Sea Route 21 0x44 text box glitch (English Yellow)

From Glitch City Wiki
Jump to navigation Jump to search
Forcing the 0x44 text box to bring up a Pokémon Center

The Sea Route 21 0x44 text box glitch exploits a 0x44 glitch text box in Pokémon Yellow, which takes its data from a writable source (0xD2C3) in the RAM.

It is a sub-glitch of both the Trainer escape glitch and text box ID matching.


Steps

1) Escape from a long-range Trainer on Sea Route 21.

2) Enable a text box when you go there (by changing boxes, resetting and being guided by the Pewter City museum guy).

3) 'Talk to' the shelves of Pokémon goods in Cinnabar Mart and return to Sea Route 21 (CF13=44).

This hex:44 text box's script location is found at 0xD2C3 in WRAM; which is the fifth character of the second Pokémon's nickname, hence that character will determine the text command code and the data following is possible to be read as arbitrary code if 0x08.

Example text commands for 0xD2C3

FF (fifth character is "9") = Pokémon Center

FE ("8") = Poké Mart (has glitch items)

FD ("7") = PC for Pokémon storage only (unused! "Switch on!" text)

FC ("6") = PC for items only

F9 ("3")= Normal PC

F7 ("1")= Game Corner Pokémon prize menu

F6 ("0")= Cable Club

F5 ("♀")= Vending machine

Arbitrary code execution

Though difficult, special bytes following an 0x08 byte at 0xD2C3 can be used to set up this method for arbitrary code execution.

This is possible by using a glitch such as Super Glitch to access the expanded party and having specific item requirements that will convert into Pokémon nicknames.

Alternatively the player can use another form of arbitrary code execution to achieve this.

YouTube video

YouTube video by ChickasaurusGL


Credits

  • ChickasaurusGL (documentation, video, article description)