Arbitrary code execution in English Pokémon Crystal
Posted by: Torchickens
Date: 2014-06-23 09:53:41
In Crystal, HM06 (item hex:F8) in the items, balls or key items pocket has an invalid pointer that jumps to ROM0:3ACB. I actually didn't find this through hacking, but through a tool called Item Editor GSC made by Mateo.
After I looked into it further, there is the code 'jp nc, CD1A' (D2 1A CD) here, where the game will jump to CD1A, which is in RAM.
Arbitrary code execution is possible if you wrote your own code at CD1A with cheats, like make the first Poké Ball Master Ball: 3E 01 EA D8 D8 C9, but unfortunately CD1A is not the most manipulable location.
On my save CD1A-CD1F is 00, so the emulator falls through. There is code from CD20 that seems to change based on your location on the map after you take at least one step, so the emulator tries to run the code there.
Theoretically, you could probably manipulate this code to redirect you to something where you can have more controllable code, like D8F2; the first item in the PC.
There is another obstacle though: How do you obtain HM06 in the wrong pocket?
When you get a Pokémon that is holding HM06 via a Generation I Pokémon with an unused catch rate in memory (because catch rates get converted into items) or theoretically through the bad clone glitch, when you take it off it goes into the TM/HM pocket, meaning that it works the way it should do.
This means that we need to think of another way of obtaining HM06.
Also, it's definitely worth asking: Are there any other TMs/HMs in the wrong pocket where you can make the game jump to somewhere in memory?
Here is a suggestion for getting HM06:
Possible method:
1) Get a ????? (00) through the bad clone glitch.
2) Try to get a glitch Unown through 6+ party trick that causes map corruption. The 6+ party trick requires a hex:00 obtained with the bad clone glitch. Map corruption Unown include 80, 8B, 8D, 90, 9E, A1, C0, D3.
I haven't confirmed if it's possible to get glitch Unown this way in Pokémon Crystal, (though it is possible in Gold/Silver through the defense stat of the Pokémon in the fifth position modulo 256) unfortunately.
3) Prepare yourself just a poisoned Pokémon, view your map corruption Unown, then step into an out of bounds location that will give you a HM06 or a more/equally suitable item.
With two locations; south of Prof. Elm's lab (through glitch Unown 8D) and south of Mt. Silver (the latter through cheats, might work with 8D), I got HM06 in the Balls pocket.
Look at the pictures below:
[img]http://i.minus.com/jMGNqYAHLZUzq.png[/img][img]http://i.minus.com/jbiHs3Rat3QeOs.png[/img][img]http://i.minus.com/jiZhXNGEj1Y6M.png[/img] [img]http://i.minus.com/jbn5dBqDbYT8wR.png[/img]
[img]http://i.minus.com/jmMuTczT6cciZ.png[/img][img]http://i.minus.com/jblCJnHkAhJFfS.png[/img][img]http://i.minus.com/jcuPpzf5k5wM9.png[/img][img]http://i.minus.com/j8r6niJz2FH8b.png[/img]
[img]http://i.minus.com/jbn0SUDlRv4vXg.png[/img][img]http://i.minus.com/jbifrTHCuai52F.png[/img][img]http://i.minus.com/jI8n288EuAFbd.png[/img][img]http://i.minus.com/jZNsE7NEULEWJ.png[/img]
[img]http://i.minus.com/jbxz3nc5RX0Aml.png[/img]
I viewed the Glitch Unown on the exit mat, exited the Pokédex, then went left and down.
My items were corrupted.
After scrolling past Cancel in the Balls pocket I found a HM06 in where the end position was supposed to be (D8F0; 13th Ball ID).
I was going to suggest that you could white out due to poison to keep it, then swap it to the first position, but unfortunately all poisoned status ailments are removed once you enter the map.
So maybe it would be a good idea to search for out of bounds locations where you can Teleport away or where poison doesn't get removed? You may not be able to Fly away due to badges getting removed.
Going out of bounds messes up your items, possibly included stored items, so that may be a problem if you have either more than the maximum number of items (withdrawing them would shift up unrelated data and likely cause a freeze) or if you're given the hex:00 item, where the game causes a lock-up when you scroll down to it or when you try to view it (I don't know if this always happens).
See also:
Maybe this glitch is worth looking into, more so than my method above. I don't understand it because I haven't tried it, only the duplicate key items part, so I can't theorize about it. It would have far less bad side effects though.
Edit: The emulator I used was VBA-rr-svn480-win32. Other emulators may give different results when stepping out of bounds.
Edit 2: Copy and paste from a slightly changed version of my post on Háčky's thread :-
I was close to getting HM06 in the Balls pocket without cheating in Pokémon Crystal with Háčky's trick.
I got three Secret Potions, and performed your trick up to the two Secret Potions in position 25 and 26 (where end should be). From there, I swapped them and caused the bytes shift upwards glitch in the balls pocket. Then, the end (FF) byte got converted into a quantity of 255. Since all quantities become items, I wanted to toss 7 of them to get a quantity of 248 (F8), which is HM06's index number, so that when I repeated the 'swap two stacks of Secret Potions at position 25 and 26 trick' it'd give me HM06.
Unfortunately the quantities of the items in the balls pocket wouldn't get reduced (now I understand that this is what your trick is about; using items infinitely including PC items from the Balls pocket) so I couldn't get HM06.
Is there a way to work around this? Trying to go out of bounds to get HM06 is emulator dependent, and the map distortion methods have a random element to them.
Edit: I have another question too. What is the address D958 used for in Crystal? It's a Max Revive (hex:28) on my save, but I'd like it to be HM06. It's the first and only item address after the PC item addresses (which directly follow the balls addresses) that I can access without a hex:00 item freeze.