Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Derivatives of 5 in Red/Green - Page 1

Derivatives of 5 in Red/Green

Posted by: Torchickens
Date: 2012-12-21 08:24:47
[size=14pt]What's 5?:[/size]

With 5 ('5F', Item 5Ah) the game runs machine code beginning from WRA1:D123 (Number of Pokémon).

The Game Boy CPU operates on a number of instructions called registers. Each register has an opcode (list of opcodes). The Game Boy typically runs machine code from the ROM, but in the case of using 5, the machine runs data from the WRAM as they were opcodes, when normally its used to store re-writable in-game variables.

Although when using 5 the Game Boy operates machine code beginning from WRA1:D123 (# of Pokémon, Pokémon 1, Pokémon 2…), you can use different opcodes to read from a memory address elsewhere (e.g. items). Jr (relative jump) is useful because the opcode is (18h [xx]h), and 18h corresponds to Tentacool which are easy to obtain.

The quantity of 5 never decreases on use unless you program it to.

[size=14pt]Method to Obtain 5:[/size]

Unfortunately I don't know of an easy way to obtain 5, but it is possible without any side effects that are too bad. I recommend doing the below steps when you have all badges, otherwise at the end your high leveled Pokémon might no longer obey you.


Adding 5 to Post-20 items:

We'll want to explode the items pack to obtain 5 (item 5Ah), but it doesn't appear past item 20 very often, so one way of finding it is if the first byte of the Trainer ID number is 5Ah.

When you start a new game there's a 1/256 chance that your ID number ranges from 23040-23295. This means that byte 1 (D2D8) is 5A, and you'll be able to find it when you scroll past the items pack. Later we'll want to deposit one 5 in the PC Box, so byte 2 (D2D9) might have to be >1 so you can deposit 1 5 without shifting the number of items, which could freeze the game.

Unfortunately, without an emulator, the only way to check is to obtain your starter Pokémon and check its ID number, but with BGB's debugger you can add a breakpoint when D2D8 becomes 5A by going to Debug>Access Breakpoints, entering 'D2D8', '5A', checking 'on write' and clicking 'Add'.

Like this:

http://i.minus.com/jE8UeQepq5aC.png

This will make the emulator pause when you begin a new game and byte 1 of the Trainer ID is set to 5Ah.

Exploding the items pack:


You'll need :-

1) Your starter (Doing it with another Pokémon made the game freeze on switching for some reason)
2) 9 Items and at least 1 Pokémon
3) A Trainer ID Number ranging between 23042-23295 or 23040 (see above)

Requirements for reverting the item pack back to normal/ Getting your starter back:

4) Two or more Pokémon
5) Access to the Day-Care Center on Route 5
6) A place like Saffron City where you can easily walk to the Daycare Center
7) At least 100 Pokédollars, (probably more)

Steps:-

1) Highlight Item 9 in the Bag. Close the menu with B,B.
2) Enter Battle and select your first Pokémon on the menu to swap it with a glitch Pokémon.

[img]http://i.minus.com/jxOskzUx0Qrh3.png[/img]

3) Run. You might have to open the Fight menu first so you don't get a 'sent to Pokémon Center' loop.
4) Walk to a PC, be careful not to encounter any Pokémon on the way. Select your PC and choose Deposit.
:Your item pack should be messed up, like this.

[img]http://i.minus.com/jvuwiIc9yMznh.png[/img]

5) 5 should be item 28. There should be more than one. Deposit one to keep in your PC, but don't deposit all of them because that might freeze the game.

[img]http://i.minus.com/jKPeiWavBP9RA.png[/img] [img]http://i.minus.com/jQQCHvZj6emlW.png[/img]

Now we have 5 to keep. Your Trainer ID has changed to your old ID, minus how many of 5 you deposited.

Getting the items pack back to normal, and your starter back:

1) Take the glitch Pokémon and one other Pokémon to the Daycare Center if you aren't already there.
2) Highlight the ninth item again, then close the menu with B,B and talk to the Daycare Man as if you're going to deposit Pokémon.

[img]http://i.minus.com/jqU1M4lipKy2N.png[/img] [img]http://i.minus.com/jzkJpB6NmaSpt.png[/img]

3) Now, press A to swap the first Pokémon with a glitchy version of your starter.

[img]http://i.minus.com/jbrTjdhtSYZJDm.png[/img]

4) Exit the menu, and open it to find your usual items are back. Repeat steps 2/3 again. You should get a weird version of the old glitchy Pokémon again.

