Arbitrary code execution: Difference between revisions

From Glitch City Wiki
Jump to navigation Jump to search
Content added Content deleted
VisualWikitext
>Torchickens
(Add initial information on Gen 4 (thanks to RETIRE for corrections!))
 
(43 intermediate revisions by 8 users not shown)
Line 1: Line 1:
{{Template:Major_glitches}}
{{Template:Major_glitches}}
{{Template:Arbitrary_code_execution}}
{{Template:Arbitrary_code_execution}}
{{PRAMA|8f-code-execution}}
{{PRAMA|ace-1G}}
{{Bulbapedia}}
{{Bulbapedia}}
{{incomplete|1=<br><br>The following methods of ACE: custom map script pointer, move effect, Trainer escape glitch text box, bad clone summary, Burned Tower Silver, TM/HM use outside of the correct pocket, glitch Pokédex categories, Pikachu glitch emote and specific details on Generation III summary and move animation ACE}}
{{incomplete|1=<br><br>The following methods of ACE: custom map script pointer, move effect, Trainer escape glitch text box, bad clone summary, Burned Tower Silver, TM/HM use outside of the correct pocket, glitch Pokédex categories, Pikachu glitch emote, specific details on Generation III summary and move animation ACE, and specific details on Generation IV ACE}}
'''Arbitrary code execution''' (Japanese: 任意コード実行) refers to a method that allows the player to force the game to run code in a write-enabled region of the game, often WRAM or RAM (see [http://gameboy.mongenel.com/dmg/asmmemmap.html Game Boy memory map]). If it is manipulable (e.g. if the region is in a representation of the player's current party), this can be abused to run custom code written by the player.
'''Arbitrary code execution''' (Japanese: 任意コード実行) refers to a method that allows the player to force the game to run code in a write-enabled region of the game, often WRAM or RAM (see [http://gameboy.mongenel.com/dmg/asmmemmap.html Game Boy memory map]). If it is manipulable (e.g. if the region is in a representation of the player's current party), this can be abused to run custom code written by the player.


It commonly involves an invalid execution pointer (such as via glitch items in Generation I), or as a side effect of the [[Coin Case glitch]] in English {{GS}}, which the player can manipulate to run custom assembly code.
It commonly involves an invalid execution pointer (such as via glitch items in Generation I). In English versions, another popular method is as a side effect of the [[Coin Case glitch]] in English {{GS}}, which the player can manipulate to run custom assembly code.


This custom code is often spelled with items, as a stack of items uses only two (Generation I/II) or four (Generation III) bytes.
This custom code is often spelled with items, as a stack of items uses only two (Generation I/II) or four (Generation III) bytes. Box names are also an option for Generation II games.


==In [[bp:Generation I|Generation I]]==
==In [[bp:Generation I|Generation I]]==
===Via items===
===Via items===
Each item that is not a TM or HM (more precisely, with ID less than HM01 (0xC4)), when used, gets its effect from a pointer table. For some glitch items, this effect pointer points to the RAM, enabling arbitrary code execution.
Both (glitch) items require a special setup for the item to run correct code.


All known ACE glitch items jump into an RAM area that is possible to manipulate, but not quite as easy to manipulate as the item pack. Therefore it is popular to jump to the third item in the item pack, and [[Generation I item codes|write the main payload there]]. This strategy of first jumping to an easier to manipulate RAM area is called "bootstrapping".
For detailed info about these items, read [http://forums.glitchcity.info/index.php/topic,6638.0.html this topic] on GCL forums if playing R/B, or [http://forums.glitchcity.info/index.php/topic,6638.msg189586.html#msg189586 this post] if playing Yellow.


There are many ways to obtain those glitch items through glitches. In {{RGB}}, the [[Select glitch]] can easily [[item creation Select glitches|create]] any glitch item. In the international versions, the most common method is to first obtain an [[expanded item pack]], then find the glitch item in the X coordinate ([[Celadon looping map trick]]) or in [[roaming items]].
It is a good idea to read all the topic messages for info.


Below is a summary of commonly used ACE glitch items. For more information, including bootstrapping setups, click on the name of an item to go to its [[ItemDex]] page.
====Using てヘ (tehe) in JP Red/Green====
<!-- NOTE : Should be tested for JP Yellow, too -->
Glitch item hex:7B has its execution script pointing to wild Pokémon data. However, by naming yourself (any character)てルめ(any characters or nothing) and talking to the Old Man, the script jumps to item pack #3.


{| class="wikitable sortable"
====Using 8F (English Red/Blue)====
!Version!!ID!!Name!!Effect pointer!!Pointing to!!Notes
The 8F item is named 7eme etage / P7 / S7 in respectively French, Italian/Spanish and German localizations. It still executes code the same way, but the setup will be different (see below).
|-
|English Red/Blue||0x6A||[[ItemDex/RB:106|-gm]]||$DA47||Safari Ball count||Followed by Day Care data and box Pokémon data <br /> Equivalent to なかよしバッジ due to the fix for the [[old man full box glitch]]
|-
|Japanese Red/Green/Blue||0x67||[[ItemDexJP/RGB:103|なかよしバッジ]]||$D983||Safari Ball count||Followed by Day Care data and box Pokémon data
|-
|English Red/Blue||0x5D||[[ItemDex/RB:093|8F]]||$D163||Party Pokémon data||Equivalent to ５かい due to the fix for the [[old man full box glitch]]
|-
|European non-English Red/Blue||0x5D||[[ItemDex/RB:093#In other European versions|7EME ETAGE / S7 / 7°P / P7]]||<!-- TODO -->||Party Pokémon data||Same item as 8F
|-
|Japanese Red/Green/Blue||0x5A||[[ItemDexJP/RGB:090|５かい]]||$D123||Party Pokémon data||
|-
|English Yellow||0x63||[[ItemDex/Y:099|ws m]]||$DA7F||Box Pokémon data||
|-
|European non-English Yellow||0x63||[[ItemDex/Y:099#In other European versions|ws l' m / ws & m]]||<!-- TODO -->||Box Pokémon data||Same item as ws m
|-
|English Red/Blue||0x59||[[ItemDex/RB:089|4F]]||$FA65||Middle of Day Care data
|-
|English Yellow||0x59||[[ItemDex/Y:089|4F]]||$FA64||Middle of Day Care data||
|-
|European non-English Yellow||0x59||[[ItemDex/Y:089#In other European versions|3EME ETAGE / S3 / 3°P / P3]]||$FA64||Middle of Day Care data||Same item as 4F
|-
|Japanese Red/Green||0x7B||[[ItemDexJP/RG:123|てヘ]]||$D806||Grass encounter table||Can be changed to the player's name by the [[Old man trick|old man]]<!-- NOTE: Should be tested for JP Yellow, too -->
|-
|Japanese Blue||0x7B||[[ItemDexJP/B:123]]||$D806||Grass encounter table||See てヘ. Requires [[0x50 sub-tile]].
|}
Notice that the items in the European non-English versions are all the same as the corresponding item (with the same ID) in English version; however, due to differences in memory layout, the bootstrapping setups will be slightly different. (The "floor items" have different numbers because in those countries, "first floor" refers to what is called second floor in American English.)


