Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation II Glitch Discussion

Arbitrary code execution in Gold/Silver UE using the Coin Case - Page 5

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Torchickens
Date: 2017-09-26 22:33:43
I discovered a way to get the transferrable GF Mew with Coin Case glitch.

First off you will need a Mew. The Mew can either be traded from Generation I or obtained with the following box names (Return Quagsire holding TM02):

Box 1: Ap0k'vA55
Box 2: é'm2pp0X5
Box 3: éA4p'v7'v'd
Box 4: é(male)2péD9'l
Box 5: 'l5555555
Box 6: 555A'lx'd5

Video demonstration:
https://www.youtube.com/watch?v=NeC36_MhSBA

Once you get a Mew, put it in slot 1 and use three more codes.

Get GF Mew (Return Quagsire holding TM02 box names method):

First use FMK's "required" code:

[REQUIRED] One-off code so all future codes don't need the 'return to game' code:
Box 1 : Ap0w'vA55    (XOR A; OR b6; SUB 0x80)
Box 2 : é'm2p'v7'v'd (LD [d2f8], A; XOR A; SUB fd; SUB d0)
Box 3 : éA355555    (LD [80f9], A)
Box 4+: 55555555    (Safe filler code)
Box 13: 5555péD9    (XOR A; LD [83ff], A)
Box 14: 'l'lA'lx'd55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)


After using it, enter and use the part 1 and part 2 codes below:

Part 1 - "GF" OT:

Box 1: Ap0'd'vG55
Box 2: é22'v9é(multiplication x)2
Box 3: 'v9é&2555
Box 4: 55555555
Box 5: p0'd'vAéA5
Box 6: 5p0FéA55
Box 7: 'v9éA5555

Part 2 GF 22796 ID number:

Box 1: Ap'v'dé's25
Box 2: 'v9é(multiplication x)2p09
Box 3: 'vgéA4p0M
Box 4: 'vA555555
Box 5: 55555555
Box 6: 5555éA45
Box 7: 'v9éA5555

Note: The 'multiplication x' is the "x" left of "(" on caps mode.

The Mew can be uploaded to Poké Transporter and Pokémon Bank if traded back to Generation I:

[img]https://i.imgur.com/csqN4MY.png[/img]
[img]https://i.imgur.com/R0YSSML.png[/img]

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: forsyz
Date: 2017-09-27 00:48:59

I discovered a way to get the transferrable GF Mew with Coin Case glitch.

First off you will need a Mew. The Mew can either be traded from Generation I or obtained with the following box names (Return Quagsire holding TM02):

Box 1: Ap0k'vA55
Box 2: é'm2pp0X5
Box 3: éA4p'v7'v'd
Box 4: é(male)2péD9'l
Box 5: 'l5555555
Box 6: 555A'lx'd5

Video demonstration:
https://www.youtube.com/watch?v=NeC36_MhSBA

Once you get a Mew, put it in slot 1 and use three more codes.

Get GF Mew (Return Quagsire holding TM02 box names method):

First use FMK's "required" code:

[REQUIRED] One-off code so all future codes don't need the 'return to game' code:
Box 1 : Ap0w'vA55    (XOR A; OR b6; SUB 0x80)
Box 2 : é'm2p'v7'v'd (LD [d2f8], A; XOR A; SUB fd; SUB d0)
Box 3 : éA355555    (LD [80f9], A)
Box 4+: 55555555    (Safe filler code)
Box 13: 5555péD9    (XOR A; LD [83ff], A)
Box 14: 'l'lA'lx'd55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)


After using it, enter and use the part 1 and part 2 codes below:

Part 1 - "GF" OT:

Box 1: Ap0'd'vG55
Box 2: é22'v9é(multiplication x)2
Box 3: 'v9é&2555
Box 4: 55555555
Box 5: p0'd'vAéA5
Box 6: 5p0FéA55
Box 7: 'v9éA5555

Part 2 GF 22796 ID number:

Box 1: Ap'v'dé's25
Box 2: 'v9é(multiplication x)2p09
Box 3: 'vgéA4p0M
Box 4: 'vA555555
Box 5: 55555555
Box 6: 5555éA45
Box 7: 'v9éA5555

Note: The 'multiplication x' is the "x" left of "(" on caps mode.

