Remote-code exploit discovered in Pokémon Ultra Sun to allow payload injection for speedrunning

Screenshot_2024-08-06_23-10-02.jpg

Wack0 (also known as "Slipstream") identified a "pialease nerf" stack buffer overflow for the game "Pokémon Ultra Sun," which can allow a payload to be executed, for the ability to perform speedrunning tasks or installing custom firmware if this is the case. The exploit appears to only work correctly with "Ultra Sun" at the time of writing with version 2.2.0; however, it is unclear whether older versions will work or if Ultra Moon might be supported.

To follow the steps in the guide, you will need both a first and secondary 3DS console with the same game installed, and both must have the same initial versions; otherwise, the exploit will not work. During this time, the exploit will run in the background on your second 3DS, and you must start a new game using Litten or Popplio as the starter. As you progress through the game, you will need to visit the nearest Pokémon Center. From there, access the Start Menu, select Quick Link, and connect. The first 3DS connected to the secondary will suddenly crash and reset. From there, load the save file and you'll be in the Champions Room to battle with a Level 100 "Darkrai", which is where the code-execution will begin.

:arrow: Source
 

Fishaman P

Speedrunner
Member
Joined
Jan 2, 2010
Messages
3,330
Trophies
1
Location
Wisconsin
Website
twitch.tv
XP
2,382
Country
United States
I guess I'm having a hard time understanding--what implications does this have for speedrunning, per se?
The author used this example code to teleport to the Champion's room from a near-fresh save file, and entered the Hall of Fame in under 40 mins because of it. Of course this would never become an actual category.

In the future, I could see race communities using this exploit to skip intro cutscenes or start with a predetermined mon and stats.
 

duwen

Old Man Toad
Member
Joined
Sep 6, 2013
Messages
3,259
Trophies
2
Location
Bullet Hell
Website
www.exophase.com
XP
4,503
Country
United Kingdom
I wonder if this will spike the price of pre-owned copies of Ultra Sun?
Quick check of CeX shows it's currently at £35 (Ultra Moon is actually more expensive at £38) - let's see where they're at in a month or two.
 

LokeYourLord

Well-Known Member
Member
Joined
Jan 3, 2017
Messages
208
Trophies
0
Age
27
Location
Seoul
XP
852
Country
Korea, South
This is once again one of those cases where I'm just sitting here, bamboozled, at how the fuck someone managed to even figure out and find such a teeny tiny, overtly specific loophole/exploit/bug in the game. It's on the same level as some of the "out of map" exploits in some of the older Call of Duty games, it just truly makes you wonder what the hell people do with their time or how the hell they even find these exploits to begin with. Absolutely insane, but kudos to the dev for even finding something like this... :wacko:
 

Scarlet

Editorial Aspirant
Editorial Team
GBAtemp Patron
Joined
Jan 7, 2015
Messages
5,436
Trophies
2
Location
Middleish South-Left
Website
scarlet.works
XP
16,934
Country
United Kingdom
Does Ultra Moon have the same exploit as Ultra Sun?
The exploit appears to only work correctly with "Ultra Sun" at the time of writing with version 2.2.0; however, it is unclear whether older versions will work or if Ultra Moon might be supported.​
 

Sir Tortoise

Well-Known Member
Member
Joined
Jan 5, 2016
Messages
194
Trophies
0
XP
1,609
Country
It's very cool just by itself, but I don't think this would be used for any serious speedrunning unless there was a way to set this exploit up without external tools. Otherwise you'd just have a homebrew application on your 3DS that immediately edits your save file to complete the game.
 

LokeYourLord

Well-Known Member
Member
Joined
Jan 3, 2017
Messages
208
Trophies
0
Age
27
Location
Seoul
XP
852
Country
Korea, South
I already did, and found nothing. It may have but the article doesn't even mention it :wtf:
You are capable of making a logical inference without having to read the exact words you're looking for and understand from context, right? Yes, it isn't outright mentioned that Ultra Moon is/isn't supported, but there are enough references made to it either directly or indirectly that you can make a logical inference and draw a conclusion by what is being said, no?

