This is a completely new type of a Super Mario World run. It beats the game by getting the THE END [dead link removed] screen in the 2nd level (Yoshi's Island 3).
After the discovery of a new glitch by あんた (anta), our Skype TASing community was trying to understand what happened in the .smv. Since he only uploaded the .smv and a japanese documentation, we had to find it out by ourselves.

Game objectives

  • Emulator used: Snes9x 1.43 v17
  • Aims for fastest time
  • Uses game-breaking glitches
  • Heavy luck manipulation
  • Achieves credits early

The "credits glitch"

"spit sprite position = yoshi X position + offset to spit object(index by Y which is the direction) normally, this would store to the sprites X position, however, because the sprite index is #$FF It writes to #$E4 + #$FF which is #$01E3. This is the stack address that is corrupted. If yoshi is facing left he must be at the position #$86, and if he is facing right it should be #$66."
p4plus2's documentation of the "credits glitch" [dead link removed]

Addresses which have to be manipulated

RAM Addressneeded ValueDescription
$7E:148C#$7CRNG 1 | See explanation below
$7E:148D#$92RNG 2
$7E:148E#$F7RNG 3
$7E:00E8#$86X position of sprite #04 (it's Yoshi in this case) (freezes when the sprite disappears, though you shouldn't have him disappear)
OAM Addressneeded ValueDescription
$01:02D4#$26X position of some score numbers onscreen (freezes when it disappears)
$01:02FC#$A3X position of the "smoke" effect (like when a fireball goes into a wall) (freezes when it disappears)
$01:02FD#$F0Y position of the "smoke" effect (same as above) (sets to #$F0 when it disappears)
$01:0304#$81X position of a Mario tile that appears when Mario is on Yoshi and he is in the turning animation (freezes when it disappears)
$01:0305#$39Y position of the same Mario tile as above (freezes when it disappears)
$01:0308#$B0X position of a cape tile (freezes when it disappears)
$01:0309#$F0Y position of a cape tile (sets to #$F0 when it disappears)
$01:030C#$60X position of a cape tile that appears when mario is flying (freezes when it disappears)
Those addresses starting with "01" are just OAM Addresses. OAM is a chunk of memory that stores the data about the sprite tiles to draw onto screen.
RNG:
The Random Number Generators (RNGs) change with certain events. We have to change the RNG 1197 times for it to work in our favor. When a koopa spawns, it's called once (when the RNG is "called", it changes). Before going into the pipe in YI3, three koopas appear; this leaves the RNG to be called a remaining 1194 times. This is where the fish come in. When a flopping fish bounces on the floor, it calls the RNG three times. So, that means the fish need to bounce 396 times (to call the RNG 1188 more times). After the fish manipulation, there are exactly six koopas that spawn. After they spawn, the RNGs are set perfectly in order for me to activate the credits.
There are also some OAM addresses that have more than one possible values, they have to have the same bytes of opcode and they also have to not affect the A register.
OAM AddressBytes of OpcodeDescription
$01:02FA2Will be the right value when you shoot a fireball with X
$01:02FE2Will be the right value when you shoot a fireball with Y
$01:03004X position of a koopa shell tile
$01:03023Will be the right value when you pick up a shell
$01:03062Nearly always right
$01:030A2Nearly always right
(actually you can change the bytes of the opcode, only the number of bytes between two required values is important)

Stage by stage comments

Yoshi's Island 2

We can't manipulate the addresses here since they would reset in the overworld.

Yoshi's Island 3

If you jump on a p-switch and then get the "pressed" p-switch in Yoshi's mouth on the right time, you will spawn a fish if you spit out the p-switch fast enough. Also, there can only be eight fishes in the room. After this room, I went back to the Yoshi block. I spawned two Yoshi's by hitting the block with Mario and the p-switch at the same time. I jumped on one Yoshi, got the p-switch in his mouth and let him die, so the second - invisible - Yoshi becomes visible and have a null sprite in his mouth. Then I go right to perform a PI (Powerup Incrementation) so i get a cape, to manipulate some values.

Other comments

Potential Improvements

Maybe the part with the fishes can be improved, since its heavy luck manipulation. Also, maybe there is a faster strategy to get all the right values.

Suggested Screenshots

[dead links removed]

Thanks to

  • Our Skype TASing community, for being able to help each other.
  • あんた (anta), for the discovery of this awesome glitch.
  • p4plus2 and smallhacker, for their awesome work exploring the glitch.
  • DarkMoon and Kaizoman666, for helping me writing this submission text.
  • bahamete, for creating some helpful lua scripts.
  • Mister, for helping me with YI2 :P.

adelikat: Judging

Accepting this movie as a new 'ram corruption' category. See this post for details.

