Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Offgao's memory viewer and Tetris ACE exploits - Page 1

Offgao's memory viewer and Tetris ACE exploits

Posted by: Torchickens
Date: 2017-01-11 12:54:36
Somebody made Tetris with , lol.

https://www.youtube.com/watch?v=baXxP6b7ANQ

Also a memory editor.

https://www.youtube.com/watch?v=IJ7mRJISeO0

Sadly I don't know if they have hosted their code :(

Incidentally offgao is also an infamous Twitter account who has blocked many people (see https://twitter.com/search?q=offgao&src=typd).

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Flandre Scarlet
Date: 2017-01-11 17:10:26

Sadly I don't know if they have hosted their code :(

Good news it appears offgao has hosted the Poketetris and what is probably the memory editor codes on his website http://offgao.net Specifically on the section about Pokemon http://offgao.net/poke/
It appears that he/she is using bytes for box storage for tetris and nicknames for the editor? (I used an English R/B RAM map and am unsure of how fare off JP is.)
It also seems that he/she thinks Poketetris is impossible in English R/B? "海は" which google translate says means "Overseas version is probably impossible." However I know nothing of Japanese and google translate is already known to not be a 100% accurate source. Hopefully the Memory editor can be used overseas as that seems like one of the most useful innovations in years. Although it might need to be rewritten since it seems that party Pokemon are corrupted to an extent?
Also if anyone can read Japanese the video with the memory editor appears to have another fun looking game in it that he/she might explain in it.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Torchickens
Date: 2017-01-11 18:34:15


Sadly I don't know if they have hosted their code :(

Good news it appears offgao has hosted the Poketetris and what is probably the memory editor codes on his website http://offgao.net Specifically on the section about Pokemon http://offgao.net/poke/
It appears that he/she is using bytes for box storage for tetris and nicknames for the editor? (I used an English R/B RAM map and am unsure of how fare off JP is.)
It also seems that he/she thinks Poketetris is impossible in English R/B? "海は" which google translate says means "Overseas version is probably impossible." However I know nothing of Japanese and google translate is already known to not be a 100% accurate source. Hopefully the Memory editor can be used overseas as that seems like one of the most useful innovations in years. Although it might need to be rewritten since it seems that party Pokemon are corrupted to an extent?
Also if anyone can read Japanese the video with the memory editor appears to have another fun looking game in it that he/she might explain in it.


Wow, thanks for that Flandre Scarlet :). Glad to hear they seem to have the code publicly! Yeah, I don't know where DA00-DDFF are in the box data either.

I get the impression maybe what they meant about it possibly not working on Blue (Japanese), Yellow (Japanese) and international versions is if they are calling any routines, changing any specific addresses the code would have to be adjusted for different versions.

I think since TheZZAZZGlitch made Pong which was already a big accomplishment we should be able to make any modifications necessary and create Tetris.

I agree it would be nice if we had a nice memory editor GUI based on offgao's. The button combination method is nice but this seems amazing if we can port it (incidentally k(ry made a similar memory editor a few years ago). Other memory editor codes we have already include TheZZAZZGlitch's coordinates based one and mine which resets item quantities representing address bytes back to 0 after each use.

I think with 海は the only ambiguity in the text might be in [muri], which apparently may mean both "impossible", "unreasonable", though it isn't elaborated on whether this is because code would likely have to be changed or they might not be aware of the glitch items 8F and ws m and how to obtain them, etc.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Yeniaul
Date: 2017-01-11 20:01:26
If I recall right, the range in question is smack-dab in boxed pokemon data.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Cryo
Date: 2017-01-11 21:52:57
Given that box data starts at 0xDE06 in the English versions of Pokemon Red/Blue, it seems like this could totally be possible, especially by using 8F. Unfortunately, it doesn't seem like it'd persist between resets as-is since the last 3 bytes would be truncated to fit the 440-byte limit. (the code is 446 bytes)

Storing it elsewhere (some parts of WRAM) or modifying the code a bit to make it fit should make it persist across resets, but it definitely does work after a few modifications, such as changing the call $3867 instruction to call $3831, which is the JoypadLowSensitivity function in the English version.

[img]http://i.imgur.com/naRbemp.png[/img]

I've attached the source code with modifications to make it work with the English versions when executed from $DE21.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Torchickens
Date: 2017-01-12 08:23:48

Given that box data starts at 0xDE06 in the English versions of Pokemon Red/Blue, it seems like this could totally be possible, especially by using 8F. Unfortunately, it doesn't seem like it'd persist between resets as-is since the last 3 bytes would be truncated to fit the 440-byte limit. (the code is 446 bytes)

Storing it elsewhere (some parts of WRAM) or modifying the code a bit to make it fit should make it persist across resets, but it definitely does work after a few modifications, such as changing the call $3867 instruction to call $3831, which is the JoypadLowSensitivity function in the English version.

