API tools faq
paste
Advertisement
M4n0z

BlipBlopMenu 2 for Pokemon Red and Blue EN via Arbitrary Code Execution

M4n0z
Dec 17th, 2024 (edited)
159
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
ASM (NASM) 12.50 KB | Gaming | 0 0
raw download clone embed print report
  1. /*
  2.  
  3. BlipBlopMenu 2 - Compatible with EN Red and Blue ONLY
  4.  
  5.  
  6. Description
  7.  
  8. BlipBlopMenu 2 allows the TimOS selector to be accessed simply by pressing the Select button while in the overworld.
  9. This eliminates the need to use a glitch item and restores the functionality of the Daycare.
  10.  
  11. In addition, three scripts are installed, providing the following effects:
  12. #3. Repeller: When active, it permanently avoids any wild battle.
  13. #4. Trespasser: By holding B button, all collisions are disabled.
  14. #5. Motorbike: New! By holding A button, super speed is activated.
  15.  
  16.  
  17. Prerequirements
  18. - TimoVM's gen 1 ACE setup with a clean TimOS installation from:
  19.  https://glitchcity.wiki/wiki/Guides:SRAM_Glitch_ACE_Setups_(EN)
  20.  
  21. Instructions
  22. 1)  - Installation on actual hardware or emulator: You can use TimoVM's NicknameConverter and NicknameWriter from the above page.
  23.     - Installation on emulator with debugging features: Just copy and paste the HEX code into address $d8b5.
  24. 2) Run the code from NicknameWriter.
  25. 3) While in overworld, by pressing Select button TimOS selector pops up.
  26. 4) Confirm everything works correctly by testing the three new scripts and then save the game.
  27.  
  28. Attention! Activating Trespasser and walking outside the game's borders will guarantee a crash. Proceed with caution!
  29.  
  30.  
  31.  
  32. Code:
  33.  
  34. 26 0a 74 26 40 36 02 01 41 00  
  35. 11 51 c8 21 6a d6 e5 cd b5 00  
  36. 0e 81 d1 21 ff d8 cd b5 00 0e  
  37. 32 11 30 d4 cd b5 00 0e 4c 11  
  38. 11 bb cd b5 00 0e 08 11 c4 c7  
  39. cd b5 00 0e 1f 11 92 c8 cd b5  
  40. 00 3e 05 ea e9 c6 21 03 c7 3e  
  41. 92 22 36 c8 fa 5c df fe 79 28  
  42. 31 f3 26 0a 74 26 40 36 02 01  
  43. 04 00 11 80 ff 21 11 bb cd b5  
  44. 00 0e 48 11 15 df cd b5 00 26  
  45. 00 74 21 5e d3 7e fe 0b 20 09  
  46. 36 76 04 21 d1 5b cd d6 35 fb  
  47. cd 15 df c3 7a 00 21 6f d3 11  
  48. a7 d6 7a be 28 1a 01 5e d3 0a  
  49. fe 76 20 09 fa 58 d3 a7 20 0c  
  50. 3e 0b 02 3a 12 1b 7e 12 3e 6a  
  51. 22 72 21 ea d6 cb 46 28 04 7d  
  52. ea 3c d1 cb 4e 28 03 cd 30 d4  
  53. cb 56 28 03 cd 42 d4 0e 46 3e  
  54. c3 c9 00 fa 30 d7 a7 c0 f0 b4  
  55. cb 4f 3e 00 28 01 3c ea 38 cd  
  56. c9 21 00 d7 af be 20 01 34 fa  
  57. 5e d3 fe 1c c8 f0 b4 cb 47 c8  
  58. fa c5 cf fe 07 d0 a7 c8 cd 27  
  59. 0d 18 f3 cd a8 d6 e2 f0 b4 cb  
  60. 57 c8 f0 b8 f5 cd 2d df 21 27  
  61. df e5 cd e8 29 f1 e0 b8 c3 07  
  62. 23 cd 19 37 21 91 cf 36 94 af  
  63. ea 94 cf cd 51 09 0e 1f 3e 9d  
  64. cd a1 23 21 c4 70 cd 22 39 3e  
  65. 1c cd e6 35 06 03 21 53 ba 11  
  66. e8 c6 e5 d5 c5 d5 cd 0f 79 51  
  67. c8 a1 c8 98 c8 ad c8 fa 5e d3  
  68. c3 bc 12 06 02 21 ea d6 7e a8  
  69. 77 c9 06 01 cd 9a c8 a0 c0 af  
  70. ea 3c d1 c9 06 04 18 e9  
  71.  
