Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Arbitrary code execution in Red/Blue using the "8F" item - Page 56

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Couldntthinkofaname
Date: 2018-07-09 16:04:49

Hello all, I have two small programs I'd like to share that uses 8F.
They are essentially the Catch Them All and Alternative Catch Them All scripts, but they have been modified to produce a random pokemon each time.
Here they are:

Catch Them All (Randomised)
Item list:
* Any item
* 8F
TM40            x212
TM34            x89
TM08            x201


[b][u]ASM:[/u][/b]
ldh a,($D4) ;Loads random number into a
ld ($D059),a
ret



[size=12pt]Encounter random Pokemon or trainer[/size]

This code, when used , will encounter a completely random Pokemon or Trainer.

8f
Any Item xAny Qnty
Poke Ball x250
TM11 x255
TM34 x89
TM08 x201

inc b ; Useless Filler
ld a,($ffd3) ; Put a random number into a
ld ($d059),a ; force encounter with a
ret ; "It's first grade, Spongebob"


Save your game before using there's a chance you'll encounter a ZZAZZ trainer or a game-crashing pokemon.
Enjoy!


lol

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2018-07-09 17:27:30
Awesome idea! Thank you for this RF_N3WB! ^^

Now that I think about it you could probably do this with grass/water encounters, then hijack the OAM DMA. If you change the meta-map script ID of select locations to run that as an arbitrary script, you can effectively create a randomiser that persists after saving and resetting without having to modify the ROM, and it could create interesting scenarios at times because certain glitch Pokémon or glitch Trainers could freeze or softlock the game.

It also reminds me of luckytyphlosion's code to make Pokémon Blue play itself with RNG.

This is one of my 'random' codes to make the game play random music and flash random colours while spinning the player character around and making him jump ('crazy effect'), where the relevant value is also pseudorandom number taken from FFD3 ("d-sum") for use at item 5 (D325), but for Pokémon Yellow. You can use it by modifying D36D/D36E to point to item 5 which can be done by placing Iron x211 at item 41.

Awakening x32
TM40 x 211
TM05 x 17
Water Stone x4
Lemonade x255
TM34 x53
TM15 x250
TM11 x255
TM34 x92
TM11 x201

Code: 0e 20 f0 d3 cd 11 22  04 3e ff ea 35 d7 fa d3 ff ea 5c d3 c9

ld c,20            ; sound bank=20
ld a,(ff00+D3)  ;random sound/music from D-sum byte 1
call 2211        ;change music
inc b              ;junk code
ld a,FF
ld (D735),a      ;D735=FF; jump/spin
ld a,(FFD3)
ld (D35C),a      ;random palette from D-sum byte 1
ret

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: RF_N3WB
Date: 2018-07-15 07:18:19

lol

Damn it, I knew I got that idea from somewhere. Oh well, at least it uses 293 less items than your code 8)

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Searinox
Date: 2018-08-04 08:41:42
I'm curious, have there been any attempts to find a bootstrap/glitch item that works for ACE in battles?

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2018-08-04 12:12:52

I'm curious, have there been any attempts to find a bootstrap/glitch item that works for ACE in battles?


8F and ws m can already be used in battles, provided you have the correct party/box set up, which is usually the same as if you were using the item outside of battle.

For example, you can use a code to change D8CF (enemy species) by using 8F in battle. In this case, while the enemy sprite does not update, the Pokémon that you catch will update after throwing a Master Ball.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Searinox
Date: 2018-08-05 01:44:59
Thank you! ^O^ I guess I expected too much of the memory layout to change between battle and overworld. Having just tested it now, it does indeed work and is impressively reliable.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2018-08-05 02:12:11

Thank you! ^O^ I guess I expected too much of the memory layout to change between battle and overworld. Having just tested it now, it does indeed work and is impressively reliable.


You're welcome, glad this helped! ^^

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: ISSOtm
Date: 2018-08-06 08:07:40

I guess I expected too much of the memory layout to change between battle and overworld.

Since everything is allocated statically, the memory layout is always the same.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: SirCrunoke
Date: 2018-08-26 15:32:28
Hey Guys,
Im kinda new to this whole 8F thing, but I kinda could need some help.
So I didnt read all of this thread, though it is planned. But I read much about this which was really helpful.

