(Link to video)
  • Emulator: lsnes rr2-beta23
  • Rom: Final Fantasy III (U) (V1.0)
  • Aims for fastest time
  • Uses game-breaking glitch
  • Abuses programming errors
  • Manipulates luck
During the previous TAS, we managed to get the Moogle Kutan in our crew to save the world. We are pleased to announce that this time, we also managed to get Kurin with us. As a side effect, we saved more than two hours and a half over the previous TAS, achieving a final time of 32 minutes and 54 seconds using a new game breaking glitch involving 52 gameover in a row on the world map.

Gameover glitch

On May 2015, a new ff6 glitch was discovered, where dying 52 times in a row on the world map leads to odd consequences. Often the game will freeze, sometimes it will trigger glitched cutscenes.

Deciphering

In this game, the developers have implemented a script language for scripted events, which contains everything from music, graphical effects, invoking windows, dialogues, character movements, etc. Two events in this game have a behaviour very close to the JSR and RTS assembly instructions. The first one (event B2) saves the pointer to the current event into a stack and starts executing a series of sub events. The second one (event FE) finishes the series of sub events by loading the event pointer from the top of the stack. Every call to event B2 is meant to be eventually followed by a call to event FE.
During a gameover screen, however, the game calls event B2 twice but only once event FE. This has the consequence of filling the event pointer stack, which can lead to a stack overflow with repeating gameovers. This is generally unnoticed, because entering any inside map (towns or dungeons) will clear the event pointer stack.
The event pointer stack is stored starting $0594 and the size of the stack is stored in $E8 and $12E8 (backup). The memory after this stack is largely unused, the only addresses that are often written by the game are located at $0630-$0632. The game repeatedly stores into $0630 the horizontal scanline location, into $0631 the vertical scanline location and into $0632 the maximum of all $0631 values. We are not sure if these values are actually used by the game.
After the 51 gameover, $E8 contains 0x99. At the 52nd gameover, the game writes the event pointer to $062D-$062F (first call to event B2) then to $0630-$0632 (second call to event B2). Before the game executes event FE, the values in $0630-$0632 have changed and contains the some scanline location coordinates. The game loads those values as the current event pointer, and executes events starting this location. This is what is causing the glitch.
By conducting a lot of tests, we observed that address $0630-$0632 is dependent on the frame where the gameover is confirmed, the inputs pressed 3 frames before confirmation and the number of characters in the party.

Triggering the ending

To trigger the game ending, one way is to set the event pointer to the address of the ending, which is located at $CA0F70 (just after the boss fight). However, the game will freeze if we jump there because it will try to move characters which are not present. Pointing after the post-Kefka dialogues does work, which was done in the present TAS (address $CA134E).
As expected, no value of $0630-$0632 comes near the values required to launch the ending sequence. Luckily, most of the values in $0630-$0632 actually point to RAM addresses, between $1700 and $2000. Here is a summary of what is present in these addresses:
$1600-$184F: Character data (592 bytes, 37 bytes each character)
$1850-$185F: Setup of current party (which party/slot/row for each character)
$1860-$1862: Gold
$1863-$1865: Game time
$1866-$1868: Steps
$1869-$1968: Items possessed
$1969-$1A68: Item quantities
$1A69-$1D4C: Espers, Magic, SwdTechs, Blitz, Lores, Rages, Dances
$1D4D-$1DC6: Menu configuration
$1DC7-$1FFF: Various stuff 

