Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Glitch item 5F ACE in Red/Blue/Yellow - Page 1

Glitch item 5F ACE in Red/Blue/Yellow

Posted by: metalmario32
Date: 2018-10-04 18:00:48
After about a month of inactivity, I've finally found yet another item plausible to execute ACE in the Gen I games. ^^

Glitch item 5F (hex:5A) executes code from D05A in Red/Blue and D059 in Yellow, which stores the type of battle you are currently in. (00 is no battle, 01 is an old man battle, 02 the Safari Zone battle, etc. The rest can be found at https://glitchcity.info/wiki/Text_pointer_manipulation_mart_buffer_overflow_glitch#Battle_systems_index_numbers) I found that past D05A/9 is battle data, Game Corner prizes, and Link Battle PRNG numbers (please correct me if I am wrong), and as such performing a reset on the game will most likely wipe these values with 00s, allowing the code to fall (or nop) through directly to party Pokemon data at D163/2, which could be used for a party setup in Yellow, although it isn't too useful in Red/Blue due to 8F already having a party setup :( It is a plausible alternative to Yellow players if they want to execute code from the party instead of using an 11-Pokemon box setup. I'll be able to think of a 5 or 6-Pokemon party setup for this item soon.

TL;DR: Glitch item 5F can execute code from D05A/9, falling through to party data at D163/2 after a reset.

Edit: Glitch item Gn#Sl (hex:71) in Yellow only executes code from D11D, which could also fall through to D162 if the above requirements are met.

Edit 2: Glitch item #m# (hex:69) in Yellow only executes code from D059 as well, isn't that interesting?

Edit 3: Glitch item #'d#m# (hex:65) in Red/Blue executes code from D11C. So many items!

Re: Glitch item 5F ACE in Red/Blue/Yellow

Posted by: Parzival
Date: 2018-10-08 14:51:42
this makes, what, 40-some ACE entrypoints in Gen 1? xD good god

Re: Glitch item 5F ACE in Red/Blue/Yellow

Posted by: metalmario32
Date: 2018-10-10 20:10:07

this makes, what, 40-some ACE entrypoints in Gen 1? xD good god


I think it's more than 40. The MetascriptDex has glitch scripts that execute ACE (https://glitchcity.info/wiki/MetascriptDex).