# Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

## Arbitrary Code Execution Discussion

### Arbitrary code execution in Red/Blue using the "8F" item - Page 41

Previous Page

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58

Next Page

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2017-06-20 05:26:03
The offsetting logic is this :
[table]
[tr]
[td]0000-7FFF[/td][td]Offsetting is complex, but things 0000-3FFF shouldn't be offset[/td]
[/tr]
[tr]
[td]8000-9FFF[/td][td]No offsetting[/td]
[/tr]
[tr]
[td]A000-BFFF[/td][td]No offsetting either[/td]
[/tr]
[tr]
[td]C000-D1XX (I think ?)[/td][td]No offsetting[/td]
[/tr]
[tr]
[td]D1XX-DFFF[/td][td]Offset +5[/td]
[/tr]
[tr]
[td]FF80-FFFE[/td][td]No offsetting[/td]
[/tr]
[/table]

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2017-06-20 16:33:16

> The offsetting logic is this :
> [table]
> [tr]
> [td]0000-7FFF[/td][td]Offsetting is complex, but things 0000-3FFF shouldn't be offset[/td]
> [/tr]
> [tr]
> [td]8000-9FFF[/td][td]No offsetting[/td]
> [/tr]
> [tr]
> [td]A000-BFFF[/td][td]No offsetting either[/td]
> [/tr]
> [tr]
> [td]C000-D1XX (I think ?)[/td][td]No offsetting[/td]
> [/tr]
> [tr]
> [td]D1XX-DFFF[/td][td]Offset +5[/td]
> [/tr]
> [tr]
> [td]FF80-FFFE[/td][td]No offsetting[/td]
> [/tr]
> [/table]

The offset +5 is before D1XX because D059 the instant encounter address is D05E in non-English European versions. I wonder where it begins (and the -1 for Yellow)?

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Problems with 8F
Date: 2017-06-21 02:52:08
Thx guys for your very detailed answers. Even if I didnt understand everything I will try your suggestions and post the results :)

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-24 05:34:40
well i readed a lot of posts in these days on this spectacular forum. I am using a pokemon yellow italian version and all i can notice and say to you for receve help is that:
http://forums.glitchcity.info/index.php?topic=6638.msg192543#msg192543 this i think is correct box party i must use:
And here's payload code for FR/ES/DE/IT Yellow. Thanks again to TheZZAZZGlitch, again I only need to change one byte!
1. 20 Pokémon in your PC box [0xDA84 = 0x14]
2. Slowpoke as the 1st Pokémon in the current PC box [0xDA85 = 0x25]
3. Slowpoke as the 2nd Pokémon in the current PC box [0xDA86 = 0x25]
4. Slowpoke as the 3rd Pokémon in the current PC box [0xDA87 = 0x25]
5. Slowpoke as the 4th Pokémon in the current PC box [0xDA88 = 0x25]
6. Slowpoke as the 5th Pokémon in the current PC box [0xDA89 = 0x25]
7. Slowpoke as the 6th Pokémon in the current PC box [0xDA8A = 0x25]
8. Voltorb as the 7th Pokémon in the current PC box [0xDA8B = 0x06]
9. Scyther as the 8th Pokémon in the current PC box [0xDA8C = 0x26]
10. Jolteon as the 9th Pokémon in the current PC box [0xDA8D = 0x68]
11. Geodude as the 10th Pokémon in the current PC box [0xDA8E = 0xA9]
12. Geodude as the 11th Pokémon in the current PC box [0xDA8F = 0xA9]
13. Geodude as the 12th Pokémon in the current PC box [0xDA90 = 0xA9]
14. Geodude as the 13th Pokémon in the current PC box [0xDA91 = 0xA9]
15. Geodude as the 14th Pokémon in the current PC box [0xDA92 = 0xA9]
16. Geodude as the 16th Pokémon in the current PC box [0xDA93 = 0xA9]
17. Geodude as the 15th Pokémon in the current PC box [0xDA94 = 0xA9]
18. Geodude as the 17th Pokémon in the current PC box [0xDA95 = 0xA9]
19. Geodude as the 18th Pokémon in the current PC box [0xDA96 = 0xA9]
20. Geodude as the 19th Pokémon in the current PC box [0xDA97 = 0xA9]
21. Voltorb as the 20th Pokémon in the current PC box [0xDA98 = 0x06]
:: END OF LIST MARKER [0xFF] [0xDA99 = 0xFF]
22. Slowpoke as the 1st Pokémon in the current PC box [0xDA9A = 0x25]
23. First PC box Pokémon needs to have 233 HP -+- [0xDA9B = 0x00]
+- [0xDA9C = 0xE9]
(quote from Wack0)
well now i need to know how use the items and what items i need to use, the correct order. if you can please post it for create items and multiply them x255 becouse im trying to make a legit mew with OT and ID event.
after i have question… i read about 7em etage, should be item replace to ws m in italian and fench version? sry i don t understand if u best can help me i apretice a lot.
thanks and sry if i wrong to ask in this section or about my last posts…
thanks in advance