Dacicus: Publication underway


1 2
8 9 10
sgrunt
He/Him
Emulator Coder, Former player
Joined: 10/28/2007
Posts: 1360
Location: The dark horror in the back of your mind
feos wrote:
How about leaving the "Glitched" branch and adding "RAM corription" simply as a category?
According to DarkKobold and adelikat, this is what was intended; it's the reason "Corrupts RAM" now exists as a category.
Post subject: Movie published
TASVideoAgent
They/Them
Moderator
Joined: 8/3/2004
Posts: 15629
Location: 127.0.0.1
This movie has been published. The posts before this message apply to the submission, and posts after this message apply to the published movie. ---- [1945] SNES Super Mario World "game end glitch" by Masterjun in 02:36.40
Editor, Player (69)
Joined: 6/22/2005
Posts: 1050
Current Projects: TAS: Wizards & Warriors III.
Editor, Experienced player (570)
Joined: 11/8/2010
Posts: 4038
I think the new "corrupts memory" category was a good idea. Shouldn't other movies be labeled with that too, like Ocarina of Time any% (RBA)?
darkszero
He/Him
Joined: 7/12/2009
Posts: 181
Location: São Paulo, Brazil
"Corrupts memory" leaves an odd feeling, like "What the hell does that mean?". I say "Manipulates memory" is better, since it's more obvious that the changes to the memory are controlled, and it's rather easy to place movies like [1616] N64 The Legend of Zelda: Ocarina of Time by Bloobiebla in 56:54.20 and [1860] GBC Pokémon: Yellow Version "save glitch" by p4wn3r in 01:09.63.
Joined: 1/13/2007
Posts: 343
I think "reprograms the game" is a more accurate category description for this run. Honestly, nothing is corrupted, and no flags are adjusted. instead, in game actions are used to create ASM code inside RAM, and then this code is jumped to. WHile it's not exactly a buffer overflow, it takes over the game's code like a buffer overflow exploit would. The creation of a glitched category means that the glitches used beat the game much faster than the un-glitched way, but a run without the glitch shows more skill and is more entertaining. There is no separate "glitched" category for mega man and super mario 64 because even though the game is completely broken, the movie is very entertaining.
Active player (436)
Joined: 9/27/2004
Posts: 650
Location: Canada
perhaps "memory is altered to activate a state within the game wherein some portion of the post-victory script of the ending code is accessed in advance of playing portions of the game usually required leading up to and including the typical defeat of the expected final boss" or you know we could be less pedantic for a second
Former player
Joined: 1/17/2006
Posts: 775
Location: Deign
I think we should just rename the category to Inzult.
Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign aqfaq Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign Deign
Joined: 6/26/2011
Posts: 167
I'm in favor of "manipulates memory". The definition of 'corrupts' carries a strong implication of negativity associated with it; when I hear about data being corrupted, it brings more to mind the runs that corrupt save data, such as Pokémon Yellow or Chrono Trigger, which cause very serious damage to the game's structure to accomplish its goals. In contrast, the definition of 'manipulates' carries an implication of skillful alteration, which sounds a lot more TAS-y and more accurate to what's happening in this run.
First a movie gets submitted, and ends up accepted despite breaking rules other runs have been rejected for. And when I vote less than spectacularly on this movie, I become the victim of harassment and threats. Yay, favoritism.
ALAKTORN
He/Him
Former player
Joined: 10/19/2009
Posts: 2527
Location: Italy
Saethori wrote:
I'm in favor of "manipulates memory". The definition of 'corrupts' carries a strong implication of negativity associated with it; when I hear about data being corrupted, it brings more to mind the runs that corrupt save data, such as Pokémon Yellow or Chrono Trigger, which cause very serious damage to the game's structure to accomplish its goals. In contrast, the definition of 'manipulates' carries an implication of skillful alteration, which sounds a lot more TAS-y and more accurate to what's happening in this run.
I agree with you
Editor, Experienced player (570)
Joined: 11/8/2010
Posts: 4038
Now that I think about it, "corrupts memory" probably isn't very accurate. I also agree with darkszero and Saethori.
Brandon
He/Him
Editor, Player (191)
Joined: 11/21/2010
Posts: 914
Location: Tennessee
Why is the published run under the "glitched" category? I thought the ruling was "ram corruption."
All the best, Brandon Evans
Site Admin, Skilled player (1255)
Joined: 4/17/2010
Posts: 11495
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
Brandon wrote:
Why is the published run under the "glitched" category? I thought the ruling was "ram corruption."
See sgrunt's post above.
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Joined: 11/17/2005
Posts: 278
Location: Massachusetts, USA
Saethori wrote:
when I hear about data being corrupted, it brings more to mind the runs that corrupt save data, such as Pokémon Yellow or Chrono Trigger, which cause very serious damage to the game's structure to accomplish its goals.
