Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Glitch City RAM Manipulation and Code Execution (no MissingNo. needed) - Page 1

Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)

Posted by: Krys3000
Date: 2015-09-13 13:06:56
A WAY TO EXECUTE CODE USING THIS, REQUIRING NO MISSINGNO. AT ALL, HAS BEEN FOUND. SEE BEYOND THIS FIRST POST. I WILL THOUGH KEEP IT UPDATED

Hey guys. This is something I started following my previous thread in which I discuss and show an example of using Glitch City regions matching with RAM data to perform the Cooltrainer Trick (based on TheZZAZZGlitch's previous discovery of a region matching with the items).

I decided to explore a little more of this and to "map" this specific Out-of-Bounds Glitch City by matching it with RAM data. The results are, I think, worth the try.

More importantly, I decided to work on an English version, since RAM addresses are +5 in other European versions like the french one I normally use

What is this about?

You can view most, if not all, the values of the game's RAM addresses by going to a specific glitch city, in form of 4x4 tile blocks. By doing this, you are literally WALKING on RAM. Basically, having the item whose hex ID is 3C in first position will make the tile block matching with the first item in this glitch city to appear as the tile block whose hex ID is 3C.

This is a tileblockdex for which you must note that some characters are different in english versions so it might lead to differences in some blocks :
http://prama-initiative.com/RBJ/CTRAM1.png

It first was ISSOtm from our website PRAMA Initiative who developped a way to use the blocks generated by stored items to perform an item-custom cooltrainer as shown in the other thread.

Here I will explain how to visualise a lot more RAM data, so you can perform the Cooltrainer with, but also how to change the values directly through glitch city for other useful or entertaining purposes.

How to access to this Glitch City?

Using a glitch to walk through walls (e.g. the ledge method which is easy and doesn't require anything), you can access this OoB Glitch City by walking, starting from here (south of Fuschia City):
[img]http://prama-initiative.com/RBJ/rammap.png[/img]
And walking 104 steps left then 95 steps up. This is an example entry point I use on my grid below:

Matching RAM with blocks

[img]http://prama-initiative.com/RBJ/ram-grid.png[/img]

If you followed the steps above, you will be as indicated on a block matching with RAM address $D524. The GC is organized in rows of 56 blocks matching with 56 addresses, then you go back to block 1 of the following row for the following address. In this grid, I voluntarly skip the first three and last three addresses of each row.
You can visualize them but I don't recommand it, because their behaviour is random; they will turn into something else when you hit start (e.g. water, even though the value of this address does not match with water blocks). This makes them unusable for the Cooltrainer Trick, and also, you will not be able to manipulate their value anyway.

Here, I indicate which block match with which address using informations from datacrystal. As you can see, you can visualise the data from some Pokémon (stats, moves, names etc.), money, items, Pokédex, rival's name and much more. The big white space between player's ID and stored items is audio and tileset data. I don't know much on how to use them so I will not talk about this.

I personnally never went further the 5th Pokémon data but I assume you can continue to go up to find new data, such as you can go down and reach event flags or stored Pokémon.

If you intend to perform the cooltrainer trick, since you will need a block containing a tree below the block with the good tile for the Pokémon you want, the best thing is to use Pokémon data (since you can change stats) or stored items (using, for example, item 1 and 29 as I did in the video of the other thread). Of course, you can use "bag" items, and generate a tree from Badges data - this is what we did first at PRAMA before ISSOtm finds the stored items region.

Manipulating the data

Now what is really awesome here is that we can manipulate this data. This is very limited and certainly is not an in-game memory viewer. But you will be able to get 8F and ws||'lm|| with this, allowing you to execute code without MissingNo. or any form of corruption.

The only way for the player to change a tile block from one to another is this tile block having grass or a cuttable tree and cut it. There are 7 tiles block you can Cut (hex values 0B, 32, 33, 34, 35, 60, D5). This means if a value on ANY address you can reach is one of those, you can manipulate it.