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Skeef
Date: 2017-06-24 07:35:13
7em etage is for French/Italian Red/Blue, ws m is for Yellow. Tho I don't know if its called that in italian games. Nor if you get it the same way as in english.
The list of Pokémon list is indeed the one you need.
This is how to get w sm in english games. May be the same in italian games. Worth a try i guess.
Do the trainer escape glitch and defeat a Ditto transformed into a Pokémon that has 194 special stat and have X Speed as your 5th item.
And some codes:
Change the second item:
- 8F
- Item to morph x(any)
- X accuracy x36
- Carbos x211
- Max Revive x(decimal index nr of item the you want)
- TM01 x(any)
This one should turn item 2 into what ever the quantity of the Max Revive corresponds with from the big hex list.
http://glitchcity.info/wiki/The_Big_HEX_List
I don't have a euro-language game to test it, but its what i use on my english Red/Blue +4 X Accuracy.
————-
Change item 2 ammount to 256 (0) (actually decreases item ammount by 1)
- 8F
- Item you want 256 of x1
- Pokéball x43
- Revive x201
This one should work on any game.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-24 09:55:54

> 7em etage is for French/Italian Red/Blue, ws m is for Yellow. Tho I don't know if its called that in italian games. Nor if you get it the same way as in english.
> The list of Pokémon list is indeed the one you need.
> This is how to get w sm in english games. May be the same in italian games. Worth a try i guess.
> Do the trainer escape glitch and defeat a Ditto transformed into a Pokémon that has 194 special stat and have X Speed as your 5th item.
> And some codes:
> Change the second item:
> - 8F
> - Item to morph x(any)
> - X accuracy x36
> - Carbos x211
> - Max Revive x(decimal index nr of item the you want)
> - TM01 x(any)
> This one should turn item 2 into what ever the quantity of the Max Revive corresponds with from the big hex list.
> http://glitchcity.info/wiki/The_Big_HEX_List
> I don't have a euro-language game to test it, but its what i use on my english Red/Blue +4 X Accuracy.
> ————-
> Change item 2 ammount to 256 (0) (actually decreases item ammount by 1)
> - 8F
> - Item you want 256 of x1
> - Pokéball x43
> - Revive x201
> This one should work on any game.

