Goals

• Complete the game as fast as possible.
• Load the credits without any visual bugs.

Additional Comments

The DPCM Bug

How the run works

This part of RAM is filled with BRK instructions, which jumps to the programmable interrupt code. Every time this happens, since the IRQ Mode is still 0x20, the same problems occur. We enter the code as an interrupt, but exit the code with RTS, sending us back to $0001. This might sound like it’s an infinite loop, but luckily for us, the IRQ Mode is at address $101, which happens to be inside the stack! With each BRK leading to an RTS, the stack pointer is moving downwards 6 bytes. This will eventually reach the IRQ Mode, overwriting it with 0xB4. Now when the programmable interrupt is executed, it properly reaches an RTI instruction, so the stack pointer stops shifting around with every BRK, and we can continue to execute bytes after address $0001.

The limitations

A: 0x80
B: 0x40
s: 0x20
S: 0x10
U: 0x08
D: 0x04
L: 0x02
R: 0x01

$17: A9 (Total Held)
$18: 20 (New buttons)

Just like the previous addresses, the bits that compose $F5 need to be contained within the bits composing $F7. The same applies for $F6 and $F8. This allows us to write much more than what can be written with addresses $17 and $18, though it too has its restrictions. Suppose I want to write 0A 20 5A B8. Like before, this takes two frames.

The win condition

1. The $C000 bank needs to be 0x19
2. The $A000 bank needs to be 0x18
3. The PPU Control Register Copy (Address 0xFF) must be 0xA8
4. The Stack Pointer must be greater than 0x30
5. The NMI Mode (Address $100) must be 0x20
6. Jump to $B85A

1. Correct the stack pointer and jump to $8FE3
2. Correct the stack pointer and set up requirements 5 and 6 manually.

The problems

1. We need to be able to run through the button inputs in RAM more than once, so we’re going to need to write a jump to $0000. That would take up one of the bytes we could use from $F5 through $F8.
2. Address $16 holds a value of 0x1E, which is a 3 byte opcode. Executing that address will skip right over $17 and $18, so our button presses won't be usable.
3. Most of the space here is filled with 0x00, which writes BRK, a 2 byte long opcode. That makes us execute on either even or odd addresses. When executing around $16, we need to make sure we’re executing odd addresses to avoid skipping our button presses. This also assumes $15 is a 2 byte opcode. We don’t need to worry about that for our button presses at $F5, as the 0xFF opcode sitting at address $F0 will always align us with odd bytes.
4. Addresses $10 and $15 are both used as timers, and change every frame. $10 counts down, while $15 counts up. Different values create opcodes of varying lengths, which could offset our code. On top of that, some opcodes crash the NES, so we need to avoid executing these addresses when they hold a problematic value.
5. We’re unable to control the A register. Multiple bytes that execute between our stored button inputs can change A in unhelpful ways, or simply in a manner we can’t manipulate.
6. We’re unable to control the Y register. Addresses $8D and $8E both hold 0xA0, which corresponds to LDY Immediate. This will guarantee that between the bytes we can control at address $18 and $F5, the Y register will get reset to either 0xA0 or 0x00.
7. We still have to work with the limitations, which prevents us from writing any 3 byte long opcodes with our button presses.
8. Any instructions that work on the zero page with offsets, such as STA $FF,X, are truncated to always remain within the zero page, so we can’t simply store our desired value into $100 by offsetting it past address $FF.

The solutions

The execution

To reiterate, when I’m “stalling” inside the input loop, I’m switching between pressing the A button and no inputs between every instance where the controllers are polled.

• The game takes 10 frames to set up the title screen.

1. Stall inside the NMI until the IRQ fires
2. Stall to write the first half of LDX 0x20
3. Stall to avoid a game crash at address $15
4. LDX 0x20
5. STX $F9
6. Stall to write the first half of the next frame.
7. PHA TXA PHA
8. Stall to write the first half of the next frame.
9. JSR $B85A to win the game.

Special thanks to

• Bigbass, who verified the run on console.
• DwangoAC, who helped out with any TASVideos related questions I had.
• Masterjun and ais523, who created the TAS in 00:00:00.78, which was an incredibly useful resource for learning about runs utilizing the SubNesHawk core.
• My friend Tony, who listened to my ramblings in a discord call for several hours over multiple days as I pieced this run together.

Suggested Screenshot