Submission #7685: BruceShankle, Fox, andzura & Seedborn's N64 The Legend of Zelda: Majora's Mask "game end glitch" in 22:44.10

Console Nintendo 64 Emulator Bizhawk 2.6.1
Game Version JPN v1.0 Frame Count 81846
ROM Filename Zelda no Densetsu - Mujura no Kamen (Japan) Frame Rate 60
Branch game end glitch Rerecord Count 46295
PowerOn Authors BruceShankle, Fox, andzura
(Additionally: Seedborn)
Submitted by BruceShankle on 9/8/2022 4:59:43 AM

Submission Comments


If you plan on encoding this movie, please stop your encode on frame 85049 so that the "The End" frame is displayed for exactly one second. Thank you. This TAS should sync in any resolution or with any GLideN64 plugin settings as long as "UseDefaultHacks" is set to "True". If you would like to change the plugin settings for playing back the movie, remember to remove or edit the SyncSettings file from the .bk2, otherwise it will use the default settings included in the movie file. However, the default plugins settings for this movie file follow this page as a reference ( ), so that HD encodes made without modifying or removing the movie's SyncSettings.json file will turn out great!
You can also find the the bizhawk emulator used to make this TAS, the TAS movie file, an FFV1 lossless encode, lua scripts, and ffmpeg on my archive page:

Where can I watch it?

Commentated Uncommentated

Wait, haven't I seen this TAS before?

This is an updated version of our N64 any% (classified as game end glitch) TAS of The Legend of Zelda: Majora's Mask which has better entertainment value (in my opinion) and very slightly better optimization. The only actual optimizations applied to this movie in comparison to the last movie was 1 frame in entering file 1, 6 input frames in the skull kid fight, and 1 frame entering file 2. The remaining frames that were saved came from less loading times that were due to having less controllers plugged in as well as from loading zone lag manipulation. Below, you will find the same or very similar information regarding the exploits used in this run in comparison to the slower TAS. Some minor edits have been made to the previous submission's notes to provide more clarity.

Movie Details

  • Emulator: Bizhawk 2.6.1
  • Core Type: Pure Interpreter
  • Active Video Plugin: GLideN64
  • Controllers: 1 and 3
  • Game Version: Japanese 1.0
  • Rom SHA1: 5FB2301AACBF85278AF30DCA3E4194AD48599E36
  • Profile: N64 Tool-assisted Speedruns
  • Required Plugin Settings: UseDefaultHacks TRUE
  • Frame Count: 81,846
  • Rerecord Count: 46,295

RAM Memory Addresses used

  • 1EF48C - Current File (8 Byte, Hex, must be viewed in hex editor)
  • 50B28C - Secondary File (8 Byte, Hex, must be viewed in hex editor)
  • 3FFFC4 - X (4 Byte, Float)
  • 3FFFC8 - Y (4 Byte, Float)
  • 3FFFCC - Z (4 Byte, Float)
  • 1EF46C - Time of Day "ToD." (2 Byte, Unsigned)
  • 40005E - Facing Angle "FAC. ANG." (2 Byte, Unsigned) (2 Byte, Hex)
  • 400A74 - Movement Angle "MOV. ANG." (2 Byte, Unsigned)
  • 400A70 - Speed "SPE." (4 Byte, Float)
  • 3E704A - Vertical Camera "VERT. CAM." (2 Byte, Unsigned)
  • 3E704C - Horizontal Camera "HORI. CAM." (2 Byte, Unsigned)
  • 1EF49A - Rupee Count "RUPEES" (2 Byte, Unsigned)
  • 3FF3B0 - Room Number "ROOM" (1 Byte, Unsigned)
  • 1EF506 - Bomb Ammo (1 Byte, Unsigned)
  • 3E89C4 - Bomb Actor Count "BOMB ACTORS" (1 Byte, Unsigned)
The names of each address were shortened to reduce the amount of text being displayed while making the TAS.

