Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
Skyekun wrote:
Hm, how about a brief interview with some of the experienced TASers? Questions like "How did you get involved into making TAS?"
"What's the easiest part of a TAS project? What's the hardest?"
"Is there anything you would like to say to newcomers trying to get involved?"
Er... heh, I'm concerned people would pay money for us to *not* hog the camera to answer those questions. :) Usually donation incentives are for things like "Play x on the hardest difficulty" or "pick the character name" but I'm still pondering what that might look like for a TAS block... At any rate, thanks for the ideas!
Heh - that generally sums it up. For donation incentives, it'd have to fit more or less inside our allocated time. Last time we tried doing a bid war between two games but it generated very little interest, in part because I think people wanted to see both of them or didn't really care very strongly which one got shown in the first place. :) Someone said jokingly "If we reach a target donation amount, Tompa will TAS a game" (OK, that wasn't a direct quote, and OK, it was actually Tompa himself who said it, but I digress). I'm amused by this suggestion. I haven't entirely given up on the idea of speed TASing off-stream, i.e. at the end of our block we announce the name of a game and a deadline to TAS it (like, a short deadline, around 4 hours), and then after the deadline just have an announcement on stream of the result, I can possibly talk the organizers into that, but it's a longshot and I have a lot of other things to get in place before I can even consider that. Still, it could be fun...
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
Weatherton wrote:
I have a bunch of Nintendo swag from E3 2001 that I think someone may like to have. Things like foam GameCube, GBA, GameCube back back and various press releases. Does that seem interesting?
Ummm.. I think so? I can't quite tell what this all is, to be honest. :) Feel free to take some pictures and submit it, the worst they will say is no thank you.
Weatherton wrote:
As for a donation incentive. We could have one for adding an extra lap on the Kart 64 Gauntlet. I could have both movie files ready.
Oh, I like that (although it does give away that they'll be facing a different number of laps, but I think that's OK). I've asked for the runs to be split and make you and micro500 the runner, so it makes sense for you to post directly in the donation incentives thread yourself (for the Pokemon Red and the "bonus" game we're still working on I'll handle posting). Thanks!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
As you may know, several years ago the folks over at SDA started a yearly charity marathon now known as Awesome Games Done Quick and AGDQ 2014 (which we participated in) raised more than $1 million in donations for the Prevent Cancer Foundation. As cancer claimed the lives of three of my grandparents when I was young I am motivated to support the AGDQ charity efforts any way I can. As part of this goal I've worked hard to organize the TASBot block for AGDQ 2015 (with massive amounts of help from people like Ilari, Masterjun, p4plus2, micro500, Weatherton, true, and a host of others) and I'm really proud of what we'll be able to show during our ~40 minute TASBot block on 2015-01-04 at 5:05 EST. One of my goals is to bring more attention to TASVideos.org by demonstrating what the site has to offer. Good donation incentives and raffle prizes go a long way toward increasing viewership which will help increase the exposure of the site, and I need your help.
Do you have an old copy of Pokemon you'd like to donate as a raffle prize? How about an old console? Perhaps game-themed costumes or plushies in good shape? Any unique things you've been holding on to that you don't really have any need to store any longer? Donate them as raffle prizes during the TASBot block! You'll even get your shipping reimbursed by the Prevent Cancer Foundation, so there's no cost to donate other than the item itself. You can sign up to donate a prize at: https://forum.speeddemosarchive.com/post/agdq_2015_prizes.html
If you have a donation incentive idea or if you are able to donate something for the block, please post about it here. All donations made by viewers watching AGDQ 2015 will go directly to the Prevent Cancer Foundation, so you'll also be helping out a good charity. I'm hoping to see $25k donated by viewers during our 40 minute block and I greatly appreciate anything you can do to help. Thanks in advance!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
I've spent many hours testing but I've finally perfected a payload that executes an epilepsy-inducing flashing pattern crafted by Ilari on a real console, executing code in SNES space. I'm going to stop here for just a second and again say that Ilari has put in a lot of time and effort on this and I really appreciate all of the work he's done. So, without further ado, if you have lsnes + Gambatte core running you can watch the result here: http://acbit.net/static/tas/PokemonRedSuperGameBoyEpilepticDemo.lsmv
If you own one of true's replay devices you can play this back on your SNES + SGB + Pokemon Red: http://acbit.net/static/tas/PokemonRedSuperGameBoyEpilepticDemo.frame.r16m
The final bit of tinkering involved determining when the "slip" frame occurred on a real console. I took a portion of a jump sequence of 3E 32 CD 6D 3E (LD A, 0x32 \ Call 0x3E6D) and split it in two; since the first part is a small load opcode that's only two bytes long I split that off and wrote the other three bytes at the end of the time period where we could write bytes. As noted earlier, since we can't press U+D or L+R at the same time we're writing at a speed of only 4 bits per frame (1 nibble), so the above two-byte sequence of 0x3E followed by 0x32 took four frames to write. I was able to move this section around and determine the exact offset where the slip frame occurred, down to the exact frame; this is because the slip frame offset was when I needed to enter the first nibble for the next frame, allowing me to get down to single-frame accuracy. Ilari then found a modification to the payload with a nearby section where the byte 00 could be inserted. We got that movie to synchronize on the emulator then dumped it and... it was oddly off by 7 frames on the console. So, by making the game exit the menu 7 frames faster, the movie file now synchronizes on real hardware using true's original replay board.