====Useful item codes====
The player's party Pokémon must be in a certain order and have certain stats :
See [[Generation I item codes]] for some useful item lists for 8F (and possibly other ACE methods).
# 5 Pokémon
# Pidgey as the first Pokémon
# Parasect as the second Pokémon
# Onix as the third Pokémon
# Tentacool as the fourth Pokémon
# Kangaskhan as the fifth Pokémon
# Pidgey must have 233 HP
To obtain such a Pidgey, Rare Candy it up to Lv100, apply 5~6 HP Ups.

If needed get it poisoned, use a Max Potion (not Full Restore !), walk 4*(Pidgey's max HP-233) steps and cure the poison.

Another setup allows any Pokémon at the front of the party :
# 6 Pokémon
# The first Pokémon does not matter
# Pidgey as the second Pokémon
# Parasect as the third Pokémon
# Onix as the fourth Pokémon
# Tentacool as the fifth Pokémon
# Arbok as the sixth Pokémon
# Pidgey must have 233 HP

It is possible to use a super-compressed setup, which requires [[GlitchDex/RB:195|h POKé (0xC3)]] and [[GlitchDex/RB:211|M p'u ゥ (0xD3)]], Pokémon difficult to obtain.
# 3 to 5 Pokémon
# h POKé (0xC3) as the first Pokémon
# Onix as the second Pokémon
# M p'u ゥ (0xD3) as the third Pokémon
Some item setups won't work with this setup ; however, inserting two items will fix this problem :
# 8F
# Any item x[any qty]
# X Accuracy x34
# Carbos x211
# (Listed items)
(credits to [http://forums.glitchcity.info/index.php?topic=6638.msg204534#msg204534 NukingDragons] for this fix)


When selecting Use on 8F, the game will run code depending on the item pack (starting from item #3)

The bootstrap code translates to the following ASM :
<code>
; Initial hl = D163<br/>
$D163 <- 05 || dec b<br/>
$D164 <- 24 || inc h ; h = D2<br/>
$D165 <- 2E ||<br/>
$D166 <- 22 || ld l, 22 ; hl = D222 <br/>
$D167 <- 18 || <br/>
$D168 <- 02 || jr 2 ; pc = D16B<br/>
$D169 <- FF ||<br/>
$D16A <- FF ||<br/>
$D16B <- 24 || inc h ; h = D3<br/>
$D16C <- 00 || nop<br/>
$D16D <- e9 || jp (hl) ; pc = D322<br/>
<br/>
</code>
and, for the 6-Pokémon setup,
<code>
<br/><br/>
$D163 <- 06 ||<br/>
$D164 <- ?? || ld b, ??<br/>
$D165 <- 24 || inc h ; h = D2<br/>
$D166 <- 2E ||<br />
$D167 <- 22 || ld l, 22 ; hl = D222<br/>
$D168 <- 18 ||<br/>
$D169 <- 02 || jr 2D ; pc = D197<br/>
(...)<br/>
$D197 <- 24 || inc h ; h = D3<br/>
$D198 <- 00 || nop<br/>
$D199 <- E9 || jp (hl) ; pc = D322
</code>

To make 8F run code starting from item 1, replace the Onix with a Tangela.

====Using 7eme etage / P7 / S7 (French & Italian / Spanish / German Red/Blue)====
These items are the same item than the 8F of English versions (the difference in numbers is because in these countries, "first floor" refers to what is called second floor in english). Therefore, it executes code in the same way.

The bootstrap code for 7eme etage, P7 or S7 must be slightly changed from the English version: no matter the setup, the player should replace the Onix with a Graveler.

When selecting Use on 7eme etage, P7 or S7, the game will run code depending on the item pack (starting from item #3).

The bootstrap code translates to the following ASM :
<code>
; Initial hl = D163<br/>
$D163 <- 05 || dec b<br/>
$D164 <- 24 || inc h ; h = D2<br/>
$D165 <- 2E ||<br/>
$D166 <- 27 || ld l, 27 ; l = 27<br/>
$D167 <- 18 ||<br/>
$D168 <- 02 || jr 2 ; pc = D16B<br/>
$D169 <- FF ||<br/>
$D16A <- FF ||<br/>
$D16B <- 24 || inc h ; h = D3<br/>
$D16C <- 00 || nop<br/>
$D16D <- e9 || jp hl ; pc = D327<br/>
<br/>
</code>
and, for the 6-Pokémon setup,
<code>
<br/><br/>
$D163 <- 06 ||<br/>
$D164 <- ?? || ld b, ??<br/>
$D165 <- 24 || inc h ; h = D2<br/>
$D166 <- 2E ||<br />
$D167 <- 22 || ld l, 22 ; hl = D222<br/>
$D168 <- 18 ||<br/>
$D169 <- 02 || jr 2D ; pc = D197<br/>
(...)<br/>
$D197 <- 24 || inc h ; h = D3<br/>
$D198 <- 00 || nop<br/>
$D199 <- E9 || jp (hl) ; pc = D322<br/>
</code>

To make 7eme etage, P7 or S7 run code starting with item 1, replace the Graveler with a Fearow.

====Using "ws m" (English and European-non english Yellow)====
The Pokémon in the '''current''' PC box must be in a certain order for the instruction pointer to be redirected to the item pack. In '''english games''', have:

# 11 Pokémon in your '''current''' PC box
# Seel as the 1st Pokémon in the current PC box
# Parasect as the 2nd Pokémon in the current PC box
# Growlithe as the 3rd Pokémon in the current PC box
# Magikarp as the 4th Pokémon in the current PC box
# Psyduck as the 5th Pokémon in the current PC box
# Flareon as the 6th Pokémon in the current PC box
# Tentacool as the 7th Pokémon in the current PC box
# Female Nidoran as the 8th Pokémon in the current PC box
# Three more Pokémon
# Finally, Seel's HP must be 233

Much like 8F games, the contents of the item pack (starting from item 3) will be read as ASM code. Optionally, Seel can be replaced by Butterfree or Mr. Mime.

