Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of an article from Glitch City Laboratories wiki.

A live version of this article is available at the Glitch City Wiki here.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of the wiki in .tar.gz or .xml.gz formats.

Sea Route 21 0x44 text box glitch (English Yellow)

The Sea Route 21 0x44 text box glitch exploits a 0x44 glitch text box in Pokémon Yellow, which takes its data from a writable source (0xD2C3) in the RAM.

It is a sub-glitch of both the Trainer escape glitch and text box ID matching.

Steps



1) Escape from a long-range Trainer on Sea Route 21.

2) Enable a text box when you go there (by changing boxes, resetting and being guided by the Pewter City museum guy).

3) 'Talk to' the shelves of Pokémon goods in Cinnabar Mart and return to Sea Route 21 (CF13=44).

This hex:44 text box's script location is found at 0xD2C3 in WRAM; which is the fifth character of the second Pokémon's nickname, hence that character will determine the text command code and the data following is possible to be read as arbitrary code if 0x08.

Example text commands for 0xD2C3



FF (fifth character is "9") = Pokémon Center

FE ("8") = Poké Mart (has glitch items)

FD ("7") = PC for Pokémon storage only (unused! "Switch on!" text)

FC ("6") = PC for items only

F9 ("3")= Normal PC

F7 ("1")= Game Corner Pokémon prize menu

F6 ("0")= Cable Club

F5 ("♀")= Vending machine

Arbitrary code execution

Though difficult, special bytes following an 0x08 byte at 0xD2C3 can be used to set up this method for arbitrary code execution.

This is possible by using a glitch such as Super Glitch to access the expanded party and having specific item requirements that will convert into Pokémon nicknames.

Alternatively the player can use another form of arbitrary code execution to achieve this.

YouTube video

[b]YouTube video by PLASMA GER[/b]


Credits

  • ChickasaurusGL (documentation, video, article description)

    Categories