Main Menu
Main Page
Forums
New pages
Recent changes
Random page
Help

Glitches
Arbitrary code execution
Pokémon cloning
Pomeg glitch and Glitzer Popping
Tweaking and voiding
Glitches by generation
Glitch categories

References/Resources
Databases
Disassembly projects
The Big HEX List
Pokémon cheat codes
Pokémon glitch terminology
Useful tools
More

Affiliates
Legendary Star Blob 2 (Hakuda) (日本語/Japanese)
Pokémon Speedruns wiki (English)
PRAMA Initiative (Français/French)
MissingNo. Glitch City (Italiano/Italian)
Become an affiliate!

Technical
Site source code

Search Wiki

 

Search Forums

 

Author Topic: Arbitrary code execution in Red/Blue using the "8F" item  (Read 415240 times)

0 Members and 1 Guest are viewing this topic.

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #420 on: July 17, 2016, 06:31:03 am »
Not all Missingno become Rhydons. Only the one that triggers the Pokédex entry.

Also, European versions have more trouble getting a Missingno, since it automatically crashes the game when encountered. Since we have to Cooltrainer him, we need a Ditto, and for that :
* either we obtain it legit east of Fuchsia City, which implies going to the Cycling Road which implies getting the Poké Flute ;
* or we Trainer-Fly the bottom-left Channeler in Sabrina's Gym, which implies getting Cut and beating Silph Co. (unless we find a way to remove the corresponding Rocket using TFly object removal manipulation).

The best solution I can see is the first one.
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

Skeef

  • GCLF Member
  • *
  • Offline Offline
  • Eek!
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #421 on: July 17, 2016, 06:32:40 am »
Remove snorlax glitch? no pokeflute required  8)

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #422 on: July 17, 2016, 06:35:19 am »
Yep, forgot about that one. Is it that Snorlax that is removed ? Or the other ?

Also, here are replacements for Rhydon.
Cubone :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 11 ff 0f         ld   de,0fff
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

Voltorb :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 06 ff            ld b, ff
WRA1:d16b 0f               rrca
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

Gengar :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 0e ff            ld c, ff
WRA1:d16b 0f               rrca
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

Gyarados :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 16 ff            ld d, ff
WRA1:d16b 0f               rrca
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

Chansey :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 28 ff            jr z, d16a ; never occurs because inc h resets this flag
WRA1:d16b 0f               rrca
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

Either Drowzee or hex:38 Missingno will work (if the carry flag is unset, it will be Missingno, otherwise Drowzee)

Drowzee / Missingno :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 30/38 ff         jr nc/c, ff ; Drowzee/Missingno
WRA1:d16b 0f               rrca
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

hex:3E Missingno :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 3e ff            ld a, ff
WRA1:d16b 0f               rrca
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

Other Pokémon work, but they are all glitch Pokémon, so I didn't mention them.

Cubone is Trainer-Flyable in Routes 6, 9, 24, 25, and in Mt. Moon as well as the Rock Tunnel.
Voltorb seems not to be obtained through TFly, but maybe by Ditto tricing.
Gengar is Trainer-Flyable in from Brock, and also in Routes 3, 24 and 25.
Gyarados can be TFlyed in Routes 9, 13 and Mt. Moon.
Chansey can be TFlyed in Routes 8, 13 and Erika's Gym as well as Lavender Town.
Drowzee can be TFlyed in Routes 11, 12, and 14.

I may have missed some TFly spots, but I can guarantee that Voltorb cannot be obtained.
« Last Edit: July 17, 2016, 07:19:35 am by ISSOtm »
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

Skeef

  • GCLF Member
  • *
  • Offline Offline
  • Eek!
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #423 on: July 17, 2016, 06:38:46 am »
You can remove both of them with the glitch. I Don't think you can remove the rocket infront of sabrina's gym with the glitch tho. You could use the safari zone walk through wall glitch to walk through him, but thats alot of work.

