Re: Arbitrary code execution in Gold/Silver UE using the Coin Case
Posted by: Couldntthinkofaname
Date: 2017-10-20 09:04:54
Finished a code to create a Celebi with its usual egg moves (Leech Seed, Recover, Confusion, Heal Bell).
Just to make it easier to get a legal moveset once Pokémon Bank finally comes to Gold/Silver VC.
First you need to run FMK's one-off code (if you haven't done so already).[REQUIRED] One-off code so all future codes don't need the 'return to game' code:
Box 1 : Ap0w'vA55 (XOR A; OR b6; SUB 0x80)
Box 2 : é'm2p'v7'v'd (LD [d2f8], A; XOR A; SUB fd; SUB d0)
Box 3 : éA355555 (LD [80f9], A)
Box 4+: 55555555 (Safe filler code)
Box 13: 5555péD9 (XOR A; LD [83ff], A)
Box 14: 'l'lA'lx'd55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)
Afterwards, use the following code twice, which on the second run will change your first Pokémon into Celebi with the moves Leech Seed, Recover, Confusion & Heal Bell.
Box 1($D8BF to $D8C7): Ap0b'vA55 (XOR A; OR a1; SUB 80 | A->21)
Box 2($D8C8 to $D8D0): é'l2p0555 (LD [d1f8], A; XOR A; OR fb | A->fb)
Box 3($D8D1 to $D8D9): 55455555 ({LD HL, [{2a}fa]}; {LD [HL], A}; {INC HL}; {INC HL} | HL->fa2a; HL->fa2c)
Box 4($D8DA to $D8E2): 55p0'd'vH5 (XOR A; OR d0; SUB 87; {LD [HL], A} | A->49)
Box 5($D8E3 to $D8EB): 5p0/'vK55 ({INC HL}; XOR A; OR f3; SUB 84; {LD [HL], A}; {INC HL} | HL->fa2d; A->69; HL->fa2e)
Box 6($D8EC to $D8F4): 55p'vd555 (XOR A; SUB a3; {LD [HL], A}; {INC HL} | A->5d; HL->fa2f)
Box 7($D8F5 to $D8FD): p0X0'd5'vu (XOR A; OR 97; OR d0; {LD [HL], A}; SUB b4 | A->d7; A->23)
Box 8($D8FE to $D906): é't2é'v255 (LD [d5f8], A; LD [d6f8], A)
Box 9($D907 to $D90F): é-2éé255 (LD [e3f8], A; LD [eaf8], A)
Box10($D910 to $D918): é/2'vmé's2 (LD [f3f8], A; SUB ac; LD [d4f8], A | A->77)
Box11($D919 to $D921): é(Pk)2é&255 (LD [e1f8], A; LD [e9f8], A | (Pk) is the character spelling Pk)
Box12($D922 to $D92A): é2é425p (LD [f2f8], A; LD [faf8], A; XOR A | A->00 | is the multiplication sign)
Box13($D92B to $D933): éD9'v'vé'm2 (LD [83ff], A; SUB d6; LD [d2f8], A | A->2a)
Box14($D934 to $D93c): 'l'lä'lx'd55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC | LEAVE UNCHANGED!)
You still need to give it to the day care/hatch the egg to get a "proper" Celebi.
Note:
Due to space requirements I changed the name of Box 13. You have to change it back to the one-off code name when using a different code.
Also: don't touch the name of Box 14!
That's awesome! Nice work!
It's worth noting that if you use TM 25 in the balls pocket as opposed to the Coin case, it is not required to use FMK's one-off code. (At least, not for me)