Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Generation II Glitch Discussion

Arbitrary code execution in Gold/Silver UE using the Coin Case - Page 8

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-20 09:04:54

Finished a code to create a Celebi with its usual egg moves (Leech Seed, Recover, Confusion, Heal Bell).
Just to make it easier to get a legal moveset once Pokémon Bank finally comes to Gold/Silver VC.

First you need to run FMK's one-off code (if you haven't done so already).

[REQUIRED] One-off code so all future codes don't need the 'return to game' code:
Box 1 : Ap0w'vA55    (XOR A; OR b6; SUB 0x80)
Box 2 : é'm2p'v7'v'd (LD [d2f8], A; XOR A; SUB fd; SUB d0)
Box 3 : éA355555    (LD [80f9], A)
Box 4+: 55555555    (Safe filler code)
Box 13: 5555péD9    (XOR A; LD [83ff], A)
Box 14: 'l'lA'lx'd55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC)



Afterwards, use the following code twice, which on the second run will change your first Pokémon into Celebi with the moves Leech Seed, Recover, Confusion & Heal Bell.

Box 1($D8BF to $D8C7): Ap0b'vA55 (XOR A; OR a1; SUB 80 | A->21)
Box 2($D8C8 to $D8D0): é'l2p0555 (LD [d1f8], A; XOR A; OR fb | A->fb)
Box 3($D8D1 to $D8D9): 55455555 ({LD HL, [{2a}fa]}; {LD [HL], A}; {INC HL}; {INC HL} | HL->fa2a; HL->fa2c)
Box 4($D8DA to $D8E2): 55p0'd'vH5 (XOR A; OR d0; SUB 87; {LD [HL], A} | A->49)
Box 5($D8E3 to $D8EB): 5p0/'vK55 ({INC HL}; XOR A; OR f3; SUB 84; {LD [HL], A}; {INC HL} | HL->fa2d; A->69; HL->fa2e)
Box 6($D8EC to $D8F4): 55p'vd555 (XOR A; SUB a3; {LD [HL], A}; {INC HL} | A->5d; HL->fa2f)
Box 7($D8F5 to $D8FD): p0X0'd5'vu (XOR A; OR 97; OR d0; {LD [HL], A}; SUB b4 | A->d7; A->23)
Box 8($D8FE to $D906): é't2é'v255 (LD [d5f8], A; LD [d6f8], A)
Box 9($D907 to $D90F): é-2éé255 (LD [e3f8], A; LD [eaf8], A)
Box10($D910 to $D918): é/2'vmé's2 (LD [f3f8], A; SUB ac; LD [d4f8], A | A->77)
Box11($D919 to $D921): é(Pk)2é&255 (LD [e1f8], A; LD [e9f8], A | (Pk) is the character spelling Pk)
Box12($D922 to $D92A): é2é425p (LD [f2f8], A; LD [faf8], A; XOR A | A->00 | is the multiplication sign)
Box13($D92B to $D933): éD9'v'vé'm2 (LD [83ff], A; SUB d6; LD [d2f8], A | A->2a)
Box14($D934 to $D93c): 'l'lä'lx'd55 (POP DE; POP DE; INC SP; POP DE; OR A; RET NC | LEAVE UNCHANGED!)

You still need to give it to the day care/hatch the egg to get a "proper" Celebi.

Note:
Due to space requirements I changed the name of Box 13. You have to change it back to the one-off code name when using a different code.
Also: don't touch the name of Box 14!


That's awesome! Nice work!

It's worth noting that if you use TM 25 in the balls pocket as opposed to the Coin case, it is not required to use FMK's one-off code. (At least, not for me)

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: SatoMew
Date: 2017-10-20 09:10:08


VBA sucks.


I second that.

