Submission #6946: BruceShankle, Fox, andzura, Seedborn's N64 The Legend of Zelda: Majora's Mask "game end glitch" in 22:44.90

System Nintendo 64 Emulator BizHawk 2.4.2
Game Version JPN v1.0 Frame Count 81894
ROM Filename Zelda no Densetsu: Mujura no Kamen [Japan] Frame Rate 60
Branch game end glitch Rerecord Count 22451
Unknown Authors BruceShankle, Fox, andzura
(Additionally: Seedborn)
Game The Legend of Zelda: Majora's Mask
Submitted by BruceShankle on 11/27/2020 5:17:31 PM

Submission Comments
The encoding of this movie should end on frame 85097.

  • Emulator: Bizhawk 2.4.2
  • Core Type: Pure Interpreter
  • Emulated Resolution: 320x240 (syncs in higher resolutions)
  • Active Video Plugin: GLideN64
  • Controllers 1, 2, 3, and 4 (Only 1 and 3 are used).
  • Game Version: Japanese 1.0, has text with less characters than the English version, in addition to having the fastest heap setup for SRM.
The goal of this TAS is to beat the game as fast as possible. In the previous any% TAS seen here: #3194: MrGrunz's N64 Legend of Zelda: Majora's Mask in 1:29:32.02, Link has to beat all 4 main temples in order to summon the 4 giants with the Oath to Order to beat Majora's Mask. Since then, several new glitches and optimizations have been discovered, but recently a very powerful glitch known as Stale Reference Manipulation, otherwise known as SRM (not to be confused with SRAM) was discovered, that allows us to skip all of that.

Glitches and Techniques


  • File Name Code: File names can be used to write code when setup properly, and whenever a file is created, its name is written into an unused portion of memory until the game is reset. Because the current file name you are playing on is always loaded somewhere else in memory, this gives us access to 2 file names to point to using SRM.
  • Curved Backwalking: Holding slightly left or right when backwalking allows you to curve your momentum. This is important for achieving the best angles in certain scenarios, such as the first moment we gain control of link.
  • Curved Sidehopping: Holding slightly up and down from the direction link is sidehopping allows you to shift his momentum in that direction. This is important in sections where you either need to be turned slightly to get an angle to reach tight spots such as sidehopping across the tree stumps during the skull kid chase.
  • Untargeted Deku Sidehopping: If Z is not pressed while deku link is airborne out of a sidehop, he will continue to turn in that direction until Z is held again. This is useful because every other form of link has to land on the ground, turn, and retarget in order to turn tight corners, costing 2 frames extra.
  • Z-Sliding: Pressing Z every other frame allows you to retain your current speed without being affected by slope. The only downside is that turning costs time, but when done out of a Hyper Extended Superslide (HESS), you can achieve a Z-Slide of any angle due to the fact that after holding Extended-Super-Slide position (otherwise known as ESS), holding Z and an angle will turn link while also targeting.
  • HESS: By rolling into damage on the correct frame of links roll animation, holding the ESS position on the control stick will cause link to gain -18 speed, sending him flying backwards. His directions can be controlled by holding ESS in the opposite direction of where link needs to be pivoted.
  • Gainer: Targeting a wall and backfliping while not holding Z, then pressing Z on the next frame will cause link to gain the ability to grab onto the top of the wall if it wasn't significantly too high.
  • Tatl-Flower Skip: It is possible to skip tatls textbox near the deku flower and the flower itself at the end of the lost woods using a precise backwalk around the textbox trigger in combination with a VERY precise spin-jump to popup on the ledge.
  • Escaping Clock Town Early: It's possible to escape clock town very easily by backwalking against the guard in east clock town on the right side of the entrance. This is used to grind for rupees outside of clock town as well as skip the north clock town introduction cutscene.
  • Cutscene Skipping: The Happy Mask Salesman Cutscene can be skipped by never being on the cutscene trigger for more than one frame at a time. This can be done by continuously pausing the game to advance the game one frame at a time. Other cutscene skips such as the clock town tatl text CS skip are done by hard resetting the game as soon as the game is saved.
  • SRM: Stale Reference Manipulation, used to write data to a referenced location that isn't pointing to the original actor it was supposed to point to. This can be used to run controller 1 inputs as code, which can then be used to run file names as code, and so on.