[img]http://i.minus.com/jeiuY9xlbHXrh.png[/img]  [img]http://i.minus.com/jbes1YV7MLMZsU.png[/img]
[img]http://i.minus.com/jbvNQRCDXbWXZV.png[/img]

5) Choose to raise the second Pokémon

[img]http://i.minus.com/jbiY73CvrVMNc4.png[/img]


6) Open the menu to find your items are glitched again. Highlight the ninth item once more and exit with B, B. Exit then retrieve your second Pokémon from the Daycare.

[img]http://i.minus.com/jqU1M4lipKy2N.png[/img] [img]http://i.minus.com/jKpYqSBmJ3OO1.png[/img]


7) Talk to the Daycare Man as if going to deposit a Pokémon again. Select the first Pokémon to switch it and receive your real starter back, with your items back to normal. 5 is still available to withdraw in the PC.

[img]http://i.minus.com/jOLeL0NenpMNh.png[/img] [img]http://i.minus.com/jOoPPhyuoK0E6.png[/img]




[size=14pt]1) Encounter any Pokémon based on the quantity of Item 1 [by K)ry][/size]:

K)ry, the author of Kattempla/Pokebug wrote ASM that allows you to easily capture all 151 Pokémon.

Once you meet the following requirements (below), 5 acts like an item that forces a value in 01xx36D0 (instant encounter with a Pokémon), which depends on the quantity of item 1 (D2A3h).

Sub-Requirements

1) 5 (see above)

2) Access to three PP Ups.

Below are locations:

[img]http://i5.minus.com/j327BkQVPLeFb.jpg[/img] [img]http://i5.minus.com/je7iuSTUMfNGq.jpg[/img] [img]http://i5.minus.com/jk4R0jR5OaCNn.jpg[/img]

3) A Pokémon with a Special stat of 182, 183, 184 (modulo 256) so you can encounter a special Missingno. with Trainer-Fly to duplicate your items. You'll need to duplicate your items several times.

4) Access to TM01, TM10, TM50 and Max Revive.

5) Master Balls are desirable, but you won't need them.

6) Access to Meowth. If you're not using Pokémon Green you'll have to trade or use a glitch.

Requirements:

1) 06h: 6 Pokémon (0xD123)
2) xxh: Any first Pokémon (0xD124)
3) 18h: Tentacool as the second Pokémon (0xD125)
4) 4Dh: Meowth as the third Pokémon (0xD126)
5) 18h: 24 PP left on the second Pokémon's first move (0xD174)
6) 56h: 22 PP left on the second Pokémon's second move w/ 1 PP Up used (0xD175)
7) 18h: 24 PP left on the 4th Pokémon's first move (0xD1CC)
8) 56h: 22 PP left on the 4th Pokémon's second move w/ 1 PP Up used (0xD1CD)
9) 18h: 24 PP left on the 6th Pokémon's first move (0xD224)
10) 4Fh: 15 PP left on the 6th Pokémon's second move w/ 1 PP Up used (0xD225)
11) C3h, A4h, D2h: The 6th Pokémon's nickname begins with "て" (0xD275-0xD277)
12) FAh: The second item is TM50 (0xD2A4)
13) A3h: The second item quantity is 163 (0xD2A5)
14) D2h: The third item is TM10 (0xD2A6)
15) EAh: The third item quantity is 234 (0xD2A7)
16) 36h: The fourth item is Max Revive (0xD2A8)
17) D0h: The fourth item quantity is 208 (0xD2A9)
18) C9h: The fifth item is TM01 (0xD2AA)

[img]http://i4.minus.com/iboEFrmbFg5594.png[/img][img]http://i1.minus.com/i0fa3X06zU1kd.png[/img][img]http://i1.minus.com/ibbALiUpaYcCD6.png[/img][img]http://i4.minus.com/iTlyJSZT6ztYR.png[/img][img]http://i3.minus.com/ibwWSDZKti7oKW.png[/img][img]http://i4.minus.com/ibqtrBVmo9Fci5.png[/img]

ASM:

D123 06 xx  ;ld B,xx
D125 18 4D  ;jr D174

D174 18 56  ;jr D1CC
D1CC 18 56  ;jr D224
D224 18 4F  ;jr D275

D275 C3 A4 D2    ;jp D2A4

D2A4 FA A3 D2    ;ld A,(D2A3)D2A3,1ので
D2A7 EA 36 D0    ;ld (D036),Aそ現に対ま
D2AA C9      ;ret

After meeting the requirements above, after using 5 and closing the menu, you'll encounter a Pokémon with an index number that equates to the quantity of the first item. (e.g. 190 of the first item will make you encounter Victreebel)

So if you have 190 Master Balls in that slot, you can look-up the index numbers of every Pokémon and use this as a guide to capture every Pokémon and complete the Pokédex.

