Infinite T-Fly/Rival CT, 9F the Stack Overflow Item and "8 8" the Vblank Item.
Posted by: luckytyphlosion
Date: 2015-01-17 21:05:38
[size=18pt]8CT-Fly/Infinite T-Fly + Rival CT/whatever you want to call it[/size]
Today, the 151 Glitchers were looking into Infinite T-Fly/Rival CT, where you can create a Cooltrainer/Lol Glitch based on the screen tiles using Rival CT, and then continually getting encounters to LG off of by using the Infinite T-Fly glitch.
For now, there isn't a video, so I'll post a link one it gets uploaded.
Another thing I want to talk about, is what 9F actually does.
[size=18pt]The Case of 9F[/size]
Usually, we've used 9F to go to the overworld in a Battle. I decided to look at what exactly 9F does (to make sure if it's safe for the 151 run), and I found it very interesting.
Basically, 9F goes through some warp checks, and after, it jumps to the overworld loop. However, it never actually returns. So basically 9F will continually add to the stack, until it eventually overflows into box nicknames. This can be a problem if you're catching pokemon, like with the 8CT-Fly, or if you switch box.
Usually, the game crashes after catching around 8-9 Pokémon, but it varies depending on how lucky you are with how stack corruption lines up with Pokemon Names + OT Names (or if you're super lucky, Pokemon Stats)
[size=18pt]8 8[/size]
8 8 is also used to generate the Infinite Trainer-Fly, but we never figured out what the effect was, as it ranged from running at ROM4 at 50BF (iirc), or generating the encounter as normal. Again, I decided to look into the item's execution path.
What's interesting about this item is that it lands in the VBlank Interrupt, right at 203D. This means the item effect is based on the VBlank Functions, as well as the return address of where the UseItem function was called. However, since you're dealing with corrupted registers (since you use the four addresses on the stack as the new values for all the registers), the effects of 8 8 depend on the values on the stack.
EDIT: I just realized that the return address of 8 8 depends on the next item on the stack after popping hl, de, bc and af. So it doesn't return like 9F, but it pops 8 bytes off the stack though.