<rant>

I used to use VBA for glitch research, and it was a nightmare. Tons of glitches were Unavailable/Weren't working properly, including Dokashira door, Coin case,Glitch Dimension, and many others, not to mention the debugger was garbage (you couldn't write anything in the debugger, you had to write code from the Hex Editor)

If your "emulator" cannot accurately emulate the target hardware, then your software should not be considered a true emulator.


To add to what was already said, the original VBA was last updated in 2004 so it shouldn't come off as a surprise that better emulators have come out such as current releases of BGB (first public version was 0.3 in 2001) and mGBA.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-20 09:38:09



VBA sucks.


I second that.

<rant>

I used to use VBA for glitch research, and it was a nightmare. Tons of glitches were Unavailable/Weren't working properly, including Dokashira door, Coin case,Glitch Dimension, and many others, not to mention the debugger was garbage (you couldn't write anything in the debugger, you had to write code from the Hex Editor)

If your "emulator" cannot accurately emulate the target hardware, then your software should not be considered a true emulator.


To add to what was already said, the original VBA was last updated in 2004 so it shouldn't come off as a surprise that better emulators have come out such as current releases of BGB (first public version was 0.3 in 2001) and mGBA.


BGB is my personal choice and recomendation. Wonderful debugger and accurate emulation.

What's mGBA? Never heard of it prior.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: SatoMew
Date: 2017-10-20 09:52:06

What's mGBA? Never heard of it prior.


A modern alternative to VBA, especially since it started as a GBA emulator.

https://mgba.io/

The developer plans to rebrand mGBA as medusa in the near future because it will also emulate the DS. There is another new DS emulator as well called melonDS which supports Wi-Fi.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-10-20 10:05:52

That's good stuff, I found this video helpful for getting Celebi's egg moves though:

https://www.youtube.com/watch?v=KdpbBYio-T0


You can easily create box name code to give it the moves one by one. Goal of this one was to have one do it all code though.
Also me confirming if it works like I think it does. :)


It's worth noting that if you use TM 25 in the balls pocket as opposed to the Coin case, it is not required to use FMK's one-off code. (At least, not for me)


You probably don't need Box14 and the name of Box13 should be changed to this
'v'vé'm25x'd
As far as I understood the code is there to recover the stack to a reasonable enough state so you can save & reset.

Now I'm not too familiar with the different methods, but as far as I'm aware the stack isn't corrupted by using TM25 in the balls pocket (I should glitch me one there  ;D).
Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)

Edited my initial post to add this as well.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-20 10:17:14

Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)


I don't know precisely where it jumps first. When I get home, I'll breakpoint some addresses in BGB and see if I can find out what it does when used.

My guess is that when you use TM 25 in the balls pocket, it reads an invalid effect pointer (similar to 8f in R/B) and eventually reaches it's destination, but AFAIK it doesn't corrupt the stack.

Something worth pointing out is that it eventually leads to Pokemon slot 2, not 3. So if you decide to use this method, move your slide and Quagsire up one slot.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: hobgoblinpie
Date: 2017-10-20 14:14:33


How would one go about modifying the EVs to maximum? Modifying the code for Rare Candies/Masterballs to place HP UP/Protein/Carbos etc. works up until 25600, but since EVs max out at 65535, it's still off by a way. I know there's one that exists already, but I think one that doesn't immediately boost to level 100 would be good too.

Also slightly strange, changing the Box 2 code from 'p0B'vAé7't' (255x Master Balls) to 'p0't'vAé7't' should yield PP Ups, but instead yields Red Aprikorns. Would a code to modify the quantity of an item in say bag slot 1, without modifying the item itself?

Appreciate all the work you guys do, it's really impressive.


Regarding question 1:
Box 1: A09é(female symbol)455
Box 2: é04é1455
Box 3: é24é3455
Box 4: é44é5455
Box 5: é64é7455
Box 6: é84p'd555

This is a slightly modified version of Torchicken's code.

Also, this doesn't work with the coin case, only TM25 in the balls pocket

Regarding question 2: Can you please post the entire box code? Box 2 loads register a into $f6af, but register a was defined in box 1.


