I noticed though that the URL for this "second test" has "oni-test" in it, whereas the "IQ test" earlier has "iq-test" instead. Maybe this is a clue.
Language: Luaconsole.clear() memory.usememorydomain("System Bus") function text(x, y, text, color, backcolor) gui.drawText(x, y, text,color,backcolor,10,"Arial") end local address={ mode=0xFFB3, mapx=0xFFE5, lives=0xDA15, deathtime=0xFFA6, marioy=0xC201 } local progress=memory.read_u8(address.mapx) local didsomething=false function dosomething() progress=memory.read_u8(address.mapx) memory.write_u8(address.deathtime,1) didsomething=true end while true do if memory.read_u8(address.deathtime)>0 then if not didsomething then dosomething() end end if memory.read_u8(address.mode)==0 and didsomething then if memory.read_u8(address.mapx)>progress then client.pause() print("success?") end memory.write_u8(address.marioy,0xB0) didsomething=false end if emu.framecount()%4==0 then memory.write_u8(address.lives,0x09) end keys=joypad.get() keys.Right=true keys.B=true joypad.set(keys) text(70,20,"mode: " .. memory.read_u8(address.mode) .. "\ndeathtime: " .. memory.read_u8(address.deathtime) .. "\nmap x: " .. memory.read_u8(address.mapx),0xFF00B000,0xFFffffff) emu.frameadvance() end
| Bug | ----- | Notes | ---- | How I found it |
| GB Super Mario Land screen wrap-around glitch (v1.0) | Found sometime before or while working on a walkathon TAS. Became useful only later, in the 12:08 "normal mode" improvement, saving ~1 second. | By chance, when playing the game. | ||
| SNES Earthbound "check area" glitch | Aka. "tent glitch", wasn't initially found by me but after I saw it could trigger the game's debug menu, I researched it a bit and managed to trigger the debug menu reliably on the Japanese version. I collaborated with pirohiko to two runs. | Saw others do it on Youtube. Then did a TON of testing. | ||
| GB Daffy Duck The Marvin Missions out of bounds glitch | When visiting a new room, by abusing mechanics related to holding down the "Down" key and shooting, it is possible to wander offscreen and reach glitch tiles that could send you to later points in the game. | I don't really remember, but I was working with mmbossman and glitch hunted the game a lot. It was somewhat of a chance occurence. | ||
| GB Daffy Duck The Marvin Missions health glitch | Walk left and press "right" and "B". For some reason it increases your health by 64 units, giving you "infinite health". It took me more than 5 years to find that it had vastly different, more severe effects on the GB version, as opposed to the SGB version. | I think it happened to me while playing casually. Basicly I saw the healthbar glitching out suddenly so I was like "oh, I did this and then that happened". | ||
| GB The Smurfs act 1 warp glitch | When entering a stump and holding "up", it finishes the level instantly. It works because you have "control" of the first frame. So holding "up" makes you start out 1 pixel higher. This makes you reach the exit trigger, which isn't updated yet. | I didn't find. A Youtuber named oudepatattezak pointed it out to me. | ||
| DS Kirby Squeak Squad item get glitch | When receiving an item, health or treasure at the same time you use an item, you will keep the used item. | Happened to me while playing casually, I figured it could be a "two things happen at the same time" thing. | ||
| GB Trip World preserving momentum while flying | Every 16th frame, the game depletes from your x-speed. By having the game paused on those frames, you can prevent the speed loss. | I noticed x-speed behaving differently after pausing different amounts of frames. | ||
| GB Trip World wall clipping | Before I worked on this game, cyghfer(?) had found a clip in Level 4's miniboss. The Trip World community asked to look into clipping possibilities so the game becomes interesting to speedrun again. I tested around with the Clam miniboss in level 3 and actually ended up finding a clip. When working on the new TAS, I found more clips along the way (Fish clip, Ball clip, Goku clip). | Lots of testing. The Ball and Goku clip work because the enemy can eject you to the side and give you a 1 frame speed boost, in some cases enough to clip you into a wall. So carefully watching the x-speed memory address helped a lot. | ||
