When aiming down or somersaulting, Samus's sprite is smaller vertically. By pressing up, L, R, or shooting, Samus will stand up fully and land a couple frames earlier.

Note: By pressing the shot button for only one frame while somersaulting, Samus will unspin, but not shoot. However, if you have Charge Beam collected, or have any other weapon selected, Samus will shoot immediately after unspinning.

When jumping to clear a platform, a somersaulting jump may not get the height needed. However, a jump of the same power and speed may be able to clear the platform if Samus aims down a few frames before she would normally catch the platform, as the hitbox for aiming down is even smaller than the somersaulting hitbox.

(AKA "back-down fall")

Usually, when you push down during a fall to enter the aimed-down posture (for instance, in a preparation for a corner hug), Samus's horizontal speed is reset. However, if you simultaneously press back and down on the d-pad, she will continue moving forward, preserving all the benefits of having reduced vertical hitbox at the same time. It can be used for more effective corner boosting or clearing certain vertical rooms without stopping. Note: sometimes it requires shooting right before pressing back in order for this trick to work.

When falling alongside a wall or a ledge that ends, aiming down and then immediately left/right on the d-pad at the right frames will shift Samus's position a few pixels down and, in case of pressing d-pad towards the ledge, go under it faster. It happens due to "aiming down" hitbox having about half the normal height; by pressing left or right Samus restores her full-size hitbox and gets immediately pushed down out of the ledge boundaries her hitbox is colliding with.

SMV demonstration.

This trick is the most effective at the beginning of the jump/fall. At full downward speed, Samus will sometimes fail to be pushed down if she falls too fast for the hitbox to "reach" the ledge's boundaries.

Samus can jump up to a platform faster than normal by aiming downward on the final frame that the jump button is held, and then immediately moving toward the platform for one frame.

In case you need to continue moving in the same direction, it is advised to time your jump so that you don't bump into the platform's edge before grabbing it. Sometimes it means doing a higher jump or pressing down a frame earlier.

Pressing down twice in mid-air will put Samus in morph ball mode in mid-air. Samus's horizontal velocity will remain until she hits the ground if the jump button is held while pressing down, and holding forwards after morphing.

When hitting the ground as a ball, Samus will bounce once before fully entering the "ground" state, where her speed is reduced to that of morph ball's roll. This bounce can be useful in a situation where a lot of small platforms would otherwise cause slower jumping.

When using a morphball bounce while jumping into the water (without the gravity suit), the speed before hitting the water can be kept until the end of the morphball bounce.

Graveworm says:

"Water ball" works because, as a ball, you keep all your speed when going into the water. You can even keep Speed booster even if you don't have the Gravity suit if you jump into the water from the ground. You can also use the "mockball" technique underwater if you build the speed up from the dry ground and jump into the water. Also, since gravity is changed underwater, you bounce much higher and can keep your speed longer, even though the water slows you down due to friction.

A mockball is a method of using the morph ball without resetting running speed. To perform it, jump into the air when at the desired speed. After reaching the peak of the jump (or releasing the jump button), hold the jump button and press down twice to morph into a ball, followed by immediately holding forward. If done close enough to the ground that Samus doesn't bounce, Samus will instead glide smoothly along the ground in ball form at the speed she was previously running with.

(AKA "kagoball")

Certain objects (such as Kagos, moving or temporary platforms, certain enemies — generally everything that is of the "SPECIES" object code^[1]) in the game can be passed through if Samus morphs one frame before landing on the object, providing falling speed is sufficient^[2]. A well-known example is the two vertical moving spiked platforms to the right of the Elite Pirate guards near Ridley's lair.

SMV demonstration.

Hovering is basically IBJ (see below) without gaining height. It can be used to lose height (albeit very slowly), wait for something without unmorphing, or as a preparation for IBJ.

To hover without gaining height optimally, you need to lay a new bomb every time the counter on the previous one reads 7, and once per 2-3 jumps, 6.

SMV demonstration.

To descend while hovering, lay a new bomb every time the counter on the previous one reads 5, and, once per 3-4 jumps, 4.

SMV demonstration.

(AKA "IBJ")

In Super Metroid, it is possible to reach unlimited height with bombjumps. There are two different ways to do IBJ.

• Through hovering: an easier method. Each new bomb should be laid when the counter on the previous reads 12 (except the first one). Visually, the button should be pressed as Samus's sprite is about to touch the previous bomb's sprite while falling. Each jump gains ~15 pixels of height on average with this method.
• Through copying double bombjump: harder to do, but more effective. Each new bomb should be laid when the vertical speed address reads 0.1024^[3] (visually, at the apex of each jump). Each jump gains ~21 pixels of height on average with this method.

Diagonal bombjumps are used to cross pits or other similar obstacles which are impossible (or at least infeasible) to cross otherwise. There are three different ways of doing this type of bombjump.

• Simple diagonal bombjump.
• Extended diagonal bombjump.
• Height-oriented diagonal bombjump (Terimakasih's method).

