NINO/NINA Route
In this route, you will be setting up arbitrary code execution in non-Japanese FireRed or LeafGreen through the PC shift/swap action in the Pokémon Storage System. Through the mail glitch, you will transform NINA/NINO the trade Nidorina/Nidorino into glitch species 0x0351 which is the standard ACE species used in non-Japanese FireRed and LeafGreen.
Prequisites
- Your save has the mail glitch active, and you know how to use it.
- If not, please read this article to learn how to activate it.
- These Pokémon has been registered as seen in your Pokédex:
- Eevee
- Can be registered at Bill’s PC at the Sea Cottage on Cerulean Cape.
- Hitmonchan
- Can be registered at the Fighting Dojo in Saffron City.
- Magikarp
- Fisherman trainers, or the salesman in Mt. Moon Pokémon Center.
- Rhyhorn
- Can be registered at Giovanni’s battle in the Rocket Hideout.
- Eevee
- Have the Nino/Nina trade available from the Route 11 building, or if you already have them, they are untouched from the initial trade.
Note
If you are doing this route after unlocking the National Mode of the Pokédex, make sure that you enter the Pokémon words from the POKéMON group, not POKéMON2 group, or A-Z mode.
FireRed route
Take NINA to the Move Deleter in Fuschia City. Delete all moves but Poison Sting.
Place NINA in Box 3, Slot 1. Then activate the mail glitch.
Set the message of the glitched mail to be the following:
| English |
|
||||
|---|---|---|---|---|---|
| French |
|
||||
| Italian |
|
||||
| German |
|
||||
| Spanish |
|
After confirming the message, reenter the PC, NINA should have become a level 0 Wigglytuff.
Place it in the daycare south of Cerulean City, and then take two steps, then remove it from the daycare.
It will become level 1, and all of its glitch moves will be replaced.
Place NINA in Box 3, Slot 1. Then activate the mail glitch.
Set the message of the glitched mail to be the following:
| English |
|
||||
|---|---|---|---|---|---|
| French |
|
||||
| Italian |
|
||||
| German |
|
||||
| Spanish |
|
NINA should have become a level 58 Parasect.
Move NINA the Parasect into your party and give it:
- 5 HP Ups
- This provides 50 HP EVs.
- 1 HP effort value
- This can be provided by Caterpie, which can be found in the Viridian Forest.
- 3 Attack effort value
- This can be provided by defeating 3 Doduo, which can be found on Route 16.
- This can also be provided by defeating 3 Mankey, which can be found on Route 22.
Place NINA in Box 3, Slot 1. Then activate the mail glitch.
Set the message of the glitched mail to be the following:
| English |
|
||||
|---|---|---|---|---|---|
| French |
|
||||
| Italian |
|
||||
| German |
|
||||
| Spanish |
|
NINA should have become glitch species 0x0351, which should have a name similar to ËÁÈî ΠËÁ.
LeafGreen route
Take NINO to the Move Deleter in Fuschia City. Delete all moves but Poison Sting.
Place NINO in Box 3, Slot 1. Then activate the mail glitch.
Set the message of the glitched mail to be the following:
| English |
|
||||
|---|---|---|---|---|---|
| French |
|
||||
| Italian |
|
||||
| German |
|
||||
| Spanish |
|
After confirming the message, reenter the PC, NINO should have become a level 0 Wigglytuff.
Go to Celadon Department Store, then buy a Poké Doll. Give NINO the Poké Doll.
Place NINO in Box 3, Slot 1. Then activate the mail glitch.
Set the message of the glitched mail to be the following:
| English |
|
||||
|---|---|---|---|---|---|
| French |
|
||||
| Italian |
|
||||
| German |
|
||||
| Spanish |
|
NINO should have become a Nidorino again, but now has Pedal Dance in its second move slot. Move this to the first move slot.
Set the message of the glitched mail to be the following:
| English |
|
||||
|---|---|---|---|---|---|
| French |
|
||||
| Italian |
|
||||
| German |
|
||||
| Spanish |
|
NINO should still be a Nidorino, however its internal data has been shuffled around.
Warning
Do not open NINO’s summary, or use any of its moves in battle. This will cause a game crash.
The EV training section must be conducted using switch training. This is done by starting the battle with NINO at the front of the party but then switching to another Pokémon in the party to do the rest of the battling.
Move NINO the Nidorino into your party and give it:
- 1 HP effort value
- This can be provided by Caterpie, which can be found in the Viridian Forest.