| GB Super Mario Land 2 pipe glitch | Most of the significant glitches in this game had already been found by other people. The "garbage area" that you could reach using the pipe glitch caught my attention. The game reads data that isn't meant to be read as level data - each block represents one memory address. I found that altering a certain address inside the "garbage area", $A2D5, can cause the game to finish on level (re-)start and I also found a way through the garbage area to reach said address. Andymac helped a lot, e.g. by providing a map of the "garbage area" and explaining. | I remember andymac kept saying there's no use in looking around in the "garbage area", it's not going to do anything. But I noticed all sorts of things could happen by breaking blocks at $A200 onwards, such as screen flashing, giving you low gravity status or making the level start scrolling. So I was persistent and tested a lot, eventually finding $A2D5. | ||
| GB Super Mario Land 2 pause glitch | I already knew pausing rapidly can cause the map loading to mess up since 2008 or so. In 2011 I noticed the game could reset itself or create blocks/coins flips above Mario's head when pausing during lag. I then found that the bug could do some way interesting things. Spikeman later explained that the bug has a chance of executing RAM addresses at $A201. With help from Masterjun, I made the game read code that makes it jump to a ROM function that finishes the game. I finished a very soon after. | Lots and lots and lots of testing and trial-and-error. | ||
| GB Tennis serve glitch | Tossing the ball up, then having it land on you makes the game award you instead of the opponent. | It was already a well known bug. | ||
| GB Bubble Ghost respawn glitch | Having the bubble burst at the same time it reaches a trigger makes it respawn on the other side of the room. It happens because the game updates the information about which exit/entrance the bubble should appear in as soon as it reaches the trigger, but since it bursts, the bubble stays in the current room. | Testing for "2 things happen at the same time" cases. | ||
| GBA Mario Pinball Land save & quit | The game lets you save and quit, then restart. When done in certain situations (receiving stars or keys etc.), it saves time. | I notice a shift of opinion between the early days and now. Using softreset and using non-American versions was rather frowned upon, but now it's "anything goes". If softreset saves 1 second, go for it. If Japanese version saves 1 second on the title screen, go for it. If save & quit saves time, go for it. I was opposed to using such techniques at first, but later I found it makes the run more interesting and I decided to go for absolutely fastest time no matter what. | ||
| GB The Adventures of Star Saver stage 9 bug | Approaching a stamper can glitch out the game. It requires that you are in human form and haven't shoot a projectile throughout the level. Not useful for speedrunning. | By chance. | ||
| GBA Dragon Ball Z The Legacy of Goku dialogue bug | When text appears and you talk to someone, the game messes up trying to display both texts. Not useful for speedrunning. | Testing for "2 things at the same time" bugs. | ||
| GBA Dragon Ball Z The Legacy of Goku II memory corruption | When using a save point to switch characters, the ki blasts you shoot aren't removed but your attack stun is cleared. Therefore, you can effectively shoot ki blasts every 2nd frame or so. When doing it with Vegeta's Big Bang attack, the resulting explosions mess up the game. Not useful yet. | After watching a WIP by Bonecrusher1022 in VBA v23, I started messing around aimlessly for a bit. By chance, I noticed that the ki blasts aren't removed when switching characters. This quickly led up to the find of the bug. | ||
| GBA Mario & Luigi Superstar Saga skipping half the game | I found a decent amount of bugs in this game. First Mini Mario glitch, then Action Command glitch, then Barrel storage and eventually the huge skip. Others contributed by finding their own share of useful bugs (e.g sign glitch) and making the category work not only on JP but on all versions. | I first stumbled upon Mini mario glitch when I was livestreaming, messing around in Bowser's Castle after a fullgame speedrun. But I didn't know what had happened at the time and dismissed it. Later when working on a TAS, I came across it again in Woohoo Hooniversity. By playing around with it, I found the Action Command glitch. Playing around with that, I managed to make it so I could teleport by screen lengths, which led to the huge skip discovery. |
System.IO.EndOfStreamException: Über das Ende des Datenstroms hinaus kann nicht gelesen werden.