  72. Total Bytes: 368
  73.  
  74.  
  75. Extra Scripts for BlipBlopMenu 2 for Pokemon Red and Blue EN also available here:
  76. https://pastebin.com/LXpuWNYB
  77.  
  78.  
  79. For directly patching your .sav file just use the patcher from the link below:
  80. https://github.com/M4n0zz/BlipBlopMenu2/
  81.  
  82.  
  83.  
  84. ************ Logic ************
  85.  
  86. Part 1 - Installer ($d8b5-$da24)
  87. After the code is written and executed, installer manages to transfer:
  88. - NicknameWriter from unused WRAM ($d66a) to TimOS area ($c851).
  89. - Main payload (MSP Manipulator and OAM payloads) to unused memory ($d66a).
  90. - Script payloads to unused memory ($d430).
  91. - OAM DMA hijack and TimOS Loader splitted payload to SRAM Bank 2 ($bb11)
  92. - Script pointers in TimOS selector ($c7c4).
  93. - Script enablers inside TimOS area ($c898).
  94.  
  95. Part 2 - Map Script payload ($d66a-$d6a7)
  96. - After installation and every time the game starts, MSP targets custom MSP payload.
  97. - MSP payload checks for active TimOS payload ($df5c).
  98. - If stack corrupts payload or OAM is not hijacked, it sets up the hijack ($ff80) and copies TimOS Loader payload at the top of the stack ($df15).
  99. - After setting up OAM hijack, current active room is checked. If unused room $0b is detected, manual map reset is performed to get out of HoF.
  100. - TimOS Loader payload's check is executed ($df15).
  101. - Jump to original MSP happens and the game continues to its normal state.
  102.  
  103. Part 3 - OAM DMA payloads ($d6a8-$d6e9)
  104. After OAM DMA hijack is set, the following routine is executed in every frame.
  105. - MapScriptPointer manipulator payload is executed, which checks if MSP is hijacked.
  106. - If not, current room is checked. If HoF is detected, it waits for the active dialogs to close and replaces room id with an unused one.
  107. - Afterwards, original MSP is copied to the end of this routine, and a custom one replaces it.
  108. - OAM DMA payloads are execuded, according to the payload bits set from TimOS.
  109. - Proper registers are set and OAM DMA routine continues its normal execution.
  110.  
  111. Part 4 - TimOS Loader payload ($df15)
  112. - In every non moving overworld frame, Select button is checked (hJoyPressed - $ffb3).
  113. - If the above checks are true, TimOS Loader is triggered, setting up some environment values and launching TimOS payload.
  114. - After TimOS closes, execution continues from a payload closer to the top of the stack, so to avoid any potential crash caused by a stack overflow.
  115. - In case stack overflows and destrys TimOS payload, the check in MS payload rebuilts it during the next overworld frame.
  116.  
  117.  
  118.  
  119. ************ Memory map ************
  120.  
  121. SRAM2
  122. bb11-bb14: OAM DMA hijack payload
  123. bb15-bb5c: TimOS Loader
  124.  
  125. WRAM0
  126. d430-d441: Trespasser payload
  127. d442-d461: Motorbike payload
  128. d66a-d6a5: MSP payload
  129. d6a6-d6a7: MSP backup address
  130. d6a8-d6e9: OAM DMA payloads
  131. d6ea: OAM DMA payload flags
  132. df15-df5c: TimOS loader copied from SRAM2 $bb15
  133.  
  134. HRAM
  135. ff80-ff83: OAM DMA hijack, copies from $bb11
  136.  
  137.  
  138.  
  139. Source is compiled with RGBDS
  140. */
  141.  
  142.  