TODO: add demos and explanations here.

(AKA "HBJ")

Horizontal bombjump is a way to travel across long distances without gaining height (mainly useful in rooms that have low ceilings, rendering diagonal bombjump impossible). There are two ways of doing HBJ:

• Through hovering.
• Through diagonal bombjumps.

TODO: add demos and explanations here.

Springball doesn't check if Samus is on the ground to initiate a jump — only her vertical speed. By letting a bomb propel Samus and pressing jump when her upward acceleration reaches zero, you can successfully springball from mid-air. You can extend the jump height afterwards further by infinite bombjumping. You can't do double springball jumps in such fashion, though.

(AKA "CWJ")

By not turning around prior to walljumping, Samus keeps her speed intact after a jump. It has many timesaving applications, such as:

• Old MB room on the way to blue Brinstar;
• Pre-Wave beam room missile pack skip;
• Wrecked Ship missile lake room;

and many others.

The only drawback of using this method is that you won't be able to release jump and continue somersaulting without losing speed. This can only be worked around by exiting the spinjump state by shooting or other similar way (see the OMBR demo above).

Note: The missile lake jump is actually manageable in realtime. To do it, you must be standing right in front of the door and start running from there, then jump on the last possible frame. When you reach the pole, you have exactly two frames to press jump until you drown, so the timing is pretty strict. Presence of the missile on that pole won't change or interfere with the timing involved in this trick.

A special case of the CWJ is "upwards CWJ". Its use is very limited, but it can save a few frames if a good application is found. One example of this is:

• Post-Red Brinstar power bomb room.

TODO: Add more relevant demos

(AKA "walljump pickup")

When spinjumping forward, the game checks the tile immediately behind Samus to see if she can wall jump off of it, starting with the top-most tile and moving down. If any solid tiles are found, the game stops checking and allows Samus to walljump.

Additionally, the game considers Samus as touching any tiles checked, allowing you to trigger items and doors earlier by spinjumping and turning around right as the tile is within walljump range. If an item that is to be collected requires Samus to turn around immediately after collecting it, using this technique can get the item a bit faster. This can also be utilized when entering doors that do not require momentum in the direction they are entered (such as boss rooms).

The maximum distance of a remote trigger pickup depends on Samus's velocity by the moment of the walljump check and can go as high as 8 pixels away from the target. This is especially noticeable during Torizo skip.

If you don't need to turn around nor continue rising after touching the trigger, but instead want to preserve the horizontal speed, you can substitute the turnaround with pressing back+down in a way similar to back-down fall.

(AKA "edgehogging")

When landing on a crumble block (or a block about to be destroyed by a bomb), if Samus is in one of her turnaround animations, her falling speed will not be reset — instead, her vertical speed will continue rising even though she's not moving.

This can be performed on consecutive rows of crumble blocks in succession.

SMV demonstration.

It is a good idea to use this technique when waiting for a block to detonate, instead of making a high jump to build vertical speed up. Compare: with edgehogging, without edgehogging.

If Samus is jumping up while turning around in mid-air, she will continue to rise until the animation is complete, even if the jump button is not pressed. Also, if Samus bumps into a ceiling during this animation, but is no longer under the ceiling when the animation finishes, her jump can continue to rise, despite being "stalled" by the ceiling.

SMV demonstration

(AKA "flatley jump")

First introduced by Michael Flatley (hence the name), corner jump is a technique that effectively allows jumping from mid-air. To do it, run off a ledge turning around just before Samus enters the "falling" state, and press jump while turning around.

SMV demonstration.

Pressing L or R with no direction held for one frame will bring Samus's movement to an immediate halt.

At the right height below a thin (one-block) ceiling, Samus can jump through it by jumping straight up while kneeling. A correctly-placed frozen enemy can be used as a platform as well. It works because crouching prior to the jump makes Samus start it about half a block above the ground, effectively placing her inside the ceiling.

SMV demonstration.

Horizontal platforms thinner than a full block can be passed through simply by jumping straight up through them if the vertical speed is sufficient.

TODO: add a demo here.

Floors that are thinner than a full block can be passed through by having Samus unmorph or stand up in a place with not enough room vertically. Since collision check while unmorphing/standing up gives a priority to the upper side of her hitbox, the lower side sinks into the ground, allowing Samus to pass through a thin floor. This is used to enter the Maridia tube from the outer side without breaking it.

SMV demonstration.

Robots on the Wrecked Ship can be passed through if Samus is invincible from recently taking damage and the robot is moving toward her.

See also: kagoball.

To pass through the first Zebetite in Tourian, you must take damage for the invincibility effect (therefore you ª763¥must disable Screw Attackª764¥). Freeze the lower Rinka (fireball) as soon as it spawns, and then spinjump onto it to "land" on it. This will push Samus to the left very slightly, but enough to jump straight up and walk through the Zebetite provided you are still invincible. The remaining three Zebetites will not appear.

