Player (41)
Joined: 1/22/2014
Posts: 38
Location: Sweden
Cpadolf wrote:
Think I got it now. Don't know if TASvideos will actually accept it but it should be ready to be submitted once the ending has been triggered. I think amaurea and total should be co authors for developing and executing the method to get control over the game and triggering the ending considering how big of a part it is to the run.
Yes, this was great, amazing work with this run! I had to add two extra frames of inputs to make sure Samus wasn't traveling upwards when the shot is fired, and then five more frames for the inputs for triggering the ending. Normally it should have been three frames only for those inputs, but for some reason the game decided to only run the code that updates beams every other frame this time, so I had to insert two blank frames. Here's the final lsnes movie file: http://tas.speedga.me/Super%20Metroid%20Glitch%25.lsmv I couldn't find a way to modify the rerecord count though, so for now it will show only 1 rerecord.
Emulator Coder, Skilled player (1112)
Joined: 5/1/2010
Posts: 1217
total wrote:
I couldn't find a way to modify the rerecord count though, so for now it will show only 1 rerecord.
What the rerecord count should be? It is bit nasty to modify but doable...
Skilled player (1443)
Joined: 7/15/2007
Posts: 1468
Location: Sweden
It was at 40430 when I uploaded it. Thanks for the great work total!
Agare Bagare Kopparslagare
Joined: 6/7/2008
Posts: 11
Great work you guys! Youtube Encode
Joined: 10/30/2011
Posts: 146
Location: Auckland, New Zealand
OMG great work guys, I really enjoyed all these new total control TASes being made recently. It's the uppermost level of awesomeness for me to watch =D
Patashu
He/Him
Joined: 10/2/2005
Posts: 4042
Submission soon? :D
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Joined: 7/2/2007
Posts: 3960
Part of me wants to see this and the SMB3 run get submitted at the same time. :) Nice work, everyone!
Pyrel - an open-source rewrite of the Angband roguelike game in Python.
Patashu
He/Him
Joined: 10/2/2005
Posts: 4042
Derakon wrote:
Part of me wants to see this and the SMB3 run get submitted at the same time. :) Nice work, everyone!
I want them to also be submitted simultaneous with the Super Monkey Ball 1 & 2 runs so everyone's minds can just explode at once. Ka-POW.
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Skilled player (1443)
Joined: 7/15/2007
Posts: 1468
Location: Sweden
Patashu wrote:
Submission soon? :D
Later today probably!
Agare Bagare Kopparslagare
Site Admin, Skilled player (1250)
Joined: 4/17/2010
Posts: 11469
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
feos 2014-02-10 wrote:
Let's say for Super Metroid someone makes a run that brings the game to end without X-Ray use, and without all the usual sequence of running through rooms and getting into the ship. And it would be awesome and people like it separately, and want to leave X-Ray run published.
1 month 10 days later... You guys are fast!
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Patashu
He/Him
Joined: 10/2/2005
Posts: 4042
W E L P http://www.twitch.tv/tewtal/c/3971198 Thanks to Total, x-ray OoB and space/time beam are now equally strong glitches. This makes low% glitched 1 % lower and might lead to an improvement for any% glitched no GT code (I also think this officially makes x-ray OoB a 'memory corruption' glitch, so 'any% no memory corruption' succintly bans both and so on)
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Joined: 7/2/2007
Posts: 3960
Okay, that's interesting. How does it work? Go OOB, navigate blindly to the room behind Mother Brain's room, use the X-Ray scope to reset your position, walk to ship, fly away?
Pyrel - an open-source rewrite of the Angband roguelike game in Python.
Patashu
He/Him
Joined: 10/2/2005
Posts: 4042
I think it is literally memory corruption, you go so far out of bounds that you are 'in' the game's RAM (ala dawn of sorrow, super mario land 2, etc)
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Player (41)
Joined: 1/22/2014
Posts: 38
Location: Sweden
I should add that this glitch using X-Ray OOB is something Kejardon found 9 years ago that someone mentioned to me and I did some research on. I haven't done any debugging or anything yet on this but the effects of it is that when you go down a few screens OOB, X-Ray will start overflowing memory and start overwriting all kinds of thing in RAM. The amount overwritten seems to be affected by the Y-position, so the further down you go, the more gets overwritten. There's some other quirks as well that needs to be researched with it, like it will write different patterns depending on which way to X-ray. Also holding up for a while will also affect the data it writes.