The bootstrap code translates to the following ASM :
<code>
; Initial hl = DA7F<br/>
$DA80 <- 3A || ldd a, (hl) ; a = 0B<br/>
$DA81 <- 2E ||<br/>
$DA82 <- 21 || ld l, 21<br/>
$DA83 <- 85 || add l ; a = 2C<br/>
$DA84 <- 2F || cpl ; a = D3<br/>
$DA85 <- 67 || ld h,a ; hl = D321<br/>
$DA86 <- 18 ||<br/>
$DA87 <- 0F || jr 0F ; pc = DA97<br/>
(...)<br/>
$DA97 <- E9 || jp (hl) ; pc = D321<br/>
<br/>
</code>

In '''European non-English games''', the item is the same, but the setup is different.

# 10 Pokémon in your '''current''' PC box
# Tangela as the 1st Pokémon in the current PC box
# Nidoking as the 2nd Pokémon in the current PC box
# Metapod as the 3rd Pokémon in the current PC box
# Haunter as the 4th Pokémon in the current PC box
# Flareon as the 5th Pokémon in the current PC box
# Parasect as the 6th Pokémon in the current PC box
# Kadabra as the 7th Pokémon in the current PC box
# Tentacool as the 8th Pokémon in the current PC box
# Grimer as the 9th Pokémon in the current PC box
# Any Pokémon as 10th Pokémon in the current PC box
# Finally, Tangela's HP must be 233

Much like 8F, the contents of the item pack (starting from item 3) will be read as ASM code.

====Using 4F (English and European non-english Yellow)====

By using item 4F instead of "ws m", we can execute code using Daycare data. Although this possibility was previously known, it was setup by Krys3000 in [http://forums.glitchcity.info/index.php?topic=8056.0 this thread] for both English and non-English Yellow games.

In english games, deposit and withdraw (or not) at the Day Care a Nidorina (that should not be evolved from a Female Nidoran), with Bite, Fury Swipes, Double Kick and Growl (the first two moves are placeholders and can be replaced with some other moves, but not just any move). Then, store in the active PC Box:

# Any lvl25 Pokémon with currently 24 HP, 33 PP currently for the first AND second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
# Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP

Using 4F will then execute code from the third item, as with other setups.

<code>
WRA1:DA64 <- 78 || ld a,b<br />
WRA1:DA65 <- 2C || inc l<br />
WRA1:DA66 <- 9A || sbc d <br />
WRA1:DA67 <- 18 2E || jr DA97<br />
WRA1:DA97 <- 18 19 || jr DAB2<br />
WRA1:DAB2 <- 21 21 D3 || ld hl,D321<br />
WRA1:DAB5 <- 00 || nop<br />
WRA1:DAB6 <- 04 || inc b<br />
WRA1:DAB7 <- 00 || nop<br />
WRA1:DAB8 <- E9 || jp hl
</code>

{{youtube|AxNliiLzA0Q|ChickasaurusGL}}

The setup is somewhat easier in non-english games. Deposit and withdraw (or not) a lvl80 Pokémon with currently 24 HP in the Day Care. The, store in the active PC Box:

# Any Pokémon with 33 PP currently for the first move, 38 PP currently for the second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
# Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP

Using 4F will then execute code from the third item, as with other setups.

<code>
WRA1:DA64 <- 00 || nop<br />
WRA1:DA65 <- 18 50 || jr DAB7<br />
WRA1:DAB7 <- 21 26 D3 || ld hl,D326<br />
WRA1:DABA <- 00 || nop<br />
WRA1:DABB <- 04 || inc b<br />
WRA1:DABC <- 00 || nop<br />
WRA1:DABD <- E9 || jp hl
</code>

===Useful item codes===
All the following items lists begin from the first item pack slot.
====Non-key item duplication====
<code>
8F

The item to duplicate x1

X Accuracy x33 (Red/Blue) </code>OR <code>X Accuracy x32 (Yellow)

Revive x201
</code>

To obtain the 201 Revive stack, have Revive x73 in the sixth item pack slot, then encounter / capture MissingNo or 'M. It will be a stack of 201 Revives.

Upon using 8F, the quantity of item #2 will be decreased by one. If there was only one item, it will be a stack of zero items. Tossing one of these rolls the quantity back to 255.

====Obtain any item(Red/Blue, compressed)====
Note: This code does not work with the super-compressed 3 to 5 Pokemon setup.
<code>

8F

[Item to morph] x[any qty]

TM03 x141

Full Heal x201 </code> OR <code> Revive x201
</code>

To obtain the TM03 x141 and Full Heal x201 stacks, have TM03 x13 or Full Heal x73 in the sixth item pack slot, then encounter/capture MISSINGNO. or 'M. Alternatively, the "Non-Key item duplication" code above can be run, and tossing TM03 x115 or Full Heal x55 will give the correct quantity.

Upon using 8F, the item in your second item pack slot will morph to the item with the next or previous index number, depending on whether Full Heals or Revives are used. Refer to the [[ItemDex]] to see which items will result.

====Obtain any item====
<code>

8F

[Item to morph] x[any qty]

Thunderstone x31 (Yellow) </code>OR <code>Thunderstone x32 (Red/Blue)

TM11 x52 </code>OR <code>TM11 x53

TM01 x[any qty]
</code>


Upon using 8F, the item in your second item pack slot will morph to the item with the next or previous index number, depending on whether TM11 x52 or x53 was used. Refer to the ItemDex to see which items will result.


====Gameshark-like code====
The following item list will work the same way a game-altering device does.

<code>
8F

Any item x Any qty

X Accuracy x(b2)

Carbon x(b3)

Max Revive x(b1)

Poké Ball x201
</code>

To obtain the 201 Poké Balls stack, have Poké Balls x73 in the sixth item pack slot, then encounter / capture MissingNo or 'M. It will be a stack of 201 Poké Balls. It is also possible to use the Non-key items duplication code.

This code aims to write code like the Gameshark code "01(b1)(b2)(b3)".

For example, the code 010138CD, which allows to walk through walls, can be transcripted into the following :

<code>
X Accuracy x(b2)

Carbon x(b3)

Max Revive x(b1)

Poké Ball x201
</code>


===Via text boxes===
===Via text boxes===
Each map has a number of different map-specific text boxes, with a table of pointers pointing to each piece of text. Certain glitches like [[Trainer escape glitch#Text box ID matching|text box ID matching]] can force the game to display a text box that doesn't exist on the current map, which means the pointer may point to anything, including into the RAM. From here, a 0x08 (TX_ASM) text command in a suitable location will enable arbitrary code execution.
====Via Trainer escape glitch on Sea Route 21====
{{main|Sea Route 21 0x44 text box glitch (English Yellow)}}
Loading the hex:44 text box on Route 21 (via the shelves of Pokémon goods in Cinnabar Poké Mart) executes arbitrary text code from D2C3 in WRAM (the fifth character of the second Pokémon's nickname). This can be manipulated to run arbitrary code; for example with [[Super Glitch]] and the [[expanded party]] one can convert items in the inventory into Pokémon nicknames and abuse this to obtain Mew as a gift Pokémon via the 08 text function (run ASM following the 08). This trick was documented by Torchickens.


