Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of a thread from Glitch City Laboratories Forums.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of this forum in .tar.gz, .sql.gz, or .sqlite.gz formats.

Arbitrary Code Execution Discussion

Silph Co 7F glitch meta-script to (possibly) execute PC items as code - Page 1

Silph Co 7F glitch meta-script to (possibly) execute PC items as code

Posted by: metalmario32
Date: 2019-07-25 08:19:41
In the 7th floor of Silph Co, there is a glitch map script 0x14 that executes code from D528, just before tileset header data. Immediately following this is the PC items, without any bootstrap required. I'm not quite sure what tileset headers are, though. I found D528 was the execution address and looked in DataCrystal, and it said something about tileset headers.

Re: Silph Co 7F glitch meta-script to (possibly) execute PC items as code

Posted by: Torchickens
Date: 2019-07-25 12:54:29

In the 7th floor of Silph Co, there is a glitch map script 0x14 that executes code from D528, just before tileset header data. Immediately following this is the PC items, without any bootstrap required. I'm not quite sure what tileset headers are, though. I found D528 was the execution address and looked in DataCrystal, and it said something about tileset headers.


Nice find! This sounds good on paper. However, unfortunately this region contains various 0xFF bytes, so it may be difficult to avoid a $rst 38.

Re: Silph Co 7F glitch meta-script to (possibly) execute PC items as code

Posted by: metalmario32
Date: 2019-07-25 14:48:23


In the 7th floor of Silph Co, there is a glitch map script 0x14 that executes code from D528, just before tileset header data. Immediately following this is the PC items, without any bootstrap required. I'm not quite sure what tileset headers are, though. I found D528 was the execution address and looked in DataCrystal, and it said something about tileset headers.


Nice find! This sounds good on paper. However, unfortunately this region contains various 0xFF bytes, so it may be difficult to avoid a $rst 38.



Aw. Well it was a nice try…