Lets start with my Problem:

So at first I was kinda scared about damaging my game with 8F, so I decided to capture some of the Pokemon I wanted to capture with the Trainer Fly Glitch and the big Map helped me to catch some of them. But suddenly when I think I was about to catch Golem, I encountered a Super Nerd, with I think it were 3 or 4 Pokemon on mid 20 Level. So I didnt thought much about and fought him, but when I beat him another fight with the same Trainer happend. I thought thats kinda wrong but decided to fight him and see if theres anything wrong with the Game. So I had Music turned off at that point and didnt realised much, so I went to a Pokemon Center and I dunno remember why I did but I changed boxes out of the awareness it would safe the game. I headed back to the Rout and noticed it would be a bit glitchy and laggy, so I turned on the Music and it would Sound like the right Melody. So I Hard resetted the GBA SP I play on and noticed Im at the PC in the Pokemon Center cause of Box Change. I googled about it and after a bit I read in this thread Glitch_meta-map_script_activation about solving the Problem with ACE. But I couldnt find any Code to help and I dont got that good programming skills. Actually it was Route 8 I messed up and the trainer to use the Trainer Fly Glitch is the furthest left one. Dunno if that helps, Im trying to remember as much as possible.


And I got another question which is:

In this Video I saw it is possible to turn a whole box into "shiny" Pokemons. This could be made to "turn a whole box into perfect Pokemons", couldnt it? Didnt know how to figure out the code for this also. Actually I found some to turn a single Pokemon into perfect, but some of them are for Yellow and some for EU versions.

About my Version:
I actually dont really know, I think its a US Version. I bought it on Ebay, cause I saw it there and it is the green one in a green Cardridge, but it is English and like the blue one.(green is my favourite colour so I had to buy it, even if it wouldnt work properly, but it actually does.) The Battery was empty in one of the ordered Cardridge, so I changed both and realized theyre not Original ones, though everything is working fine like it does in the Original ones. Including Trainer Fly Glitch, MissingNo as "SquareSign 'M SquareSign", Item Underflow and last but not least 8F with the Bootstrap Pigdevil2010 and the Codes of this thread ""CATCH 'EM ALL" SCRIPT","CHANGE THE SECOND ITEM" and also this one "Non-key item duplication"

I think the "normal" Red/Blue Codes should work.

Thanks for reading me out and sorry if I posted this in the wrong place, I kinda figured out this is a helpfule thread.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2018-08-26 16:37:10

Hey Guys,
Im kinda new to this whole 8F thing, but I kinda could need some help.
So I didnt read all of this thread, though it is planned. But I read much about this, including the big ZZAZZ thread, which was much helpful.


Hello SirCrunoke! Sure, we're happy to help. Welcome to the forums! :)


Lets start with my Problem:

So at first I was kinda scared about damaging my game with 8F, so I decided to capture some of the Pokemon I wanted to capture with the Trainer Fly Glitch and the big Map helped me to catch some of them. But suddenly when I think I was about to catch Golem, I encountered a Super Nerd, with I think it were 3 or 4 Pokemon on mid 20 Level. So I didnt thought much about and fought him, but when I beat him another fight with the same Trainer happend. I thought thats kinda wrong but decided to fight him and see if theres anything wrong with the Game. So I had Music turned off at that point and didnt realised much, so I went to a Pokemon Center and I dunno remember why I did but I changed boxes out of the awareness it would safe the game. I headed back to the Rout and noticed it would be a bit glitchy and laggy, so I turned on the Music and it would Sound like the right Melody. So I Hard resetted the GBA SP I play on and noticed Im at the PC in the Pokemon Center cause of Box Change. I googled about it and after a bit I read in this thread Glitch_meta-map_script_activation about solving the Problem with ACE. But I couldnt find any Code to help and I dont got that good programming skills. Actually it was Route 8 I messed up and the trainer to use the Trainer Fly Glitch is the furthest left one. Dunno if that helps, Im trying to remember as much as possible.


This usually happens if a. if you use the death-warp method and don't flash the Start menu as the last menu, or I think b. if your last text box corresponds with a Trainer text after you return.

Additionally though it sounds like you got a text box encounter upon entering the route, if the last Trainers walking animation hasn't finished, the Start menu won't appear which is the reason why you have to either battle another Trainer who walks up to you, or change boxes and be guided by the Pewter Museum man, or the Hall of Fame sequence, or by pushing a Strength boulder.

According to the article, Route 8's script is at D601. When a Special encounter script (requiring the walking animation to have finished) is active this value is at 01, and by defeating the Trainer it advances the script value further, which is the cause of the glitch scripts and/or walking lag.

So with the following 8F code, you may be able to reset it.

