# Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

## Arbitrary Code Execution Discussion

### Arbitrary code execution in Red/Blue using the "8F" item - Page 43

Previous Page

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58

Next Page

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-27 12:46:29

> > THE ITEM CODE TO CHANGE ID u already give it to me i tryed before and it work fine if please say me how to have my own old id back

> Sadly you need to have remembered your old ID to do that but if you know it (check an old Pokémon) let me know and I can give you the code. :)

> > THE ITEM CODE TO CHANGE OT

> OK, I've prepared one for the Italian, French, German and Spanish versions for you:
> Item in slot 1: any item/ws# #m#
> Item in slot 2: any item/ws# #m# (one of these has to be ws# #m#)
> Item in slot 3: TM50 x 185
> Item in slot 4: TM10 x 64
> Item in slot 5: TM34 x 92
> Item in slot 6: TM09 x 4
> Item in slot 7: X Accuracy x43
> Item in slot 7: Full Heal x46
> Item in slot 8: Calcium x52
> Item in slot 9: TM01 x anything
> Item in slot 10+: anything
> [tt]
> code to place at D326 and below for testing on memory editor:
> FA B9 D2 40 EA 5C D1 04 2E 2B 34 2E 27 34 C9
> [/tt]
> To use it prepare a Pokémon named "GF" in party slot 1 and use ws m three times.
> If you want to change it back after getting Mew, change item 3's quantity back to 185 and item 5's quantity back to 92 (this code changes them so it knows which letter you're on), prepare a Pokémon named (Your name) in slot 1, and use ws m for (your name length+1) times.
> Hope this works!

thanks… can you please say me item code about how i catch all pokemon? and how i must use it? because if i must use this:
- ws m
- Item to morph x(any)(meglio 1)
- X accuracy x36
- Carbos x211
- Max Revive x(decimal index nr of item the you want http://glitchcity.info/biglist.htm )
- TM01 x(any)
but where i will have pokemon i use decimal number?
thanks again

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: TheSixthItem
Date: 2017-06-27 16:10:19

> > > THE ITEM CODE TO CHANGE ID u already give it to me i tryed before and it work fine if please say me how to have my own old id back

> > Sadly you need to have remembered your old ID to do that but if you know it (check an old Pokémon) let me know and I can give you the code. :)

> > > THE ITEM CODE TO CHANGE OT

> > OK, I've prepared one for the Italian, French, German and Spanish versions for you:
> > Item in slot 1: any item/ws# #m#
> > Item in slot 2: any item/ws# #m# (one of these has to be ws# #m#)
> > Item in slot 3: TM50 x 185
> > Item in slot 4: TM10 x 64
> > Item in slot 5: TM34 x 92
> > Item in slot 6: TM09 x 4
> > Item in slot 7: X Accuracy x43
> > Item in slot 7: Full Heal x46
> > Item in slot 8: Calcium x52
> > Item in slot 9: TM01 x anything
> > Item in slot 10+: anything
> > [tt]
> > code to place at D326 and below for testing on memory editor:
> > FA B9 D2 40 EA 5C D1 04 2E 2B 34 2E 27 34 C9
> > [/tt]
> > To use it prepare a Pokémon named "GF" in party slot 1 and use ws m three times.
> > If you want to change it back after getting Mew, change item 3's quantity back to 185 and item 5's quantity back to 92 (this code changes them so it knows which letter you're on), prepare a Pokémon named (Your name) in slot 1, and use ws m for (your name length+1) times.
> > Hope this works!