Glitches, Techniques, and Game Mechanics

  • Textboxes and Cutscenes: A little known mechanic about textboxes and cutscenes, is that advancing textboxes on the earliest frame possible is not always necessary for triggering the next textbox on the earliest frame, because the game has a timer for how long it has to display the cutscene the textbox is displayed on. This is why you sometimes see some delayed textboxes, because they didn't need to be cleared on the first frame possible to achieve the best time. And in terms of textbox mechanics, normal textboxes can be advanced by pressing A, B, or C-up at the end of the dialogue, although some textboxes can be "quick-text" where pressing B will immedietly display all the textbox, allowing you to advance the textbox much sooner than normal textboxes.
  • File Name Code: File names can be used to write code when setup properly, and whenever a file is created, its name is written into an unused portion of memory until the game is reset. Because the current file name you are playing on is always loaded somewhere else in memory, this gives us access to 2 file names to point to using SRM.
  • Curved Backwalking: Holding slightly down and to the left or right relative to link and the current camera when z targeted allows you to curve the momentum of your backwalk. This is important for crossing long distances that aren't completely straight, such as the beginning of lost woods, or for when you need to open a door and using sidehops puts link too far away from the door to outspeed backwalking.
  • Curved Sidehoping and Backflipping: Holding any direction (that isn't the last frame of the sidehop/backflip) allows you to shift the movement angle. This is important in sections where you shouldn't move in a straight line, such as in the next area of the lost woods where link sidehops across the stumps.
  • Untargeted Initial Sidehops/Backflips (I don't have a good name for this): When you sidehop or backflip by pressing A without being in a targeted state and retarget by pressing Z afterwards, it causes your current movement angle to shift in the direction you were sidehoping/backflipping towards. For example, if you were to do an untargeted sidehop to the left and retarget, your next sidehop would act as if link had turned slightly to the left, putting him slightly down of left relative to the initial sidehop.
  • Untargeted Deku Sidehops/Backflips: If deku link is not targeted while airborne during a sidehop/backflip, he will turn in the moving direction until retargeted. This is useful because every other form of link has to land on the ground before being able to make any significant changes to the direction of their sidehops, which costs 2 extra frames, though it may only cost you one frame since link continues moving on the frame you change his facing angle.
  • Z-targeting with walls: Pressing Z-target while up against a wall will force links facing angle to align with the wall. If you do this during an untargeted sidehop, it also shifts link's momentum towards the wall. This is useful during fox's TAS of the stock pot inn, where he uses this technique to fall forward under the upper wall to get around a corner faster.
  • Z-Sliding: Pressing Z every other frame allows you to retain your current speed without being affected by slopes. By pressing Z during the 2nd input frame of an untargeting visual frame, you can Z-Slide without losing your speed while z-target is being locked on an object, such as the dog in south clock town. Z-slides are typically done out of a backwalk or a Hyper Extended Superslide, though it can be performed from most grounded movement.
  • Superslide: A superslide occurs when link rolls into a grabbable object while shielded, then grabs the object with A and then takes recoil damage from an explosion. The superslide will end if you let go of the R to stop shielding, causing link to stop by picking up the item that was superslided off, even if it isn't currently loaded. This is one of the most common ways to perform Stale Reference Manipulation.
  • Hyper Extended Superslide: HESS for short, rolling into any kind of damage source during one of two correct frame of link's roll animation and holding the extended superslide position (which requires a minimum of 16x, as opposed to Ocarina of Time's 8x) on the control stick, will momentarily cause link to gain -18 speed, allowing link to quickly travel backwards using methods like the extended superslide position or Z-sliding to retain the speed. His directions can be controlled by holding ESS in the opposite direction of where link needs to be pivoted. Holding Z in this state will allow you to move in the opposing direction of the control stick without changing link's facing angle.
  • Extended Superslide Position: ESS for short, holding a minimum of 16x on the analog stick in any direction that isn't link's facing angle will cause link to turn to the direction of the analog input relative to the camera. This is mostly useful for maintaining the negative speed gained from HESS's, but it can be used for ESS-twisted sidehops/backflips as well.
  • ESS-Twisted Sidehops/Backflips: Holding the ESS position on the analog stick until link's movement angle has shifted will allow you to change link's facing angle and use Z to target on the same frame. If you backflip or sidehop during this time after changing link's facing angle this way, link will shift his current facing angle to the pre-targeted facing angle. This can be entertaining to see during playarounds but can also be useful in some circumstances where you are not traveling in a straight line. But this technique unfortunately seems limited to a certain range of angles depending on the current camera.
  • Gainer: If you target a wall and backflip without holding Z and retarget the wall on first frame of the backflip, you can use the backflip to climb low hanging ledges that could be otherwise unreachable. An example of this being useful would be the platform in front of the clock tower doors, which is otherwise unreachable without using the business scrub deku flower (which would cost time), or using a gainer on the wall closest to the silver rupee chest in east clock town as zora link to reach the chest faster.
