Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Another possible (emulator-preferred) ACE setup for Yellow - Page 1

Another possible (emulator-preferred) ACE setup for Yellow

Posted by: metalmario32
Date: 2018-09-04 17:51:09
Glitch item "f m", or hex:68, executes arbitrary code from FAD1 (a copy of DAD1) in Echo RAM, which are the Attack/Defense IVs of the second stored Pokémon. To redirect to the third item, one could manipulate the IVs to C321 and then have 19 PP on the first move with three PP-Ups applied (better setup for emulators) or use a luck-based setup with 3 PP on the first move with three PP-Ups applied, 33 PP on the second move with no PP-Ups applied, and 19 PP on the third move with three PP-Ups applied (better setup for real console or Virtual Console).

Re: Another possible (emulator-preferred) ACE setup for Yellow

Posted by: Torchickens
Date: 2018-09-05 08:50:38

Glitch item "f m", or hex:68, executes arbitrary code from FAD1 (a copy of DAD1) in Echo RAM, which are the Attack/Defense IVs of the second stored Pokémon. To redirect to the third item, one could manipulate the IVs to C321 and then have 19 PP on the first move with three PP-Ups applied (better setup for emulators) or use a luck-based setup with 3 PP on the first move with three PP-Ups applied, 33 PP on the second move with no PP-Ups applied, and 19 PP on the third move with three PP-Ups applied (better setup for real console or Virtual Console).


That's cool! :)

Yeah I remember while doing the ItemDex project there were a number of items like these, but I never thought too deeply about the pointers. It's nice we actually have so many options, and it looks like with another ACE item we could set up FAD1 to redirect to item 3 too.

Thanks for this. ^^