> thanks… can you please say me item code about how i catch all pokemon? and how i must use it? because if i must use this:
> - ws m
> - Item to morph x(any)(meglio 1)
> - X accuracy x36
> - Carbos x211
> - Max Revive x(decimal index nr of item the you want http://glitchcity.info/biglist.htm )
> - TM01 x(any)
> but where i will have pokemon i use decimal number?
> thanks again

https://jpst.it/10wNt (Catch any pokemon)

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-27 19:41:17

> > > > THE ITEM CODE TO CHANGE ID u already give it to me i tryed before and it work fine if please say me how to have my own old id back

> > > Sadly you need to have remembered your old ID to do that but if you know it (check an old Pokémon) let me know and I can give you the code. :)

> > > > THE ITEM CODE TO CHANGE OT

> > > OK, I've prepared one for the Italian, French, German and Spanish versions for you:
> > > Item in slot 1: any item/ws# #m#
> > > Item in slot 2: any item/ws# #m# (one of these has to be ws# #m#)
> > > Item in slot 3: TM50 x 185
> > > Item in slot 4: TM10 x 64
> > > Item in slot 5: TM34 x 92
> > > Item in slot 6: TM09 x 4
> > > Item in slot 7: X Accuracy x43
> > > Item in slot 7: Full Heal x46
> > > Item in slot 8: Calcium x52
> > > Item in slot 9: TM01 x anything
> > > Item in slot 10+: anything
> > > [tt]
> > > code to place at D326 and below for testing on memory editor:
> > > FA B9 D2 40 EA 5C D1 04 2E 2B 34 2E 27 34 C9
> > > [/tt]
> > > To use it prepare a Pokémon named "GF" in party slot 1 and use ws m three times.
> > > If you want to change it back after getting Mew, change item 3's quantity back to 185 and item 5's quantity back to 92 (this code changes them so it knows which letter you're on), prepare a Pokémon named (Your name) in slot 1, and use ws m for (your name length+1) times.
> > > Hope this works!

> > thanks… can you please say me item code about how i catch all pokemon? and how i must use it? because if i must use this:
> > - ws m
> > - Item to morph x(any)(meglio 1)
> > - X accuracy x36
> > - Carbos x211
> > - Max Revive x(decimal index nr of item the you want http://glitchcity.info/biglist.htm )
> > - TM01 x(any)
> > but where i will have pokemon i use decimal number?
> > thanks again

> https://jpst.it/10wNt (Catch any pokemon)

This work for italian version?
And when i use ws m where i ll have pokemon??? Can explain pls?

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: TheSixthItem
Date: 2017-06-28 01:52:30

> > > > > THE ITEM CODE TO CHANGE ID u already give it to me i tryed before and it work fine if please say me how to have my own old id back

> > > > Sadly you need to have remembered your old ID to do that but if you know it (check an old Pokémon) let me know and I can give you the code. :)

> > > > > THE ITEM CODE TO CHANGE OT

> > > > OK, I've prepared one for the Italian, French, German and Spanish versions for you:
> > > > Item in slot 1: any item/ws# #m#
> > > > Item in slot 2: any item/ws# #m# (one of these has to be ws# #m#)
> > > > Item in slot 3: TM50 x 185
> > > > Item in slot 4: TM10 x 64
> > > > Item in slot 5: TM34 x 92
> > > > Item in slot 6: TM09 x 4
> > > > Item in slot 7: X Accuracy x43
> > > > Item in slot 7: Full Heal x46
> > > > Item in slot 8: Calcium x52
> > > > Item in slot 9: TM01 x anything
> > > > Item in slot 10+: anything
> > > > [tt]
> > > > code to place at D326 and below for testing on memory editor:
> > > > FA B9 D2 40 EA 5C D1 04 2E 2B 34 2E 27 34 C9
> > > > [/tt]
> > > > To use it prepare a Pokémon named "GF" in party slot 1 and use ws m three times.
> > > > If you want to change it back after getting Mew, change item 3's quantity back to 185 and item 5's quantity back to 92 (this code changes them so it knows which letter you're on), prepare a Pokémon named (Your name) in slot 1, and use ws m for (your name length+1) times.
> > > > Hope this works!

