Submission #7192: AleMastroianni's PSX Crash Team Racing "game end glitch" in 19:21.59

(Link to video)
Sony PlayStation
game end glitch
BizHawk 2.6.1
69626
59.94004789969645
41724
Unknown
CTR_NTSC_U.cue
Submitted by AleMastroianni on 8/19/2021 6:36:58 AM
Submission Comments

Movie goals

  • Emulator used: Bizhawk 2.6.3-dev (Syncs on BizHawk 2.6.1)
  • CD ID: SCUS-94426
  • Bios: SCPH5501.bin
  • Version: NTSC-U
  • Abuses Programming Errors
  • Manipulates Luck
  • Genre: Racing Game

Category Description:

This is CTR: Crash Team Racing Any%. This category uses the Battle Mode Warp Glitch but not to jump directly to the credits, since that method does NOT have oxide beaten in the game ram, but its just a cutscene warp. This instead is the fastest completion of the game by having the final boss beaten in the game ram. All skips are allowed, the goal is to beat """Oxide""".

Lua Scripts and Addresses

To help myself to develop the TAS, i realized a few .lua scripts that would be constantly telling me which ram adresses i was manipulating at each time. I also made use of the scripts i already had from lapogne36 and TheRedHotBR that i used in my last submission for the game, to which im still grateful, since they also were useful to understand how to code scripts on my own this time.

