Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Arbitrary code execution in Red/Blue using the "8F" item - Page 55

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2018-04-13 05:57:52

Then there's the perhaps more user friendly but somewhat less complete RAM map at https://datacrystal.romhacking.net/wiki/Pokémon_Red/Blue:RAM_map. It's for Red and Blue, though, but it works for Yellow because Yellow RAM addresses are exactly 1 less than those in Red/Blue.

This is only true for addresses past, I think, CF00.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Azarokkusu
Date: 2018-04-14 02:21:20


I noticed there are different ACEs but the order of items are the same. At least I'm using Pidgey 233 current HP, Paras, Onix, Tentacool and Kangaskhan in my party in that order. In Yellow, i had to fullfill a box with slowpokes voltorb, jolteon and geodudes to manipulate the DVs of the first pokemon of my party, i'm wondering if there will be a simpler ACE in Yellow with ws&m.


There are other somewhat easier ones in my opinion. Rather than the filled box, you could use the other one in the OP, which is only 10 Pokémon (most of which aren't too hard to catch).

You can also use 4F, which isn't awful. https://forums.glitchcity.info/index.php?topic=8056.0 . (Note below that I think Krys got an address wrong here).

Another possible bootstrap for 4F would be this one I came up with a few nights ago, which I think is a lot better because it allows you to get everything required without any glitches (because I don't think it's possible to get a Nidorina unevolved from a NidoranF without Ditto glitch):

Put in daycare a Hitmonlee with these moves (you can take it out afterward if you want):
* Any move.
* Any move that won't crash the game when used on its own (I use Meditate for this).
* Double Kick.
* Mega Kick.

Then you just need to box:
* Any pokemon with current pp as follows:
1) Any PP
2) 33
3) 33 (you can do this method in Red/Blue too, but if you do you just need to change this to 34)
4) 19 with 3 PP Up used
* Clefairy (or anything else that won't crash the game or alter h or l registers) at 233 hp
* Anything
* Tentacool
* Parasect

Unless both BGB and the disassembly are giving me the wrong values (and believe me, I've double-checked myself on this more than 20 times to make absolutely sure), the value at FA64 is *not* the catch rate of the Daycared Pokémon, it's the secondary type of the Daycared Pokémon. Since Krys was using Nidorinas, the opcode executed was "inc bc" because Nidorina has type POISON POISON, so DA64=03. This meant that nothing of interest happened and the next byte was executed, which was the catch rate, which is why assuming it jumped to the catch rate didn't have any harmful effects. I use a Hitmonlee because it's convenient and learns the moves we need pretty easily, but I think a ton more Pokémon will work as a result, because if you use Fighting type, that's 01, which means that it eats the next two bytes, the catch rate and the first move. (And other types presumably could be used for other effects. I'm not a fan of the type constants, so I'm not looking any further than this.)

So here's the ASM for this:
WRA1:DA64: 01 2D 1B ld bc,$1B2D
WRA1:DA67: 60 ld h,b
WRA1:DA68: 24 inc h
WRA1:DA69: 18 19 jr DA83
WRA1:DA83: 18 2E jr DAB3
WRA1:DAB3: 21 21 D3 ld hl,D321
WRA1:DAB6: 04 inc b
WRA1:DAB7: 00 nop
WRA1:DAB8: E9 jp [hl]


I mean unless BGB's debugger is giving me the wrong information and I'm counting in the disassembly wrong. But it works when I do it. And the breakpoints I'm setting claim that the things being executed are the things I'm saying are being executed.


-gm (hex 0x6A) is the newest one to pop up thanks to luckythyplosion. https://pastebin.com/e3MRpspZ the setups are INCREDIBLY easy to do for it and take nearly no time at all!

It executes from d4a7 which is just before name data in daycare (and is, from what I've seen, usually 0, or at least can be manipulated to be 0) (da48 is wether a pokemon is in daycare or not, and then da49 is the start of name data). You can set it up a few different ways and it's REALLY easy to set up too, one of the main problems is that it executes from slot 2 for most of the setups (or stored item 1 for some setups etc) but you can literally just write code to the name to overwrite the name to execute from item three.

