Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation II Glitch Discussion

Arbitrary code execution in Gold/Silver UE using the Coin Case - Page 6

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Torchickens
Date: 2017-10-10 09:30:41

Torchickens I've still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I'm still not getting anything.

Are you really sure there's nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well?
I've been doing the steps exactly with a few differences in the beginning, namely:


    [li]Saving outside a grass patch before catching the mon for slot 3 so I can catch a new one if the one in slot 3 fails to work and save having to buy more poke balls
    [/li][li]Pokemon in slots 2 and 5 are clones of the same mon and they don't trigger the glitch if put in slot 3
    [/li][li]Healing the party after catching the mon for slot 3
    [/li]


I've double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.  :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.

Here's a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png
I've gone through at least 50+ mons for slot 3 and none of them worked…



Hmm I had a look a few times and found a problem with your box names. It looks like you used a "d" instead of "'d". If you don't use the 'd the game doesn't create an inc sp opcode that is responsible for not freezing the game.

[img]https://i.imgur.com/VuttHvd.png[/img]

Otherwise, I'm afraid I really don't know sorry. Somebody sent me a message saying they tried over 300 slide Pokémon with no success, which has affected my confidence in the glitch. It would be interesting if the Coin Case glitch does work slightly differently on 3DS Virtual Console, as unlikely as it appears.

I've just realized something. I wonder if OT names could be a problem (but I can't find anything that messes with the stack). The name TAYLOR seems to be fine, however. The Trainer ID shouldn't be a problem because the game doesn't read DA90, DA91 (it goes to DA98, so only Pokémon 3 addresses beyond that should matter).



Torchickens I've still been trying to turn my Ditto shiny via the Coin Case+Box method from your vid and I'm still not getting anything.

Are you really sure there's nothing else other than a bad slide pokemon in slot 3 that could prevent the glitch from working? Do the mons in slots 2 and 5 have to work as well?
I've been doing the steps exactly with a few differences in the beginning, namely:


    [li]Saving outside a grass patch before catching the mon for slot 3 so I can catch a new one if the one in slot 3 fails to work and save having to buy more poke balls
    [/li][li]Pokemon in slots 2 and 5 are clones of the same mon and they don't trigger the glitch if put in slot 3
    [/li][li]Healing the party after catching the mon for slot 3
    [/li]


I've double checked my box names and everything and yet I still get either funky color resets or the game freezing on a white screen.  :-\ Someone else also seemed to mention to me that if a mon has a Special Defense/Speed stat of 9 it will never work too.

Here's a few pictures of my save position, mon in slots 2+5 and my box names: https://i.imgur.com/AWdmtyM.png
I've gone through at least 50+ mons for slot 3 and none of them worked…


Torchickens helped me with a code to change my trainer ID, but I can't get her rare candy video code to work. I assume it was because I needed a new slide pokemon, but like you I used a lot of slide Pokemon and nothing. :/ I was doing your steps too, saving near the grass to get a new slide Pokemon if it didn't work because it saved a bit of time. I remember in the originals messing around with the Coin Case a few years back, it seemed easier to get a working slide Pokemon then it does in the VC games. Idk why. And older videos on Coin Case glitches suggested a low level female Pokemon tend to work better, I assume it's because female Pokemon have a worse attack stat and therefore more likely a bad DV spread. I'm not sure if this 100% true, but I have messed around with the Coin Case a lot and it seemed a low level female Pokemon seemed to work better and when I started playing VC Gold and used the Coin Case to change my trainer ID, I used a female level 3 Sentret.

Weirdly though, the Sentret stopped working as a slide Pokemon, I assume because of a happiness increase from walking with it, but I fainted it twice to reset it happiness but it still didn't work. :/




Interestingly that's the same trick somebody tried with over 300 slide Pokémon as well.

When I test both box name codes they work perfectly on my side, so the only thing I know might be wrong if the slide Pokémon persistently doesn't work on 3DS Virtual Console is to make sure you haven't made a small mistake in the box names (regardless of how small), to switch item pockets (underlined as it's easy to forget) before using the Coin Case and after listening to Bellsprout's cry, and to make the correct movements.

If you or Nostalgia have 3DS CFW and still can't get it to work you can send me your save file if you like and I'll try to see what's wrong. :)

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Nostalgia
Date: 2017-10-10 12:26:10
It worked yes! I too had written a d instead of a 'd in the box names haha.

And I used a freshly hatched Magby as my slide Pokemon, so maybe for those struggling with slide Pokemon try a freshly hatched egg Pokemon.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Torchickens
Date: 2017-10-10 15:00:05

It worked yes! I too had written a d instead of a 'd in the box names haha.