Skilled player (1443)
Joined: 7/15/2007
Posts: 1468
Location: Sweden
Patashu wrote:
W E L P http://www.twitch.tv/tewtal/c/3971198 Thanks to Total, x-ray OoB and space/time beam are now equally strong glitches. This makes low% glitched 1 % lower and might lead to an improvement for any% glitched no GT code
How does it make glitched low% lower than it is if you still need X-ray, maybe you mean for regular speedrunners? Anyway, really cool glitch. I wonder if there's another spot you can get off screen far enough quickly.
Agare Bagare Kopparslagare
Former player
Joined: 2/19/2007
Posts: 424
Location: UK
Wow, fantastic Total! PJBoy and I were discussing whether OOB could be sufficient to jump to the ending, or even execute arbitrary code, but the route we thought of was to try to exploit glitched door transitions, and the whole setup seemed pretty unlikely. The X-ray method seems really promising! Edit: I looked at what happens when using the X-ray OOB:
$91/C505 08          PHP
$91/C506 C2 30       REP #$30
$91/C508 A5 18       LDA $18
$91/C50A 3A          DEC A
$91/C50B 0A          ASL A
$91/C50C A8          TAY
$91/C50D A5 12       LDA $12
$91/C50F C9 40 00    CMP #$0040
$91/C512 D0 07       BNE $07    [$C51B] down
$91/C514 A9 00 FF    LDA #$FF00
$91/C517 97 00       STA [$00],y
$91/C519 80 05       BRA $05    [$C520] down
$91/C51B A9 00 FF    LDA #$FF00
$91/C51E 97 00       STA [$00],y
$91/C520 88          DEY
$91/C521 88          DEY
$91/C522 B7 00       LDA [$00],y
$91/C524 C9 FF 00    CMP #$00FF
$91/C527 F0 09       BEQ $09    [$C532] down
$91/C529 A9 FF 00    LDA #$00FF
$91/C52C 97 00       STA [$00],y
$91/C52E 88          DEY
$91/C52F 88          DEY
$91/C530 10 F0       BPL $F0    [$C522] up
$91/C532 A5 18       LDA $18
$91/C534 0A          ASL A
$91/C535 A8          TAY
$91/C536 B7 00       LDA [$00],y
$91/C538 C9 FF 00    CMP #$00FF
$91/C53B F0 0C       BEQ $0C    [$C549] down
$91/C53D A9 FF 00    LDA #$00FF
$91/C540 97 00       STA [$00],y
$91/C542 C8          INY
$91/C543 C8          INY
$91/C544 C0 CC 01    CPY #$01CC
$91/C547 30 ED       BMI $ED    [$C536] up
$91/C549 28          PLP
$91/C54A 60          RTS
At this point, $0 = 7e9800 = base and $18 = samusY-screenY-10 = yoff, so this should be equivalent to the pseudo-code
y=(yoff-1)<<1
base[y]=ff00
for(y -= 2;      base[y] != 00ff; y-=2) { base[y]=00ff; if(y<0)    break; }
for(y  = yoff<<1; base[y] != 00ff; y+=2) { base[y]=00ff; if(y>=1cc) break; }
Assuming no 00ff values are encountered, this will overwrite [base+(yoff-1)<<1:base] backwards and [base+yoff<<1:base+1cc] forwards. We cannot affect anything below base, I.e. below 7e9800. But there are some interesting things above there, such as the event bit array, which is what total used. We are very limited as to which values will be written. It's either 00ff or ff00, but that is enough to set any event bit we want. On the other hand, this leaves very little potential for arbitrary code execution: It's hard to do anything useful with only ff00 or 00ff.
Skilled player (1443)
Joined: 7/15/2007
Posts: 1468
Location: Sweden
amaurea wrote:
On the other hand, this leaves very little potential for arbitrary code execution: It's hard to do anything useful with only ff00 or 00ff.