Poké Ball x 175
TM34 x 1
TM14 x 201

Source:

04 AF EA 01 D6 C9

inc b (technically not needed, but getting the hex:AF glitch item is harder)
xor a (if we xor a with a (which this operation does), we always get 0. This is often more convenient than a x0 quantity which requires the Celadon looping map glitch or another item beyond the end of items list)
ld (d601),a (load 'a' into D601)
ret (end the code)

TM34 is a prize for beating Brock and TM14 can be found at the Pokémon Mansion, but you can get them infinitely with the expanded items pack combined with Celadon looping map glitch.

https://glitchcity.info/wiki/Expanded_item_pack
https://glitchcity.info/wiki/Celadon_looping_map_glitch

Alternatively, set up dry underflow (described in the expanded items pack article above) but in the PC item storage. According to the glitch meta map script activation article the script for Route 8 is represented by PC item 100's quantity, so if you find an item that is x0, you can place it there (but beware not to swap one kind of item stack with itself e.g. a j. with a j. as the game will try to merge the stacks).


And I got another question which is:

In this Video I saw it is possible to turn a whole box into "shiny" Pokemons. This could be made to "turn a whole box into perfect Pokemons", couldnt it? Didnt know how to figure out the code for this also. Actually I found some to turn a single Pokemon into perfect, but some of them are for Yellow and some for EU versions.


Hmm I'm unsure too, sorry on this case. :(

For a Pokémon to be Shiny its Attack IV must be 2, 3, 6, 7, A (10), B (11), E (14), or F (15), and its other IVs must be A (10) each. So for stored Pokémon 1, DAB1 (Attack/Defense DV) must be 2A, 3A, 6A, 7A, AA, BA, EA or FA and DAB2 (Speed/Special DV) must be AA.

Crystal_'s whole box code definitely sets 'a' to to AA, and it may be that it sets both Attack/Defense and Speed/Special values to AA, which produces a valid Shiny. At a glance I'm not confident enough to know if it works this way, but if you change the value to FF there's a chance it will produce all perfect DV Pokémon. This may apply to the single Pokémon code as well.


About my Version:
I actually dont really know, I think its a US Version. I bought it on Ebay, cause I saw it there and it is the green one in a green Cardridge, but it is English and like the blue one.(green is my favourite colour so I had to buy it, even if it wouldnt work properly, but it actually does.) The Battery was empty in one of the ordered Cardridge, so I changed both and realized theyre not Original ones, though everything is working fine like it does in the Original ones. Including Trainer Fly Glitch, MissingNo as "SquareSign 'M SquareSign", Item Underflow and last but not least 8F with the Bootstrap Pigdevil2010 and the Codes of the ZZAZZ thread ""CATCH 'EM ALL" SCRIPT","CHANGE THE SECOND ITEM" and also this one "Non-key item duplication"

I think the "normal" Red/Blue Codes should work.


Hmm is the Green one Pokémon Green? Pokémon Green was never officially released outside of Japan, so it looks like you may have got a bootleg copy. Official Japanese Red/Green cartridges only had a coloured sticker and a grey cartridge. I'm afraid I'm unsure if English Red/Blue codes will work for it, sorry. It's possible they use the Japanese codes instead, or neither. I think to test you can try both 01xx59D0 (English instant encounter) and 01xx36D0 (Japanese instant encounter). This way you can have a good idea whether other English or Japanese codes will work.


Thanks for reading me out and sorry if I posted this in the wrong place, I kinda figured out this is a helpfule thread.


You're welcome! ^^ That's OK, yes, this is the right thread. :)

Hope these tricks work for you!

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: SirCrunoke
Date: 2018-08-27 11:56:48
I found a Video  which explained it alot. Its very much like this Route 8 (around 6:30 he starts the battle and than enters the Route), but also my Music is a more glitched at the start. But as in the Video, the 4 Trainers in a row get the game very glitchy.

Poké Ball x 175
TM34 x 1
TM14 x 201


So I just execute this, probably 8F as first or second item and the second one doesnt matter, since the Bootstrap Code starts at the 3rd item slot, and the Route 8 should/may be fixed?
Could there be any sideaffect?

Additionally though it sounds like you got a text box encounter upon entering the route, if the last Trainers walking animation hasn't finished, the Start menu won't appear which is the reason why you have to either battle another Trainer who walks up to you, or change boxes and be guided by the Pewter Museum man, or the Hall of Fame sequence, or by pushing a Strength boulder.