- 0B is a grass block. Once cut, it will turn into block 0A. This lowers a value by 1, meaning if you wanted to have a special stat of 10 but unfortunately got 11, you can fix that.
- 32 is a block containing a cuttable tree in the upper right corner. Once cut, it becomes block 6D. This is a good way, for example, to turn a stat of 50 to 109.
- 33 has a cuttable tree in the down-right tile. Once cut, it becomes 6C.
- 34 has one in the upper-left corner and turns to 6F. This is the highest available value by GC RAM Manipulation.
- 35 has one in the upper-right corner too, and turns to 4C.
- 60 has one in the down-left corner and turns to 6E.
- 5D is a glitched block. Cutting the tree won't change anything to the tile, who will still have a tree and a hex value of 5D.

Outside from obvious uses of getting more money, more casino chips, or better stats for your Pokémon easily, this is also important because of hex value matching with items, moves and Pokémon.

Here is another excel table:
[img]http://prama-initiative.com/RBJ/ram-corres.png[/img]

As you can see this is useless for player's name manipulation. So bad. About Pokémon, probably the only useful thing here is to change Lickitung for Exeggutor… and if you have the good MissingNo. I guess it's an easy way to get Poliwrath.
Then you can learn Solar Beam to any fire-type Pokémon which previously know Flamethrower. Considering this is a powerful attack you could use on a ground or rock-type foe.

But it becomes even more fun when you deal with items (besides having a whole lot of moon stones) as you can use this to get glitch items without the need for ACE or expanded item pack! Probably glitch items 6D and 6E are not realistic because you can't have the prototype PP Plus or 11F (floor) item in game.

Item 6C reads $3DED (ROM data) so it's probably useless, however using Item 6F execute code from $CDD1 which is inside a tile buffer ; this address particularly is a tile from the Start menu when it is open. The code here jumps to $9C60 which is a screen tile. I don't know is this can lead a code execution but I'll check that some day. It's not the most important part of this glitch.

Trigger a PC overflow and taking advantage of it

Now this is the most recent and maybe the major breakthrough here. You can have a maximum of 50 items inside the PC. 50 is hex:32, so it's a cuttable tile! If you cut the tree in it, it will turn into 6D… which is 109 stored items. You just activated an overflow.

Use the PC overflow to trigger an inventory underflow (and execute code)

The most complete form of using this is also very easy. You will have a lot of items x0 in this overflow. Just toss 1 item of one stack and withdraw the remaining x255. You don't need anything else to perform a regular dry underflow and get an expanded item pack.

Now you can use this to manipulate bytes and also get 8F / ws*l||lm||. Click here to read more about 8F Code Execution.

Use the PC overflow to directly get glitch items such as ws*l||lm||

If you play Yellow, you might wanna do this trick with 63 casino chips. Doing so, once the PC is at 109 items, your 52nd item will be ws*l||lm||, which is the item you need to execute code. You don't even need to underflow your item menu anymore.

I'm working on a R/B adaptation of this but you can't have 5E (hex for the item 8F used in R/B code execution) chips. Maybe some addresses after can be used but they are indicated as "Missable Object Flags" and I don't know what that means.

Anyway, using the chips, you can get pretty much any item or glitch item whose hex value contains no letters. This includes a lot of "xF" and "x||lm||" items but I still need to watch if they are documented. Also Surfboard, Master Ball, etc. are easy to get.

Use the PC overflow to directly get the 8F item (or others items you could not get with the casino chips trick

From item 55 onwards, items match with the fact that you did or did not picked visible items on Routes (see posts below) with one address/item matching with the current status of 8 items (one per bit). Therefore, there is a way to use this to get some items, including the 8F item (hex:5D) for code execution.

if you have picked :
- Hp Up on Route 2
- TM04 on Route 4
- TM30 on Route 9
- TM16 on Route 12

But haven't picked :
- Moon Stone on Route 2
- Iron on Route 12

And the Snorlax in Route 12 is still sleeping, then 8F will appear as the 56th item in the PC.

Delete an item

Well this is a more a side trick but it can be useful if, for some reason, you wanna get rid of a rare, untossable item, or a glitch item. Then, just have 11 items (PC or held) with the last being this item. Then go to the number of items spot in Glitch City (the one according whether you chose to do that in the stored items or not) and cut the grass. The item will be deleted as the number of items drops to 10.

Sorry for the long post, I think it comes to an end now (for now). Next step is the dex. Don't hesitate to tell me what you think about all this!

Re: Glitch City RAM Manipulation

Posted by: Xiphiidae
Date: 2015-09-13 22:47:09
Very interesting post!
Just one error to point out though; in your last table, you have the Pokémon listed for hex value 6E as Ditto, when it should be Poliwhirl.