Glitches

This TAS makes use of a number of glitches in the game in order to make the process as fast as possible. By quitting and also giving an input (one frame later) to join a submenu (what i do before joining Sewer Speedway warp in Hub1), i manage to "store" that submenu and access it during a race, which i shouldnt be allowed to. Doing this allows me to quit the race and head straight to the main menu, still keeping the Crystal Challenge in RAM. Having this in place, and joining the track Dingo Canyon (first in the array of the game), the game goes out of bounds with LEV_ID being negative due to the operation the game itself does to switch from common trophy races to crystal challenges, which usually happen in Battle Arenas (like Skull Rock).
Apparently wumpas and crystals share some properties in the game code, the first and most obvius being the sound they make when the player collects them. This lead me to try a few things out when i initially found the glitch, which eventually lead to finding out that all wumpas on crystal challenges manipulate the game RAM. It was not long till that made possible to manipulate ram in order to choose which item/award to manually add in the game ram (boss Keys in this instance). It's still not clear why certain section of a track having wumpas there manipulate specific parts of RAM. Dingo Canyon specifically has a couple of wumpas (one of which im using in the TAS) that give access to every single award in the game, and more.
After manipulating ram in arcade mode, to join once again Adventure Mode, i couldnt simply load the save file, as that would have got ridden of what i had just gotten via ram manipulation. Instead, i made use of an old Battle Warp glitch, mainly used to skip to the cutscene in a(n)(infamous) way to end the game, that simply warps to the ending cutscene when performing the battle warp glitch 16 times in a row. Here, i just needed to use it 2 times in order to join Hub2 of adventure mode and get back to business by avoiding the common way of loading back into the save file.
Quoting TheRedHotBR: "What actually happens is that when you have the battle mode end of race code running, the game makes a copy of an array to the stack and uses it to award the player. The catch is: the index number of race levels are less than the index number of battle levels, so when calculating the reward with this glitch activated, the game will access variables out of bounds in the stack. Luckily for Dingo Canyon, the variable it accesses is one of your camera values, so it ends up being possible to manipulate a reasonable range of the memory, including some variables about the game completion status (e.g items, highscores)."
Lev_Id_Values:
  • 0 - dingo canyon
  • 1 - dragon mines
  • 2 - blizzard bluff
  • 3 - crash cove
  • 4 - tiger temple
  • 5 - papu's pyramid
  • 6 - roo's tubes
  • 7 - hot air skyway
  • 8 - sewer speedway
  • 9 - mystery caves
  • 10 - cortex castle
  • 11 - n.gin labs
  • 12 - polar pass
  • 13 - oxide station
  • 14 - coco park
  • 15 - tiny arena
  • 16 - slide coliseum
  • 17 - turbo track
  • 18 - nitro court
  • 19 - rampage ruins
  • 20 - parking lot
  • 21 - skull rock
  • 22 - the north bowl
  • 23 - ROCKY ROAD <-- STARTING POINT
  • 24 - lab basement
  • 25 - gemstone valley
  • 26 - warp room 1
  • 27 - warp room 2
  • 28 - warp room 3
  • 29 - warp room 4
  • 30 - intro
and so on.
Once i finally collect all the keys, since the "battle warp glitch" is still active, i wouldnt be racing the final boss, nor be able to end the final race, so what i ended up doing is "storing" a sub-menu once again to keep the final boss race in ram, while reloading adventure mode. This forces the game to transform any trophy warp i enter (crash cove here) to be interpreted as the final boss race. And there it goes, once winning the final race, final cutscene plays, followed by credits. Final Boss results beaten in the game RAM.
I made a couple of commentaries a couple of months ago, trying to show properly how the manipulation happens:
Address Value (hex) Stage ID Item Stage
08FBA4 1 ? ? ?
08FBA4 2 ? ? ?
08FBA4 4 ? ? ?
08FBA4 8 ? ? ?
08FBA4 10 ? ? ?
08FBA4 20 ? ? ?
08FBA4 40 0 Trophy Dingo Canyon
08FBA4 80 1 Trophy Dragon Mines
08FBA4 100 2 Trophy Blizzard Bluff
08FBA4 200 3 Trophy Crash Cove
08FBA4 400 4 Trophy Tiger Temple
08FBA4 800 5 Trophy Papu's Pyramid
08FBA4 1000 6 Trophy Roo's Tubes
08FBA4 2000 7 Trophy Hot Air Skyway
08FBA4 4000 8 Trophy Sewer Speedway
08FBA4 8000 9 Trophy Mystery Caves
08FBA4 10000 10 Trophy Cortex Castle
08FBA4 20000 11 Trophy N.Gin's Lab
08FBA4 40000 12 Trophy Polar Pass
08FBA4 80000 13 Trophy Oxide Station
08FBA4 100000 14 Trophy Coco Park
08FBA4 200000 15 Trophy Tiny Arena
08FBA4 400000 0 Sapphire Dingo Canyon
08FBA4 800000 1 Sapphire Dragon Mines
08FBA4 1000000 2 Sapphire Blizzard Bluff
08FBA4 2000000 3 Sapphire Crash Cove