bei System.IO.BinaryReader.FillBuffer(Int32 numBytes)
bei System.IO.BinaryReader.ReadInt32()
bei BizHawk.Common.Serializer.Sync(String name, Int32& val)
bei BizHawk.Emulation.Common.Components.LR35902.LR35902.SyncState(Serializer ser)
bei BizHawk.Emulation.Cores.Nintendo.GBHawk.GBHawk.SyncState(Serializer ser)
bei BizHawk.Client.Common.BinaryStateLoader.GetLump(BinaryStateLump lump, Boolean abort, Action`2 callback)
bei BizHawk.Client.Common.BinaryStateLoader.GetCoreState(Action`1 callbackBinary, Action`1 callbackText)
bei BizHawk.Client.Common.SavestateManager.LoadStateFile(String path, String name)
bei BizHawk.Client.EmuHawk.MainForm.LoadState(String path, String userFriendlyStateName, Boolean fromLua, Boolean supressOSD)
bei BizHawk.Client.EmuHawk.MainForm.LoadQuickSave(String quickSlotName, Boolean fromLua, Boolean supressOSD)
bei BizHawk.Client.EmuHawk.MainForm.CheckHotkey(String trigger)
bei BizHawk.Client.EmuHawk.MainForm.<ProcessInput>b__94_0(Boolean current, String trigger)
bei System.Linq.Enumerable.Aggregate[TSource,TAccumulate](IEnumerable`1 source, TAccumulate seed, Func`3 func)
bei BizHawk.Client.EmuHawk.MainForm.ProcessInput()
bei BizHawk.Client.EmuHawk.MainForm.ProgramRunLoop()
bei BizHawk.Client.EmuHawk.Program.SubMain(String[] args)
Language: Luaconsole.clear() memory.usememorydomain("System Bus") client.SetGameExtraPadding(0,0,134,0) local MouseX = 0 local MouseY = 0 local clickedFrames = 0 local clicked = false local prevframe = emu.framecount() function arrowDown(xpos,ypos,col) gui.drawLine(xpos,ypos,xpos+6,ypos,col) gui.drawLine(xpos+1,ypos+1,xpos+5,ypos+1,col) gui.drawLine(xpos+2,ypos+2,xpos+4,ypos+2,col) gui.drawPixel(xpos+3,ypos+3,col) end function arrowUp(xpos,ypos,col) gui.drawLine(xpos,ypos,xpos+6,ypos,col) gui.drawLine(xpos+1,ypos-1,xpos+5,ypos-1,col) gui.drawLine(xpos+2,ypos-2,xpos+4,ypos-2,col) gui.drawPixel(xpos+3,ypos-3,col) end local addressList={ --address color note [1]={0x0040,0xFFA0A0A0,"VBLANK START"}, [2]={0x2258,0xFFFFE000,"READ FFEA"}, [3]={0x225D,0xFFFFE000,"READ FFE9"}, [4]={0x2267,0xFFFF7000,"UPDATE FFE9(+1)"}, [5]={0x2198,0xFFFFE000,"READ FFEA"}, [6]={0x218A,0xFFFF7000,"UPDATE FFEA(03)"}, [7]={0x2195,0xFFFF7000,"UPDATE FFEA(00)"}, [8]={0x22A6,0xFFFF7000,"UPDATE FFEA(02)"}, [9]={0x0067,0xFFA0A0A0,"0067"}, [10]={0x06E7,0xFF00E0FF,"FFFE5->HL"}, [11]={0x0723,0xFF0070FF,"UPDATE FFFE5"}, [12]={0x21D8,0xFF00E0FF,"READ FFE5"} } local addressListFrame={} local address=0 local col=0 local index=1 local ListOffset=1 local Mouse={} function text(x, y, text, color, backcolor) gui.drawText(x, y, text,color,backcolor,10,"Arial") end local addAddress=function(n) addressListFrame[index]=n index=index+1 end for n=1,table.getn(addressList) do address=addressList[n][1] color=addressList[n][2] label=addressList[n][3] event.onmemoryexecute(function() addAddress(n) end,address) end event.onframestart(function() addressListFrame={} ListOffset=1 end) event.onloadstate(function() addressListFrame={} ListOffset=1 end) while true do thisframe=emu.framecount() MouseX = input.getmouse().X MouseY = input.getmouse().Y clicked = input.getmouse().Left if clicked then clickedFrames = clickedFrames + 1 else clickedFrames = 0 end text(164,2,"FRAME " .. emu.framecount(),0xFFA060A0) n=1 for s=ListOffset,table.getn(addressListFrame) do z=addressListFrame[s] text(164,4+n*10,string.upper(string.format("%04x",addressList[z][1])),0xFFFFFFFF) text(190,4+n*10,addressList[z][3],addressList[z][2]) n=n+1 end if MouseX>280 and MouseX<290>130 and MouseY<138 then if clicked and clickedFrames%2==1 then if ListOffset<table>280 and MouseX<290>120 and MouseY<127>1 then ListOffset=ListOffset-1 end end arrowUp(282,123,0xFFFFFFFF) else arrowUp(282,123,0xA0FFFFFF) end text(281,104,ListOffset-1,0xFFE0E0E0) index=1 if client.ispaused() then gui.DrawFinish() emu.yield() else emu.frameadvance() end prevframe=thisframe clicked=false end
http://dehacked.2y.net/microstorage.php/info/1074552241/sml1%20bug.bk2
It syncs on both v1.0 and v1.1.