  143. SECTION "BlipBlopMenu2RB", ROM0
  144.  
  145. start:
  146.  
  147. ;;;;;;;;;;;; Installer payload ;;;;;;;;;;;;
  148.  
  149. ; Opens SRAM bank 2
  150. ld h, $0a
  151. ld [hl], h
  152. ld h, $40
  153. ld [hl], $02
  154.  
  155. ; move NicknameWriter into TimOS
  156. ld bc, $0041        ; 65 bytes
  157. ld de, $c851        ; destination
  158. ld hl, $d66a        ; origin
  159. push hl
  160. call $00b5          ; CopyData
  161.  
  162. ; move main payload in unused memory $d66a
  163. ld c, $81           ; 129 bytes
  164. pop de
  165. ld hl, $d8ff        ; origin
  166. call $00b5          ; CopyData
  167.  
  168. ; move scripts in unused memory
  169. ; copy trespassing and motorbike payloads to d430
  170. ld c, $32           ; 50 bytes
  171. ld de, $d430        ; to unused memory
  172. call $00b5          ; CopyData - due to previous copyData, de points correctly
  173.  
  174. ; move OAM hijack + TimOS Loader into SRAM Bank 2
  175. ld c, $4c           ; 76 bytes
  176. ld de, $bb11        ; destination
  177. call $00b5          ; CopyData
  178.  
  179. ; move TimOS pointer
  180. ld c, $08           ; 8 bytes
  181. ld de, $c7c4        ; destination
  182. call $00b5          ; CopyData
  183.  
  184. ; move TimOS enablers + patch
  185. ld c, $1f           ; 49 bytes
  186. ld de, $c892        ; destination
  187. call $00b5          ; CopyData
  188.  
  189. ld a, $05           ; set no of scripts
  190. ld [$c6e9], a
  191.  
  192. ld hl, $c703        ; patches timos return
  193. ld a, $92
  194. ld [hli], a
  195. ld [hl], $c8
  196.  
  197.  
  198. ;;;;;;;;;;;; Executed by MSP hijack ;;;;;;;;;;;;
  199.  
  200. ; $d66a - executed by MapScript after loading the game
  201. ; it checks if TimOS Loader payload is present
  202. ld a, [$df5c]       ; last byte of TimOS payload, so if it gets corrupted to be rebuilt together with OAM DMA hijack
  203. cp a, $79
  204. jr z, .timoscheck
  205.  
  206. ; if DMA is unset
  207. di
  208. ; Opens SRAM bank 2
  209. ld h, $0a
  210. ld [hl], h
  211. ld h, $40
  212. ld [hl], $02
  213.  
  214. ; copy 4 bytes to hijack dma
  215. ld bc, $0004        ; 4 bytes to be copied to ff80 earlier set to de
  216. ld de, $ff80        ; destination
  217. ld hl, $bb11        ; from SRAM 2
  218. call $00b5          ; CopyData - the stored version of .OAMDMApayload.
  219.  
  220. ; copy timos loader to df15
  221. ld c, $48           ; 72 bytes
  222. ld de, $df15        ; to the top of the stack
  223. call $00b5          ; CopyData - due to previous copyData, de points towards TimOS loader payload
  224.  
  225. ; closes SRAM
  226. ld h, $00
  227. ld [hl], h
  228.  
  229. ; checks and initialises map if unused room is detected in place of HoF
  230. ld hl, $d35e        ; wCurMap: 00=Pallet town, 76=HoF room, 0b=unused
  231. ld a, [hl]
  232. cp a, $0b           ; if unused room is detected
  233. jr nz, .endcp  
  234. ld [hl], $76        ; set room back to HoF
  235. inc b               ; bank 1 : b=0 from previous use
  236. ld hl, $5bd1        ; run MainMenu.pressedA, as it is intended by the game
  237. call $35d6          ; Bankswitch
  238.  
  239. .endcp
  240. ei
  241.  
  242. .timoscheck
  243. call $df15          ; TimOS loader checks
  244.  
  245. .curmsp
  246. jp $007a            ; a safe address to be replaced automatically by msp manipulator
  247.    