[img]http://i6.minus.com/j9rGHIRUbELF.png[/img] [img]http://i2.minus.com/jBWIROWfX5CbD.png[/img]
[img]http://i5.minus.com/jkD6kgqJsA5pV.png[/img]

Video: http://youtu.be/vyt4r0GPKEo

Re: Derivatives of 5 in Red/Green

Posted by: camper
Date: 2012-12-21 22:54:27
1. Can the Pokemon's level be modified? L0 Pokemon may crash the game when withdrawn from the PC box (or does it?)
2. Does the position and quantity of 5 matter? You don't have to avoid the special Missingno. if it doesn't matter.
3. Does it only work in JP version?

Re: Derivatives of 5 in Red/Green

Posted by: Vuroja5
Date: 2012-12-22 05:10:08
Very interesting Torchickens, I wonder if you have a Japanese speaker translating that Japanese glitch site for you, as Google Translate isn't very helpful! (or maybe you speak/read it yourself?)


3. Does it only work in JP version?


Select button glitches only work on Red/Green yeah.

Re: Derivatives of 5 in Red/Green

Posted by: camper
Date: 2012-12-22 06:58:48


3. Does it only work in JP version?


Select button glitches only work on Red/Green yeah.

I know, but does the item 5F have the same effects in Red/Blue?

Re: Derivatives of 5 in Red/Green

Posted by: Torchickens
Date: 2012-12-22 07:35:18

1. Can the Pokemon's level be modified? L0 Pokemon may crash the game when withdrawn from the PC box (or does it?)
2. Does the position and quantity of 5 matter? You don't have to avoid the special Missingno. if it doesn't matter.
3. Does it only work in JP version?


1. Yes, the level of the Pokémon seems to be based on the last level loaded by the game. If you deposit a level 100 Pokémon, withdraw it and then rearrange your party, 5 will give you Level 100 Pokémon. If you encounter something like a Level 2 Pidgey before using the item all Pokémon you battle from 5 will be Level 2.

For some reason, in the English versions level 0 'normal' Missingno. or 'M freeze the game when you withdraw them but Pokémon in normal experience groups like Slow, Medium Slow, Medium Fast and Fast will either stay at level 0 or revert to level 1.

2. The only item requirements are that you have TM50 x 163 in Item 2, TM50 x 234 in Item 3 and Max Revive x 208 in Item 4 and any number of TM01 in Item 5. So you can have 5 and your Poké Balls anywhere but those positions (item 1 or items 6 and above).





3. Does it only work in JP version?


Select button glitches only work on Red/Green yeah.

I know, but does the item 5F have the same effects in Red/Blue?


No, 5F works differently in Red/Blue unfortunately.



Very interesting Torchickens, I wonder if you have a Japanese speaker translating that Japanese glitch site for you, as Google Translate isn't very helpful! (or maybe you speak/read it yourself?)


Glad you find it interesting. To get the requirements I looked at the ASM on this page and noted what the addresses are for. Google Translate/Excite are OK if you try translating one sentence at a time.

My Japanese skills are rudimentary, though I'm interested in the language. I know about half the hiragana and how to write a few basic sentences, though not much more than that at the moment.

Re: Derivatives of 5 in Red/Green

Posted by: Vuroja5
Date: 2013-04-16 14:31:27
Torchickens, do you know of another way to make item '5F' appear in the bag? I'm keen to try this for myself on a cart but I'm getting real bored of resetting for the Trainer ID.

Re: Derivatives of 5 in Red/Green

Posted by: Torchickens
Date: 2013-04-17 07:31:27

Torchickens, do you know of another way to make item '5F' appear in the bag? I'm keen to try this for myself on a cart but I'm getting real bored of resetting for the Trainer ID.


I've found another way.

If your y-coordinate [memory address: D2E0] is 5Ah (dec: 90), 5 will appear in the bag as the 32nd item.

One place where you can get your y-coordinate to 90 is on Cycling Road (Route 17), here:

[img]http://i.minus.com/jKgbB8CHN7Fhy.png[/img]


There is something important I need to note about the glitch where you swap the ninth item with the first Pokémon. The number of items you get depends on the Pokémon's defence exp byte 2 (D141). This means you have to use a Pokémon that you have trained in defence, such as your starter, otherwise you'll be left with 0 items.


Basically, swap the ninth item with the first Pokémon to get x>32 (20h) items, then go to the place in the picture above, highlight 5 with the select button and put it in the first position, Fly away, then deposit one in the PC.

I hope this helps.  :)

Re: Derivatives of 5 in Red/Green

Posted by: camper
Date: 2013-04-17 12:17:47
Hmm… using the y-coordinates you can get any items without resetting over and over again? Since you can access every possible y-coordinate from the Route 20 Glitch City.