The Mew can be uploaded to Poké Transporter and Pokémon Bank if traded back to Generation I:

[img]https://i.imgur.com/csqN4MY.png[/img]
[img]https://i.imgur.com/R0YSSML.png[/img]


would it work with celebi to. also a challenge would to make a memory editor with box names so you can do almost any thing with one box name setup

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: forsyz
Date: 2017-09-28 09:12:40
can't get walkthough walls to work https://www.youtube.com/watch?v=1w2iQdAHPh4 it crashes the game

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Torchickens
Date: 2017-09-28 12:14:29

can't get walkthough walls to work https://www.youtube.com/watch?v=1w2iQdAHPh4 it crashes the game


The reason for this may be a bad emulation problem on the 3DS Virtual Console. I think the OAM DMA exploit (used there for walk through walls) working relies on an obscure hardware detail that only platforms like real hardware or BGB emulator correctly emulate.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: forsyz
Date: 2017-09-29 02:33:13


can't get walkthough walls to work https://www.youtube.com/watch?v=1w2iQdAHPh4 it crashes the game


The reason for this may be a bad emulation problem on the 3DS Virtual Console. I think the OAM DMA exploit (used there for walk through walls) working relies on an obscure hardware detail that only platforms like real hardware or BGB emulator correctly emulate.

i forgot to use the letters with the commas in front my bad it works now on the vc version

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: ISSOtm
Date: 2017-09-29 05:44:51
Also OAM DMA doesn't rely on any obscure detail, only on a simple feature used by almost all games. It couldn't be emulated incorrectly, no matter how crappy the emulator.
[size=1pt]And god knows the VC is a crappy one.[/size]

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-09-29 06:17:27


Is there any method to make a pokemon learn a specific move with the coin case? Mainly so that I could get Aeroblast on Lugia in Gold Version since that isn't possible otherwise. Using the method where you only use Box Names if possible similar to this video by Torchikens https://youtu.be/NeC36_MhSBA


It's most certainly possible – and actually extremely simple for Aeroblast in particular, though to use any of my Coin Case ACEs you need to do the following first:

[REQUIRED] One-off code so all future codes don't need the 'return to game' code:
Box 1 : Ap0w'vA55    (XOR A; OR b6; SUB 0x80)
Box 2 : é'm2p'v7'v'd (LD [d2f8], A; XOR A; SUB fd; SUB d0)
Box 3 : éA355555    (LD [80f9], A)
Box 4+: 55555555    (Safe filler code)
Box 13: 5555péD9    (XOR A; LD [83ff], A)
Box 14: 'l'lA'lx'd55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)

Pokemon 5, Move 4 Modifier (Aeroblast) - Box 1, change r to whatever and replace 5555 with 'v(Letter)55 or 'v(Letter)'v(Letter) when needed:
Box 1: Ap0r5555  (XOR A; OR b1)
Box 2: é455555  (LD [efda], A)
Box 3+: 55555555
Box 13 and 14: Should never be modified after using the required code.



I'm having some trouble using your code.
Doing the Glitch with the required no further return-to-game code as my boxnames my Game freezes after using the Coin Case.
I'm using the same slide-Pokémon and Quagsire as with the (working) Shinify/Turn-Egg-to-Celebi codes from Torchickens' video.
Does anyone by chance have a Screenshot/Video of the box-names so I can check if I missed some ' flying around unnoticed.

I'm using Pokémon Silver VC if that matters.

Oh and out of curiosity:
Where on the slide-mon does the code start to run and can you use this to predict success just by looking at stats?

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Torchickens
Date: 2017-09-29 09:22:28
The first party address that the code starts to run is at FA98 (DA98). This is the second byte of the Attack stat experience of Pokémon 3 (the slide Pokémon).

Following this is Defense, Speed, Special stat experience as well as DVs, PPs, happiness, Pokérus, level, status, stats. You can probably predict whether the Pokémon will work by looking at the stats but I don't know the details sadly.

Since your slide Pokémon no longer works it's possible the problem could be due to one of the above variables changing, such as happiness increasing to a 'bad' opcode; the solution being to increase or decrease the happiness until it works. Another cause could be if you made your slide Pokémon gain some experience.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Torchickens
Date: 2017-09-29 09:29:09

Also OAM DMA doesn't rely on any obscure detail, only on a simple feature used by almost all games. It couldn't be emulated incorrectly, no matter how crappy the emulator.
[size=1pt]And god knows the VC is a crappy one.[/size]


I see. I was thinking about the "RNG Plays Pokémon" 8F code though. It's an OAM DMA exploit that works on BGB and real hardware but not VBA. However it's good that the walk through walls exploit works on VC.

http://forums.glitchcity.info/index.php?topic=7155.0

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-09-29 16:04:54

The first party address that the code starts to run is at FA98 (DA98). This is the second byte of the Attack stat experience of Pokémon 3 (the slide Pokémon).