The Route


1st Cycle


  1. Setup File 1.
  2. Reach Clock Town
  3. Reach night of the 3rd day by advancing time using grandma's stories and the scarecrows dancing.
  4. Collect the stray fairy in east clock town and escape clock town early.
  5. Farm 50 rupees from the 2 patches of grass in Termina Field and get the magic reward from the great fairy.
  6. Buy the bomb bag from the bomb shop and use a gainer to reach the clock tower platform.
  7. After the clock door opens, shoot a deku bubble at skull kid for him to drop the ocarina.
  8. Collect the Ocarina of Time, learn the song of time, and rewind time. Hard reset to skip the cutscene.
1st cycle is an unavoidable part of this TAS because there's no known way to get the ocarina without it. If it was possible to get any mask at all as deku link, we could use a glitch with honey and darling minigame to become human, but currently there's no way to do that either. So for now, the best thing we can do is use the NPC's around clock town to advance the in game time to night of the final day, and collect the bomb bag so that we can use bombs later on in the TAS. The best way to do this is to get rupees from termina field, because that will also let us get to north clock town without having to watch the introduction cutscene because we are entering it from its exit. I manipulated the RNG here in various segments, such as for the bush rupees as well as the angle of the bubble fired at skull kid in order to hit him on the first frame possible.

2nd Cycle


  1. Setup File 2.
  2. Learn the song of healing and obtain the deku mask.
  3. Leave Clock Town through the east entrance and obtain 2 bomb drops from the closet patch of grass via RNG Manipulation.
  4. HESS using the nearby chuchu as a damage source and clip behind the fence around the observatory using an acute angle with the wall, and then instantly change angle using a z-slide to reach the observatory faster.
  5. Manipulate the Actor Heap using bombs between observatory and the hideout.
  6. Trigger SRM by supersliding off of a pot using a bomb with an inverted camera to keep it culled when loading the hideout.
  7. Re-enter the observatory and drop the SRM in a certiain range of angles to point to the moons tear draw function.
  8. Line the 8 digit hex of links last targeted angle a links current facing angle to run links controller inputs as code once the draw function is loaded using the ocarina.
  9. Point to the 2 file names we setup earlier to unlock the 3rd controller to load the end of the credits with total control.
In the 2nd cycle, now that we can become human, we can trigger the SRM glitch I mentioned earlier. We can use this glitch to get the game to run controller 1's input as code, and then use controller 1 to load the 2 file names as code to enable the 3rd controller, then use both controllers to load the end of the credits. The credits noticeably doesn't have any music, and that's because we didn't warp to the start of the credits that triggers the music. The reason why we didn't do that, is because at that point in the credits there are multiple textboxes that require me to press A or B to advance, and the goal is to end input on the first frame possible to achieve the fastest TAS timing. TAS timing starts from the first frame of input to the last frame of input, so we don't want to have to go through textboxes after warping to the end of the game, so we want to warp past the start of the credits. We warp to the very end specifically, because otherwise the credits do not play out correctly, and the player will regain control of link during the credits.

Other Contributors to this TAS


  • Türkenheimer helped me determine the fastest combination of file names for triggering the total control ACE.
  • Rylie walked me through how the heap manipulation worked and explained how the angles could be setup.

Who Did What?


  • I, Bruce Shankle, TAS'd the 2nd half of 1st cycle after the scarecrow, as well as the beginning of the TAS up to the 2nd deku flower, and movement to stock pot inn. I also TAS'd the entirety of 2nd cycle up to the superslide, besides the RNG manipulation for the 2 bomb drops and the rupee angles RNG manipulation at the beginning of the observatory.
  • Fox TAS'd the tatl/flower skip, the HMS CS skip, the stock pot inn movement, and the movement to the scarecrow shop.
  • Andzura TAS'd the flower angle to sync fox's inputs for tatl/flower skip, double bomb drop RNG manipulation, rupee angle RNG manipulation, and the angles for setting up the ACE. He also researched the observatory heap setup so that we could allocate bombs on the first frame possible.
  • Seedborn TAS'd the inputs for total control ACE to load the end credits using controllers 1 and 3. He also wrote the final explanation for this submission.

Technical Explanation of Total Control ACE, by Seedborn


By passing through a loading plane while grabbing a pot, Link is in the state of 'holding' an actor which is no longer loaded. By loading other actors at an offset in that space, the properties of the grabbed item that Link is supposed to be affecting (e.g. position, rotation) become ways of writing over the new actors' data. We take advantage of this by corrupting a pointer to the function that draws the Moon's Tear present in the observatory. We redirect this pointer into Link's instance, and by manipulating his angles further redirect execution to the controller inputs.
Filenames in the game are 8 bytes, and so can be used to form mips instructions (within the limits of the Japanese characterset). Fortunately, Majora's Mask keeps a stale copy of the name of the last created file in RAM, which allows us to use the names of two separate files to form these instructions. When we redirect the game's execution to the controllers, the first thing that controller 1 does is jump to the secondary file name, which then jumps to the primary file name and then away to normal execution. Along the way we are able to erase an instruction that suppresses input from the other three controllers, which means that now we can form instructions using multiple controllers (only the inputs of controllers 1 and 3 are 4 byte-aligned in RAM, so only those two can form full instructions).
Reserving controller 3 for a jump to safe execution, controller 1 can form nearly arbitrary instructions each frame. This allows us to write a small snippet of code which, when executed, sends us to the final cutscene of the credits (and also removes the usual fadeout).