[img]http://i.imgur.com/naRbemp.png[/img]

I've attached the source code with modifications to make it work with the English versions when executed from $DE21.


Thanks for this!

Cryo, I used your port and the menu loads but in a Pokémon Center the characters are black space, and outside the characters appeared as white space.

[img]http://i.imgur.com/tBLwCtt.png[/img]

I put jp da80 in de22 and put the following code at da80, where each part directly follows on from each other (copied in with BGB debugger):


ld  bc,$DA00
push bc
dec  bc
dec  bc
ld  d,$12
ld  hl,$C3AA
call $d3c6
inc  bc
push bc
ld  bc,$000A
add  hl,bc
pop  bc
dec  d
jr  nz,$F3
pop  bc
ld  a,$ED
ld  ($C3D3),a
ld  a,$FF
ldh  ($B7),a
halt
push bc
call $3831
pop  bc
ldh  a,($B5)
cp  $02
ret  z
cp  $03
jr  nz,$02
push bc
ret
cp  $40
jr  nz,$01
dec  bc
cp  $80
jr  nz,$01
inc  bc
cp  $20
jr  nz,$06
ld  hl,$FFF0
add  hl,bc
ld  b,h
ld  c,l
cp  $10
jr  nz,$06
ld  hl,$0010
add  hl,bc
ld  b,h
ld  c,l
cp  $24
jr  nz,$06
ld  hl,$FF00
add  hl,bc
ld  b,h
ld  c,l
cp  $14
jr  nz,$06
ld  hl,$0100
add  hl,bc
ld  b,h
ld  c,l
ld  d,$00
cp  $88
jr  nz,$02
ld  d,$FF
cp  $48
jr  nz,$02
ld  d,$01
cp  $28
jr  nz,$02
ld  d,$F0
cp  $18
jr  nz,$02
ld  d,$10
ld  h,b
ld  l,c
cp  $44
jr  nz,$08
push af
ld  a,(hl-)
push af
ld  a,(hl+)
ld  (hl-),a
pop  af
ld  (hl),a
pop  af
cp  $84
jr  nz,$08
push af
ld  a,(hl+)
push af
ld  a,(hl-)
ld  (hl+),a
pop  af
ld  (hl),a
pop  af
ld  b,h
ld  c,l
ld  a,d
and  a
jr  z,$03
ld  a,(bc)
add  a,d
ld  (bc),a
jp  $d324
ld  a,$7C
ld  (hl+),a
ld  a,$7F
ld  (hl+),a
ld  a,b
call $d3df
ld  a,c
call $d3df
ld  a,$E3
ld  (hl+),a
ld  a,(bc)
call $d3df
ld  a,$7C
ld  (hl+),a
ret
push af
swap a
call $d3e6
pop  af
push hl
ld  h,$DE
or  $F0
ld  l,a
ld  a,(hl)
pop  hl
ld  (hl+),a
ret
db $F6
db $F7
db $F8
db $F9
db $FA
db $FB
db $FC
db $FD
db $FE
db $FF
db $60
db $61
db $62
db $63
db $64
db $65


(I also tried storing the entire code from D321 then later D322 and it still didn't work, hmm)

It seems hl becomes DEFD, so I tried placing the graphics there in case that is where the game expects to find the graphics nd the graphics changed but they were still loaded wrongly.

Do you know what changes I need to make to my code to make it work properly? Thanks!

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Flandre Scarlet
Date: 2017-01-12 08:55:04

Given that box data starts at 0xDE06 in the English versions of Pokemon Red/Blue, it seems like this could totally be possible, especially by using 8F. Unfortunately, it doesn't seem like it'd persist between resets as-is since the last 3 bytes would be truncated to fit the 440-byte limit. (the code is 446 bytes)

Unless Datacrystal's RAM map (found here http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Stored_Pok.C3.A9mon) is off box data starts at DA96. According to Datacrystal DE06 is the start of Pokemon nicknames which would mean that box data is definitely large enough space seeing as according to the same source box data ends at DEE1 which would give you 1099 Bytes to work with.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Torchickens
Date: 2017-01-12 09:03:59


Given that box data starts at 0xDE06 in the English versions of Pokemon Red/Blue, it seems like this could totally be possible, especially by using 8F. Unfortunately, it doesn't seem like it'd persist between resets as-is since the last 3 bytes would be truncated to fit the 440-byte limit. (the code is 446 bytes)

Unless Datacrystal's RAM map (found here http://datacrystal.romhacking.net/wiki/Pok%C3%A9mon_Red/Blue:RAM_map#Stored_Pok.C3.A9mon) is off box data starts at DA96. According to Datacrystal DE06 is the start of Pokemon nicknames which would mean that box data is definitely large enough space seeing as according to the same source box data ends at DEE1 which would give you 1099 Bytes to work with.


