Interesting Glitches in Pokémon Red/Blue
Because the franchise is fresh on everyone's mind with Pokémon Go

And more importantly, why they happen
Even if you don't like Pokémon...
I think this is a really good case study about a complex piece of software that tries its best to work on very limited hardware. We take a lot of features on modern hardware for granted.
While not directly applicable to what we do here, some exploits do share similar vulnerabilities to known exploits in PHP, like so:
http://phpsecurity.readthedocs.io/en/latest/Insufficient-Entropy-For-Random-Values.html
Missingno. or 'M'
Probably the most popularly known glitch, lots of people know it exists but probably not why it happens

How to Perform:
- Be able to use both Fly and Surf, and have visited Cinnabar Island already
- Talk to the Old Man in Viridian City and watch his "how to catch a Pokémon" tutorial
- Fly to Cinnabar Island and surf along the east coast


What it does:
- Changes the encounter table so you run into impossibly high-level "normal" Pokémon
- ... and several not-so-normal ones, like Missingno.
- Modifies the quantity of the 6th item in your items list to either 128 or 255

The tens-digit is trying to represent a number in base-16 but is just trying to use the sprite data a few blocks after '9' instead of the letter 'F'
Why it happens:
In short: the game reads memory it shouldn't and interprets it as valid data anyhow.
- Visiting the Old Man is important because the game writes the player's name onto the stack for temporary storage and overwrites your name with "OLD MAN"
- When finished, the game reads from the top of the stack and replaces "OLD MAN" with your name again, but doesn't change the stack
- Cinnabar Island is unique in that it's possible to encounter Pokémon on the east coast, but doesn't have an encounter table native to the area
- When entering a new area, the encounter table read from some table and put into active memory. Normally, this is the previous area you were in, so it's not an issue...
- ...but if you just came from Viridian City with your character's name on the top of the stack instead, the game reads your name as if it were encounter data
- Therefore, what you encounter using this glitch depends on the name you input at the beginning of the game
- Or more specifically, the characters in spots 3, 5, and 7 of your name determine which Pokémon show up
A: Golduck
B: Hypno
C: Golbat
D: Mewtwo
E: Snorlax
F: Magikarp
G: Missingno.
H: Missingno.
I: Muk
J: Missingno.
K: Kingler
L: Cloyster
M: Missingno.
N: Electrode
O: Clefable
P: Weezing
Q: Persian
R: Marowak
S: Missingno.
T: Haunter
U: Abra
V: Alakazam
W: Pidgeotto
X: Pidgeot
Y: Starmie
Z: Bulbasaur
a: Missingno.
b: Missingno.
c: Missingno.
d: Ponyta
e: Rapidash
f: Rattata
g: Raticate
h: Nidorino
i: Nidorina
j: Geodude
k: Porygon
l: Aerodactyl
m: Missingno.
n: Magnemite
o: Missingno.
p: Missingno.
q: Charmander
r: Squirtle
s: Charmeleon
t: Wartortle
u: Charizard
v: Missingno.
w: Missingno. (KABUTOPS FOSSIL)
x: Missingno. (AERODACTYL FOSSIL)
y: Missingno. (GHOST)
z: Oddish
- Also, the item count part of the glitch occurs due to some unintended interactions between the Pokédex and the item list
- The Pokédex stores one of 3 values for a Pokémon:
- not seen, seen, caught
- This table is only 151 bytes long, but the index for the 'M' variant of Missingno extends past this
- Game Boy hardware doesn't have support for array guards, so ... an array is really just a pointer and doesn't 'know' its max length
#define NOT_SEEN = 0;
#define SEEN = 128;
#define CAUGHT = 255;
byte pokedex_table[151];
byte item_list[41];
byte missingno_pokedex_index = //some byte that's definitely greater than 151
pokedex_table[missingno_pokedex_index] = SEEN or CAUGHT;
Glitch 2: Catch Mew without cheating
No Gameshark, no external devices, nothing except natural in-game input

How to Perform:
Not just for Mew, and not intended by the developers
- Have at least one trainer with a maximum "sight" distance equal to the length of the screen not fought yet and some way to instantly travel (Escape Rope, Dig, Teleport, Fly)
- For Mew: Gambler on Route 8, youngster on Route 25
- Has some margin of error - save beforehand to easily retry
- Step towards this trainer so they will attempt to battle you as soon as you step
- There will be one frame where you can pause the menu -- use this chance to travel before the fight starts
- After successfully cancelling the fight, run into grass
- Doesn't matter where -- we're doing more "override the encounter table" shenanigans
- A very specific Pokémon should show up!
- Which one depends on which trainer you used for this glitch



Why it happens:
- We're able to pause the game for one frame while the trainer gets loaded onto the screen
- The trainer always faces south, then turns, creating an extra frame of delay in this case
- Encounter data is loaded for the fight to begin, depending on the trainer
- The Pokémon itself is dictated by the Special stat Pokémon in the trainer's last slot
- Certain trainers have Special stats that generate Mew
- The level depends on the modifier on the attack stat (starts at 7, ranges from 1 to 13, modified with buff/debuff moves like Growl or Swords Dance)
- The Pokémon itself is dictated by the Special stat Pokémon in the trainer's last slot
More than 151 again
- What happens if the Special stat picks something outside of the normal range of 1-151?
- Same thing as Missingno, just a different method
- With even more possibilities!

http://bulbapedia.bulbagarden.net/wiki/List_of_glitch_Pok%C3%A9mon
Hijack Pokémon and use it as a programming IDE
- Yes, really.
- Requires the use of some automation with frame-perfect timing
- So getting a bot to play for you is necessary...
- ...but this is all still technically feasible without directly modifying any in-game memory via cheating devices
- http://aurellem.org/vba-clojure/html/total-control.html
RNG Abuse in Later games
- "Surely having an in-game clock will satisfactorily randomize the seed value and thwart any attempts to make our RNG deterministic!"
- Nope: http://www.smogon.com/ingame/rng/
Pokémon Glitches
By tdhoward
Pokémon Glitches
- 1,355