Well if it turns out to be possible to use this to beat the recent ACE run for speed it would still be possible to find something cool to do with that run as a starting point so as to not let all the work to make ACE possible (and also getting there) go to waste over a run that would unfortunately (great discovery aside) probably be a lot less interesting to watch.
Agare Bagare Kopparslagare
Player (41)
Joined: 1/22/2014
Posts: 38
Location: Sweden
There might be some hope for this for arbitrary code execution actually. I found yesterday that if you hold up to X-Ray up, it will start shifting in bytes that's certainly not 00FF or FF00. They seem to be the same every time so it could be data from ROM but I'm not sure, it was late so didn't have time to research much more. I did manage to use it to trigger something funny though. By standing at the exactly right pixel I got it to set both the escape sequence trigger and also reset the gamestate so when loading a save the intro plays. http://www.twitch.tv/tewtal/c/3980860 Doing this will also delete your missiles and make your item percent one percent lower, so doing this would result in 5% if you do it with 6% :)
Skilled player (1443)
Joined: 7/15/2007
Posts: 1468
Location: Sweden
Getting back to the intro after saving has been a known side effect of resetting the game state for a long time afaik, but having the escape sequence being triggered already when you land is just brilliant :P As well as doing any of that without the glitched beams of course. I'm unsure if it should be considered to be lower than 6%, considering that you still collect 6 items and if you go purely by the percentage that the game shows you could have it be 0% with ACE.
Agare Bagare Kopparslagare
Former player
Joined: 2/19/2007
Posts: 424
Location: UK
I'm currently investigating the Yapping Maw shinespark glitch: Link to video It crashes the game, and as we all know, crashes often lead to arbitrary code execution, and this glitch only depends on the speed booster (and a yapping maw). Tracking down the full mechanism of this glitch is complicated, but a rough sketch is that $a60 contains a pointer to code to run depending on Samus' pose. When moving normally it has the value e913, but while shinesparking it has the value e90e. When yapping maws releases Samus, it sets this value to e913 (moving normally) even if she is shinesparking. This messes up the handling of the speed echoes that are supposed to circle around Samus when she hits a wall. A mirror of Samus' pose in $a28 is supposed to contain ffff when she stops sparking, but due to this error, it contains her actual pose, which further down the line causes ffff to be written to $aae. Which finally leads to this:
90d346 lda #$000f             A:ffff X:0080 Y:0004 S:1ff4 D:0000 DB:90 NvmxdizC V: 56
90d349 sta $0a68     [900a68] A:000f X:0080 Y:0004 S:1ff4 D:0000 DB:90 nvmxdizC V: 56
90d34c lda $0aaf     [900aaf] A:000f X:0080 Y:0004 S:1ff4 D:0000 DB:90 nvmxdizC V: 56
90d34f and #$00ff             A:90ff X:0080 Y:0004 S:1ff4 D:0000 DB:90 NvmxdizC V: 56
90d352 asl a                  A:00ff X:0080 Y:0004 S:1ff4 D:0000 DB:90 nvmxdizC V: 56
90d353 tax                    A:01fe X:0080 Y:0004 S:1ff4 D:0000 DB:90 nvmxdizc V: 56
Things are sensible up to this point, where we perform the jump
 jsr *$d37d[($aaf&ff)<<1].
We jump far into a region of the rom which is filled with ffffffff, which we execute
until we wrap around into RAM. $d37d is ROM, so what's going wrong must be
$aaf, which is documented as an index used for shinespark echoes.
This value is ff here, but is not set in this file. Should compare with normal shinespark
90d354 jsr ($d37d,x) [90d57b] A:01fe X:01fe Y:0004 S:1ff4 D:0000 DB:90 nvmxdizc V: 56
90fead sbc $ffffff,x [0001fd] A:01fe X:01fe Y:0004 S:1ff2 D:0000 DB:90 nvmxdizc V: 56
...