Yes. It actually begins at 0xDA80 in the format (number of Pokémon), (Pokémon species byte 1 for Pokémon 1-20), (end of list), but Pokémon 1's data begins at DA96.

I noticed later I've been using DA80 instead of DE06 so I tried making the adjustments for that but it sadly still didn't load the tiles.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Cryo
Date: 2017-01-12 09:07:26

It seems hl becomes DEFD, so I tried placing the graphics there in case that is where the game expects to find the graphics nd the graphics changed but they were still loaded wrongly.

Do you know what changes I need to make to my code to make it work properly? Thanks!


Sure thing! To make it work when executing from $D321, the following modification will do the trick:

Line 125:
[tt]ld h,$DE  =>  ld h,$D3[/tt]

Also, the final [tt]db $65[/tt] instruction must end on byte $xxFF because of how the code refers to the necessary sprites.



…box data starts at DA96. According to Datacrystal DE06 is the start of Pokemon nicknames which would mean that box data is definitely large enough space seeing as according to the same source box data ends at DEE1 which would give you 1099 Bytes to work with.


Ah whoops, my bad! I was just looking around-about where the original code resided, but I wasn't expecting that big of a change. That'd definitely explain why the data I was seeing was only 11 bytes long per Pokemon. Sorry about that!

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Torchickens
Date: 2017-01-12 09:10:18


It seems hl becomes DEFD, so I tried placing the graphics there in case that is where the game expects to find the graphics nd the graphics changed but they were still loaded wrongly.

Do you know what changes I need to make to my code to make it work properly? Thanks!


Sure thing! To make it work when executing from $D321, the following modification will do the trick:

Line 125:
[tt]ld h,$DE  =>  ld h,$D3[/tt]

Also, the final [tt]db $65[/tt] instruction must end on byte $xxFF because of how the code refers to the necessary sprites. I'll be working on shortening the code today so that it can be done using PC boxes in the English version of R/B.


Ah, cool. Will this work if D321 contains jp DA80 too or would more adjustments have to be made?

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Cryo
Date: 2017-01-12 09:14:38

Ah, cool. Will this work if D321 contains jp DA80 too or would more adjustments have to be made?


Nah, it'd only work if that code was at D321 and was executed from there. That's a good point though, I'll modify it so that it's not entirely location-dependent. (e.g. doesn't need to end on an xxFF boundary)

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Torchickens
Date: 2017-01-12 09:30:38
Yay! It worked. ^w^ Thank you very much Cryo  :D

[img]http://i.imgur.com/99UCliX.png[/img]

Sadly I encountered another problem. I scrolled down to D059 (instant encounter address) but it won't let me change the value, only view it.



Ah, cool. Will this work if D321 contains jp DA80 too or would more adjustments have to be made?


Nah, it'd only work if that code was at D321 and was executed from there. That's a good point though, I'll modify it so that it's not entirely location-dependent. (e.g. doesn't need to end on an xxFF boundary)


I see. Thanks! Yeah, it would be a good idea to fit a version in DA80 (the actual start of the boxed data) due to map data changing for every step, etc. There is enough room because current box data is a whopping 1122 bytes.

Edit: I think I get what you mean. Register HL=D3FF for the D321 version, so if we adjusted hl to another value with the 65 (as in D3FF) maybe that would work? I will try various modifications to your code.

Edit: This code is from DA80


0100DAC50B0B161221AAC3CD25DB03C5010A0009C11520F3C13EEDEAD3C33EFFE0B776C5CD3138C1F0B5FE02C8FE032002C5C9FE4020010BFE80200103FE20200621F0FF09444DFE10200621100009444DFE2420062100FF09444DFE14200621000109444D1600FE88200216FFFE4820021601FE28200216F0FE18200216106069FE442008F53AF52A32F177F1FE842008F52AF53A22F177F1444D7AA728030A8202C383DA3E7C223E7F2278CD3EDB79CD3EDB3EE3220ACD3EDB3E7C22C9F5CB37CD45DBF1E526D3F6F06F7EE122C9

The code makes hl DBFD, and when we place:
F6F7F8F9FAFBFCFDFEFF00606162636465
@DBEE so the 65 lands at DBFD, the tiles load correctly!

[img]http://i.imgur.com/ZLjf22n.png[/img]

But sadly the wrong memory addresses are displayed, and when you go past FFFF it goes to FFF9/you get other errors.

