Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

[English Red/Blue] Using item 0x7A instead if 8F for ACE - Page 1

[English Red/Blue] Using item 0x7A instead if 8F for ACE

Posted by: Dark
Date: 2018-04-11 20:59:49
I recently spent some time working on a setup for using 0x7A as an alternative for using 8F. 0x7A will jump to a spot in daycare data instead of the party, removing the the requirement of having to have certain pokemon in your party to execute code. Currently, 8F is a requirement to set this up as I do not have a method for obtaining 0x7A and bootstrapping the code without needing to use 8F.

The following method requires you to be able to use 8F

First, you will need to obtain 0x7A, this can be easily done with the following item list.

Item 1: 8F
Item 2: Any Item x1
Item 3: Lemonade x122
Item 4: X Accuracy x32
Item 5: Carbos x211
Item 6: Poké Ball x119
Item 7: Fresh Water x201

Then you should remove your pokemon from the daycare (if you have one in there you care about) as the following 4 item lists will modify the OT of that pokemon. They can be executed in any order, as long as all 4 are ran.

Item 1: 8F
Item 2: 0x7A
Item 3: Lemonade x33
Item 4: X Accuracy x88
Item 5: Carbos x218
Item 6: Poké Ball x119
Item 7: Fresh Water x201

Item 1: 8F
Item 2: 0x7A
Item 3: Lemonade x34
Item 4: X Accuracy x89
Item 5: Carbos x218
Item 6: Poké Ball x119
Item 7: Fresh Water x201

Item 1: 8F
Item 2: 0x7A
Item 3: Lemonade x211
Item 4: X Accuracy x90
Item 5: Carbos x218
Item 6: Poké Ball x119
Item 7: Fresh Water x201

Item 1: 8F
Item 2: 0x7A
Item 3: Lemonade x233
Item 4: X Accuracy x91
Item 5: Carbos x218
Item 6: Poké Ball x119
Item 7: Fresh Water x201


Once this is done, you should be ready to use 0x7A like you do with 8F, but without the party pokemon bootstrap needed for 8F

(credit goes to Wack0 for the item list used to modify ram, which I made use of here)

(also this is my first post here)

Re: [English Red/Blue] Using item 0x7A instead if 8F for ACE

Posted by: RETIRE
Date: 2018-04-15 15:03:51
what if you set up your OT without using ACE and put a pokemon in the daycare with it, that should work too, right?

Re: [English Red/Blue] Using item 0x7A instead if 8F for ACE

Posted by: Darkshadows
Date: 2018-04-26 16:22:34
I would suggest reversing the order of the last four sets you write, considering it's a strictly decreasing quantity.

Otherwise, great find! Just tested it and it seems to work perfect. Sad that it's just about impossible to bootstrap without 8F, but it's more convenient after the fact.


what if you set up your OT without using ACE and put a pokémon in the daycare with it, that should work too, right?

It's difficult to do something like that. These 8F codes write the following bytes to memory in the daycare's OT:
21 22 D3 E9

Which is the following code:
ld hl, $D322
jp (hl)

None of these values can be manually entered at game start, and these are the values required to execute normal 8F scripts.

But theoretically, if you change your OT before catching the Pokémon you put in the daycare, it'll work without 8F… if I'm not missing any bad effects from having an improper name.

(This is also my first post here)

Re: [English Red/Blue] Using item 0x7A instead if 8F for ACE

Posted by: Krys3000
Date: 2018-06-02 13:04:20
For the notice, this works in french games too :)

Re: [English Red/Blue] Using item 0x7A instead if 8F for ACE

Posted by: Dark
Date: 2018-06-02 21:13:11

I would suggest reversing the order of the last four sets you write, considering it's a strictly decreasing quantity.


I mentioned they can be ran in any order since all of them are ram writes anyway.



Also thanks for the feedback in general guys.