SMV demonstration.

The other way to pass through the Zebetite is to diagonally shinespark beneath it. After the crash animation ends, Samus will end up inside the pillar; after that you need to jump up and aim downwards, jump up again and finally walk or damage boost through the Zebetite.

SMV demonstration.

(AKA "door glitch")

Known mainly as the door glitch of NES Metroid fame, this technique allows an incredible amount of sequence breaking and traveling out-of-rooms possibilities.

To execute it, get yourself stuck in a door (by trying to walljump off of it from the other room) or an array of self-restoring blocks, crouch and enable X-ray scope, then turn around and immediately release dash button. If you do it before the turnaround animation is finished, Samus will be forced to stand up upon turning around with her vertical position shifted up by 5 pixels. By crouching and repeating the process, you can wrap around the screen, travel out-of-rooms and do other interesting things, including 6% runs and no-boss runs.

The optimal way to x-ray climb is to repeat the following (starting from a crouched position): press run for 11 frames, then backward for a frame, then down for a frame, and wait 4 frames.

SMV demonstration

Most easily exploited on spikes, but possible during any hit, enemy knockback will send Samus flying at high speed in the direction opposite to the one she is facing at the moment of being hit. To perform this trick, you must be hit by an enemy and enter the "ouch" animation. There is a window of 4 frames (the first two frames of the "ouch", and two frames before it) during which you must press and hold the jump button and backwards. She will continue to fly backwards until either of these buttons are released, or until she lands on solid ground (in which case she will instantly turn in the direction she was flying).

This technique is quite robust; depending on the direction and height the collision takes place at, and timing of pressing jump, enemy knockback can start higher or lower, and go shorter or farther. Experiment depending on the situation.

If an enemy is taking damage at the moment its and Samus's hitboxes collide, the hit will not be registered. However, there is little to no chance that Samus will have enough speed to pass the enemy's hitbox by the time it finishes taking damage. By shooting an enemy with a plasma beam, it will become intangible for a number of frames, thus allowing Samus to pass through it easily until that timer runs out and beam finishes colliding with the enemy's hitbox.

Note that the enemy that Samus is passing through doesn't need to be actually harmed by the plasma shot to be rendered harmless.

SMV demonstration.

The effect won't work on solid damage sources and enemies that eject Samus out of their collision zone (Mother Brain is an example of such enemy).

The same can also be done using power bombs, but in that case the enemy must be harmed in order to be rendered intangible.

After being hit, Samus is invincible for a brief amount of time. In certain situations, it may be desirable to take damage as fast as possible. Using the Screw Attack will cancel any damage invincibility and allow Samus to get hit again much faster.

Note: This only happens if there are active enemies in the room. If there are no active enemies, such as a room with only spikes, Screw Attack will not disable invincibility after being hit.

Each type of weapon has a certain time span, during which it renders Samus's gun inactive (see "cooldown timer" in the RAM address table). After the cooldown timer is activated, no other weapon can be used, including bombs. However, it does NOT include the Grappling beam. The grapple can be used immediately after it is selected, and in the right situation, can hit certain enemies or open doors a few frames faster, since this delay is no longer present.

It is possible to cut 31 frames off the usual shinespark crash animation by using a powerbomb shield. It will work only on the second and subsequent sparks, and only until you leave the room.

SMV demonstration.

Usage: charge your beam and go to the menu, then equip all five beams. Exit the menu and fire it while facing straight to the left. Dispatching it in any other direction will crash the game. Shooting it uncharged will crash the game.
Effect: the result of a dispatched murder beam is a kind of an area-of-effect weapon that is considered charged power-bomb damage-type beam that can freeze, go through enemies and through walls. Different enemies react to this damage differently, so experiment in each case. It is known that it deals 200 damage per 16 in-game frames to Mother Brain, though.
Known applications: Mother Brain's 3rd form, Ridley, Golden Torizo.

By far, the most useful glitched beam. It is commonly used in unassisted speedruns to speed up Mother Brain's 2nd & 3rd forms kill.

(AKA "ISP beam")

Usage: equip Ice, Spazer and Plasma (Charge optional), shoot anywhere.
Effect: …is pretty much unpredictable. The S/T beam is considered bomb damage-type beam that can freeze and go through enemies, but its main feature is corrupting the game's memory (differently, depending on where and how you dispatched the beam). This is a severe hardware glitch that can destroy the game's SRAM, crash it or produce very interesting results that differ on different emulators. Unless you're dispatching it at point-blank to a solid surface, the game will lag heavily. Experiment at your own risk.
Known applications: out-of-room travelling, triggering Zebes's explosion, resetting picked up items and room statuses.

TODO: Show these applications.

One interesting application this beam allows is bypassing the point of no return in Tourian and exiting it backwards.

YouTube video.

Note: triggering Zebes's explosion does not work on Snes9x. Also, dispatching a bomb spread during the effect helps to ease the lag.

