Arbitrary code execution with move 00's type in English Gold/Silver
Posted by: Torchickens
Date: 2017-06-29 20:19:17
Luckytyphlosion (I think, please correct me if someone else discovered this) found a way to execute arbitrary code execution with move 00's type in Gold/Silver. This type's identifier is 0xD0 (dec:208) and after analysis its type name seems to be sourced from 0x8350 in VRAM.
0x8350 can contain menu-sprite data for Pokémon on the Pokémon menu as well as possibly NPC sprites(?), but when I had exactly four Pokémon (two tailed Pokémon, bird, tailed Pokémon) I got different results that included freezes and arbitrary code execution which didn't occur otherwise when I had six Pokémon.
https://www.youtube.com/watch?v=TdxzLn0txFM
How exactly can we use this for arbitrary code execution outside of speedrunning?
I tried making the movement patterns in the video and at one point the game executed E9F0 (Echo RAM for C9F0). Perhaps that's what the route exploits for it to eventually touch box names at D8BF onward (but that would seem very far away).
An update! When the game executed E9F0, it eventually came across the following:
jr c, EC68(@EC2D)
jp c, FA9B (@EC70)
These may have only appeared when moving around in the pattern in the speedrun route.
At FA9B (DA9B) is the Speed experience byte 1 of the third slot Pokémon. We know from the Coin Case glitch that we can have this as a low level slide Pokémon, so perhaps following it could be a Quagsire holding an item with a specific move 1 (like Quagsire holding HP Up with Sleep Talk as the first move; jp D61A or Quagsire holding TM02 with Return; as the first move; jp D8C0) for us to jump to stored items or box names.
So it looks like we can possibly use this as an alternative to Coin Case glitch, but what would really be cool is if you can do it in Crystal as it's easy to just trade over a CoolTrainer Ditto from Red/Blue/Yellow. That way no 'pseudo-bad clone' would be required nor an unterminated name Pokémon from Red/Blue/Yellow.