The Glitchhouse · Pokemon Red and Blue

ZZAZZ

A trainer that was never meant to exist. Its battle floods your wallet to the maximum, scrambles the screen, and can quietly ruin your save, all from a class number the game never finished.

Decoded from a Pokemon Red ROM · part of The Glitchhouse

Every trainer in the game belongs to a class, a number that says who they are and what they carry. The real classes stop at Lance, number forty-seven. Reach a battle whose roster is empty, or whose class number lands past the end of that list, and the game builds a trainer out of whatever memory sits there. One of the most infamous is ZZAZZ, a trainer whose name is a smear of the same letter and whose battle starts by setting your money to its absolute maximum, then keeps writing over memory it does not own. It is the game reading past the edge of itself, wearing the costume of a Trainer.

Where the trainers run out

Every trainer has a class number, and the game keeps a list of them, forty-seven in all. Turn the dial and watch the list end: number 47 is Lance, the last real class, and everything past him is a glitch trainer the game was never designed to build. ZZAZZ lives out there.

Classes 1 to 47 are real trainers, from Youngster to Lance, each with a proper name and team. Past 47 there is no class defined, so the game reads memory as if it were one: garbled names, impossible teams, and effects like ZZAZZ's. The real list simply ran out.

The money overflow

The first thing ZZAZZ does is make you rich, and it is entirely by accident. Your money is not stored as an ordinary number. It lives in exactly three bytes, written in a format called BCD, where each half of a byte holds one decimal digit. Three bytes, six digits, so the most money the game can ever hold is 999,999. As it corrupts memory, ZZAZZ stamps the byte $99 across everything it touches, and those three money bytes are in the way. Each $99 is just the digits nine and nine. Stamp all three and watch the wallet max out.

$000000
wPlayerMoney · 3 bytes, BCD
Money is three bytes of BCD. Tap any byte to split it into its two digits.
Money is stored big-end first: byte one is the top two digits, byte three the bottom two. In BCD a half-byte can only count 0 to 9, so $99 is the largest a byte can mean, and three of them read as exactly 999,999. That is the ceiling ZZAZZ slams you into. The $99 fill is documented by the glitch community; the three-byte BCD money format is straight from the ROM.

What triggers it

So how do you ever meet a trainer the game never wrote? It comes down to a single byte the battle engine reads to decide who you are fighting. That byte does not know the difference between a Pokemon, a real trainer, and a number that should never have been there. Walk the byte from a normal encounter out to where ZZAZZ lives.

25
wCurOpponent
0–199 wild
200–247 real
248+
0200247255
The battle engine reads one byte, wCurOpponent. Below 200 it is a wild Pokemon of that number; 200 and up it subtracts 200 and treats the rest as a trainer class (OPP_ID_OFFSET is exactly 200, from the ROM). Nothing checks that the class actually exists, so a byte of 248 or more names a trainer that was never built. Drag the byte, or step through the story.

The real trigger: an empty roster

The dial and the byte tell you where glitch trainers live, but not the exact thing that sets ZZAZZ off. TheZZAZZGlitch mapped all 14,336 trainer rosters in the game, and the trigger turns out to be simpler and stranger than a bad class number: ZZAZZ fires whenever the game loads a trainer roster that holds no Pokemon at all. A normal roster is a short list of species and levels. An empty one has nothing to send out, and the game reaching for that nothing is what floods your money and corrupts your save. Flip through a few real rosters, then the empty one.

How you reach an empty roster (all from TheZZAZZGlitch): the Ditto / Mew glitch sets the roster by how many times you stat-mod the Ditto, Growl twice loads roster 5, Swords Dance once loads roster 9; roster 0 loads a non-existent roster 256; the Old Man glitch on the Cinnabar coast fights a roster of trainer #256. Any route that lands on an empty roster is ZZAZZ. It then corrupts a link-battle flag that erases the real roster, which is why every ZZAZZ trainer shows a garbled “Charizard ‘M” instead of a real team.

The corruption

Maxing your money is only the first thing ZZAZZ does. Its signature is that it takes the byte $99, the one that made your wallet read 999999, and keeps writing it, over a long unbroken run of memory. It does not aim. It just paints, and a lot of what it paints over is the stuff your game is built from. Let it write, and watch it march through a slice of your save one line at a time.