Usage: equip Wave, Spazer and Plasma, shoot anywhere at point-blank (shooting straight up doesn't work). Works with Charge beam equipped, too, but that removes the chainsaw beam's only significant advantage — see below.
Effect: destroys beam-destroyable blocks, opens blue hatches. The beam is considered super missile damage-type, possesses a high rate of fire (similar to that of the Grappling beam), but very limited range, and it doesn't deal actual damage.
Known applications: nothing useful is known so far.

SMV demonstration.

Effect: simply crashes the game. Thus, only these three glitched beams are known.

The game processes the list active beams in a function at position 0x90aece:

  $90/AECE 08          PHP
  $90/AECF C2 30       REP #$30
  $90/AED1 A9 12 00    LDA #$0012
  $90/AED4 8D DE 0D    STA $0DDE
  $90/AED7 AA          TAX
  $90/AED8 BD 40 0C    LDA $0C40,x
  $90/AEDB F0 0A       BEQ $0A    [$AEE7]
  $90/AEDD FC 68 0C    JSR ($0C68,x)
  $90/AEE0 22 E9 81 93 JSL $9381E9
  $90/AEE4 AE DE 0D    LDX $0DDE
  $90/AEE7 CA          DEX
  $90/AEE8 CA          DEX
  $90/AEE9 8E DE 0D    STX $0DDE
  $90/AEEC 10 EA       BPL $EA    [$AED8]
  $90/AEEE 9C D2 0D    STZ $0DD2
  $90/AEF1 28          PLP
  $90/AEF2 60          RTS

This is equivalent to the pseudo-code

  for(x=0x12;x>=0;x-=2) {
    if(!$0c40[x]) continue;
    call $0c68[x]
    call $9381e9
  }

where $0c40[x] stores two bytes of data per active beam shot x, and $0c68[x] stores a set of function pointers which handle particulars for shots of that kind. These tables are computed based on the formula

  $0c68[x] = charged ? $90ba3e[2*beam.L] : $90b963[2*beam.L]
  $0c40[x] = $0000[(charged ? $9383c1[2*beam.L] : $9383d9[2*beam.L])+ 2*dir + 2]

where beam=$0c18=(beam.L,beam.H) is a two-byte variable with the bits (0000psiw,000c0000), where c=charged, p=plasma, s=spazer, i=ice and w=wave (so if you equip plasma and wave, it would be p00w=9), and dir is the direction you're shooting in, taking the values (0=UUR,1=UR,2=R,3=DR,4=DDR,5=DDL,6=DL,7=L,8=UL,9=UUL) (UUR indicates shooting straight up while facing right, etc.).

Since you're not supposed to be able to equip plasma and spazer at the same time, the tables are only dimensioned to handle values of beam.L < 12, while using all the beams allows us to go all the way to beam.L = 15. This makes the game read outside the bounds of the tables. If we ignore the unglitched beams from now on, $0c40[x] will take on the values

           U   UR    R   DR    D    D   DL    L   UL    U
  0ps00:  8e77 8e8b 8e9f 8eb3 8ec7 8ec7 8edb 8eef 8f03 8e77
  0ps0w:  8f17 8fa3 9027 90ab 8f1f 8f1f 8fa3 9027 90ab 8f17
  0psi0:  912f 912f 912f 912f 912f 912f 912f 912f 912f 912f
  0psiw:  9153 91df 9263 92e7 915b 915b 91df 9263 92e7 9153
  cps00:  9ebb 9ec7 9ed3 9edf 9eeb 9eeb 9ef7 9f03 9f0f 9ebb
  cps0w:  9ebb 9ec7 9ed3 9edf 9eeb 9eeb 9ef7 9f03 9f0f 9ebb
  cpsi0:  9f1b 9f27 9f33 9f3f 9f4b 9f4b 9f57 9f63 9f6f 9f1b
  cpsiw:  9f87 001e 9fbf 0008 a007 0008 a039 0000 a06b 012c

while $0c68[x] is will be

  0ps00: 3920   cps00: 1cad
  0ps0w: b0ac   cps0w: 0a0a
  0psi0: ad16   cpsi0: 0a0a
  0psiw: 0dc2   cpsiw: a4aa

The first table explains why the murder beam must be fired to the left: In that case, $0c40[x]=0, and the loop body is skipped. And that's where all the really interesting stuff happens. For the glitched beams, $0c68 contains nonsensical values, which we then treat as memory addresses for code to execute! For the three "standard" glitched beams, we have

Jumps to $90a4aa (ROM) (but only if not fired to the left. Otherwise nothing happens here). This is half-way through some other function, which due to an extra PLP instruction fails to return properly, leading to the function failing to return properly, and almost certainly leading to a crash. What happens depends on the direction the beam was fired in, as well as the controller input for that frame, and lots of other stuff on the instruction pointer's wild romp through the ROM. That makes this a promising avenue for exploits.

