(Link to video)
Submission Text Full Submission Page Publication Page

Game objectives

  • Allow Left+Right / Up+Down
  • Emulator used: FCEUX 2.2.2 (Old PPU)
  • Major skip glitch
  • Executes arbitrary code
  • Corrupts memory
  • Genre: RPG
  • Uses a game restart sequence
  • Aims for fastest time
  • Heavily abuses programming errors
  • Manipulates Luck

Usable memory address

  • $00F5 = RNG index
  • $00F6 = RNG index direction, if it is more than 80, it is leftward.
  • $F900-$F9FF = RNG table
  • $F900+($00F5) = RNG
  • $00F7 = The encounter number of times
  • $00F8 = The encounter threshold in UW

Save and Restart

Even if a game is reset, the encounter table is held. 1. You save a game 2. You move it one pixel 3. You reset a game 4. The encounter is skipped When you overwrite a game, the confirmation message is very slow. Because a game is saved before confirmation, it is fast that a game is reset than it closes a menu. It is faster to touch a power supply, but 1/4 time is good at a good balance with the distance to walk.

To Paloom

The route going around the world to the west obtains a canoe and is faster than a route across the river by more than 50 seconds.

Chocobo Forest

Because the power supply was initialized, NPC RNG is not manipulated. On the way, I adjusted it to be able to encounter the Land Turtle.

Takeover of the shuttle ship

When you push the start button just before you enter the paid sailing ship, the autopilot is concluded with a menu screen and becomes able to steer it by yourself. But you can never get into a ship if you got it off in the island.

Deist Cavern

The monster of this place cannot escape. I pushed forward RNG for encounter evasion twice using Potion. Because the encounter number of times is 4, the land turtle appears.

45-floor bug

Outline

Please refer to the post of TaoTao.
This game has room movement of "goto" and "return". 5 bytes are pushed to stack domain by "goto" movement, and it is popped for "return" movement. "goto" movement is repeated between the rooms with complicated divergence of stairs. "goto" movement is restricted by 45 times, but that's insufficient, so when a battle was accomplished, a stack overflow occurs.

Top of the stack and NMI

When Non-Maskable Interrupts (NMI) occurs by this game, $0100 are run. $0100 are the top of the stack domain that is 256 bytes, and ReTurn from Interrupt (RTI) and JMP are written in dynamically here. When the stack is pushed up to $0101-$0102, unjust JMP is carried out at the time of NMI, the game almost freezes, and the save data often disappear, too.

Why were $6785 called?

When the second character attacked the Land Turtle, a stack domain was renewed to $0101 by a recursive Jump SubRoutine (JSR). 
27364 frame
A:FF X:04 Y:08 S:02 P:NvUbdIzc                              $9B4A:20 B6 9B  JSR $9BB6
A:FF X:04 Y:08 S:00 P:NvUbdIzc                                $9BB6:A5 C4     LDA $00C4 = #$FF
NMI occurs in the middle of a calculation, and return address and P-Register are pushed to stack up as "$010F:27 A0 FC".
  • P:nvUbdIZC = 0b00100111 = 0x27 
A:00 X:10 Y:EE S:11 P:nvUbdIZC               $FC9E:85 04     STA $0004 = #$00
A:00 X:10 Y:EE S:0E P:nvUbdIZC                  $0100:4C 4C 9B  JMP $9B4C
A:00 X:10 Y:EE S:0E P:nvUbdIZC                  $9B4C:6A        ROR
NMI jumped to $9B4C, and a Stack-Pointer slipped off when the Program-Counter returned from many subroutines. RTI using 3 bytes at the end of NMI is usually appropriate, but the Program-Counter goes to $A028 because RTS, which in this case only 2 bytes uses, was run. 
27374 frame
A:00 X:03 Y:00 S:0E P:nvUbdIZC                  $9B84:60        RTS -
A:00 X:03 Y:00 S:10 P:nvUbdIZC                $A028:04        NOP (illgal)
A:00 X:03 Y:00 S:10 P:nvUbdIZC                $A02A:66 A9     ROR $00A9 = #$76
A:00 X:03 Y:00 S:10 P:NvUbdIzc                $A02C:15 85     ORA $85,X @ $0088 = #$04
A:04 X:03 Y:00 S:10 P:nvUbdIzc                $A02E:67        RRA $20 (illgal)
A:40 X:03 Y:00 S:10 P:nvUbdIzc                $A030:2F        RLA $A997 (illgal)
A:40 X:03 Y:00 S:10 P:nvUbdIzc                $A033:05 85     ORA $0085 = #$0E
A:4E X:03 Y:00 S:10 P:nvUbdIzc                $A035:66 A9     ROR $00A9 = #$BB
A:4E X:03 Y:00 S:10 P:nvUbdIzC                $A037:69 85     ADC #$85
A:D4 X:03 Y:00 S:10 P:NvUbdIzc                $A039:67        RRA $20  (illgal)
A:F2 X:03 Y:00 S:10 P:NvUbdIzc                $A03B:2F        RLA $A997 (illgal)
A:40 X:03 Y:00 S:10 P:nvUbdIzc                $A03E:06 85     ASL $0085 = #$0E
A:40 X:03 Y:00 S:10 P:nvUbdIzc                $A040:66 A9     ROR $00A9 = #$5D
A:40 X:03 Y:00 S:10 P:nvUbdIzC                $A042:20 85 67  JSR $6785
  • $A041:"A9 20 85 67" is "LDA #$20" and "STA $0067"
  • $A042:"20 85 67" becomes "JSR $6785", because 1 byte slips off than a right program. 
27374 frame
A:40 X:03 Y:00 S:0E P:nvUbdIzC                  $6785:4C 42 64  JMP $6442
A:40 X:03 Y:00 S:0E P:nvUbdIzC                  $6442:CE CF D0  DEC $D0CF = #$85
A:40 X:03 Y:00 S:0E P:NvUbdIzC                  $6445:4C 4D F3  JMP $F34D
It can arrive at the credits by "JMP $F34D", but MMC1, which became unstable because of "RLA $A997", will fail in bank changing. I initialize MMC1 with "DEC $D0CF" to evade it.

