Glitches Annotations Part 2

Unfortunately, none of these glitches saves time in an any% TAS. These glitches mearly save time in battles, which, as this TAS has shown, a TAS does not really need

The any% TAS uses Taillow and the same Guts paralysis strategy Machop used in this TAS This steamrolls the game, especially with crits, and has very little room for turn saves This means that the immense setup for these glitches is only worth it for any% in RTA

Another Pokemon Ruby/Sapphire glitch worth talking about is ACE (no not the sexuality) ACE stands for Arbitrary Code Execution and it refers to players running any sort of code on a system to do as they please

Poorly designed systems (not just games) may have vulnerabilities that allows users to run code as they please. One example includes typing in code into a search bar that gets executed due to the lack of code differentiating between normal inputs and code

Obviously, executing code in video games is much more complicated than that; how you do so differs from game to game. In Pokemon Ruby/Sapphire, this starts with the roaming pokemon Latios and Latias, so without trading, ACE is only doable in the postgame

Pokemon Ruby/Sapphire has 6 memory slots dedicated to the 6 possible pokes on an opponent's team. These slots do not change after a battle until a new battle is initiated, in which all 6 are reset and new values are put in for the new opponent

Normally, when a wild encounter happens, all 6 slots are reset and only the first gets added data of the wild poke. However, with the Latias and Latios encounters, only the first slot is reset while the other 5 remain the same

This means that if you have fought a trainer with 2 or more pokes beforehand and then encounter Latias/os, the game will continue to send out the trainer's pokes after Latias/os is defeated since there are still unfainted pokes left in the memory slots

Since the battle is treated as a wild pokemon battle, you can \"catch\" the trainer's pokes. Catch is in quotation marks because after being \"caught\" the pokes usually turn into Bad Eggs due to the pokes not matching your own Trainer ID and Secret ID

When the game stores data for a poke, the game calculates a checksum value, encrypts it and stores it into its data structure. When a pokes data is loaded, it recalcuates its own checksum value and if it doesn't match the value that is stored, it turns into a Bad Egg

The recalculation process involves decrypting the poke's data. Since the decryption and encryption process involves the TID and SID of the poke, pokes caught with a different TID and SID usually get turned into Bad Eggs

\"Usually\" is the key word here; it's actually possible for decrypted data to generate a checksum value that is the same as the one stored from the encryption process while having a different TID and SID. If this happens, the poke won't become a Bad Egg

The result of a poke caught like that varies on factors such as your TID and SID, the poke's TID and SID and the captured poke's data. Glitch Hunters have found a combination of these that frankensteins up a glitchmon that does some... interesting things

The setup they found involves catching Camper Cliff's (on Route 111) second Baltoy and manipping its TID and SID. These values are actually random and generate before the battle The player's TID and SID also must be manipped to a specific value

After being caught, this Baltoy turns into a glitchmon with a comically long name Funnily enough, the absurd name length is actually what enables ACE

Part of the process of ACE involves going into the \"Move Pokemon\" menu in the PC using the swapping hand (by pressing Select) and then swap the poke you're holding with the glitchmon. The swapping pokemon process can get replaced with custom code

This happens because before the swapping process, the game must execute the displaying poke function for the poke you'll hold. This function involves displaying the name which due to its length, messes up the game's understanding of its next function to do

The data for the name gets leaked into other areas of the game. There is a pointer in the game that points to which function needs to be done and that gets overwritten by the name data. As a result, the game reads the PC box names to determine its next function

Therefore, the custom code you would like to execute is written onto the PC box names The large variety in characters that can be written alongside the amount of inputs allows for a lot of different code that can be written

Custom code then can get executed by using the swapping poke method mentioned earlier There's a lot of things that can be done with this and glitch hunters have found box names that can respawn the starter bag and changing the trainer name