bliny | rainbow dog srm heap @bliny | Uploaded 3 years ago | Updated 17 seconds ago
To spawn the rainbow dog I manipulate the actor heap to allocate things to the correct spots in memory then modify the draw function pointer in a grass actor instance to write to a 32 bit value to save context by running an instruction inside the fish's actor file which writes whatever is in $t1, which is constantly set as a 32 bit float relative to the angle of grass patch which we modified the draw function of. The value in save context written to is used to determine if a dog is following you, along with what kind of dog it is. The value is cleared when loading a scene that does not allow dogs, so I then must warp directly to a scene that is cool with stray dogs following children by modifying the grotto's entrance index.
The color of the rainbow dog is determined by its X coordinate, +0x24 the start of the rainbow dog's actor instance.
This only uses a partial function call which technically is not arbitrary code execution.
To spawn the rainbow dog I manipulate the actor heap to allocate things to the correct spots in memory then modify the draw function pointer in a grass actor instance to write to a 32 bit value to save context by running an instruction inside the fish's actor file which writes whatever is in $t1, which is constantly set as a 32 bit float relative to the angle of grass patch which we modified the draw function of. The value in save context written to is used to determine if a dog is following you, along with what kind of dog it is. The value is cleared when loading a scene that does not allow dogs, so I then must warp directly to a scene that is cool with stray dogs following children by modifying the grotto's entrance index.
The color of the rainbow dog is determined by its X coordinate, +0x24 the start of the rainbow dog's actor instance.
This only uses a partial function call which technically is not arbitrary code execution.