> > > thanks… can you please say me item code about how i catch all pokemon? and how i must use it? because if i must use this:
> > > - ws m
> > > - Item to morph x(any)(meglio 1)
> > > - X accuracy x36
> > > - Carbos x211
> > > - Max Revive x(decimal index nr of item the you want http://glitchcity.info/biglist.htm )
> > > - TM01 x(any)
> > > but where i will have pokemon i use decimal number?
> > > thanks again

> > https://jpst.it/10wNt (Catch any pokemon)

> This work for italian version?
> And when i use ws m where i ll have pokemon??? Can explain pls?

Yes, This works for EU versions and to execute this you use ws m and then you enter a battle with the pokemon when you close the menu

#### Encounter Random Pokemon/Trainer

Posted by: Couldntthinkofaname
Date: 2017-06-29 08:06:31
[size=12pt]Encounter random Pokemon or trainer[/size]
This code, when used , will encounter a completely random Pokemon or Trainer.
8f
Any Item xAny Qnty
Poke Ball x250
TM11 x255
TM34 x89
TM08 x201
`inc b ; Useless Filler
ld a,($ffd3) ; Put a random number into a
ld ($d059),a ; force encounter with a
ret ; "It's first grade, Spongebob"`
Save your game before using there's a chance you'll encounter a ZZAZZ trainer or a game-crashing pokemon.
Enjoy!

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2017-06-29 09:00:20
Notice : the above code depends on the last Trainer you fought for the level of the opposing Pokémon / the opposing Trainer's roster ID.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-29 14:03:40

> > THE ITEM CODE TO CHANGE ID u already give it to me i tryed before and it work fine if please say me how to have my own old id back

> Sadly you need to have remembered your old ID to do that but if you know it (check an old Pokémon) let me know and I can give you the code. :)

> > THE ITEM CODE TO CHANGE OT

> OK, I've prepared one for the Italian, French, German and Spanish versions for you:
> Item in slot 1: any item/ws# #m#
> Item in slot 2: any item/ws# #m# (one of these has to be ws# #m#)
> Item in slot 3: TM50 x 185
> Item in slot 4: TM10 x 64
> Item in slot 5: TM34 x 92
> Item in slot 6: TM09 x 4
> Item in slot 7: X Accuracy x43
> Item in slot 7: Full Heal x46
> Item in slot 8: Calcium x52
> Item in slot 9: TM01 x anything
> Item in slot 10+: anything
> [tt]
> code to place at D326 and below for testing on memory editor:
> FA B9 D2 40 EA 5C D1 04 2E 2B 34 2E 27 34 C9
> [/tt]
> To use it prepare a Pokémon named "GF" in party slot 1 and use ws m three times.
> If you want to change it back after getting Mew, change item 3's quantity back to 185 and item 5's quantity back to 92 (this code changes them so it knows which letter you're on), prepare a Pokémon named (Your name) in slot 1, and use ws m for (your name length+1) times.
> Hope this works!

i tryed it but i got only half name… i must refill all items each time i use ws m or just at start? can u explain me better please?
than i have to ask how i can retourn to my ID originally? i know i must change number of repel and lemonade can u say me how many?(my originally ID was 13579) :
Item slot 1: any item/ws# #m#
Item slot 2: any item/ws# #m#
Item slot 3: Lemonade x (xx)
Item slot 4: Repel x (xx)
Item slot 5: Carbos x 211
Item slot 6: X Accuracy x93
Item slot 8: Water Stone x115
Item slot 9: TM01 x(any)
Item slot 10+: anything
And last question… is possible to change ID in pokemon silver (2gen)?thanks :)

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2017-06-29 14:38:17
Each time you use ws m, it adds a letter from the first Pokémon's name. So if it was "GF", you would have to use it once to add the "G", a second time to add the "F" and a third time to add the name terminator. You don't have to change the original items in that code as the code will change itself.
For the ID 13579 in the ID changing code, you need Lemonade x53 and Repel x11.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-29 16:51:38