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #424 on: July 17, 2016, 07:20:19 am »
I guess it is better to just go to the Cycling Road.
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

Aldrasio

  • GCLF Member
  • Offline Offline
  • Gender: Male
  • Our Lady of Perpetual Underflow
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #425 on: July 17, 2016, 08:44:23 am »
For the Nidoran, you can use trainer-fly to get one at level 1 and then EXP underflow it to 100.
Also, how do you know which trainers result in the pokemon you want in Trainer-Fly? I found http://puu.sh/257S but it is terrible. Mostly because you can't search on images automatically.

That's actually exactly what I used, lol. I had this list open, and for higher-valued indices I looked in places where you'd find higher-level trainers. I also zoomed the image out and kinda scanned for the Pokemon I was looking for. Took a while, but I found what I was looking for.

Either Drowzee or hex:38 Missingno will work (if the carry flag is unset, it will be Missingno, otherwise Drowzee)

Drowzee / Missingno :
Code: [Select]
WRA1:d163 06 0f            ld   b,0f
WRA1:d165 24               inc  h
WRA1:d166 24               inc  h
WRA1:d167 2e 22            ld   l,22
WRA1:d169 30/38 ff         jr nc/c, ff ; Drowzee/Missingno
WRA1:d16b 0f               rrca
WRA1:d16c 00               nop 
WRA1:d16d e9               jp   hl

I just checked, all flags are unset once you jump to the items with 8F. It'd have to be Missingno(38).
« Last Edit: July 17, 2016, 09:00:06 am by Aldrasio »

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #426 on: July 17, 2016, 09:01:09 am »
I used the same method for my overly long post. I searched for Pokémons around the world (while having the image zoomed, of course :P), and wrote my results.
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

Krys3000

  • French living dexer
  • Distinguished Member
  • *
  • Offline Offline
  • Gender: Male
  • Head admin of the PRAMA Initiative
    • View Profile
    • PRAMA Initiative - French Pokémon glitch website
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #427 on: July 17, 2016, 11:30:08 am »
Also, European versions have more trouble getting a Missingno, since it automatically crashes the game when encountered.

To be perfectly correct, you should have said "Non-english european R/B versions have more trouble getting a non-Ghost/Fossil MissingNo. by either Ditto or Old Man glitch"

Admin of the PRAMA Initiative, the main french Pokémon glitch website
https://www.prama-initiative.com
“Anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that 'my ignorance is just as good as your knowledge.'” - Isaac Asimov

Aldrasio

  • GCLF Member
  • Offline Offline
  • Gender: Male
  • Our Lady of Perpetual Underflow
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #428 on: July 17, 2016, 11:54:21 am »
Came up with another script: Change the background music.
  • 8F
  • (any item)
  • Awakening x (sound bank)
  • Lemonade x (song index)
  • TM05 x 161
  • HP UP x 201

Code: [Select]
WRA1:d322 0e xx            ld   c,xx    ; xx for sound bank
WRA1:d324 3e yy            ld   a,yy    ; yy for music index number
WRA1:d326 cd a1 23         call 23a1    ; PlayMusic function
WRA1:d329 c9               ret

And I couldn't find a list of song indices anywhere from googling, so here's one I made from the ROM map on Datacrystal a while ago:

Bank 02 (2):
  • BA (186): Pallet Town
  • BD (189): Pokemon center
  • C0 (192): Gym theme
  • C3 (195): Viridian city
  • C7 (199): Fuschia city
  • CA (202): Celadon city
  • CD (205): Cinnibar island
  • D0 (208): Vermillion city
  • D4 (212): Lavender Town
  • D8 (216): S.S. Anne
  • DB (219): Follow Oak
  • DE (222): Gary fucking Oak
  • E1 (225): Follow someone
  • E5 (229): Safari Zone/evolution
  • E8 (232): Pokemon healed
  • EB (235): Route 1
  • EF (239): Welcome to the world of Pokemon
  • F3 (243): Route 4
Bank 08 (8):
  • EA (234): Gym battle
  • ED (237): Trainer battle
  • F0 (240): Wild battle
  • F3 (243): Final battle
  • F6 (246): Trainer defeated
  • F9 (249): Wild defeated
  • FC (252): Gym leader defeated
Bank 1F (31):
  • C3 (195): Title screen
  • C7 (199): Credits
  • CA (202): Hall of Fame
  • CD (205): Oak's lab
  • D0 (208): Jigglypuff's song
  • D2 (210): Bike riding
  • D6 (214): Surfing
  • D9 (217): Casino
  • DC (220): Intro battle
  • E0 (224): Rocket Hideout
  • E4 (228): Viridian Forest
  • E8 (232): Cave music
  • EC (236): Cinnabar mansion
  • F0 (240): Pokemon Tower
  • F3 (243): Silph Co
  • F6 (246): Meet bad trainer
  • F9 (249): Meet girl trainer
  • FC (252): Meet boy trainer