  • Lost Woods Tatl and Deku Flower Skip (very precise movement): It is possible to skip Tatl's textbox near the deku flower and the flower itself at the end of the lost woods using a precise backwalk around the textbox trigger in combination with a VERY precise spin-jump to popup on the ledge.
  • Escaping East Clock Town: It's possible to easily escape east clock town by backwalking against the guard on the side of the entrance closest to the milk bar/inn. This is used to collect rupees outside of clock town as well as skip the north clock town introduction cutscene.
  • RNG Manipulation: It's possible to manipulate seemingly random events in the game without losing time by making analog inputs while an area is being loaded, giving you a different RNG seed. This was used to manipulate the bombers kids to be farther away from link so that pressing A to sidehop does not trigger their textboxes, as well as before 2nd cycle Termina field to get two bomb drops and before the observatory to get the blue rupee drops from each pot to be directed towards link. These manipulations are done using a lua script that generates random inputs between up, down, left right, upleft, upright, downleft, and downright.
  • Loading Lag Manipulation: To start explaining this section, first let's get one thing out of the way. Majora's Mask does not load area's in the same way as Ocarina of Time. You may enter a load zone and end up outside on one frame, but if you enter that load zone and make a any kind of input right before the loading starts, you may end up coming out a frame later, or sometimes a frame sooner than you would have if you had not held any inputs. RNG manipulation, which is done by making inputs while the game is loading, seems to affect future loading zones and how they react to inputs being made before the load. You can end up in a circumstance where performing RNG manipulation causes the first, second, or third loading zone from that point to have an unpreventable extra frame of lag, but it's completely unpredictable, which means it has to be accounted for by testing it manually. But some loading zones have a "cursed seed", which is a scenario where no matter how many manipulations you perform with your current RNG, there is no way to accomplish your desired result. This TAS had a cursed seed, which occurs after the 2nd hard reset, in which we need to collect two RNG bomb drops in Termina field and manipulate the pot drop trajectories to hit link. While only testing random inputs from the loading zone to Termina field, it was impossible to guarantee those results. So I began doing RNG manipulations in earlier loading zones so that we would have a different seed to use when we manipulated in the loading zone to termina field. In earlier loading zones, such as the load to clock tower and the load to south clock town, performing the RNG manipulation would cause us to be cursed with an unremovable lag frame in the load to termina field. But then I did 5 different manipulations with the loading zone to east clock town and we still ended up with a lag frame. Notice how I didn't say "unremovable" this time? Because certain lag frames can be remedied by making an input on the analog stick for at least one frame during link's state prior to the load while link is entering the loading zone. Based on my testing, your manipulated RNG can affect the loading zone lag as well, which was such the case with the RNG manipulated in the loading zone to west clock town from day 3, in which nearly every other RNG seed seems to have caused a lag frame upon re-entering SCT with the same inputs. In short, to optimize for loading zone lag, you should avoid holding inputs on the analog stick during link's uncontrollable state when entering a loading zone to prevent possible lag frames, but you should test to see if holding an input happens to cause your load to happen sooner and use that if it does. When factoring in RNG manipulation, you must take into account that the RNG could affect whether you get the lag frame or not (depending on the circumstances). Try to setup a scenario where RNG does not affect the lag, so that you can effficiently optimize RNG with lua scripting. Otherwise, you may be encountering frequent desyncs and wasted script time. This is not a well understood mechanic, as it seems I am the first person to have found it, so there's not much known about how it actually works. I can only suggest ways to get around the extra lag frame which can sometimes happen.
  • Input Lag: The previous events that have lead to the game's present state seem to affect which frames the game checks your inputs, even if there isn't any noticeable visual lag. This is noticeable during the heap setup for SRM, as executing the same input file even with a working RNG seed for aligned pot drop trajectories is nearly guaranteed to result in a desync during either the input change during the HESS, and sometimes during both the first and third backwalks as well. Because of input lag, whenever a new optimization was found to the run after the 2nd hard reset, I had to redo the inputs for manipulating the SRM heap due to different amounts of input lag each time. Despite coining the term "input lag" though, there is no in-game lag, the inputs are just processed on different frames.
  • Cutscene Skipping: The Happy Mask Salesman Cutscene can be skipped by never being on the cutscene trigger for more than one frame at a time. This can be done by continuously pausing the game to advance the game one frame at a time. Cutscenes that occur just after the game is saved can be skipped by hard-resetting the game, such as after exiting the clock tower for the first time or anytime after confirming the song of time textbox.
  • Stale Reference Manipulation: Often referred to as SRM for short, is a technique to write data to a referenced location that isn't pointing to the original actor it was supposed to point to. This can be used for various purposes such as modifying a chest's contents to rely on link's angle, run the current file names as code (N64 only), or even skip first cycle (Wii only).
  • Arbitrary Code Execution: Often referred to as ACE for short, is a technique available in few games, which allows controller inputs to be ran as code within the game. It is the most potent glitch any video game can have, as it allows literally anything within the limitations of the console/emulator to occur.

