(Link to video)
Recently, a glitch was found that can replace an egg with a null sprite so that you can basically take any sprite with you. I use this glitch to confuse the game with its indexing and jump to controller data to manipulate some data and jump to the credits.

Game objectives

  • Emulator used: lsnes rr1-Δ18
  • Aims for fastest time
  • Abuses programming errors in the game
  • Executes arbitrary code
  • Achieves credits early

Comments

The glitch happens when you grab the egg from the head of a Mouser and let him despawn before he "realized" that you took it from him (without him touching the floor). Then the egg also despawns but you still "have" this egg (the RAM value of the egg counter is still showing that you have this egg) and the sprite slot of that egg is also saved, but opened so that every sprite can take its place. So far so good but the problem that people had was that when they went into the goal ring, the game crashes for 99% of the sprites that were brought. So I took a look at what was going on with the game and found out that it checks every egg you have and indexes it so that every different sprite ID has it's own function (a normal egg just returns from this function). This is probably for the other sprites you can have, for example a key or a big egg and so on. I quickly found out that a Shy Guy will bring the code to $02:608C... and that just happens to be the x position of Yoshi!
So $608C is the low byte, $608D is the high byte, $608E is the y subposition and $608F is some value from 0x04 to 0xFC (probably for calculation stuff)
So I want to jump to controller data, that would be JMP $4218, in hex: 4C 18 42, but I had a better idea that made the run a bit faster: instead of JMP $4218 I would JML $024218, in hex: 5C 18 42 02, because getting my x position to 0x5C instead of 0x4C was faster.
So I will cover changing x position low byte later, but how do I change my x position high byte to 0x18? I don't! The high byte is 0x0E at the end of 2-2 and jumping to $420E wasn't a problem because YI is good at recovering from BRKs (0x00), so I just let the game jump over some of the registers. Changing y subposition to 0x42 wasn't a big problem either, you just have to press B and release B at the correct times, and the last value wasn't a problem, it just was 0x02 (it could have been every value from 0x00 - 0x04).
So now to the x position change. The goal ring is not movable so how do I trigger the goal ring while being at the correct position? I just use another null sprite egg to change the properties of the goal to make it possible to lick it and spit it out. Then it recovers itself so I can trigger it again.
When the code is at controller data, I couldn't just use WAI to get the next input, because IRQ is activated every H-Blank, so it will stop there. Changing the mode of IRQ (so that it only fires at V-Blank) also isn't possible since it changes itself back to the other mode. Deactivating IRQ also isn't an option because NMI is very short and returns while Auto-Joypad Read is enabled (so the controller data is garbage).
The way I did it was just activating DMA controllers to stop the game for a few frames (that is why strange things are going on with the video at the end). That worked wonderful and all I had to do was set Data Bank and Direct Page to zero, setting gamemode ($0118) to 0x1B and jumping to the start of the main game routine (which loads the gamemode and decides what to do/where to jump next) to trigger the credits. The good thing is that normally the main game routine is called at the highest stack value, meaning that the code will never return back to the controller data/egg routine/garbage code.

Stage by stage comments

Intro

Trying to get 14 coins as fast as possible to do the warp glitch to go to 2-2.

2-2

I took the fastest route I could think of while getting 4 eggs for the third/last room. There I had to manipulate sprite slots to do the glitch and win the game.

Other comments

Possible improvements

  • Maybe some tiny frame improvements in room 1 (any% like route)
  • Finding another glitch (infinite tongue glitch?) to reach credits faster

Thanks to

  • Arne for finding this glitch
  • Carl Sagan for the possible improvements
  • YI community for finding every glitch in the Game Resource page

Suggested Screenshots

[dead links removed]

Nach: Once of the most awesome runs of the year, accepting.

Patashu
He/Him
Joined: 10/2/2005
Posts: 4000
I'm hoping for Playaround myself, there's so much you can do with the glitch.
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Skilled player (1703)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Patashu wrote:
I'm hoping for Playaround myself, there's so much you can do with the glitch.
Maybe something along the lines of this movie, where the focus is on glitch abuse while still completing the game.
Experienced player (512)
Joined: 7/23/2011
Posts: 108
I have actually considered doing a playaround rather than simply remaking the any% TAS, which kind of is just a worse version of the 100% TAS. Though there are 5+ minutes of improvements to the any% TAS.
Spikestuff
They/Them
Editor, Expert player, Publisher (2254)
Joined: 10/12/2011
Posts: 6324
Location: The land down under.
Carl Sagan wrote:
I have actually considered doing a playaround rather than simply remaking the any% TAS, which kind of is just a worse version of the 100% TAS. Though there are 5+ minutes of improvements to the any% TAS.
GO GO GO GO CARL SAGAN (GALO SENGEN)
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. These colours are pretty neato, and also these.
Joined: 12/19/2007
Posts: 40
I'm downvoting because I don't think it should have obsoleted the previous run. Arbitrary Code Execution should always be a separate category. Always. Heck, I'm still not sure why these don't get put in the Vault. They are speed for speed's sake, which is what the Vault is supposed to be.
Editor
Joined: 11/3/2013
Posts: 506
trlky wrote:
I'm downvoting because I don't think it should have obsoleted the previous run. Arbitrary Code Execution should always be a separate category. Always.
Yeah good point about ACE being a separate category, someone should change that as I believe that such a policy was made official some time after this movie was created.
Masterjun
He/Him
Site Developer, Skilled player (1968)
Joined: 10/12/2010
Posts: 1179
Location: Germany
trlky wrote:
Heck, I'm still not sure why these don't get put in the Vault.
Because they're entertaining.
Warning: Might glitch to credits I will finish this ACE soon as possible (or will I?)
Editor
Joined: 11/3/2013
Posts: 506
Masterjun wrote:
trlky wrote:
Heck, I'm still not sure why these don't get put in the Vault.
Because they're entertaining.
Be fair, entertainment is subjective. Triky's opinion is in the minority, but it is not wrong. Though I do think triky should go watch some vault movies and that will give him a taste of what is truly boring.