Main Menu

Glitches

References/Resources

Affiliates

Technical

Search Wiki

Toolbox

0x1500 control code arbitrary code execution
 Page | Discussion | View source | History

From Glitch City Laboratories

Jump to: navigation, search
Arbitrary code execution in the Pokémon series

0x1500 control code arbitrary code execution (Crystal) | Cart-swap arbitrary code execution | Connection Copier (arbitrary RAM writer) | Generation I custom map script pointer | Generation I invalid meta-map scripts | Generation I item ("8F", "ws m", "-g m", "5かい", "てへ" etc.) | Generation I move ("-", "TM42") | Generation I Trainer escape glitch text boxes | Generation II bad clone | Generation II Burned Tower Silver | Japanese Crystal Pokémon Communication Center SRAM glitches | Coin Case glitch | Generation II glitch Pokédex sortings | Pikachu off-screen glitch ACE | OAM DMA hijacking | Pikachu glitch emote | Generation III glitch Pokémon summary | Generation III glitch move animation) | Remote code execution | TM/HMs outside of the TM/HM pocket | ZZAZZ glitch Trainer FC (view, talk, edit)
This article is incomplete. Please feel free to add any missing information about the subject. It is missing: Original speedrunning method needed. Cover starting menu ACE research as well..
Traded Lapras method. In this case, the arbitrary code execution is triggered after exiting the inventory with A on Cancel with Antidote x21 at the bottom of the bag, and then viewing Lapras's summary.

0x1500 control code arbitrary code execution is an arbitrary code execution method found in Pokémon Crystal. It does not occur in Pokémon Gold and Silver.

A specific variation of this glitch involving an unterminated name glitch Pokémon is also known as unterminated name Pokémon arbitrary code execution.

Both of these exploits were discovered by luckytyphlosion. The original method used for speedrunning purposes is not yet covered in this article.

This glitch involves the combination of the byte 0x15 ("Day" control character) followed by 0x00 in a text string, and will lead to arbitrary code execution at memory address 0xCD52. Once the code is terminated with a ret, the program counter by default will be at the location following where the 0x1500 sequence was in the RAM.

There are various means of setting up this glitch:

Unterminated name glitch Pokémon method w/ traded Lapras and box names

For this method, an unterminated name glitch Pokémon is required. A convenient way of getting one is through a box name corruption glitch in Pokémon Red, Blue, and Yellow, such as through the 9F (0x5E) glitch item in Pokémon Red and Blue.

Video

YouTube video by ChickasaurusGL

Requirements

1) A Lapras with Perish Song (level 29 in Generation II), Bide (TM34 in Generation I) and Safeguard (level 50 in Generation II) which will have its name corrupted. The Lapras should be able to gain experience with an Exp. Share or Rare Candies (in this video Rare Candies are used from outside of the items pack, which allows them to be used effectively infinitely).

2) The 9F glitch item in Pokémon Red/Blue if you want to corrupt Lapras' name without getting a bad clone in Generation II. When the 9F glitch item is used many times with Lapras in the box, its name will corrupt.

You can then save and reset the game to withdraw it and its moves shouldn't be corrupted if you didn't use 9F too much. We can get the 9F glitch item with dry underflow glitch (https://www.youtube.com/watch?v=ZyppA...) with the Celadon looping map trick (http://glitchcity.info/wiki/Celadon_l...).

3) Two Generation II core games; one a that just got the ability to trade (this was a measure due to the glitch not working on a later save file) with Crystal and another (with access to the Time Capsule after meeting Bill in Ecruteak City and waiting a day) to raise Lapras to level 50.

4) Specific box names for storage box 1

Steps

1) Teach level 28 Lapras on Generation I Bide via TM34; move 2.

2) Deposit in the PC, corrupt nickname with 9F. Try about 15 9F uses each iteration.

3) Save and reset after nickname is corrupted, view a Pokémon summary that can withdraw unterminated name Pokémon and withdraw the Pokémon.

4) Trade to a Generation II game (Time Capsule must be enabled - meet Bill in Ecruteak and wait one day).

5) Raise it to level 29 (e.g. with Rare Candy) to learn Perish Song; move 1. Raise it to level 50 to learn Safeguard; move 3.

6) Trade to a new Generation II Crystal that just got to the Pokémon Center with Antidote x21 purchased

7) Do box name cheats and save every iteration. There are various examples below. Before doing a box name cheat (box name cheats can be set via a PC by altering PC names), save and reset the game and then perform the following; In order to perform the box names cheats, have Antidote x21 at the bottom of the inventory, try to toss all x21 (move toss counter down to show all x21) but Cancel with B, scroll down and exit by pressing A on Cancel (not with B), and then view the Lapras summary to execute arbitrary code.

