the B register, which contains clear, set or read) github.com/pret/pokered/blob/606df6a317df7c8d076410e8189f7e0a7782b530/engine/flag_action.asm#L1 predef seems to be the bank-switching function, which is structured as a macro (?) in Pokered: github.com/pret/pokered/blob/6ba3765c5932996f5da6417ae703794ff10bb1cb/home/predef.asm Thanks for these two great videos! I had a lot of fun watching and now reading the assembly.

[@Demonslay335]

@3:30 OMG I literally had to pause the video, I was laughing so hard. Can totally relate to that moment on so many levels - both in game and in debugging. 😆

[@NorthLaker]

Hearing you being satisfied with your findings makes me satisfied as well!

[@lkdyn]

Could you possible name yourself in the begin of the game to match the Mew ID and make it spawn instead of MissingNo?

[@MaZeModding]

I was hoping that he would check out the lookup table to solve exactly this scenario!

[@drawapretzel6003]

too bad this sort of glitch doesnt exist in newer versions, what a fun and silly way to get arceus to show up, like some sort of crazy stardew valley crossover :P

[@HighPriestFuneral]

If memory serves that was the older method to get Mew before people discovered the equally wacky Delayed Encounter "technique".

[@renakunisaki]

Unfortunately the ID for Mew doesn't match any of the available letters. D gives Mewtwo though.

[@HighPriestFuneral]

@@renakunisaki I stand corrected.

[@m4gmu5hell]

I just started learning 6502 assembly like a week ago and am amazed, on how much I could follow with the code xD

[@Chaos89P]

6502 and z80, especially a modified one to include 8088 instructions, are different chips, but ASM tends to be similar in appearance.

[@KidPrarchord95]

I've been fearing and neglecting starting for years and I am also amazed at how well I could follow

[@EmM-ko7mu]

So depending on your player name you can decide what valid pokemon shows up instead of MissingNo

[@katier9725]

Correct. This is also why Missingno. is so common because the default ASH name happens to contain the necessary letters to call one of its many IDs. With different names you can summon different Pokémon and at different levels, such as a lv 255 Mewtwo.

[@undead890]

@Lilith does stuff Mew wasnt in Gen 1, Mewtwo was.

[@StooRoxxAss]

@@undead890 Mew also was!

[@ParodieHecker-mobile]

@@undead890 Mew also was

[@somegalnamedseelpit3713]

This is also how you can unlock that strange Prof. Oak battle, by using one of the "Pk" or "Mn" symbols as the 7th letter of your name (iirc). Scykoh explained it a bit better in his final episode of Gen I glitch quest.

[@tatusaalasti304]

DID YOU KNOW THAT LIVEOVERFLOW HAS NEVER READ GAMEBOY ASSEMBLY

[@1337GameDev]

I REALLY like that you show that you're not super knowledgeable about everything, and your process in figuring it out. Very fun to watch/listen.

[@ScrombIo]

IIRC the game will place the ending "1" into the item slot, essentially adding 128 items to item stacks that do not have 128+ items in them already. The glitch will not work on any item stack that is greater than 128, and using it on an item with a stack of 127 makes that item into a stack of 255. 255 also has the same properties as the CANCEL button which lead to some of the old Pokemon Blue any% NSC routes before easy ace with maps was discovered.

[@jimmyjimbo666]

10:51 I think you weren't able to rename symbols because the function was undefined. You should be able to define a function in the disassembly window by right clicking the start of the function and clicking "Create Function" :-)

[@AmyraCarter]

Seems they weren't thinking about bit checks and such. Of course, this was early in the life cycle of the console, so it's not that surprising. Still, knowing now about how PokéNaN works, makes me think twice about using it.

[@razerx9393]

Just on a side note: Pokémon red/ blue had Pokémon from gen 2 (gold/ silver) in the Code but they were never really put in. No sprites etc. There is a list online that shows you every Pokémon that’s in the code and where it’s placed. Early on in the video, you said that you hit the value 135. That’s probably the actual Pokédex number (or shifted by one because of starting from zero) but it is a Pokémon that never made it into the game, so showing a missing no. I’m not a nerd in this coding stuff but I’m a nerd for Pokémon :D ps: most of these gen 2 Pokémon are above the index of 100 for some reason

[@ArloMathis]

The internal IDs are the order Pokemon were added to the game. Scrapped Pokemon IDs were blanked out with a OO, or missing number. Pokemon scrapped from Gen 1 were recycled for Gen 2, leading to them being in the data.

