Jump to content

Arbitrary code execution: Difference between revisions

→‎Via items: Put the commonly used items into a table.
>Bbbbbbbbba
>Bbbbbbbbba
(→‎Via items: Put the commonly used items into a table.)
Line 16:
All known ACE glitch items jump into an RAM area that is possible to manipulate, but not quite as easy to manipulate as the item pack. Therefore it is popular to jump to the third item in the item pack, and [[Generation I item codes|write the main payload there]]. This strategy of first jumping to an easier to manipulate RAM area is called "bootstrapping".
 
Below is a summary of commonly used ACE glitch items. For more information, including bootstrapping setups, click on the name of an item to go to its [[ItemDex]] page.
====Using てヘ (tehe) in JP Red/Green====
<!-- NOTE : Should be tested for JP Yellow, too -->
The glitch item [[ItemDexJP/RG:123|てヘ]] (0x7B) has its execution script pointing to wild Pokémon data. However, by naming yourself (any character)てルめ(any characters or nothing) and talking to the Old Man, the script jumps to item pack #3.
 
{|
====Using 8F (English Red/Blue)====
{| align=top style="background: grey; -moz-border-radius: 0.5em; border: 5px solid #000000; color: grey"
The glitch item [[ItemDex/RB:093|8F]] (0x5D) executes code starting from the party Pokémon data. See the [[ItemDex/RB:093|ItemDex page]] for more information on the setup.
|-
 
|
====Using 7EME ETAGE (French) / S7 (German) / 7°P (Italian) / P7 (Spanish) (Red/Blue)====
{| border=1 width="100%" align=left class="sortable" style="background:#f0f0f0; border:1px solid #000000; border-collapse:collapse;"
These items are the same item than the 8F of English versions (the difference in numbers is because in these countries, "first floor" refers to what is called second floor in english). Therefore, it executes code in the same way.
|-style="background: silver;"
 
! Version !! ID !! Name !! Effect pointer !! Pointing to !! Notes
The bootstrap code for 7eme etage, S7, 7°P or P7 must be slightly changed from the English version: no matter the setup, the player should replace the Onix with a Graveler. See the ItemDex page of 8F for more information.
|-
 
| English Red/Blue || 0x5D || [[ItemDex/RB:093|8F]] || $D163 || Party Pokémon data || Equivalent to 5かい due to the fix for the [[old man full box glitch]]
====Using ws m (English), ws l' m (French/German), ws & m (Italian/Spanish) (Yellow)====
|-
The glitch item [[ItemDex/Y:099|ws m]] (0x63) executes code starting from the current box Pokémon data. In European non-English games, the name of the item looks like '''ws l' m''' (French/German) or '''ws & m''' (Italian/Spanish), but they execute code in the same way, so only minimal change to the bootstrapping is needed.
| European non-English Red/Blue || 0x5D || [[ItemDex/RB:093#In other European versions|7EME ETAGE / S7 / 7°P / P7]] || <!-- TODO --> || Party Pokémon data || Same item as 8F
 
|-
See the [[ItemDex/Y:099|ItemDex page]] for more information on the setup.
| Japanese Red/Green/Blue || 0x5A || [[ItemDexJP/RGB:090|5かい]] || $D123 || Party Pokémon data ||
 
|-
====Using 4F (English and European non-english Yellow)====
| English Yellow || 0x63 || [[ItemDex/Y:099|ws m]] || $DA7F || Box Pokémon data ||
 
|-
By using item 4F instead of "ws m", we can execute code using Daycare data. Although this possibility was previously known, it was setup by Krys3000 in [http://forums.glitchcity.info/index.php?topic=8056.0 this thread] for both English and non-English Yellow games.
| European non-English Yellow || 0x63 || [[ItemDex/Y:099#In other European versions|ws l' m / ws & m]] || <!-- TODO --> || Box Pokémon data || Same item as ws m
 
|-
In english games, deposit and withdraw (or not) at the Day Care a Nidorina (that should not be evolved from a Female Nidoran), with Bite, Fury Swipes, Double Kick and Growl (the first two moves are placeholders and can be replaced with some other moves, but not just any move). Then, store in the active PC Box:
| English Yellow || 0x59 || [[ItemDex/Y:089|4F]] || $FA64 || Middle of daycare data ||
 
|-
# Any lvl25 Pokémon with currently 24 HP, 33 PP currently for the first AND second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
| European non-English Yellow || 0x59 || [[ItemDex/Y:089|3EME ETAGE / S3 / 3°P / P3]] || $FA64 || Middle of daycare data || Same item as 4F
# Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP
|-
 
| Japanese Red/Green || 0x7B || [[ItemDexJP/RG:123|てヘ]] || $D806 || Grass encounter table || Can be changed to the player's name by the [[Old man trick|old man]] <!-- NOTE: Should be tested for JP Blue and JP Yellow, too -->
Using 4F will then execute code from the third item, as with other setups.
|}
 
|}
<code>
Notice that the items in the European non-English versions are all the same as the corresponding item (with the same ID) in English version; however, due to differences in memory layout, the bootstrapping setups will be slightly different. (The "floor items" have different numbers because in those countries, "first floor" refers to what is called second floor in American English.)
WRA1:DA64 <- 78 || ld a,b<br />
WRA1:DA65 <- 2C || inc l<br />
WRA1:DA66 <- 9A || sbc d <br />
WRA1:DA67 <- 18 2E || jr DA97<br />
WRA1:DA97 <- 18 19 || jr DAB2<br />
WRA1:DAB2 <- 21 21 D3 || ld hl,D321<br />
WRA1:DAB5 <- 00 || nop<br />
WRA1:DAB6 <- 04 || inc b<br />
WRA1:DAB7 <- 00 || nop<br />
WRA1:DAB8 <- E9 || jp hl
</code>
 
{{youtube|AxNliiLzA0Q|ChickasaurusGL}}
 
The setup is somewhat easier in non-english games. Deposit and withdraw (or not) a lvl80 Pokémon with currently 24 HP in the Day Care. The, store in the active PC Box:
 
# Any Pokémon with 33 PP currently for the first move, 38 PP currently for the second move, 19 PP currently for the third move (3 PP Up used) and no fourth move or no PP currently on it
# Clefairy, Male Nidoran or Spearow (among many possibilities) with 233 HP
 
Using 4F will then execute code from the third item, as with other setups.
 
<code>
WRA1:DA64 <- 00 || nop<br />
WRA1:DA65 <- 18 50 || jr DAB7<br />
WRA1:DAB7 <- 21 26 D3 || ld hl,D326<br />
WRA1:DABA <- 00 || nop<br />
WRA1:DABB <- 04 || inc b<br />
WRA1:DABC <- 00 || nop<br />
WRA1:DABD <- E9 || jp hl
</code>
 
===Useful item codes===
Anonymous user
Cookies help us deliver our services. By using our services, you agree to our use of cookies.