Notable setups for text box ACE include:
====Via Pikachu off-screen glitch====
<!--Much of this text is copied from ChickasaurusGL's video with permission, who (alias Torchickens) is one of the authors of this article https://www.youtube.com/watch?v=evdxp0UgunQ-->
By using the [[Pikachu off-screen glitch]] in the Vermilion City Fan Club and making specific movements to force the non-existing sign 04 to appear at coordinates x=1, y=1, it is possible for the player to read the signpost and execute arbitrary code beginning from D221; the catch rate/held item of party Pokémon 5.


*[[Sea Route 21 0x44 text box glitch (English Yellow)]], which is accessed by text box ID matching.
Once you have prepared one of the setups below, put your Pokémon in the 5th position of the party, prepare your items from item 1, get the Clefairy event in the Vermilion Fan Club, then do the following steps:
*[[Pikachu off-screen glitch#Glitch text box activation and arbitrary code execution|Pikachu off-screen glitch ACE]], which works by forcing the non-existing sign 04 to appear in the Vermilion City Fan Club.


===Via "TRAINER 4" (hex:FC)===
1) Go to the bottom-left walkable tile (putting Pikachu off the screen), then walk up to the top and down to the bottom of the left-most column 11 times, but for the 11th time step one tile short on the final way back down.


This method will make [[TrainerDex/RB:052|"TRAINER 4"]] (hex:FC) (encountered via the [[Trainer escape glitch]]) run code based on the data of the Pokémon in the current PC box.
2) Step right, step left, then walk up to the top and down to the bottom of the left-most column 10 times.


Requirements :
3) Step right, then go the top-left tile you can walk to, face right and press A.


*No Pokémon must ever have been deposited info the Daycare (even on a previous save file)
=====Luckless setups=====
*Knowing and being able to perform the [[Trainer escape glitch]]
*A Pokémon with a Special stat of 252


#One must perform the Trainer escape glitch using a Special stat of 252 (hex:FC)
5 different setups to use for this trick have been made by Krys3000 and Torchickens/ChickasaurusGL [http://forums.glitchcity.info/index.php?topic=8063.0 in this thread]. They all execute code from item 3 in the pack, similarly to ws m or 4F setups.
#Aside from the [[ZZAZZ glitch|ZZAZZ effects]], upon selecting an attack, code based on the data of the Pokémon that was last deposited into the Daycare (specifically at $FA58) will be run. If no Pokémon was ever deposited, the script will "fall" to boxed Pokémon data.


The code at $D040 may also to be adjusted, as not to freeze the game, due to Trainer AI scripts having at least two (ignoring duplicates) separate routines. This Trainer is only known to execute $FA58 and $D040.
# The 4 moves setup involves as 5th Pokémon in the party a Nidorina or Nidorino. It has to have been traded to G/S/C, hold a Moon Stone there and then be traded back to Yellow. This Pokémon must have 2 'placeholder moves' (typically Bite and Fury Swipes, since it learns both) followed by Double Kick (also learned) and Bubblebeam (TM11). Also, the 6th Pokémon can be anything but requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
# The 2 moves + HP/Box Level setup involves as 5th Pokémon a Nidorina or Nidorino. It has to have been traded to G/S/C, hold a Moon Stone there and then be traded back to Yellow. This Pokémon must have Double Kick (learned) as first move and Take Down (TM09) as second. Also, the 6th Pokémon can be anything but must have 24 HP currently and also have been lvl24 last time it was stored in the PC. This Pokémon requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
# The 4 moves + Glitch Pokémon setup involves as 5th Pokémon the glitch Pokémon PKMN pゥぁ ゥぇ, that can be obtained via several glitches, Equivalent Trade or Time Capsule Exploit. This Pokémon must have Ice Punch, DoubleSlap, Double Kick and BubbleBeam (all can be learned except Bubblebeam which is TM11). Also, the 6th Pokémon can be anything but requires currently 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also).
# The Untrained Hitmonchan setup is the only tradeless/glitchless setup. 5th Pokémon would be Hitmonchan and this Pokémon must never have been trained, but must know Strength (HM), Agility, Fire Punch and Ice Punch (it requires rising it to lvl 38 with Rare Candies). This Pokémon must also have 00 PP currently at Strength, 24 at Agility, 14 at Fire Punch (Ice Punch doesn't matter). Also, 6th Pokémon can be anything but must be lvl25, requires currently 24 HP, 3 PP on its first move (with 3 PP Up used), 33 PP on the second move, and 19 PP for the third move (with 3 PP Up used also). The code can be broken at any time by Hitmonchan's IV. The best way is to reset the pick of Hitmonchan to make sure that yours work. For this setup to work, you must also check that when converted into hexadecimal, Hitmonchan's trainer ID won't trigger invalid opcodes or many-bytes opcodes
# The underflow-based setup is described [http://forums.glitchcity.info/index.php?topic=8063.msg206641#msg206641 here].


{{Youtube|5x9G5BWanWw|TheZZAZZGlitch}}
A video of the Hitmonchan setup has been made by ChickasarusGL
{{youtube|bewkwWKf7qU|ChickasaurusGL}}


==In [[bp:Generation II|Generation II]]==
=====Luck-based setup=====
{{PRAMA|ace-2G}}


===Gold and Silver===
A Graveler with 08 c2 (2242) HP stat experience and 1d d3 (7635) Attack stat experience may be used as an applicable Pokémon 5, preferably a Graveler from Victory Road.
{{main|Coin Case glitch}}


The English versions of {{GS}} use a hex:57 character as a terminator for the Coin Case's "Coins: (x)" text, like in the Japanese versions.
If you are using level 44 Graveler, make note that since you can't really predict its total exp. you may not be able to get your result dictated by items. However, saving before the last few Krabby to get different levels or keeping Rare Candies, saving before talking to the text box and using one if it didn't work last time may fix this.


While this is a valid control character for the Japanese version, it isn't for the English versions, causing the game to jump into the memory at echo RAM address E112 and execute code there.
To get these specific EVs, your Pokémon needs to have encountered the following Pokémon (and no more):


Bellsprout, Machop and Machamp's cries make the coin case run a "inc sp" which changes the game into running code based on a palette table. Standing at certain places makes the code jump to data regarding party Pokémon data, and finally to the PC items.
71 Krabby, 1 Farfetch'd, 1 Dugtrio, and 1 Magnemite.