08FBA4 4000000 4 Sapphire Tiger Temple
08FBA4 8000000 5 Sapphire Papu's Pyramid
08FBA4 10000000 6 Sapphire Roo's Tubes
08FBA4 20000000 7 Sapphire Hot Air Skyway
08FBA4 40000000 8 Sapphire Sewer Speedway
08FBA4 80000000 9 Sapphire Mystery Caves
08FBA8 1 10 Sapphire Cortex Castle
08FBA8 2 11 Sapphire N.Gin's Lab
08FBA8 4 12 Sapphire Polar Pass
08FBA8 8 13 Sapphire Oxide Station
08FBA8 10 14 Sapphire Coco Park
08FBA8 20 15 Sapphire Tiny Arena
08FBA8 40 16 Sapphire Slide Coliseum
08FBA8 80 17 Sapphire Turbo Track
08FBA8 100 0 Gold Dingo Canyon
08FBA8 200 1 Gold Dragon Mines
08FBA8 400 2 Gold Blizzard Bluff
08FBA8 800 3 Gold Crash Cove
08FBA8 1000 4 Gold Tiger Temple
08FBA8 2000 5 Gold Papu's Pyramid
08FBA8 4000 6 Gold Roo's Tubes
08FBA8 8000 7 Gold Hot Air Skyway
08FBA8 10000 8 Gold Sewer Speedway
08FBA8 20000 9 Gold Mystery Caves
08FBA8 40000 10 Gold Cortex Castle
08FBA8 80000 11 Gold N.Gin's Lab
08FBA8 100000 12 Gold Polar Pass
08FBA8 200000 13 Gold Oxide Station
08FBA8 400000 14 Gold Coco Park
08FBA8 800000 15 Gold Tiny Arena
08FBA8 1000000 16 Gold Slide Coliseum
08FBA8 2000000 17 Gold Turbo Track
08FBA8 4000000 0 Platinum Dingo Canyon
08FBA8 8000000 1 Platinum Dragon Mines
08FBA8 10000000 2 Platinum Blizzard Bluff
08FBA8 20000000 3 Platinum Crash Cove
08FBA8 40000000 4 Platinum Tiger Temple
08FBA8 80000000 5 Platinum Papu's Pyramid
08FBAC 1 6 Platinum Roo's Tubes
08FBAC 2 7 Platinum Hot Air Skyway
08FBAC 4 8 Platinum Sewer Speedway
08FBAC 8 9 Platinum Mystery Caves
08FBAC 10 10 Platinum Cortex Castle
08FBAC 20 11 Platinum N.Gin's Lab
08FBAC 40 12 Platinum Polar Pass
08FBAC 80 13 Platinum Oxide Station
08FBAC 100 14 Platinum Coco Park
08FBAC 200 15 Platinum Tiny Arena
08FBAC 400 16 Platinum Slide Coliseum
08FBAC 800 17 Platinum Turbo Track
08FBAC 1000 0 Token Dingo Canyon
08FBAC 2000 1 Token Dragon Mines
08FBAC 4000 2 Token Blizzard Bluff
08FBAC 8000 3 Token Crash Cove
08FBAC 10000 4 Token Tiger Temple
08FBAC 20000 5 Token Papu's Pyramid
08FBAC 40000 6 Token Roo's Tubes
08FBAC 80000 7 Token Hot Air Skyway
08FBAC 100000 8 Token Sewer Speedway
08FBAC 200000 9 Token Mystery Caves
08FBAC 400000 10 Token Cortex Castle
08FBAC 800000 11 Token N.Gin's Lab
08FBAC 1000000 12 Token Polar Pass
08FBAC 2000000 13 Token Oxide Station
08FBAC 4000000 14 Token Coco Park
08FBAC 8000000 15 Token Tiny Arena
08FBAC 10000000 ? ? ?
08FBAC 20000000 ? ? ?
08FBAC 40000000 N/A Key Ripper Roo
08FBAC 80000000 N/A Key Papu Papu
08FBB0 1 N/A Key Komodo Joe
08FBB0 2 N/A Key Pinstripe
08FBB0 4 N/A Star N. Oxide
08FBB0 8 ? ? ?
08FBB0 10 ? ? Hub 2 Access Door
08FBB0 20 ? ? Gem Cups Access Door
08FBB0 40 ? ? Hub 1 Hub 3 Access Door
08FBB0 80 ? ? Hub 2 Hub 3 Access Door
08FBB0 100 ? ? Hub 4 Access Door
08FBB0 200 ? ? ?
08FBB0 400 ? Red Gem N/A
08FBB0 800 ? Green Gem N/A
08FBB0 1000 ? Blue Gem N/A
08FBB0 2000 ? Yellow Gem N/A
08FBB0 4000 ? Purple Gem N/A
08FBB0 8000 21 Token Skull Rock
08FBB0 10000 19 Token Rampage Ruins
08FBB0 20000 23 Token Rocky Road
08FBB0 40000 18 Token Nitro Court
08FBB0 80000 ? ? ?
08FBB0 100000 ? ? ?
08FBB0 200000 ? ? ?
08FBB0 400000 ? ? ?
08FBB0 800000 ? Hint Using a Warp Pad
08FBB0 1000000 ? Hint Accessing a Track
08FBB0 2000000 ? Hint Using a Boss Garage
08FBB0 4000000 ? Hint Entering Oxide's Space Ship
08FBB0 8000000 ? Hint Opening World Doors
08FBB0 10000000 ? Hint Load-Save Screen
08FBB0 20000000 ? Hint New World Greeting
08FBB0 40000000 ? Hint Exit
08FBB0 80000000 ? ? ?
08FBB4 1 ? ? ?
08FBB4 2 ? ? ?
08FBB4 4 ? ? ?
08FBB4 8 ? ? ?
08FBB4 10 ? Hint Hang Time Hint
08FBB4 20 ? Hint Power Sliding Hint
08FBB4 40 ? Hint Turbo Boost Hint
08FBB4 80 ? Hint Brake Slide Hint
08FBB4 100 ? Hint Double Locked World Doors
08FBB4 200 ? ? ?
08FBB4 400 ? ? ?
08FBB4 800 ? ? ?
08FBB4 1000 ? Hint Wumpa Fruit Hint
08FBB4 2000 ? Hint TNT Hint
08FBB4 4000 ? Hint Map Information
08FBB4 8000 ? Hint Bonus Rounds
08FBB4 10000 ? Hint CTR Challenge
08FBB4 20000 ? Hint Gem Cups
08FBB4 40000 ? Hint Secret Tracks
08FBB4 80000 ? Hint Relic Race
08FBB4 100000 ? ? ?
08FBB4 200000 ? ? ?
08FBB4 400000 ? ? ?
08FBB4 800000 ? ? ?
08FBB4 1000000 ? ? ?
08FBB4 2000000 ? ? ?
08FBB4 4000000 ? ? ?
08FBB4 8000000 ? ? ?
08FBB4 10000000 ? ? ?
08FBB4 20000000 ? ? ?
08FBB4 40000000 ? ? ?
08FBB4 80000000 ? ? ?

feos: This run triggers the ending from the Adventure mode, by corrupting memory during other modes. As I said in the thread, this counts as tricking the game into considering itself completed, unlike the Battle mode glitch alone. After the credits roll, the game behaves the same as in the published run, which is another legitimacy proof.
While this run can probably be improved by skipping some extra logic, that doesn't mean this movie is sloppy. Also since we jump straight to the ending, it's a "game end glitch", not a "warp glitch".
Accepting as a new branch.
Spikestuff: Publishing.
Last Edited by adelikat on 11/6/2023 5:18 PM
Page History Latest diff List referrers