> Each time you use ws m, it adds a letter from the first Pokémon's name. So if it was "GF", you would have to use it once to add the "G", a second time to add the "F" and a third time to add the name terminator. You don't have to change the original items in that code as the code will change itself.
> For the ID 13579 in the ID changing code, you need Lemonade x53 and Repel x11.

ok i understand i success, thanks
and about the question is possible to change ID in pokemon silver (2gen)?is possibile to do it?
thanks :)

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-30 15:03:48

> > > > > > THE ITEM CODE TO CHANGE ID u already give it to me i tryed before and it work fine if please say me how to have my own old id back

> > > > > Sadly you need to have remembered your old ID to do that but if you know it (check an old Pokémon) let me know and I can give you the code. :)

> > > > > > THE ITEM CODE TO CHANGE OT

> > > > > OK, I've prepared one for the Italian, French, German and Spanish versions for you:
> > > > > Item in slot 1: any item/ws# #m#
> > > > > Item in slot 2: any item/ws# #m# (one of these has to be ws# #m#)
> > > > > Item in slot 3: TM50 x 185
> > > > > Item in slot 4: TM10 x 64
> > > > > Item in slot 5: TM34 x 92
> > > > > Item in slot 6: TM09 x 4
> > > > > Item in slot 7: X Accuracy x43
> > > > > Item in slot 7: Full Heal x46
> > > > > Item in slot 8: Calcium x52
> > > > > Item in slot 9: TM01 x anything
> > > > > Item in slot 10+: anything
> > > > > [tt]
> > > > > code to place at D326 and below for testing on memory editor:
> > > > > FA B9 D2 40 EA 5C D1 04 2E 2B 34 2E 27 34 C9
> > > > > [/tt]
> > > > > To use it prepare a Pokémon named "GF" in party slot 1 and use ws m three times.
> > > > > If you want to change it back after getting Mew, change item 3's quantity back to 185 and item 5's quantity back to 92 (this code changes them so it knows which letter you're on), prepare a Pokémon named (Your name) in slot 1, and use ws m for (your name length+1) times.
> > > > > Hope this works!

> > > > thanks… can you please say me item code about how i catch all pokemon? and how i must use it? because if i must use this:
> > > > - ws m
> > > > - Item to morph x(any)(meglio 1)
> > > > - X accuracy x36
> > > > - Carbos x211
> > > > - Max Revive x(decimal index nr of item the you want http://glitchcity.info/biglist.htm )
> > > > - TM01 x(any)
> > > > but where i will have pokemon i use decimal number?
> > > > thanks again

> > > https://jpst.it/10wNt (Catch any pokemon)

> > This work for italian version?
> > And when i use ws m where i ll have pokemon??? Can explain pls?

> Yes, This works for EU versions and to execute this you use ws m and then you enter a battle with the pokemon when you close the menu

When i use this item i find pkmn lv0, can u help me to find lv 30? or some?

> Each time you use ws m, it adds a letter from the first Pokémon's name. So if it was "GF", you would have to use it once to add the "G", a second time to add the "F" and a third time to add the name terminator. You don't have to change the original items in that code as the code will change itself.
> For the ID 13579 in the ID changing code, you need Lemonade x53 and Repel x11.

can you say me if is possible to change ID on pokemon silver 2 gen? thanks

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Skeef
Date: 2017-06-30 16:03:14

> When i use this item i find pkmn lv0, can u help me to find lv 30? or some?

ISSOtm said something about it depending on the last trainer you fought. However when I use that code on red, depositing or withrawing a Pokémon into a box changes the lvl 0 to whatever the lvl of the Pokémon I put in or take out of the box. Worth a try I guess. Make sure you don't mess up your bootstrap box or forget to switch back to it if you do that on yellow though.

> can you say me if is possible to change ID on pokemon silver 2 gen? thanks

There seem to be ways of arbitrary code execution on some gen2 games. But I know verry little of that and I'm not sure this is the right thread to discuss gen 2.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2017-07-01 11:48:27

> > When i use this item i find pkmn lv0, can u help me to find lv 30? or some?