----------
I would like to investigate "respawning at checkpoints" now. You know why.
The game seems to rely on $FFE5 (which is some sort of x-pos address) to determine where Mario should respawn.
So I made another trace log, right before the screen fades white to respawn Mario.
This is the frame where $FFE5 is checked. It actually seems $FFE5 is supposed to be read as 2-byte(?).
Values of $FFE5~$FFE6
Frame1: 12 06 (Mario died and screen is about to turn white)
Frame2: 0F 01
Frame3: 0F 0D (Screen white)
Frame4: 10 04
Frame5: 10 07
Frame6: 10 07
Frame7: 10 08 (Visible)
https://paste.ee/p/jlRIC (this is when transitioning from frame 1 to 2)
I looked at line 3952, where it does something with FFE5.
What I can understand:
save address "FFE5" to HL
(...)
load value from HL (FFE5: 0x12) to A
if A > 0 then decrement A by 1 (So A turns 0x11)
(...)
Do some operations(Not sure what's happening) and save the result to B (= 0x0F)
load contents of B to address in HL (FFE5 is now 0x0F)
Write 0x00 to FFE6
(...)
Later on, it saves value of FFE5 to A (= 0x0F)
Adds A to A (= 0x1E) and saves the value to E
(...?)
This effect is not emulated by any emulator yet.
void gui.drawText(int x, int y, string message, [color? forecolor = null], [color? backcolor = null], [int? fontsize = null], [string fontfamily = null], [string fontstyle = null], [string horizalign = null], [string vertalign = null])
Language: Luawhile true do gui.drawText(50,60,"hillo",0xFF0000) emu.frameadvance() end
Isn't it supposed to be red text?
| normal frame ($FFE9 is updated) | --- | bug frame ($FFE9 not updated) |
| 0AFF:--20--F7--JR--NZ,0AF8h--A:ff--Cy:1861108572 0AF8:--7E--LD--A,(HL)--A:ff--Cy:1861108584 0AF9:--FE--FF--CP--#FFh--A:ff--Cy:1861108592 0AFB:--20--05--JR--NZ,0B02h--A:ff--Cy:1861108600 (...) 06B4:--7E--LD--A,(HL)--A:01--Cy:1861110032 06B5:--A7--AND--A--A:00--Cy:1861110040 06B6:--C8--RET--Z--A:00--Cy:1861110044 0296:--76--HALT--A:00--Cy:1861110064 0040:--C3--60--00--JP--#0060h--A:00--Cy:1861117772 0060:--F5--PUSH--AF--A:00--Cy:1861117788 0061:--C5--PUSH--BC--A:00--Cy:1861117804 0062:--D5--PUSH--DE--A:00--Cy:1861117820 0063:--E5--PUSH--HL--A:00--Cy:1861117836 0064:--CD--58--22--CALL--#2258h--A:00--Cy:1861117852 2258:--F0--EA--LDH--A,(#FFEAh)--A:00--Cy:1861117876 225A:--FE--01--CP--#01h--A:01--Cy:1861117888 225C:--C0--RET--NZ--A:01--Cy:1861117896 