This is the state I had hoped to be at before the 9th and ideally hoped to be at two months ago, but considering the hurdles we had to overcome this is a huge success. There's a lot more work to be done, however; we still need to find some way to reset the console (either through a solenoid or through the expansion port), we need to get the MultiReplay board to support this movie file type (difficult, as true is currently distracted due to various circumstances), we need to figure out a payload (something Masterjun and p4plus2 are working on now), and it would be nice if we could get ROB flashcodes working (effort started by p4plus2 but that's something that is hard to test without a CRT and a ROB). There are other nice-to-haves such as getting the visualization boards working, but we might not be able to get that in time.
This is a good time to say that my involvement with AGDQ 2015 has expanded to organizing getting pinball machines set up for attendees. It's still a bit early but things are looking promising. I hope to post more in the coming days.
Finally, I'm on the hook to get some nice pictures of ROB so we can get a bumper made. I'm a bit behind on that (it's been a hectic week, a tree fell on our house and it was a bit of a mess there for a while) but I hope to get that done tomorrow now that we've made it past the arbitrary code execution on the SNES processor. Thanks again to everyone for the support and I'll post updates as they happen. It's a tight schedule to get everything done but we'll do what we can.
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
I have good news - after many hours of effectively testing blind, I was able to puzzle out what changes to make to get a movie file to synchronize on a real console. If you want to grab the movie file you can find it at: http://acbit.net/static/tas/PokeRedV16DoubledMoreButtonsTitlescreenJumpShifted.lsmv (You can try this yourself with lsnes + Gambatte in Linux, after following the.. er.. mostly straightforward instructions to compile from source; there is also a not-yet-ready-for-primetime Windows build of lsnes + Gambatte created by Ilari that I'm not yet sure if I can share if you need it - ask me or Ilari on IRC as needed, but I digress)
The above movie file triggers a series of opcodes that resets the game to the title screen but leaves the player sprite present. It emulates the same way on the console as it does on the emulator, more or less, but the clock skew is still an issue for longer payloads. The payload I tested was only 4 bytes long but what we need to write is more like 40, and because we can only read a nibble (four bits) per frame it takes us over 80 frames to write the payload meaning we hit at least one 56/57 clock skew window where input is messed up, and the point after where it is messed up could require adjustment by another extra lag frame in addition to simply offsetting the bad section to occur where it won't cause damage. This is basically my way of saying that the next step will require substantial blind testing unless we can figure out a way to sniff the clock. Since we can now execute short sections of arbitrary code perhaps there's something we can do to suss it out, or perhaps I'll borrow a logic analyzer and a scope from work and try my hand at some hardware hacking.
Either way, this is finally some hope in what has been a downright unpleasant time (where everything from very long hours at work to getting sick to having a tree fall on our house has happened). I'll post more after I make some additional progress, but it could be a few days. Thanks for the support all and I hope to have good news again soon.
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
TASeditor wrote:
No intense FrankerZ freakout in the Twitch chat. :-(
So help is not needed anymore for Family Feud answers.