Yeah I think too it was a text box id matching encounter. But it was the last Trainer on that Route to be able to fight, or would another Trainer who walks up to me do the same? I changed the boxes a few times after that, so be guided by the Pewter Museum Man could work too? Actually the same with just pushing a boulder with Strength and triggering Hall of Fame?
Just sounds so easy, that Im unsure if I understood that right.


Source:

04 AF EA 01 D6 C9

inc b (technically not needed, but getting the hex:AF glitch item is harder)
xor a (if we xor a with a (which this operation does), we always get 0. This is often more convenient than a x0 quantity which requires the Celadon looping map glitch or another item beyond the end of items list)
ld (d601),a (load 'a' into D601)
ret (end the code)

TM34 is a prize for beating Brock and TM14 can be found at the Pokémon Mansion, but you can get them infinitely with the expanded items pack combined with Celadon looping map glitch.


I dont really understand any of the Sourc Codes sadly.  :'( You can keep riding them, may I understand it somehow. So I understood hexadezimal system, which was a great moment when I finally understood how easy it is. But I dont know how translating things there and back. The "inc b" to "end the code" thing is totaly off my mind. Just the Text thing saying a qunatity of x0 is kinda harder.
And since I can use the "Change the second Item" 8F code, I dont need to get the TMs on original way. Since I cleared both of them either. But thanks for the mentioning!  :)


Alternatively, set up dry underflow (described in the expanded items pack article above) but in the PC item storage. According to the glitch meta map script activation article the script for Route 8 is represented by PC item 100's quantity, so if you find an item that is x0, you can place it there (but beware not to swap one kind of item stack with itself e.g. a j. with a j. as the game will try to merge the stacks).


So Im not sure if I understand it right here, again. Changing the PC item on place 100 with an item with Quantity x0, would/could reset the glitch also? Dunno if this is the x0 thing which is harder to get you mentioned earlier. But I feel like thats a pretty risky way, though changing the item on place 99 could make another Map Sprict Glitch or even something worse.


Crystal_'s whole box code definitely sets 'a' to to AA, and it may be that it sets both Attack/Defense and Speed/Special values to AA, which produces a valid Shiny. At a glance I'm not confident enough to know if it works this way, but if you change the value to FF there's a chance it will produce all perfect DV Pokémon. This may apply to the single Pokémon code as well.


Like above, I dont really understand putting codes into items, I neither understand putting "Commands" as "change the value to FF" in Codes. So 0xFF should be the max Number possible right? Or at least the FF is the highest "number" possible in hexadizaml systems, am I right?


Hmm is the Green one Pokémon Green? Pokémon Green was never officially released outside of Japan, so it looks like you may have got a bootleg copy. Official Japanese Red/Green cartridges only had a coloured sticker and a grey cartridge. I'm afraid I'm unsure if English Red/Blue codes will work for it, sorry. It's possible they use the Japanese codes instead, or neither. I think to test you can try both 01xx59D0 (English instant encounter) and 01xx36D0 (Japanese instant encounter). This way you can have a good idea whether other English or Japanese codes will work.


Correct, thats what I meant with Green one. Pokemon Green. Actually for that cheap, I didnt really thought it would be an original. And I kinda knew the Green Game would just be a Grey Cardridge with a Green Sticker, cause we already got one of those.  :D But I think thats an Original one, though it is also in English and not in Japenese.
Since the "normal" Codes for Blue English version would pass, I think the English Codes are working for mine Version. But like I mentioned earlier and in the last post, its no original Cardridge, which can be seen by looking into them, they got a lot of other smaller hardware, so maybe some glitches wont work cause any RAM (there is the sRAM and.. dunno what else but there are more Im sure, thats what I mean with that) is may in a different place or is booting something else. I dont know, till now nothing encountered so far.

Actually are these Codes the English Codes? Real English Codes or US Codes? Is there even a difference? There are a lot more versions, or different hard- or softwares than I thought. Is there a reason for this? So clearly for other Languages the Software, but why did the Hardware changed at some Point, and for the European Versions the RAM locations are also sometimes different as far as I understood.  But thats kinda far more I wanted to know  :D

I think I catched everything up. Actually sorry if im misswriting something or if its hard to understand, English is not my main language, as you may noticed.

Thanks for welcoming me, the things I read about this Forum till now, are absolutely great. Why didnt I discovered this earlier?

PS: Since I just came from Work and wrote last post yesterday evening, I couldnt try a trick, but I also was unsure if I did understand that all right and dont want to Glitch someothing else out.
PPS: I hope I did everything right with this answer system (especially the quotes). I have not been active in a Forum since some time.

