Self-referential control character abuse: Difference between revisions

*In Generation II, 0x3F is an enemy control character, including their Trainer class. In [https://xcellerator.github.io/posts/tetsuji/ ana Remote Code Execution exploit by Tetsuji] this is written to wOTClassName ($C64C). The later occurrence of another 0x3F at $D29C leads to a recurrence (and stack overflow); the program counter falls into WRAM for [[arbitrary code execution]] after executing ret with the stack pointer in locked SRAM. However, pfero is skeptical if this would work on real hardware because of difficult to predict open bus behavior.