Re: Glitch City RAM Manipulation

Posted by: Krys3000
Date: 2015-09-14 03:22:18
Hmm, copy-paste mistake…

Fixed. Thank you!

Re: Glitch City RAM Manipulation

Posted by: Krys3000
Date: 2015-09-14 10:57:39
Guys, I'm a complete newbie on this but thanks to ISSOtm who assisted me, it seems glitch item 6F executes code from CDD1.

CDD1 is indicated as part of "second buffer for temporarily saving and restoring current screen's tiles (e.g. if menus are drawn on top)" on pokéred. Apparently it points to the tile just before the Pokémon option in the start menu. ISSO says when you use the item, it executes some code then jumps to 9C60 which is a screen tile we could use.

Do you think we can execute code from here? Or just give ourselves 8F (the item) so we could do 8F ACE without the need for any MissingNo. ? That would be a major breakthrough.

Then, glitch item 6C reads from 3DED but I don't know if this is useful.

Re: Glitch City RAM Manipulation

Posted by: Krys3000
Date: 2015-09-15 12:24:55
Oh my God, I think I just discovered a way to arbitrary code execution using this.

If you have 50 stored items in your PC, which is the maximum, the tile block matching with the number of stored item (first dark red block on the image above) is 32. If you cut it, it will turn into 6D… which is 109 stored items. You just activated an overflow.

Now the only thing you have to do is to go to a PC and take any x255 item (toss one item of the numerous x0 items then take it) and perform the "dry" item underflow in the item menu to get 8F.

You can also toss 255 of the 100th item just like explained here and perform the no-trainer ditto trick to get MissingNo. so it will allow you to make a new stack of 255. But this is time lost :D

Finally, finally, we have a method ANYONE can do, in Red Blue AND Yellow, without the need for MissingNo. Without the need for a trainer, for a specific name, for a working cooltrainer corruption or super glitch. You just need fly and cut and the world is yours.

I am so happy.

Re: Glitch City RAM Manipulation

Posted by: The G-Meister
Date: 2015-09-15 13:02:55
Oh wow, that's nice!
Only 1 thing, how, if at all, is it possible to get the PC back to normal? And if we can't, how do items behave when deposited?

Re: Glitch City RAM Manipulation

Posted by: Krys3000
Date: 2015-09-15 14:22:53
To fix an underflow, whether it is on the PC or the item menu, you normally need to buy new items until it becomes impossible to go beyond the CANCEL button. However here, we have a non-complete overflow and this won't work.

But this is not a problem even if you can't fix the PC this way, since you can do arbitrary code execution to set back the number of items into an acceptable value.

I'm adding two interesting thing :

Directly get "ws l'm" and other items/glitch items without underflowing

If you play Yellow, you might wanna do this trick with 63 casino chips. Doing so, once the PC is at 109 items, your 52nd item will be ws l'm, which is the item you need to execute code. You don't even need to underflow your item menu anymore.

I'm working on a R/B adaptation of this but you can't have 5E (hex for the item 8F used in R/B code execution) chips. Mayne some addresses after can be used but they are indicated as "Missable Object Flags" and I don't know what that means.

Anyway, using the chips, you can get pretty much any item or glitch item whose hex value contains no letters. This includes a lot of "xF" and "x||lm||" items but I still need to watch if they are documented. Also Surfboard, Master Ball, etc. are easy to get.

Delete an item

Well this is a more a side trick but it can be useful if, for some reason, you wanna get rid of a rare, untossable item, or a glitch item. Then, just have 11 items (PC or held) with the last being this item. Then go to the number of items spot in Glitch City (the one according whether you chose to do that in the stored items or not) and cut the grass. The item will be deleted as the number of items drops to 10.

Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)

Posted by: The G-Meister
Date: 2015-09-15 16:02:29
Thought it might be that simple… although is it? That's a lot of items to buy… 146? And won't they have to be different to the ones you already have?… which means you'll need quite a bit of cash to buy them all, if that many are even obtainable. I'm not sure exactly what goes on, but perhaps removing items might be easier?