Our goal is to write somewhere in RAM an event that will jump to the ending. A few events can do that: B2, B3, B6, B7, BD, BE, C0-CF, following by the destination address (e.g. B2 4E 13 00 jumps to $CA0000 + $00134E = $CA134E). The values inside $0630-$0632 heavily depend on the number of characters in the party. Here is roughly which address we have access:
  • 1 character: $1700-$1900
  • 2 characters: $1900-$1B00
  • 3 characters: $1B00-$1D00
  • 4 characters: $1D00-$1FFF
The earliest point where we can trigger the glitch is with a party of two characters. With this party, we can jump to the addresses storing the inventory, the Espers and magics. The problem is that we cannot write any of the jumping events above in memory because no item with the corresponding id is available, and we are limited to 99 for item quantities. Of course, we don't have any Esper or magic available.
Then, for a very small time, we have access to a 1 character party (solo Terra) during Figaro castle. With this party, we can jump to part of the character data, gold, game time, steps and part of the inventory. Character data would have been very encouraging, but the only characters we can control are Terra and Locke, which are at the beginning of the section, outside our range. Like before, we cannot write the event code using the inventory, but we can use either one byte of the Gold or one byte of the step counter easily. The second problem was to write the destination address in RAM next to the event code, which is of the form XX 13 00 with XX being several values possible between 0x20 and 0x70. We couldn't manage to write these values, however we could make an intermediate jump to a much more friendly area in RAM where we can control values: the config menu. It is located starting $1D4D and luckily, we have access to the Mithril Pike (id 1D), the Buckler (id 5A) and the Mithril Shield (id 5C).
Here is the state of the memory starting $1860:
|     Gold     |   Game Time  | Step counter |                  Inventory
| A0 | xx | xx | xx | xx | xx | C1 | xx | xx |   01    |  00  |   5A    |   1D    |   5C    |
                                               Mithril | Dirk | Buckler | Mithril | Mithril |
                                               Knife   |      |         |  Pike   | Shield  |
We tried to jump directly to the step counter, but we only could jump to the Gold address. That is why we manipulated the first byte of the Gold value to be A0 (by selling stuff), an event which takes 5 bytes as argument, so that we arrive at the beginning of the step counter.
Event C1 has 3 arguments: t1 (2 bytes), t2 (2 bytes) and addr (3 bytes). The meaning of this event is: if the story bit t1 or the story bit t2 is true, then jump to $CA0000+addr. We manipulated t2 with the MithrilKnife and the Dirk so that the corresponding story bit is true. So the game jumps at $CA0000 + $5C1D5A = $261D5A, which is the RAM address $1D5A, in the middle of the colours of the windows.
Now we have full control over the events we can trigger. We previously changed the value of those colours so that the bytes starting $1D5A are:
  • 5B is a no argument event that does (almost) nothing. We couldn't write B2 on the first byte because the way the colours are stored implied that every other value must be below 7E.
  • B2 00 53 00 jumps to address $CA0000 + $005300 = $CA5300. This is the very end of the world destruction sequence that loads the World of Ruin maps. It was necessary to avoid a softlock during the game ending.
  • A9 triggers the game opening, because why not.
  • 5C is another dummy event like 5B
  • B2 4E 13 00 jumps to address $CA0000 + $00134E = $CA134E. This triggers the ending sequence.

Run comments

Narshe

As opposed to the previous TAS, we did not need to level-up Terra so that other characters who join get a higher level. However, we still need Terra to be at least level 4 so that the quick kill on Whelk is possible. The fastest way we found was to escape the first and fourth fights, to fight the third one and to make Wedge escape the second fight. This gives level 4-3-2 for Terra, Vicks and Wedge, respectively. The quick kill on Whelk was barely possible by manipulating the random damage to always be a high value. The fight against Marshal and Lobo was improved from the previous TAS by manipulating both Lobo not to attack. Both Mithril Pike and Mithril Shield are removed from Mog for the glitch.
Extra steps were used to manipulate the battle RNG, because we had to do a lot of steps anyway for the glitch.

Figaro

The inventory is sorted as described above during the two random fights to Figaro castle. After being solo Terra, two Tonics and 4 Echo Screen are bought to get Gold to xxxxA0. Then the remaining number of steps are performed to get the number xxxxC1 at the second fight in the world map.
The first fight in the desert is manipulated to get Terra's HP as low as possible. A critical could not be manipulated for the Sand Ray because this enemy has the bad habit of skipping his turn; it was replaced with his special attack.

