Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Simplifying ACE (theory) - Page 1

Simplifying ACE (theory)

Posted by: Torchickens
Date: 2018-09-04 08:43:30
It's been established since the early days of SRAM glitch TASes that D36E-D36F ("level-script pointer") is capable of executing arbitrary code. These addresses represent a pointer which is usually supposed to be in ROM; and the pointer controls a script on the current map for when the menu is closed. The script is temporary, and is updated each time you enter a new map (so if you change it and enter a new map it will go away, but if you stay on the map the modified pointer will still be there).

There is nothing to stop this pointer from being represented in RAM instead, and fortunately D36E-D36F is in the expanded items pack. Specifically it is at item 41. (but note in Japanese versions, I think this may be a quantity instead; so in Japanese versions the script must be represented in two stacks. I don't know the specifics yet.)

Having Water Stone x 211 (Red/Blue) or Thunderstone x 211 (Yellow) at item 41 and closing the menu, therefore will make the game run code at item 3 and is (as bytes) 22 D3 or 21 D3 respectively (because D322/D321 is the RAM address for item 3).

In theory for non-English European versions the items would be:

Calcium x 211 (Red/Blue) or Carbos x 211 (Yellow) instead and would be (as code) 27 D3 and 26 D3 respectively.

If we only want to exploit ACE a limited number of times, this may be enough; we can set up the expanded items pack and then you can place your items in slot 3 obtained with the Celadon looping map glitch, and the game will execute the code after you close the menu; many item setups from the main thread for slot 3 will work this way, and will let you execute code without the need of bootstrap Pokémon.

However, if we want to perform a slightly more user friendly method and reduce the time for ACE, the best thing we may want to do is give ourselves a glitch item to execute code quickly without having to place the item again. It also gives us the ability (which we can already do, but I don't know if there is a known way with the level-script pointer) to execute arbitrary code in battle.

A good item for this (but not the only option) is 4F (to be placed in a position after or before the code such as slot 1), which executes FA65 (RB) or FA64 (Yellow) in the middle of the Day Care. This means we have freedom to have whatever party Pokémon or boxed Pokémon we want, with the only requirement being that we don't use the Day Care.

Usually we would need an elaborate bootstrap setup for this, but if the data is "C3 22 D3" (jp D322), it can be done with only three bytes so it's just a matter of writing this data into FA65.

This can be achieved with the reusable RAM writer. All these items can be obtained if you close the menu multiple times;

1. When you have Lemonade x195, Carbos x218, X Accuracy x101 (writes C3 to DA65)
2. When you have Lemonade x34, Carbos x218, X Accuracy x102 (writes 22 to DA66)
3. When you have Lemonade x211, Carbos x218, X Accuracy x103 (writes D3 to DA67)

In English Yellow, the quantities of the X Accuracies are -1 of the original and the Lemonade quantity is x33.

For non-English European versions it's unfortunately unconfirmed for now.

After each use, the quantities of the items are replaced by x0 (actually x256) so you can set them up again by tossing from the stacks. There is no side effect related to the quantity being x0.

Now after you've done this, you're free to use any existing script (see main thread)) with ACE you desire. :) Or if you like, you can stick with the reusable RAM writer with a WRAM map and Windows Calculator or The Big HEX List (to convert from decimal to hexadecimal) as a reference.

All you have to do is bring up items from the Celadon looping map glitch, and if the quantity is x1, just move one tile up/down to change it to x0 (actually x256), after which you can access any quantity you want.

There is one difficulty with this which varies based on the save file. Sometimes the menu will 'freeze'. This is due to 'lag name glitch items' on the screen. You must be really careful not to press A, or the freeze from these lag name glitch items could destroy the save file (which is a lot more likely on 3DS VC). From experience, viewing a Pokémon's summary before a freeze seems to lower the likelihood of save corruption. What you need to do is keep pressing B at a slow rate, while holding up/down. This way eventually you will get to where the Nugget x1 was.

Setting up expanded items pack:

In order to get the expanded items pack, we can use the old man glitch in Red/Blue to encounter MissingNo. to duplicate an X Special by 128. Then either capture MissingNo. after using an X Special (gives x127) to get X Special x255 and then perform dry underflow (see here).

In Yellow, we can use Glitch City RAM manipulation, Pikachu off-screen ACE, stable MissingNo., "stable unstable MissingNo." (requires save file to have been wiped, to have never seen a glitch Pokémon after wiping, and to be using an accurate console (I think GBA SP likely works, speedrunners have confirmed it on real hardware, and I've confirmed it working on 3DS Virtual Console) or emulator (like BGB)).

If you are encountering MissingNo., exploit the same method once MissingNo. appears to get a x255 stack as in Red/Blue.

If you are using Glitch City RAM manipulation, you will need 50 stored items and to find the D53A map block, and Cut it to get 109 stored PC items, after which you can get a x255 stack from the PC.

If you are using the Pikachu off-screen glitch method, you can use the glitch text box to enable the expanded items pack with specific Pokémon and specific items as described in the article.