  $90/A4AA 30 1C       BMI $1C    [$A4C8]
  $90/A4AC CD 99 9E    CMP $9E99
  $90/A4AF 10 17       BPL $17    [$A4C8]
  $90/A4B1 AD FA 0D    LDA $0DFA
  $90/A4B4 29 00 FF    AND #$FF00
  $90/A4B7 09 01 00    ORA #$0001
  $90/A4BA 8D FA 0D    STA $0DFA
  $90/A4BD A5 8F       LDA $8F    Controller button pressed this frame!
  $90/A4BF 2D B4 09    AND $09B4
  $90/A4C2 F0 04       BEQ $04    [$A4C8]
  $90/A4C4 22 BC 98 90 JSL $9098BC
  The intial value of A no longer matters at this point.
  $90/A4C8 AD 1C 0A    LDA $0A1C
  $90/A4CB C9 81 00    CMP #$0081
  $90/A4CE F0 39       BEQ $39    [$A509]
  $90/A4D0 C9 82 00    CMP #$0082
  $90/A4D3 F0 34       BEQ $34    [$A509]
  $90/A4D5 80 00       BRA $00    [$A4D7]
  $90/A4D7 A5 12       LDA $12
  $90/A4D9 F0 1A       BEQ $1A    [$A4F5] Perhaps
  $90/A4DB AE 96 0A    LDX $0A96
  $90/A4DE AD 94 0A    LDA $0A94
  $90/A4E1 C9 01 00    CMP #$0001
  $90/A4E4 D0 0F       BNE $0F    [$A4F5]
  $90/A4E6 BD 14 A5    LDA $A514,x
  $90/A4E9 29 FF 00    AND #$00FF
  $90/A4EC F0 07       BEQ $07    [$A4F5]
  $90/A4EE A9 2F 00    LDA #$002F
  $90/A4F1 22 49 90 80 JSL $809049
  $90/A4F5 AD D0 0C    LDA $0CD0  =0000
  $90/A4F8 C9 3C 00    CMP #$003C
  $90/A4FB 30 12       BMI $12    [$A50F]
  $90/A4FD A5 12       LDA $12
  $90/A4FF D0 0E       BNE $0E    [$A50F]
  $90/A501 A9 04 00    LDA #$0004
  $90/A504 8D 6E 0A    STA $0A6E
  $90/A507 80 06       BRA $06    [$A50F]
  $90/A509 A9 03 00    LDA #$0003
  $90/A50C 8D 6E 0A    STA $0A6E
  $90/A50F 20 40 90    JSR $9040
  $90/A512 28          PLP This messes up the stack!
  $90/A513 60          RTS Will return somewhere crazy

Jumps to $90ad16 (ROM). This also jumps into the middle of a function (actually into the middle of a STA instruction, turning it into a harmless CMP ($7e,x) the first time through):

  $90/AD12 B7 00       LDA [$00],y
  $90/AD14 9F C0 C1 7E STA $7EC1C0,x
  $90/AD18 E8          INX
  $90/AD19 E8          INX
  $90/AD1A C8          INY
  $90/AD1B C8          INY
  $90/AD1C C0 20 00    CPY #$0020
  $90/AD1F 30 F1       BMI $F1    [$AD12]
  $90/AD21 60          RTS

with y=$0c40[x] (and x still being the loop counter in the loop at the beginning of this section) (actually $0c54 looks like it might affect this). For this beam, y always starts out with the value 912f (see the $0c40-table above), so this will essentially do (notice that the loop won't stop until long after y has overflowed)

  memcpy(0x7ec1c0+x+2,*(int24*)0+y+2,0x6eef)

so it will overwrite the RAM range $7ec1c2:$7f30b1, shifted by up to 12 bytes up depending on the value of x, with values pulled from an area determined by the value of the first 3 bytes in memory. This will clobber palettes, status bar tilemaps, various vram-related stuff, explored locations, events, collected items, opened doors, map stations, PLM-related stuff, including PLM Goto Instruction Pointer ($7edebc-$7edf0b) and half of the bytes for the current room's tilemap (see the RAM map). The event-related stuff is what allows this glitch to make the bosses come back to life, or make the planet blow up. But even more interesting is the PLM goto instruction pointer part, which could potentially be used to gain control if the right values could be copied over.

This jumps to $90b0ac (ROM), among a group of functions that actually have to do with handling beams (the wave beam handling is just beyond the end of this code block).

  ...
  $90/B0A9 22 AC 9C*94 JSL $949CAC  We enter at the "*"
  $90/B0AD 60          RTS
  --------------------------------
  $90/B0AE BD 04 0C    LDA $0C04,x
  $90/B0B1 29 F0 00    AND #$00F0
  $90/B0B4 F0 05       BEQ $05
  $90/B0B6 22 B7 AD 90 JSL $90ADB7
  $90/B0BA 60          RTS
  $90/B0BB 20 57 C1    JSR $C157
  $90/B0BE 22 AC 9C 94 JSL $949CAC
  $90/B0C2 60          RTS

Since we enter half-way through an instruction, the JSL and RTS change into

  $90/B0AC 94 60       STY $60,x

which will overwrite any of addresses $60-$72 (depending on x). According to the RAM map, this could affect values that will be written to some color-related registers later. But otherwise, the chainsaw-beam seems to end up executing a valid beam or projectile handling routine. This one has little potential for arbitrary code execution.