Glitch

One step before the second fight, the battle speed was set to 1 so that the enemy can act faster. The fight to get the gameover to was chosen to be a solo enemy, so that the initial ATB are very high. 51 gameover later, the message and gameover screen were confirmed at the right frame and the input was chosen so that the game loads address $1860 as the event pointer. As explained above, this eventually triggers the ending.

Special Thanks

  • pirohiko for posting the new glitch in the ff6 topic
  • Catastrophe for helping disassembling the new glitch
  • Yousei for providing a very detailed description of the ff6 ROM, including the list of events
  • Imzogelmo for providing a dump of the entire list of events of the game

ars4326: (Replaced movie file with updated version that accesses full ending). Claimed for judging!
ars4326: Hello, Keylie and Kadmony. Fantastic work on executing this unique 'game end glitch' method, as well as listing out the intricate details in the submission text. The minor strategic optimizations made during battles were a treat to watch, as well. Altogether though, as others have expressed in the thread, there honestly just isn't too many ways that one can make 52 straight game-overs entertaining. The payoff of watching the glitched ending (with more Moogles, this time around!) was indeed enjoyable, but the more repetitive 15+ minute lead-in must also be considered. Outstanding work, nonetheless!
edit: Accepting for publication to the Vault, and to obsolete the current 'sketch glitch' run. Reason being, an issue was brought up in the thread concerning how this movie, initially (and similar to the 'sketch glitch' run) soft-locked at the end and didn't technically complete the game. Keylie addressed this and made some adjustments to this run which allowed the complete ending to take place. Therefore, for the sake of consistency, we've got to abide by this standard going forward. And since the 'sketch glitch' run soft-locks, it now must be obsoleted by a run that doesn't.
fsvgm777: Processing.

