I remember when arbitrary code execution started being the name of the game. I was amazed when TheZZAZZGlitch wrote pong just using items! At that time, I already had plenty of Game Boy projects going on. I was even writing my own emulator (in Python…) as a thesis in my high school, and I created a simple snake game. I knew I could accomplish something myself for Pokémon, too. Gen 1 had been thoroughly studied by the time, so I focused on Gen 2. Quickly I realized that the Coin Case glitch, which was also called "glitch dimension" at the time due to its tendency to restart in Game Boy mode, had potential. I brought out bgb and spent hours tracing where the code runs through. I thought it was silly to document what every individual cry does. I still think the only reason people even knew the cries affect the result is thanks to the Machop in Vermillion. These effects were barely interesting! Nonetheless, I traced the game's execution upon viewing the Coin Case. I discovered the error the translators made in improperly terminating the dialogue box. I watched the game hop through memory. I figured out why Machop's cry is so significant. A single instruction, left behind by memory values the cry used, a simple `inc sp`, caused the game to change its course and execute other memory. That memory was the tile or attribute map of the current screen. I observed it change as I moved around. I noticed that jump instructions appear. I prayed for a useful one and my wish was granted, upon a certain movement a jump to the third party Pokémon data appeared. Bingo, I thought. Now we have total control. I further routed the code to the PC box items and published a proof of concept here on GCL.
Others quickly found useful pieces of code as I expected, which made me happy. The thread grew to 26 pages! It's silly, but this makes me feel accomplished.