But in addition to these "standard" glitched beams, there are 5 other glitched beam combinations. And unlike the the former, the latter all results in jumps to RAM. That is why they almost always end up crashing the game. But since RAM is variable, and to some extent controllable by the player, this means that one could potentially coax the game into running something useful instead of crashing.

Let's look at these nonstandard glitched beams:

Jumps to $903920 (RAM). This is part of the layer 3 tilemap, and varies from room to room, though many rooms don't use it, and leave it unchanged. Tiles tend to come in repetitive patterns, so it might be hard to get useful bytes here, but it still deserves further investigation.

Jumps to $901cad (RAM). This is the position in the room of the PLM in slot 38. I've only seen this change when clearing a large number of blocks with a power bomb, but it deserves further investigation.

Jumps to $900dc2 (RAM), the beam charge counter, a 16 bit number which takes the values 0-120. But since this is an uncharged shot, our range is restricted to 0-60 (i.e. up to 0x3c). It is followed by a 16 bit number containing a block index. This index is written to during Samus' collision detection, and hence reflects her position. This is a very promising beam for taking control!

These jump to $900a0a (RAM), which is Samus' super missile count, followed by her power bomb count, selected item, etc. These all take one a relatively wide range of values, and are directly controllable by the player!

                             Typical range
  a0a  num super missile low    00-32
  a0b  num super missile high   00
  a0c  num power bomb low       00-32
  a0d  num power bomb high      00
  a0e  selected item low        00-05
  a0f  selected item high       00
  a10  samus x-direction        {04=left,08=right}
  a11  samus movement type      {0=stand,1=run,2=jump,3=spin,4=ball,5=crouch,6=fall,8=airball,e=turn,f=morph,17=airturn,1b=spark}
  a12  health low               00-ff
  a13  health high              00-05

$400 is in the middle of OAM memory, which contains screen-relative position and tile information for all the active sprites. In particular, starting at $400 we have [x y ? ?] for one sprite, followed by a similar 4-byte record for another one. Since the positions are screen-relative, we can basically freely choose the first two bytes. That reduces the problem to finding a sprite with the right 3rd byte. This simple-sounding situation is complicated by the game rearranging the OAM table for every frame, making it difficult to get the correct sprite with the right position in the right slot at the right time. To end up at the auto-read registers, we want something like

            x  y  ?
  $90/0400 4C 18 42    JMP $4218

or

  $90/0400 82 15 3E    BRL $3e15

etc.

The memory at $b00 is laid out as

  b00 height       stand=(15,ORA,A),jump=(13,ORA,A),aimdown (0a,bad),crouch=(10,BPL,nop)
  b01 00
  b02 coltype      L=BRK, R=ORA, U=COP, D=ORA, so R or D are OK,  though both modify A.
  b03 00
  b04 x_screenrel low  practically any value
  b05 x_screenrel high nonzero only if Samus is off-screen
  b06 y_screenrel low  typically between 2c and c0
  b07 y_screenrel high

The low bytes of Samus' screen-relative position can be chosen very freely just by moving about in a room, but the high bytes are usually zero, which limits where one can jump from this location. However, by going out of bounds (for example by firing the normal uncharged space-time beam), the high bytes can be made arbitrarily high. It is therefore feasible to make $b04-$b06 take on any values, for example

  $90/0B04 4C 18 42    JMP $4218

which would jump to the auto-read registers. This requires going 24 screen-widths off-screen.

This video uses the charged space-time beam to jump to the joypad auto-read registers using the OAM method in the green pirate room in Crateria (it's certainly possible many other places, but the details will change from room to room). The space pirates' beams (or perhaps the pirates themselves while firing) have a third OAM byte equal to 3e at least some of the time, making the BRL approach mentioned above possible with the right positioning (the object must be near the middle of the screen (0x82), close to the top of it (0x15-0x1a. In this case, uncooperative OAM lead to y-position 0x19 being used, so we jump to $421c.

