Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
Posted by: spamviech
Date: 2017-12-28 21:19:23
Maximize all PC items (quantity x 255) while leaving the item type unchanged.
1) A p 'v 5 é 4 2 5 XOR A; SUB fb; LD [faf8], A | A->05
2) 'v 9 é / 2 p 'v . SUB ff; LD [f3f8], A; XOR A; SUB e8 | A->06; A->18
3) é 0 2 'v 2 é 5 2 LD [f6f8], A; SUB f8; LD [fbf8], A | A->20
4) 'v 9 é 2 'v 9 5 SUB ff; LD [f5f8], A; SUB ff | A->21; A->22
5) é 2 2 'v 9 é 3 2 LD [f8f8], A; SUB ff; LD [f9f8], A | A->23
6) 'v é , 2 0 9 9 SUB f1; LD [f4f8], A; OR ff; LD B, 32 | A->32
7) 0 0 0 5 5 5 5 5 LD HL, 18f6; LD [HLI], A; INC HL; DEC B; JR NZ, fb | HL->f618
8) x 'd OR A; RET NC
Fun little thing about x0 quantity (at least in the PC):
You can withdraw/toss any quantity you want, it won't change the quantity of the item. While tossing obviously does nothing, withdrawing works without problems (creates items).
Depositing an additional item of the type simply adds the amount which restores normal functionality.
Possibly also works in the inventory to give you an infinite amount of an item, but I didn't test that.