Tool-assisted game movies
When human skills are just not enough

Submission #6612: Jigwally's NES Romance of the Three Kingdoms II "save glitch" in 02:33.0

Console: Nintendo Entertainment System
Game name: Romance of the Three Kingdoms II
Game version: USA
ROM filename: Romance of The Three Kingdoms II (U) [!].nes
Branch: save glitch
Emulator: BizHawk 2.4
Movie length: 02:33.0
FrameCount: 9195
Re-record count: (unknown)
Author's real name: Basil Gruber
Author's nickname: Jigwally
Submitter: Jigwally
Submitted at: 2020-01-31 16:02:38
Text last edited at: 2020-03-17 14:24:57
Text last edited by: feos
Download: Download (4718 bytes)
Status: published
Click to view the actual publication
Submission instructions
Discuss this submission (also rating / voting)
List all submissions by this submitter
List pages on this site that refer to this submission
View submission text history
Back to the submission list
Author's comments and explanations:

I'm resubmitting this now that I have a significantly faster, more elegant route to arbitrary code.

I guess I've now made it a goal to achieve a save glitch win in as many Koei games as possible.

I use the same basic method in my L'Empereur TAS of a mid-frame reset to create a general pointing to controller input. However unlike L'Empereur, there is no single RAM address I can write to in order to trigger the ending. Instead, I perform rudimentary arbitrary code execution to jump to the ending by writing code to RAM.

I went through trial and error of different methods of writing the code I need to the zero page but the method I came up with ended up being really simple. Like my last TAS, you instantiate entries in the general list by holding down the appropriate button combinations. Appointing a general as governor places them at the start of the linked general list. In order to write a specific value to the zero page, first you make a general w/ that value, appoint them General, then create a general representing the address and appoint them. This causes the previous general to be written to that address. There are some caveats:

I reduced the number of actions I need to perform by having the controller input at $6E/$6F be part of the arbitrary code to be run. This new method only require me to appoint 3 glitch generals:

After selecting this general, I switch my input to $E037. When the $0006 is appointed governor, it is overwritten with the previous governor ($006D). $0006 is the virtual machine's program counter, so after this happens it begins reading code from that address. The value AC written there is the opcode for "call $XXXX", so the game then proceeds to call $E037 (ending function).

I've been mulling this over for a while and can't think of any faster method to the ending. I looked for a way to write the address of the ending function directly into the program counter (only 2 steps) but got crashes with every possibility I tried. So 3 steps may be the minimum.

In addition to this rudimentary ACE I've also written a full ACE bootstrap for a potential total-control TAS. The setup for it was around 10 minutes but using this new method I should be able to shave that down considerably. A simple demonstration of using it to draw custom graphics: https://www.youtube.com/watch?v=EKCj2jXPqIU

Temporary encode:

(Link to video)

Memory: Judging.

Memory: This submission is fairly similar to [4065] NES L'Empereur (USA) "save glitch" by Jigwally in 01:52.08. No noted flaws in terms of execution. I don't see a lot of feedback here and L'Empereur didn't do that great post publication. I respect the work put into this, but there's just not much to actually watch.

Accepting to Vault.

feos: Pub.

Similar submissions (by title and categories where applicable):