TASVideoAgent
They/Them
Moderator
Joined: 8/3/2004
Posts: 14776
Location: 127.0.0.1
Editor, Skilled player (1998)
Joined: 8/25/2013
Posts: 1198
RIP FF6 I loved you. Yes vote.
effort on the first draft means less effort on any draft thereafter - some loser
Synahel
She/Her
Joined: 1/19/2011
Posts: 259
Location: France
Having watched WIP and research closely This is amazing
Experienced player (670)
Joined: 11/23/2013
Posts: 2206
Location: Guatemala
Shouldn't the category be "game end glitch" to fit in with the others?
Here, my YouTube channel: http://www.youtube.com/user/dekutony
Senior Moderator
Joined: 8/4/2005
Posts: 5769
Location: Away
Warning: this does exactly what it says on the tin: 52 gameovers in a row. About 17.5 minutes in you will have seen everything there is to see in the movie, and can safely fast-forward/skip to the credits. I did a rough breakdown by time, and came to rather amusing ~15% of time spent on active gameplay (that mostly includes walking and running away from fights), ~30% dialogues and cutscenes, and ~55% for the actual glitch setup (that will give you brain cancer). Should it be published? Yes, definitely! Was it entertaining? Not in the slightest.
Kurabupengin wrote:
Shouldn't the category be "game end glitch" to fit in with the others?
It should.
Warp wrote:
Edit: I think I understand now: It's my avatar, isn't it? It makes me look angry.
Skilled player (1703)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
The game felt sorry for the player, and decided to simply give up out of pity. No vote in entertainment, but I'd rate it high technically.
Joined: 6/5/2005
Posts: 139
jlun2 wrote:
No vote in entertainment, but I'd rate it high technically.
this pretty much sums it up. Also yes vote because of Edgar flipping us the bird while levitating in the glitched ending sequence.
I like stuff...
Skilled player (1766)
Joined: 5/7/2008
Posts: 187
Location: Japan
Because an event flag is not enough, the ending sequence seems to stop in Kohlingen.
Joined: 2/15/2015
Posts: 12
The regular sketch% speedrun softlocks at the same point in the ending. It's waiting for an NPC to walk over a trigger but because it's not initialized properly he'll never get there.
Skilled player (1703)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Gyre wrote:
The regular sketch% speedrun softlocks at the same point in the ending. It's waiting for an NPC to walk over a trigger but because it's not initialized properly he'll never get there.
If it really bothers people, is it possible to modify the TAS so it won't softlock?
Joined: 3/9/2009
Posts: 530
jlun2 wrote:
Gyre wrote:
The regular sketch% speedrun softlocks at the same point in the ending. It's waiting for an NPC to walk over a trigger but because it's not initialized properly he'll never get there.
If it really bothers people, is it possible to modify the TAS so it won't softlock?
It seems like a valid concern. A number of runs that skip to one ending screen or part of the ending sequence have been rejected for not leaving the game in an actual completed state.
Joined: 2/15/2015
Posts: 12
I'm not bothered by the ending softlock. It might hurt the entertainment value a bit but we're talking about a run that involves watching 52 game overs. There are already accepted TAS and RTA runs of the sketch glitch which have the same problem with the ending. I'd expect they'd have to trigger the World of Ruin cutscene to fix it.
Dwedit
He/Him
Joined: 3/24/2006
Posts: 692
Location: Chicago
Should this be tagged as Executes Arbitrary Code?
Editor, Skilled player (1998)
Joined: 8/25/2013
Posts: 1198
Dwedit wrote:
Should this be tagged as Executes Arbitrary Code?
It's not ACE, as he just glitches to the ending as opposed to programming to the ending.
effort on the first draft means less effort on any draft thereafter - some loser
Player (12)
Joined: 6/17/2006
Posts: 498
Tangent wrote:
jlun2 wrote:
Gyre wrote:
The regular sketch% speedrun softlocks at the same point in the ending. It's waiting for an NPC to walk over a trigger but because it's not initialized properly he'll never get there.
If it really bothers people, is it possible to modify the TAS so it won't softlock?
It seems like a valid concern. A number of runs that skip to one ending screen or part of the ending sequence have been rejected for not leaving the game in an actual completed state.
Yes, and how this problem is resolved by judges appears to be completely inconsistent from submission to submission and game to game as well. It bothered me in the last published FF6 movie, and it still bothers me. I might start sounding like a broken record to a few people, but I'll repeat it again for everyone else: a softlock before the actual end screen does not count as beating the game in my opinion, and as long as TASVideos won't have an objective definition as to what counts as beating the game in the rules, I cannot accept this as a speedrun, but only as an interesting glitch exploit demonstration.
Joined: 6/12/2015
Posts: 2
SmashManiac wrote:
Yes, and how this problem is resolved by judges appears to be completely inconsistent from submission to submission and game to game as well. It bothered me in the last published FF6 movie, and it still bothers me. I might start sounding like a broken record to a few people, but I'll repeat it again for everyone else: a softlock before the actual end screen does not count as beating the game in my opinion, and as long as TASVideos won't have an objective definition as to what counts as beating the game in the rules, I cannot accept this as a speedrun, but only as an interesting glitch exploit demonstration.