- 3 Attack effort value
- This can be provided by defeating 3 Doduo, which can be found on Route 16.
- This can also be provided by defeating 3 Mankey, which can be found on Route 22.
Place NINO in Box 3, Slot 1. Then activate the mail glitch.
Set the message of the glitched mail to be the following:
| English |
|
||||
|---|---|---|---|---|---|
| French |
|
||||
| Italian |
|
||||
| German |
|
||||
| Spanish |
|
NINO should have become glitch species 0x0351, which should have a name similar to ËÁÈî ΠËÁ.
Appendix
How to trigger ACE
Note
Before triggering any kind of ACE, make sure that:
- Done all prerequisite steps for that particular code (e.g. created specific bootstraps, in correct location, etc.)
- You have changed the box names to the ones for your code. Make sure that you have entered these codes correctly!
- The entrypoint (Box 13, Slot 7) and all spaces after it are empty.
- If the Pokémon occupying these spaces are bootstrap Pokémon (Pokémon containing special data for various ACE setups to use), they should be fine occupying these spaces as long as they are for the form of ACE you are using (the covered form in this tutorial is grab/swap ACE).
To trigger ACE with this Pokémon, in the PC’s Move Pokémon mode, grab any Pokémon (except for the glitch Pokémon), and make sure the cursor is orange (press SELECT if it is not). Then swap this Pokémon with the glitch Pokémon by hovering it over the glitch Pokémon then pressing A. This should move the glitch Pokémon into the cursor, press A again and the other Pokémon should come back into the cursor. Place this Pokémon anywhere afterwards.
Checking if everything worked
Make sure that Box 9, Slot 30 is empty, then set your box names to the ones shown below.
Box 1: C C U n n R E o [CCUnnREo]
Box 2: P R o / G w m [PRo/Gwm] (change '/' to 'B' for inaccurate emulators)
Box 3: A A T S , m [AATS,m]
Box 4: A / F Q m [A/FQm]
Box 5: D F Q m [DFQm]
Box 6: _ V o H I C o r [ VoHICor]
Box 7: B n [Bn]
Box 8+: (anything)
Then trigger ACE. Then enter the PC, and look at Box 9, a shiny, level 0, female Bulbasaur should have appeared in slot 30. That means the ACE is working properly. You can safely delete this Bulbasaur after doing this code.
Technical details
This method uses the mail words to change the NINA/NINO’s PID and the stored secret ID to change which substructure areas of data is being read as while also preserving the encryption key1 to make sure that the Pokémon does not turn into a bad EGG.
Below shows what is happening to the PID, TID, SID, encryption key, as well as the substructure order (shown in the parentheses after the corresponding PID) during the process of turning NINO/NINA into glitch species 0x0351.
NINA (FireRed)
First, deleting all of NINA’s moves (except for Poison Sting) is needed2 as that sets up the Attack substructure for the first glitched mail. The first glitched mail modifies the PID in a way that causes the Attack substructure to be read as the Growth substructure3, where:
- The index number of the first move will be read as the species index number, in this case 40 (Poison Sting) becomes Wigglytuff.
- The index number of the second move will be read as the index number of the held item, in this case 0 (No move) becomes no held item.
- The index numbers of the third and fourth moves combined will be read as experience, in this case the combined number is 0.
- How the numbers are combined is determined by this calculation: move3 + move4 × 65536
- The PPs will be read as various other stats which are not relevant.
Wigglytuff learns four moves at level 1, overwriting the various glitch moves it now has due to the old Miscellaneous substructure now being read as the Attacks substructure. The 0 experience will cause the level to be calculated as level 0, which allows using the daycare to obtain all of the level 1 moves quickly with only a few steps. Overwriting these glitch moves4 is important as the next glitched mail modifies the PID in a way that causes the Attacks substructure to be read as the Growth substructure. If the glitch moves are not replaced, we end up with a glitch species 0xFE00 where we do not even know whether it can be EV trained because it might have unwanted behaviour, and the amount of “experience” it has might make EV training impossible.
After the second glitch mail, the Wigglytuff becomes a level 58 Parasect. This Parasect already has 30 HP EVs as its EVs substructure was originally NINA’s Growth substructure, where the HP and Attack EVs combined (they are combined with this calculation: hpEV + attackEV × 256) was the species index number of NINA, in this case 30 (Nidorina) becomes 30 HP EVs and 0 Attack EVs.