===Crystal===
(Thanks FMK for working out what Pokémon to battle).
{{main|0x1500 control code arbitrary code execution}}


In {{C}}, there is a recently found way to execute arbitrary code. It is based on getting [[unterminated name Pokémon (Generation II)|a Pokémon with an unterminated name]] (can be done with the [[bad clone glitch]]) and viewing its name unprotected (e.g. in the stats screen or in the PC).
=====Example codes (all from item 1)=====


This method was first used in a speedrun by Werster. The exploitation strategy consists of renaming boxes to specific names, and jumping there with a specific trainer ID. Until mid 2020, the [[Pokémon Crystal any% speedrun route|any% speedrun route]] was based on this method. However, [https://pastebin.com/3satHMsE the current route] now consists of using wrong pocket TM22 to achieve ACE, using the item quantity buffer and item quantity change buffer to quickly jump into the Mail buffer, where the payload is stored.
Obtain 255 items:
{{Youtube|Gj7m4vh18c8|Werster}}


==In [[bp:Generation III|Generation III]]==
This allows you to do 20+ items related glitches and get more complicated item set ups if you have items like multiple X Special x1 spare.
There are at least three methods of arbitrary code execution, all stemming from the use of [[Glitzer Popping]].


===Via stack overflow===
*Protein x1
Certain glitch pokemon have very long species names that overflow the stack and cause execution to jump to save RAM.
*Repel x1
*X Accuracy x28
*Lemonade x1
*Poké Ball x61
*Antidote x61
*Water Stone x37
*X Accuracy x97
*TM01 x1


The method is dependent on save block ordering and is somewhat impractical, but was first performed in [http://youtu.be/m9pvNYdhldo this video] by TheZZAZZGlitch.
Note: This code may be unstable.


===Via glitch move animation===
Encounter a Pokémon:
Similar to the above, certain glitch moves that can be acquired via Glitzer Popping have animation scripts that point to PC data. When the animation for these moves play, PC data is treated like an animation script and may create sprites, call callbacks, etc.
By writing an animation script that launches a visual or sound task, execution can be redirected into bad data, PC data, PC Box names etc.
Below are the most relevant glitch move IDs, EVs required on the in-game trade Plusle to acquire them with glitzer popping, and target script addresses for different versions of Pokemon Emerald. Note that due to address mirroring, addresses like 0x02330000 are mirrored with 0x02030000.
{| class="wikitable"
|-
!Version!!Move ID!!EVs!!Target
|-
|US||0x1608||8 HP 22 Attack||0x02030400 (Box 12, slot 15)
|-
|JP||0x3110||16 HP 49 Attack||0x02330000 (Box 12, slot 14)
|}
As for the animation script, a Pokemon nickname can be used on Japanese Emerald, using this [https://bulbapedia.bulbagarden.net/wiki/Character_encoding_in_Generation_III character map].
An example script may look like: 1F zz yy xx ww FF to execute code at address 0xWWXXYYZZ.


On other versions, setting up the bootstrap script is more complicated. There is a [https://pastebin.com/U5ajVMp8 Pastebin guide] for this by Metarkai.
*Iron x37
*X Accuracy x88
*Lemonade x(species you want, 21=Mew)
*Water Stone x4
*Protein x4
*TM01 x1


This strategy was used in [https://www.youtube.com/watch?v=cY_O9nRwxc4&t=3309s this TAS] by merrp, using a bootstrap nickname of: 1F 09 18 03 02 FF (まけねうい), targeting Box 1's name.
This technique was discovered by stumpdotio, originally for speedrunning Pokémon Yellow using a different method. A video of the route by Dabomstew's may be found [https://www.youtube.com/watch?v=mcsKo4K7BNE here].


This method is somewhat finicky because of its dependence on Emerald's memory layout randomization. If the bootstrap in the PC does not line up exactly with the script address, code will not be executed. This means that blindly, per battle, this method has only a 1/32 chance of actually working.
{{Youtube|evdxp0UgunQ|ChickasaurusGL}}


===Via ZZAZZ Trainer hex:FC===
===Via glitch sprite animation===
Yet another case where glitch pokemon/moves have exploitable behavior. In Emerald, each pokemon's sprite has a small animation when its summary is viewed. Certain glitch pokemon have sprites whose animation callbacks are in RAM, specifically, again, in PC data. Below are the relevant species IDs, EVs required on the in-game trade Seedot to acquire, and target addresses. Again, due to address mirroring, 0x0206xxxx is mirrored with 0x0202xxxx.
{| class="wikitable"
|-
!Version!!Species ID!!EVs!!Target!!ARM/THUMB
|-
|US||0x40E9||233 HP 64 Attack||0x0206FFFF (Box 12 Slot 3)||THUMB
|-
|US||0x0611*||17 HP 6 Attack||0x0206FEFE (Box 12 Slot 3)||ARM
|-
|JP||0x085F||95 HP 8 Attack||0x0206FFFF (Box 12 Slot 3)||THUMB
|-
|JP||0x0615*||21 HP 6 Attack||0x0206FEFE (Box 12 Slot 3)||ARM
|}
Species IDs with asterisks cannot be safely viewed from the summary screen; the game will crash from its species name. They can only be used for ACE by either hatching them from an Egg, or viewing their animation in a Pokemon Contest.


[https://problemkaputt.de/gbatek.htm THUMB or ARM code] can be executed by using PC Box names as instructions and leaving Boxes 12-14 empty. This is much easier on JP Emerald due to the number of available characters.
This method will make the ZZAZZ trainer hex:FC (encountered via the [[Trainer escape glitch]]) to run code based on the data of the Pokémon in the current PC box.


On US Emerald using species 0x40E9, since writing THUMB code is extremely limited, it may be useful to place a pokemon with the following nickname in Box 12 Slot 4: (x♂zN”6FFxC). This switches execution into ARM mode at Box 12 Slot 13's nickname, as long as your Trainer ID & Secret ID are valid THUMB instructions.
Requirements :
* No Pokémon must ever have been deposited info the Daycare (even on a previous save file)
* Knowing and being able to perform the [[Trainer-Fly glitch]]
*A Pokémon with a Special stat of 252


This glitch has been used in the latest (as of 2020/03/19) Any% WR Emerald speedrun by Startoria: https://www.youtube.com/watch?v=M5HrQM5boQs. The code used in the run was written by merrp.
# One must perform the Trainer escape glitch using a Special stat of 252 (hex:FC)
# Aside from the ZZAZZ effects, upon selecting an attack, code based on the data of the Pokémon that was last deposited into the Daycare will be run. If no Pokémon was ever deposited, the script will "fall" to boxed Pokémon data.


