Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
Posted by: Skeef
Date: 2017-11-01 14:37:41
Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.
You can join Glitch City Research Institute to ask questions or discuss current developments.
You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.
To execute ace you have to go into the over world though to get into the bag to use tm 25
What the code does:
Self-mods. A lot.
Unlocks SRAM
Switches to SRAM bank 1
Loads $?? Into $ADCD
Thats not an issue since you go to your item pack before unlocking SRAM.
Also
What the code does:
Self-mods. A lot.
Unlocks SRAM
Switches to SRAM bank 1
Loads $?? Into $ADCD
$ADCD is the third pokémon first HP EV adress. I hope thats just a typo.
Can't get it to work the adresss where pc box pokemon are stored is still all 0s when i unlock the sram and switch banks. Also doesn't the 3ds vc emulator not emulate sram locking if it doesn't why won't the memmory editor let me write to the sram.
Writing to only one address instead of two will make the Pokémon an unstable hybrid. You should load to $AD62, because the generated hybrid could then be fixed by depositing it into the Daycare then back.
What the code does not do:
Load $?? Into $AD82, meaning the name on the stats page stays the same (AFAIK this affects nothing)
Can't get it to work the adresss where pc box pokemon are stored is still all 0s when i unlock the sram and switch banks. Also doesn't the 3ds vc emulator not emulate sram locking if it doesn't why won't the memmory editor let me write to the sram.
Writing to only one address instead of two will make the Pokémon an unstable hybrid. You should load to $AD62, because the generated hybrid could then be fixed by depositing it into the daycare and back
What the code does not do:
Load $?? Into $AD82, meaning the name on the stats page stays the same (AFAIK this affects nothing)
Has any one tested this since the vc emulator does not emulate sram locking so it mean you only need to switch banks?
Writing to only one address instead of two will make the Pokémon an unstable hybrid. You should load to $AD62, because the generated hybrid could then be fixed by depositing it into the daycare and back
What the code does not do:
Load $?? Into $AD82, meaning the name on the stats page stays the same (AFAIK this affects nothing)
What's $AD62? Can't find it on the RAM map.
Edit: You're likely referring to $AD82. Do you mean to load it with or as opposed to $AD6D? If it's the forward, it may not be possible due to the heavy amount of SMC.