So it's been a while. People managed to
run arbitrary code to go to the credits in SMB3 by jumping inside an out-of-bounds glitch tile. And so I was interested to see if I could manage to do anything in SML2, but I'm just an amateur with this CPU instruction stuff...
Anyway, this
movie (SML2 (U) [!] (v1.0) VBA 24m svn3xx) performs the pause glitch at frame 12554. The "return address" would be 4067 which means that code at address A201 would be executed. At that very moment in the movie, A201 onwards would read:
13 00 1D B4 10 9A 00 FF FF FF FF C0 60 00 00 00 00 01 ...
My question is where does the code execution end? Is it at the first '10' (STOP)?
If I edit the first bytes to be 08 D5 A2 or EA D5 A2 then it will change address A2D5 to nonzero which means that revisiting a level will trigger the ending. But if I write those hex strings anywhere later, or into the 'FF's, then the game crashes... If I write the hex string into the '00's after the 'FF's, and remove the '10', then it does still not affect A2D5, and I don't understand why. ( I think the string would work in A201~A205 but not anywhere else, and sadly that part of memory is almost impossible to change into something meaningful)