So, if for example you wanted to play the SS Anne music, you'd need 2 Awakenings and 216 Lemonades. If you wanted to play the Pokemon Tower music, you'd need 31 Awakenings and 240 Lemonades.

Something to note, if you use anything from Bank 02 or Bank 1F in battle, it'll mess with the other battle sound effects. If you use anything from Bank 08 on the overworld, it'll also mess with other sound effects.
« Last Edit: July 17, 2016, 01:14:35 pm by Aldrasio »

Skeef

  • GCLF Member
  • *
  • Offline Offline
  • Eek!
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #429 on: July 17, 2016, 11:55:41 am »
Also, European versions have more trouble getting a Missingno, since it automatically crashes the game when encountered.

To be perfectly correct, you should have said "Non-english european R/B versions have more trouble getting a non-Ghost/Fossil MissingNo. by either Ditto or Old Man glitch"

Tru, My english european red cartidge has no problems with missingno. Nor does my english virtual console. (wich im pretty sure is availible worldwide)

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #430 on: July 17, 2016, 03:25:17 pm »
Also, my French Rouge (Red) 3DS VC has trouble with Missingno. It crashed on me with a single "beep" when I believe it tried to load its sprite.
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

Aldrasio

  • GCLF Member
  • Offline Offline
  • Gender: Male
  • Our Lady of Perpetual Underflow
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #431 on: July 25, 2016, 01:34:54 pm »
Something occurred to me today: Creating a bootstrapping program that takes input from the Gameboy's serial port would be both short to write with items and pretty fast to execute, assuming you had something specifically designed for it attached to the serial port. You could probably make a simple datalink device with an Arduino or something. Has anyone tried this?
« Last Edit: July 25, 2016, 01:48:04 pm by Aldrasio »

ISSOtm

  • The French Lord of Laziness (and a huge The Legend Of Zelda fan)
  • Staff
  • *****
  • Offline Offline
  • Gender: Male
  • Pewter City (B)rocks !
    • View Profile
    • My Little Website
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #432 on: July 25, 2016, 06:40:15 pm »
You named it.
[youtube]http://www.youtube.com/watch?v=3UnB1fomvAw[/youtube]
"THOU SHALL NOT PASS !!"  RIVAL's effect, Gandalf.

Proudly glitching Pokémon Red and Yellow on a Black & White GB, Pocket GB, GB Color, GBA SP and new 3DS.

My Twitter (beware, I'm French)
My YouTube (same warning)

Here is an online tool to build 8F setups : GBz80 to Items !

They see me layzin', they ha-tin'...
Heavy contributor of the global augmentation of entropy (my room's is too damn high !)

Aldrasio

  • GCLF Member
  • Offline Offline
  • Gender: Male
  • Our Lady of Perpetual Underflow
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #433 on: July 25, 2016, 07:34:05 pm »
Yeah, but that TAS's bootstrapper uses the 8 buttons on the Gameboy as 8 bits for input, and it just reads an input each frame. Best you can do with that is 60B/s. With the serial port, if you use the internal clock at its lowest setting you get 1024B/s.

danny

  • Decamark Collector and Pokémaniac
  • Member+
  • *
  • Offline Offline
  • i hate being alive
    • View Profile
Re: Arbitrary code execution in Red/Blue using the "8F" item
« Reply #434 on: July 25, 2016, 08:07:40 pm »
2:48 is CGOL
2:54 is foreshadowing

And I know 60(+8 or something idkaidc) digits of pi
ralsei is my son.

discord: dani#5700