[@CoolJosh3k]

0xFF is actually 255, but yes there are 256 possible numbers. You obviously know what you are doing, but figured it’d point out this mistake anyway.

[@YellowBunny]

For more information on the internal ID versus Pokédex number anyone interested should watch this video by Retro Game Mechanics Explained if they haven't done that yet: kzbin.info/www/bejne/kHqYYYuLmrNph6c

[@Minecodes]

A little question, has been Maxsecurity AV a false positiv trigger on the windows version of SamaBoy? Becouse it says it's "Trojan.Malware.106557651.susgen "

[@frenches1995]

I only understood 50% of it and I'm scared now to research a bug that some friends of mine found back in my childhood

[@sagacious03]

Pretty interesting! I wonder if you'll "tackle" some of the less well-known Glitch Pokemon! Nonetheless, thanks for uploading!

[@SergioEduP]

Loved this (and the previous) videos! Would love to see a similar one explaining the Super Mario Bros credits warp used in speedruns =P

[@dervolker]

As always great analysis, couldn't agree more with you, that time spent fiddling around with something is worth it, since you learn so many things on your way, that otherwise only seem like abstract ideas. Nothing explains raceconditions better than injecting code into some process and having it crash hard ...sometimes... Keep it up

[@over00lordunknown12]

You are the first person I’ve seen actually go into the code to explain the MissingNo glitch. I hadn’t even thought about why it duplicates items, I just knew it did. Keep up the good work!

[@rikschaaf]

Does this mean that a second memory area is written to out of bounds when you actually catch a pokemon?

[@Faebiebot]

If you switch what item is in the sixth slot before catching missingno. the new item will also be duplicated. that might have something to do with what you're talking about.

[@olestrohm]

It would be when you catch the missing no, but this should happen, yeah :D

[@ilonachan]

Yes it does absolutely mean that. If I recall correctly, the supposed "caught" flag for Missingno is at the same location as the "seen" flag for Rhydon. No wait, I think that was Cubone.

[@LunaphaseLasersOfficial]

@@ilonachan It's Rydon if I remember. It has an internal index of hex 01 which makes sense.

[@ilonachan]

My reasoning is as follows: The "caught/seen" flags aren't based on internal IDs, but on Pokedex Numbers. That's why all Missingnos count as Entry 0, or 0xff (because unsigned byte). Rhydon has Pokedex Entry 112, or 0x6f, which lines up with the bit position, but look: Rhydon needs to be 0xD bytes after start of the "seen" table, and Missingno would have to be 0x1f bytes after start of the "caught" table. But the difference is 0x12, or 18 bytes, leaving room for 18*8=144 flags; not enough room for all ~152 Pokemon. So the "caught" table would be smaller than it has to be to hold flags for all Pokemon. Cubone, on the other hand, has Entry 104, or 0x67. So it's 0xC bytes into the table, and 0x1f-0xC=0x13, one byte more than before. And that's enough space for the flag table. tl;dr: If Missingno's flag overlaps that of Rhydon, we see that the "caught" table would be shorter than it actually has to be. Cubone, on the other hand, is a plausible candidate.

[@traaafik]

Wow, I got nerd chills when listen to this great explaintion! Thank you!

[@djbvck]

I love how in depth you went into the reasons the glitch effects everything. A lot of people just say "it changes these values when you talk to the old man" and didnt go into the things you can do with for instance the safari zone. I wish I knew about that years ago, would have made getting a Dratini waaaaay easier lol

[@BatteryAcid1103]

I wish I could thumbs up this video multiple times. That little rant about playful research is really important for people to understand! If you're learning something, it's not a waste of time!

[@AT-zr9tv]

Totally agree!