And I used a freshly hatched Magby as my slide Pokemon, so maybe for those struggling with slide Pokemon try a freshly hatched egg Pokemon.


Awesome! Congratulations :D

I relate. It's easily done. Often I make mistakes like this in glitching too, like when recording something I might forget something or mess something up.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Lost-Paisley
Date: 2017-10-10 17:16:32

Hmm I had a look a few times and found a problem with your box names. It looks like you used a "d" instead of "'d". If you don't use the 'd the game doesn't create an inc sp opcode that is responsible for not freezing the game.

Otherwise, I'm afraid I really don't know sorry. Somebody sent me a message saying they tried over 300 slide Pokémon with no success, which has affected my confidence in the glitch. It would be interesting if the Coin Case glitch does work slightly differently on 3DS Virtual Console, as unlikely as it appears.

I've just realized something. I wonder if OT names could be a problem (but I can't find anything that messes with the stack). The name TAYLOR seems to be fine, however. The Trainer ID shouldn't be a problem because the game doesn't read DA90, DA91 (it goes to DA98, so only Pokémon 3 addresses beyond that should matter).

Interestingly that's the same trick somebody tried with over 300 slide Pokémon as well.

When I test both box name codes they work perfectly on my side, so the only thing I know might be wrong if the slide Pokémon persistently doesn't work on 3DS Virtual Console is to make sure you haven't made a small mistake in the box names (regardless of how small), to switch item pockets (underlined as it's easy to forget) before using the Coin Case and after listening to Bellsprout's cry, and to make the correct movements.

If you or Nostalgia have 3DS CFW and still can't get it to work you can send me your save file if you like and I'll try to see what's wrong. :)


Wow, I can't believe I didn't see that :-[

Tried again, and it seemed like it worked but the game froze/crashed to a white screen after I pressed B when it displayed my coins. At least I got somewhere :'D

Tired a second time and it worked!!! ;D
[img]https://i.imgur.com/tXFUDSJ.png[/img]
That lag tho like wow

TAYLOR is one of the names to choose from in the beginning so who knows, it'd be interesting if player names did effect it in some degree.


So the box names are corrupted like you said, but if I wanted to do this again with another mon I don't have to rename them right? And there's no harm to any mons in the boxes either?


Weirdly though, the Sentret stopped working as a slide Pokemon, I assume because of a happiness increase from walking with it, but I fainted it twice to reset it happiness but it still didn't work. :/

Happiness can effect the glitch?  :???:

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Flandre Scarlet
Date: 2017-10-10 20:26:44

So the box names are corrupted like you said, but if I wanted to do this again with another mon I don't have to rename them right? And there's no harm to any mons in the boxes either?

I am not sure but it would be best to just redo any corrupted box names. Normally its only 1-2 and the visual corruption from them makes it look like the others are corrupted but really aren't (just exiting and entering the menu again should let you know if anything is still corrupted) boxes 13-14 however should be kept the same if you are using that method.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Nostalgia
Date: 2017-10-11 06:51:35

Happiness can effect the glitch?  :???:


Yes, Torchickens informed me of that and recommended to not walk too much with your slide Pokemon and put it in the PC when not using it. Though it seems because I had a tiny error with the box names, there was probably nothing wrong with my slide Pokemon but I still ended up releasing it thinking it had become useless, RIP Sentret.

But got it working with a freshly hatched Pokemon so all is good. I was just working on my Pokedex and breeding a Magmar to get a Magby and it turned out the Magby worked perfectly as a slide Pokemon, which is great, better then wasting time on Route 29 catching 20 odd Pokemon they may not even work for the glitch.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Lost-Paisley
Date: 2017-10-13 03:19:34

Yes, Torchickens informed me of that and recommended to not walk too much with your slide Pokemon and put it in the PC when not using it.


I'll be keeping that in mind~ how many steps does it take for the mon to develop its happiness value? And does it decrease if left in the box?

I'm curious, the box codes that let you change one mon to another, if you have an egg that is shiny (let's say it's a Wooper for example) and you alter it into a different mon (like Zapdos) via the box codes, would the egg result in a shiny Zapdos?

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Nostalgia
Date: 2017-10-13 12:58:23

I'll be keeping that in mind~ how many steps does it take for the mon to develop its happiness value? And does it decrease if left in the box?

I'm curious, the box codes that let you change one mon to another, if you have an egg that is shiny (let's say it's a Wooper for example) and you alter it into a different mon (like Zapdos) via the box codes, would the egg result in a shiny Zapdos?


Happiness won't decrease if left in the box. And I'm not sure, but I think if the slide Pokemon gets any noticeable happiness increase then it will mess up the code, because the slide Pokemon has to be freshly caught or hatched with no stat experience and happiness is another one of those factors I guess.