90fffd sbc $d3ffff,x [d401fd] A:01fd X:01fe Y:0004 S:1ff2 D:0000 DB:90 nvmxdizC V: 59
900001 sta $0000,x   [9001fe] A:01fd X:01fe Y:0004 S:1ff2 D:0000 DB:90 nvmxdizC V: 59
900002 brk #$00               A:01fd X:01fe Y:0004 S:1ff1 D:0000 DB:90 nvmxdizC V: 59
900003 brk #$04               A:01fd X:01fe Y:0004 S:1ff0 D:0000 DB:90 nvmxdizC V: 59
900004 tsb $b5       [0000b5] A:01fd X:01fe Y:0004 S:1ff1 D:0000 DB:90 NvmxdizC V: 59
900006 bra $ff88     [8fff88] A:01fd X:01fe Y:0004 S:1ff1 D:0000 DB:90 NvmxdizC V: 59
900009 brk #$98               A:cc1b X:01fe Y:0004 S:1ff1 D:0000 DB:90 NvmxdizC V: 59
90000c brk #$53               A:001b X:01fe Y:0004 S:1ff1 D:0000 DB:90 nvmxdizC V: 59
90000d eor ($00,s),y [909094] A:0036 X:01fe Y:0004 S:1ff1 D:0000 DB:90 nvmxdizc V: 59
90000e brk #$27               A:0036 X:0036 Y:0004 S:1ff1 D:0000 DB:90 nvmxdizc V: 59
We enter oam here, and survive for a surprising amount of time
9004a9 beq $04ab     [9004ab] A:0036 X:0036 Y:0004 S:1fef D:0000 DB:90 nvmxdizc V: 59
...
Ok, this brk is real. The others must be fake somehow. Amazingly, we get all
the way to 4f1 here, which is in oam I believe. So with lots of luck, one could
manipulate oam to jump somewhere better.
9004f1 brk #$0e               A:9dd3 X:0037 Y:007e S:1ff7 D:0000 DB:90 NvmXdizC V: 60
008573 jml $808573   [808573] A:9dd3 X:0037 Y:007e S:1ff3 D:0000 DB:90 NvmXdIzC V: 60
The upshot of all this is that the Yapping Maw shinespark glitch ends up executing RAM as code, and while we have less control than with the charged space-time beam, it makes it into the powerful but tricky OAM region of memory, which is the same one I used for my original game-ending demonstration video. So I think this is pretty pomising, and certainly worth more investigation. If it could be made to work, one could make a TAS that makes a beeline for the speed booster, and then heads for the closest yapping maw. Edit: Total and I have investigated this now. It seems like snes9x does not emulate this correctly. In lsnes it seems like this inevitably leads to a BRK soon after it starts executing RAM. Too bad. Edit2: It seems like the lava/sand shinespark crash is practically the same as the yapping maw glitch, including the same wrap-around to RAM, and the same method of avoidting the glitch (holding a button). So that's another promising method that didn't work out. Though, the current approach is already fully workable, we just hoped one could go faster.
AzumaK
He/Him
Joined: 5/5/2011
Posts: 42
The progress you guys are making is simply mind-numbing. DEER FORCE tier!
Currently obsessed with: Mega Man 2 hacks, SFA3, Super Metroid Zero Mission, MM8BDM (Skulltag MegaMan mod, it's amazing!)
P.JBoy
Any
Editor
Joined: 3/25/2006
Posts: 850
Location: stuck in Pandora's box HELLPP!!!
How did you get that $91C505 routine to execute? Some reverse engineering tells me that routine can only be executed by the Eye enemy (the thing that shines light at you after getting morph ball), and even then, I'm not sure if it's ever executed under normal circumstances
Site Admin, Skilled player (1250)
Joined: 4/17/2010
Posts: 11469
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
Looks like lsnes really needs some symbolic debugging/tracing.
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Former player
Joined: 2/19/2007
Posts: 424
Location: UK
PJBoy: It jumps there from $91beb2. I just used x-ray quite normally (while being oob). The code leading there did not seem particularly glitchy. That eye enemy uses a similar effect to the x-ray scope, so it wouldn't be odd for them to share some could, would it? Here is <a>a trace</a> of the execution leading up to it. It starts from just after we return from interrupt, which released the code from a long waiting cycle.
Joined: 11/16/2009
Posts: 68
Looks like this route might make for a faster x-ray glitch route, and less boring, too: http://www.twitch.tv/twocat/c/3988333 Also it's a 5% completion of the game.