Thanks again, for the fast answer and the try to help me.  :)

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Torchickens
Date: 2018-08-27 13:18:39
(Answering the questions as they appear)





So I just execute this, probably 8F as first or second item and the second one doesnt matter, since the Bootstrap Code starts at the 3rd item slot, and the Route 8 should/may be fixed?
Could there be any sideaffect?


Yes; the

Poké Ball x 175
TM34 x 1
TM14 x 201

should be placed at item 3, and all you need to do is use 8F (with the party setup to item 3) to activate the code to remove the glitchy Route 8 script. There should be no side effects.





Yeah I think too it was a text box id matching encounter. But it was the last Trainer on that Route to be able to fight, or would another Trainer who walks up to me do the same? I changed the boxes a few times after that, so be guided by the Pewter Museum Man could work too? Actually the same with just pushing a boulder with Strength and triggering Hall of Fame?
Just sounds so easy, that Im unsure if I understood that right.


I think it doesn't matter if it was the last Trainer; you can still get incorrect text box IDs that trigger Trainers even if you have escaped from the first or second Trainer on the route.

For context, when you encounter a Trainer, the "!" mark appears and he or she will walk up to you.

The old Trainer escape glitch method worked like this:

1. Fly or Teleport away from a "long-range" (off screen at first) Trainer.
2. Battle another Trainer who walks up to you (and also, not just by pressing A to talk to them).
3. A "Special stat encounter" is now available on the map in step 1 (provided it is one of the route/cave/Fighting Dojo ones in this list.

After findings such as this, an alternative method was discovered.

1. Fly or Teleport away from a long-range Trainer (alternatively thanks to expanded items pack, we can use any Trainer that can spot you this time (see Rival's effect) by using a glitch item instead, but this is optional)
2. Change boxes and reset the game to get the ability to use the Start with the Start menu back (technically not needed, if the Start menu can open by itself it will)
3. (required) Either be guided by the Pewter Museum man (not recommended, as his sprite may possibly be removed), push a Strength boulder, clear the Pokémon League, or encounter a Trainer who steps up to you as in the old method. All these clear D730, in other words the game thinks the Trainer has finished walking, thus activating "Special stat encounter" on the original map (but you will still need to encounter a Pokémon to load your Special stat).

"Special stat encounter" is usually caused when the map script has a value of 01. If it is possible, the game will load the previous text box (or Start menu if it was the last menu) when you enter the route, normally resulting in an encounter corresponding with the previous opposing Pokémon's Special stat (otherwise address $CD2D), but as you mention, if text-box matching means a Trainer text appears instead, the game will load a Trainer instead of a Pokémon.





I dont really understand any of the Sourc Codes sadly.  :'( You can keep riding them, may I understand it somehow. So I understood hexadezimal system, which was a great moment when I finally understood how easy it is. But I dont know how translating things there and back. The "inc b" to "end the code" thing is totaly off my mind. Just the Text thing saying a qunatity of x0 is kinda harder.
And since I can use the "Change the second Item" 8F code, I dont need to get the TMs on original way. Since I cleared both of them either. But thanks for the mentioning!  :)


Ah yes, I forgot about that code to change items in the inventory ha ha. :) You're welcome.

Basically (though this is a lot of information not all of it is needed in case you want to make new codes) there are three forms that the code can be in here:

Items/quantities, bytes, code

The Big HEX List tells you how to convert them.

For instance here.

[img]https://i.imgur.com/0o1daCi.png[/img]

We have byte EA (in hexadecimal). The table says EA is 234 in decimal (you can use this table as a decimal to hexadecimal converter or hexadecimal to decimal converter), which is Red/Blue item TM34, which is ld ($xxyy),a.

The Game Boy operates with a combination of a modified version of Z80 programming language (namely some instructions were omitted), with instructions like ld a, xx call $xxyy etc. the ability to write to RAM (e.g. $xxyy here) an example is D059 like 01xx59D0 in the instant encounter code) or run/execute bytes which the CPU encodes as these instructions.

Because there are many different types of things you can do with the simplified Z80, documenting how it works for Game Boy games is another subject but at its simplest form it can be used to write to RAM like a GameShark (with combination of ld a, xx and ld ($xxyy),a and ret).

