Anonymous user
Pokémon Blue any% No Save Corruption speedrun route: Difference between revisions
Pokémon Blue any% No Save Corruption speedrun route (view source)
Revision as of 21:14, 18 March 2019
, 5 years ago→Arbitrary code execution
>Bbbbbbbbba (Created page with "The current Pokémon Blue any% No Save Corruption speedrun route is based on glitch meta-map script activation after the "death-warp"...") |
>Bbbbbbbbba |
||
Line 91:
VRAM addresses $8055 to $8057 are part of tile 0x05, and with the overworld tileset, their values are "F8 08 F8". If those values are really read as such, then the Predef function should switch to bank $F8 (invalid of course, but not harmful) and then jump to $F808 (echo RAM equivalent of $D808). Unfortunately, at $D89C are the enemy party data, which contains a few 0xFF bytes, and this early in the game they are impossible to dodge. Therefore all $F808 would give is a rst 38 crash.
Fortunately, those values are not actually read as such, because of [[VRAM inaccessibility]]. The timing of this map script execution relative to the V-Blank is quite consistent
* The in-game timer didn't carry when advanced (i.e. IGT0) on this very frame.
* The audio engine didn't play a note on this very frame.
<!-- Is there any other conditions that may throw the timing off? -->
By some miracle, under the most common timing, the VRAM is inaccessible when reading $8056 (giving a 0xFF), but becomes accessible just before reading $8057 (giving the correct 0xF8). This means that the game instead jumps to $F8FF, nicely dodging the aforementioned 0xFF bytes.
Relevant register states:
| |||