Re: Arbitrary code execution in Red/Blue using the "8F" item
Posted by: pigdevil2010
Date: 2014-04-28 23:50:54
Tangela with 233 HP
Nidoking
Metapod
Haunter
Flareon
Parasect
Growlithe
Tentacool
Grimer
Any Pokemon
; Initial hl = DA7F
$DA7F <- 0A || ld a, (bc)
$DA80 <- 1E ||
$DA81 <- 07 || ld e, 7 ; e = 7
$DA82 <- 7C || ld a, h ; a = DA
$DA83 <- 93 || sub e ; a = D3
$DA84 <- 67 || ld h, a ; h = D3
$DA85 <- 2E ||
$DA86 <- 21 || ld l, 21 ; l = 21
$DA87 <- 18 ||
$DA88 <- 0D || jr D ; pc = DA96
$DA96 <- 00 || nop
$DA97 <- E9 || jp (hl) ; pc = D321
I also finally discovered the code to make it jump to the first stored item.
[size=12pt]8F[/size]
You must have exactly 5 Pokemon in a party, these are
Lv. 25 Pidgey with 24 HP, 36 PP left on the first and second move, 24 PP left on the third move and 13 PP left on the forth move
Parasect with 233 HP
Diglett
Tentacool
Kangaskhan
; Initial hl = D163
$D163 <- 05 || dec b
$D164 <- 24 || inc h ; h = D2
$D165 <- 2E ||
$D166 <- 3B || ld l, 3B ; l = 3B
$D167 <- 18 ||
$D168 <- 02 || jr 2 ; pc = D16B
$D16B <- 24 || inc h ; h = D3
$D16C <- 00 || nop
$D16D <- 18 ||
$D16E <- 19 || jr 19 ; pc = D188
$D188 <- 24 || inc h ; h = D4
$D189 <- 24 || inc h ; h = D5
$D18A <- 18 ||
$D18B <- 0D || jr D ; pc = D199
$D199 <- E9 || jp (hl) ; pc = D53B
[size=12pt]w sm[/size]
You must have exactly 10 Pokemon in the box, these are
Tangela with 233 HP
Spearow
Metapod
Haunter
Flareon
Parasect
Seel
Tentacool
Grimer
Any Pokemon
; Initial hl = DA7F
$DA7F <- 0A || ld a, (bc)
$DA80 <- 1E ||
$DA81 <- 05 || ld e, 5 ; e = 5
$DA82 <- 7C || ld a, h ; a = DA
$DA83 <- 93 || sub e ; a = D5
$DA84 <- 67 || ld h, a ; h = D5
$DA85 <- 2E ||
$DA86 <- 3A || ld l, 3A ; l = 3A
$DA87 <- 18 ||
$DA88 <- 0D || jr D ; pc = DA96
$DA96 <- 00 || nop
$DA97 <- E9 || jp (hl) ; pc = D53A