Sadly, no. This is most unfortunate, as i know you've put some work into it. You may consider posting what you have the day-of, or completing it as a standard TAS on a newer emulator that can obsolete the existing run. Maybe this is even donation incentive material. In other words, just because the game has some characteristic that makes it lag unpredictably and thus difficult to console verify doesn't mean that your work has been entirely in vein. I do want to take this opportunity to thank you for the time you put in, and I hope that you'll be able to do something with what you've created.
If you're willing to finish off the game in time for the marathon, please let me know. I think the final questions can be a little less Twitch chat oriented if you need them to be, and since I won't be actively presenting it you can probably get away with a bit more leeway with content. Regardless, thanks for your efforts!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
Extremely brief update to at least get a data dump of the current state out there. There's a lot of bad news, although there is a bit of good news.
First, p4plus2 (a talented SNES ROM hacker) came over and we walked through what was going wrong with Family Feud. The answer is... something deep and very ugly causes completely different lag frame patterns than on an emulator and we cannot come up with any solution to counter the problem because getting the correct "round" of questions to appear in the first place can get thrown off. Regrettably, unless some miracle happens, Family Feud will not be console verifiable.
On the good news front, we've made substantial progress on Pokemon Red and it is now possible to execute arbitrary code on lsnes + gambatte. I spent many, many hours tweaking the Pokemon Red movie file I adapted from a movie file Masterjun created for GB in BizHawk. It was extremely time consuming to get it to the item quantities to match on the emulator but I finally got it after many iterations. Ilari hacked together this .lsmv file for Pokemon red (for lsnes + Gambatte core): http://www.elisanet.fi/ilari_l/pokered-with-visuals.lsmv as something I could use to see if the effect worked on a real console. Unfortunately, despite the fact that everything seems to work for stage 1 (the payload we write by switching Pokemon and items or decrementing items) we can't easily get stage 2 to synchronize. This has a lot to do with the fact that SGB drops or duplicates input every 56/57 frames due to clock slew. I haven't heard back on trying to get an SGB2 and with not a lot of time left (less than three weeks!) it might not make sense to try that route. Which means I'm brute-forcing everything trying to get the clock slew to happen at a time where it won't cause problems, except I have to do it entirely blind. And I've been sick the last couple of days, so that's not been helping either. Oh, and I've been supporting lab work going on in India and my sleep schedule has been a wreak, so thinking straight has been difficult. That part is over but I'm a little concerned I won't be able to get everything done in time at this pace.
We're also having some difficulties with our intended (still secret) payload, mostly dealing with the fact that the SNES really is a fairly limited platform in comparison. We're in talks about workarounds and alternative methods, but it's been a discouraging time. I'm still optimistic we can do something, it's just a matter of if what I've worked on will pan out or not or if we'll have to abandon this and do something else instead.
More updates to come but thanks for any encouragement or help you could send toward Ilari, Masterjun, p4plus2, or myself,
A.C.
******
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
miseiler wrote:
Has this been worked on at all? I'm still excited!
Hi, thanks for your interest! As ais523 noted, he's been extremely busy this fall and I'm actively preparing for AGDQ 2015 and have not made any progress on the newer framework method I've been pondering (using CRIU). My hope is that I will be able to finish the framework early next year and that we'll be able to resume meaningful progress in time to submit the run to the site before the deadline where the game we chose in the future is, er, no longer in the future. :)
I also have dreams in my head of trying to do NetHack at a future AGDQ or SGDQ event in a graveyard shift, where we spend two hours or so and walk through explaining all of the complex things going on but fast-forward through the boring parts, explaining in enough detail that people unfamiliar with the game can understand what's happening. So far I've received extremely divided opinions on whether this is a good idea, with the general response to the idea being either one of utter elation or utter repulsion and not much middle ground. I'll have to ensure that whatever we pitch meets the needs of as large an audience as possible.
