Submission #10095: IgorOliveira66X's SNES Super Mario World "all 96 exits, arbitrary code execution" in 18:27.043

Super Nintendo Entertainment System
all 96 exits, arbitrary code execution
(Submitted: Super Mario World.smc USA)
BizHawk 2.6.3
66532
60.0988138974405
1348
PowerOn
6b47bb75d16514b6a476aa0c73a683a2a4c18765
Synced on BizHawk 2.11 with the BSNES core.
			
Submitted by IgorOliveira66X on 12/17/2025 12:03 AM
Submission Comments
All Super Mario World 96 exits in less than 19 minutes? Yeah, it's possible!
  • Emulator used: BizHawk 2.6.3
  • Allow Left+Right / Up+Down
  • Core BSNES
  • Abuses programming errors
  • Heavy glitch abuse
  • Corrupts memory
  • Complete all exits
Earlier this year I submitted a TAS for Super Mario World completing all 96 exits, which ended up going to the playground due to some factors, and here I am with a new version heheheh!
This TAS completes all 96 exits in Super Mario World in under 19 minutes, using an ACE code that allowed me to complete all levels (both secret exits and normal exits) on the first possible frame upon entering a level! Wow Igor, how is that possible? Let's go!

Normal Exit

The address $100 in Super Mario World is responsible for the game mode. You can learn more here. There are several game modes for each stage of the game. However, there is one game mode that, for some reason, completes the level, giving you a normal exit, which is #$F8. If the game mode is set to #$F8, the level is automatically completed. I used that to my advantage.

Secret Exit

The secret exit is quite simple. Address $1434 is responsible for the secret exit, and it's set to #$80 when Mario inserts a key into a keyhole. In the case of the code, I set it to 01, instead of 80, to reduce the animation frames and be as fast as possible.

Code

The code is quite simple. Pressing L sets $100 to #$F8, and pressing R sets $1434 to #$01. So, from the moment I wrote the code into memory, I could, on the first possible frame, press L or R to complete the level, either with a secret or normal exit.
The code is this:
LDA $18
AND #$10     ;|check if R (controller 1) is pressed
BNE ace1
LDA $18
AND #$20     ;|check if L (controller 1) is pressed
BNE ace2
RTL
ace1:
LDA #$01      ;|set 01 in $1434 if $18 equals 20
STA $1434
RTL
ace2:
LDA #$F8      ;|set F8 in $100 if $18 equals 10
STA $0100
RTL
The process of how the code was written in memory is the same as my glitchfest with arbitrary code execution, so I won't go into details here.
So, basically I wrote a code into the game's memory, via inputs, where pressing L sets $100 to F8, and pressing R sets $1434 to 01. Another detail is that, in addition to writing the code, I also changed 2 addresses: I set 03 in address $19 and set B6 in address $0DC2. In other words, I gave Mario a fire flower and put a Koopa Kid in the item box. You'll understand why.

Questions

This run seems quite simple, but there are a few points that need to be detailed here.
FIRST POINT: Is it possible to be faster than that using ACE? Yes, however, the only way I see is by setting all 96 exits in the ACE code itself (something I've already done here, but it's kind of pointless). This way, it's possible to unlock all 96 exits in less than 1 minute. However, Mario doesn't actually complete the levels, so I think it's kind of invalid (it would be valid, perhaps, as an "all 96 exits, game end glitch" or something like that).
SECOND POINT: Isn't it possible to make it faster by optimizing this code or adding more features to it, such as increasing Mario's speed on the map or things like that? Yes, maybe. But I don't think it will save much time. I believe that what would save the most time in a run like this would be to increase Mario's speed on the map, but this is complicated (perhaps impossible) because the address that defines Mario's speed on the map is an address in the ROM and not in the WRAM, which is unreachable via ACE (there might be some way, but I don't know of it). Therefore, I believe this is the fastest way to complete the 96 exits using ACE. If anyone finds another way, please do so :)
NOTE: In Forest Fortress, I didn't need to skip the cutscene because I took a secret exit, but unfortunately I only realized I had skipped the cutscene after finishing the TAS. It's possible to save some frames by taking the secret exit at the very first possible frame, without skipping the cutscene.

The Run

Now I'm going to talk about some important things here regarding the run!
  • When the game mode is set to #$F8, the level is completed. However, if Mario's speed is not 0 or if he is on an even frame (any frame other than odd, according to the real frame address $13), the animation will be much longer. Therefore, if Mario's speed is zero and the frame is odd, setting the game mode to #$F8 makes the level ending animation much faster. This is why I didn't complete the castles and ghost houses on the first possible frame. In the cutscenes of these levels, Mario already starts at speed 3, so it's faster to skip the cutscene and complete the level on the first possible frame within the level.
  • I had to lose several frames on various levels because the first frame was an odd-numbered frame. So, on those levels, I completed the level on the second possible frame to avoid a longer animation. In the secret exit, there is no difference in the animation, regardless of Mario's speed or the frame he is in. Setting $1434 to 01 immediately finishes the level with a secret exit, and all secret exits are completed on the first possible frame. Perhaps improvements can be made to this TAS by optimizing the frame rules.
  • The secret exit animation is faster than the normal exit animation. Knowing this, in some levels, I used the secret exit (even if the level didn't have a secret exit) to save time, like in castle 6 and castle 7. Even with a secret exit in levels that don't have a secret exit, the game still counts it as an exit. But why not take the secret exit in every level? Simple. When you take a secret exit in a level that doesn't have one, it ends up activating the next event (which is usually the event of the following level). This makes Mario get stuck on the map, because when he goes to the next level and completes it, the event will already be active and Mario won't be able to move. However, if the next event has already been activated or is a "null" event, the event in the following level is not affected, and Mario does not get stuck on the map. This is the case in the levels where I activated the secret exit.
  • Why did I give Mario a fireflower and put a Koopa Kid in the item box? Well, that was for the end of TAS, in Bowser's castle. When a boss is killed inside Bowser's castle, the game activates the credits. That way, I didn't have to fight Bowser. The fireflower was used to throw two fireballs at the Koopa Kid (who was invisible) that was spawned by the item box and kill him (he died when Mario stepped on him).
This TAS is a 45-second improvement over the previous record (which was mine). This improvement was achieved by optimizing the code (setting 01 in $1434 instead of 80 and reducing the animation) and also by optimizing the strategies (finishing some levels with a secret exit, instead of a normal exit).
I believe I've explained everything that needed to be explained. If you have any questions, feel free to ask in the submission comments :)

nymx: Claiming for judging.
nymx: I'm not sure I'm the judge for this submission. Gave it some thought for a few days, but I'm going to put it in the hand for someone else to mull over.
Last Edited by nymx on 1/3/2026 6:59 PM
Page History Latest diff List referrers Change Log