However, I was using the coin case a lot yesterday with the same slide Pokemon and walking from the PC in Cherrygrove to outside the mart in Cherrygrove for coin cases glitches, when you repeat that enough times you're certainly walking a good number of steps, but still my slide Pokemon still worked. And today I was using the hatched Togepi as a slide Pokemon as a test and it worked, so I would certainly recommend freshly hatched Pokemon.

As for your question, I haven't messed around with shiny codes yet but if the first code changed the egg to shiny and then you changed the Pokemon species then it should still be shiny as that is determined by the DV's which are made when you use you shiny code.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-13 17:20:57


I'll be keeping that in mind~ how many steps does it take for the mon to develop its happiness value? And does it decrease if left in the box?

I'm curious, the box codes that let you change one mon to another, if you have an egg that is shiny (let's say it's a Wooper for example) and you alter it into a different mon (like Zapdos) via the box codes, would the egg result in a shiny Zapdos?


Happiness won't decrease if left in the box. And I'm not sure, but I think if the slide Pokemon gets any noticeable happiness increase then it will mess up the code, because the slide Pokemon has to be freshly caught or hatched with no stat experience and happiness is another one of those factors I guess.

However, I was using the coin case a lot yesterday with the same slide Pokemon and walking from the PC in Cherrygrove to outside the mart in Cherrygrove for coin cases glitches, when you repeat that enough times you're certainly walking a good number of steps, but still my slide Pokemon still worked. And today I was using the hatched Togepi as a slide Pokemon as a test and it worked, so I would certainly recommend freshly hatched Pokemon.

As for your question, I haven't messed around with shiny codes yet but if the first code changed the egg to shiny and then you changed the Pokemon species then it should still be shiny as that is determined by the DV's which are made when you use you shiny code.

Not quite. Even if your slide's happiness value increases, it doesn't matter too much unless it reaches a malicious opcode. What I mean by that is, any opcode that changes code flow (call,ret,jp,jr), any opcode that stops the cpu (stop, and MAYBE halt, I'm not quite sure), any op that messes with the stack (inc sp,push,pop,ld sp,rst,etc.), any invalid ops ($D3,$DB,$DD,$E3,$E4,$EB,$EC,$ED,$F4,$FC,$FD), and "di".

The Happiness value increments upon walking 256 steps, and when freshly caught, has a value of $00. The first "malicious" opcode it encounters first is "stop", which is hex $10. So, a freshly caught slide pokemon is considered "broken" after 4096 steps. However, you can easily set this value to $11 (ld de,$xxyy) by walking 256 more steps. So if you find that your slide has stopped working, walk 256 more steps and see if that fixes it.

Also, it is worth noting that happiness is not the only thing that affects slide pokemon.
Here's a list of all factors that affect slide pokemon:

Attack EV
Defense Ev
Speed EV
Special EV
Attack/Defense IV
Speed/special IV
PP of current moveset
Happiness/Hatch Time
Pokerus
Caught Information
Level
Status
Hp
Max Hp
Attack
Defense
Speed
Special Defense
Special Attack - Must correspond to an instruction that is one byte long, otherwise the jump instruction that executes your code will be absorbed!

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-10-18 09:21:08

what letters in the box code are the address and the value it changes i want to use it like a memory editor


Have a look at this post from torchickens
To construct the memory adress using Box names use the big hex list (doesn't contain GSC characters) linked Pastebin or sth. similar.



The first party address that the code starts to run is at FA98 (DA98). This is the second byte of the Attack stat experience of Pokémon 3 (the slide Pokémon).

Following this is Defense, Speed, Special stat experience as well as DVs, PPs, happiness, Pokérus, level, status, stats. You can probably predict whether the Pokémon will work by looking at the stats but I don't know the details sadly.

Since most of them are naturally hidden (statXP, happiness, etc.) prediction would be difficult I guess. At least statXP and happiness should be fixed at the start though, but I guess trial and error is good enough for now.


Was tired of trial and error so I constructed a method to create a working slide-Pokémon. You basically get the right amount of stat-Exp to pass the atk-stat and use jr $1F in the Def-stat to jump right to your fourth Pokémon which should be the well-known Quagsire holding TM02 with Return as its first move.

To do this take one newly caught Pokémon and defeat exactly the following Pokémon:


This leaves your Pokémon at 870 ($0366) Atk stat-Exp and 6175 ($181F) Def stat-Exp (rest is skipped).

Starting at the second byte of the Atk stat-Exp this produces the following code:
ld h,(hl)
jr $1F

Which then continues at Pokémon 4 to jump to wherever you want.

