So, it was just a normal day yesterday when I suddenly got the idea to try and mess around in Peach escort room 4, the infamous room where Mugg got the credits warp back in 2014 that was deemed impossible to replicate outside of the VBA emulator. But back in 2022, RETIRE figured out that it's possible to do it on mGBA, although it requires memory editing to change the byte at $2336 in IWRAM to 10 in order for the game to load the credits sequence. Up until now, based on the attempts that were made to pull off the credits warp legit, the result always ended up being one of the scripts being played, and the script loaded stayed mostly consistent every time it was loaded, so it was pretty much assumed that this game only had Arbitrary Script Execution to work with. Below is a list with all the scripts that could be played by changing the byte at $2336.
| Byte value | Outcome |
| 05 | Mario turns into his form when he ingests water |
| 07 | Warp to room ??? (room ID: 128) |
| 08 | Warp to room ??? (room ID: 128) |
| 09 | Start minecart minigame |
| 0A | Star amimation from when entering a battle (softlocks the game) |
| 0B | Open suitcase menu |
| 0C | Open save menu |
| 0D | Open map (area selection screen) |
| 0E | Open shop selling items menu |
| 0F | Trigger death warp (respawn screen) |
| 10 | Trigger credits sequence |
| 11 | Warp to test room (room ID: 0, unused) |
| 12+ | No effect, game simply softlocks |
The byte at $2416 is responsible if the game crashes when Luigi breaks out or hops off a barrel. Throughout the game, this byte is set to 0 most of the time but a few rooms, like room 4 of Peach escort or Chuckroot's room, change it to 22 instead if Luigi is in a barrel which triggers the crash to happen. However, when Luigi breaks out of the barrel (or when Mario hops off the barrel), as soon as both bros are on the ground, the game always sets the byte at $2336 to 0A which corresponds to the star animation being played. This caused the progress to stop dead in its tracks, since we realised this value is most likely not useful for us if we want to make credits warp a reality in real time.
It was already established for years that the bros' position in the room and what action command Mario had in the back could lead to different scripts being played, but yesterday I decided that I wanted to try to trigger as many of these scripts as I could and make input files for them in order to maybe analyze them and potentially figure out why they happen when they happen. I was able to trigger some of these events, as well as some other events that couldn't be achieved by editing $2336. But probably the most interesting result that I got during my testing session was this:
This is the shop selling menu, a script that is by no means a rare script to trigger, in fact I managed to trigger it dozens of times before. However, this instance of the script was special because it had this glitched badge at the bottom (which I was able to actually sell and not softlock the game), something which never appeared in any of my other instances of triggering the shop menu. I am not sure why this badge was generated but my assumption is that it had to have read some garbage parameters from somewhere when it was loading the items, which got my hopes up a bit that actual Arbitrary Code Execution might be possible to do in this game. I have yet to figure out how it happened but this might a good step in the path to discovering ACE.