Thanks again for the interest and I hope to have something useful to put in here sometime in the next couple of months!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
With a lot of work in a sleep-deprived state over the last week I'm happy to say that arbitrary code execution is now possible on Pokemon Red (thanks to help from Masterjun, Ilari, padz, p4plus2, and a few other people I'm forgetting). The long and the short of it is we had to completely rework FractalFusion's item and Pokemon switching and renaming to get a value of F8 and the previous post's memory addresses are more or less useless at this point because the new input is so different; I may create a new post in the same vein at some point, but I've mostly just been talking to myself as of late in this thread so I'll hold off for the moment. :)
With said help, I've created a pair of lsnes + Gambatte movie files (which can be found in my static TAS storage page), one that starts from creating a character and does a reset and the other that starts Pokemon Red with that existing (corrupted) GB SRAM state that contains the player character RED, the rival name xAxA(Pk), and FF in *just* the right place to allow further exploitation. As noted, the second movie file uses input suggested by Masterjun based on FractalFusion's work to execute arbitrary code, which it does very well. One minor caveat: I've discovered with help from Ilari and padz that D+U and L+R (representing bit values 128, 64, 32, and 16 respectively) are canceled out by the SGB BIOS meaning FractalFusion's payload can't be written as it contains the value 0xD3. This movie file contains a bunch of input at the end that softlocks the game in an interesting way but doesn't yet do exactly what we want it to. Still, it shows arbitrary code execution on Pokemon Red, which is good. I'll consult with the experts and work out a plan as quick as I can.
For anyone in the SF bay area, I'll be presenting my take on the anatomy of an arbitrary code exploit at NBLUG on 2014-12-09 at 7:30 PST at the O'Reilly campus in Sebastopol, CA. Hopefully I'll be able to make some more progress over the next couple of days so I have a bit more I can show. Thanks again to all who helped!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
The path forward is becoming potentially more clear. Here's the modified set of steps, with large swaths of content lifted from FractalFusion's post, but using lsnes GBWRAM addresses for Pokemon Red (offset by - 0xC000 compared to GBBUS addresses as used in VBA and offset by an additional -1 or -3 in various places compared to Pokemon Yellow). The target payload ultimately needs to reside at 0x1367 in GBWRAM, and for Pokemon Red it needs to be:
0x1367: 22 00 76 00 F0 F8 D4 50 D3
To get there, things will generally follow the same pattern as what FractalFusion did in Pokemon Yellow. The player's name can be set to anything (Note: someone needs to claim the Donation Incentive coordinator position and turn this into a donation incentive by finding someone to write an autoname script!). Every action will have an impact on memory, as noted below by showing its old value followed by the new value on a new line.
As a side note, everything interesting is moved to 0x133B:
0x133B: 22 00 76 00 F0 F5 D4 50 D3
Switch the 12th Pokemon with the 11th:
0x1367: 22 00 76 00 F0 F5 D4 50 D3
This section now has 33 bytes of 00 before it. After closing the menu the game will do a few things better explained by FractalFusion resulting in a jump to 0x1350 which will contain the value 0x50 at 0x136E. After a few other things happen 0x1351 will be written to with the byte value of the combination of buttons being pressed as read from GBHRAM 1F5... and herein lies the rub. On Pokemon Yellow, 1F5 contains the input from the first controller, meaning whatever buttons are pressed is what gets copied into 0x1351 and following addresses. Unfortunately, Pokemon Red is offset a bit and the address needs to be GBHRAM 1F8 instead, meaning that the F5 we inherited from the female symbol in the rival's name needs to change.
I did a bunch of testing and determined that it is safe to swap the 16th Pokemon with the 17th which will offset F5 from being an item ID to being an item quantity which can then be decremented, but because I have to go *up* I have to start with a value higher than F8 (like 00, which can wrap around because the game decrements quantities first before checking if the quantity is 0, meaning we can toss 8 to get F8). There are no values higher than F8 that can be selected for the name, so the other solution is to name the rival with a single space as noted above. This causes a trickle-down effect as now all those 00's (most importantly, E1) have to later be decremented to the desired values. I think this can be resolved by tossing the correct number of items after shifting the 16th Pokemon with the 17th and then reversing the change but it will require a fair bit more testing. This can possibly be thought through without actually consulting the game if someone is brave enough to try it. :)
More to come but any help with the various things left un-done would be appreciated. Thanks, all!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
Based on FractalFusion's extremely thorough writeup and help from Mothrayas I've been able to work out what we need to do. Except it seems neigh impossible to do at the moment with Pokemon Red. Here's the issue:
In the exploit for Yellow, the rival was named (space) (female) (PK) (END). Memory in D343 at that point is:
D343: 00 00 00 00 30 00 7F F5 E1 50 00
In Pokemon R/G/B/Y, items are stored with an identifier followed by their quantity (Pokered has extensive information about the layout of RAM but I find the less accurate but still useful Datacrystal RAM layout page to be a bit more accessible for this bit of information). To make a long story short, you can toss quantities of items to change their value in RAM but you can't change the identifier. In this case, the value that matters the most is that F5, which happens to be the female symbol that was used for the rival's name and is aligned as an item identifier which can't be altered through tossing items. In Pokemon Yellow, that F5 is used to point at the address where controller input resides, but in Pokemon Red those values are shifted and we need to have it point to F8 instead.
