'M (FF), the Charizard one
The last index a single byte can express. At slot 255 the game reads one step past the end of its species table and lands on the number 6, which happens to be Charizard. So this creature borrows everything visible from Charizard: the sprite, the Fire and Flying types, the exact stats. Meet it in battle and you would swear you are fighting the real thing.
The disguise cracks the moment it acts. Its name is a strip of garbage with an 'M lodged in the middle. Its learnset is its own fever dream, read from a pointer that was never meant to be followed: Substitute at level 4, a glitch move at 24, and Fissure if you could somehow reach level 242. The community usually files this specimen alongside Blue's famous Charizard 'M; on a Red cartridge, this is the closest thing wearing the crown.
It is a hybrid glitch, the largest family in this catalogue: invalid index, valid-looking body. The best kind of counterfeit is the one that copies something real.
FIRE FLYING
The bytes
| What | Where in the ROM | Value |
|---|---|---|
| Index number | slot 255 of the species table | 0xFF (255) |
| Pokedex byte | 0x41122 | 6 (borrowed from a real species) |
| Stats entry | 0x3846A | 06 4E 54 4E 64 55 14 02 2D D1... |
| Size byte | entry byte 10 | 0x77 = 7 wide, 7 tall (the buffer holds 7x7) |
| Name bytes | 0x1CC0A | D7 3D 3E 12 E0 8C CD 20 29 CD |
| Catch rate | entry byte 8 | 45 |
Front sprite pointer 0x6286 resolves into ROM bank 0x0D (deterministic) at file offset 0x36286. The decode is deterministic: it looks the same on every cartridge, every time.
Byte for byte identical in Blue.
Base stats
Its stat spread, straight from the entry bytes. Glitch specimens love extremes, a wall with zero attack, or a paper-thin speedster.
Moves
Knows from the start: SCRATCH, GROWL, EMBER, LEER.
Learnset (read straight from its pointer)
| Level | Move |
|---|---|
| L4 | SUBSTITUTE |
| L181 | DOUBLE KICK |
| L186 | THUNDERBOLT |
| L66 | FURY SWIPES |
| L97 | AMNESIA |
| L24 | GLITCH MOVE 0xDE |
| L242 | FISSURE |
| L75 | AMNESIA |
| L20 | FURY SWIPES |
| L140 | RAGE |
| L74 | SUPER FANG |
| L101 | PIN MISSILE |
| L125 | LEECH LIFE |
| L88 | GLITCH MOVE 0xE8 |
| L168 | VINE WHIP |
| L182 | DIZZY PUNCH |
| L213 | LOVELY KISS |
| L183 | BARRAGE |
| L160 | GLITCH MOVE 0xAA |
| L59 | SPORE |
| L90 | PSYBEAM |
| L68 | GLITCH MOVE 0xCA |
| L143 | MEGA KICK |
| L38 | SWIFT |
TM and HM compatibility (flag bits, entry bytes 20 to 26)
| Machine | Move |
|---|---|
| TM01 | MEGA PUNCH |
| TM03 | SWORDS DANCE |
| TM05 | MEGA KICK |
| TM06 | TOXIC |
| TM08 | BODY SLAM |
| TM09 | TAKE DOWN |
| TM10 | DOUBLE-EDGE |
| TM15 | HYPER BEAM |
| TM17 | SUBMISSION |
| TM18 | COUNTER |
| TM19 | SEISMIC TOSS |
| TM20 | RAGE |
| TM23 | DRAGON RAGE |
| TM26 | EARTHQUAKE |
| TM27 | FISSURE |
| TM28 | DIG |
| TM31 | MIMIC |
| TM32 | DOUBLE TEAM |
| TM33 | REFLECT |
| TM34 | BIDE |
| TM38 | FIRE BLAST |
| TM39 | SWIFT |
| TM40 | SKULL BASH |
| TM44 | REST |
| TM50 | SUBSTITUTE |
| HM01 | CUT |
| HM04 | STRENGTH |
Evolutions
| Trigger | Becomes |
|---|---|
| LEVEL 66 (glitch method 0xA9) | MAGIKARP (0x85) |
| LEVEL 162 (glitch method 0x48) | MEW (0x15) |
| LEVEL 211 (glitch method 0x42) | PORYGON (0xAA) |
| LEVEL 213 (glitch method 0x6D) | MISSINGNO. (0xA2) |
| LEVEL 96 (glitch method 0x22) | VENONAT (0x41) |
| LEVEL 154 (glitch method 0x38) | ARTICUNO (0x4A) |
| LEVEL 168 (glitch method 0x70) | NIDORINA (0xA8) |
| LEVEL 132 (glitch method 0xB8) | \x39\xd6\xc94\x38\xcdh\xc0\xcd\xd7 (0xD6) |
Hear its cry
A cry is three bytes the game looks up by index number: a base sound, a pitch, and a length. This specimen reads a base that points past the real cries into data that was never a cry, so it comes out broken straight from the table. I rebuild the sound live from the Game Boy's two pulse channels and its noise channel. This is not a recording.
Does it still work?
This is the question people actually ask about a glitch, so here is the honest answer for this one.
| Where | Still works? |
|---|---|
| Original Game Boy cartridge | Yes. The source of every byte on this page. |
| Game Boy Color / Super Game Boy | Yes, with the auto-assigned palette shown above. |
| 3DS Virtual Console (2016 re-release) | Yes. Nintendo shipped the re-release unpatched, so this is the most accessible way to reach it in 2026. |
| Later remakes (FireRed, Let's Go, and newer) | No. Rebuilt engines, the empty-slot overflow that produces this creature is gone. |
Fight it yourself
This is our from-scratch recreation of the Red battle engine. The enemy team is preset to this specimen; pick your own fighter, glitch or otherwise.
Every number on this page was read from a Pokemon Red ROM by reproducing the game's own out-of-bounds memory reads. Nothing is invented. Part of The Glitchhouse.