225D:--F0--E9--LDH--A,(#FFE9h)--A:01--Cy:1861117904 225F:--6F--LD--L,A--A:5a--Cy:1861117916 2260:--3C--INC--A--A:5a--Cy:1861117920 2261:--FE--60--CP--#60h--A:5b--Cy:1861117924 2263:--20--02--JR--NZ,2267h--A:5b--Cy:1861117932 2267:--E0--E9--LDH--(#FFE9h),A--A:5b--Cy:1861117944 2269:--26--98--LD--H,#98h--A:5b--Cy:1861117956 226B:--11--B0--C0--LD--DE,#C0B0h--A:5b--Cy:1861117964 226E:--06--10--LD--B,#10h--A:5b--Cy:1861117976 2270:--E5--PUSH--HL--A:5b--Cy:1861117984 (...) 22A0:--D1--POP--DE--A:2c--Cy:1861121476 22A1:--05--DEC--B--A:2c--Cy:1861121488 22A2:--20--CC--JR--NZ,2270h--A:2c--Cy:1861121492 22A4:--3E--02--LD--A,#02h--A:2c--Cy:1861121500 22A6:--E0--EA--LDH--(#FFEAh),A--A:02--Cy:1861121508 22A8:--C9--RET--A:02--Cy:1861121520 0067:--CD--86--1B--CALL--#1B86h--A:02--Cy:1861121536 1B86:--AF--XOR--A--A:02--Cy:1861121560 1B87:--EA--E2--C0--LD--(#C0E2h),A--A:00--Cy:1861121564 (...) 0030:--56--LD--D,(HL)--A:00--Cy:1861123776 0031:--D5--PUSH--DE--A:00--Cy:1861123784 0032:--E1--POP--HL--A:00--Cy:1861123800 0033:--E9--JP--(HL)--A:00--Cy:1861123812 0627:--CD--98--21--CALL--#2198h--A:00--Cy:1861123816 2198:--F0--EA--LDH--A,(#FFEAh)--A:00--Cy:1861123840 219A:--A7--AND--A--A:02--Cy:1861123852 219B:--20--EB--JR--NZ,2188h--A:02--Cy:1861123856 2188:--3E--03--LD--A,#03h--A:02--Cy:1861123868 218A:--E0--EA--LDH--(#FFEAh),A--A:03--Cy:1861123876 218C:--F0--A4--LDH--A,(#FFA4h)--A:03--Cy:1861123888 218E:--47--LD--B,A--A:f9--Cy:1861123900 218F:--FA--AA--C0--LD--A,(#C0AAh)--A:f9--Cy:1861123904 2192:--B8--CP--B--A:f8--Cy:1861123920 2193:--C8--RET--Z--A:f8--Cy:1861123924 2194:--AF--XOR--A--A:f8--Cy:1861123932 2195:--E0--EA--LDH--(#FFEAh),A--A:00--Cy:1861123936 2197:--C9--RET--A:00--Cy:1861123948 062A:--CD--4E--08--CALL--#084Eh--A:00--Cy:1861123964 084E:--F0--9C--LDH--A,(#FF9Ch)--A:00--Cy:1861123988 0850:--A7--AND--A--A:00--Cy:1861124000 (...) 06B4:--7E--LD--A,(HL)--A:02--Cy:1861174368 06B5:--A7--AND--A--A:00--Cy:1861174376 06B6:--C8--RET--Z--A:00--Cy:1861174380 0296:--76--HALT--A:00--Cy:1861174400 | 6C51:--FE--03--CP--#03h--A:01--Cy:1860406336 6C53:--20--10--JR--NZ,6C65h--A:01--Cy:1860406344 6C65:--E5--PUSH--HL--A:01--Cy:1860406356 6C66:--7D--LD--A,L--A:01--Cy:1860406372 (...) 