Glitch City Laboratories Archives

Glitch City Laboratories closed on 1 September 2020 (announcement). This is an archived copy of an article from Glitch City Laboratories wiki.

A live version of this article is available at the Glitch City Wiki here.

You can join Glitch City Research Institute to ask questions or discuss current developments.

You may also download the archive of the wiki in .tar.gz or .xml.gz formats.

TryObjectEvent arbitrary code execution

TryObjectEvent arbitrary code execution is an engine vulnerability or glitch, known to be in Pokémon Crystal.Pokémon Crystal disassembly

When this function is called, if the carry flag is not set, it is possible for the game to cause arbitrary code execution with bc as the pointer.

The following is the code that causes it in the Pokémon Crystal disassembly. It seems the fix is to add a pop bc instruction.

-; Bug: If IsInArray returns nc, data at bc will be executed as code. push bc ld de, 3 ld hl, .pointers call IsInArray jr nc, .nope pop bc

inc hl ld a, [hli] ld h, [hl] ld l, a jp hl

.nope - ; pop bc + pop bc xor a ret


More research is needed for this article.


Reason given: Document more effects of it. Can a Glitch Pokémon evolve if its sprite and name are "stable" enough? Are there many glitch cries available for Glitch Pokémon? List Glitch Type Sprites that could cause interesting effects. Study the causes and effects of the corruption of the PC Pokémon Selection in Fr/Lg. Test again the effect of Pokédex entries of Glitch Pokémon.





References

Categories