ItemDex/RB:093
(↑ Back to the ItemDex index.)
Name (transcribed): 8F Identifier (HEX): 5D Identifier (DEC): 093 Effect pointer: 01:d163 (WRAM1) Unterminated name glitch item?: No Tossable/Sellable?: No Buy Price: 0 Sell Price: 0 Name bytes: $fe, $85, $50
|
8F redirects here. For other uses, see 8F (disambiguation).
(hex:5D) is a glitch item in Pokémon Red and Blue, with index number 93 (hex:5D). The actual use of the item is for use in the Silph Co. elevator.
This glitch item's effect pointer is $D163 in WRAM, which is the beginning of the party Pokémon data in memory, similar to Japanese Red/Green/Blue's 5かい. As such it is very popular for arbitrary code execution, as a bootstrap code to items can be written using the species of Pokémon in the party.
Usage
After setting up the bootstrap code and the payload, simply use 8F from the item list (either in the overworld or in combat) to execute arbitrary code. The quantity of 8F will not decrease, unless it is programmed to do so.
For example applications of 8F, see Generation I item codes. Notice that all applications involving an item list need a bootstrap code to work.
During the start of the execution of 8F, the following registers and stats are expected to be constant:
- a=63
- bc=00b8
- de=0001
- hl=d163
- Flags z, n, h, c are not set
- lcdc=E3
- ie=0D
- if=F0
- spd=0
- rom=3 (FFB8; loaded ROM bank)
- ime=1
- ima=1
Bootstrapping
There exists multiple different bootstrapping strategies with 8F. Most of them jump to $D322, which is the third item in the item pack. The advantage of using the third item slot is that this allows 8F to be the first item, and another item that is unrelated to the code to be the second (which is useful if the payload modifies the item).
2–5 Pokémon "Tentacool PPs" setup
An 8F setup can consist of as few as 2 Pokémon, with one of them having specific PP values:
- 2–5 Pokémon
- Tentacool as the first Pokémon
- Onix as the second Pokémon
- The Tentacool must have exactly the following amounts of remaining PP and number of PP Up used:
- 33 for 1st move (0 PP Up used)
- 34 for 2nd move (0 PP Up used)
- 19 for 3rd move (3 PP Up used)
- 41 for 4th move (3 PP Up used)
| ASM translation |
|---|
; Initial hl = 0xD163, a = 0x63, bc = 0x00B8 $D163 <- 02/03/04/05 || ld [bc], a / inc bc / inc b / dec b $D164 <- 18 22 || jr 0x22 ; pc = $D166 + 0x22 = $D188 (...) $D188 <- 21 22 D3 || ld hl, 0xD322 $D18B <- E9 || jp hl ; pc = $D322 Here the register
|
Older setups
| Details |
|---|
|
5 Pokémon "233 HP Pidgey" setup The "233 HP Pidgey" setup used to be the most popular 8F setup, although it is considered outdated due to the difficulty of controlling the exact HP value of a Pokémon. It consists of 5 valid Pokémon, with one of them having a specific current HP value:
To obtain such a Pidgey, Rare Candy it up to Lv100, apply up to 10 HP Ups. If the Pidgey still does not have 233 HP it has bad DVs. In this case either try another Pidgey or do many battles with this Pidgey (preferably Trainer battles, they are quicker than wild encounters) until depositing and withdrawing it gives it 233 HP (see box trick). If the Pidgey's maximum HP is higher than 233, a reliable method to get it to 233 HP is to get it poisoned, walk until it has 233 HP, then cure the poison. The bootstrap code translates to the following ASM: ; Initial hl = D163 $D163 <- 05 || dec b $D164 <- 24 || inc h ; h = D2 $D165 <- 2E || $D166 <- 22 || ld l, 22 ; hl = D222 $D167 <- 18 || $D168 <- 02 || jr 02 ; pc = D16B $D169 <- FF || $D16A <- FF || $D16B <- 24 || inc h ; h = D3 $D16C <- 00 || nop $D16D <- E9 || jp hl ; pc = D322 Understanding the ASM will allow modifying the setup to suit different needs. For example, to make 8F run code starting from item 1 ($D31E), replace the Onix (0x22) with a Tangela (0x1E). 6 Pokémon "233 HP Pidgey" setup A slight modification to the above setup allows a full team of 6 Pokémon, with any Pokémon at the front, which may be desirable when using an instant encounter script, for example (the lead Pokémon can be used to weaken the enemy Pokémon, and when the enemy is caught it's sent to the PC without messing up the setup).
ASM translation: $D163 <- 06 || $D164 <- ?? || ld b, ?? $D165 <- 24 || inc h ; h = D2 $D166 <- 2E || $D167 <- 22 || ld l, 22 ; hl = D222 $D168 <- 18 || $D169 <- 2D || jr 2D ; pc = D197 (...) $D197 <- 24 || inc h ; h = D3 $D198 <- 00 || nop $D199 <- E9 || jp hl ; pc = D322 3 Pokémon super-compressed setup It is possible to use a super-compressed setup, but it requires some difficult to obtain glitch Pokémon, namely h POKé (0xC3) and M p'u ゥ (0xD3).
ASM translation: $D163 <- 03/04/05 || inc bc / inc b / dec b $D164 <- C3 || $D165 <- 22 || $D166 <- D3 || jp $D322 Notice that this setup doesn't set hl to $D322, which some common item setups assume. For those item setups, inserting two items will fix this problem:
(credits to NukingDragons for this fix) |
In other European versions
In other European versions, the 8F item is named 7EME ETAGE (French) / S7 (German) / 7°P (Italian) / P7 (Spanish). It still executes code the same way, but the setup will be different due to differences in the memory layout, with the third item at $D327 rather than $D322.
The "Tentacool PPs" setup above can be adapted to those European versions by having 39 PP for the 2nd move instead of 34. For the three setups in the "Older setups" section, the common fix is to replace the Onix with a Graveler (or to replace the Tangela with a Fearow to run code starting from item 1).
See also
- 8F Helper
- ws m (hex:63): A popular glitch item for arbitrary code execution in Pokémon Yellow.
- ５かい: A glitch item in Pokémon Red, Green, and Pokémon Blue (Japanese) that executes the equivalent address ($D123, beginning of the party Pokémon data).
External links