For example, in the English versions of Red/Blue, if you catch a pokemon and name it A then in memory the name would be 80 50 followed by buffer data. So you use one of the setups above, then write code to write to said pokemon's name and write 21 22 d3 e9 after the 50 terminator byte. Then the pokemon's name is still A, but its stored name in data is actually going to be 80 50 21 22 d3 e9. So then you withdraw the other pokemon from daycare and deposit this one

putting a pokemon in daycare sets da48 to 1 (which is ld bc $xxyy) which makes the code the following

00 01 80 50 21 22 d3 e9


nop
ld bc,$5080
ld hl,$d322
jp hl


and if you withdraw the pokemon from daycare again it'd still be safe

00 00 80 50 21 22 d3 e9


nop
nop
add a,b
ld d,b
ld hl,$d322
jp hl


which would not only set it up to jump to executing from item 3 as our usual payloads do, but also mean it was transferable (IE you could trade it to another save, get -gm on that save and then instantly start executing from item 3 as is standard with other setups like most 8f setups). the default setups are transferable too but executing from item 2 is annoying when you want to use codes that manipulate your inventory.

Easy way to transfer it:

1. deposit the pokemon
2. withdraw the pokemon
3. write code in your items to set da48 to 1
4. withdraw the pokemon
5. repeat steps 3 and 4 as many times as you want to get as many copies of your pokemon as you want.
6. trade those copies to whichever carts need 'em!

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: lel
Date: 2018-04-14 13:35:37
Oh, I was talking about in Yellow. Has anybody made -gm work in Yellow, yet?

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2018-04-14 14:30:06
As far as I know -g m won't work for arbitrary code execution in Yellow as it works like Red/Blue's 9F or Yellow's 6F in which it's a partial battle escape item or scripted encounter/Trainer battle reset item.

For what it's worth memdump did some work on Red/Blue's -g m in the past on page 9 of this thread.
https://forums.glitchcity.info/index.php?topic=6638.msg196498#msg196498

They noted if you like you can also make it nop sled to DA80 where it can be used like Yellow's ws m.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: jfb1337
Date: 2018-04-14 18:29:41
Since -g m jumps to da47, the current number of safari balls, it could sometimes break in the safari zone. Lucky's setup is more prone to this since useful code begins at da48 (wDaycareInUse) so some opcodes will interfere with that. Azarokkusu's setup begins useful code a bit later with the rest being safe filler, so it's a little more robust and in fact all legitimate values of safari balls (i.e. <= 30 (decimal)) don't interfere with it jumping to the 3rd bag item; even jr only ends up having an operand of 0 or 1.

However a few values should be taken note of: If you have 2 or 18 safari balls, SRAM will be opened since these opcodes are ld (bc), a and ld (de), a respectively, and bc and de both happen to point to the 0x00??, and a happens to by 0x6A, making rst 38 crashes more deadly, and if you have 8 safari balls you'll end up writing 2 junk bytes (the stack pointer) to the start of VRAM - possibly causing a slight graphical glitch but nothing major.

Also if your item setup depends on registers other than HL (which are rare), just don't use it in the safari zone at all; most ball amounts will break something.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Azarokkusu
Date: 2018-04-15 00:09:31

Since -g m jumps to da47, the current number of safari balls, it could sometimes break in the safari zone. Lucky's setup is more prone to this since useful code begins at da48 (wDaycareInUse) so some opcodes will interfere with that. Azarokkusu's setup begins useful code a bit later with the rest being safe filler, so it's a little more robust and in fact all legitimate values of safari balls (i.e. <= 30 (decimal)) don't interfere with it jumping to the 3rd bag item; even jr only ends up having an operand of 0 or 1.

However a few values should be taken note of: If you have 2 or 18 safari balls, SRAM will be opened since these opcodes are ld (bc), a and ld (de), a respectively, and bc and de both happen to point to the 0x00??, and a happens to by 0x6A, making rst 38 crashes more deadly, and if you have 8 safari balls you'll end up writing 2 junk bytes (the stack pointer) to the start of VRAM - possibly causing a slight graphical glitch but nothing major.

Also if your item setup depends on registers other than HL (which are rare), just don't use it in the safari zone at all; most ball amounts will break something.


I obviously missed the da47 = safari ball count in the RAM map lol but yes, avoid 2 safari balls, ld (bc),a, and 18 safari balls, ld (de),a. The chance of these values happening by accident are fairly low (you'd have to 1: have the safari zone ball counter active and 2: have exactly 2 or 18 safari balls.)

Interestingly, da47 is reset to 0 if you run out of time in the safari zone (or outside of it if you used the safari escape/glitch city glitch), but not if you choose the leave early option.  Kind of ironic since choosing yes at the "leave early" dialogue is the only time it displays the "please return any SAFARI BALLs you have left." text.