[@savagetheunicorn4555]

Awesome i was waiting for this video when i found the previous yesterday c:

[@666mrcrowley666]

same here

[@craig47721]

Nice I was searching for the answer to this yesterday.

[@Lachanceuse100]

I know it's probably for simplicity purpose but it's still tilting that you label 'M as "Missingno" Though they are basically the same behavior wise, Missingno is there to pad out the Pokémons that were probably cut in development (Theorized by the Johto guard glitch) while 'M has the internal idea 0x00 which was not given a name by the developers.

[@ChickasaurusGL]

I think the conversion table from index number to Dex number you're looking for is here ^^ github.com/pret/pokered/blob/6ba3765c5932996f5da6417ae703794ff10bb1cb/data/pokedex_order.asm For binary hacking that's at 10:5024 (offset 0x41024).

[@GrandpaGameHacker]

This is awesome work. Using a scientific approach to game hacking, you figured out exactly why a bug occurs. I didnt know about the memory bank system, thats very cool. Also high five to Ghidra for making hobbyist's lives easier

[@cryptearth]

imagine this would had been found during playtesting of original japanese 1st gen - maybe MissingNo would had never become such a meme ... I remember back in primary school - about 20 years ago - someone came up with that very crazy way to abuse safari zone to get to "sunny town" (it's basically raw game data / memory) and although we didn't knew what it is or what it may could be used for we did it over and over and over again a similar bug is possible on certain casio calculators (there're a few models which work) - it takes forever to set it up and requires a lot of precision - but in the end it freaks out completely - one can change a few inputs during the setup which, in combination with how much time has passed since last power on (I asume a very simple counter that keeps getting counted up the longer its powered on) + number of inputs and/or operations, does affect the output a bit search for "casio fx-85ms matrix" (or fx-82ms - which is the same but without the solar hybrid) and you'll find some videos - impressive how a simple school calculator can go full ham when you overload its firmware - would like an analyze of whats goin on with that party - but has to be some sort of inifite loop caused by some overflow ...

[@dripherobrinelvl8335]

Yes

[@danieliusz7228]

Nice luck I'm having. This got uploaded when I finished watching part 1!

[@BlackOps78321]

This is so stupid, yes if you literally take the cartridge games and change values on them, or do like you are doing to emulate it most likely on PC, then there will be unexplained behaviors. This is beyond just saying it's novice, it's expected that it will do something wrong if you literally tamper with it.

[@Samir-rd8xp]

no idiot, this was a glitch ON THE GAMEBOY, him changing the code has nothing to do with the original bug missingno, I hope in these 2 years you realize how dumb your comment sounds. Him being on a PC makes no difference for the bug to be replicated

[@WillPeterson]

so interesting that they would have seperate internal IDs than the pokedex ID numbers, and have to have a seperate table to map between them. Why not just use the pokedex IDs for all the internal uses as well?

[@SincerelyVince]

I'm a Java code architect. Recently, I've been working with systems that involve working with files containing raw data. This series has inspired me to jump into the ROM modding community. Keep up the excellent work 👍 Have any recommendations for those interested in studying assembly?

[@Innosos]

Some people are gonna eat this up. I'm reminded why I hate assembly. Great video and good job explaining it. It's a bit hard to follow at times because I'm not up to snuff with pointers, memory, addresses and their concepts. Always good to see people with a lots of patience and competence.

[@undead890]

Who here is old enough to have played Pokemon Red and Blue when it first came out and use the Missingno item duplication glitch to duplicate rare candies to level all of your pokemon to max level?

[@marcobonera838]

I played it, but European versions were patched :(

[@BGroothedde]

That's a beautiful bug, it's so involved and has so many steps; that's what old school programming was all about!

[@TheTutoriales1971]

Could you try hack a minecraft server?

[@DigGil3]

I'm not sure I'm smart enough for this.

[@ripmeep]

rip

[@CODEBYTE]

same here

[@Chaos89P]

It helps to be a computer nerd with at least some knowledge of assembly programming.

[@jpobi9880]

@@Chaos89P Yeah, I'm a computer nerd without knowledge of Assembly and it generally still goes over my head.

