Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Arbitrary code execution in Red/Blue using the "8F" item - Page 49

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Misdreavus
Date: 2017-11-01 02:33:48
Thanks, @ISSOtm!


I'm currently trying to obtain the 8F Item using invlid encounter flags (because i have no event that takes an item away and I dont feel like playing the main story all over again…).


Actually you don't need an event anymore. There is a "dry" variation of the item underflow glitch, for which all you need is a stack of 255 X Special. You can get it with MissingNo. using the glitch of your choice. Moreover, if the invalid encounter flag method works, it means the cooltrainer corruption works for you, so that you can encounter a MissingNo. This invalid encounter flag method is obsolete, you should not use it.

The item underflow glitch requires you to have this :
[img]http://www.prama-initiative.com/RBJ/iug1.png[/img]
French screen, Special + is X Special and the two first item are useless.

Toss the two first useless items, you will have this :
[img]http://www.prama-initiative.com/RBJ/iug2.png[/img]

Toss several 255x of the first item until you only have access to two items. Toss 253 of that first X Special stack and switch item 1 and 2 twice.  You should have X Special x0, like this :
[img]http://www.prama-initiative.com/RBJ/iug3.png[/img]

Item underflow will be active. Now go there (near Celadon) :
[img]http://www.prama-initiative.com/RBJ/iug4.png[/img]

Toss 255 X Special again, and switch the remaining X Special with the Nugget in 35th position. 5 steps right, 5 steps down, 20 steps right and open the item menu to see 8F, that you can switch to a "normal" place (eg : first place). Fly back to Celadon and buy items to fix the item menu.


If you still wanna use the invalid encounter flags, you don't need to USE the attack to trigger the corruption. Just enter/exit the FIGHT menu until it works.

Fact is, cooltrainer corruption doesn't always work, it depends on the values of some RAM addresses. You wil find here TheZZAZZGlitch's methods to maximize the chances. I can tell you that the "renaming party + open unused box" method works very well.

Good luck !
I'm trying to use this method but am having some trouble.  I've never done ACE or item underflow before so please bear with me.

I begin with my item pack in its entirety as follows (just as in the pictures):

Great Ball x1
Parlyz Heal x1
X Special x255
TM09 x3 (It's my understanding that this is not necessary but I did it to match the images in the quote)

I also start in the proper position to the east of Celadon City.

Everything goes according to plan until I'm supposed to swap with the Nugget in the 35th position.  While my game lets me scroll past "Cancel," the items listed there all have no name or quantity, and by the time I push "down" 34 times, my cursor has stopped moving.  I never see a Nugget.  My game then operates extremely slowly and is unresponsive to some commands.

What could I be doing wrong?  I'd like to get this method to work since I don't feel like restarting my file to gain access to an event item.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Couldntthinkofaname
Date: 2017-11-01 05:41:23
This is called the lagging menu glitch, some glitch items with unterminated names can cause the game to lag. If you notice this, try pressing "a" on the offending item, and see if you can scroll your cursor any further.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2017-11-01 06:34:58
I recommend pressing B instead, since popping the USE/TOSS menu on such large-named items will cause memory corruption and potentially crash the game. At worst you'll close the item menu, and you will have to press B again when trying to re-open the menu. But eventually you'll get it to work.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Misdreavus
Date: 2017-11-01 13:08:02

I recommend pressing B instead, since popping the USE/TOSS menu on such large-named items will cause memory corruption and potentially crash the game. At worst you'll close the item menu, and you will have to press B again when trying to re-open the menu. But eventually you'll get it to work.
This worked for me and I successfully got 8F… temporarily.  When I Flew back to Celadon and bought items to restore my pack to normal, the newly-purchased items overwrote 8F in my pack, and my pack is then comprised solely of the items that I bought right then.  How many items am I supposed to buy?

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Skeef
Date: 2017-11-01 14:40:35
You need to store 8F in the pc before fixing your pack actually.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Misdreavus
Date: 2017-11-09 23:18:04
@Skreef That worked; thanks.

What would my pack setup be to modify a Pokémon's DVs to a number of my choice (not necessarily max)?

Also, does anyone know why I wouldn't be allowed to re-nickname the in-game trade Jynx after using ACE to change my trainer name to TRAINER and my ID to match its ID?

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Nostalgia
Date: 2017-11-10 03:33:06
I'm curious Misdreavus, why do you want to do that? Just seems the effort to keep changing the ID and player name to attempt to nickname traded Pokemon to make them your own(?) is a bit over the top. When you can just get Jynx for example, with trainer fly with much less effort.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Krys3000
Date: 2017-11-10 04:08:42

@Skreef That worked; thanks.

What would my pack setup be to modify a Pokémon's DVs to a number of my choice (not necessarily max)?


As for any other thing you may want to do with 8F, you can just use the single-address value memory changing code multiple times, using the addresses that match the DV of the given Pokémon :)

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2017-11-10 05:42:09

Also, does anyone know why I wouldn't be allowed to re-nickname the in-game trade Jynx after using ACE to change my trainer name to TRAINER and my ID to match its ID?


Actually you can do this, but there is one complication. The name TRAINER doesn't consist of each individual letter, but rather the 5D control character (TRAINER) followed by 10 0x50 terminators.

Using 93 91 80 88 8D 84 91 50 00 00 00 won't work because it doesn't match how TRAINER in in-game trade Pokémon is internally stored. To get it to work you need to use 5D 50 50 50 50 50 50 50 50 50 50 instead.

Hope this helps.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Misdreavus
Date: 2017-11-10 19:38:16

I'm curious Misdreavus, why do you want to do that? Just seems the effort to keep changing the ID and player name to attempt to nickname traded Pokemon to make them your own(?) is a bit over the top. When you can just get Jynx for example, with trainer fly with much less effort.
Well, I haven't experimented with the Trainer Fly glitch before outside of getting Mew (it's the glitch that's the basis of the famous Mew glitch, right?), so it didn't really occur to me.  Good idea though… perhaps I'll look into it.