This means that da47 can only be 2 or 18 outside of the safari zone if 1: you use the safari zone escape glitch (in which case the step counter is still running down, as we already know) with 2 or 18 safari balls, or if you choose the "leave early" option with 2 or 18 safari balls.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Masuta Satoshi
Date: 2018-06-08 11:57:14
Any ACE to change the trained ID and OT of a Pokemon? Maybe with the pseudo-gameshark code or any other?

And… I was reading you cant change the nickname of in-game trades Pokemon just by matching your ID and OT, why is this? This applies to Amnesia Psyduck or the other prizes from Gym Leader Castle in Stadium 1? And why not Farfecht'd and Gligar in Stadium 2?

Thanks in advance.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2018-06-08 16:41:25
The only requirement for the game to consider a Pokémon "yours" is that your OT and OTID match

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Masuta Satoshi
Date: 2018-06-08 18:25:06

The only requirement for the game to consider a Pokémon "yours" is that your OT and OTID match

My doubt was about two quotes which were wroten here:

START
Misdreavus: Also, does anyone know why I wouldn't be allowed to re-nickname the in-game trade Jynx after using ACE to change my trainer name to TRAINER and my ID to match its ID?

Torchickens: Actually you can do this, but there is one complication. The name TRAINER doesn't consist of each individual letter, but rather the 5D control character (TRAINER) followed by 10 0x50 terminators.

Using 93 91 80 88 8D 84 91 50 00 00 00 won't work because it doesn't match how TRAINER in in-game trade Pokémon is internally stored. To get it to work you need to use 5D 50 50 50 50 50 50 50 50 50 50 instead.

Hope this helps.
END

If I understand correctly, I cant nickname in game trade Pokemon just by having TRAINER as my OT.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Flandre Scarlet
Date: 2018-06-08 19:29:10
It'd probably be easier to just use ACE to change the nickname.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Guy
Date: 2018-06-08 19:52:55
Typing in "TRAINER(end)" during the New Game sequence will not give you the same OT as the owners of in-game trades, even if it looks the same when printed to the screen. It's like how choosing the preset name "RED" isn't the same as typing in "R", "E", "D", and then the end marker. The only way I can think of to change your name to 5D 50 50 50 50 50 50 50 50 50 50 would be through ACE.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Masuta Satoshi
Date: 2018-06-09 11:54:54

Typing in "TRAINER(end)" during the New Game sequence will not give you the same OT as the owners of in-game trades, even if it looks the same when printed to the screen. It's like how choosing the preset name "RED" isn't the same as typing in "R", "E", "D", and then the end marker. The only way I can think of to change your name to 5D 50 50 50 50 50 50 50 50 50 50 would be through ACE.

Oh thanks, then it is like they are not the same characters even if it looks the same.

Then maybe, It would be better if I nickname the Pokemon through ACE, any help?
Oh, and this applies to the Pokemon from Pokemon Stadium?: OT: STADIUM, ID: 02000. Or in that case I can just nickname the Pokemon by typing STADIUM as my name?

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2018-06-09 12:18:27
Yes, the name is exactly `STADIUM[50]`. You can use the pseudo-GS setup to change the mon's OT and OTID

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: luckytyphlosion
Date: 2018-06-09 18:27:35
Addendum for Number of Safari Balls for -g m: There are a lot more caveats than what jfb1337 and Azarokkusu listed, so it's best to have the Number of Safari Balls at zero. This is done by either running out of Safari Balls, digging or using an Escape Rope in the Safari Zone, or running out of steps.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: RF_N3WB
Date: 2018-07-09 15:50:26
Hello all, I have two small programs I'd like to share that uses 8F.
They are essentially the Catch Them All and Alternative Catch Them All scripts, but they have been modified to produce a random pokemon each time.
Here they are:

Catch Them All (Randomised)
Item list:
* Any item
* 8F
TM40            x212
TM34            x89
TM08            x201


[b][u]ASM:[/u][/b]
ldh a,($D4) ;Loads random number into a
ld ($D059),a
ret


Alternative Catch Them All (Randomised)
Item list:
* Any item
* 8F
Poke Ball      x240
TM12            x71
Awakening      x1
Potion          x20
TM05            x72
Lemonade        x201


[b][u]ASM:[/u][/b]
inc b
ldh a,($D4) ; Put a random number into a
ld b, a ;Loads random number into b
ld c, $01 ;Pokemon will be level 1
inc d
inc d
call $3E48
ret ; Level is based on c register

Enjoy!