The location at which code is run is called the program counter. Some games like Pokémon only intend the game to run ROM or HRAM, but arbitrary code execution allows use to abuse the fact that WRAM (containing variables like our items, Pokémon list) can be executed as the simplified Z80 code despite the fact that they are meant to contain just data.

(These are all the memory regions)

So (also we can look up on the table) if you have a Lemonade, you have a 3E (or 62), or ld a, xx. Depending on where you are in the items list, it will either be an item or a quantity. Usually as a rule, the xx and yy should be regarded as either a value or address (depending on the instruction) so for instance, ld a, 3E means "load 62 into a" and ld ($xxyy),a means "load a into address $xxyy". Note also, when "a" is on the left side of the instruction it can mean you're loading the value into a. When "a" is on the right side of the instruction it can mean you're loading the value into $xxyy etc. Also there are many other letters (called registers), such as b, c, d, e. The inc b means to add +1 to b, but in my code its only use is to make sure xor a is a quantity and not an item to simplify the requirements.





So Im not sure if I understand it right here, again. Changing the PC item on place 100 with an item with Quantity x0, would/could reset the glitch also? Dunno if this is the x0 thing which is harder to get you mentioned earlier. But I feel like thats a pretty risky way, though changing the item on place 99 could make another Map Sprict Glitch or even something worse.


Yes, that's exactly right! :)

Yes, now that you mention it changing PC item 100 is a little risky :( because you could mess up other scripts and other data from D5A0-D639 (or a range like that, not 100% sure) (see https://github.com/pret/pokered/blob/master/wram.asm ) related data depending on where you are in the PC items list and which items you swap or toss from. Most often a quantity of x0 won't cause anything bad; for many map scripts it is essentially just 'no script'. However, if you're changing the item before the quantity, it could mean you're changing the script of another location with an ID corresponding to the item.





Like above, I dont really understand putting codes into items, I neither understand putting "Commands" as "change the value to FF" in Codes. So 0xFF should be the max Number possible right? Or at least the FF is the highest "number" possible in hexadizaml systems, am I right?


Yes, 0xFF is the highest number possible here. Although this is usually 255 (and is represented as x255 in the Lemonade quantity in the codes), in these code's case it probably means all IVs of 15 (F). If this is how it works, then all you need to do is change the Lemonade quantity to 255 to get Pokémon with maximum DVs. Unfortunately I'm not sure if it affects the EVs though (referred to as stat experience in this Generation and Generation II), sorry if you want to get a perfect Pokémon without having to train it in battles.





Correct, thats what I meant with Green one. Pokemon Green. Actually for that cheap, I didnt really thought it would be an original. And I kinda knew the Green Game would just be a Grey Cardridge with a Green Sticker, cause we already got one of those.  :D But I think thats an Original one, though it is also in English and not in Japenese.
Since the "normal" Codes for Blue English version would pass, I think the English Codes are working for mine Version. But like I mentioned earlier and in the last post, its no original Cardridge, which can be seen by looking into them, they got a lot of other smaller hardware, so maybe some glitches wont work cause any RAM (there is the sRAM and.. dunno what else but there are more Im sure, thats what I mean with that) is may in a different place or is booting something else. I dont know, till now nothing encountered so far.

Actually are these Codes the English Codes? Real English Codes or US Codes? Is there even a difference? There are a lot more versions, or different hard- or softwares than I thought. Is there a reason for this? So clearly for other Languages the Software, but why did the Hardware changed at some Point, and for the European Versions the RAM locations are also sometimes different as far as I understood.  But thats kinda far more I wanted to know  :D

I think I catched everything up. Actually sorry if im misswriting something or if its hard to understand, English is not my main language, as you may noticed.

Thanks for welcoming me, the things I read about this Forum till now, are absolutely great. Why didnt I discovered this earlier?

PS: Since I just came from Work and wrote last post yesterday evening, I couldnt try a trick, but I also was unsure if I did understand that all right and dont want to Glitch someothing else out.
PPS: I hope I did everything right with this answer system (especially the quotes). I have not been active in a Forum since some time.

Thanks again, for the fast answer and the try to help me.  :)


Yes :)

In regards to your question, as far as I know, there are no differences between US and English EU Red/Blue/Yellow however I've heard conflicting information that there are differences in the credits. I may have to get a UK Yellow to test because although I live in England my Yellow cartridge is from the Americas. My Red and Blue might be EU English though. All codes I know work the same between EU English and American English/Australasian Pokémon cartridges (side note: a lot of the time the language isn't converted into Commonwealth English anyway).