[@NineEyeRon]

I write VBA for excel so I am fine

[@carlisleee_]

This video makes me really want to learn assembly... Thank you for that

[@laurinneff4304]

I like how everyone is doing game boy/Pokemon/missingno videos rn, you, stacksmashing and retro game mechanics explained

[@basedfacistman]

im genuinely happy when i see live's new video

[@spicybaguette7706]

It's always the array out of bounds that gets ya

[@hpsmash77]

I thank the devs for missing this bug🙏

[@texon7631]

When a new video? Love your channel 😳

[@Dpx008Music]

I think you should check out Zelda Ocarina of Time related glitches, there are a ton of really interesting glitches like inventory manipulation or abusing cutscene pointers to warp to unintended locations. Even a few months ago, they discovered how to execute arbitrary code and functions in the game to basically do anything they like. I think it'd be really amazing if you took a look at this game!

[@TheTutoriales1971]

Brooooo please try hack a minecraft server

[@VampireJester]

I have no knowledge of coding but I feel like I understood everything you said in both videos. I have no idea why but you just made so much sense.

[@PieJee1]

Cool, i always assumed it was the Pokemon seen check doing the item duplication. I still wonder what corrupts the hall of fame. And i can also remember something was being saved when encountering missingno when running the game from Pokemon stadium. I guess it is some error handler logging something

[@MrJerohm]

I'm impressed by the details you time and time you must have spent working on this video, thanks a lot for sharing it !

[@WinVisten]

By the way, 'M is NOT MissingNo. It's so similar because it shares its Pokedex number, and there are glitch Pokemon that share Pokedex numbers with valid Pokemon, and with other glitch Pokemon. Those are called hybrids. So 'M is a hybrid of MissingNo.

[@Andreas-vr3vs]

I remember this trick from my childhood

[@Luigi1000]

Believe it or not the function you ran into is the subroutine for decompressing and assembling the graphics data for encountered Pokemon sprites. It uses 3 same sized buffers at a size of 392 bytes each to store the graphics data as it is manipulated and assembled before being sent out to video ram to be shown when a battle starts. Due to the copying and moving of the data to preform this it needs a pointer to compressed graphics data as well as the the bounding box size of the sprite to be drawn. Because MissingNo. points to random memory in the game it tries to draw graphics from random memory and the size it's given WAY exceeds the 3 buffers. As the routine tries to preform the action of assembling this data to show the player it writes outsize of the buffers allocated to it, right over the hall of fame data right after it and into other random parts of memory which is why items and other aspects of the game get affected. A full more in depth explanation of the drawing routine and how MissingNo. looks the way he looks can be seen in a video by the channel "Retro Game Mechanics Explained". They go over a lot of older system hardware and some interesting quirks of Pokemon's software and explain it in depth.

[@IsaacShoebottom]

For anyone curious they should watch the video "Retro Game Mechanics Explained" did on missingno, it's very in depth.

[@sundhaug92]

The Game Boy (and Game Boy Color) uses an instruction-set that is mostly like the 8080 and z80. This family uses 8-bit registers (except PC and SP, which are 16-bit), but for some instructions you can use 16-bit pairs (AF, HL, ...)

[@Jonathanloov]

"seventytwoth"

[@0ne87]

Seventy toothed 😁

[@seriousskateboarding9938]

I personally found a bug along time ago to give your pokemen unlimited hp. It could be used to further this research, if you're interested. And this bug has possibly never been released, until now. As I'm the one whobpersonally discovered this bug by pure accident back in grade 6. Though I'm not sure, this bug is probably already, but here it is; I can't remember exactly how to do it because it was like 2 decades ago, but I think the trick was a Lil sumthin like this. 1. You need to start by doing this same missing no glitch (as most of us know each save file gets its own randomly selected pokemen that can be a lvl that is over 100.) 2. Catch the bugged lvl pokemen. 3. Lvl the bugged pokemen to max lvl. (THIS IS WHERE EVERYONE THOUGHT THE GLITCHES STOPPED) 4. (this next part is the part I accidentally discovered) After steps 1-3 are done: trade the pokemen to a different game via the ol link cable, then trade it back. The pokemon will lose lots of lvls after the trades, but the hp will remain as if it didn't unlvl. 5. Lvl the pokemon back to max lvl then repeat step 4... Everytime you lvl then do the trade and trade back it allows you to infinitly?? Keep increasing the hp everytime steps 4+5 are repeated. I never knew this random bug I found 20 years ago could possibly be useful for awesome research like this my dude..

