Pokéwalker Info
The Pokéwalker itself does not store the IVs/PID of captured Pokémon. They are generated when the Pokémon is transferred to HG/SS. This means it is abusable through more or less standard methods.
Seeding
The seed is created the usual way, with one major difference: it is created as soon as HG/SS is started, rather than when the Connect to Pokéwalker option is selected. This means the seconds value will be different (I get about 12 seconds less), and the delay is always 0. On the flip side, it makes hitting the correct seed very easy, as you only have to worry about the seconds (not the delay).
IVs
IVs are created the usual way (two LCRNG calls). This means the Wondercard IVs method in RNG Reporter will also work for the Pokéwalker.
However, on the Pokéwalker menu, there is no way to advance the frame manually (no radio, Elm calls etc). Thus, the only way to get a higher-frame spread is to capture and transfer multiple Pokémon from the Pokéwalker without exiting the Pokéwalker menu. Each transferred Pokémon advances the RNG by 2 frames. This means only odd-numbered frames are reachable. If multiple Pokémon are transferred at once, IVs are generated in the order the Pokémon were captured; assuming no frame advances, the first Pokémon captured is on frame 1, the second is on frame 3, and the third is on frame 5. As mentioned earlier, there is no other known way to advance the RNG; this means if you transfer a few Pokémon, the frame will stay the same until another transfer takes place (i.e. it does not reseed upon transfer).
PID (nature, gender, shininess etc)
The PID is created using the IRNG (a Mersenne Twister). In this respect, it is similar to Egg PID creation. However, the actual method is different.
Much like with Wondercards, it forces non-shininess; however, instead of creating a new PID each time until a non-shiny one is found, it incorporates the player's trainer ID into the PID in a way that ensures it cannot be shiny.
The nature is chosen using a call to the IRNG, modulo 24. This means that the Quirky nature cannot be chosen.
The gender is fixed for each type of Pokémon on the Pokéwalker; this is also incorporated when creating the PID.
The ability of the Pokémon is given by the least significant bit of the generated random number (not verified). This suggests that natures are tied to abilities (e.g. it is impossible to get a Brave, Thick Fat Munchlax). I haven't tested this yet (been in Yellow Forest all this time); could anyone verify/disprove this?
Anyway, on to the good bit: the PID generation formula.
Code:
rnd = CallIrng()
nature = rnd % 24 # There are actually 25 natures, so this prevents the Quirky nature being chosen, for some reason.
pid = (((trainerId ^ secretId) >> 8) ^ 0xFF) << 24 # the most significant byte of the PID is chosen so the Pokémon can never be shiny.
nature = nature - (pid % 25) # Adjusts the nature value so that when it is added to the PID, the resulting nature is the same as the original chosen nature. This can underflow to give a negative number.
pid = pid + nature # Creates the PID with the correct nature. If nature is negative, underflows to give a PID in the form 0xXXFFFFYY; otherwise, the PID is in the for 0xXX0000YY.
gr = GenderRate(species) # Gets the gender rate of the Pokémon (0-255; 0 is always male, 254 is always female, and 255 is genderless).
if (gender == male)
pid = pid + ((((gr - (pid & 0xFF)) / 25) + 1) * 25) # Ensures gender is set to male without affecting nature.
else if (gender == female)
pid = pid + (((((pid & 0xFF) - gr) / 25) + 1) * 25) # Ensures gender is set to female without affecting nature.
end if
if ((rnd & 1) != (pid & 1)) # If ability does not match the chosen ability
pid = pid - 25 # Switches ability without affecting nature
end if
return pid
I'm not 100% sure on the gender/ability generation, as they're not really necessary for abusing Pikachu. However, the nature seems to work.
The IRNG is also used for the swirl animation when connecting to the Pokéwalker. The full animation advances the IRNG 192 times; therefore, the PID of the first Pokémon transferred is generated on frame 193. Each PID generated advances it by 1.
This means it can be manually advanced by connecting to the Pokéwalker. The easiest way to do this is to set up the PID beforehand; with the Pokéwalker empty, hit your seed. Then, choose 'Receive Gift' to start the swirl animation; do this as many times as is necessary to hit your correct nature. For example, doing this twice, catching a Pokémon, and transferring it results in a frame of 577 (1 + 192 * 2 + 192).
The advance is only 192 if the connection is completed; while a communication failure also advances the IRNG, it appears to be inconsistent. The above method is consistent, as long as you don't mess up and accidentally get a communication failure.
Note that if you connect multiple times to reach a frame higher than 5, each connection still increases the IRNG by 192 + the number of Pokémon caught.
Miscellaneous
Withdrawing the Pokémon from the Pokéwalker, then depositing it again, seems to reseed the LCRNG. More research into this is needed (is it depositing, withdrawing, or both? Does it reseed with the same seeding formula? Does the IRNG reseed as well?).
How to control the Pokémon appearing (e.g. Surfing Pikachu rather than Flying Pikachu) is unknown at this time, although it probably has something to do with the above.
I think that's pretty much it so far.