As for non-English EU Red/Blue/Yellow it's a different story. Many of the RAM addresses in these games are +5 from the original; so for instance 01xx59D0 becomes 01xx5ED0 in French, German, Italian and Spanish versions.

That's all right :), quite a lot of us here don't have English as their native tongue as well.

You're welcome. Ah thanks hehe. ^^

Pleasure, again I hope my post answers some of your questions. :)

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: SirCrunoke
Date: 2018-08-30 13:26:34
Yes; the

Poké Ball x 175
TM34 x 1
TM14 x 201

should be placed at item 3, and all you need to do is use 8F (with the party setup to item 3) to activate the code to remove the glitchy Route 8 script. There should be no side effects.


I forgot to ask, if I need to be at any special place to use that code, but it got answered later on.




Yeah I think too it was a text box id matching encounter. But it was the last Trainer on that Route to be able to fight, or would another Trainer who walks up to me do the same? I changed the boxes a few times after that, so be guided by the Pewter Museum Man could work too? Actually the same with just pushing a boulder with Strength and triggering Hall of Fame?
Just sounds so easy, that Im unsure if I understood that right.


I understood it that way: if I did that, I would remove the glitchy route 8 Script also, but your answer on that cleared it up also. So, nevemind.




Basically (though this is a lot of information not all of it is needed in case you want to make new codes) there are three forms that the code can be in here:

Items/quantities, bytes, code

The Big HEX List tells you how to convert them.

For instance here.

(Image deleted, due to too confusing if it is 2 times in here)

We have byte EA (in hexadecimal). The table says EA is 234 in decimal (you can use this table as a decimal to hexadecimal converter or hexadecimal to decimal converter), which is Red/Blue item TM34, which is ld ($xxyy),a.

The Game Boy operates with a combination of a modified version of Z80 programming language (namely some instructions were omitted), with instructions like ld a, xx call $xxyy etc. the ability to write to RAM (e.g. $xxyy here) an example is D059 like 01xx59D0 in the instant encounter code) or run/execute bytes which the CPU encodes as these instructions.

Because there are many different types of things you can do with the simplified Z80, documenting how it works for Game Boy games is another subject but at its simplest form it can be used to write to RAM like a GameShark (with combination of ld a, xx and ld ($xxyy),a and ret).

The location at which code is run is called the program counter. Some games like Pokémon only intend the game to run ROM or HRAM, but arbitrary code execution allows use to abuse the fact that WRAM (containing variables like our items, Pokémon list) can be executed as the simplified Z80 code despite the fact that they are meant to contain just data.

(These are all the memory regions)

So (also we can look up on the table) if you have a Lemonade, you have a 3E (or 62), or ld a, xx. Depending on where you are in the items list, it will either be an item or a quantity. Usually as a rule, the xx and yy should be regarded as either a value or address (depending on the instruction) so for instance, ld a, 3E means "load 62 into a" and ld ($xxyy),a means "load a into address $xxyy". Note also, when "a" is on the left side of the instruction it can mean you're loading the value into a. When "a" is on the right side of the instruction it can mean you're loading the value into $xxyy etc. Also there are many other letters (called registers), such as b, c, d, e. The inc b means to add +1 to b, but in my code its only use is to make sure xor a is a quantity and not an item to simplify the requirements.


Ahhh! That helped alot! I didnt realized some things.

1. The big Hex list contains the Hex Dezimal conversion too look up (I saw it, but didnt thought about it, did it up myself since Im good in Mathematics)
2. The "Slots" are usable for multiple purposes, so theres the Hexadezimal number, the Pokemon, the item, and the ASM instruction.
3. A little bit of how to use it for myself.

So I dont get it all, but probably if Id spent the time I would get it.
I understand how the Code is build up, but I stuck at what to Load into what address $xxyy.
If I want to get for instance max item, I would put at that place of the quantity a 255 or FF to load into the memory of the item place, do I?
Just for instance, I know there is a Code to reduce item by one to get at 255 easily.
 




So Im not sure if I understand it right here, again. Changing the PC item on place 100 with an item with Quantity x0, would/could reset the glitch also? Dunno if this is the x0 thing which is harder to get you mentioned earlier. But I feel like thats a pretty risky way, though changing the item on place 99 could make another Map Sprict Glitch or even something worse.