[@Matthew_and_Ami]

So one thing i remember, is if you got to the east side of seafoam islands coming from fuchsia city it does the same thing. While it does take longer to reach. It does work as well

[@Chaos89P]

I went down the right shore of the route south of Pallet Town and found a Raticate.

[@endymallorn]

Are you going to explain the overflow into the Hall of Fame next?

[@prof.tahseen6104]

Me: Does something using a program I haven't used before. My friends: Wouldn't that make you a ''NERD''? That's the explanation: 11:46

[@OrangeJuiceToothPaste]

Nice video, but the 'MissingNo' you found wasn't actually MissingNo, it's 'M (another glitch Pokémon). Many glitch pokémon share sprites with other glitch pokémon, so many people would confuse them with eachother.

[@vinzpiration]

Even though you've never studied this particular assembly code (gameboy), the knowledge of architectures and playing around with x86, arm, and avr over the years, accumulated experience and knowledge that allow you to make educated guesses about this. So if you ever wonder how somebody can research and figure out something new, most of the time it's because there is prior related knowledge a person can draw from. And that's why playing around with something seemingly useless like POKEMON RED from 1997 is not wasted time!

[@santoshpss]

Important Fact: Standing Bodies Of Water are *always* level (level means no elevation or deviation from the starting point to the end). This is a scientific fact because this is observable, testable, repeatable, measurable, demonstrable by every single human being alive. This fact alone destroys the mathematical concept and religious idea known as the "heliocentric model". More specifically, this fact alone makes it impossible for us to live on an exterior of a pear-shaped sphere spinning at fantastical speeds going nowhere. Just before you start to attach straw man fallacies on to me, keep in mind these important things: There are three different sciences: Natural Science (which deals with the Objective World) Social Science (deals with societies and the relationship between people in societies) Formal Science (deals with languages such as mathematics which bares no connection to the Objective World) "What is the shape of the earth I stand upon?" this is a Natural Science question. Science does not belong to an institution or a group of people. It belongs to every single human being alive. We live in the present. Not in the past or the future. History can never be considered as a fact of reality in any way shape or form because of obvious reasons. We can't directly experience the past or the future. Just observing something is not a fact that something exists. We need observable, testable, repeatable, measurable, demonstrable practical proofs for something to be considered as a fact. This is also known as the Scientific Method. There is a difference between the corporeal world (the physical world) and the visible world. The reason why we can't conclude something as a fact based on our observations is because we know things get smaller based on how far they're from us when we see them through our eyes. If I see a railroad, the lines look like they're converging, but we know that's impossible because people measured the lines, and the lines are parallel. The lines don't actually meet in real life, it's just how we see things. Our eyes are spherical, we see euclidean (planar) world through spherical eyes. Without physically testing, repeating, measuring, and accessing something in full three dimensions, it's impossible to know exactly what it is that we're trying to quantify. Looking up at the sky does not give you measurable proof of the earth you stand upon. It's like looking up at the light in your room and then measuring the floor based on that light. It's absurd. Images and videos are never considered as scientific proofs because of obvious reasons. Images and videos can be manipulated, they're not tangible. We can't directly experience them. Mathematical equations bare no relation to the Objective World. Mathematics is just a language, like English. Just because something is mathematically correct does not make it real. It's like saying "I'm flying!", even though the sentence is grammatically correct, I'm obviously not flying right now. "Gravity" is a mathematical concept, it's pseudoscience. It does not have any practical proofs. Magical pulling forces don't exist in the Objective Reality. Motion only happens if something presses on something else (pressure variants). Pull is just a term for taking something closer to someone. Things falling down has got nothing to do with the shape of the earth. In the simplest sense things that weigh more than air fall, and things that weigh less than air float. Why do things even fall? No one has any practical proof for why things even have weight. The mathematical theorists are making assumptions about why things are falling, but understand that those are just assumptions, not facts. The sky, the Moon, the Sun, and the Stars are all intangibles. If every single human being can't observe, test, repeat, measure, demonstrate something in a practical fashion, it is considered a belief, or pseudoscience. Does every single human being has access to these lights in the sky? Obviously not. Not to mention stars look like flashing lights when looked through a Nikon COOLPIX P900 (It's still not a proof of anything because we can't move around them in full three dimensions). Admitting to yourself that you truly don't know something is the most honest realization