Tool-assisted game movies
When human skills are just not enough

Submission #6603: Jigwally's NES Romance of the Three Kingdoms II "save glitch" in 05:46.15

Console: Nintendo Entertainment System
Game name: Romance of the Three Kingdoms II
Game version: USA
ROM filename: Romance of The Three Kingdoms II (U) [!].nes
Branch: save glitch
Emulator: BizHawk 2.3.2
Movie length: 05:46.15
FrameCount: 20803
Re-record count: 29755
Author's real name: Basil Gruber
Author's nickname: Jigwally
Submitter: Jigwally
Submitted at: 2020-01-22 05:56:35
Text last edited at: 2020-01-31 06:33:35
Text last edited by: Jigwally
Download: Download (5449 bytes)
Status: decision: cancelled
Submission instructions
Discuss this submission (also rating / voting)
List all submissions by this submitter
List pages on this site that refer to this submission
View submission text history
Back to the submission list
Author's comments and explanations:

I guess I've now made it a goal to achieve a save glitch win in as many Koei games as possible.

I use the same basic method in my L'Empereur TAS of a mid-frame reset to create a general pointing to controller input. However unlike L'Empereur, there is no single RAM address I can write to in order to trigger the ending. Instead, I perform rudimentary arbitrary code execution to jump to the ending by writing code to RAM.

I went through trial and error of different methods of writing the code I need to the zero page but the method I came up with ended up being really simple. Like my last TAS, you instantiate entries in the general list by holding down the appropriate button combinations. Appointing a general as governor places them at the start of the linked general list. In order to write a specific value to the zero page, first you make a general w/ that value, appoint them General, then create a general representing the address and appoint them. This causes the previous general to be written to that address. There are some caveats:

By writing 0x6EA4 to 0x1F and 0x63DD to 0x22 I get the following code (in the Koei VM bytecode):

Now in order to actually run this code I need to clear the program counter for the virtual machine (0x06) so that the game starts executing values in the zero page. To do so I simplify instantiate an officer @ 0x06 and then dismiss them, which causes zero to be written to it (removal from linked list). The game then starts executing the "code" starting at 0x00, and eventually comes to the code we've written. At this point, by holding down the button combo for the ending function (0xE037), it gets called.

NOTE: The game uses the name of the ruler of Province 1 as the winning ruler, since normally the game ending is only triggered when all provinces have a singular ruler. The name is glitched because Province 1 is unoccupied so it does a name lookup on an invalid ID.

Future improvements are possible, there might exist a way to have sufficient code in the zero page to leverage the ending skip using only a single memory write in combination with values that are already there.

In addition to this rudimentary ACE I've also written a full ACE bootstrap for a potential total-control TAS. The setup for it was around 10 minutes but using this new method I should be able to shave that down considerably. A simple demonstration of using it to draw custom graphics: https://www.youtube.com/watch?v=EKCj2jXPqIU

Temporary encode:

(Link to video)

Similar submissions (by title and categories where applicable):