I think this run seriously damaged SMW's structure, too. There is no glitch in SMW which will show the credits early. There is however a glitch which will let you execute any code which you can point to, and the player used that glitch to set the current game mode to "0x1C - run thank you cutscene". Victory in any game can be measured in terms of RAM. For example, in SMW victory could be defined as "fastest time to a value of $26 in $7E:0100". That gives us a nice quantitative frame number to stop timing on rather than "input end" or "The End". (Although I like movies which creatively end input early!) Authors who submit runs with memory manipulation should probably state their goal this way instead of "reaches the ending" so that obsoletion can be more obvious. (Does this run not reach the ending because there are no fireworks with Peach?) If victory is defined as setting up a specific game state then I think I can explain why this run's category was controversial when this site has many similar runs. type 1 glitches: walking out of bounds in LttP or A Boy and His Blob, the debug menu in Earthbound, and spawning the end-of-level object in SMW and Megaman 1. These moves are in the official game rules. (And are usually patched out in remakes.) type 2 glitches: intentionally corrupting your save file in Chrono Trigger, the sketch glitch in FF6, "take glasses" in Shadowgate, the current Six Golden Coins run, and the bottle glitch in OoT. It's not like there's a glitch in OoT which gives you credit for beating dungeons just by waving your bottles around. The glitch is that RAM can be in-explicitly written to at all. The exact application is up to the player. (And we calculate the result to great effect.) type 3 glitches: manipulating not memory, but the execution of the game. Now you're basically reprogramming the game. Has any other run done this before this one? The reason for a new category, I think, is because this run doesn't feel legit. It doesn't just use glitched game moves to reach the ending. The path to victory that this run chose did not exist when the game was powered on. I like the idea of putting these runs in a separate "corrupts RAM" category. Now the question is do you reclassify every run which uses a "type 2" glitch as corrupts RAM, or is this category reserved for runs which hack the stack? (My two cents - the former.) And runs which are submitted for the "corrupts RAM" category need quantitative goals since the nature of RAM corruption makes lots of game states instantly possible. (Carefully defining goals is important. The current A Boy and His Blob run does not end "at the credits", and I agree with how the author chose to define "the ending" there.)
Joined: 12/31/2009
Posts: 174
Catastrophe wrote:
type 3 glitches: manipulating not memory, but the execution of the game. Now you're basically reprogramming the game. Has any other run done this before this one?
Something about that is making me scratch my head. Manipulating execution sounds a little too vague to me. Glitches happen under specific conditions and causes varying levels of unexpected results. Wouldn't manipulating the game into those specific conditions, regardless if it is as simple as using unexpected input or as difficult as chaining together a ton of other glitches in order to achieve the specific conditions, still fall under manipulating execution? You could try and separate them into manipulating values to change execution results (execution continues as normal but with modified values) and manipulating memory to interrupt normal execution flow (execution ends up running code that shouldn't be ran at that point in time). The real problem isn't the nature of the glitches but is the significance of the end results. Yes, a glitch could cause a large amount of memory corruption and other unexpected results, but that doesn't mean the results are in any way useful. Let's say we instead used this glitch to execute the level completion and continued on. Would you still consider it a "glitched" run? It interrupted normal execution flow but why would it not be a "glitched" run? The answer is that the end result from the glitch would not be significant enough. Trying to categorize the glitches used and their significance in the run isn't something you could create a formula for. Maybe you can but it might be best to do it case by case until then.
Active player (451)
Joined: 3/21/2011
Posts: 127
Location: Virginia (United States)
Catastrophe wrote:
type 3 glitches: manipulating not memory, but the execution of the game. Now you're basically reprogramming the game. Has any other run done this before this one?
No run has done that one, since you can not manipulate ROM in any way, shape, or form (unless you count this glitch, since it causes the game to read RAM as ROM, but that is still manipulating memory).
YouTube Channel - Twitter Current projects: Sutte Hakkun, Hyper VI, RTDL, own hacking projects
Editor, Player (69)
Joined: 6/22/2005
Posts: 1050
He said manipulating game execution, not manipulating the ROM. Personally, I like the idea of calling it
Bisqwit on IRC wrote:
"reaches undeserved ending"
although you could argue that that is not specific enough to what happens in this run.
Current Projects: TAS: Wizards & Warriors III.
Player (13)
Joined: 6/17/2006
Posts: 510
This publication didn't even get a moon? O_o
Editor, Experienced player (570)
Joined: 11/8/2010
Posts: 4038
Looks like it has one now.
Player (13)
Joined: 6/17/2006
Posts: 510
Joined: 4/3/2006
Posts: 269
Wow! I am speechless! mmm... I have to say something for a game that I have spent so many time on. WTF just happened? Voting yes!
Joined: 11/20/2007
Posts: 22
Thrilled about the category decision. I think it's a really neat differentiator that could apply to a lot of runs. About to watch this. Can't wait. :)
Joined: 11/20/2007
Posts: 22
Amazing!
Active player (462)
Joined: 12/24/2010
Posts: 297
Location: CT, USA
I know I'm late to the party but, holy hell that ending was unexpected. I would have never expected a run like this coming from SMW.
Masterjun
He/Him
Site Developer, Expert player (2047)
Joined: 10/12/2010
Posts: 1185
Location: Germany
unoptimized run with this glitch on lsnes: http://tasvideos.org/userfiles/info/946903001545478
Warning: Might glitch to credits I will finish this ACE soon as possible (or will I?)
1 2
8 9 10