Re: Arbitrary code execution in Red/Blue using the "8F" item
Posted by: Torchickens
Date: 2014-04-15 13:55:50
Here it is:
Notes: Though it's normally impossible for DA94 (end of list terminator, FF) to be E9, using ws m will change it to this value. This is perfectly safe. Only problem is if you withdrew a Pokémon and DA93 (20th Pokémon) was not FF, but this is not possible in normal gameplay.
(You must have exactly 19 Pokémon in the box.)
When you deposit a 20th Pokémon, after using w sm, DA94 gets changed back to FF again.
Pokémon:
Butterfree
Voltorb
Gyarados
Spearow
Golduck
Poliwrath
Voltorb
Pikachu
Clefairy
Golduck
Venomoth
Metapod
Tangela
Nidoking
Haunter
Flareon
Parasect
Growlithe
Voltorb
Which would make the RAM and ASM looked like this:
; Initial hl = DA7F
$DA7F <- 13 || inc de
$DA80 <- 7D || ld a, l ; a = 7F
$DA81 <- 06 ||
$DA82 <- 16 || ld b, 16 ; b = 16
$DA83 <- 05 || dec b ; b = 15 (since Mew is unobtainable)
$DA84 <- 80 || add a, b ; a = 94
$DA85 <- 6F || ld l, a ; l = 94
$DA86 <- 06 ||
$DA87 <- 54 || ld b, 54 ; b = 54
$DA88 <- 04 || inc b ; b = 55 (since Raichu is unobtainable in Yellow)
$DA89 <- 80 || add a, b ; a = E9
$DA8A <- 77 || ld (hl), a ; $DA94 <- E9
$DA8B <- 7C || ld a, h ; a = DA
$DA8C <- 1E ||
$DA8D <- 07 || ld e, 7 ; e = 7
$DA8E <- 93 || sub e ; a = D3
$DA8F <- 67 || ld h, a ; h = D3
$DA90 <- 2E ||
$DA91 <- 21 || ld l, 21 ; l = 21
$DA92 <- 06 ||
$DA93 <- FF || ld b, ff ; rst 38 prevention
$DA94 <- E9 || jp (hl) ; finally jumps to $D321!