Main Menu

Glitches

References/Resources

Affiliates

Technical

Search Wiki

Toolbox

TryObjectEvent arbitrary code execution
 Page | Discussion | View source | History

From Glitch City Laboratories

Jump to: navigation, search

TryObjectEvent arbitrary code execution is an engine vulnerability or glitch, known to be in Pokémon Crystal.[1]

When this function is called, if the carry flag is not set, it is possible for the game to cause arbitrary code execution with bc as the pointer.

The following is the code that causes it in the Pokémon Crystal disassembly. It seems the fix is to add a pop bc instruction.

-; Bug: If IsInArray returns nc, data at bc will be executed as code.

	push bc
	ld de, 3
	ld hl, .pointers
	call IsInArray
	jr nc, .nope
	pop bc
	inc hl
	ld a, [hli]
	ld h, [hl]
	ld l, a
	jp hl
.nope

- ; pop bc + pop bc

	xor a
	ret

More research is needed for this article.
Gen III 00FC-0114.png
Reason given: Might this be the cause of Burned Tower Silver wrong side glitch?



References