Arbitrary code execution in Pokémon Ruby: Sound Test (Proof of concept/teaser)

Notes (including save file and pointer list ^^): In Pokémon Ruby you can do arbitrary code execution, even without external modifications in theory. I decided to research this version because it seemed to have more areas of the memory where DMA doesn't apply. I dumped lots of glitch move animation pointers and found various access points, settling on this one: glitch move 0F4A.

Having the following data in memory will trigger the sound test (note in this video I used another glitchy code by accident so unfortunately the game froze while playing music, but with the data below it shouldn't freeze).

02038208: 1F ED A0 0B 08 00 08

Edit: This data appears as a Bad Egg in Box 14 slot 25. I don't know if you can trade one from Emerald, but would be cool if it's possible.

In my party I have a glitchy Vileplume, originally the trade Plusle from Emerald but corrupted with Glitzer Popping with the following EVs; 74 HP , 15 Attack, 0 in other EVs, no contest stats (wiped out). It's a Vileplume in this case because its first move is Growl. You should be able to hatch the Egg if trading the hatched Vileplume is impossible.

Also in the party is a Smeargle with the moves Assist, Spore and Lock-On. Glitch move 0F4A won't work with no status ailment, so we put the Pokémon to sleep with Spore. We then use Lock-On and call the move with Assist; avoiding its glitch name that would otherwise be seen by selecting it on the Fight menu with Vileplume out. Assuming move animations are on, the sound test should trigger. A side effect if you exit is it corrupting the tiles on the map. Curiously this lets you walk through tiles like the Mail-Trick glitch from Japanese Ruby.

Save file https://sites.google.com/site/torchickens2/pokemon-save-files (ace sound test ruby.sav)

Animation pointers list: https://sites.google.com/site/torchickens2/glitch-city-laboratories-resources (ruby glitch move animation script pointers.txt)