Thanks, I really appreciate it! I modified it slightly so that it works with the Coin Case ACE (Ap09é45), only a minor change but I already have that one set up so it seemed worth doing.

In regards to the second point, this is the original code for 255x Master Balls in Ball Slot 1:

Ap09é8't5 
p0B'vAé7't
p555'v7'v'd
é(male)2péD9'l
'l5555555
555A'lx'd

With the third letter/number in Box 2's name changing the given item. Most seem to work, given that they are all offset to begin at 0x81, with 'v being the last usable character in that block (BF). Rare Candy is indexed 32 positions higher, so requires the letter 'a'. PP Up is indexed 30 positions after Rare Candy so should require the character 't, but using 't gives Red Apricon, which is a little strange.

Thanks again!

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-20 14:46:00
From my understanding, what the code does is take the character's hex value, subtract $80, and use the end result as the item.

't ($d5) - ($80) = $55, which should return Red Apricorns.

Unfortunately, The hex value of PP Ups ($3e) + ($80) = ($BE), which is not able to be represented as a valid character.

If you would like, i can alter the code to produce PP Ups.

Edit: Change box 2 to p0'v'vYé7't

Hope this helps!

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: hobgoblinpie
Date: 2017-10-20 15:22:10

From my understanding, what the code does is take the character's hex value, subtract $80, and use the end result as the item.

't ($d5) - ($80) = $55, which should return Red Apricorns.

Unfortunately, The hex value of PP Ups ($3e) + ($80) = ($BE), which is not able to be represented as a valid character.

If you would like, i can alter the code to produce PP Ups.

Edit: Change box 2 to p0'v'vYé7't

Hope this helps!


Thanks man, you're a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I'm trying to learn. If you don't mind, could you explain what the changed Box 2 does differently to the previous one?

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-20 15:59:55


From my understanding, what the code does is take the character's hex value, subtract $80, and use the end result as the item.

't ($d5) - ($80) = $55, which should return Red Apricorns.

Unfortunately, The hex value of PP Ups ($3e) + ($80) = ($BE), which is not able to be represented as a valid character.

If you would like, i can alter the code to produce PP Ups.

Edit: Change box 2 to p0'v'vYé7't

Hope this helps!


Thanks man, you're a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I'm trying to learn. If you don't mind, could you explain what the changed Box 2 does differently to the previous one?


Absolutely! The new box 2 code subtracts $D6 with $98 to get $3E, the hex for PP Ups.

Make sure to take this into account when adjusting the code for different items.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-10-20 16:11:19

Thanks man, you're a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I'm trying to learn. If you don't mind, could you explain what the changed Box 2 does differently to the previous one?


Basically a different calculation. The é7't part present in both is writing the value currently in register A to the specified location which is the type of the first item (judging from the original  code in the balls pocket; you might need to adjust this, too).


Now for the calculations itself:
p0B'vA (XOR A; OR 81; SUB 80)

p0'v'vY (XOR A; OR d6; SUB 98)

All Instructions are evaluated against register A and you can look them up in Sanqui's Pastebin.
XOR A (character p) is basically an elaborate way to set register A to the value 0.
OR (character 0) takes the next character as argument and with A currently at the value of 0 the argument becomes the new value of A (here: 81 and d6).
SUB (character 'v) also takes the next character as argument and substracts it from A leaving the result as the new value (here: 01 and be).

Unfortunately ADD and XOR with argument are not represantable with characters, so getting some values can be a bit tricky. One trick here is to deliberately underflow in the calculation and use SUB to get to the desired value anyway. This way you can represent the required 01 for the Master Ball also in this way:
p'v9 (XOR A; SUB ff)

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-20 16:14:08


Thanks man, you're a legend! I figured something was up with the offset, but my understanding of these codes is pretty basic but I'm trying to learn. If you don't mind, could you explain what the changed Box 2 does differently to the previous one?


