Turning Splash into a One-hit-KO move (exclamation point arbitrary code execution, Pokémon Red/Blue)

Channel:

Evie (ChickasaurusGL) 🌺

Subscribers:

17,700

Published on November 2, 2021 4:47:23 PM ● Video Link: https://www.youtube.com/watch?v=Rtj2iMg9ROE

Game:

Pokémon Red and Blue (1996)

Duration: 8:47

1,799 views

91

Notes: In this video after using 4F, Magikarp's Splash turns into a one-hit KO move, which proceeds to KO the first Pokémon of each Elite Four member and the Champion, causing them to surrender and accuse us of cheating. ^^


The 'exclamation point arbitrary code execution' (or move text box end-part ACE) works because of a leftover from Japanese Red/Green/Blue; whenever you used a move, the sentence would differ depending on the group of the move;


00-

（Pokémon）は
（Move）を　つかった！　Ending 1　#f:5d97

01-
（Pokémon）は
（Move）を　した！ Ending 2 #f:5da0

02-
（Pokémon）は
（Move）した！ Ending 3 #f:5da7

03-
（Pokémon）の
（Move）　こうげき！ Ending 4 #f:5dac

04-
（Pokémon）の
（Move）! Ending 5 #f:5db4



05+ Glitch text pointer endings


In the case of the English version, the code was left as it is but all five entries were replaced with "!" as the ending, for some reason. By locking D11E (D0E3) in the Japanese versions, you can manipulate the ID to a glitch one above 04 which will have a glitch pointer (in Red/Green v1.0, 0x05 is the convenient DD00, Red/Blue's 0x40 is also D311 (in the Pokédex flags)). This text begins with a text command, so making it 08 enables arbitrary code execution at D312.


From there on, I could run my own code to enable a OHKO effect (Sing sound effect, followed by Hyper Beam animation and sound effect with the one-hit KO text) and give the illusion that Splash did it (if you experiment with the save file, other moves may work too; as I didn't add a check specifically for Splash, although that should be possible). My code also modifies the enemy Trainer's victory text, gives them one Pokémon, and in an earlier version I changed the Trainer class in case the opponent used a Super Potion when their Pokémon fainted etc. but I may have removed it in this version of the save.


4F is responsible for OAM DMA hijacking (this time without breaking the sprites, as I used a relative jump at FF89 to an earlier part of HRAM with code I added) to lock D11E to 0x40. Note: Locking this is also a starter modifier ^^ (like 01xx1ED1).


I used a relative jump to avoid Gengar's Pokédex flag from messing up the code. You can use 4F to fix any other Pokédex flags that might have got affected (D311-D31C), additionally it will reset your inventory because 4F will assume you haven't touched it.


Save file:

https://drive.google.com/file/d/1Zv0VtxqMwa9FGEqiBg367lClITSrn-h2/view?usp=sharing


Disassembly project relevant notes:
"

https://github.com/pret/pokered/blob/2954013da1f10e11db4ec96f9586b7c01706ae1a/data/moves/grammar.asm




0F:5B62 - ExclamationPointPointerTable


; this function does nothing useful
; if the move being used is in set [1-4] from ExclamationPointMoveSets,
; use ExclamationPoint[1-4]Text
; otherwise, use ExclamationPoint5Text
; but all five text strings are identical
; this likely had to do with Japanese grammar that got translated,
; but the functionality didn't get removed
DetermineExclamationPointTextNum:"

Other Statistics