Pokemon first generation: Long-range trainer escape glitch
Unknown (first described in 2003 by Daniel26)

The player wants to capture any Pokemon (usually Mew).

In Game Boy, the game code runs in cycles. On every cycle the screen is drawn, and the code has a chance to decide what to display the next time the screen is displayed. In Pokemon first generation, the game is split in multiple "scripts" or "maps". Each map represents a physical section in the game. Each map also holds the part of the code responsible for battles. Battles are split in 3 scripts. The first detects when the player walks in-front of a trainer and start a battle. The second disables the controls from the player and makes the enemy walk over the player, and the last one finishes the battle.

The code responsible for detecting the player only runs if the enemy is currently visible in screen, however the code that makes enemies visible runs after the code that detects user input. Because of this, there is a small amount of time when the player can pause the game and "escape" from the map. When the player escapes the code responsible for displaying the enemy will execute, followed by the code responsible for starting the battle, however the battle never happens because the player escapes from that map, leaving the map frozen in the "battle" script. Since the game reuses memory within the battle script (as it is assumed that only one battle can happen at a time), it is possible for a player to control the part of memory that defines the Pokemon being fought by battling a specific type of Pokemon before returning to the map where the player escaped from. Once the player returns to that map, the battle in that map will finally start and the Pokemon to be fought will be defined by the memory overwritten by the player in the previous battle.
About In Security Bugs Gallery you will find drawings of different stories inspired by software security vulnerabilities.
Creative Commons License