The Route

1st Cycle

  1. Setup File 1 to write the "080200BE AF801448" hex code.
  2. Get to clock tower from the lost woods.
  3. Skip the Happy Mask Salesman cutscene using pause buffers to prevent the game from having two frames of being in the cutscene trigger.
  4. Hard-reset the game after the game saves to skip a cutscene with Tatl.
  5. Reach night of the 3rd day by advancing time using grandma's stories and the scarecrows dancing.
  6. Collect the stray fairy in east clock town and escape east clock town.
  7. Collect at least 50 rupees by manipulating the RNG from the patches of bushes Termina Field and get the magic reward from the NCT great fairy.
  8. Buy the bomb bag from the bomb shop and use a gainer to reach the clock tower platform.
  9. Wait until midnight for the clock tower door to open (this is the main reason why first cycle takes such a long time to complete)
  10. After the clock door opens, shoot a deku bubble at skull kid and collect the ocarina of time.
  11. Learn the song of time and equip bombs along with the ocarina of time. This is the only pause in this TAS.
  12. Hard-reset after saving the game through confirming the song of time save prompt.
1st cycle is an unavoidable part of this TAS because there's no known way to become human without getting the ocarina and learning the song of time. If it was possible to get any mask at all as deku link, we could use a glitch with honey and darling minigame to become human, but currently there's no way to do that. So for now, the best thing we can do is use the NPC's around clock town to advance the in game time to night of the final day, and collect the bomb bag so that we can use bombs later on in the TAS. The best way to do this is to skip as much waiting time as possible using grandma's 2nd story that advances to the next day and the scarecrow's dancing which advances by 12 hours each. Escaping east clock town allows us to collect the required rupees to buy bombs for later usage and skip the north clock town entrance cutscene by entering from Termina field.

2nd Cycle

  1. Setup File 2 to write the "0807BD23 3C1C8017" hex code.
  2. Load file 1 and enter the clock tower.
  3. Learn the song of healing and obtain the deku mask.
  4. Leave Clock Town through the east entrance and obtain 2 bomb drops from the closet patch of grass via RNG Manipulation.
  5. HESS using the nearby chuchu as a damage source and clip behind the fence around the observatory using an acute angle with the wall, and then use a Z-slide to redirect link's movement angle to reach the observatory door faster.
  6. Manipulate the Actor Heap using bombs between observatory (room 1) and the hideout (room 0).
  7. Trigger SRM by supersliding off of a pot using a bomb that is placed to apply recoil link to link without breaking the pot
  8. Release the Z button while the camera is inverted to twist the camera away from the observatory and cull (unload) the pot by having it off-camera.
  9. Re-enter the observatory and drop the SRM within a certain range of angles to point to the moons tear draw function.
  10. Make link's last targeted angle either EE8C, EE8D, EE8E, EE8F or EE90 in hex and face angle 0807.
  11. Pull out the ocarina to pan the camera with link's current facing angle to load the moons tear draw function.
  12. Use the two loaded file names to allow controller 1 and controller 3 to write inputs that can be ran as code.
In the 2nd cycle, now that we can become human, after making it to the observatory and doing some heap manipulation, we can trigger the SRM glitch I mentioned earlier. We can use this glitch to get the game to run controller 1 and 3's inputs as code, and load the end of the credits. The credits noticeably doesn't have any music, because we didn't warp to the start of the credits that triggers the music. This is because at the start of the credits, there are multiple textboxes that require inputting A, B, or C-up to advance, and TAS timing ends on the last frame of input, not the first frame of the credits, unlike RTA timing. We also warp to the end specifically because otherwise the credits do not play out correctly, and the player will regain control of link during the credits.