  248.    
  249.    
  250. ;;;;;;;;;;;; Executed by OAM DMA hijack ;;;;;;;;;;;;
  251.  
  252. ; $d6a8
  253. ; MSP Manipulator - It checks and sets Map Script Pointer after backing up the original one
  254.  
  255. ; Preload addresses
  256. ld hl, $d36f        ; wCurMapScriptPtr+1
  257. ld de, $d6a7        ; Original MSP backup address+1
  258.  
  259. ; checks if MSP is hijacked
  260. ld a, d             ; Custom wCurMapScriptPtr high byte check
  261. cp a, [hl]          ; Compares current to custom pointer
  262. jr z, .payload1
  263.  
  264. ; room checking to bypass HoF reset
  265. ld bc, $d35e        ; wCurMap: 00=Pallet town, 76=HoF room, 0b=unused
  266. ld a, [bc]
  267. cp a, $76           ; if wCurMap = HoF
  268. jr nz, .backup
  269. ld a, [$d358]       ; wLetterPrintingDelayFlags
  270. and a               ; check if text is active
  271. jr nz, .payload1    ; if 0 do following
  272. ld a, $0b           ; set wCurMap to unused id
  273. ld [bc], a
  274.  
  275. ; hijacks MSP
  276. .backup
  277. ld a, [hl-]
  278. ld [de], a
  279. dec de
  280. ld a, [hl]
  281. ld [de], a
  282. ld a, $6a
  283. ld [hl+], a
  284. ld [hl], d          ; d66a
  285.  
  286. ; if scriptflag's bit0=0, skip leavemealone script
  287. .payload1           ; Always ignore encounters
  288. ld hl, $d6ea
  289. bit 0, [hl]
  290. jr z, .payload2
  291. ld a, l             ; a!=0
  292. ld [$d13c], a       ; wNumberOfNoRandomBattleStepsLeft
  293.  
  294. ; if scriptflag's bit1=0, skip trespassing script
  295. .payload2
  296. bit 1, [hl]
  297. jr z, .payload3    
  298. call $d430          ; trespassing script
  299.  
  300. ; if scriptstate's bit2=0, skip parkour script
  301. .payload3
  302. bit 2, [hl]
  303. jr z, .endoam
  304. call $d442          ; Motorbike script
  305.  
  306. ; setting return values for OAM DMA routine
  307. .endoam
  308. ld c, $46
  309. ld a, $c3
  310. ret
  311.  
  312.  
  313. ;;;;;;;;;;;; Temporary data ;;;;;;;;;;;;
  314. db $00              ;  Flags initialisation
  315.  
  316.  
  317.  
  318. ;;;;;;;;;;;; Trespassing payload ;;;;;;;;;;;;
  319. ; -> d430 - 18 bytes
  320. ld a, [$d730]       ; spin check [wStatusFlags5]
  321. and a
  322. ret nz
  323. ldh a, [$b4]        ; If Pressed
  324. bit 1, a            ; B Button
  325. ld a, $00           ; we cannot use xor a, since it will reset z
  326. jr z, .trespass
  327. inc a
  328. .trespass
  329. ld [$cd38], a       ; Loads Walk Type
  330. ret
  331.  
  332. ;;;;;;;;;;;; Motorbike payload ;;;;;;;;;;;;
  333. ; -> d442 - 24 bytes
  334. ; if walking activates bike
  335. ld hl, $d700        ; hl = d700
  336. xor a
  337. cp a, [hl]
  338. jr nz, .checkb
  339. inc [hl]
  340. .checkb
  341. ; checks for cycling road
  342. ld a, [$d35e]
  343. cp a, $1c
  344. ret z
  345.  
  346. ; checks button A pressed
  347. ldh a, [$b4]
  348. bit 0, a
  349. ret z
  350.  
  351. ; script activates at 6th moving frame and loops until it hits 0
  352. .loop
  353. ld a, [$cfc5]       ; wWalkCounter
  354. cp a, $07
  355. ret nc
  356. and a
  357. ret z
  358. call $0d27          ; AdvancePlayerSprite
  359. jr .loop
  360.  
  361.  