And if it's hard to get exactly the right amount of casino chips for "8F", if you can swap an item into the casino chips bytes (or simply get the right amount of chips) such that it yields one of the tiles with grass or trees in, then you can go and cut the grass/tree to give you more than 5E chips, then you can simply spend some to get the right amount… unless it happens to work the same way the money did with the capping :/

Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)

Posted by: Krys3000
Date: 2015-09-16 04:03:56
Yes, that is the problem. If you appear to have 6D chips (appearing as 6[tile]), the game behaves as 67 chips. If you spend 3, you will have 64 left. It will be impossible, then, to naturally go to an amount of 5D.

Other available bytes are Active box second byte (which I don't really understand how it works), address $D5A3 which is mentionned in the disassembly as "unused" although it happened that its value changed in my games.

Then we move on those Missable Objects Flags which are probably our best shot. I don't however understand what they are.

About the overflow fix, you are probably right. One more realistic solution is, once you have 8F/ws*l'||lm|, to prepare this before using it with the proper Pokémon setup:

Any item
8F / ws*l||lm||
Limonade x50
TM34 x213
Dire Hit x201

In english games, and

Any item
8F / ws*l||lm||
Limonade x50
TM34 x213
S.S. Ticket x201

in any other european game.

This is an example code to set back the total items in storage to 50 but you can also delete some items by modulating the number of Limonades. All those items at such quantities can be obtained with the underflow.

Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)

Posted by: Krys3000
Date: 2015-09-18 05:54:10
Here is the video about this glitch to make all this a little more visual  ;)

[youtube]https://www.youtube.com/watch?v=fH-W5hfpkFQ[/youtube]

As always I wrote too much in French so this is the english description:

[EN:] This video was made by Krys3000 of the PRAMA Initiative.

It shows how to trigger the Item Underflow Glitch and, therefore, 8F Arbitrary Code Execution (meaning also the trainerless Ditto Trick) without the need for MissingNo.'s item duplication.

This very recent discovery within the team changes everything because it is now possible to everyone, including those who can't use the Old Man Trick (bad name or yellow), defeated all trainers, and for whom the cooltrainer corruption does not work, to execute code!

Torchickens' video about "dry" item underflow :
https://www.youtube.com/watch?v=ZyppANEvnh8

http://glitchcity.info/wiki/index.php/Arbitrary_code_execution

The glitch is based on PRAMA team member ISSOtm's discovery of a glitch city region generated from stored items. We first used that to create custom cooltrainers.

https://www.youtube.com/watch?v=kUie0JMqYGM

For more informations about custom cooltrainers using RAM and possible RAM Manipulations through Glitch City, please refer to this : http://forums.glitchcity.info/index.php/topic,7353.0.html

In this precise application, when you have 50 different stored items in the PC (which is 32 in hexadecimal) the 4x4 tile bloc matching with memory address $D53A ($D539 in yellow) (stored items number) contains a cuttable tree. Once cut, the block changes into the hex:6D tile block (dec:109) which makes the number of stored items to become 109. Manipulating the 59 extra items allows RAM manipulation, allowing you to :
- Generate trainerless ditto trick on several routes by changing the quantities of items starting from the 95th.
- Get many items and glitch items as 54th item, by changing the quantities of casino chips (every item with a hex ID of x0 to x9 with x being not more than 9 can be obtained); this allows to get ws*l||lm|| without underflow.
- Get a stack of 255 items to generate a classical "dry" underflow in the item menu.

UPDATE : It is also possible to get items like the 8F item (which allows code execution in R/B) directly in the PC if you haven't picked up some items on Routes. Scroll down to the post below for an explanation.

Step-by-step:

1/ Have a Pokémon with Fly and one with Cut.
2/ Store 50 different items in your PC, and only useless items in your "bag".
Recommended: Don't have more than 99 casino chips.
Recommended if you want to get 8F or ws*l||lm|| with the underflow: have a X Special in your bag.
If you play Yellow and want to get ws*l||lm|| without underflow: Have 63 casino chips.
3/ Perform the Noclip Trick:
3.1/ All your Pokémon must be fainted but one, which must be poisoned. Go to Fuchsia City inside the Pokémon Center, then go out and enter Safari Zone.
3.2/ Exit immediately, answer NO to get back inside the Zone, and walk a few steps.
3.3/ Note your remaining steps, save and reset. Exit the Zone counting your steps. You must jump a ledge with your 500th step including those made before the reset and those to exit the Safari Zone. You will be called back in the Hall with the ability to walk above walls. The poisoned Pokémon must not faint during this step, so heal it when needed.
3.4/ Allow your poisoned Pokémon to faint by walking inside the hall without exiting the map. You will be back in Fuchsia's Pokémon Center with the glitch active.
4/ Place yourself above the wall in the intersection with Sea Route 19 (as in the video). Do 60 steps left and 95 steps up to reach the Glitch City region generated from stored items. In Yellow games, you have to do 62 steps left instead of 60. In European non-english games, you have to do 50 (R/B) / 52 (Yellow) steps left instead of 60, which is what I do in the french version in the video. Then, cut the cuttable tree.
5/ Fly anywhere and access the stored items to go below the 50th.
To get ws*l||lm|| without underflow: withdraw ws*l||lm|| (54th item)
To generate an underflow in the item menu, toss one of any item with a quantity of 0 and withdraw the remaining 255 (if you have less than 100 coin chips, the 53th item is x0)

Code Execution through underflow:

1/ Place the x255 item as third and toss the first two.
2/ Toss 255 of this item until you can only select two items (the second one being in fact CANCEL).
3/ Toss 253 of the first item.
4/ Switch twice item 1 and 2. The underflow is active.
5/ Go to the eastern entrance of Celadon, as shown in video. Switch the X Special with the Nugget x1 in 35th position.
6/ Do 5 steps left, 5 steps down, 20 (R/B) or 26 (Yellow) steps right and open the item menu to find 8F / ws*l||lm||. Switch it back with the Nugget.
7/ Fly to any town, store the item in the PC, buy a new item and withdraw the 8F / ws*l||lm|| item (which was in position 110.)
8/ Prepare a proper Pokémon setup for code execution as explained in the link above.

Special thanks in the video at the end. Also a little bonus with a game :)

It's in french, but you can, if you want, use our compilator to generate easily 8F codes. It was made by ISSOtm
http://www.prama-initiative.com/8F/

Re: Glitch City RAM Manipulation and Code Execution (no MissingNo. needed)

Posted by: Krys3000
Date: 2015-09-21 09:33:41
It's me again and this time with a way to get the item 8F for code execution without the item menu underflow!

As suggested earlier this is a bit more complicated than having casino chips. Fact is, item above 50 are organized this way:

- 51: [Cancel] x[Active box number byte 1]
- 52: [Active box number byte 2] x[Number of HOF teams]
- 53: [Apparently Unused] x[Casino Chips Byte 1] (this is why this item basically always is hex:00 x0 if you have less than 99 chips, allowing you to get an easy x0 item to underflow the item menu)
- 54: [Casino Chips Byte 2] x[first address of the Missable Object Flags section] (this item is used to get easily ws l'm, with 63 casino chips)
- 55 onwards : Missable Objects Flags section, followed by the Game Progress Flags section which includes the Map Scripts (accepting only 0 and 1 as value) used for trainerless ditto trick.

I did not know what Missable Objects Flags were about until Torchickens eventually found out that setting address $D5A9 (matching with item 56 in the "PC overflow") to FF gets the visible items of Route 2 to appear again.

So this is what it is about; this address controls the 8 first visible items you could get on Routes, each bit controlling one. I insist of "visible" because hidden items are not controlled by this address, and on "Routes" because visible items of Viridian Forest or Mt Moon, for example, will not affect its value neither. For some reason, when you start a new game the value begins at 1 and not at 0. For the remaining 7 bits, the items are :
- 1: default
- 2: Moon Stone (Route 2)
- 3: Hp Up (Route 2)
- 4: TM04 (Route 4)
- 5: TM30 (Route 9)
- 6: Snorlax (Route 12). Yep, it is considered as an item!
- 7: TM16 (Route 12)
- 8: Iron (Route 12)

Long story short: if you have picked the Hp Up, the TM04, 30 and 16, but haven't picked the Moon Stone, the Iron, and the Snorlax in Route 12 is still sleeping, then $D5A9 value is 5D (bin:01011101) and then 8F appears as the 56th item in the PC.

This is only one method and since probably everyone awoke the Snorlax here, keep in mind there are surely many more using the other missable object flags addresses  ;)