Also in all versions, we can use the SRAM glitch, which in English and non-English European versions, the reset is exploited a fraction of a second after the Yes/No box closes. This is actually a fast way to set up ACE in general, but getting the save with 255 Pokémon requires some practice and may require multiple attempts. Once you're able to do it, swap Pokémon 2 with Pokémon 10 to get the expanded items pack. :)

There are two small complications being that you will have a party full of 255 Pokémon and (for Yellow version) having 152 Pokémon in the Pokédex (a side effect of swapping Pokémon 2 with Pokémon 10) will prevent you from being able to deliver Oak's Parcel and being able to obtain the Pokédex.

Addressing the Pokédex problem, I've noticed however item 91 in the expanded PC items will affect the Professor Oak's Lab script. In Red/Blue, setting this to x15 (hex:0F) will allow you to get the Pokédex. In Yellow, the value you need to set to get the Pokédex may be different, but the item position (item 91) should be the same.

Addressing the Pokémon party, this is what I do.

1. Change D365 (item 36 quantity) to 05 (either a Master Ball or the hex:00 ".j in RB", "x in Yellow" item usually) then walk out of your house to warp to Vermilion City.
2. Enter Diglett's Cave, enter battle, and then use a Master Ball from your inventory (careful which one you use, save before battle to be safe) to reduce the number of Pokémon to 49-51 (varies depending on which Pokémon the foe turns into; a side effect of wild appeared!)
3. Open the Start menu (important)

In Pokémon Red and Blue, entering Diglett's Cave and opening the Start menu is mandatory. However, in Pokémon Yellow you can do this step from anywhere and I think whether you opened the Start menu or not doesn't matter.

4. Save at a PC and view the summary of a valid sprite Pokémon in your party to be safe in case you get a freeze (in RB this is easy, Charizard 'M (FF) does the trick)
5. Try to deposit the first Pokémon. The game may freeze due to its unterminated name, but may also not freeze. If the game freezes keep viewing different Pokémon in your party until you find one that works. I don't know the exact cause of this, but in oobLG it was to do with move 4, possibly its name.
6. Repeat until you have 1-5 Pokémon. You will need to change boxes during this process. You can now catch a new Pokémon and release the rest, with care.

If you set up ACE this way, you may want to get all Badges, Fly locations and a Pokémon with HM moves.

I've noticed TM52 in the expanded items pack in Route 1, which can be used for Fly and Pidgey are possible on Route 1. HM03 is possible too, but I'm afraid I'm unsure of the specifics. ????? (surfboard) can be found on the top-right most corner of the sea south of Pallet Town and can be used to catch Tentacool. If you need the other HMs, they (like most other items) should be available with the Celadon looping map glitch.

Potions aren't too uncommon in the expanded items pack, and can be placed somewhere below the options address in the expanded items pack to give you 2 badges, specifically the Thunder Badge and Soul Badge which will let you use Fly and Surf. I'm unsure if you can get all badges as that would be a Cancel item but I don't rule it out.

However, if you want all badges using the RAM writer to write FF (255) to D356 (x211 and x86) should do the trick. To be able to Fly anywhere, change item 36 to visit every key area (maps 00-0A or x0-x10). If this isn't possible (if the quantity required is larger so you can't toss to get it), what you can do is place the Ultra Ball x0 four slots above it (item 32) in item 36. If the item is an Old Amber instead, try it in a Pokémon Center and it should be an Ultra Ball.

Once you've set up 4F, if you ever want to get rid of the expanded items pack, buying enough items may reset it. You can then use the item morphing code with item duplication from MissingNo. or 'M (00) to get other setups instead (see "change the second item" in main thread). If you have 255, buying two would fix the inventory. I don't know of a way to get x0 quantities this way, but in fact on hindsight you don't need a x0 for the reusable RAM writer (but as it is, the first three items wouldn't be able to write a x0 value); replacing Lemonade x0 with Poké Ball x175 will do it. In that case it may be best just to keep the expanded items pack. On the other hand it leaves the inventory glitched and you can't obtain new items without deleting the rest.

I hope this information is useful and let me know if you have any further questions. :)

Re: Simplifying ACE (theory)

Posted by: Parzival
Date: 2018-09-08 21:59:54
I'm still waiting for someone to make a "stock" ACE save or a decompression bootstrap which sets up multiple vectors. That'd be easier

Re: Simplifying ACE (theory)

Posted by: Torchickens
Date: 2018-09-14 23:11:32
I put together a route to do all this in Red/Blue. :)

I'm still waiting for someone to make a "stock" ACE save or a decompression bootstrap which sets up multiple vectors. That'd be easier

I have some old ACE save files here if you mean a save file with ACE set up:

Not sure what you mean re: the latter, but if you mean just a choice of code destinations, you could use say 4F for the memory editor GUI and -g m for the items pack, with the custom map script writing C3 80 DA to to FA65 (for 4F) and C3 22 D3 to DA47 (for -g m). That would give you two locations. Having 8F and a specific party would give you three (the well known Pokémon bootstrap setups), you could store a code in the Day Care structure too (or elsewhere in the stored Pokémon) perhaps for 8F to jump to. Also, with care you can write to A7D0 in SRAM for B1F as another destination.

Or maybe if it's ideal to save item slots you could have one of the ACE items (8F included but it's not the best anymore as it requires a specific party which isn't as good as Day Care) read an item quantity and use that to decide where it will jump to; allowing for different codes you can choose from.

Edit: Item 91 x19 in the expanded PC items seemed to work for getting the Pokédex in Yellow (that or x18 or similar, not quite sure from memory).