ItemDex/RB:107
(↑ Back to the ItemDex index.)
Name (transcribed): # Identifier (HEX): 6B Identifier (DEC): 107 Effect pointer: 00:cd35 (WRAM) Unterminated name glitch item?: No Tossable/Sellable?: Yes Buy Price: 938581 Sell Price: 469290 Name bytes: $c0, $cf, $2a, $50
|
(hex:6B) is a glitch item in Pokémon Red and Blue.
Its name is taken from the untranslated string たまご (Egg) from the Japanese versions, resulting in mojibake. たまご is also the name of the hex:6B glitch item in Japanese versions.
Using this glitch item causes arbitrary code execution at $CD35 in RAM.
Arbitrary code execution methods
Hall of Fame entry bootstrap
If the player views a Level 211 h POKé (0xC3) (getting one at this high of a level is possible with Rival LOL glitch) in the Hall of Fame, it will write C3 18 D3 to (jp D318) at CD3D, so using the item will execute Pokédex flags (from seen 113-seen 152, and then the player's inventory data starting with the number of items, then item/quantity pairs). However, at this point the sprite of h POKé corrupted the Hall of Fame, so viewing the Hall of Fame again will break the setup. Certain combinations of Pokédex flags will also break the arbitrary code execution in items, so to prevent issues it's a good idea that Pokédex entries 113-152 are not seen at all.
Using another level for the h POKé is also an option, such as 219 to execute DB18 (current PC box Pokémon 5 PP of Move 3). It may also be possible to use a different glitch Pokémon representing a conditional variation of the jp opcode (C2 (jp nz), CA (jp z), D2 (jp nc), or DA (jp c)) depending on the state of CD38-CD3C (all flags are reset by default, in which case CA and DA wouldn't work).
Unfortunately, corrupting the Hall of Fame (including viewing the sprites of certain glitch Pokémon, such as h POKé) will break this setup; so the player must ensure not to interact with any further glitch Pokémon which corrupt the Hall of Fame. Notably, viewing ゥ .4 (C2) in the Hall of Fame is not enough to corrupt the Hall of Fame, so ゥ .4 (C2) is an ideal alternative to h POKé (0xC3).
| |