Once in position in the input registers, we must secure our position by creating a loop (entry point marked by *):

   4218        <-+
   4219          |
   421a          |
   421b          |
  *421c          |
   421d          |
   421e BRA 80   |
   421f f8  f8 --+

That leaves us 6 bytes for other purposes. However, in order to do anything interesting, we will need to change the values of these registers for the next frame (by changing which buttons are pressed), and this does not happen instantaneously. And even if it did, we wouldn't know where in the loop we are at that point. So we need a way to wait long enough for the registers to have updated. Masterjun suggested a simple way of doing this: Activate some huge DMA transfers. These will pause the CPU while in progress, and can easily last for several frames. By virtue of the way we got here, the accumulator and x/y registers are all 16 bit, and A contains the value 9f33. Writing this to $420b (the DMA activation register) will start 6 maximally-sized DMA transfers, but 3 of these will be killed by the HDMA we start at the same time (due to A being 16 bit), leaving 3. These transfers take a whole 6 frames to execute, which is more than enough to get our new inputs in place before the next instruction executes. Incorporating this, we get

   4218 STA 8D
   4219  0b 0b
   421a  42 42
   421b NOP ea
  *421c NOP ea
   421d NOP ea
   421e BRA 80
   421f f8  f8

By the time we get to the NOPs, 6 frames will have passed and all these registers will be updated with our new inputs. From this point, one has a stable, changeable loop, and full control over the game.

The demonstration video goes on to make the loop a bit more efficient by switching the accumulator to 8-bit mode, and using X and Y to write to the DMA register, leaving us with 4 free bytes per iteration:

   4218 STY,x 94
   4219  00   00
  *421a
   421b
   421c
   421d
   421e BRA   80
   421f f8    f8

From there, it writes 0x26 to the game mode variable at $998, and returns control to the game (after removing the charged space-time shot and cleaning up the stack a bit). A game state value of 0x26 means that the game has been won, and the game dutifully fades out into the ending sequence.

For a bigger payload, the auto-read joypad registers are too slow. The loop above achieves on average 1-2 bytes per frame worth of instructions, which is horribly slow. Thankfully, there are also the manual joypad registers at $4016-$4017, which can be polled many times per frame.

You can escape Torizo by the use of shoulder pumping, walljump trigger pickup and very precise positioning.

The door timer (RAM address 7EDE6A,1u), before it starts the countdown, oscillates between "1" and "2" each frame. Depending on what the value is by the time of triggering the bombs, you'll get either 41 or 42 frames to escape once you regain control. You need 42 — it will not work with 41.

Then, you should pick up the bombs by using the walljump check, meaning you have to press away from them at the maximum possible distance (horizontal position 180.xxxxx is recommended). Picking up the bombs farther than 180.65535 will put you at 180.65535 regardless; this is the best you can hope for.

You should land immediately after you take the bombs. Ideally, you should have only one frame of air movement before you land. You can check it by pressing and holding shoot button before the control over Samus is regained: if she still has time to unspin before landing, try to take the bombs lower.

Upon landing, start running with 30 Hz shoulder-pump immediately, and jump at the last possible frame that allows you to clear the corner and get stuck in the door. If you get stuck at horizontal position of 28.0, everything is alright. If more, something is wrong.

After you succeed in getting 28.0, just load a state at the moment of the final jump and press away from the door when you come close enough to it (usually less than x=36.0). If everything is alright, you'll catch the trigger before the door slams shut.

SMV demonstration.

TODO: Port Kriole's method here, since it's faster and easier to do.

The trick also works on the PAL version, but due to differences in event timing, you have much greater margin of error. It apparently is enough to be feasible on console (although still requires very good timing).

Spore Spawn only needs to be fought to get Super Missiles. By getting them in the first room on the right in green Brinstar (by using the mockball or shoulder pumping), this mid-boss becomes useless. Even the Super Missile expansion that Spore Spawn was supposed to guard can be collected by entering the chamber through its exit with an appropriately timed Super Missile, or by using the Crystal Flash in the chamber.

Kraid can be killed before fully coming out of the ground with four super missiles or three super missiles and one missile. If you move forward during the last shot, the projectile will connect with Kraid faster, resulting in a faster kill. A charged Wave+Plasma shot can also speed up the battle if Kraid is fought after Draygon.

Note that the screen will not fully scroll if Kraid is killed during the first phase, but leaving the room through either door will fix this.

Saving Crocomire until after you get the plasma beam makes the fight a breeze. One charged Ice+Wave+Plasma shot will hit him enough times to send him crawling all the way back into the lava.

Phantoon can also be hit more times than normally allowed by using the Doppler effect — running forward very slowly (see "stutter walking" under Charge shinespark in shorter distance) while constantly firing missiles. With enough missiles (and one super missile at the end), Phantoon can be killed in one round.

SMV demonstration.

In fact, as much as a single missile pack is enough for the task.

SMV demonstration.

10 super missiles will take down this miniboss, but four can be substituted by using a Wave SBA. Both techniques allow killing him in one round under TAS conditions, however only the latter allows the same in realtime play.

Draygon is a unique boss in the way that he takes damage from Samus during a shinespark — 150 damage per frame (as much as 2400 damage can be delivered in a single charge). Using this property, Draygon can be killed in two rounds by combining Wave SBAs and shinesparking through him, with super missiles used as necessary.

SMV demonstration.

Draygon can also be killed quickly by abusing the X-Ray Scope together with the Plasma beam, which, however, requires you to obtain Plasma before killing Draygon, which may be infeasible in a speedrun.

