This is a completely new type of a Super Mario World run. It beats the game by getting the THE END [dead link removed] screen in the 2nd level (Yoshi's Island 3).
After the discovery of a new glitch by あんた (anta), our Skype TASing community was trying to understand what happened in the .smv. Since he only uploaded the .smv and a japanese documentation, we had to find it out by ourselves.

Game objectives

  • Emulator used: Snes9x 1.43 v17
  • Aims for fastest time
  • Uses game-breaking glitches
  • Heavy luck manipulation
  • Achieves credits early

The "credits glitch"

"spit sprite position = yoshi X position + offset to spit object(index by Y which is the direction) normally, this would store to the sprites X position, however, because the sprite index is #$FF It writes to #$E4 + #$FF which is #$01E3. This is the stack address that is corrupted. If yoshi is facing left he must be at the position #$86, and if he is facing right it should be #$66."
p4plus2's documentation of the "credits glitch" [dead link removed]

Addresses which have to be manipulated

RAM Addressneeded ValueDescription
$7E:148C#$7CRNG 1 | See explanation below
$7E:148D#$92RNG 2
$7E:148E#$F7RNG 3
$7E:00E8#$86X position of sprite #04 (it's Yoshi in this case) (freezes when the sprite disappears, though you shouldn't have him disappear)
OAM Addressneeded ValueDescription
$01:02D4#$26X position of some score numbers onscreen (freezes when it disappears)
$01:02FC#$A3X position of the "smoke" effect (like when a fireball goes into a wall) (freezes when it disappears)
$01:02FD#$F0Y position of the "smoke" effect (same as above) (sets to #$F0 when it disappears)
$01:0304#$81X position of a Mario tile that appears when Mario is on Yoshi and he is in the turning animation (freezes when it disappears)
$01:0305#$39Y position of the same Mario tile as above (freezes when it disappears)
$01:0308#$B0X position of a cape tile (freezes when it disappears)
$01:0309#$F0Y position of a cape tile (sets to #$F0 when it disappears)
$01:030C#$60X position of a cape tile that appears when mario is flying (freezes when it disappears)
Those addresses starting with "01" are just OAM Addresses. OAM is a chunk of memory that stores the data about the sprite tiles to draw onto screen.
RNG:
The Random Number Generators (RNGs) change with certain events. We have to change the RNG 1197 times for it to work in our favor. When a koopa spawns, it's called once (when the RNG is "called", it changes). Before going into the pipe in YI3, three koopas appear; this leaves the RNG to be called a remaining 1194 times. This is where the fish come in. When a flopping fish bounces on the floor, it calls the RNG three times. So, that means the fish need to bounce 396 times (to call the RNG 1188 more times). After the fish manipulation, there are exactly six koopas that spawn. After they spawn, the RNGs are set perfectly in order for me to activate the credits.
There are also some OAM addresses that have more than one possible values, they have to have the same bytes of opcode and they also have to not affect the A register.
OAM AddressBytes of OpcodeDescription
$01:02FA2Will be the right value when you shoot a fireball with X
$01:02FE2Will be the right value when you shoot a fireball with Y
$01:03004X position of a koopa shell tile
$01:03023Will be the right value when you pick up a shell
$01:03062Nearly always right
$01:030A2Nearly always right
(actually you can change the bytes of the opcode, only the number of bytes between two required values is important)

Stage by stage comments

Yoshi's Island 2

We can't manipulate the addresses here since they would reset in the overworld.

Yoshi's Island 3

If you jump on a p-switch and then get the "pressed" p-switch in Yoshi's mouth on the right time, you will spawn a fish if you spit out the p-switch fast enough. Also, there can only be eight fishes in the room. After this room, I went back to the Yoshi block. I spawned two Yoshi's by hitting the block with Mario and the p-switch at the same time. I jumped on one Yoshi, got the p-switch in his mouth and let him die, so the second - invisible - Yoshi becomes visible and have a null sprite in his mouth. Then I go right to perform a PI (Powerup Incrementation) so i get a cape, to manipulate some values.

