AreaDex/Y:254: Difference between revisions
Jump to navigation
Jump to search
Content deleted Content added
Line 92: | Line 92: | ||
The map has a height of 8x17 blocks (D367/8: 0x08 0x11). The "map's data" (D369-D36A) reads 1F 88. The text-script pointer table is at 0089. It has some specific map connection data. (dump from D36F: CC 6E E6 DD DD B9 99 BB BB 67 63 6E 0E EC CC DD DC 99 9F BB B9 33 3E FF 4E 40 9E C7 09 14 F8 27 16 C7 FF 5D 42 B5 C7 09 23 F8 00 12 C7). Tileset bank: 0x19, pointer to blocks: 00 46 (4600), pointer to graphics: 00 40 (4000), pointer to collision data: C2 4A (4AC2), "talking over" tiles: FF FF FF, grass tile: 0x52. |
The map has a height of 8x17 blocks (D367/8: 0x08 0x11). The "map's data" (D369-D36A) reads 1F 88. The text-script pointer table is at 0089. It has some specific map connection data. (dump from D36F: CC 6E E6 DD DD B9 99 BB BB 67 63 6E 0E EC CC DD DC 99 9F BB B9 33 3E FF 4E 40 9E C7 09 14 F8 27 16 C7 FF 5D 42 B5 C7 09 23 F8 00 12 C7). Tileset bank: 0x19, pointer to blocks: 00 46 (4600), pointer to graphics: 00 40 (4000), pointer to collision data: C2 4A (4AC2), "talking over" tiles: FF FF FF, grass tile: 0x52. |
||
Map 0xFE also causes a huge buffer overflow for D3AE (wWarpEntries), where data from 20:4F52-20:5300 (seems to be in the Pikachu's Beach minigame code) is copied to D3AE-D75D (a corruption of |
Map 0xFE also causes a huge buffer overflow for D3AE (wWarpEntries), where data from 20:4F52-20:5300 (seems to be in the Pikachu's Beach minigame code) is copied to D3AE-D75D (a corruption of 944 bytes). Not all of this data will change after leaving map 0xFE. In particular, map 0xFE corrupts many [[Meta-map script activation|meta-map scripts]], causing many locations to freeze the game with no easy solution to stop them from freezing the game when entering them without arbitrary code execution. |
||
==Exploring Map 0xFE with arbitrary code execution== |
==Exploring Map 0xFE with arbitrary code execution== |