Now, we could just change the name, but the problem is that the character that is stored as F8 in memory is the number 2, and numbers are not selectable as names. This means we have to alter the value some other way, likely by swapping Pokemon around. Having said that, I have not yet found a way to swap Pokemon in a way that does not cause utter destruction in other areas of RAM that need to stay intact. The path forward is still very unclear to me.
I've spent substantial time on Pokemon Red. Ilari has spent substantial time on the new lsnes + Gambatte core. The new core is more accurate, but Pokemon Yellow has some strange characteristics that cause it not to start and we have not yet been able to determine why. To abandon Pokemon Red *and* the Gambatte core seems like an affront, and there is no guarantee that even with extremely conservative button presses that Pokemon Yellow in the older, far less accurate bsnes core will synchronize on a console (whereas I have Pokemon Red working on real hardware right now). To that end, I'd really like to figure out a way to make Pokemon Red work, but it may take a lot more work to find a new solution as the copy-and-paste from Yellow falls through in the one important memory value we need to change.
Without the help of people like padz, Ilari, Mothrays, Nach, true, p4plus2, micro500, and others I'm positive I wouldn't have been able to get this far. Things may be looking a bit rough with the Family Feud TAS not wanting to synchronize and the arbitrary exploit TAS still not yet working right but I know we'll pull through one way or another. Thanks to everyone who has helped out!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
A few minutes ago, on my real Pokemon Red cartridge that is currently in the save glitch state (more on that in a second), I was able to carefully walk through FractalFusion's Pokemon Yellow arbitrary execution instructions by hand and I was able to get the player character to disappear. There's a *whole lot* more to that sentence than meets the eye, so let me back up a bit.
First, I was able to create a movie file in lsnes + Gambatte core on Pokemon Red that recreated the behavior of FractalFusion's Pokemon Yellow run. It took a lot of work as everything in memory is offset on Red by +1 compared to Yellow and lsnes doesn't show GBBUS in the memory tool but I was able to find the same memory values by looking at GBWRAM and subtracting 0xC000. It is thanks to FractalFusion's careful notes that I was able to recreate the exact memory values needed. Because I don't yet have a solenoid method working I manually hit the reset button while saving the game and i managed to recreate the glitch state on my Pokemon Red cartridge after 3 or 4 attempts. I'm now reticent to erase it so I attempted to craft a new movie that starts from after the reset but it kept desynching. It wasn't until tonight that I was confident it could work after I make some timing adjustments.
This means that the path forward now is to ensure I can really, truly execute arbitrary code on the emulator (rather than just getting the player character to disappear and getting the memory values to match). That will require one more fix from Ilari who has continued to tirelessly chip away at emulation inaccuracy issues. As soon as that fix is in and I'm able to confirm I can do some kind of arbitrary execution on the emulator I'll dump the file again and see if I can tweak everything enough to get it to play back through the bot on the console. These are exciting times!
In less good news we're having problems with Family Feud desynchronizing in random ways on real hardware. We have not yet determined if some kind of other factor is being used for RNG creation or what the issue could be but for some reason button presses are not registered by the console and answers show up with the wrong letters pressed. I need to try again when true sends his updated Multireplay board to me.
In better news, I was able to hack together a pinball flipper coil (solenoid) with the correct windings and a 6.5v power supply to move a rod about 3/8ths of an inch, or enough to trigger the reset button on an SNES. I still need to sort out some way to mount it, get a transistor on it to act as a button, and work with true to get it connected to the bot so we can script it some way, but there's some definite potential. The timing is apparently not too sensitive as I got it by hand on about the 4th try so I'm overall optimistic.
This is all extremely exciting progress, but i can't help but feel that the clock is ticking. I've given myself until December 9th to completely finish everything except the final arbitrary execution payload and I'll be hard-pressed to have everything done by then but I think it might be possible if things go well. As always, this progress couldn't happen without the help of a lot of talented people - thanks to all who have supported, and if I haven't mentioned your name in any of these update posts, have no fear because I'll be doing a full credits listing both here in the forums and during the TASBot block.