Samsara: File replaced with a more entertaining version. Time remains unchanged. Also, judging.
Samsara: Optimization looks good all throughout, and audience feedback is looking good as well. The glitches and ACE used appear to be legit, with precedence in the Ocarina of Time run.
With the small kerfuffle that happened over the branching of said run, I feel it's necessary to re-explain the logic in this judgement. Whenever we get a "game end glitch" submission intending to be the fastest completion of a game, it is always a separate category. This is to ensure that runs that execute arbitrary code are never in direct contention with any other category due to the extreme amount of power and control it would allow. Otherwise, any game that allows for ACE would essentially have every category looking completely identical, just with different ACE payloads that set the proper values to fulfill the requirements of each category. Some people have argued in the past that there's nothing wrong with this, and that "faster is faster" no matter what, but there's a major issue there in terms of our site philosophy: From the very beginning, we've always been highly focused on entertainment. Allowing ACE in all categories would slowly homogenize the site over time, driving away an audience looking for unique and entertaining TASes, and alienating new TASers by essentially requiring them to be coders in order to break in. It'd likely drive away a lot of current TASers as well because of that, since raising the barrier to entry for a fair number of games to be "MUST UNDERSTAND ASSEMBLY CODE TO START A TAS" severely limits the number of people who are actually able to look at making improvements.
On top of that, there's merit in keeping ACE and non-ACE separated, in terms of actually providing gameplay for people to watch. For example, people who want to see Super Mario Bros 3 getting destroyed are far more likely to enjoy the 10 minute warps run than the 47 frame ACE run. The 47 frame run is a novelty for sure, it's really surprising when you see "Wait, is that literally beating the game in less than a second?" and then find out that it's something that could actually be done on console, but you have that run in your head for the rest of your life after that. There's no rewatch value after that in the same way that there is with the longer warps run. Rewatch value is important not just for the casual audience, but also for RTA runners. Someone who can't do subframe inputs by themselves (i.e, literally everyone in the entire world) definitely isn't going to be looking at the run that's less than a second of subframe inputs, they're going to look at whatever the most human-doable TAS record is. This benefits both communities! RTA runners get inspired by TAS records, pushing their times down further and further, and in return they often improve TASes as well by discovering new strats or glitches, things that wouldn't come to our attention if we didn't have published non-ACE runs of those games.
So let me put it this way: Branchless does not mean any% in the way that the RTA community thinks of it. Branchless to us more or less means "standard", I.E it just beats the game within its own bounds as quickly as possible, not doing anything worthy of a branch. It's not necessarily any% (since there can be faster GEG runs), but in games that don't have GEGs, it does end up being the de facto any% label. For games that DO have GEGs, consider our branchless "category" to be "fastest completion without outside interference", I.E no ACE or memory/save corruption. I'm well aware I'm incredibly over-simplifying a lot of different things into "outside interference", which isn't the best descriptor, but it's the best I can manage to come up with right now for an explanation that can still make sense to a casual viewer. This isn't normally such a big problem, but the N64 Zelda games are a cavalcade of weird wrong warps and item swapping and game-destroying glitches that are entirely possible in-game without outside interference, making branching hard to figure out and even worse to explain. To some, there really isn't much of a difference between ACE-ing straight to the end credits and using Stale Reference Manipulation to warp directly to the Moon and finish the game from there. I understand that, but it's kind of a problem that's inherent to Majora's Mask and Ocarina of Time, and we're not N64ZeldaTASvideos so we can't just make exceptions for them without disrupting the balance of our 4300+ other publications, nearly 7000 submitted runs, and our potential future of thousands more of each.
Right now, as far as I'm concerned, if another Majora's Mask run is submitted that explicitly does not use ACE, but does use Stale Reference Manipulation to wrong warp and skip a large portion of the game, that run would be in direct contention with the published branchless run and would either obsolete it directly or be published alongside it while adopting the branchless label, with Grunz' run picking up a branch of something like "no SRM". I can't say for sure which option would be taken - assuming it ends up being either of them at all - without such a run being submitted in the first place, and I can pretty safely say that any other Judge would feel the same way that I do.
To tl;dr it, just think of branches like "game end glitch" and "save glitch" to be the de facto any% runs for their respective games even if they're not explicitly branched (or branchless) as such. To be completely sure of it, look for the Fastest Completion flag on publications. That's our explicit any% label, and this does include GEG submissions.
Hopefully that was an adequate explanation. If not, I'm happy to answer any questions in the thread or on the site's Discord. With all that being said, I'm accepting this as a new branch for this game. As for the tier, the audience's feedback improved dramatically after the replacement file added in some playaround, though feedback in general wasn't necessarily too negative even before that (lots of Yes votes despite also mentioning the initial lack of playaround), so this is going to that big terrifying-looking Moon in the sky, in the same way that Link doesn't do in this movie. Haha. Majora jokez.
Zinfidel: Processing...

Last Edited by BruceShankle on 11/8/2021 1:52 AM
Page History Latest diff