Submission #4698: TASeditor & Masterjun's FDS The Legend of Zelda "2nd quest, game end glitch" in 03:34.70

Famicom Disk System
2nd quest, game end glitch
FCEUX 2.2.2
12903
60.0988138974405
69731
Unknown
Zelda no Densetsu - The Hyrule Fantasy (Japan) (v1.0).fds
Submitted by TASeditor on 5/19/2015 3:08:45 PM
Submission Comments
Once again Link goes on a journey to save Zelda, but the circumstances let him not do that.

Game objectives

  • Emulator used: FCEUX
  • Heavy glitch abuse
  • Luck Manipulation
  • Uses damage to save time
  • Uses game restart sequence
  • Executes arbritray code

Comments

Route

The first thing that needs to be done is get the flute in dungeon 2. It almost starts as the published 2nd quest TAS, but with two differences: Using the first savegame and not collecting bombs.
After dungeon two a single rupee is collected, not to spent it on anything, but to do some memory manipulation of course. On the way to the graveyard nothing interessting happens.
On the graveyard all 10 ghosts need to be spawned in order to glitch the game. The ghost which is already there and the last spawned ghost need to be at the right position at the right time.
If everything is done correctly, the item glitch will happen and have a lot of powerful new items.
Now going to level 9, because the credits load into memory when entering this dungeon, using the warp bombs.
In dungeon 9 the warp bombs are used to get to room 0x00, from there to the next room and use another item to call the credits depending on the X positions of Link and the next two enemies.

Technical explanation

Using saveslot 1
The current saveslot is stored in $16 and using the 1st slot gives value 0x00. Using the 3rd saveslot, which is faster when typig in the name, gives value 0x02. That is bad, because that would crash the game when the PC runs over this instruction. That's why the 1st slot is used, the opcode 00 does nothing.
Collecting a rupee
The rupee is collected, because of the nice sound it makes. After the sound played, address $0618 will be 0x4C, with the next 2 bytes that results as an JMP $0000.
Waiting for the random numbers
It is crucial to get from $18-$24 into somewhere where the memory can easily manipulated, because at $59 there will be always a 0x02. In this case a branch BNE $5F at $23 to the Y positions is taken. I made a list with the numbers of the RNG to see when a branch would happen.
Positioning the enemies
To get the item glitch, the area around $EC6E needs to be executed. It is possible to use a direct jump, but it turned out to be slower, because of the last enemy that spawns. So a indirect jump is used. Link will be at Y position 0x6C, the ghost which is already there will at Y position 0x9A and the last spawned ghost will be at Y position 0xB3. All this together will result in JMP ($B39A) wich jumps to $EC69. After positioning the enemies a long pause is used to wait for the random numbers.
Playing the flute
Because every slot for objects on screen is already used, the ghost AI will jump to $0602. From there it will execute the memory which is set up.
Item glitch
The item glitch overwrites that area where the items, collected rupees from caves and opened caves are. To use the glitch items the item index $0656 needs to be greater than 8 and the area where the item index is needs to be filled with something not equal to 0, or else the item index will be set back to 0 if there are to many zeroes between two addresses. In this case the item index is set 0x6E and the whole area from $0602 to $0701 is overwritten. Besides the glitch items the cave to level 9 needs to be opened, $067F needs to be greater or equal to 0x80.
Preventing a crash
The game would crash after the item glitch, but when visiting the menu and closing it again at the right frame, the crash can be prevented.
Warp bombs
Item index 0x66 refers to the warp bombs. It makes the screen scroll and warps to the last visited screen in the screen history. The warp happens instantly, so a room can be load instantly without moving.
X position ACE item
Item index 0x76 executes $1870, where a copy of the X positions are. So an opcode which jumps to the credits $B7C7 is needed. Again an indirect jump is used again, man I love these. Link is at X position 0x6C, the first enemy at 0x7C and the next at 0x9A, which will result in JMP ($9A7C), that makes the PC jump to $B7C4.

Thanks to...

  • RAT926 for finding the item glitch.
  • Sockfolder for documentation on the glitch.
  • Masterjun for documentation on the glitch and finding the credits glitch. Although he doesn't have any inputs on this run, he still is a co-author, because I would be a bit helpless on the credits glitch.
I hope I blew your mind.

Nach: I'm told there's going to be an immediate improvement, so rejecting.
Last Edited by adelikat on 10/13/2023 10:46 PM
Page History Latest diff List referrers