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
feos wrote:
Spikestuff wrote:
I'd say it's more fitting to complete Wave 45 (Egg Wave) rather than just staying there but that was your choice.
I did consider it, but
1) it would look 100% similar to all the previous bonus rounds, and
2) I won't be able to end input so early. There's actually my personal
3) seeing how eggs become enemies is a better post-movie situation than seeing all enemies normally spawn once again.
I'm not sure what you two are talking about, level 45 is completed around 10:50.00 (and a surprising number of pterodactyls on level 45 are slain in the process). You may want to fast-forward a bit, though. :) The game over screen occurs around 11:40.00.
Yes vote - this *was* entertaining, and I really enjoyed how you took advantage of the free time you had. I am, of course, biased, but I'm thankful to see a Joust run that is likely to be accepted. Great work.
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
True wrote:
Was this ever verified to run on console?
Yes, I tried a test run from TASEditor - it seemed to desynch on the Multireplay board, but I was also having lots of problems with my SD card at the time. I got it to sync at least once on the older replay board, but even there I seem to recall it didn't work the first time I tried it. I'll be doing some more extensive testing to make sure it's reliable once I get the Multireplay board back.
Regarding phrase ideas, I'm feeling super lame on what to suggest for phrases. To clarify, you need two answers, and either answer an have ANY\WORDS\IN\LIST? About the best I can come up with is something lame like "FranerZ eats TRIPe" or something equally stupid. This is a good time to reminder you, oh reader, that we're still looking for someone to feed TASEditor twitch memes, because I'm clearly not great at it. :) (OK, I could probably do better than that, but I'm hoping someone with some linguistic creativity and a dictionary can step up to help out.)
In other news, we're still daily pushing forward with trying to get the total control run going. I have to again thank Ilari, true, Nach and now padz (from the Pokemon ROM hacking community) for their contributions of time, experience, and patience with me as I keep oscillating on what the path of least resistance of the day seems to be. We've almost all been online every day (or night) chatting about what to do and trying various tests. One thing I tested and ruled out is the Select+Start+B+A soft reset - Pokemon Red will not respond to that while saving, so there's no way to use it to save glitch. Because we thought we wouldn't be able to use the save glitch I pursued the fastest method that wouldn't use it which would be on red, but we've since determined that the non-save glitch method on Red would be substantially identical to the realtime run which is something we want to avoid if possible.
Because of all that, I'm now leaning back toward a save glitch with either Pokemon Yellow or the same general kind of save RAM glitch on Red. While it would be nice to do it on Yellow just to represent a different game it might be best to use Red because at the moment Yellow is not behaving right with lsnes + SGB + Gambatte core and can't even be started (and even Red, while at least playable, isn't coming up with the same trainer ID and I know we'd all feel a lot better if the accuracy were good enough to get it to match). Ilari is at the end of what he can do without more data about real hardware, so I've purchased a GB EPROM PCB board and shipped it to true and padz has volunteered to write a couple of tests we can run on raw hardware. Back when I thought we were doing Pokemon Red normally without the save RAM glitch I talked true into buying a copy (which he groused about amusingly :) so at the moment it makes the most sense to try to re-create the save glitch there since both of us will now have a copy.
I got far enough with Pokemon Red to confirm that the save glitch is possible to the point of getting all items in inventory but I did it with a hardware reset as expected, and that's still something we need to build and test. The latest information from padz and others is that it *should* be around a 20ms or so window and it's possible for even humans to get it with 10 or 15 attempts, so we'll boldly forge forward. If we absolutely must it's possible to reset the SNES through the Ext port on the bottom of the console, but that's getting into territory where it might look like we've modified the console so I'd rather have an actual reset solenoid on the reset button if the timing can be repeatable enough. If anyone is willing to step up and test/build this please let me know!
...and that was a *lot* more information than I anticipated putting in this post but I wanted to let everyone know that there is at least some momentum, even if it's been easy to feel a bit worn down by all the failed concepts. Thanks to everyone for the support and I'll check back in once we've made some more progress. Until then, happy TASing!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
This was definitely an entertaining watch. I can't help but think that it's missing something, however - like the ending. :) (Not that I have much room to speak, I seem to consistently make submissions that don't meet completion criteria, but I digress.)
