Game:

Pokémon Red and Blue (1996)

Duration: 1:19

1,250 views

44

日本語 :

ここを参照です。

  / 1562220212321230848  

1. 「かみなりバッヂ」(62h) を取得します ( 闇ショップバグ ? , セレクトバグ, 拡張されたプレーヤーのどうぐ) ( 等 ))。

2. プレイヤー名 (ASM)でどうぐを使用です。

例: アてルめ (add b jp D2A6) (どうぐのアイテム3です)。

参照 「てへ」(7Bh):    • "てへ" and "-g m" arbitrary code execut...  

3. D0E1~D11D コードがプレーヤーの名前から悪用される前に、これらのアドレスの内容は安全でなければなりません。マサラタウンの自宅から再スタートです。成功は運次第です (事前に内容を知らなければ)。

日本の『 ポケットモンスター青』も D0E1 をコードとして実行することに注意してください。 ただし、日本語『 ピカチュウ』バージョンの機能は異なります。 プログラムカウンターはリビジョン(Rev0～Rev3)によって異なるようです。

English:
This subject was raised by my friend Alice, the owner of the Pokémon blog (including glitches) Wonderland Seeker.
https://alice-wreath.hatenablog.com/e...

Alice noted that the execution pointer of the ThunderBadge (0x62) (which runs 0xD0E1 in RAM) could possibly be exploited, so we looked into it together.

  / 1562220212321230848  

We found a way to do it. This is just one potential method. Acquire the item (with a glitch such as with Yami Shop glitch(?), Select glitch, expanded inventory) and then you can make it read from the player's name, to bootstrap it to the inventory. For instance, having the name アてルめ will redirect to item 3. However, in order for this to work the game must span through D0E1~D11D without issues first. At a glance, you only have a chance of the glitch working when you restart at your house in Pallet Town, sometimes the game will freeze (possibly because the game wasn't able to reach D11D or you corrupted the stack, etc.) unless you knew the data in advance (and more research is perhaps needed regarding what these memory addresses correspond to).

Previously, the arbitrary code execution items in Japan have been restricted to items like ５かい (0x5A) or なかよしバッジ (0x67) or てヘ (0x7B). てヘ is similar to this glitch technique, because it relies on the player's name. The luck element is removed, but unlike かみなりバッヂ (0x62) you will have to watch the old man's catching demonstration in Viridian City if the wild encounter table (minus the encounter rate) doesn't match the player's name.

Note, Japanese Pokémon Blue also runs D0E1. However, Japanese Yellow functions differently. The execution pointer seems to vary based on the revision (Rev 0~Rev 3).

Other Statistics