Arbitrary code execution in Pokémon Ruby: Sound Test (Proof of concept/teaser)

Subscribers:
17,600
Published on ● Video Link: https://www.youtube.com/watch?v=QChxZVJdwC0



Duration: 3:00
2,913 views
122


Notes (including save file and pointer list ^^): In Pokémon Ruby you can do arbitrary code execution, even without external modifications in theory. I decided to research this version because it seemed to have more areas of the memory where DMA doesn't apply. I dumped lots of glitch move animation pointers and found various access points, settling on this one: glitch move 0F4A.

Having the following data in memory will trigger the sound test (note in this video I used another glitchy code by accident so unfortunately the game froze while playing music, but with the data below it shouldn't freeze).

02038208: 1F ED A0 0B 08 00 08

Edit: This data appears as a Bad Egg in Box 14 slot 25. I don't know if you can trade one from Emerald, but would be cool if it's possible.

In my party I have a glitchy Vileplume, originally the trade Plusle from Emerald but corrupted with Glitzer Popping with the following EVs; 74 HP , 15 Attack, 0 in other EVs, no contest stats (wiped out). It's a Vileplume in this case because its first move is Growl. You should be able to hatch the Egg if trading the hatched Vileplume is impossible.

Also in the party is a Smeargle with the moves Assist, Spore and Lock-On. Glitch move 0F4A won't work with no status ailment, so we put the Pokémon to sleep with Spore. We then use Lock-On and call the move with Assist; avoiding its glitch name that would otherwise be seen by selecting it on the Fight menu with Vileplume out. Assuming move animations are on, the sound test should trigger. A side effect if you exit is it corrupting the tiles on the map. Curiously this lets you walk through tiles like the Mail-Trick glitch from Japanese Ruby.

Save file https://sites.google.com/site/torchickens2/pokemon-save-files (ace sound test ruby.sav)

Animation pointers list: https://sites.google.com/site/torchickens2/glitch-city-laboratories-resources (ruby glitch move animation script pointers.txt)




Other Videos By Evie (ChickasaurusGL) 🌺


2020-10-15Pokémon Ruby/Sapphire how to set up basic arbitrary code execution (v1.0 and v1.1/v1.2) with a trade
2020-10-08Generation III hybrids and a non freezing glitch Unown (Pokémon FireRed/LeafGreen)
2020-10-08Pokemon Crystal (v1.1): All 230 glitch Unown in battle
2020-10-08Pokémon Gold: All 230 glitch Unown in battle
2020-10-06Various curiosities/glitches/fun things randomly encountered in non-Pokémon games
2020-09-30Strange behaviour of 10°P on Virtual Console in Italian Yellow (execution of FED1?)
2020-09-26Notice about my lack of communication in comments and apology (You can contact me in DM on Twitter)
2020-09-250x76 Pallet Town warp: One of the item underflow methods to escape Glitch Cities (Generation I)
2020-09-25Viewing Pokémon 153-255 with the extended Pokédex glitch (Generation I)
2020-09-25152nd Pokémon owned and no Pokémon seen buffer overflow freeze (Generation I)
2020-09-13Arbitrary code execution in Pokémon Ruby: Sound Test (Proof of concept/teaser)
2020-09-13Encountering the Generation II glitch Pokémon but with the IsAPokemon check patched (EN Crystal)
2020-09-133TrainerPoké's Type 1 manipulated as a 'message' on the Hall of Fame screen (Pokémon Yellow)
2020-09-13Encore-Disobedience glitch (Japanese Gold/Silver)
2020-09-03Mendel Palace transform glitch (glitch in Game Freak's first game)
2020-09-03Pokémon Gold's alternative colour clothes
2020-08-27Exploring all glitch maps with patched map sizes, tilesets, sound banks (EN Red/Blue) (with map FF)
2020-08-27NPC grass sprite attribute glitch (Pokémon Red/Green JP)
2020-07-17'These glitchy copies of Pokémon Yellow and Red are personalised... with a Mario challenge'
2020-07-14Choice item lock glitch returns in Pokémon Sword and Shield
2020-07-14Three small debugging related menus in Pokémon Gold and Silver



Other Statistics

Pokémon Ruby and Sapphire Statistics For Evie (ChickasaurusGL) 🌺

At this time, Evie (ChickasaurusGL) 🌺 has 601,972 views for Pokémon Ruby and Sapphire spread across 22 videos. The game makes up 2 hours of published video on his channel, or 1.58% of the total watchable video for Pokémon Ruby and Sapphire on Evie (ChickasaurusGL) 🌺's YouTube channel.