Edit 2: Well we're getting somewhere nice. The memory can be edited by holding down Start and pressing Up/Down to decrease/increase the value by 1 or Left/Right to decrease/increase the value by 10.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Cryo
Date: 2017-01-12 14:21:01

I see. Thanks! Yeah, it would be a good idea to fit a version in DA80 (the actual start of the boxed data) due to map data changing for every step, etc. There is enough room because current box data is a whopping 1122 bytes.


Okay, so I came up with a method that uses the box, but it involves glitch Pokemon and normally-unobtainable values.

Using 8F to insert the Pokemon into the box is totally worth it though, since it's essentially a permanent hex editor.

Only 7 Pokemon are used; just insert this at DA80 and you'll be good to go. ;D


07F60100FE01181FFF00000000000000000000000000
F6F7F8F9FAFBFCFDFEFF606162636465660100DAC50B0B161221AAC3CD4FDB03C5
010A0009C11520F3C13EEDEAD3C33EFFE0B776C5CD3138C1F0B5FE02C8FE032003
00C5C9FE4020010BFE80200103FE20200621F0FF09444DFE10200621100009444D
FE2420062100FF09444DFE14200621000109444D1600FE88200216FFFE48200216
01FE28200216F0FE18200216106069FE442008F53AF52A32F177F1FE84200AF52A
1800F53A22F177F1444D7AA728030A8202C3AADA3E7C223E7F2278CD6ADB791E1F
CD6ADB3EE3220ACD6ADB3E7C22C9F5CB37CD71DBF1E526DAE60FC6966F7EE122C9


[img]http://i.imgur.com/nYSuPjI.png[/img]

I've also attached the ASM equivalent of the code above.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Flandre Scarlet
Date: 2017-01-12 14:30:59


I see. Thanks! Yeah, it would be a good idea to fit a version in DA80 (the actual start of the boxed data) due to map data changing for every step, etc. There is enough room because current box data is a whopping 1122 bytes.


Okay, so I came up with a method that uses the box, but it involves glitch Pokemon and normally-unobtainable values.

Using 8F to insert the Pokemon into the box is totally worth it though, since it's essentially a permanent hex editor.

Only 7 Pokemon are used; just insert this at DA80 and you'll be good to go. ;D


07F60100FE01181FFF00000000000000000000000000
F6F7F8F9FAFBFCFDFEFF606162636465660100DAC50B0B161221AAC3CD4FDB03C5
010A0009C11520F3C13EEDEAD3C33EFFE0B776C5CD3138C1F0B5FE02C8FE032003
00C5C9FE4020010BFE80200103FE20200621F0FF09444DFE10200621100009444D
FE2420062100FF09444DFE14200621000109444D1600FE88200216FFFE48200216
01FE28200216F0FE18200216106069FE442008F53AF52A32F177F1FE84200AF52A
1800F53A22F177F1444D7AA728030A8202C3AADA3E7C223E7F2278CD6ADB791E1F
CD6ADB3EE3220ACD6ADB3E7C22C9F5CB37CD71DBF1E526DAE60FC6966F7EE122C9


[img]http://i.imgur.com/nYSuPjI.png[/img]

I've also attached the ASM equivalent of the code above.


Awesome work! I plan to eventually do this on console when I have lots of spare time.

Re: Offgao's memory viewer and Tetris ACE exploits

Posted by: Torchickens
Date: 2017-01-12 14:46:51
Amazing. Thank you Cryo! :)

I worked out another way to do it but your version looks a lot shorter.

Edit: Mine is shorter but it needs the code at DBF0.

@DA80:

01 00 DA C5 0B 0B 16 12 21 AA
C3 CD 25 DB 03 C5 01 0A 00 09
C1 15 20 F3 C1 3E ED EA D3 C3
3E FF E0 B7 76 C5 CD 31 38 C1
F0 B5 FE 02 C8 FE 03 20 02 C5
C9 FE 40 20 01 0B FE 80 20 01
03 FE 20 20 06 21 F0 FF 09 44
4D FE 10 20 06 21 10 00 09 44
4D FE 24 20 06 21 00 FF 09 44
4D FE 14 20 06 21 00 01 09 44
4D 16 00 FE 88 20 02 16 FF FE
48 20 02 16 01 FE 28 20 02 16
F0 FE 18 20 02 16 10 60 69 FE
44 20 08 F5 3A F5 2A 32 F1 77
F1 FE 84 20 08 F5 2A F5 3A 22
F1 77 F1 44 4D 7A A7 28 03 0A
82 02 C3 83 DA 3E 7C 22 3E 7F
22 78 CD 3E DB 79 CD 3E DB 3E
E3 22 0A CD 3E DB 3E 7C 22 C9
F5 CB 37 CD 45 DB F1 E5 26 DB
F6 F0 6F 7E E1 22 C9

@DBF0:

F6 F7 F8 F9 FA FB FC FD FE FF
60 61 62 63 64 65