If the completing the credits is to be considered having finished the TAS, then yes this doesn't complete the run. But I think a good philosophical case could be made that reaching the credits is a completed state, if you take examples from other forms of media. For example, do you finish watching a movie once you reach the credits, or do you have to watch the credits to say you have finished the movie? Or how about books, if you have a novel and the author left a personal message at the end of his book after the story, and you choose not to read the author's message, can you say that you finished the book? And in speed running different communities have elected to follow different views on the matter. Eg. By SDA rules when using real time, time ends when the player loses complete control at the credits, effectively saying that that is the point when the runner has completed the game. I'm not trying to say it should be one way or another; my point is more that it isn't as cut and dry as it might seem. I mean it's conceivable to have standards based on the kind of exploits involved in a run; which would allow for a more nuanced way of appraising submissions. BUT ANYWAY moving on to what I was going to post before I got side tracked into thinking about what it means to finish something.
jlun2 wrote:
[...] is it possible to modify the TAS so it won't softlock?
Gyre's got the right idea, instead of jumping to the address of the credits; you would jump to the address of the cutscene where the world gets remodeled by Kefka. That would then leave you at the beginning of the World of ruin with Kutan. So the hypothetical modified TAS would have to do this whole process twice.
Senior Moderator
Joined: 8/4/2005
Posts: 5769
Location: Away
Many games have a boolean "finished" flag which helps us identify if the game considers itself finished in case credits are skipped (like in the SMW glitch run). This TAS jumps to the credits, but neither it nor the previous glitched TAS confirm that "show credits early" equates to "game is finished". I'm not saying that it necessarily means this run or its predecessor should be somehow discarded, but this needs to be looked at very carefully. It is possible that in this case the game indeed considers itself finished, but still needs to pull some progress information to show the ending properly, and since the addresses it points to are empty, softlocking is perfectly normal and unavoidable without further memory manipulation that may or may not be feasible.
Warp wrote:
Edit: I think I understand now: It's my avatar, isn't it? It makes me look angry.
Editor, Expert player (2457)
Joined: 4/8/2005
Posts: 1573
Location: Gone for a year, just for varietyyyyyyyyy!!
There is no such thing as finishing a game. It is a vague concept. One day you finish a game and next day the game is there again. The question is: Does this run accomplish something interesting? The answer is obvious.
Joined: 3/9/2009
Posts: 530
Aqfaq wrote:
There is no such thing as finishing a game. It is a vague concept. One day you finish a game and next day the game is there again. The question is: Does this run accomplish something interesting? The answer is obvious.
How high were you when you wrote this?
Joined: 5/12/2010
Posts: 38
I WAS going to vote Yes for Moons, then Meh after watching most of the ending just being a glitchy mess, then decided on No because I realized I skipped over practically all of it just to see an unsatisfying glitched ending that ends in a soft lock. Overall, extremely interesting that 52 game overs results in oddness, but incredibly disappointing forced ending. It's really this game though. I think because you actually skip over TWO of the characters the game forces you have at the end really glitches the ending something fierce. Is it possible to somehow glitch Celes and Setzer into your party before the ending?
keylie
He/Him
Editor, Emulator Coder, Expert player (2822)
Joined: 3/17/2013
Posts: 391
Kurabupengin wrote:
Shouldn't the category be "game end glitch" to fit in with the others?
I agree, this has been changed.
jlun2 wrote:
If it really bothers people, is it possible to modify the TAS so it won't softlock?
I investigate a bit, and yes, running the very end of the world destruction cutscene (after the Celes/Cid dialogue) before the ending sequence allows it to run until the end. This should not cost much time, just changing more colors on the configuration menu. If people think this is necessary, I will do this part again.
Editor, Experienced player (807)
Joined: 5/2/2015
Posts: 671
Location: France
I WAS going to vote No for Vault based on reading the opinions on here, then Meh after actually watching the run and Yes after watching the ending being totally destroyed. Overall, a solid and impressive run.
Samsara
She/They
Expert player, Senior Judge, Site Admin (2121)
Joined: 11/13/2006
Posts: 2792
Location: Northern California
keylie wrote:
If people think this is necessary, I will do this part again.
It's already been ruled okay in the previous submission, there's no reason to redo anything just to appeal to the 2-3 people who care about it.
TASvideos Admin and acting Senior Judge 💙 | Cohost
warmCabin wrote:
You shouldn't need a degree in computer science to get into this hobby.
Editor, Skilled player (1998)
Joined: 8/25/2013
Posts: 1198
The published sketch glitch movie has the exact same ending, and that was accepted. This shouldn't even be an issue.
effort on the first draft means less effort on any draft thereafter - some loser
Skilled player (1403)
Joined: 10/27/2004
Posts: 1976
Location: Making an escape
I'd be down for a fixed ending sequence.
A hundred years from now, they will gaze upon my work and marvel at my skills but never know my name. And that will be good enough for me.