Guides:TMless 0x1500 ACE (JP): Difference between revisions
m
no edit summary
mNo edit summary |
|||
Line 1:
{{Guides header|0x1500 control code arbitrary code execution}}
This page serves as
The setup requires catching a Spearow during day time and fighting Spinarak during night time. It is recommended to set the in-game time at the start of the game somewhere between 5:00PM-5:30PM.
If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.▼
'''When playing on cartridge or emulator, it is required to have previously cleared an old save by pressing SELECT + UP + B simultaneously on the start screen at least once since obtaining the cart. Otherwise you will not be able to obtain a bad clone or an unterminated name pokémon.'''
=General overview=
▲If you encounter any issues when going through this guide or would like to provide feedback, please contact TimoVM on the Glitch City Research Institute Discord.
Pokémon Crystal contains two important differences compared to its predecessors. Firstly, Crystal won't abort the text printing function when it encounters a $00 value, instead printing a '?' instead. Secondly, Crystal added new printing funtions related to the Mobile Game Boy Adapter, a Japanese exclusive peripheral that allowed internet connectivity through a mobile phone.
By obtaining a pokémon whose name does not contain the usual text terminator, we can force the game into printing much larger amounts of texts than would otherwise be possible. By abusing an illegal Mobile Adapter function and setting up memory in a specific way, we can escape the text printing function and trigger arbitrary code execution based on the data of the last viewed party pokémon.
In practice, the initial ACE setup will be created using the following general process:
# Train a pokémon that can redirect the effect of 0x1500 ACE to the last read mail.
# Obtain an [[Bad clone glitch|unterminated name pokémon]].
# Set up the currently buffered memory in such a way that we can trigger 0x1500 ACE upon seeing the name of the unterminated name pokémon.
=Starting from a new game=
| |||