The details of the character

SRAM Addresses

Save Data 1
$64400100CECFD04C4DF31400140005000500
Save Data 2
$67000000FFFFFFFFFF951E001E0005000500
$67400100CECFD04C4DF31400140005000500
$67800200D0DAD14C42642800280005000500
$67C00800A2B6A2B6FFFF1E001E0005000500

Meaning of the character name

1st し Five space that were skipped"Shi" is death
2ndオカキびぶレ "O KA KI" is DEC $D0CF "Bi Bu Re" is JMP $F34D
3rdキチクびじぱ "Ki Chi Ku" is without meaning"Bi Ji Pa" is JMP $6442
4thのんのん "No N No N" is without meaning

Nameable Text Table

あいうえお かきくけこ
8A8B8C8D8E 8F90919293
さしすせそ たちつてと
9495969798 999A9B9C9D
なにぬねの はひふへほ
9E9FA0A1A2 A3A4A5A6A7
まみむめも らりるれろ
A8A9AAABAC B0B1B2B3B4
やゆよわん がぎぐげご
ADAEAFB5B6 3C3D3E3F40
ざじずぜぞ だぢづでど
4142434445 464748494A
ぱぴぷぺぽ ばびぶべぼ
6465666768 4B4C4D4E4F
ゃゅょっ ０１２３４
7D7E7F7CFF 8081828384
アイウエオ カキクケコ
CACBCCCDCE CFD0D1D2D3
サシスセソ タチツテト
D4D5D6D7D8 D9DADBDCDD
ナニヌネノ ハヒフヘホ
DEDFE0E1E2 E3E4E5E6E7
マミムメモ ラリルレロ
E8E9EAEBEC F0F1F2F3F4
ヤユヨワン ガギグゲゴ
EDEEEFF5F6 5051525354
ザジズゼゾ ダヂヅデド
5556575859 5A5B5C5D5E
パピプペポ バビブベボ
696A6B6C6D 5F60616263
ャュョッ－ ５６７８９
BDBEBFBCC2 8586878889

Special Thanks

  • cheap: Cheap showed that Deist Cavern was the shortest route.
  • FinalFighter: FinalFighter made the LuaScript which told that a PC passed a specific address.
  • naruko: Naruko taught me code where MMC1 did not freeze. And he also offered various documents.
  • TaoTao: TaoTao made a movie of the 45-floor bug. I was able to discover the jump to SRAM of $6785 by investigating the movie with LuaScript of FinalFighter.
ars4326: (Made some minor grammatical corrections for better readability).
ars4326: Judging underway!
ars4326: Hello, pirohiko. This run was an outstanding technical display of arbitrary code execution (ACE), which, despite a considerable trek through the overworld, provided an entertaining payoff. The included overlay in the encode made the process easier to understand and added to the viewing experience. Thread feedback, also, was mostly enthusiastic and appreciative of the amount of effort put in. Great work on another well-made TAS!
Accepting for publication to Moons!
Guga: Processing...

