View source for Type 0xD0 move glitch

{{Major glitches}}
'''Type 0xD0 move glitch''', also known as '''Move 0x00 arbitrary code execution''' (not to be confused with [[- (move)]] arbitrary code execution in Generation I) is a glitch in at least English {{GS}} that allows the player to execute arbitrary code without using the Coin Case.

An advantage to this glitch over Coin Case glitch is that it may not corrupt the stack (similar to wrong pocket TM ACE which never corrupts the stack), however it requires move 0x00 which can only be obtained by trading a Pokémon with it over from Generation I (such as [[- (move)|"-" move Ditto]] with the [[swapping Transform moves glitch]], obtaining a [[bad clone]], or using another form of arbitrary code execution).

This glitch has been used in any% speedruns of Pokémon Gold and Silver ([https://www.youtube.com/watch?v=3mI3Cdt4j24 see here]), and was researched by Luckytyphlosion. ChickasaurusGL also adapted it for non-speedrunning uses.

==Summary==
You can execute arbitrary code by moving in a specific way in Cherrygrove City (see these pictures http://i.imgur.com/I0UjT7z.png) and viewing move 0x00 from the move description menu in a Pokémon's summary provided the following requirements are met:

1. You have exactly four Pokémon.

1i) The first Pokémon has move 0x00 (e.g. a "CoolTrainer" Ditto).

1ii) The third Pokémon is a low level 'slide' Pokémon you caught in the wild (whether it will work is up to chance but if you find one that works it will always work, possibly the same one compatible for Coin Case ACE without bad DVs etc.)

1iii) To be safe have Pokémon 2 and 3 have the bird and tailed creature menu sprites and have no Pokémon hold an item except for Pokémon 4.

2. Pokémon 4 is a Quagsire with TM02 and Return as its first move (for box name ACE at D8C0 (box 1 character 2)) or a Quagsire with HP Up and Sleep Talk as its first move (for stored items ACE at D61A (second item quantity)).

Before you move one step up and four steps right from picture 3, save the game. Afterwards view Pokémon 1's moves from the move description menu and close it repeatedly until your code works.

Sometimes this will not execute arbitrary code. At times it is possible to get a flashing color 'disco' effect as well.

==Example box name code==
This box name code with many thanks to Crystal_ for the concept allows us to warp to the Bug-Catching Contest and obtain Celebi.

The box names for that are as such:

Box 1: Bp'vZ'vL55

Box 2: é'r2p'vA'vF

Box 3: é!Ap'v/'v)

Box 4: é?2p'v5'vA

Box 5: 'vBéA'tp'vZ

Box 6: 'v[éx2

(x is the multiplication sign)

==Technical information==

Move 0x00 has a glitch type, specifically glitch type 0xD0. The source of its glitch type is 0x8350 in VRAM, hence what is or what was on the screen will affect what the game brings up as a type name; possibly with what's on the Pokémon menu affecting 0x8350{{fact}}, as 0x8350 may be written to if you have enough Pokémon menu sprites and/or held items in the party.

When we have 'good' data at 0x8350 the name of the glitch type causes memory corruption, and by making the specific movements in Cherrygrove City/meeting the party requirements the game may start to execute arbitrary code on attempts, seemingly at random.

If by chance the game executes E9F0 (Echo RAM for C9F0) then it will eventually come across jr c, EC68 (@EC2D) and jp c, FA9B (@EC70), which causes the game to execute FA9B (DA9B).

As DA9B is Pokémon 3's Speed DVs, we can make the data slide over to Pokémon 4. Using Quagsire, the code can be redirected to somewhere else (such as box names or stored items) where we can spell out code.

Here is the assembly code for the box name code to obtain Celebi:

 xor a
 sub 99
 sub 8b
 ei
 ei
 ld d,b
 ld (f8d3),a
 xor a
 sub 80
 sub 85
 ld d,b
 ld (80e7),a
 xor a
 sub f3
 sub 9b
 ld d,b
 ld (f8e6),a
 xor a
 sub fb
 sub 80
 ld d,b
 sub 81
 ld (d580),a
 xor a
 sub 99
 ld d,b
 sub 9e
 ld (f8f1),a
 ld d,b
 ld d,b
 ld d,b
 ld d,b

==YouTube video==
{{YouTube|W-yPxRpoKyI|ChickasaurusGL}}

==See also==
*[http://forums.glitchcity.info/index.php?topic=8000.0 Glitch City Laboratories Forums thread]