Re: Arbitrary code execution in Red/Blue using the "8F" item
Posted by: ISSOtm
Date: 2016-09-07 08:27:50
Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.
You can join Glitch City Research Institute to ask questions or discuss current developments.
You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.
Well, yeah, but still…
He first needs to fix the negative experience Pokémon then run the offset code.
Now trying to make the daycare cloning manipulation work (described here: http://forums.glitchcity.info/index.php?topic=6638.msg200226#msg200226). Just taken like this, it does not work for me. I though about which item / item number could represent the address to which I want to add +5, in order to reach 77. After reading the asm code, I think I have to add +5 to the number X Accuracy. I will try this, and come back to tell you whether it worked or not.
EDIT2: Nope, X Accuracy x77 did not work. I really will have to properly look into this.
It'd be kinda funny if in 5 years the Autism posts were still there… it'd be like talking about soup in the middle of a Master's essay to see if …whoever grades those things reads it or not.
Anyway, if the addresses are +5, why'd you lower the number of X Accuracy by more than 60?
Now trying to make the daycare cloning manipulation work (described here: http://forums.glitchcity.info/index.php?topic=6638.msg200226#msg200226). Just taken like this, it does not work for me. I though about which item / item number could represent the address to which I want to add +5, in order to reach 77. After reading the asm code, I think I have to add +5 to the number X Accuracy. I will try this, and come back to tell you whether it worked or not.
EDIT2: Nope, X Accuracy x77 did not work. I really will have to properly look into this.
Because english yellow has -1 offset to english red/blue. I think the +5 for european yellow is compared to english yellow. That makes +4 compared to english red/blue.
It would need 71 X Accuracy in english yellow. So 76 for european yellow?
call ZZYY
ret
Box Items:
D53B-D53C: ld h, D3 ;Carbos x 211
D53D-D53E: ld l, 22 ;X Accuracy x 34
D53F: jp hl ;TM 33 x Any
Start of destination WWVV (D1F7)
Start of target code UUTT (D53B)
End of target code ??ZZ +1 (D1FB+1 = D1FC)
Note that all inc b are filler.
Code Value Item Breakdown
inc b ; Pokeball
ld d, UU ;D5 x22 && TM13
inc b ; x04
ld e, TT ;3B Repel x59
ld h, WW ;D1 Carbos x209
ld l, VV ;F7 X Accuracy x247
inc b ; Pokeball
ld a, (de) ; x26
inc de ; Super Potion
ld (hl+),A ; x34
ld a, ZZ ;FC Lemonade x252
inc b ; Pokeball
cp l ; x189
jr nz, F7 ; Fire Stone x247
ret ; TM01
I had a similar idea myself: to use the current box RAM for permanent subroutines. I haven't implemented this idea yet because I do not understand enough about the subject. The theory is as follows:
Assuming SRAM holds state due to the cartridge battery,
Assuming SRAM is written to by a "save" subroutine in ROM
Assuming the "save" subroutine copies an entire section of WRAM to SRAM, specifically, that the entire current box pokémon list data is copied to SRAM regardless the number of pokémon in the box
So we can have an empty box filled with subroutines instead of pokémon data.