Well on pokemon yellow italian version i have this item http://imgur.com/a/bs5sY
than i try as you sayed
-ws m
-item you want 256 of x1
-pokeball x43
-revive x201
and don t work…
about
- 8F
- Item to morph x(any)
- X accuracy x36
- Carbos x211
- Max Revive x(decimal index nr of item the you want)<———- i don t understand what u mean with this… how many i should have?
- TM01 x(any)
Anyway it don t work… i used box with 6 slowpoke voltorb shyter jolteon 10x geodude and voltorb where 1st slowpoke have 233hp.
i wait answer anyway thanks for your help mate
EDIT 1-
To get any item, use this code:
ws# #m#
Item you want to change x any
Burn heal x 43
Ice heal x 43
Revive x 201
and if u give me correct is correct use this for choiche item i need? http://glitchcity.info/biglist.htm
BUT IT DON T WORK
than this too
To get any item quantity, set up your items like so:
ws# #m#
Item you want to increase x 1
Burn or ice heal x 43
Revive x 201 (You should already have this)
DONT WORK.
at last i must use this for change my ID
he item code to change trainer ID is:
any item/ws# #m#
any item/ws# #m#
Lemonade x (xx)
Repel x (yy)
Carbos x 211
X Accuracy x88
Water Stone x115
TM01 x(any)
as we are going for an ID of the GF mew, we want 89 lemonades, and 12 repels. If you want to change your ID back afterward, you need to get it from one of your previously captured pokes (look at summary) and convert it into hexidecimal (there's tonnes of converters online.). Then, split the four digit hexidecimal number into two chunks, the first two digits, and the last two. Then convert those individual chunks back into decimal to find out how many repels and lemonades you need. First chunk is for lemonades, second for repels. Just use ws# #m# to change your ID.
but is this correct?

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Skeef
Date: 2017-06-24 18:12:52
What happens when you try to execute a code? Nothing or does the game crash?
Anything else I can advise is to double check your box to see if the Pokémon are all in the correct order. And to make sure the first Slowpoke has 233 hp left, its max hp does not matter.
Also, I just compared the euro Bootstrap code with the english and i think Scyter may be incorrect there. Replacing Scyter with Kadabra could fix it. Cuz Scyter is dec 26 on the big list, but we need hex 26 <— Thus Kadabra.

> - 8F
> - Item to morph x(any)
> - X accuracy x36
> - Carbos x211
> - Max Revive x(decimal index nr of item the you want)<———- i don t understand what u mean with this… how many i should have?
> - TM01 x(any)

First, look at the big hex list here: http://glitchcity.info/biglist.htm
See the R/B/Y Item column? Say you want to change item 2 into Rare Candy, look in that column for Rare Candy. Now Look in the "Decimal" column on the same row as Rare Candy. As you see its 40, so you need 40 Max Revive to turn item 2 into Rare Candy.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Parzival
Date: 2017-06-24 18:58:03

> What happens when you try to execute a code? Nothing or does the game crash?

> What happens when you try to execute a code?

> [size=24pt]try to execute a code?[/size]

> [size=36pt]execute a code[/size]

[img]http://www.quickmeme.com/img/a2/a2e2c23b6669a334364c83e892bdc9649deeec1aa530b29ce4b6f73f37539d0d.jpg[/img]
Anyway… I have nothing useful to add.
[size=3pt]please don't ban me Abwayax-sama I swear I'll change please no don't cave my account in with your ban hammer[/size]

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-25 04:14:25

> What happens when you try to execute a code? Nothing or does the game crash?
> Anything else I can advise is to double check your box to see if the Pokémon are all in the correct order. And to make sure the first Slowpoke has 233 hp left, its max hp does not matter.
> Also, I just compared the euro Bootstrap code with the english and i think Scyter may be incorrect there. Replacing Scyter with Kadabra could fix it. Cuz Scyter is dec 26 on the big list, but we need hex 26 <— Thus Kadabra.

> > - 8F
> > - Item to morph x(any)
> > - X accuracy x36
> > - Carbos x211
> > - Max Revive x(decimal index nr of item the you want)<———- i don t understand what u mean with this… how many i should have?
> > - TM01 x(any)

> First, look at the big hex list here: http://glitchcity.info/biglist.htm
> See the R/B/Y Item column? Say you want to change item 2 into Rare Candy, look in that column for Rare Candy. Now Look in the "Decimal" column on the same row as Rare Candy. As you see its 40, so you need 40 Max Revive to turn item 2 into Rare Candy.

thanks for last explain i understand all.
anyway about real big problem i tryed right now to change kadabra with shyter and i try
-ws m
-item you want 256 of x1
-pokeball x43
-revive x201
and don t work…
ws# #m#
Item you want to change x any
Burn heal x 43
Ice heal x 43
Revive x 201
BUT IT DON T WORK
ws# #m#
Item you want to increase x 1
Burn or ice heal x 43
Revive x 201
DONT WORK.
well or box party for italian version is wrong or setting items are wrong
About question if my game crash or nothing happen when i try execute a code the answer is NOTHING HAPPEN.
thansk for future helps.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2017-06-25 07:44:08