SMV demonstration.

Finally, if Draygon is killed via shinespark, the variable that determines whether or not Samus is "blue" is not reset. In this state, a new shinespark can be charged simply by ducking. The drawback to the blue suit is that it is lost by pressing the dash button. In the existing runs on the site, the blue suit glitch is used to shinespark along the top of the large room just two rooms outside Draygon's lair.

Each charged plasma shot can register two hits if Samus is ducking nearby and shooting straight up (press L and R at once to do so). During one of the Torizo's jumps, the beam will register two hits with just an up-angled shot.

Keep in mind that Golden Torizo is able to dodge regular missiles and catch supers. While the latter can be bypassed by spamming them while he prepares to throw the caught missile back, the former can be used to temporarily interrupt his attacks.

However, if you aren't going for 100% item collection, it is advisable to simply skip this fight. It's possible (and is even faster) to take Screw Attack from behind, anyway.

When Ridley's health hits 0, he will die the next time he grabs you, but you often have to wait for his AI to decide to do so. Placing a power bomb will instantly cause Ridley to attempt to grab Samus, however, allowing you to end the fight quicker.

On the other hand, you don't have to be grabbed if you don't want to: Ridley will still die all alone after several seconds.

The Mother Brain fight is divided into three distinct phases, each with separate energy count:

• First form — 3000 energy units. Harmless by itself. Requires breaking the glass before the actual damage can be dealt. When energy reaches zero, the room is locked in a single screen.
• Second form — 18000 energy units. The fastest way to deal with this form is shooting charged Ice+Wave+Plasma. Murder beam is slower both in-game and in realtime. When energy reaches zero, Mother Brain starts shooting the beam that drains Samus's ammo and energy, which initiates the metroid cutscene.
• Third form — 36000 energy units. The damage is dealt as soon as the energy count is reset, if any of the methods listed below are used. When energy reaches zero, Mother Brain dies.

It is possible to have Mother Brain's energy drained away right at the start of the third phase while Samus is supposed to be uncontrollable; it requires shooting the Murder beam right before Mother Brain delivers her last beam attack. After you acquire the Hyper Beam, it will take only 1-2 shots to finish her off.

Note that, while this method is preferred if you're aiming solely for lower in-game time, it is much slower (and uglier) in realtime due to heavy lag and having to enter the menu at least once.

SMV demonstration.

With enough energy, it is also possible to retain control of Samus during the metroid cutscene. All that is needed is having 700 to 999 energy (must be current energy, not in reserves) and de-equipping the Varia Suit before Mother Brain uses her final attack. The game will still attempt to put Samus into the kneeling pose a few times during the cutscene, but this can be circumvented by being in mid-air each time the game attempts to enforce Samus's pose.

Even with the metroid on you, you can still attack Mother Brain by firing point blank. However, the metroid stops following Samus as soon as she has full health, though it will teleport to her again when Mother Brain attacks it.

TODO: add an SMV demonstration.

If you morph in midair instead of on the ground or through mockball, you lose the ability to control the height of a springball jump. Even if you unmorph during such jump, Samus will continue rising. It has no known benefits as of now — thus, springball jumps should only be done after prior mockballing.

(AKA "Things not to spark into".)

There are several objects and environments that do not cope too well with Samus's ability to shinespark. They include:

• Lava and quicksand

Effect: Samus will move at a pathetically low speed (about 0.11 px/f) with her energy drained as usual, until she runs out of it (then the game might crash regardless). Note: the speed will vary depending on how deep Samus is submerged (compare: the same lava demo, but two pixels higher).

• Mother Brain

Effect: energy depleted at a very fast rate.

• Yapping Maw.

Effect: game crashes.

Aiming for frame count gives more consistent, but less varying and overall slower action.

Benefits	Drawbacks
Less non-action sequences	Slowest action sequences
Less time spent collecting items	Less items available to vary technique
Little to no laggy scenes or menu entering	Lag and menus are not "free" options
Shorter door transitions	Optimizing screen scrolling is a concern (if your position at the moment of entering the door is shifted from the center of the screen, it will take much more time to catch up)

Aiming for in-game timer gives more waiting, but faster and more varying action.

Benefits	Drawbacks
Fastest action sequences	Longest in realtime
More items, which allows more variety in technique during play	More non-action sequences
No concerns about using menu screen (that is, as much as needs be)	More visually redundant scenes ("menu action", etc.)
No concerns about minimizing lag	More laggy scenes

Many authors choose to do a combination of the two timing methods. For example, one author might aim for frame count, but not take extra time to optimize door transitions because he or she thinks it looks sloppy. Another author may aim for in-game timer, but avoid entering the pause menu when unnecessary because he or she thinks it disrupts the flow of the run.

It's up to each author to decide what they feel will make the most entertaining TAS.

• Game Resources ― we have resource pages for other games too!
• Common Tricks ― tricks common to many games
• Boss Fighting Guide ― tricks specific to boss fights