A slice of your game's memory, still intact. Press the button and let ZZAZZ paint.
The exact spread was mapped by TheZzazzGlitch, the researcher this glitch is named after, not by any manual, but the shape is always the same: a wall of $99 rolling through memory. Your money maxes, your team and bag scramble, and because so much of this is what the save file is copied from, ZZAZZ can quietly ruin a cartridge for good. This writer is calm and photosensitive-safe; the real thing happens in a flash.

Can you survive it

ZZAZZ has a fearsome reputation as a save killer, and it earns half of it. Here is the part that reputation leaves out: everything it wrecks, the maxed money, the scrambled team, the wall of $99, lives in the game's working memory, the temporary scratch the console forgets the instant you power off. The cartridge save is a separate chip, and ZZAZZ only reaches it if you hand it over. Pick what you do next and see whether you walk away.

The one rule that saves cartridges: never save after meeting ZZAZZ. Its damage is written in working memory, which a power-off wipes clean, so a reset almost always leaves your last save whole. It only turns permanent if you copy the garbage to the cartridge yourself by choosing SAVE. Outcomes are honest and vary by console; the crash odds come from the glitch community.

The TMTRAINER family

ZZAZZ is not one trainer, it is a whole clan. The 47 real classes have names in a list; every class number past them just keeps reading, and prints whatever it finds as a name. Slide across the classes and watch the names run out, turn to garbled tiles, and then, past a certain point, get accidentally labelled as TMs, which is where the nickname TMTRAINER comes from.

Classes 1–47 are real, named from the ROM. 48–195 have no name, so the game prints leftover memory as a scramble of tiles (the red blocks are glitch tiles with no letter). From 196 up, a bug in the name routine mistakes the high class number for a TM or HM item, so they come out HM01–HM05 then TM01–TM55, literal TM trainers. A ZZAZZ battle can happen anywhere in this glitch range when the roster is empty. TM/HM name bug verified in home/names2.asm.

The same trick, one table over

Once you see how ZZAZZ works, you start seeing it everywhere. Every glitch on this shelf is the same move: the game keeps a list, you ask for something past the end of it, and it reads on anyway into memory that was never meant to be that kind of thing. ZZAZZ does it to the trainer list. Its relatives do it to other tables, and one of them turns the whole idea into a tool.

Three glitches, one shape: read past the end of a list and take whatever is there as real. ZZAZZ reads past the trainers, Super Glitch reads past the move names, and arbitrary code execution stops reading by accident and starts choosing what the game reads, turning corruption into a language you can write in.

Does it still work

ZZAZZ is not patched out of anything, because it was never a feature to remove; it is a consequence of how the game was built, and that game still ships in every form it always did. What changes from one platform to the next is not whether ZZAZZ happens, but whether you can take it back. Pick where you are playing.

Same glitch everywhere, because it is the same ROM everywhere. The only thing that moves is your safety net: a cartridge has none, so ZZAZZ is genuinely dangerous there; a 3DS restore point or an emulator save state turns the exact same event into something you can undo in a second. Study it on the safe ones.

From the ROM

Everything on this page rests on three small facts, and all three are right there in the game's own source. There is no ZZAZZ routine to find, only these edges, and the empty space just past them.

; constants/trainer_constants.asm  - the real trainer classes
    trainer_const CHANNELER   ; $2D  (45)
    trainer_const AGATHA      ; $2E  (46)
    trainer_const LANCE       ; $2F  (47)  <- the last one ever defined
    ; nothing past here. classes $30 and up have no trainer.

; constants/battle_constants.asm  - how a battle reads its opponent
DEF OPP_ID_OFFSET EQU 200   ; an opponent byte >= 200 is a trainer of class (byte - 200)

; ram/wram.asm  - why the money maxes at 999999
wPlayerMoney:: ds 3   ; three bytes, BCD. $99 $99 $99 reads as 999999.

Line them up and ZZAZZ writes itself: a class past the forty-seven that exist, reached through an empty roster, with a battle that stamps the byte $99 over three BCD money bytes and keeps going. No secret code, just the places the game stops describing itself.

ZZAZZ was never programmed. It is the shape of the empty space just past the last trainer the game bothered to name.

Go deeper: Super Glitch | arbitrary code execution | Mew under the truck | browse the Glitchhouse.