Hope this helps anyone having trouble catching a working slide Pokémon. This way, as long as you don't defeat any Pokémon afterwards (Exp. Share counts) your Slide-Pokémon will continue working, regardless of Happiness, moves, or anything else.
Disadvantage obviously is the time it takes to set up, but this could in theory be improved (use always-available Pokémon instead of Sunkern, use Pokémon with higher Stat-Exp/Base stats in defence).
You could use 10 Geodude, 1 Magicarp and 2 Irons to achieve the same Def-Stat-Exp (and therefore the same jump), but it would produce a ld (hl), a in the executed Atk-byte so I would advice against it.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Torchickens
Date: 2017-10-18 10:44:03
Wow, thanks for this spamviech. :) Yeah, the slide Pokémon has been a problem for lots of people. Will try it out later.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Skeef
Date: 2017-10-18 12:18:29


what letters in the box code are the address and the value it changes i want to use it like a memory editor


Have a look at this post from torchickens
To construct the memory adress using Box names use the big hex list (doesn't contain GSC characters) linked Pastebin or sth. similar.



The first party address that the code starts to run is at FA98 (DA98). This is the second byte of the Attack stat experience of Pokémon 3 (the slide Pokémon).

Following this is Defense, Speed, Special stat experience as well as DVs, PPs, happiness, Pokérus, level, status, stats. You can probably predict whether the Pokémon will work by looking at the stats but I don't know the details sadly.

Since most of them are naturally hidden (statXP, happiness, etc.) prediction would be difficult I guess. At least statXP and happiness should be fixed at the start though, but I guess trial and error is good enough for now.


Was tired of trial and error so I constructed a method to create a working slide-Pokémon. You basically get the right amount of stat-Exp to pass the atk-stat and use jr $1F in the Def-stat to jump right to your fourth Pokémon which should be the well-known Quagsire holding TM02 with Return as its first move.

To do this take one newly caught Pokémon and defeat exactly the following Pokémon:

    [li]1 Magicarp (use Old Rod anywhere)[/li]
    [li]7 Geodude (most common Route 46)[/li]
    [li]10 Sunkern (National Park, day time)[/li]
    [li]Give 2 Iron to your Pokémon


This leaves your Pokémon at 870 ($0366) Atk stat-Exp and 6175 ($181F) Def stat-Exp (rest is skipped).

Starting at the second byte of the Atk stat-Exp this produces the following code:
ld h,(hl)
jr $1F

Which then continues at Pokémon 4 to jump to wherever you want.

Hope this helps anyone having trouble catching a working slide Pokémon. This way, as long as you don't defeat any Pokémon afterwards (Exp. Share counts) your Slide-Pokémon will continue working, regardless of Happiness, moves, or anything else.
Disadvantage obviously is the time it takes to set up, but this could in theory be improved (use always-available Pokémon instead of Sunkern, use Pokémon with higher Stat-Exp/Base stats in defence).
You could use 10 Geodude, 1 Magicarp and 2 Irons to achieve the same Def-Stat-Exp (and therefore the same jump), but it would produce a ld (hl), a in the executed Atk-byte so I would advice against it.


I was looking into this aswell coincidently. My conclusion was 3 irons and 7 Exeggcutes.

Thats 280 att xp and 8240 def xp. Or $0118 att and $2030 def. Since the first byte of att doesnt matter that makes jr 20

4 slowpoke and 2 shuckle should also work.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-10-18 12:34:52

Wow, thanks for this spamviech. :) Yeah, the slide Pokémon has been a problem for lots of people. Will try it out later.


Was a problem for me as well, so kind of necessary. Also I somewhat enjoyed poking around here a bit.

Another question:
in several codes presented here (i.e. the Celebi code) you change memory at the adress $fa2a, but according to the ram map from data crystal the species is stored at $da2a.
Is there a mismatch, or are the last two bits simply ignored?

I was looking into this aswell coincidently. My conclusion was 3 irons and 7 Exeggcutes.

Thats 280 att xp and 8240 def xp. Or $0118 att and $2030 def. Since the first byte of att doesnt matter that makes jr 20

4 slowpoke and 2 shuckle should also work.

Tried that first as well, but was tired of keeping track of two stats so I just fitted the Def-stat and hoped for the best with Atk.  ;D

7 Exeggcutes sounds like a pain. Isn't it pure headbutt-encounter?
4 Slowpoke and 2 Shuckle sounds doable, but requires Surf to get Slowpoke with >15% probability. Since it's not too far after Coin Case (story wise) I don't think it's a problem.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-18 12:48:02
If i'm not mistaken, $fa2a is ECHO Ram for $da2a

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-10-18 13:02:56
So I can simply use whichever I like and achieve the same thing? (don't want to dive too deep into gameboy specifics)
Sounds really useful since da has no valid character whereas fa is easily usable with 4.

Thanks for the reply.