Show more

Hide
1 2
Posted: 7/21/2015 9:53 PM
Quote
TASVideoAgent
They/Them
Moderator
Joined: 8/3/2004
Posts: 15577
Location: 127.0.0.1
This topic is for the purpose of discussing #4770: pirohiko's NES Final Fantasy II in 07:32.37
Posted: 7/21/2015 10:51 PM
Quote
ars4326
He/Him
Experienced player (777)
Joined: 12/8/2012
Posts: 706
Location: Missouri, USA
I'm pleasantly surprised to finally see a run of NES Final Fantasy II submitted! Despite mostly being a trek through the overworld in order to reach the Deist Cavern, I found the overall payoff entertaining enough to give a 'yes' vote. Outstanding work, Pirohiko! ...so whose up for making a run of FF7? :)
"But as it is written, Eye hath not seen, nor ear heard, neither have entered into the heart of man, the things which God hath prepared for them that love him." - 1 Corinthians 2:9
Posted: 7/21/2015 11:05 PM
Quote
MUGG
Editor, Expert player (2329)
Joined: 5/15/2007
Posts: 3933
Location: Germany
Gameboy TASer of 2015 NES TAS of 2013 Gameboy TASer of 2011 Gameboy TASer of 2010
Awesome pirohiko
Youtube • Livestream • Progress 11th TASer of the Decade 2010-2019 !
Posted: 7/22/2015 12:44 AM
Quote
Zzyzzyxx
Joined: 11/2/2010
Posts: 8
Say what you want about TAS that involve arbitrary codes. Seeing the ending screen popping up from nowhere is always hilarious (I mean, unless a previous TAS of the same game uses an identical method, but slower). Yes vote.
.........
Posted: 7/22/2015 1:11 AM
(Edited: 2/2/2022 2:33 AM)
Quote
£e_Nécroyeur
Skilled player (1672)
Joined: 7/1/2013
Posts: 448
Arcade TASer of 2017 Arcade TAS of 2016 Exotic platforms TASer of 2014 Exotic platforms TAS of 2014
I'm just happy that Josef did not have to die. :)
Posted: 7/22/2015 3:33 AM
Quote
TheAxeMan
Ambassador, Experienced player (709)
Joined: 7/17/2004
Posts: 985
Location: The FLOATING CASTLE
Yay! Finally now that there is a run at this game people will stop asking me to try it. The glitches are pretty well exploited and very well done. Nice.
Posted: 7/22/2015 3:49 AM
Quote
d-feather
He/Him
Joined: 2/12/2015
Posts: 152
Location: Everett, WA
I wasn't expecting arbitrary code execution in Final Fantasy II for the longest time. Weak yes vote since I got somewhat bored before the payoff.
:shrug: I'm more active on Twitter nowadays: @HunterCoates5
Posted: 7/22/2015 5:50 AM
Quote
Synahel
She/Her
Former player
Joined: 1/19/2011
Posts: 260
Location: France
Glad to see that, thanks !
Posted: 7/22/2015 6:19 PM
Quote
Nicos
Joined: 6/4/2009
Posts: 893
great job as always pirohiko , easy YES vote
Posted: 7/22/2015 7:07 PM
Quote
feos
Site Admin, Skilled player (1254)
Joined: 4/17/2010
Posts: 11475
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
NES TAS of 2011
This movie utterly entertained me intellectually by presenting this nice lua script and showcasing the result of great research. So much that what's happening in the run didn't even need to be entertaining. Who cares what happens there visually if we know that yet another game got PWNED?
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Posted: 7/22/2015 11:55 PM
Quote
CoolKirby
Editor, Experienced player (570)
Joined: 11/8/2010
Posts: 4036
Exotic platforms TASer of 2014 NES TAS of 2013
I really liked watching the addresses slowly get flooded with stairs glitch values. You could really see exactly how and when the ACE happened. Thanks for that overlay encode.
Zzyzzyxx wrote:
Say what you want about TAS that involve arbitrary codes. Seeing the ending screen popping up from nowhere is always hilarious
This.
Posted: 7/23/2015 1:42 AM
Quote
Fishaman_P
Joined: 10/1/2013
Posts: 98
Location: My Basement
Would this work on the USA prototype? Would this be doable in real time? Not going to vote, but with just the game display, it was a lot of work for not a lot of entertainment payoff. The memory overlay was very cool, though!
Posted: 7/23/2015 3:39 AM
Quote
Volcanon
Joined: 7/14/2007
Posts: 14
Fishaman P wrote:
Would this work on the USA prototype? Would this be doable in real time? Not going to vote, but with just the game display, it was a lot of work for not a lot of entertainment payoff. The memory overlay was very cool, though!