Box name codes (from slot 1)

Get wrong pocket TM17 with code at DA47 to go to DB75 (i.e. set up TM17 ACE to go to box names by default):

When a TM or HM is used in the wrong pocket, it will execute an unintended code pointer. TM17 executes DA47, which is in WRAM and this data persists after save and reset. Using this code, upon executing DA47 the game redirects to box names (DB75; specifically the codes start from PC Box 1 character 1 unlike common Coin Case box name ACE cheats). Using TM17 once setup, is faster than 0x1500 control code arbitrary code execution as you don't need to do the Antidote x21 steps or have the bad name Lapras and view its summary - this way then;

i. With wrong pocket TM17, you are free to have whatever party Pokémon you like (DA47 in Crystal is related to Mobile GB Adapter variables that are fortunately saved, so it's apparent it won't be affected by party Pokémon at least while offline). ii. With wrong pocket TM17, it won't matter whether your inventory later becomes full/you can do it late in game. (Note there is another method to do 0x1500 control code arbitrary code execution late in game and with no trades, but it requires a specific type of bad clone (unterminated name clone) which may be a pain for some)


p0'déT2(Pk)5

p'vzéM5p5

'vd'v(éA45

p'vyé:5p5

'vLéB4p'vx

ém5p0555

éI4x'd

xor a

or a, d0

ld (f893),a

pop hl

ei

ld d,b

xor a

sub b9 ; 47

ld (fb8c),a

xor a

ei

ld d,b

sub a3

sub 9a ;c3

ld (fa80),a

ei

ld d,b

xor a

sub b8 ; 48

ld (fb9c),a

xor a

ei

ld d,b

sub 8b ; 75

ld (fa81),a

xor a

sub b7; 49

ld d,b

ld (fbac),a

xor a

or a, fb

ei

ei

ld d,b

ld (fa88),a

or a

ret nc

All badges:

p'viéI5p5

'vjéL5p09

éA2éB2(Pk)'d

xor a

sub a8

ld (fb88),a

xor a

ld d,b

ld d,b

sub a9

ld (fb8b),a

xor a

or a, ff

ld d,b

ld (f880),a

ld (f881),a

ld d,b

ld d,b

ld d,b

pop hl

or a

ret nc

Have Fly (DCE1 [move 1]=0x13):

p0T'vAé(Pk)6

(Pk)x'd

xor a or a, 93 sub 80 ld (fce1),a ld d,b pop hl or a ret nc ld d,b

Fly can go anywhere

p09ée655

éf6ég6(Pk)5

éh6éi6x'd

xor a

or a, ff

ld (fca4),a

ei

ei

ld d,b

ld (fca5),a

ld (fca6),a

pop hl

ei

ld d,b

ld (fca7),a

ld (fca8),a

or a

ret nc

ld d,b

Get GS Ball in Goldenrod City Pokémon Center

p'vséJ5p(Pk)

0B'vAéI55

éAAp0N'vA

ée5p0B'vA

éd5p0K'vA

éBBp'va'vc

55555555

55555555

é'l5p'v(male)'v't

é'd5p0L'vA

éIIx'd

xor a

sub b2 ;a=4e

ld (fb89),a

xor a

pop hl

ld d,b

or 81

sub 80 ;a=01

ld (fb88),a

ld d,b

ld d,b

ld (8080),a

xor a

or 8d

sub 80 ;0d

ld d,b

ld (fba4),a

xor a

or 81

sub 80

ld d,b

ld (fba3),a

xor a

or 8a

sub 80

ld d,b

ld (8181),a

xor a

sub a0

sub a2 ;be

ld d,b

ei

ei

ei

ei

ei

ei

ei

ei

ld d,b

ei

ei

ei

ei

ei

ei

ei

ei

ld d,b

ld (fbd1),a

xor a

sub ef

sub d5 ; 3c

ld d,b

ld (fbd0),a

xor a

or 8b

sub 80 ; 0b

ld d,b

ld (8888),a

or a

ret nc

ld d,b

ld d,b

--What this does basically:

ld a,01

ld (4e01),a ;change to SRAM bank 1

ld a, 0a

ld (0d01),a ;this enables writing to SRAM

ld a, 0b

ld (be3c),a ;enable Celebi GS Ball event

Get Master Ball items slot 2

p0B'vAéV2

(Pk)x'd

xor a

or 81

sub 80

ld (f895),a

ld d,b

pop hl

or a

ret nc

ld d,b


Get Rare Candy balls slot 1

p0i'vA'v

éI5p0a'vA

éA2x(Pk)'d

(fill box 1 name with 5 beforehand to prevent freeze)

xor a

or a8

sub 80

sub 50

ld d,b

ld d,b

ld (fb88),a

xor a

or a0

sub 80

ld d,b

ld (f880),a

or a

pop hl

ret nc

ld d,b


Make it a day+1 (D4B6 = 01)

p0B'vAéw,

xPk'd

xor a

or 81

sub 80

ld (f4b6),a

ld d,b

or a

pop hl

ret nc

ld d,b

Make it a day+2 (D4B6 = 02)