I don't think this can be published in its current form but it is certainly worthy of Gruefood Delight, and I hope that this movie can be the base of a 3% run as others have suggested may be possible (although I reserve the right to be wrong and to have completely misunderstood the conversation). Keep up the good work!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
Zanoab wrote:
Did you clear your cookies and cache? Sites tend to notice returning potential customers and would adjust prices under the assumption you have to buy a ticket.
I tend to use a private browsing / incognito window for exactly that reason. Luckily, Southwest seems to not play those games as far as I can tell. It's definitely a fair point when dealing with the discount ticket sites, though!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
They say that the cheapest day to buy airfare is 54 days before the flight, and we're right around that time now, so I re-ran the numbers. It doesn't look pretty. Even adjusting for the cheapest possible flight times, the OAK to IAD and back round-trip costs went from $728.70 to $749.90, but staying on the exact same flights that wouldn't involve awkward travel times comes out to $991.40 per person, although oddly the flight number on the segment returning from DEN to OAK did not appear in the list as if it were completely sold out so I had to pick the next closest flight time.
The punchline is that we spent $1,343.80 when we purchased our airfare on 2014-10-22; booking the exact same flights today (54 days before the flight, the "ideal" time to purchase airfare according to cheapair.com) comes up to $1,982.80, meaning we saved $639 by buying earlier. As a disclaimer, it's always possible that other airlines other than Southwest have reduced their fares but it would appear that if you're flying near a holiday it's better to book earlier rather than later.
We are stoked for the opportunity to go represent TASVideos and I'll be sure to do a postmortem on our costs. As always, I hope this information is of use to someone!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
7It's been an eventful past couple of weeks. I need to again thank Ilari for his tireless efforts to port the Gambatte core into lsnes which has allowed for much better accuracy. There was a brief period of despair when we discovered that Pokemon Yellow is very hard to emulate accurately and we also determined that a reset probably would not synchronize. There was a period where we hoped to find an exploit in SML2:6GC but because the game is not SGB enabled all SGB functionality is disabled and it would be impractical to pursue. We've moved on to Pokemon Red and I was able to purchase a local copy with Bitcoin for the equivalent of $15 USD. I've done some initial tests using the older replay board and I can now get a movie to sync in the sense that all the button presses happen when they should but the trainer ID's do not match.
Right now I need to create a new movie file that presses Start to start the game as early as possible (something my sloppy test movie did not do) and determine if the pre-input phase lines up on the same frame, i.e. to ensure that the emulation accuracy of the SGB startup section is accurate. Past that, we need to deconstruct how the trainer ID is generated and work out how to get the trainer ID to line up with what it is on lsnes + Gambatte core. If anyone would like to help with this, please let me know.
Lastly, there are a number of positions still unfilled, including someone to think up donation incentives, someone to handle raffle prizes, and someone to help us work out twitch meme references (that avoid overly foul language or drug references in deference to our primetime spot and the fact that I anticipate that young children will likely be watching that segment of the marathon, including my own two children, but I digress :).
Thanks to all who have supported this effort. There's still a lot to get done but there's hope that the crazy arbitrary execution payload is still viable, which is awesome.
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
I interrupt this preparation thread with important news - we have been granted a 40 minute consolidated TAS block on the first day of the marathon during primetime (2015-01-04 20:15 EST). We're scheduled immediately after Mario Kart 8 and Mario Kart Wii, so I intend to have micro500 and Weatherton do the Mario Kart 64 race first, followed by the playaround TAS and finishing with the arbitrary code TAS.
As a brain dump of what I'm thinking through right now, I think I need to TAS those 40 minutes until they are perfect, i.e. I need to practice the actual presentation a whole lot more and not be as worried about last-minute payload testing and hardware hacking this year. I'll be requesting a rolling cart to make setup easier and improve reproducibility / reliability; this will be especially needed to accommodate everything we'll need for the different consoles.
I've updated the TASBot twitter feed with a link (I'm still somewhat new to Twitter and I think I committed a no-no by pasting the raw link; perhaps someone here with more experience can enlighten me.) It remains my goal to raise $25k during this 40 minute block, and if anything having it all consolidated into one block actually makes that goal a bit easier.
So, here's where I need to start pestering people to think about donation incentives, raffle prizes, etc. - as noted, I need volunteers for those positions and I haven't had a lot of response to that just yet so I figured I'd bring them up again. If you can help, please let me know. Thanks!
