I came across a video yesterday which I found frankly jaw-dropping. With the use of a Gameboy emulator and other purpose-made infrastructure, someone has managed to gain full control of the Gameboy using only legitimate moves in the game Pokemon Yellow.
In short, this hack uses a bug to corrupt the player's inventory, then places items in the inventory in a specific order based on their hexadecimal identity to spell out a short bootstrapping function in Gameboy machine code. Then, by switching the location of a pointer outside the limits of the corrupted inventory, the player forces the game to call his function.
After writing and executing another, more complex input function, the hack gains total control, and could conceivably run anything that could fit in the Gameboy's ~6KB of RAM.
All based on legal in-game moves. Ingenious and inspiring.
Video and additional explanation after the break.
(I omitted 9:30 of mostly item switching, but you can watch the whole thing for some more context)
Author's comments: http://aurellem.org/vba-clojure/html/total-control.html
A simpler explanation: http://tasvideos.org/3767S.html
Some blog coverage: http://hackaday.com/2012/11/24/...
No comments:
Post a Comment