Legit Checking Guide
First off you will need a couple of programs.
http://www.4shared.com/file/98201620/be950f67/Legal.html – A legit checker written by Sabresite.
http://www.4shared.com/file/98201613/cb10d1e/Pokesav_DP_40c_EN.html [DP] http://www.4shared.com/file/98201616/7cdbf991/Pokesav_PL_6d_EN.html [PL] – A .pkm editing software written by COM.
http://www.4shared.com/file/98201106/608fde55/Legit_Pokemon_Checker.html – A trash byte checker written by [???].
http://www.4shared.com/file/98201614/92d598bd/TrashBytes.htmlTrash Byte Normalizer – A Trash Byte program written by Sabresite.
Take the .pkm file being checked and drag it onto legal.exe.
If either “Checksum 0xDBB6″, “Gender Check”, “Effort Values”, or “Trash Bytes” is Invalid, then it is hacked.
Next, in the same program Legal.exe, look at the very bottom where it says “type”.
Match the event being checked to what is supposed to be read there. [List coming later].
Now, hit “enter” to close legal.exe. Open up Secure Checker and scan the .pkm with that. If it comes out to the legit side then you’re one step closer!
Now open the .pkm with Pokesav and confirm that all information is correct.
Click on the name, and you can see the trash bytes. Each character of the Pokemon’s name takes up two boxes of data. After the name is finished, there are two “FF” terminators. These tell you that the name has stopped. After those two terminators there should be some code somewhere in the remaining boxes. If there are only “00” then the .pkm did not come from Pal Park or a Wondercard. Trash Byte Values are as follows:
Japanese GBA to English DP
        [B4] [C5] [0C] 
[E0] [FF] [7F]       
English GBA to English DP
  [0D]         
     [A1] [0C]  [E0] [FF]
[Wherever the terminators are placed, that is where the Trash begins. Don’t worry about the trash “hidden” under the name. If the box is empty after the FF’s, there should be trash.]
And there you have it. The complete way to check if an event is legit or not.
Oh, another thing. The “Common GBA Event [Restricted]” and etcetera is unhackable. If the Pokemon was never an event, then you can never change it to look like it was. It it does say the correct type but the trash is gone, that means someone opened it with an old version of Pokesav and saved it. Simply input the trash and check with legal.exe and Secure Checker to confirm. If legal.exe still shows it has invalid trash bytes, then drop the .pkm file onto the normalizer and it will fix it.
If anymore information comes my way or if I remember anything, I’ll be sure to post more. Writing off of the top of my head sucks… ^_^
It gets to become second nature once you do it a lot.