Other comments

Potential Improvements

Maybe the part with the fishes can be improved, since its heavy luck manipulation. Also, maybe there is a faster strategy to get all the right values.

Suggested Screenshots

[dead links removed]

Thanks to

  • Our Skype TASing community, for being able to help each other.
  • あんた (anta), for the discovery of this awesome glitch.
  • p4plus2 and smallhacker, for their awesome work exploring the glitch.
  • DarkMoon and Kaizoman666, for helping me writing this submission text.
  • bahamete, for creating some helpful lua scripts.
  • Mister, for helping me with YI2 :P.

adelikat: Judging

Accepting this movie as a new 'ram corruption' category. See this post for details.

Dacicus: Publication underway


1 2 3 4 5
9 10
Joined: 6/4/2009
Posts: 570
Location: 33°07'41"S, 160°42'04"W
I... don't even know what to say. One of the most wtf-esque movies ever. Obvious yes vote, as it is now (I like the way it ends). Of course as a separate category, don't redo the mistake of Super Mario Land 2's obsoletion.
Skilled player (1326)
Joined: 9/7/2007
Posts: 1354
Location: U.S.
I'm a little skeptical to vote on this because it looks like this glitch is caused by inaccurate emulation. I'll vote once there is more concrete evidence that this is a legitimate glitch.
Active player (428)
Joined: 9/7/2007
Posts: 329
This video is so awesome! It is nice so see how the video ends so sudd...THE END
Editor, Skilled player (1536)
Joined: 7/9/2010
Posts: 1319
wow just awesome. Another game broken. YES VOTE
Favorite animal: STOCK Gt(ROSA)26Sortm1.1(rtTA,EGFP)Nagy Grm7Tg(SMN2)89Ahmb Smn1tm1Msd Tg(SMN2*delta7)4299Ahmb Tg(tetO-SMN2,-luc)#aAhmb/J YouTube Twitch
Joined: 12/29/2011
Posts: 13
Sonikkustar wrote:
I'm a little skeptical to vote on this because it looks like this glitch is caused by inaccurate emulation. I'll vote once there is more concrete evidence that this is a legitimate glitch.
While I was unable to fully replicate the glitch on console, I have been able to test each component and it IS possible in theory on console. Additionally, having debugged this glitch and seeing the ASM involved, there is no reason why this would be from inaccurate emulation. If you actually read the technical document that Masterjun included, you would know this glitch works by changing the game mode (RAM address $0100) by manipulating the stack, RNG, and OAM mirrors. I can confirm with an extremely high degree of certainty this is not an emulator specific glitch.
Skilled player (1326)
Joined: 9/7/2007
Posts: 1354
Location: U.S.
Thanks for the clarification p4plus2. I havent been on the site in a long time, so I didnt know that he posted some relative info. With that said, Im voting Yes. This run seems to utilize a different glitch than the other SMW run in the bench right now. Because of this, I dont believe they can be directly comparable to each other.
Joined: 12/22/2011
Posts: 2
Location: Lille (FRANCE)
...Wow.
Joined: 12/1/2007
Posts: 43
Location: Bogotá, Colombia
I love these runs where games get completely annihilated. There should be a special category for them.
When human lurking is not enough
Player (150)
Joined: 11/27/2004
Posts: 688
Location: WA State, USA
I showed this to one of my brothers and he thought it was a hoax. Mission accomplished.
Nach wrote:
I also used to wake up every morning, open my curtains, and see the twin towers. And then one day, wasn't able to anymore, I'll never forget that.
Editor, Expert player (2330)
Joined: 5/15/2007
Posts: 3933
Location: Germany
how's snesbot coming along anyway?
Skilled player (1652)
Joined: 11/15/2004
Posts: 2202
Location: Killjoy
MUGG wrote:
how's snesbot coming along anyway?
I have a circuit board made, and zero time to parts-shop/solder.
Sage advice from a friend of Jim: So put your tinfoil hat back in the closet, open your eyes to the truth, and realize that the government is in fact causing austismal cancer with it's 9/11 fluoride vaccinations of your water supply.
Joined: 4/5/2011
Posts: 4
Location: USA
p4plus2 wrote:
While I was unable to fully replicate the glitch on console, I have been able to test each component and it IS possible in theory on console. Additionally, having debugged this glitch and seeing the ASM involved, there is no reason why this would be from inaccurate emulation. If you actually read the technical document that Masterjun included, you would know this glitch works by changing the game mode (RAM address $0100) by manipulating the stack, RNG, and OAM mirrors. I can confirm with an extremely high degree of certainty this is not an emulator specific glitch.