  362.  
  363. ;;;;;;;;;;;; OAM hijack payload ;;;;;;;;;;;;
  364. call $d6a8          ; if initial payload changes, change address acordingly
  365. ld [c], a           ; setup to trigger stock OAM payload
  366.  
  367.  
  368. ;;;;;;;;;;;; TimOS Loader payload ;;;;;;;;;;;;
  369. ; timos loader - 76
  370. ; Loaded from $bb15 to $df15 automatically with map script pointer
  371.  
  372. ; Read select button state - It automatically skips false positives like it happens in start menu
  373. ldh a, [$b4]        ; Read buttons [hJoyPressed]
  374. bit 2, a            ; Compare to select button [bit2]
  375. ret z               ; If select not pressed, stop executing
  376.  
  377. ldh a, [$b8]        ; Saves hLoadedROMBank
  378. push af
  379.  
  380. call $df2d          ; .tempdata
  381.  
  382. ;;;;;;;;;;;; After TimOS loader ;;;;;;;;;;;;
  383. ; safedata - this part should not be overwritten while timos is active, otherwise it will crash
  384. ld hl, $df27        ; We set hl to static address to continue execution after CloseTextDisplay
  385. push hl
  386. call $29e8          ; CloseTextDisplay
  387.  
  388. pop af              ; Restores saved rom bank
  389. ldh [$b8], a
  390.  
  391. jp $2307            ; PlayDefaultMusic
  392.  
  393. ;;;;;;;;;;;; TimOS loader ;;;;;;;;;;;;
  394. ; tempdata ($df32) - - this part can be overwritten safely while timos is active
  395. call $3719          ; SaveScreenTilesToBuffer1
  396.  
  397. ld hl, $cf91        ; wCurPartySpecies
  398. ld [hl], $94        ; Change nickname pokemon to Abra, so we avoid random missigno names crashing the game
  399. xor a
  400. ld [$cf94], a       ; wListMenuID
  401.  
  402. call $0951          ; StopMusic
  403. ld c, $1f           ; Bank with sound
  404. ld a, $9d           ; BlipBlop sound
  405. call $23a1          ; PlayMusic
  406.  
  407. ld hl, $70c4        ; To execute DisplayTextIDInit.drawTextBoxBorder after bankswitch
  408. call $3922          ; Bankswitch to bank 01
  409.  
  410. ;;;;;;;;;;;; TimOS payload ;;;;;;;;;;;;
  411. ; timos - 22 bytes
  412. ld a, $1c           ; bank number
  413. call $35e6          ; Bankswitch+16
  414. ld b, $03           ; SRAM bank number
  415. ld hl, $ba53        ; Origin/destination
  416. ld de, $c6e8        ; Destination/origin
  417. push hl
  418. push de
  419. push bc
  420. push de
  421. call $790f          ; CopyBoxToOrFromSRAM+1
  422.  
  423.  
  424. ;;;;;;;;;;;; Payload pointers ;;;;;;;;;;;;
  425. db $51, $c8, $a1, $c8, $98, $c8, $ad, $c8
  426.  
  427.  
  428. ;;;;;;;;;;;; TimOS return patch ;;;;;;;;;;;;
  429. ld a, [$d35e]       ; wCurMap
  430. jp $12bc            ; SwitchToMapRomBank
  431.  
  432.  
  433. ;;;;;;;;;;;; Bit Enablers pointers ;;;;;;;;;;;;
  434. ; Trespasser - 2 bytes
  435. ld b, $02
  436.  
  437. ; common function - 7 bytes
  438. .common
  439. ld hl, $d6ea
  440. ld a, [hl]
  441. xor a, b
  442. ld [hl], a
  443. ret
  444.  
  445. ; Repeller - 12 bytes
  446. ld b, $01
  447. call $c89a      ; .common
  448. and a, b
  449. ret nz
  450. xor a
  451. ld [$d13c], a       ; wNumberOfNoRandomBattleStepsLeft
  452. ret
  453.  
  454. ; Motorbike - 4 bytes
  455. ld b, $04
  456. jr .common      ; .common
  457.  
  458.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!