What has happened to people these days, all of the most modern educational systems and institutions in the world and yet so many fail at basic fifth grader reading comprehension. We're done for I swear... :nayps3:

#bringbackshaming
 
  • Like
  • Angry
Reactions: Ricken and SDA

wurstpistole

GBAtemp MVP
Member
Joined
Nov 19, 2015
Messages
4,681
Trophies
1
XP
5,553
Country
United Kingdom
I wonder if this will spike the price of pre-owned copies of Ultra Sun?
Quick check of CeX shows it's currently at £35 (Ultra Moon is actually more expensive at £38) - let's see where they're at in a month or two.
Presumably not, since you have been easily able to hack any 3DS without the need of a physical game copy for years now.
 

SylverReZ

80s/90s Commodore Fanatic
OP
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
8,044
Trophies
6
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
24,158
Country
United Kingdom
I wonder if this will spike the price of pre-owned copies of Ultra Sun?
Quick check of CeX shows it's currently at £35 (Ultra Moon is actually more expensive at £38) - let's see where they're at in a month or two.
I doubt the price would ever go higher. A lot of 3DS exploits don't need a game like Cubic Ninja to install custom firmware these days.

I'd like to agree, but look what happened with that Alien game on PS1 despite there being many free alternatives available to run backups on that system.
That's because of the shear number of scalpers who have watched Modern Vintage Gamer's video skyrocketing the price.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Xdqwerty @ Xdqwerty:
    Is anyone here?
  • BigOnYa @ BigOnYa:
    I'm not
  • Xdqwerty @ Xdqwerty:
    @BigOnYa, I can see you hiding
    +1
  • K3Nv2 @ K3Nv2:
    The cops are gone you can come out
    +2
  • BigOnYa @ BigOnYa:
    Thank goodness, I was tired of hiding in the cloud.
    +1
  • K3Nv2 @ K3Nv2:
    5-0 we got him
    +2
  • Xdqwerty @ Xdqwerty:
    Good night
  • Michael-MSL @ Michael-MSL:
    good evening
  • K3Nv2 @ K3Nv2:
    Good lord
  • BigOnYa @ BigOnYa:
    Nighty night
    +1
  • K3Nv2 @ K3Nv2:
    Rp5 is shipping with 8gb of ram now
    +2
  • WinReset @ WinReset:
    haha hello
  • Psionic Roshambo @ Psionic Roshambo:
    @K3Nv2, I think the RP5 has had 8GBs for a while? I know mine has 8GBs not sure it's needed for emulation though? Probably 4GBs is enough for 99% of what it's fast enough to emulate? I could be wrong if it can do like GC and PS2 stuff maybe more is needed? Probably stream the ROMs like the consoles did off the drives.
  • Psionic Roshambo @ Psionic Roshambo:
    I believe what they do is OS and translation layer (emulator) and the emulator has its RAM like 36MBs for PS2 so like 3 times that maybe as things are shuffled around, a frame buffer and. Load the data from the ROM file into that systems RAM. I think I read that even 2GBs is enough if your just using a Pi for emulation.
  • BakerMan @ BakerMan:
    What's an RP5?
  • Psionic Roshambo @ Psionic Roshambo:
    Raspberry Pi 5
  • Psionic Roshambo @ Psionic Roshambo:
    For me it's just an emulation machine
  • Psionic Roshambo @ Psionic Roshambo:
    Like a super mini system, I use Batocera as an OS and it's pretty easy to set up, has a ton of UI skins you can make it look almost anyway you want. Still would kill for a WiiFlow like skin (some are close)
  • Psionic Roshambo @ Psionic Roshambo:
    I bought the 8GB model because my thoughts on that is the the difference between the models is like 20 bucks so why not get the good one just in case.
  • Psionic Roshambo @ Psionic Roshambo:
    Almost never hear anyone complaining about too much RAM but not enough? Yeah best to avoid that one. Lol
  • Psionic Roshambo @ Psionic Roshambo:
    I did kind of overshoot on storage, a 2TB nvme drive and I think 1TB would have been plenty.
  • Psionic Roshambo @ Psionic Roshambo:
    Probably have like 700GBs of stuff on it now, and don't think I can add much more.
    Psionic Roshambo @ Psionic Roshambo: https://m.youtube.com/watch?v=5FrGx-L5XaM