Tool-assisted game movies
When human skills are just not enough

Submission #6354: filpAM's GB Super Mario Land "arbitrary code execution" in 00:10.08

Console: Game Boy
Game name: Super Mario Land
Game version: any v1.0
ROM filename: Super Mario Land (W) (V1.0) [!].gb
Branch: arbitrary code execution
Emulator: lsnes (gamebatte svn537)
Movie length: 00:10.08
FrameCount: 602
Re-record count: 13
Author's real name: Filipe A. Paulino
Author's nickname: filpAM
Submitter: filpAM
Submitted at: 2019-04-01 15:57:40
Text last edited at: 2019-06-12 12:57:08
Text last edited by: ThunderAxe31
Download: Download (1110 bytes)
Status: decision: rejected
Submission instructions
Discuss this submission (also rating / voting)
List all submissions by this submitter
List pages on this site that refer to this submission
View submission text history
Back to the submission list
Author's comments and explanations:
Here I beat super mario land through the most unusual ways possible known in TASscene, I use ACE by means of precise frame inputs to corrupt and execute data in RAM and skip immediately to the end, or better yet, directly to the game title screen. Fuck the mushroom kingdom, Daisy and the cake. Everything is a lie.

(Link to video)

Game objectives

  • Emulator used: lsnes (this is a custom linux build but will most likely sync on the lastest lsnes version for download).

  • Aims for fastest completion through arbitrary code execution.

  • Break the laws of the universe and existence.

  • Daisy is a thot(Bowsette is better ;) ).

  • Make Mario realize he is just a Brooklyn plumber and that everything that happened until now was nothing but an acid trip.



To put it simply, excluding all the quantum physics math, theorems and laws, I use from the very beginning my frame inputs to manipulate the data which is written on the RAM, no input is wasted. The game normally executes code in the RAM starting at position 0xffb6, this is called everytime by the vblank interrupt routine, here I inject code on that region to jump directly to the function which triggers the end game-


Well, the "end game" function actually checks for the value of address 0xc101, and this determines whether the cutscene will be played or not. However that address is unreachable so the "end game" cutscene is skipped.

Other comments

PS: Subscribe to my channel and follow me on twitter.

Everything was my original research.

Masterjun: Thanks to my superhuman ability to see through shenangians, granted to me by countless decades of judging submissions, I have found that this run merely presses A+B+Start+Select, resetting the game.


Similar submissions (by title and categories where applicable):