> > What happens when you try to execute a code? Nothing or does the game crash?
> > Anything else I can advise is to double check your box to see if the Pokémon are all in the correct order. And to make sure the first Slowpoke has 233 hp left, its max hp does not matter.
> > Also, I just compared the euro Bootstrap code with the english and i think Scyter may be incorrect there. Replacing Scyter with Kadabra could fix it. Cuz Scyter is dec 26 on the big list, but we need hex 26 <— Thus Kadabra.

> > > - 8F
> > > - Item to morph x(any)
> > > - X accuracy x36
> > > - Carbos x211
> > > - Max Revive x(decimal index nr of item the you want)<———- i don t understand what u mean with this… how many i should have?
> > > - TM01 x(any)

> > First, look at the big hex list here: http://glitchcity.info/biglist.htm
> > See the R/B/Y Item column? Say you want to change item 2 into Rare Candy, look in that column for Rare Candy. Now Look in the "Decimal" column on the same row as Rare Candy. As you see its 40, so you need 40 Max Revive to turn item 2 into Rare Candy.

> thanks for last explain i understand all.
> anyway about real big problem i tryed right now to change kadabra with shyter and i try
> -ws m
> -item you want 256 of x1
> -pokeball x43
> -revive x201
> and don t work…
> ws# #m#
> Item you want to change x any
> Burn heal x 43
> Ice heal x 43
> Revive x 201
> BUT IT DON T WORK
> ws# #m#
> Item you want to increase x 1
> Burn or ice heal x 43
> Revive x 201
> DONT WORK.
> well or box party for italian version is wrong or setting items are wrong
> About question if my game crash or nothing happen when i try execute a code the answer is NOTHING HAPPEN.
> thansk for future helps.

Darn, yes. Like Skeef said we need to replace Scyther with Kadabra. This will make the execution start at item 3. It looks like Wack0 confused decimal:26 (Scyther) with hexadecimal:26 (Kadabra). Sorry for the inconvenience.
You shouldn't have to change the codes in your previous post as they don't specify an absolute memory address.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-25 09:57:19

> > > What happens when you try to execute a code? Nothing or does the game crash?
> > > Anything else I can advise is to double check your box to see if the Pokémon are all in the correct order. And to make sure the first Slowpoke has 233 hp left, its max hp does not matter.
> > > Also, I just compared the euro Bootstrap code with the english and i think Scyter may be incorrect there. Replacing Scyter with Kadabra could fix it. Cuz Scyter is dec 26 on the big list, but we need hex 26 <— Thus Kadabra.

> > > > - 8F
> > > > - Item to morph x(any)
> > > > - X accuracy x36
> > > > - Carbos x211
> > > > - Max Revive x(decimal index nr of item the you want)<———- i don t understand what u mean with this… how many i should have?
> > > > - TM01 x(any)

> > > First, look at the big hex list here: http://glitchcity.info/biglist.htm
> > > See the R/B/Y Item column? Say you want to change item 2 into Rare Candy, look in that column for Rare Candy. Now Look in the "Decimal" column on the same row as Rare Candy. As you see its 40, so you need 40 Max Revive to turn item 2 into Rare Candy.

> > thanks for last explain i understand all.
> > anyway about real big problem i tryed right now to change kadabra with shyter and i try
> > -ws m
> > -item you want 256 of x1
> > -pokeball x43
> > -revive x201
> > and don t work…
> > ws# #m#
> > Item you want to change x any
> > Burn heal x 43
> > Ice heal x 43
> > Revive x 201
> > BUT IT DON T WORK
> > ws# #m#
> > Item you want to increase x 1
> > Burn or ice heal x 43
> > Revive x 201
> > DONT WORK.
> > well or box party for italian version is wrong or setting items are wrong
> > About question if my game crash or nothing happen when i try execute a code the answer is NOTHING HAPPEN.
> > thansk for future helps.