Re: Derivatives of 5 in Red/Green

Posted by: Torchickens
Date: 2013-04-17 13:47:44

Hmm… using the y-coordinates you can get any items without resetting over and over again? Since you can access every possible y-coordinate from the Route 20 Glitch City.


It should be possible to access most if you perform the alternative walk through walls glitch, as luckily there's water tiles (for battling) and a ledge for pulling off the glitch. This glitch involves exploding the items pack (in the video by swapping item [Pokémon] 13 with Pokémon 3) then, coincidentally, 'swapping' item 32 (though your y-coordinate will stay the same because your technically swapping Pokémon 32) with a Pokémon. However, for some reason I couldn't get another encounter on the 1x1 water tile the second time. Not sure if this is just my bad luck or if there's another reason.

Once you swap the 32nd item, the surfing sprite disappears as if you weren't surfing and you can just walk off, then jump off the ledge to trigger the glitch.

[img]http://i.minus.com/jreVyGx7nAbG1.png[/img]

For some reason however, when I step on a tile where y=18 the map changes and the game freezes, so 0-18 are unobtainable with Sea Route 20 Glitch City. You can't access y=255, either.

Without walk through walls, I can only access 107 (6Bh) - 119 (77h) with the Sea Route 20 Glitch City.

6Bh:

[img]http://i.minus.com/jkoHm21DBF7rO.png[/img]

77h:

[img]http://i.minus.com/jble4ukNYd56S2.png[/img]

Re: Derivatives of 5 in Red/Green

Posted by: camper
Date: 2013-04-18 01:15:37
Try walking left a bit from the original position. You'll end up in the leftmost part of Route 19. Walk left one step Use surf while facing left and you'll be in an "endless" sea of Route 20 (kinda like the "infinite" grass of Pallet Town). You don't need walk through walls for that. (This is actually part of the "encountering glitch Pokemon/trainer in Glitch City" trick, I think)

Yes, you can't access y=18 as it's already a valid coordinate of the Route 20 map. Getting a coordinate of 0-18 is possible without going to Glitch City. As for 255, you can't access that item anyways, so there's no need for that.

Btw, the Bulbapedia article about Glitch City is terribly outdated.

Re: Derivatives of 5 in Red/Green

Posted by: Torchickens
Date: 2013-04-18 07:10:56

Try walking left a bit from the original position. You'll end up in the leftmost part of Route 19. Walk left one step Use surf while facing left and you'll be in an "endless" sea of Route 20 (kinda like the "infinite" grass of Pallet Town). You don't need walk through walls for that. (This is actually part of the "encountering glitch Pokemon/trainer in Glitch City" trick, I think)

Yes, you can't access y=18 as it's already a valid coordinate of the Route 20 map. Getting a coordinate of 0-18 is possible without going to Glitch City. As for 255, you can't access that item anyways, so there's no need for that.

Btw, the Bulbapedia article about Glitch City is terribly outdated.


Hmm, for some reason when I try that the water tiles change to building tiles and I get stuck?

Do you mean this glitch? Its smart how Paco81 used Cut to walk instead of Surf on the water tile (as you probably know you have to walk on the water tile to do the old man glitch in the Spanish version)

Re: Derivatives of 5 in Red/Green

Posted by: camper
Date: 2013-04-18 07:54:17
It changes into building tiles since you arrive at the edge of Route 19. You should be able to surf one step left back to Route 20.

Re: Derivatives of 5 in Red/Green

Posted by: Stackout
Date: 2013-04-19 11:08:47
I know 5F in english games, and one or two of the other *F items, also jump to some location in RAM. I assume they can't be used for arbitrary code execution easily?

Re: Derivatives of 5 in Red/Green

Posted by: camper
Date: 2013-04-19 13:53:47
D123 is not Pokemon data in the localized versions.

Re: Derivatives of 5 in Red/Green

Posted by: Torchickens
Date: 2013-04-19 14:02:29

I know 5F in english games, and one or two of the other *F items, also jump to some location in RAM. I assume they can't be used for arbitrary code execution easily?


Probably not, though I haven't checked, so I don't know what the floor items do in the English versions, sorry. 5Kai is useful because it jumps to WRA1:D123; the number of Pokémon in the party. Not only is D123 something different in the English games, but 5F and similar items probably jump to somewhere entirely different too.


It changes into building tiles since you arrive at the edge of Route 19. You should be able to surf one step left back to Route 20.


Oh. OK. Thanks, I'll test it out later.


I've just finished a real-time 'Catch 'em All' speedrun of Pocket Monsters Green involving 5, with another Green to trade the Pokémon on and perform the Cable Club escape glitch to duplicate items. It took me 2:19 in-game time. Note the sound is out of sync.

[img]http://i.minus.com/jj3twpEACdcGL.png[/img]

Links: Part 1, Part 2, Part 3, Part 4