This is by far the most consistent method of ACE in Emerald. Once the glitch pokemon is acquired, all that's needed is to look at it, either by hatching it from an Egg, from the summary, or a Pokemon Contest. Although Emerald's memory randomization still shifts PC data around, as long as code is placed far enough past the maximum shift distance, it will execute 100% of the time. This is why it is suggested to place code in box names or Box 12 Slot 4 even though this targets Box 12 Slot 3.
{{Youtube|5x9G5BWanWw|TheZZAZZGlitch}}


==In [[bp:Generation II|Generation II]]==
==In [[bp:Generation IV|Generation IV]]==
===Via Retire glitch===
Executing a script with an index higher than the available script indexes in a map via the [[Retire glitch]] can be used to obtain arbitrary script execution, which can be escalated to full ACE. This method has been [https://www.craft.do/s/VTsIAtSd7ob1uT refined] over time.


{{Youtube|tmPzFAuKMA8|RETIRE}}
===Gold and Silver===
{{main|Coin Case glitch}}
The English versions of {{GS}} use a hex:57 character as a terminator for the Coin Case's "Coins: (x)" text, like in the Japanese versions.


===Via Alt-Retire glitch===
While this is a valid control character for the Japanese version, it isn't for the English versions, causing the game to jump into the memory at echo RAM address E112 and execute code there.
Similarly to the previous method, arbitrary script execution can also be obtained via the [[Alt-Retire glitch]].


===Via NPC ASE===
Bellsprout, Machop and Machamp's cries make the coin case run a "inc sp" which changes the game into running code based on a palette table. Standing at certain places makes the code jump to data regarding party Pokémon data, and finally to the PC items.
Interacting with an NPC runs a script with an index equal to the event_id of that NPC. ASE can be obtained through invalid event_ids. Currently, this can only be achieved via an existing ASE method. There is a [https://www.craft.do/s/oLpZYx2GFRf8N1 guide] for this by RETIRE.


==In [[bp:Generation VI|Generation VI]]==
===Crystal===
A heap overflow utilising a crafted Secret Base name can be used to achieve arbitrary code execution in Pokémon Omega Ruby and Alpha Sapphire. This vulnerability ("basehaxx") was found by MrNbaYoh and is used to execute homebrew/unsigned code on the 3DS.
In {{C}}, there is a recently found way to executed arbitary code. It is based on getting a bad clone, renaming boxes to specific names, and jumping there with a specific trainer ID.
This method was used in a speedrun by Werster.
{{Youtube|Gj7m4vh18c8|Werster}}


==Custom data==
==In [[bp:Generation III|Generation III]]==
Arbitrary code execution can be used to create custom data, such as sprites, text and sounds.
The method is extremely complicated, but can be achieved.


*[[Arbitrary sprites|Custom Pokémon and Trainer front/back sprites]]
To learn how, watch [http://youtu.be/m9pvNYdhldo this video] by TheZZAZZGlitch.
*[[Custom maps]]
*[[Custom player sprite]]
*[[Custom Pokédex entries]]
*[[Custom screens]]
*[[Custom text boxes]]
*[[Custom tilesets]]
*[[Custom PCM sound effects]]


==Related articles==
==In [[bp:Generation VI|Generation VI]]==
A heap overflow utilising a crafted Secret Base name can be used to achieve arbitrary code execution in Pokémon Omega Ruby and Alpha Sapphire. This vulnerability ("basehaxx") was found by MrNbaYoh and is used to execute homebrew/unsigned code on the 3DS.


==Related articles==
*[[Executing large programs with arbitrary code execution]].
*[[Executing large programs with arbitrary code execution]].
*[[Cart-swap arbitrary code execution]]
*[[Cart-swap arbitrary code execution]]
Line 432: Line 184:
*[[List of 8F bootstrap setups]]
*[[List of 8F bootstrap setups]]
*[[List of arbitrary code execution programs]]
*[[List of arbitrary code execution programs]]
*[[GB Programming]]



[[Category:Arbitrary code execution|*]]
[[Category:Arbitrary code execution|*]]

Latest revision as of 16:04, 7 December 2022

Major glitches of the Pokémon series


Arbitrary code execution

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC

No further extensions

Cloning | Item duplication glitch (Generation I) | Pokémon merge glitch ("Q Glitch", Generation I) | Time Capsule exploit | Bug-Catching Contest data copy glitch (Generation II, Japan only) | Berry glitch | Battle Tower Lati@s glitch (Generation III) | (Mimic) Transform Rage glitch (Generation IV)

Transform held item glitch (Generation IV, Japan only) | Mimic glitch (Generation IV, Japan only)

Buffer overflow techniques

99 item stack glitch | LOL glitch | Rival LOL glitch | Instant LOL glitch | RAM LOL glitch | Out of bounds LOL glitch | blockoobLG | Instant encounter infinite chain glitch | LGFly | Super Glitch (Generation I) | Party remaining HP glitch | Super Glitch (Generation III) | Text pointer manipulation mart buffer overflow glitch | CoolTrainer♀-type move | Double distort CoolTrainer♀ corruption | Yami Shop glitch | Party Pokémon box data shift glitch | Unterminated name glitch item instant encounter (Japanese Red/Green)

Item stack duplication glitch (Generation I)

Generation I expanded items pack (Glitch Rocket HQ maps, Map FE (English and non-English European Yellow) | Map script pointer manipulation (arbitrary code execution | Map script pointer item ball manipulation) | Text pointer manipulation (arbitrary code execution | Item ball manipulation | Mart buffer overflow) | Trainerless instant encounter glitch

Bad clone glitch (Generation II)

????? party overloading (Type 0xD0 move glitch | ????? map corruption | Celebi trick | Celebi Egg trick | Shiny Celebi trick | Glitch move map corruption | Overloaded party map corruption | Glitch Unown (Glitch Unown map corruption) | Duplicate key items glitch (Infinite items and item creation, Expanded Balls pocket (Wrong pocket TM/HMs, Glitch Pokédex categories))

Closed menu Select glitches (Japanese Red/Green)

Dokokashira door glitch (International) | Fossil conversion glitch (international) | Second type glitch | Skip to Level 100 glitch | Trainer mutation glitch | Walk through walls (International) | Lift glitch | Badge describer glitch

Pomeg glitch (Generation III)

Pomeg data corruption glitch ("Glitzer Popping") | Charm glitch

Voiding (Generation IV)