> ISSOtm said something about it depending on the last trainer you fought. However when I use that code on red, depositing or withrawing a Pokémon into a box changes the lvl 0 to whatever the lvl of the Pokémon I put in or take out of the box. Worth a try I guess. Make sure you don't mess up your bootstrap box or forget to switch back to it if you do that on yellow though.

IIRC, the level of the Pokémon you obtain will be based on :
- The level of the last wild Pokémon you fought (if your last fight was against a wild Pokémon)
- The roster ID of the last Trainer you fought (otherwise)
- 0 if you didn't fight since you last started up the game

> > can you say me if is possible to change ID on pokemon silver 2 gen? thanks

> There seem to be ways of arbitrary code execution on some gen2 games. But I know verry little of that and I'm not sure this is the right thread to discuss gen 2.

Indeed. There are a bunch of different ACE exploits, but I can't tell much more (I forgot lol).
Also please, asphere, stop quoting huge posts, I think you should remove the innermost posts. It can get pretty annoying :P

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-07-01 16:17:48
how i can insert this symbol in the nickname of 1 pokemon i catch in yellow? the symbol is '
i want rename a pokemon with apostrophe, how i can do that? becouse when i transfer it on pkmn moon it change name in FARFETCH D, all maiusc without ' and the others 150 pokemon i trasfered change name in correct first letter maiusc the others letters lowercase
can you help me with this?
thanks

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-07-02 04:52:15

> Maybe someone finds a use for this. This code maxes out stat exp and DVs for all stats of the first Pokémon in the current PC box. It uses an absolute address and works only for the European versions of the game, but has only been tested using the German version.
> It does use copious amounts of throwaway inc b instructions to make expressing it in items easier, so there's a good chance it can be optimized in size or require less items with high quantities.
> `; In C without throwaway increments:
> ; a = 0xb8;
> ; h = 0xda;
> ; l = 0xac;
> ; do {
> ; *((h << 8) | l) = 0xff;
> ; l++;
> ; } while (l != a);
> ld a, $b8 ; 3E B8
> ld h, $da ; 26 DA
> ld l, $ac ; 2E AC
> ld (hl), $ff ; 36 FF
> inc b ; 04, throwaway (Poké Ball)
> inc l ; 2C
> inc b ; 04, throwaway (Poké Ball)
> cp l ; BD
> jr nz, $f8 ; 20 F8
> inc b ; 04, throwaway (Poké Ball)
> ret ; C9`
> Or expressed in items:
> [li]Lemonade x184 (3E B8)[/li]
> [li]Carbos x218 (26 DA)[/li]
> [li]X Accuracy x172 (2E AC)[/li]
> [li]Max Revive x255 (36 FF)[/li]
> [li]Poké Ball x44 (04 2C: inc b, inc l)[/li]
> [li]Poké Ball x189 (04 BD: inc b, cp l)[/li]
> [li]Fire Stone x248 (20 F8)[/li]
> [li]Poké Ball x201 (04 C9: inc b, ret)[/li]

> > works only for the European versions of the game, but has only been tested using the German version.

> To convert from a DE/FR/IT/ES WRAM address to an EN one, subtract 5.

For have pokemon shiny when i trasnfer it from pokemon yellow to pokemon 7 gen, i must use this code or is different for italian version?
ps. idk what mean subtract 5 xD. can you say me the right code of items?
thanks
edit: i find this code on youtube but it don t work for ita version https://www.youtube.com/watch?v=5uDQLUi0ZEo&t=44s
thanks

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2017-07-02 09:31:26
Memory-wise, all EU versions are the same. So use the code eironeia posted, it will work.
"Subtracting 5" means "Subtract 5 from the absolute address". If you don't understand that learn GBz80 ASM lol :p
Furthermore, this code will not turn a Pokémon shiny. Just max out its DVs.
Previous Page

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58

Next Page