Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Where to get started - Page 1

Where to get started

Posted by: Torchickens
Date: 2019-04-25 12:52:39
When I was originally first trying to make ACE codes, the following links helped.

https://iimarckus.org/etc/asmopcodes.txt
https://max-m.github.io/gb-docs/optables/
https://github.com/pret/pokered/blob/master/wram.asm
http://gameboy.mongenel.com/dmg/asmmemmap.html

You can start with simple instructions like

ld a, 15
ld [$d059] ,a
ret
(3E 15 EA 59 D0 C9) to encounter Mew, and other 'RAM write' codes and modify them. The tables linked also tell you what a byte / opcode / operand maps to which item / quantity. In Yellow, a lot of addresses are shifted by 1, so in that example you would use ld [$d058], a instead for Yellow Mew.

https://glitchcity.info/wiki/The_Big_HEX_List

If you use BGB's debugger, you can compile opcodes without doing it by hand, and see their byte representation. (right-click the screen, Other -> Debugger, use Ctrl+G to reach destinations quickly)
You can also set a breakpoint (double-click a location in the code panel, or use F2) at address $D322 (which corresponds to item 3's ID), or wherever your bootstrap code is, to see how it affects the registers and the memory. The step into (F7) and step over (F3) commands allow stepping through the execution one line at a time.

The game will keep running fine if you alter the value of all registers except sp, so feel free to use "padding" instructions such as "inc b" (maps to a Poké Ball) to make your code easier to set up and avoid rare/glitch items.

Later you can start reading the document ISSOtm posted for things like calling other addresses and setting conditions in your code. For example, when you want to call other functions, you can use the "call" instruction with the pointer (based on above memory map link) of your choice. Some functions in the ROM can be found here https://sites.google.com/site/torchickens2/sym-files and require certain conditions. One of the most common, the bank switch (located at address $35d6) requires b and hl to be set to a specific value (which you can do with "ld b, xx" etc.), then when you use call 35d6 the address at b:hl is executed.

Hope this helps. ^_^


(EDIT by ISSOtm: fixed and clarified wording, changed resource links.)

Re: Where to get started

Posted by: Sherkel
Date: 2019-04-25 21:11:33
Great guide! I think this works well as a sticky in this section.

Re: Where to get started

Posted by: joshuarpl
Date: 2019-05-12 14:35:41
Well, i also started with simply changing memory, and now I'm up to jumping and stuff like that, thanks!
I am still working on opcodes like sbc, ld sp, etc. but I can make simple code enough for maybe a simple game.