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
ars4326 wrote:
You know DwangoAC, I still think you could pull off the Joust ports if you would feature a new one every month, or so. Looking back, I believe submitting them all at once prevented them from "standing out" on their individual merits.
Maybe one port could be an "any%", while another could be a "playaround", etc. That way, each port would offer something new to the table.
That was actually something I was angling for, making one of them 1 player, one of them 2 player, one of them to highest score, one of them to first egg wave, etc., but the goal choices were not well received and the consensus was that it should be 2 player wherever possible.
Out of all of the ports, jpc-rr is the hardest emulator to use but the DOS version produces the most entertaining result so after I complete AGDQ 2015 I might consider taking this on again; in the meantime I'd welcome someone else doing it, though!
A.C.
******
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
Nach wrote:
That's quite alright, every guy here I'm sure gets mad from time to time. Just relax, have fun, and carry on.
Really, Nach? :)
(As an aside, this is always a complex issue as the typical in-person cues are flat-out missing and I go out of my way to avoid making gender assumptions online because of it.)
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
Nach wrote:
I'm offended that you think this run wasn't judged on its own merits. Copy and pastes aside to save verdict text effort, I looked at each run on its own, and I did for a time consider accepting this.
~snip~
Find the point where the game stops increasing in difficulty, and has a level loop, and stop there. As I said to you on IRC, I recall the game needing a good 30 waves more before it loops.
If I was mistaken about increasing difficulty, and I'm getting different ports of the game mixed up (there are multiple DOS ports, and I've played ports for several systems), please enlighten me, and I'll review, and happily accept if I'm wrong.
I confess that I was a bit rushed when I submitted this run as a knee-jerk response to Feos's NES Joust run (fed by my somewhat childish desire to have *all* the Joust ports represented at the same time). I had finished this TAS so many months before submitting it that even my own memory of which ports were different had started to blend together. The level of effort I went to to verify that this run was as complete as possible was less than adequate, fueled in part by my emotional state after all of the runs were rejected with the same message. If there really is meaningful content after the point I stopped in this DOS Joust port and it's the only way to satisfy the rules (entertainment / length considerations notwithstanding), then so be it.
I will endeavor to put more effort into researching the completeness of my category and goal choices, as this appears to be a personal failing on my part that I should address based on my recent submissions that have been rejected. Nach, I apologize for my reaction and any personal attack you perceived, which was not my intent. I expect my behavior as a representative of TASVideos to be above reproach, and that was not the case here, for which I am sorry.
As far as my involvement with any additional effort on this run, that will have to wait as I am fully invested in getting AGDQ 2015 prep completed right now but if someone else wants to pick this run up they are more than welcome to do so. Thanks to everyone for the interest, and here's hoping a good run of this game can be accepted at some point.
Experienced Forum User, Moderator, Published Author, Senior Ambassador, Experienced player
(898)
Joined: 9/14/2008
Posts: 1007
feos wrote:
dwangoAC wrote:
after a fair bit of twiddling I was able to get the movie file to console verify.
Oh god can you make a video?!
Otherwise, is there a possibility to strip lag frames out of the verification movie and make it feed input only when there's a poll?
I'll edit my post to clarify that I only got up to the point where FractalFusion tries to save the game, as any further would require an extremely accurate reset solenoid. I'm still in a position where the only solenoids I have on hand are from pinball machines and are strong enough to launch the reset button across the room (and, um, possibly embed it into a wall). So, I stopped right before saving, which has been good enough to prove what I feared - that SGB emulation accuracy inside of lsnes isn't accurate enough.
Some clarifying points - I am not using the VBA movie at all, I've only watched it and re-implemented the same button presses using lsnes's multirom loading feature to load world SGB ROM and Pokemon Yellow ROM. One interesting experiment would be to have someone do the exact same thing with Gambatte (or the BizHawk core) so we can count frames during the transitions and see how far off SGB emulation in lsnes is. It might not help in the long run unless we can fix SGB emulation accuracy but it'd give a good indication of the extent of the problem.
I can work around the minor issue of the SGB running at 1.024x speed by manually inserting a lag frame here or there and it's possible I could even work around *all* of the problems by making heavy modifications to the .r16m console verification file but I'm convinced I need a better method to do that than just relying on a hex editor. I'll ponder this. Any other ideas?