We then prepare NINA for the next (and final) glitched mail, which modifies the PID to read the EVs substructure as the Growth substructure. To do this, we give NINA an extra 51 HP EVs and 3 Attack EVs, totalling to 81 HP EVs and 3 Attack EVs. With the next glitched mail, these will be read as the species index and they will combine to form species index 0x0351 which corresponds to glitch species 0x0351.
After entering the glitched mail, we are left with glitch species 0x0351 that is named NINA.
Below shows what is happening to the PID, TID, SID, encryption key, as well as the substructure order (shown in the parentheses after the corresponding PID) during the process of turning NINA into glitch species 0x0351.
- Personality value (PID)
-
0x00EECA15 (GMEA) → 0x2A6BCA15 (MAEG) → 0x2A81CA15 (EGMA) → 0x2A85CA15 (GMEA)
- Trainer ID (TID)
-
13637 (0x3545) → 13637 (0x3545) → 13637 (0x3545) → 13637 (0x3545)
- Secret ID (SID)
-
0 (0x0000) → 10885 (0x2A85) → 10863 (0x2A6F) → 10859 (0x2A6B)
- Encryption key
-
0xEEFF50 → 0xEEFF50 → 0xEEFF50 → 0xEEFF50
NINO (LeafGreen)
First, deleting all of NINO’s moves (except for Poison Sting) is not technically required (in fact the original version of this route did not do this, as seen at https://www.youtube.com/watch?v=8d2kd2_iVps), but is done to keep the LeafGreen route consistent with the FireRed route.
The first glitched mail modifies the PID in a way that causes the Attack substructure to be read as the Growth substructure3, the final species and experience does not really matter for our purposes.
After the first glitched mail, we give this new Pokémon a Poké Doll which is index number 80, which will become more significant later on. The next glitched mail will modify the PID so that the Growth substructure will be read as the Attacks substructure. This particular glitched mail also happens to make the game interpret the NINO’s data using its original substructure order, hence why it is a Nidorino again.
After the second glitched mail, the Poké Doll (80) given to NINO is now read as its second move which is Petal Dance (80). This move is then swapped to the first move slot. The next glitched mail modifies the PID in a way that causes the Attacks substructure to be read as the EVs substructure where the index number of the first move becomes the HP and Attack EVs, in this case Petal Dance (80) becomes 80 HP EVs and 0 Attack EVs. This particular PID modification reads the Growth substructure from the same place as before but the Miscellaneous substructure will now be read as the Attacks substructure, which is interpreted as a bunch of glitch moves that usually cause a game crash.
We then prepare NINO for the next (and final) glitched mail, which modifies the PID to read the EVs substructure as the Growth substructure. To do this we give NINO one more HP EV and 3 Attack EVs, totalling to 81 HP EVs and 3 Attack EVs. With the next glitched mail, these will be read as the species index and they will combine (they are combined with this calculation: hpEV + attackEV × 256) to form species index 0x0351 which corresponds to glitch species 0x0351.
After entering the glitched mail, we are left with glitch species 0x0351 that is named NINO.
Below shows what is happening to the PID, TID, SID, encryption key, as well as the substructure order (shown in the parentheses after the corresponding PID) during the process of turning NINO into glitch species 0x0351.
- Personality value (PID)
-
0x00EECA19 (AEMG) → 0x2A6BCA19 (GAME) → 0x2A85CA19 (AEMG) → 0x2A81CA19 (EMAG) → 0x2A6BCA19 (GAME)
- Trainer ID (TID)
-
13637 (0x3545) → 13637 (0x3545) → 13637 (0x3545) → 13637 (0x3545) → 13637 (0x3545)
- Secret ID (SID)
-
0 (0x0000) → (0x2A85) → (0x2A6B) → (0x2A6F) → (0x2A85)
- Encryption key
-
0xEEFF5C → 0xEEFF5C → 0xEEFF5C → 0xEEFF5C → 0xEEFF5C
Credits
- Papa Jefé for originally coming up with this method.
-
The encryption key is formed by this calculation: PID ⊕ (TID + SID × 65536) ↩
-
The minimum required is just having Poison Sting as move 1, and nothing as moves 3 and 4. Move 2 can be anything but instructing everyone to keep it blank keeps the route consistent. ↩
-
You can read more at the provided link (courtesy of Bulbapedia) on how the data substructures are arranged and what is stored in each one. https://bulbapedia.bulbagarden.net/wiki/Pok%C3%A9mon_data_substructures_(Generation_III) ↩↩
-
Like footnote 2, ↩