Sea Route 21 0x44 text box glitch (English Yellow)
The Sea Route 21 0x44 text box glitch exploits a 0x44 glitch text box in Pokémon Yellow, which takes its data from a writable source (0xD2C3) in the RAM.
It is a sub-glitch of both the Trainer escape glitch and text box ID matching.
Steps
1) Escape from a long-range Trainer on Sea Route 21.
2) Enable a text box when you go there (by changing boxes, resetting and being guided by the Pewter City museum guy).
3) 'Talk to' the shelves of Pokémon goods in Cinnabar Mart and return to Sea Route 21 (CF13=44).
This hex:44 text box's script location is found at 0xD2C3 in WRAM; which is the fifth character of the second Pokémon's nickname, hence that character will determine the text command code and the data following is possible to be read as arbitrary code if 0x08.
Example text commands for 0xD2C3
FF (fifth character is "9") = Pokémon Center
FE ("8") = Poké Mart (has glitch items)
FD ("7") = PC for Pokémon storage only (unused! "Switch on!" text)
FC ("6") = PC for items only
F9 ("3")= Normal PC
F7 ("1")= Game Corner Pokémon prize menu
F6 ("0")= Cable Club
F5 ("♀")= Vending machine
Arbitrary code execution
Though difficult, special bytes following an 0x08 byte at 0xD2C3 can be used to set up this method for arbitrary code execution.
This is possible by using a glitch such as Super Glitch to access the expanded party and having specific item requirements that will convert into Pokémon nicknames.
Alternatively the player can use another form of arbitrary code execution to achieve this.
YouTube video
| |
Credits
- ChickasaurusGL (documentation, video, article description)