Even if this isn't an emulation glitch, what are the chances it would happen on an actual console if you provided the same input? It seems like runs that heavily abuse the RNG and the contents of RAM would be impossible to replicate when you can't see the RAM...
Joined: 12/22/2009
Posts: 291
Location: Michigan
BobbyTables wrote:
Even if this isn't an emulation glitch, what are the chances it would happen on an actual console if you provided the same input?
99%
BobbyTables wrote:
It seems like runs that heavily abuse the RNG and the contents of RAM would be impossible to replicate when you can't see the RAM...
It's nigh impossible to replicate toolless anyway, so it doesn't really matter.
Current projects: Yoshi's Island Disassembly Yoshi's Island any% TAS with Carl Sagan
Joined: 12/29/2011
Posts: 13
The RNG is reset every time you enter a level. This is in order to help keep objects which use the RNG consistent each time the level is entered. Because the SMW RNG doesn't use user input or any other variable source as entropy, it will always take the same number of iterations to get a desired result. However, being off by a single frame WILL cause it to fail. This glitch is very sensitive, but not impossible. The contents of RAM is extremely hard, but not impossible as well. Especially if there were a bot involved. In theory the same input will result in the same RAM values. The only exception would be uninitialized RAM which this glitch does not use. If this is attempted on console, there are a million ways to go wrong and only a few hundred to get it right at best.
Joined: 2/20/2010
Posts: 209
Location: I'm in space
WTF * Click youtube "Play" * Mario beats a level * Mario goes in a pipe * A bunch of fish appear (?) * ??? something * ????????????? * The End * Vote "yes"
Oh, play it cool. Play it cool. Here come the space cops.
Brandon
He/Him
Editor, Player (191)
Joined: 11/21/2010
Posts: 914
Location: Tennessee
Yes vote. Just wow.
All the best, Brandon Evans
Site Admin, Skilled player (1254)
Joined: 4/17/2010
Posts: 11479
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
p4plus2 wrote:
The RNG is reset every time you enter a level. This is in order to help keep objects which use the RNG consistent each time the level is entered. Because the SMW RNG doesn't use user input or any other variable source as entropy, it will always take the same number of iterations to get a desired result. However, being off by a single frame WILL cause it to fail. This glitch is very sensitive, but not impossible. The contents of RAM is extremely hard, but not impossible as well. Especially if there were a bot involved. In theory the same input will result in the same RAM values. The only exception would be uninitialized RAM which this glitch does not use. If this is attempted on console, there are a million ways to go wrong and only a few hundred to get it right at best.
When FinalFighter discovered his Rockman's glitch (DelayStageClear), he made a hack that allowed to test this glitch with higher possibility, and it was tested on console via Power Pak. Is it possible to invent something like that to check the possibility itslef on console? http://tasvideos.org/forum/viewtopic.php?p=228835#228835
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Joined: 12/29/2011
Posts: 13
feos wrote:
When FinalFighter discovered his Rockman's glitch (DelayStageClear), he made a hack that allowed to test this glitch with higher possibility, and it was tested on console via Power Pak. Is it possible to invent something like that to check the possibility itslef on console? http://tasvideos.org/forum/viewtopic.php?p=228835#228835