Technical Explanation of Total Control ACE, by Seedborn

By passing through a loading plane while grabbing a pot, Link is in the state of 'holding' an actor which is no longer loaded. By loading other actors at an offset in that space, the properties of the grabbed item that Link is supposed to be affecting (e.g. position, rotation) become ways of writing over the new actors' data. We take advantage of this by corrupting a pointer to the function that draws the Moon's Tear present in the observatory. We redirect this pointer into Link's instance, and by manipulating his angles further redirect execution to the controller inputs.
Filenames in the game are 8 bytes, and so can be used to form mips instructions (within the limits of the Japanese characterset). Fortunately, Majora's Mask keeps a stale copy of the name of the last created file in RAM, which allows us to use the names of two separate files to form these instructions. When we redirect the game's execution to the controllers, the first thing that controller 1 does is jump to the secondary file name, which then jumps to the primary file name and then away to normal execution. Along the way we are able to erase an instruction that suppresses input from the other three controllers, which means that now we can form instructions using multiple controllers (only the inputs of controllers 1 and 3 are 4 byte-aligned in RAM, so only those two can form full instructions).
Reserving controller 3 for a jump to safe execution, controller 1 can form nearly arbitrary instructions each frame. This allows us to write a small snippet of code which, when executed, sends us to the final cutscene of the credits (and also removes the usual fadeout).

Contributors to this TAS

  • Türkenheimer helped me determine the fastest combination of file names for triggering the total control ACE.
  • Rylie walked me through how the heap manipulation worked and explained how the angles could be setup.

What is Each Author Responsible For?

  • I, Edwin Bruce Shankle IV, TAS'd the 1st lost woods section, the 1st half of the 2nd lost woods section, movement to the inn, movement to WCT from ECT, night 3, and 2nd cycle, except for the last ACE angle, as well as the RNG manipulation for the two bomb drops in Termina field and the pot rupee spawn trajectories. I've also redone this entire TAS several times due to re-optimizing, desyncs, finding better file names, having the wrong file name to begin with, etc. This may be 6th or 7th time redoing this, but it is my BEST! At this point, if this run is ever beaten without any new strategies, it will be from lag reduction in some way that isn't currently known about.
  • Fox TAS'd the 2nd half of the 2nd lost woods section, the pause buffered HMS CS skip, the stock pot inn movement, and the movement to the scarecrow shop. There's no way this TAS would have as much optimization as it does today without Fox's help, he essentially TAS'd the two most precise tricks in the entire run which I don't think anyone else could pull off as well as he did.
  • Andzura TAS'd the flower angle to sync fox's inputs for 2nd half of the 2nd lost woods section, lua scripted RNG manipulation for the two bomb drops in termina field, lua scripted rupee spawn trajectories in the observatory, found the input for the last angle before Seedborn executed ACE, and researched the heap manipulation. He has ran his lua scripts for this movie several different times, I really appreciate how much work he has put into making this TAS possible.
  • Seedborn TAS'd the inputs for total control Arbitrary code execution to load the end of the credits using controllers 1 and 3. He also wrote the technical explanation of ACE for this submission, and looked over this submission with me for a little bit, as well as providing the addresses for file name 1 & 2 and discovering ACE in the first place. He's the real legend here.

Closing Notes and 1st Cycle Skip

I hope you had as much fun watching this TAS as I did making it! This is currently the most optimized N64 any% (referred to as game end glitch on tasvideos) TAS of this game, although I expect that if there is ever a Wii TAS of this game submitted, it will easily beat this run by several minutes even with much less optimization due to this new (new to me) method of skipping first cycle using a Wii-exclusive SRM that crashes on N64:
It's also possible to skip first cycle by using SRM to obtain a normal mask after collecting a map from tingle, as demonstrated by Türkenheimer today:
A similar approach used SRM in Grezzo's 3DS Remake of Majora's Mask to obtain the Keaton mask during 1st cycle, which if was possible in this run, would also allow us to skip 1st cycle by equipping the mask during the honey & darling mini-game on the third day.
If there becomes another method to perform SRM that allows deku link to turn human during 1st cycle, and it happens to not crash on N64, then this TAS will be outdated. Until then, I believe this TAS is up-to-date based on what we know about Majora's Mask today. This run is a giant leap for TAS optimization standards, yet we're still one small step away from first cycle skip, hence one of the reasons so many people found this TAS boring due to the abundance of mandatory cutscenes. I really hope that there is eventually a discovered way to skip first cycle in Majora's Mask, then we could go to the observatory right away and load the credits even faster. Or perhaps it would allow for an even faster way of demonstrating some of the crazy things that are possible using N64-exclusive Total Control Ace, such as this demonstration from Seedborn here:

Samsara: Delaying at the author's request until a final file is provided.
Samsara: It appears that there will be no further improvements, so replacing with the final file and resuming judgement.

Last Edited by BruceShankle 3 days ago
Page History Latest diff