Glitch blackboard text arbitrary code execution (Generation I)

Channel:
Evie (ChickasaurusGL) 🌺
Subscribers:
17,700
Published on ● Video Link: https://www.youtube.com/watch?v=x24UgyGgpFg


Duration: 2:40
625 views
39

Each entry for text on the Viridian City school blackboard is indexed. Invalid entries (other than the explanations for ailments SLP, BRN, PSN, FRZ, PAR, and the QUIT) can be forced by writing to CC26. To preserve it, we can write to CC26 with OAM DMA arbitrary code execution (requiring another form of arbitrary code execution such as the glitch item 4F).

In Red, glitch entry 0x1C is sourced from FACD (Echo RAM for DACD); the Defense EV of the second stored Pokémon in the current box. So outside of emulation which doesn't emulate Echo RAM correctly (e.g. Stadium Game Boy Tower), having it as 08 makes the text execute code from DACE onward. Here, you can have your own code such as one to call the Hall of Fame function in the video.

Some useful resources for doing this:

https://glitchcity.wiki/ItemDex/RB:089
https://glitchcity.wiki/OAM_DMA_hijac...
https://glitchcity.wiki/The_Big_HEX_List
https://glitchcity.wiki/Arbitrary_cod...
https://glitchcity.wiki/Dry_underflow...
https://glitchcity.wiki/Reusable_RAM_...
https://glitchcity.wiki/Generation_I_...

(e.g. with reusable RAM writer, write to D322 onward - 3E 1C EA 26 CC C9 and DACD onward 08 0e 16 26 64 2e bb 41 40 cd d6 35 c9 then at FF82-FF80 backwards D3 22 C3)



Other Videos By Evie (ChickasaurusGL) 🌺


2023-09-08Experimental Pokédex nest buffer overflows (Generation I)
2023-09-08Cloning over/deleting a corrupted box contents w/arbitrary code execution (Gold/Silver EN request)
2023-09-08Clearing the mailbox (Japanese Crystal) (request)
2023-06-20Get any Pokémon w/any move+set of internal types (AncientPower Bulbasaur in video) (No ACE) (Yellow)
2023-06-01The uppercut invulnerability exploit (Game Freak's 1994 Pulseman) (warning: flashing lights)
2023-05-27Exploiting Game Boy Camera's SRAM storage to run minigames via cart swap (w/shoddy "Snek Fly" game)
2023-04-18NamingScreenType (D07D/C) arbitrary code execution (Generation I)
2023-04-18Agatha's badge describer glitch and arbitrary code execution from Antidote badge (Pokémon Red/Blue)
2023-04-18Special text box IDs during Trainer-Fly that work independent of maps (Generation I)
2023-04-18Use DHNhIT4 89 ゥ N (0x74) to obtain the 0xFF PP value without PP underflow glitch (Pokémon Yellow)
2023-03-21Glitch blackboard text arbitrary code execution (Generation I)
2023-02-27Level 0 Pokémon cannot evolve by stone/obtain Level 0 Clefairy w/Brock Through Walls (Generation I)
2023-02-27Obtain MissingNo. (0xAF) with GoldBadge item (addendum to the GoldBadge glitch) (Red/Green v1.0)
2023-02-27Select glitch 35 Pokémon swap for instant Safari Zone exit glitch (Glitch City) (Red/Green/Blue JP)
2023-02-19Manipulating the unused Silph Co. 11F wLastMap warp 10 (Another Glitch City glitch) (Generation I)
2023-02-18Locating the warping ('parallel universe') NPC caused by playing sound 00 (Generation I)
2023-02-18Character misalignment glitches (Generation I)
2023-02-18Select glitch species corruption with party swap 178 for battling ィﾞゃゾＡ (00) (Red/Green/Blue JP)
2022-12-28Oak Through Walls concept (Pallet Town Professor Oak guide abuse) (Generation I)
2022-12-28Attempting to exchange the Bike Voucher with a full bag of 20 items (Generation I)
2022-12-28Placeholder and unused Professor Oak text (Generation I)