Given the RAM used, it would be tricky, but doable. You would need to override OAM and the RNG in order to give a reasonable shot of doing this on console. Even doing that, this glitch depends on you being at an exact position on the screen which doesn't help. If you take a look at the document I made about this glitch, you can see why it WILL work on console. If this didn't work on console, we are doing something fundamentally wrong in emulation as most of the opcodes involved are basic and nothing involving SNES registers. So to recap: 1) Override OAM 2) Override the RNG 3) Hope you get the exact position on brown platform 4) Make sure yoshi has a null sprite If you do all of that you could feasibly do this on console easier. Get one part wrong, and you will probably just crash the game. The reason this glitch requires brown platforms(which I never explained in the document) is because the brown platforms preform some tricks to hide mario then recall the his display and handling routines. They do this to avoid the "jitter" effect which would have happened trying to snap mario to a single location. You can find a brown platform disassembly here: http://99.10.160.182/evil.asm I never finished commenting it, but the important part is the call to JSL $00E2BD before the storing of #$FF to $78(that JSL is called in the RTS just before the storing of #$FF). This all happens at CODE_01CA6E. If you really want to try and make a hack I will see if I can toss something together. But as I said, I have already tested pieces of this on an SNES and conceptually it all works. Its just a matter of getting all components perfect which I could never do on console. EDIT: Here is a link to my document so you don't have to go to the first post, http://99.10.160.182/glitch.asm
Site Admin, Skilled player (1254)
Joined: 4/17/2010
Posts: 11479
Location: Lake Char­gogg­a­gogg­man­chaugg­a­gogg­chau­bun­a­gung­a­maugg
I can't hack a game, but one can add Mario's position to the heads up display, so that the tester would see if he is in correct place.
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Joined: 12/22/2009
Posts: 291
Location: Michigan
feos wrote:
I can't hack a game, but one can add Mario's position to the heads up display, so that the tester would see if he is in correct place.
It's pixel and frame perfect, not to mention direction perfect. I don't think that would be of use, since the timing is "do it on this frame at this position, or the game crashes".
Current projects: Yoshi's Island Disassembly Yoshi's Island any% TAS with Carl Sagan
Joined: 12/29/2011
Posts: 13
feos wrote:
I can't hack a game, but one can add Mario's position to the heads up display, so that the tester would see if he is in correct place.
If you can see the position, the correct position that means you can no longer do the glitch already. That means you have to precalculate the speed and know how fast you are going then hope you are fast enough to spit on the exact frame required. It is possible, just extraordinarily hard.
Joined: 12/22/2009
Posts: 291
Location: Michigan
p4plus2 wrote:
feos wrote:
I can't hack a game, but one can add Mario's position to the heads up display, so that the tester would see if he is in correct place.
If you can see the position, the correct position that means you can no longer do the glitch already. That means you have to precalculate the speed and know how fast you are going then hope you are fast enough to spit on the exact frame required. It is possible, just extraordinarily hard.
To translate: the SNES has input delay. If you were to see the position on-screen and spit it out on that frame, it would actually be spit a couple frames later. You'd have to spit it a few frames earlier to time it right, but that's really hard because that also involves knowing how fast you are moving, which isn't the easiest thing to manipulate in real time.
Current projects: Yoshi's Island Disassembly Yoshi's Island any% TAS with Carl Sagan
Joined: 7/31/2005
Posts: 128
Location: Virginia
Wtf, well that was fast! Yes vote.
Working on a mod of an old favorite in my spare time. PM for updates!
Senior Moderator
Joined: 8/4/2005
Posts: 5777
Location: Away
This was weird. The result is interesting, but I can't say I was entertained by the process of achieving it.
Warp wrote:
Edit: I think I understand now: It's my avatar, isn't it? It makes me look angry.
Player (121)
Joined: 2/11/2007
Posts: 1522
just as input from non forum geeks, this got linked to me by a friend who did not know i was into tasing before i saw it here. her words: "so rad. so very rad." impressive movie, i agree.
I make a comic with no image files and you should read it. While there is a lower class, I am in it, and while there is a criminal element I am of it, and while there is a soul in prison, I am not free. -Eugene Debs
1 2 3 4 5
9 10