Basically a different calculation. The é7't part present in both is writing the value currently in register A to the specified location which is the type of the first item (judging from the original  code in the balls pocket; you might need to adjust this, too).


Now for the calculations itself:
p0B'vA (XOR A; OR 81; SUB 80)

p0'v'vY (XOR A; OR d6; SUB 98)

All Instructions are evaluated against register A and you can look them up in Sanqui's Pastebin.
XOR A (character p) is basically an elaborate way to set register A to the value 0.
OR (character 0) takes the next character as argument and with A currently at the value of 0 the argument becomes the new value of A (here: 81 and d6).
SUB (character 'v) also takes the next character as argument and substracts it from A leaving the result as the new value (here: 01 and be).

Unfortunately ADD and XOR with argument are not represantable with characters, so getting some values can be a bit tricky. One trick here is to deliberately underflow in the calculation and use SUB to get to the desired value anyway. This way you can represent the required 01 for the Master Ball also in this way:
p'v9 (XOR A; SUB ff)

^This

Integer underflow is your friend

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-10-20 17:11:17


Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)


I don't know precisely where it jumps first. When I get home, I'll breakpoint some addresses in BGB and see if I can find out what it does when used.

My guess is that when you use TM 25 in the balls pocket, it reads an invalid effect pointer (similar to 8f in R/B) and eventually reaches it's destination, but AFAIK it doesn't corrupt the stack.

Something worth pointing out is that it eventually leads to Pokemon slot 2, not 3. So if you decide to use this method, move your slide and Quagsire up one slot.


Just found this. (How could I be so blind  :o)
Reconstructing from the Slide-Mon requirement removal it start execution at $da9a (Second byte defense EV of the second Party Pokémon).

Switching to TM25 usage now. Soo much easier and without constant resetting.  ;D

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: Couldntthinkofaname
Date: 2017-10-20 17:19:25



Do you know any more specifics about this, like where the execution starts and what else is required? (i.e. do I even need the Quagsire and can the slide-mon be the same?)


I don't know precisely where it jumps first. When I get home, I'll breakpoint some addresses in BGB and see if I can find out what it does when used.

My guess is that when you use TM 25 in the balls pocket, it reads an invalid effect pointer (similar to 8f in R/B) and eventually reaches it's destination, but AFAIK it doesn't corrupt the stack.

Something worth pointing out is that it eventually leads to Pokemon slot 2, not 3. So if you decide to use this method, move your slide and Quagsire up one slot.


Just found this. (How could I be so blind  :o)
Reconstructing from the Slide-Mon requirement removal it start execution at $da9a (Second byte defense EV of the second Party Pokémon).

Switching to TM25 usage now. Soo much easier and without constant resetting.  ;D


Indeed it is. Another thing I didn't like about the coin case is moving in a specific pattern, listing to Machop's cry, fixing the stack, etc.

Re: Arbitrary code execution in Gold/Silver UE using the Coin Case

Posted by: spamviech
Date: 2017-10-21 08:11:41
Next code: Turn Pokémon 1 into an Egg, ready to be hatched (probably 256 steps left):
1)55555555
2)p0d'vAé!2 XOR A; OR a3; SUB 80; LD [e7f8], A | A->23
3)p0't'vQé2 XOR A; OR d5; SUB90; LD [eff8], A | A->45
4)55555555
5)p07éé45p XOR A; OR fd; LD [{23}fa], A; XOR A | A->fd; A->0
6)'v9éé4x'd SUB ff; LD [{45}fa], A; OR A; Ret NC | A->01


This is for use with TM25 in the balls bag. If you want to use Coin Case, use the one-off code from FMK and change the name of Box 6
6)'v9éé4555 XOR A; LD [{45}fa], A


And just in case you didn't know: Shiny Celebi looks awesome in Gen II.  ^-^