Tweaking

Broken escalator glitch (Japan only) | Elite Four door glitch (Japan only)

2x2 block encounter glitches (Generation I)

Left-facing shore tile glitch (in-game trade shore encounter trick, Old man trick, Trade link up shore encounter trick, Fight Safari Zone Pokémon trick) | Viridian Forest no encounter grass tiles glitch

Glitch City

Safari Zone exit glitch | RAM manipulation | Out of bounds Glitch City (Generation II) | Slowpoke Well out of bounds corruption (French Gold/Silver/Crystal)

Large storage box byte shift glitch

Storage box remaining HP glitch | Generation I max stat trick

Pikachu off-screen glitch

Trainer corruption glitch

SRAM glitches

Generation I save corruption | 255 Pokémon glitch | Expanded party encounter table manipulation (Generation I) | Send party Pokémon to a new game (Generation I) | Generation II save corruption | Mailbox glitches | Mystery Gift item corruption | Trainer House glitches

Trainer escape glitch

Death-warp | Ditto trick | Experience underflow glitch | Mew trick | Text box ID matching | Meta-map script activation

Walk through walls

Ledge method | Museum guy method | Rival's effect | Select glitch method (International Select glitch method), Brock Through Walls

Surf down glitch

Grass/rock Surfing glitch (Spanish/Italian only) (adaptions: Submerge glitch (international)) | 8 8 (0x7C) grass/rock surfing glitch (English Red/Blue))

(view, talk, edit)
Arbitrary code execution in the Pokémon series

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Serial interrupt ACE | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | Type 0xFF mail arbitrary code execution (Japanese Crystal) | ZZAZZ glitch Trainer FC


List of arbitrary code execution programs

(view, talk, edit)
PRAMA Initiative a également une page sur Arbitrary code execution.
Bulbapedia also has an article about Arbitrary code execution.
This article is incomplete. Please feel free to add any missing information about the subject. It is missing:

The following methods of ACE: custom map script pointer, move effect, Trainer escape glitch text box, bad clone summary, Burned Tower Silver, TM/HM use outside of the correct pocket, glitch Pokédex categories, Pikachu glitch emote, specific details on Generation III summary and move animation ACE, and specific details on Generation IV ACE.

Arbitrary code execution (Japanese: 任意コード実行) refers to a method that allows the player to force the game to run code in a write-enabled region of the game, often WRAM or RAM (see Game Boy memory map). If it is manipulable (e.g. if the region is in a representation of the player's current party), this can be abused to run custom code written by the player.

It commonly involves an invalid execution pointer (such as via glitch items in Generation I). In English versions, another popular method is as a side effect of the Coin Case glitch in English Pokémon Gold and Silver, which the player can manipulate to run custom assembly code.

This custom code is often spelled with items, as a stack of items uses only two (Generation I/II) or four (Generation III) bytes. Box names are also an option for Generation II games.

In Generation I

Via items

Each item that is not a TM or HM (more precisely, with ID less than HM01 (0xC4)), when used, gets its effect from a pointer table. For some glitch items, this effect pointer points to the RAM, enabling arbitrary code execution.

All known ACE glitch items jump into an RAM area that is possible to manipulate, but not quite as easy to manipulate as the item pack. Therefore it is popular to jump to the third item in the item pack, and write the main payload there. This strategy of first jumping to an easier to manipulate RAM area is called "bootstrapping".

There are many ways to obtain those glitch items through glitches. In Pokémon Red, Green, and Pokémon Blue (Japanese), the Select glitch can easily create any glitch item. In the international versions, the most common method is to first obtain an expanded item pack, then find the glitch item in the X coordinate (Celadon looping map trick) or in roaming items.

Below is a summary of commonly used ACE glitch items. For more information, including bootstrapping setups, click on the name of an item to go to its ItemDex page.

Version ID Name Effect pointer Pointing to Notes
English Red/Blue 0x6A -gm $DA47 Safari Ball count Followed by Day Care data and box Pokémon data
Equivalent to なかよしバッジ due to the fix for the old man full box glitch
Japanese Red/Green/Blue 0x67 なかよしバッジ $D983 Safari Ball count Followed by Day Care data and box Pokémon data
English Red/Blue 0x5D 8F $D163 Party Pokémon data Equivalent to ５かい due to the fix for the old man full box glitch
European non-English Red/Blue 0x5D 7EME ETAGE / S7 / 7°P / P7 Party Pokémon data Same item as 8F
Japanese Red/Green/Blue 0x5A ５かい $D123 Party Pokémon data
English Yellow 0x63 ws m $DA7F Box Pokémon data
European non-English Yellow 0x63 ws l' m / ws & m Box Pokémon data Same item as ws m
English Red/Blue 0x59 4F $FA65 Middle of Day Care data
English Yellow 0x59 4F $FA64 Middle of Day Care data
European non-English Yellow 0x59 3EME ETAGE / S3 / 3°P / P3 $FA64 Middle of Day Care data Same item as 4F
Japanese Red/Green 0x7B てヘ $D806 Grass encounter table Can be changed to the player's name by the old man
Japanese Blue 0x7B ItemDexJP/B:123 $D806 Grass encounter table See てヘ. Requires 0x50 sub-tile.

Notice that the items in the European non-English versions are all the same as the corresponding item (with the same ID) in English version; however, due to differences in memory layout, the bootstrapping setups will be slightly different. (The "floor items" have different numbers because in those countries, "first floor" refers to what is called second floor in American English.)

Useful item codes

See Generation I item codes for some useful item lists for 8F (and possibly other ACE methods).

Via text boxes

Each map has a number of different map-specific text boxes, with a table of pointers pointing to each piece of text. Certain glitches like text box ID matching can force the game to display a text box that doesn't exist on the current map, which means the pointer may point to anything, including into the RAM. From here, a 0x08 (TX_ASM) text command in a suitable location will enable arbitrary code execution.

Notable setups for text box ACE include:

Via "TRAINER 4" (hex:FC)

This method will make "TRAINER 4" (hex:FC) (encountered via the Trainer escape glitch) run code based on the data of the Pokémon in the current PC box.

Requirements :

  • No Pokémon must ever have been deposited info the Daycare (even on a previous save file)
  • Knowing and being able to perform the Trainer escape glitch
  • A Pokémon with a Special stat of 252
  1. One must perform the Trainer escape glitch using a Special stat of 252 (hex:FC)
  2. Aside from the ZZAZZ effects, upon selecting an attack, code based on the data of the Pokémon that was last deposited into the Daycare (specifically at $FA58) will be run. If no Pokémon was ever deposited, the script will "fall" to boxed Pokémon data.