p0C'vAéw,

xPk'd

xor a

or 82

sub 80

ld (f4b6),a

ld d,b

or a

pop hl

ret nc

ld d,b


Get Mew (recommended Egg slot 1) DCDF=97

p0?'vH'vA5

éI5p0X55

éA6(Pk)x'd

xor a

or a, e6

sub 87

sub 80

ei

ld d,b

ld (fb88),a

xor a

or a,97

ei

ei

ld d,b

ld (fc80),a

pop hl

or a

ret nc

Hatch steps left = 1 cycle/1 happiness (DCFA=01)

p0B'vAé46

Pkx'd

xor a

or a, 81

sub 80

ld (fcfa),a

ld d,b

pop hl

or a

ret nc

ld d,b

Warp to Safari Zone

p0D'vAév6

(Pk)p'vhéw6x

'd

xor a

or a, 83

sub 80

ld (fcb5),a

ld d,b

pop hl

xor a

sub a7 (;59)

ld (fcb6),a

or a

ld d,b

ret nc

ld d,b

Explanation

Luckytyphlosion offers the following explanation on the forums:

"Basically, it's the cause of poor error checking by GameFreak. When the game has to print the Fake Bad Clone's name through the PlaceString function, it encounters 0x00 characters which aren't supposed to be printed.

In Gold/Silver, encountering a 0x00 character would cause the game to stop processing the string (and also terminate a call from the text processing engine, although that's irrelevant in this case). However, in Crystal, for whatever reason GameFreak replaced this error checking so encountering a 0x00 character would print a ? instead. This can lead to PlaceString writing past the tilemap in WRAM and into other RAM (as seen in Crystal_'s Bad Clone/Kingdra video).

This new error checking has another consequence; being able to read invalid characters. Normally this would not be too destructive; the only thing you could do at best (worst?) is overflowing text into other portions of RAM, as seen above. However, due to another instance of bad error checking, the <DAY> control code (0x15) can jump to a fairly exploitable portion of RAM, 0xcd52.

The code for control code 0x15 jumps to a mobile function, Function17f036, which then calls Function17f036 leading to a jumptable, which reads the next byte from the source as the jumptable index. While there's error checking implemented, GameFreak missed one invalid index, 0x00. The maximum index check checks if the index is greater than the upper bound, but then decrements the a register after the error check. This can allow a 0x00 index to pass through the error check, but then underflow to 0xFF, thereby reading an invalid address from ROM, which conveniently points to WRAM, and a fairly manipulable portion. This is why you need the byte combination 0x15 0x00 to jump to 0xcd52.

From there, you can do whatever setup you want to achieve ACE. Conveniently, Gamefreak pushed the source address onto the stack before jumping to the specified address, so the return address will point to whatever was after the 0x15 0x00. In the Crystal Any% speedrun case, this is an immense help as the memory after is a temporary buffer for storing a Pokemon struct (which stores the Pokémon with the corrupted nickname), allowing us to use the moves and trainer ID as a bootstrap to reach box names.

It might be possible to find other locations for a bootstrap. The address where the game jumps is similar to the address where Coin Case jumps in Gold/Silver, so you could potentially manipulate the BG Map buffers to jump to a more suitable place. (The jump to the middle of party data would not work, as the address of party data had shifted in Crystal).

Interestingly, I found this ACE exploit a while ago when attempting to do regular cloning, but I dismissed it as the result of a crash. (When I was doing some testing regarding cloning, I encountered this glitch again and actually decided to look into it)."

Stored unterminated name Pokémon/bad clone method w/ stored PC items

Video

YouTube video by Crystal_

Requirements

(From Crystal_'s video)

1. Items in the PC item storage ended with a ret command, with register de set to a specific value (e.g. 0134)

2. A bad clone in the current PC box

3. Max Elixer or TM21 (Frustration) in the bag

4. Quagsire in party slot 1, with Return as move 1, with a move with less than 10 characters in it, in slot 4

5. Spearow holding TM50 (Nightmare) in party slot 2. TM49 may also work and depends on the number of items in the PC item storage.

Steps

1. Save and reset the game just outside of a regular Pokémon Center

2. Press up on the d-pad only, until the player character is one tile below the Pokémon Center desk

3. Move right only, until facing the wall/edge of map

4. Move up only until facing the PC. Do not use the PC yet.

5. Press Start and open the player's bag

6. Have the cursor point to Max Elixer or TM21, then exit the bag without pressing A on the item

7. Go to deposit a Pokémon and view your Quagsire's summary.

8. Exit and scroll down to Spearow, then exit Deposit

9. Choose withdraw and have the cursor on the bad clone/unterminated name Pokémon, which will force its name and the 0x1500 sequence that follows, and cause arbitrary code execution.

Attribution

  • Much of the text in this article (specifically for the Lapras method) is courtesy of ChickasaurusGL's video description, with permission.