0030:--56--LD--D,(HL)--A:00--Cy:1860409752 0031:--D5--PUSH--DE--A:00--Cy:1860409760 0032:--E1--POP--HL--A:00--Cy:1860409776 0033:--E9--JP--(HL)--A:00--Cy:1860409788 0627:--CD--98--21--CALL--#2198h--A:00--Cy:1860409792 2198:--F0--EA--LDH--A,(#FFEAh)--A:00--Cy:1860409816 219A:--A7--AND--A--A:01--Cy:1860409828 219B:--20--EB--JR--NZ,2188h--A:01--Cy:1860409832 2188:--3E--03--LD--A,#03h--A:01--Cy:1860409844 218A:--E0--EA--LDH--(#FFEAh),A--A:03--Cy:1860409852 218C:--F0--A4--LDH--A,(#FFA4h)--A:03--Cy:1860409864 218E:--47--LD--B,A--A:f9--Cy:1860409876 218F:--FA--AA--C0--LD--A,(#C0AAh)--A:f9--Cy:1860409880 2192:--B8--CP--B--A:f8--Cy:1860409896 2193:--C8--RET--Z--A:f8--Cy:1860409900 2194:--AF--XOR--A--A:f8--Cy:1860409908 2195:--E0--EA--LDH--(#FFEAh),A--A:00--Cy:1860409912 2197:--C9--RET--A:00--Cy:1860409924 062A:--CD--4E--08--CALL--#084Eh--A:00--Cy:1860409940 084E:--F0--9C--LDH--A,(#FF9Ch)--A:00--Cy:1860409964 0850:--A7--AND--A--A:00--Cy:1860409976 (...) 2D02:--1A--LD--A,(DE)--A:20--Cy:1860415488 2D03:--22--LD--(HL+),A--A:27--Cy:1860415496 2D04:--13--INC--DE--A:27--Cy:1860415504 0040:--C3--60--00--JP--#0060h--A:27--Cy:1860415532 0060:--F5--PUSH--AF--A:27--Cy:1860415548 0061:--C5--PUSH--BC--A:27--Cy:1860415564 0062:--D5--PUSH--DE--A:27--Cy:1860415580 0063:--E5--PUSH--HL--A:27--Cy:1860415596 0064:--CD--58--22--CALL--#2258h--A:27--Cy:1860415612 2258:--F0--EA--LDH--A,(#FFEAh)--A:27--Cy:1860415636 225A:--FE--01--CP--#01h--A:00--Cy:1860415648 225C:--C0--RET--NZ--A:00--Cy:1860415656 0067:--CD--86--1B--CALL--#1B86h--A:00--Cy:1860415676 1B86:--AF--XOR--A--A:00--Cy:1860415700 1B87:--EA--E2--C0--LD--(#C0E2h),A--A:00--Cy:1860415704 (...) 0030:--56--LD--D,(HL)--A:00--Cy:1860475292 0031:--D5--PUSH--DE--A:00--Cy:1860475300 0032:--E1--POP--HL--A:00--Cy:1860475316 0033:--E9--JP--(HL)--A:00--Cy:1860475328 0627:--CD--98--21--CALL--#2198h--A:00--Cy:1860475332 2198:--F0--EA--LDH--A,(#FFEAh)--A:00--Cy:1860475356 219A:--A7--AND--A--A:00--Cy:1860475368 219B:--20--EB--JR--NZ,2188h--A:00--Cy:1860475372 219D:--F0--A4--LDH--A,(#FFA4h)--A:00--Cy:1860475380 219F:--E6--08--AND--#08h--A:fa--Cy:1860475392 21A1:--21--A3--FF--LD--HL,#FFA3h--A:08--Cy:1860475400 21A4:--BE--CP--(HL)--A:08--Cy:1860475412 21A5:--C0--RET--NZ--A:08--Cy:1860475420 062A:--CD--4E--08--CALL--#084Eh--A:08--Cy:1860475440 084E:--F0--9C--LDH--A,(#FF9Ch)--A:08--Cy:1860475464 0850:--A7--AND--A--A:00--Cy:1860475476 (...) 089E:--E0--A2--LDH--(#FFA2h),A--A:4e--Cy:1860476528 08A0:--3E--02--LD--A,#02h--A:4e--Cy:1860476540 08A2:--80--ADD--A,B--A:02--Cy:1860476548 08A3:--E0--8F--LDH--(#FF8Fh),A--A:53--Cy:1860476552 |