Yes, that's exactly right! :)

Yes, now that you mention it changing PC item 100 is a little risky :( because you could mess up other scripts and other data from D5A0-D639 (or a range like that, not 100% sure) (see https://github.com/pret/pokered/blob/master/wram.asm ) related data depending on where you are in the PC items list and which items you swap or toss from. Most often a quantity of x0 won't cause anything bad; for many map scripts it is essentially just 'no script'. However, if you're changing the item before the quantity, it could mean you're changing the script of another location with an ID corresponding to the item.


I think it was a good idea to mention it here again, if somebody reads it up and thinks "ok lets do that". Now he should probably be sure about the risk. Thanks for confirming me.




Yes, 0xFF is the highest number possible here. Although this is usually 255 (and is represented as x255 in the Lemonade quantity in the codes), in these code's case it probably means all IVs of 15 (F). If this is how it works, then all you need to do is change the Lemonade quantity to 255 to get Pokémon with maximum DVs. Unfortunately I'm not sure if it affects the EVs though (referred to as stat experience in this Generation and Generation II), sorry if you want to get a perfect Pokémon without having to train it in battles.


Yes, thats what I need to do, youre right! (Didnt test it yet)
I wrote a comment under that Video, asking about what I asked here, and Crystal_ answered the same as you mentioned.
So Crystal_ answered with that Code. I now ask myself, why is it 2 times in there, and what to use for "Any item xAny" to not do anything wrong or is it really regardless what to use there?




In regards to your question, as far as I know, there are no differences between US and English EU Red/Blue/Yellow however I've heard conflicting information that there are differences in the credits. I may have to get a UK Yellow to test because although I live in England my Yellow cartridge is from the Americas. My Red and Blue might be EU English though. All codes I know work the same between EU English and American English/Australasian Pokémon cartridges (side note: a lot of the time the language isn't converted into Commonwealth English anyway).

As for non-English EU Red/Blue/Yellow it's a different story. Many of the RAM addresses in these games are +5 from the original; so for instance 01xx59D0 becomes 01xx5ED0 in French, German, Italian and Spanish versions.

That's all right :), quite a lot of us here don't have English as their native tongue as well.

You're welcome. Ah thanks hehe. ^^

Pleasure, again I hope my post answers some of your questions. :)


Ah ok, so thats the Codes that should probably work for mine, since it sais US version on the back either.
I would have a lot of German ones (Yellow, Blue and Red) to try codes on, but nevermind the most of them are probably already tested. But would be nice to know what to do to change the codes onto them. You wrote it but like said, I dont get the making of codes fully. So do I just need to decrase every item by 5? No just decrase the RAM addreses by 5. Thats where I stuck, but that should always be the $xxyy, doesnt it? Than I may get it. :)
(The question I was talking about is more than I wanted to know was, if there was a reason for the RAM to be different address than in the EU/US ones.)
The green Pokemon with the gray Cartridge, doesnt say anything about the Version at all. I screwed it up and it got a Battery to slide out like the Fake green I play on now, so maybe its a Fake either, but we bought it in 2006 or so, I dont know if there were Fakes back than. The European version all got soldered Batterys, kinda hard to change without knowledge or tools.

What you wrote helped me alot! Thank you very much!  :)
Like written I kinda get the making of codes now, or at least now how to convert them back into Items  :D
Doesnt expected that much from registering here, but I got really much help in short Time here, really Thanks!
Youre Great. :) Keep up that good attitude!

PS: Is here a tool to give you like a like or +1 or something like that?

Thats again all for now, quite busy the last days, so didnt test it now either, but when I do I gone reply here.

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: wadusher
Date: 2018-10-01 01:16:41
Hey all, I found the need to get several boxfuls of pokemon at exactly the same experience value so as to receive the same nature upon transfer from VC to gen7. Is there an 8F code that can increase/decrease EXP values by very specific amounts, or clone a mon?

Re: Arbitrary code execution in Red/Blue using the "8F" item

Posted by: Krys3000
Date: 2018-10-01 03:54:00
Technically you could either:
- Create a code with a counter that decreases the exp of a Pokémon of a given value. Something like ld hl,a16 ; ld a,(hl) ; sub d8 ; ld (hl),a will do the trick if you want to remove less than 256.
- Directly modify that value to the final amount of exp you need (ld hl,a16 ; ld (hl),d8 if possible).
- Elaborate a more technical code that stores the current Pokémon's exp byte address in hl, the value to give to it in a, 002C in bc, and the number of Pokémon in box in d, then chains ret z, ld (hl),a ; add hl,bc ; dec d somehow ? Note sure about this.

I guess cloning mons can be done also by copying 2C bytes serially. I would use connection copier rather than writing a code I think :p