Following this is Defense, Speed, Special stat experience as well as DVs, PPs, happiness, Pokérus, level, status, stats. You can probably predict whether the Pokémon will work by looking at the stats but I don't know the details sadly.

Since most of them are naturally hidden (statXP, happiness, etc.) prediction would be difficult I guess. At least statXP and happiness should be fixed at the start though, but I guess trial and error is good enough for now.

Since your slide Pokémon no longer works it's possible the problem could be due to one of the above variables changing, such as happiness increasing to a 'bad' opcode; the solution being to increase or decrease the happiness until it works. Another cause could be if you made your slide Pokémon gain some experience.


Thing is, it does still work for the shinify-Code for example, at least somewhat.
My sprite is vanishing and there's menu-lag (no freeze), but for whatever reason it doesn't turn the first mon shiny.
Also tried with a different slide-mon and same result, but box-names should be correct (checked multiple times).


Thanks for you time.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: forsyz
Date: 2017-09-29 22:30:28
what letters in the box code are the address and the value it changes i want to use it like a memory editor

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Storyreader21
Date: 2017-10-08 19:39:05
Hey, I have a question. I've seen coin case codes for getting shiny pokemon with an attack DV of 14 which is male, and a level 98 pokemon with perfect dvs, but is there one for getting shiny pokemon with an attack dv of 2 (thus female), and a code for getting to level 98 without effecting DVs (this is so I can get my Unown to a high level without changing what letter they are.  Either with an item list, or box name method, though if a box name then please explain how to set that up cause I'm a bit confused on that method. Thanks.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Nostalgia
Date: 2017-10-09 11:20:49
Is it possible to get the evolutionary stones with the Coin Case? In Gold/Silver you can't get Water Stones, Fire Stones etc - until after the Elite Four. I'm so used to playing Crystal where you can get them much earlier. Would be helpful to get the stones earlier for team choices and for filling out the Pokedex.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Lost-Paisley
Date: 2017-10-10 03:02:39
Torchickens I've still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I'm still not getting anything.

Are you really sure there's nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well?
I've been doing the steps exactly with a few differences in the beginning, namely:



I've double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.  :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.

Here's a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png
I've gone through at least 50+ mons for slot 3 and none of them worked…

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Nostalgia
Date: 2017-10-10 06:17:07

Torchickens I've still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I'm still not getting anything.

Are you really sure there's nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well?
I've been doing the steps exactly with a few differences in the beginning, namely:


    [li]Saving outside a grass patch before catching the mon for slot 3 so I can catch a new one if the one in slot 3 fails to work and save having to buy more poke balls
    [/li][li]Pokemon in slots 2 and 5 are clones of the same mon and they don't trigger the glitch if put in slot 3
    [/li][li]Healing the party after catching the mon for slot 3
    [/li]


I've double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.  :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.

Here's a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png
I've gone through at least 50+ mons for slot 3 and none of them worked…


Torchickens helped me with a code to change my trainer ID, but I can't get her rare candy video code to work. I assume it was because I needed a new slide pokemon, but like you I used a lot of slide Pokemon and nothing. :/ I was doing your steps too, saving near the grass to get a new slide Pokemon if it didn't work because it saved a bit of time. I remember in the originals messing around with the Coin Case a few years back, it seemed easier to get a working slide Pokemon then it does in the VC games. Idk why. And older videos on Coin Case glitches suggested a low level female Pokemon tend to work better, I assume it's because female Pokemon have a worse attack stat and therefore more likely a bad DV spread. I'm not sure if this 100% true, but I have messed around with the Coin Case a lot and it seemed a low level female Pokemon seemed to work better and when I started playing VC Gold and used the Coin Case to change my trainer ID, I used a female level 3 Sentret.

Weirdly though, the Sentret stopped working as a slide Pokemon, I assume because of a happiness increase from walking with it, but I fainted it twice to reset it happiness but it still didn't work. :/