> Darn, yes. Like Skeef said we need to replace Scyther with Kadabra. This will make the execution start at item 3. It looks like Wack0 confused decimal:26 (Scyther) with hexadecimal:26 (Kadabra). Sorry for the inconvenience.
> You shouldn't have to change the codes in your previous post as they don't specify an absolute memory address.

Well i ll go to replace shyter with kadabra but please can you say me for To get any item quantity, how i must set up my items items?
example : 1st ws m
2nd item x255 x 1
burn heal x43
revive x201
??? which is the setting? this i post not work i need setting for get any item quantity(x255) and to get any item.
thanks again
in the end can u explain how to get ws m? maybe i wrong something

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2017-06-25 12:24:42
We call the item ws m, but it can also show up as ws l m, so this is the correct item.

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-25 12:56:18

> We call the item ws m, but it can also show up as ws l m, so this is the correct item.

mine is ws & m, is correct? and anyway can answer the other question please?

> > > > What happens when you try to execute a code? Nothing or does the game crash?
> > > > Anything else I can advise is to double check your box to see if the Pokémon are all in the correct order. And to make sure the first Slowpoke has 233 hp left, its max hp does not matter.
> > > > Also, I just compared the euro Bootstrap code with the english and i think Scyter may be incorrect there. Replacing Scyter with Kadabra could fix it. Cuz Scyter is dec 26 on the big list, but we need hex 26 <— Thus Kadabra.

> > > > > - 8F
> > > > > - Item to morph x(any)
> > > > > - X accuracy x36
> > > > > - Carbos x211
> > > > > - Max Revive x(decimal index nr of item the you want)<———- i don t understand what u mean with this… how many i should have?
> > > > > - TM01 x(any)

> > > > First, look at the big hex list here: http://glitchcity.info/biglist.htm
> > > > See the R/B/Y Item column? Say you want to change item 2 into Rare Candy, look in that column for Rare Candy. Now Look in the "Decimal" column on the same row as Rare Candy. As you see its 40, so you need 40 Max Revive to turn item 2 into Rare Candy.

> > > thanks for last explain i understand all.
> > > anyway about real big problem i tryed right now to change kadabra with shyter and i try
> > > -ws m
> > > -item you want 256 of x1
> > > -pokeball x43
> > > -revive x201
> > > and don t work…
> > > ws# #m#
> > > Item you want to change x any
> > > Burn heal x 43
> > > Ice heal x 43
> > > Revive x 201
> > > BUT IT DON T WORK
> > > ws# #m#
> > > Item you want to increase x 1
> > > Burn or ice heal x 43
> > > Revive x 201
> > > DONT WORK.
> > > well or box party for italian version is wrong or setting items are wrong
> > > About question if my game crash or nothing happen when i try execute a code the answer is NOTHING HAPPEN.
> > > thansk for future helps.

> > Darn, yes. Like Skeef said we need to replace Scyther with Kadabra. This will make the execution start at item 3. It looks like Wack0 confused decimal:26 (Scyther) with hexadecimal:26 (Kadabra). Sorry for the inconvenience.
> > You shouldn't have to change the codes in your previous post as they don't specify an absolute memory address.

> Well i ll go to replace shyter with kadabra but please can you say me for To get any item quantity, how i must set up my items items?
> example : 1st ws m
> 2nd item x255 x 1
> burn heal x43
> revive x201
> ??? which is the setting? this i post not work i need setting for get any item quantity(x255) and to get any item.
> thanks again
> in the end can u explain how to get ws m? maybe i wrong something

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: TheSixthItem
Date: 2017-06-25 14:17:03

> please don't ban me Abwayax-sama I swear I'll change please no don't cave my account in with your ban hammer

I SAW THAT!
OK but anyway, what is the asm for thezzazzglitch's 20 pokemon ws m bootstrap?

#### Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: asphere
Date: 2017-06-25 15:37:56
???? i need settings for create and multiply items
Previous Page

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58

Next Page