Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
Posted by: Torchickens
Date: 2017-11-12 11:17:57
Didn't try it, but judging from the name maybe it is possible to change available charset while typing. Since you can't access menu there it would have to be done via OAM DMA loop.
I came across that address in the past too. It indeed allows you to change the available characters but it seems 05 and up work as if you're nicknaming a Pokémon (so it will say (POKéMON)'s nickname, display a menu sprite and bring up the characters you can input while nicknaming one), and box names (04) happens to be the best menu in terms of available characters. I may be wrong though.
03 is the unused menu for naming your mother.
[img]https://i.imgur.com/Nputhrt.png[/img]
Mother's name is stored at D1AE and can be returned with the hex:49 control character, but since the Dude's demonstration overwrites it it may come up as your player's name.
C5D0 appears to look for where the characters are, and moves them to the other buffer/destination like D8BF (box 1 name). In box names the pointer is CEED. Changing values in the buffer at CEED will print characters on the screen.