Game objectives

• Emulator used: FCEUX
• Heavy glitch abuse
• Luck Manipulation
• Uses damage to save time
• Uses game restart sequence
• Executes arbritray code

Comments

Route

Technical explanation

Using saveslot 1

The current saveslot is stored in $16 and using the 1st slot gives value 0x00. Using the 3rd saveslot, which is faster when typig in the name, gives value 0x02. That is bad, because that would crash the game when the PC runs over this instruction. That's why the 1st slot is used, the opcode 00 does nothing.

Collecting a rupee

The rupee is collected, because of the nice sound it makes. After the sound played, address $0618 will be 0x4C, with the next 2 bytes that results as an JMP $0000.

Waiting for the random numbers

It is crucial to get from $18-$24 into somewhere where the memory can easily manipulated, because at $59 there will be always a 0x02. In this case a branch BNE $5F at $23 to the Y positions is taken. I made a list with the numbers of the RNG to see when a branch would happen.

Positioning the enemies

To get the item glitch, the area around $EC6E needs to be executed. It is possible to use a direct jump, but it turned out to be slower, because of the last enemy that spawns. So a indirect jump is used. Link will be at Y position 0x6C, the ghost which is already there will at Y position 0x9A and the last spawned ghost will be at Y position 0xB3. All this together will result in JMP ($B39A) wich jumps to $EC69. After positioning the enemies a long pause is used to wait for the random numbers.

Playing the flute

Because every slot for objects on screen is already used, the ghost AI will jump to $0602. From there it will execute the memory which is set up.

Item glitch

The item glitch overwrites that area where the items, collected rupees from caves and opened caves are. To use the glitch items the item index $0656 needs to be greater than 8 and the area where the item index is needs to be filled with something not equal to 0, or else the item index will be set back to 0 if there are to many zeroes between two addresses. In this case the item index is set 0x6E and the whole area from $0602 to $0701 is overwritten. Besides the glitch items the cave to level 9 needs to be opened, $067F needs to be greater or equal to 0x80.

Preventing a crash

The game would crash after the item glitch, but when visiting the menu and closing it again at the right frame, the crash can be prevented.

Warp bombs

Item index 0x66 refers to the warp bombs. It makes the screen scroll and warps to the last visited screen in the screen history. The warp happens instantly, so a room can be load instantly without moving.

X position ACE item

Item index 0x76 executes $1870, where a copy of the X positions are. So an opcode which jumps to the credits $B7C7 is needed. Again an indirect jump is used again, man I love these. Link is at X position 0x6C, the first enemy at 0x7C and the next at 0x9A, which will result in JMP ($9A7C), that makes the PC jump to $B7C4.

Thanks to...

• RAT926 for finding the item glitch.
• Sockfolder for documentation on the glitch.
• Masterjun for documentation on the glitch and finding the credits glitch. Although he doesn't have any inputs on this run, he still is a co-author, because I would be a bit helpless on the credits glitch.