Could be doable in real time, but Dist is very far into the game and in real time you might not be able to avoid encounters the way he did here. He would have to sae and reload for every tile on the overworld, which is insane. If you played the game normally and Dist is the only place you can do this that would be a 10-20 hour "speedrun". I'm curious how a non glitch speedrun of this game would work considering the levelling system (and the complete lack of "Disk 1 Nukes" except for a trip to Mysidia to buy mid-late game weapons). This game has some infamous difficulty spikes that are manageable in a real playthrough but might be tricky if everybody is always underlevelled. I imagine a full speed run would just be a lot of Mini / Toad spam (Toad at levels 4+ can easily wipe an entire monster encounter). You can one-shot the last boss with a combo of Wall and Toad and a fair chunk of this game is optional especially if you can "commandeer" the ship early. Though might be helpful to check if you can do the leviathan dungeon without Layla in the party. US prototype probably has different text so it wouldn't work.
Posted: 7/23/2015 3:49 AM
Quote
MarioUniverseZone
Other
Joined: 9/22/2014
Posts: 33
Location: New Taipei City, Taiwan
LOL
Posted: 7/23/2015 4:58 AM
Post subject: Re: #4770: pirohiko's NES Final Fantasy II in 07:32.37
Quote
Kingfisher
Joined: 1/9/2011
Posts: 31
TASVideoAgent wrote:
it is fast that a game is reset than it closes a menu. It is faster to touch a power supply,
How soon until someone designs an emulator that can properly handle manipulating the power cord?
Posted: 7/23/2015 5:42 AM
Quote
Tangent
Joined: 3/9/2009
Posts: 530
Volcanon wrote:
If you played the game normally and Dist is the only place you can do this that would be a 10-20 hour "speedrun".
Real time speedruns are in the 4-5 hour range, so you're off. By a lot.
Posted: 7/23/2015 8:16 AM
Quote
Volcanon
Joined: 7/14/2007
Posts: 14
Tangent wrote:
Volcanon wrote:
If you played the game normally and Dist is the only place you can do this that would be a 10-20 hour "speedrun".
Real time speedruns are in the 4-5 hour range, so you're off. By a lot.
Always good to be proven wrong. I can't get it to play. Niconico is always 1000% more frustrating to use than youtube. https://www.youtube.com/watch?v=8t5aO_PbnwQ&list=PL5xRbOCDD11yN-t6M7bRxtCnZvsys1vU4 Tas of the game for 1 hour 44 minutes. I don't quite get what he did to kill the emperor in one hit, something to do with equipping the fire book.
Posted: 7/23/2015 12:21 PM
Quote
TehBerral
Active player (264)
Joined: 8/14/2014
Posts: 188
Location: North Kilttown
I always love ACE TASes, they tend to be extremely detail oriented and this one is no exception. Yes vote.
Somewhat damaged.
Posted: 7/23/2015 7:55 PM
Quote
MikhailP
He/Him
Joined: 6/22/2015
Posts: 14
Location: Cookeville, TN
Yes vote from me.
Posted: 7/24/2015 11:22 PM
Quote
sheela901
Joined: 7/6/2014
Posts: 24
Location: Canada
Final Fantasy games are my favorite! Glad to see another game yet with a weird way to end the game. Voting yes for sure!
Posted: 7/27/2015 3:39 PM
Quote
feos
Site Admin, Skilled player (1254)
Joined: 4/17/2010
Posts: 11475
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
NES TAS of 2011
So what branch? ACE, GEG or (suddenly) blank?
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Posted: 7/27/2015 4:19 PM
Quote
Noxxa
They/Them
Moderator, Expert player (4124)
Joined: 8/14/2009
Posts: 4090
Location: The Netherlands
Exotic platforms TASer of 2018 Exotic platforms TAS of 2018 Exotic platforms TASer of 2017 Exotic platforms TAS of 2017 Exotic platforms TAS of 2017 Exotic platforms TASer of 2016 Exotic platforms TAS of 2016 Gameboy TASer of 2013
There is no published run of this game, so a branch name is not strictly necessary. It could go without.
http://www.youtube.com/Noxxa <dwangoAC> This is a TAS (...). Not suitable for all audiences. May cause undesirable side-effects. May contain emulator abuse. Emulator may be abusive. This product contains glitches known to the state of California to cause egg defects. <Masterjun> I'm just a guy arranging bits in a sequence which could potentially amuse other people looking at these bits <adelikat> In Oregon Trail, I sacrificed my own family to save time. In Star trek, I killed helpless comrades in escape pods to save time. Here, I kill my allies to save time. I think I need help.
Posted: 7/27/2015 4:36 PM
Quote
feos
Site Admin, Skilled player (1254)
Joined: 4/17/2010
Posts: 11475
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
NES TAS of 2011
What will it become when there's another branch?
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Posted: 7/27/2015 4:58 PM
Quote
Guga
He/Him
Joined: 1/17/2012
Posts: 838
Location: Chile
feos wrote:
What will it become when there's another branch?
Then it gets changed...?
Posted: 7/27/2015 5:06 PM
Quote
feos
Site Admin, Skilled player (1254)
Joined: 4/17/2010
Posts: 11475
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
NES TAS of 2011
Guga wrote:
feos wrote:
What will it become when there's another branch?
Then it gets changed...?
Yes, if a run without major skip glitch is published.
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
1 2