EDIT:



@Skreef That worked; thanks.

What would my pack setup be to modify a Pokémon's DVs to a number of my choice (not necessarily max)?


As for any other thing you may want to do with 8F, you can just use the single-address value memory changing code multiple times, using the addresses that match the DV of the given Pokémon :)
Thanks. 

from 2nd link:
DAB1 - Attack/Defense IV
DAB2 - Speed/Special IV

Let's say I want to set my Chansey's DVs to 8/15/15/15.  (That's a legal R/B/Y spread for that Pokémon that doesn't compromise Defense, Speed, or Special.)  My code for the Attack and Defense DVs would be:

Item 1: any item
Item 2: 8F
Item 3: Lemonade x143 (8 Attack, F [15] Defense)
Item 4: X Accuracy x177 (decimal equivalent of B1)
Item 5: Carbos x218 (decimal equivalent of DA)
Item 6: Poké Ball x119
Item 7: Fresh Water x201

Is this correct?  Would I just set this up and use 8F once?

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Nostalgia
Date: 2017-11-11 03:02:58

Well, I haven't experimented with the Trainer Fly glitch before outside of getting Mew (it's the glitch that's the basis of the famous Mew glitch, right?), so it didn't really occur to me.  Good idea though… perhaps I'll look into it.


Well if you just want a regular Jynx, Trainer-Fly is the way to go. Use this map for a guide: https://puu.sh/257S A quick look at the map now shows a swimmer south of Pallet Town yields a Jynx with the Trainer-Fly glitch.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Krys3000
Date: 2017-11-12 05:48:56



@Skreef That worked; thanks.

What would my pack setup be to modify a Pokémon's DVs to a number of my choice (not necessarily max)?


As for any other thing you may want to do with 8F, you can just use the single-address value memory changing code multiple times, using the addresses that match the DV of the given Pokémon :)
Thanks. 

from 2nd link:
DAB1 - Attack/Defense IV
DAB2 - Speed/Special IV

Let's say I want to set my Chansey's DVs to 8/15/15/15.  (That's a legal R/B/Y spread for that Pokémon that doesn't compromise Defense, Speed, or Special.)  My code for the Attack and Defense DVs would be:

Item 1: any item
Item 2: 8F
Item 3: Lemonade x143 (8 Attack, F [15] Defense)
Item 4: X Accuracy x177 (decimal equivalent of B1)
Item 5: Carbos x218 (decimal equivalent of DA)
Item 6: Poké Ball x119
Item 7: Fresh Water x201

Is this correct?  Would I just set this up and use 8F once?


Provided that your game is an english R/B (otherwise, addresses would be $DAB6 and $DAB7 in european non-english R/B, $DAB0 and $DAB1 in english yellow, and $DAB5 and $DAB6 in european non-english yellow) then yes this would be exactly what you have to do. Change the values to 255/178/218 and use 8F a second time for the Speed/Special IVs :) (don't forget your Pokémon setup though)

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Skeef
Date: 2017-11-13 04:45:14




@Skreef That worked; thanks.

What would my pack setup be to modify a Pokémon's DVs to a number of my choice (not necessarily max)?


As for any other thing you may want to do with 8F, you can just use the single-address value memory changing code multiple times, using the addresses that match the DV of the given Pokémon :)
Thanks. 

from 2nd link:
DAB1 - Attack/Defense IV
DAB2 - Speed/Special IV

Let's say I want to set my Chansey's DVs to 8/15/15/15.  (That's a legal R/B/Y spread for that Pokémon that doesn't compromise Defense, Speed, or Special.)  My code for the Attack and Defense DVs would be:

Item 1: any item
Item 2: 8F
Item 3: Lemonade x143 (8 Attack, F [15] Defense)
Item 4: X Accuracy x177 (decimal equivalent of B1)
Item 5: Carbos x218 (decimal equivalent of DA)
Item 6: Poké Ball x119
Item 7: Fresh Water x201

Is this correct?  Would I just set this up and use 8F once?


Provided that your game is an english R/B (otherwise, addresses would be $DAB6 and $DAB7 in european non-english R/B, $DAB0 and $DAB1 in english yellow, and $DAB5 and $DAB6 in european non-english yellow) then yes this would be exactly what you have to do. Change the values to 255/178/218 and use 8F a second time for the Speed/Special IVs :) (don't forget your Pokémon setup though)


Probably easyer to run the Speed/Special code first, then drop 1 X Accuracy and drop Lemonade to 143. Saves you the trouble of multiplying those 2 back. Since you can't just withdraw or buy more if the quantities are over 99.

8F
Any
Lemonade x255 / 143
X Accuracy x178 / 177
Carbos x218
Poké Ball x119
Fresh Water x201

This is the same code, just less items really:
8F
Any
X Accuracy x178 / 177
Carbos x218
Max Revive x255 / 143
TM01 xAny

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Krys3000
Date: 2017-11-13 05:12:23
I agree about doing the second code first  :)

I think the point with Wack0's code was to design a code that uses only items that can be easily bought, that's why he prefered Poké Ball/Fresh Water over Max Revive/TM01  ;D

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Skeef
Date: 2017-11-13 14:35:45
I know  :P I didn't originally see he was using that one though. Posted only the Max Revive code. Then noticed it was the Lemonade Pokéball Fresh Water version So I editted.

Also TM01 can be easily bought in Celadon dept store. So this also works  8)

8F
Any
Lemonade xx
X Accuracy xx
Carboss xx
Pokéball 119
TM01 x Any