you could have, it is how you progress further. For example, I do not know what the Sun is. The mathematical theorists are making assumptions of what the Sun is, and where it is located. They don't know what the Sun actually is, or where it is located. Unless I could move around the Sun in full three dimensions, the only possible stance I can have is "I don't know". Anything beyond that will be a belief. For example, if I say "The Sun is a cylinder-shaped object moving in the sky", it is just a belief because I can't move around the Sun in full three dimensions to know if it's a cylinder or a circle. The only thing I know is that it's a light in the sky moving in a straight line across the sky (because of how our eyes work it looks like the Sun is moving in an arc across the sky, but the Sun is actually moving across the sky in a straight line). Another example, "I know the full dimensions of earth" is also a belief because I never explored the whole world to know the full dimensions. Remember, something only becomes a fact if it's observable, testable, repeatable, measurable, demonstrable by every single human being alive. In this case, each and every individual should explore the Objective World to its fullest extent, listening to "authorities" is just a belief. The world "map" is also a concept, because every single human being didn't explored the whole world to verify or falsify the map. People are believing in whatever the "governments" say or show. People are literally believing in complete strangers and thinking the official "world map" is true and there is nothing more to explore because they see a blue sphere on their TV. Just because the majority of the population are believing something exists doesn't mean something actually exists in the Objective World. Once again, we need OTRMDPPs for something to be considered a fact of the Objective Reality. Letters before your name does not mean anything. Direct experience is the most important thing. If we can't experience something directly then most of the time it's useless for us. I can only represent myself. Personalities are OUT of the question. If I drop a brick on my head I know what's going to happen. The objective reality does not change based on your subjective opinions or beliefs. It is what it is. Why is this important? Well, the government and its associations are BLATANTLY lying about our existence, the shape of the world, and the dimensions of the world. What's more important than finding out how far the world extends? Full exploration is needed for further understanding of life's most important questions: where we are, why we're here, and what's it all about. Without knowing where we are everything we do is just a concept. For example, if I give you a board, and without giving you any instructions or rules, I want you to play a game, what game are you going to play? The government and its associations are telling you what you're suppose to do, what's expected of you, what you're not suppose to do. Who agreed to their "law" book? I certainly did not. How is it fair that the government and its associations (the police and the military) are imposing their subjective rules onto the human beings? Everyone has different rules about different things, subjective rules are personal, they're NOT objective. These governments, police, military are imposing their SUBJECTIVE rules onto others, this is nothing short of tyranny. Why can't we freely explore the objective world as much as we like? Why is there a physical, and mental restriction by the police, the military, and by psychopaths known as the governments? Remember, no one rules if no one obeys. "People are arguing and fighting over what game to play when they don't even know the board they're playing on" -Del (Beyond the imaginary curve youtube channel: kzbin.info/door/vswlgeHodOejVN21TWweLw) (People are arguing about what to do without knowing the full dimensions of the world) Another analogy: if I erase your memory and put you in a confinement, what is the first thing you're going to look for? Where's the exit. But if I put some actors to distract you by showing you books and telling you there is no exit, then you'll never try to even think about the exit, there will be other brainwashed people just like you who'll brainwash you even more. Then some other actors will tell you what to do, what's expected of you, what you're not suppose to do, and what's the punishment for breaking their god-given "law" book, some other brainwashed people will also have weapons so that common people like you will forcefully follow my law book, which makes my job incredibly easy by making you a slave if that's what I was ever up to. Why should we accept slavery? Why should we accept strangers imposing their subjective versions of what's good and what's bad onto us? If you have OTRMDPPs (Observable, Testable, Repeatable, Measurable, Demonstrable Practical Proofs) that large Standing Bodies Of Water can bend, (sounds absurd to even think about it) please feel free to email me at [e-mail], but understand that I should be able to demonstrate your claims in a practical fashion, because that's how the Objective World works. No offense, but If your claims does not have any practical proofs, then I'm afraid I have to conclude that you're either blatantly lying or you're really stupid (Or for some reason you want to defend your religious beliefs, because the Earth being a sphere is a religious belief, a mathematical concept, it has no practical proofs, it has no relation to the Objective World, that being real life).