The code at $D040 may also to be adjusted, as not to freeze the game, due to Trainer AI scripts having at least two (ignoring duplicates) separate routines. This Trainer is only known to execute $FA58 and $D040.

YouTube video by TheZZAZZGlitch


In Generation II

PRAMA Initiative a également une page sur Arbitrary code execution.

Gold and Silver

Main article: Coin Case glitch

The English versions of Pokémon Gold and Silver use a hex:57 character as a terminator for the Coin Case's "Coins: (x)" text, like in the Japanese versions.

While this is a valid control character for the Japanese version, it isn't for the English versions, causing the game to jump into the memory at echo RAM address E112 and execute code there.

Bellsprout, Machop and Machamp's cries make the coin case run a "inc sp" which changes the game into running code based on a palette table. Standing at certain places makes the code jump to data regarding party Pokémon data, and finally to the PC items.

Crystal

Main article: 0x1500 control code arbitrary code execution

In Pokémon Crystal, there is a recently found way to execute arbitrary code. It is based on getting a Pokémon with an unterminated name (can be done with the bad clone glitch) and viewing its name unprotected (e.g. in the stats screen or in the PC).

This method was first used in a speedrun by Werster. The exploitation strategy consists of renaming boxes to specific names, and jumping there with a specific trainer ID. Until mid 2020, the any% speedrun route was based on this method. However, the current route now consists of using wrong pocket TM22 to achieve ACE, using the item quantity buffer and item quantity change buffer to quickly jump into the Mail buffer, where the payload is stored.

YouTube video by Werster


In Generation III

There are at least three methods of arbitrary code execution, all stemming from the use of Glitzer Popping.

Via stack overflow

Certain glitch pokemon have very long species names that overflow the stack and cause execution to jump to save RAM.

The method is dependent on save block ordering and is somewhat impractical, but was first performed in this video by TheZZAZZGlitch.

Via glitch move animation

Similar to the above, certain glitch moves that can be acquired via Glitzer Popping have animation scripts that point to PC data. When the animation for these moves play, PC data is treated like an animation script and may create sprites, call callbacks, etc. By writing an animation script that launches a visual or sound task, execution can be redirected into bad data, PC data, PC Box names etc. Below are the most relevant glitch move IDs, EVs required on the in-game trade Plusle to acquire them with glitzer popping, and target script addresses for different versions of Pokemon Emerald. Note that due to address mirroring, addresses like 0x02330000 are mirrored with 0x02030000.

Version Move ID EVs Target
US 0x1608 8 HP 22 Attack 0x02030400 (Box 12, slot 15)
JP 0x3110 16 HP 49 Attack 0x02330000 (Box 12, slot 14)

As for the animation script, a Pokemon nickname can be used on Japanese Emerald, using this character map. An example script may look like: 1F zz yy xx ww FF to execute code at address 0xWWXXYYZZ.

On other versions, setting up the bootstrap script is more complicated. There is a Pastebin guide for this by Metarkai.

This strategy was used in this TAS by merrp, using a bootstrap nickname of: 1F 09 18 03 02 FF (まけねうい), targeting Box 1's name.

This method is somewhat finicky because of its dependence on Emerald's memory layout randomization. If the bootstrap in the PC does not line up exactly with the script address, code will not be executed. This means that blindly, per battle, this method has only a 1/32 chance of actually working.

Via glitch sprite animation

Yet another case where glitch pokemon/moves have exploitable behavior. In Emerald, each pokemon's sprite has a small animation when its summary is viewed. Certain glitch pokemon have sprites whose animation callbacks are in RAM, specifically, again, in PC data. Below are the relevant species IDs, EVs required on the in-game trade Seedot to acquire, and target addresses. Again, due to address mirroring, 0x0206xxxx is mirrored with 0x0202xxxx.

Version Species ID EVs Target ARM/THUMB
US 0x40E9 233 HP 64 Attack 0x0206FFFF (Box 12 Slot 3) THUMB
US 0x0611* 17 HP 6 Attack 0x0206FEFE (Box 12 Slot 3) ARM
JP 0x085F 95 HP 8 Attack 0x0206FFFF (Box 12 Slot 3) THUMB
JP 0x0615* 21 HP 6 Attack 0x0206FEFE (Box 12 Slot 3) ARM

Species IDs with asterisks cannot be safely viewed from the summary screen; the game will crash from its species name. They can only be used for ACE by either hatching them from an Egg, or viewing their animation in a Pokemon Contest.

THUMB or ARM code can be executed by using PC Box names as instructions and leaving Boxes 12-14 empty. This is much easier on JP Emerald due to the number of available characters.

On US Emerald using species 0x40E9, since writing THUMB code is extremely limited, it may be useful to place a pokemon with the following nickname in Box 12 Slot 4: (x♂zN”6FFxC). This switches execution into ARM mode at Box 12 Slot 13's nickname, as long as your Trainer ID & Secret ID are valid THUMB instructions.

This glitch has been used in the latest (as of 2020/03/19) Any% WR Emerald speedrun by Startoria: https://www.youtube.com/watch?v=M5HrQM5boQs. The code used in the run was written by merrp.

This is by far the most consistent method of ACE in Emerald. Once the glitch pokemon is acquired, all that's needed is to look at it, either by hatching it from an Egg, from the summary, or a Pokemon Contest. Although Emerald's memory randomization still shifts PC data around, as long as code is placed far enough past the maximum shift distance, it will execute 100% of the time. This is why it is suggested to place code in box names or Box 12 Slot 4 even though this targets Box 12 Slot 3.

In Generation IV

Via Retire glitch

Executing a script with an index higher than the available script indexes in a map via the Retire glitch can be used to obtain arbitrary script execution, which can be escalated to full ACE. This method has been refined over time.

YouTube video by RETIRE


Via Alt-Retire glitch

Similarly to the previous method, arbitrary script execution can also be obtained via the Alt-Retire glitch.

Via NPC ASE

Interacting with an NPC runs a script with an index equal to the event_id of that NPC. ASE can be obtained through invalid event_ids. Currently, this can only be achieved via an existing ASE method. There is a guide for this by RETIRE.

In Generation VI

A heap overflow utilising a crafted Secret Base name can be used to achieve arbitrary code execution in Pokémon Omega Ruby and Alpha Sapphire. This vulnerability ("basehaxx") was found by MrNbaYoh and is used to execute homebrew/unsigned code on the 3DS.

Custom data

Arbitrary code execution can be used to create custom data, such as sprites, text and sounds.

Related articles

Retrieved from "https://glitchcity.wiki/wiki/Arbitrary_code_execution?oldid=10995"