[@ChrisBigBad]

So! What can we hack by selecting our name cleverly?

[@marcoroth_]

Super interesting stuff :)

[@aerospherology2001]

Fighting a certain Super Nerd on the glitched Route 8 (Lavender Town-Saffron City) of my German copy of Yellow causes the first item to be changed into a TM of Dragon Rage, IIRC, and to have an out of bounds inventory. It got glitched because I did the Mew glitch incorrectly and saved. It has glitched music, slower movement (I have to press A or B often there), crashes, etc. Sometimes I can't even reach the Super Nerd to do the glitch, since he's at the more unstable Saffron side. For his battle, the first one is normal but it does the battle again.

[@gcm4312]

Ghidra can read GameBoy Assembly Language out of the box?! What? Why??? How???

[@some1fromthedark]

Knowing that the item amount changing is a result of the game trying to mark Missingno as seen in the pokedex makes me wonder what gets modified when the game tries to mark Missingno as caught.

[@TheAkashicTraveller]

Doesn't missingno. glitch the hall of fame as well?

[@danimalforlife]

The caught information actually appears before the seen information, so it would update the seen information. I just checked, and it updates seen encounter data for Pokemon #097 - #104 in the Pokedex.

[@void-ul5ds]

@@TheAkashicTraveller Yeah but that has to do with the sprites for the "pokemon" and the compression algorithm it uses to compress the sprites. Basically the compression algorithm fucks up and it overwrites into the hall of fame data. Theres a detailed explanation here: kzbin.info/www/bejne/kHqYYYuLmrNph6c

[@some1fromthedark]

@@danimalforlife Neat. I had a feeling that might be the case from one of the views in memory from the video, but I was too lazy to check lol.

[@helston7262]

I bought a dodgy grey cartridge pokemon red in Singapore which works perfectly except when you see MissingNo it scrambles all pokemon in all computer boxes except the one you have open. If you open another box then all of your boxes are scrambled and you've lost everything. All scrambled pokemon are a picture like MissingNo and all the characters in the name are randon letters, numbers and symbols. Had about 130 pokemon when I found this out.

[@wildbill268]

This is so cool to see in action! If you didn't know, it's actually possible to duplicate TWO sets of items by replacing the already duped item with another item that has yet to have it's bit flipped during battle. When you catch missingno, that same function must be performed in the process of updating it's Pokedex entry, but instead of listing it as "seen", it gets listed as "caught". The game then forgets that you even saw missingno since the data for that would normally be referenced in the Pokedex data, which explains why this can be repeated multiple times through various wild encounters with missingno. That's probably not 100% correct, but that's my educated guess :)

[@MakotoTheKnight]

All this time, MissingNo was both a TOCTOU and memory overwrite bug... I'm just in shock.

[@AronHetLam]

I haven't really played the game, but @6:50 could it just be that the level is too high? Or how high level can you reach? I guess you would be able to test this by putting 0x87 for Pokémon and 0x01 for level and see if it's valid.

[@Timc394]

That border in the beginning made me think my screen was broken lol

[@linoxyard]

There were actually supposed to be 190 pokemon, but some did not make the final cut, and were simply blanked out as "missing numbers"; those used to be valid pokemon. The values greater than 190 are completely unrelated data being interpreted as pokemon (such as 'M, which happens to share the same garbage sprite with missingno., because they happen to share the same internal id if I recall correctly), and could potentially cause some serious damage to the save file.