(Link to video)
Bowser left a back door open into the Princess' chamber, letting Mario rescue her 7 minutes and 30 seconds faster. This run uses a glitched pipe entry in 7-1 to go out of bounds, where a glitched tile and enemy x-positions are used to execute arbitrary code that jumps straight to the Princess rescue.
Enable subtitles on the encode if you want some explanation as the movie plays.

Lord Tom's Comments

Tompa and I had been working pretty steadily on a 100% run when RAT926 found the glitch. I wasn't good enough with assembly to try to do anything with it until HHS figured out a way to use it to reach the credits. The prospect of cutting 7 minutes off the any% was too much to pass up, so here we are!
It was a challenge to understand the spawning/despawning behavior and translate that into strats that would both be fast and gives us the memory values we needed. But my biggest surprise was how hard it was to optimize Mario's movements with the tail on a vertical level like 7-1...we re-did various portions countless times for frame savings big and small.
Along the way I was happy to work with Producks on strats that might be possible realtime, a feat at least 3 speed-runners have accomplished, with the fastest time currently 3:31 with room for improvement.
My personal preference would be that this run not obsolete the prior any%, with a new category created whichever labels are chosen. I know there's active discussion presently on how to handle this sort of glitched run, so here's some more fodder for discussion. :)

Tompa's Comments

I had tried to improve the previous run for a long time, just to see if we could push it lower. Thanks to Glitchman, 9 of the 14 needed frames for the first world were improved. And with a few extra frames by Tom and I, we reached 13. I gave up for the moment. Until this glitch came around!
I expected us to be done fairly quickly, for an April 1st submission, though we kept pushing it. When you are just one frame to bypass another frame rule, we just got to go for it.
I'm quite happy with the result. Meaning it's finally time to get back to the 100% TAS and work on fun autoscrollers again...

World 1

Not much is new here. GlitchMan found a faster way to collect the mushroom in 1-1. We managed to save a few more frames in the fortress using less slowdown to get past the balls.

7-1

Recent warpless TAS's have gone through the wall to skip most of 7-1 so TAS'ing the vertical portion was pretty new. Having the racoon suit left over from 1-F is helpful since the tail-flip lets Mario grab shells very quickly and Mario can also tail-flip shells on the same frame he stomps them to climb faster. Wall jumps are also crucial to climbing without needing either P-speed or entering extra tubes (which are very slow).

Wrong-warping SMB3

Touching the glitch tile, an invisible note block, makes the processor try to update memory outside of the normal tile data, at an address ($9c70) that reprograms how the processor interprets addresses. This causes execution to jump to an unintended area of the ROM and execute incorrect instructions. Eventually, the stack overflows and it starts executing RAM instructions starting at address $0081, which is just before the location of the player x value at $0090 and enemy x values $0091-5.
Devising an effective strat requires understanding how enemies spawn into the five enemy slots. New enemies spawn when the screen scrolls close enough to their spawn position, and that enemy has not previously been killed. The new enemy will be placed into the first slot that doesn't already hold an active enemy, starting at $0095 and working backwards.
To jump to the Princess, we need 3 consecutive x values to read, in order: 32, 225 or 227, 143. This results in the assembly instruction "JSR $8FE1", which reads as "Jump to the subroutine at address $8FE1."
Mario's x must be 232-240 to activate the glitch, so 3 enemies must be used. The leftmost piranha plant's x range includes 32; the other 2 plants aren't useful so 225/227 and 143 have to come from koopas.
The piranha plant unavoidably spawns into $0094 at the start of the level, but we need it at $0093 or lower to have 2 enemy slots follow it. Therefore we have to climb at least until the piranha despawns. But doing so (bringing the first koopa along to keep $0095 occupied) spawns the koopa between the ?'s into $0094 and the flying koopa into $0093. Initial efforts killed the flying koopa to allow the piranha to spawn into $0093 on the way down. Later, we found that by optimizing a 4-frame despawn rule and grabbing the ?'s koopa and falling very quickly we could despawn the flying koopa just before the piranha spawns, putting the piranha into the correct slot. Note also that the right-most piranha must be killed on the way up or it will spawn into $0093 on the way back down.
Mario can only carry one shell at time. So to grab the ?'s shell, we need to throw the $0095 shell such that it doesn't despawn and also ends up where we can grab it again. There's not much margin for this, but it's just possible to throw the shell so it ends up spinning between the middle pipes down below. This lets Mario grab it after throwing the $0094 shell without breaking stride.
As we fall from the ?'s area, we now have the left piranha plant in $0093, the ?'s shell in $0094, and the first shell from the level entry in $0095. All that remains is to throw the two shells such that they hit the right x values on the same (single) frame the plant's x value hits 32...and then execute the pipe glitch on that same frame.

The Pipe Glitch

This glitch has been known for some time. If Mario presses down while being ejected from the right side of a pipe end-cap, the game thinks he's standing in the middle and lets Mario enter the pipe.

Thanks

RAT926 for discovering the glitch tile that enables the wrong warp.
HHS for figuring out the technical details of the glitch, determining the instruction that would skip to the ending, and writing a script to troubleshoot sprite placement.
vgmaps.com for making TAS'ing so much easier.

Noxxa: Judging.
Noxxa: Great to see another big title broken with arbitrary code execution to jump to the ending. Accepting to Moons as a separate branch - this run will not obsolete the classic conventionally played run category.
Ilari: Processing.
Ilari: Replaced file with one with author subtitles. No changes to input.

TASVideoAgent
They/Them
Moderator
Joined: 8/3/2004
Posts: 14877
Location: 127.0.0.1
This topic is for the purpose of discussing #4288: Lord_Tom & Tompa's NES Super Mario Bros. 3 in 02:54.98
Editor, Skilled player (1404)
Joined: 3/31/2010
Posts: 2086
It's raining Total Control!
Joined: 2/21/2014
Posts: 4
Great improvement. I really like how 7-1 looks now compared to the earlier proof of concept run.
Spikestuff
They/Them
Editor, Publisher, Expert player (2292)
Joined: 10/12/2011
Posts: 6337
Location: The land down under.
My face when I saw the time: :| My face when I realized why: :3 My face when I watched TAS: :3 My face when I saw Tompa: :D TOMPALALALALALALALALA :3 Easy Yes Vote. #SAVETHEFRAMES
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. Something better for yourself and also others.
Editor, Skilled player (1505)
Joined: 7/9/2010
Posts: 1317
Nice work Lord Tompa. Yes vote.
Favorite animal: STOCK Gt(ROSA)26Sortm1.1(rtTA,EGFP)Nagy Grm7Tg(SMN2)89Ahmb Smn1tm1Msd Tg(SMN2*delta7)4299Ahmb Tg(tetO-SMN2,-luc)#aAhmb/J YouTube Twitch
Eszik
He/Him
Joined: 2/9/2014
Posts: 163
No vote because it's not by Masterjun. ... Kidding. Awesome run, easy yes vote!
I problably made mistakes, sorry for my bad English, I'm French :v
Experienced player (501)
Joined: 3/1/2014
Posts: 76
Location: Paris
yes vote! that glitch!
ACE is my raison d'etre!
Warepire
He/Him
Editor
Joined: 3/2/2010
Posts: 2174
Location: A little to the left of nowhere (Sweden)
Been anticipating this since the demonstration TAS in the SMB3 topic. Absolutely fantastic. Yes vote.
Emulator Coder
Joined: 3/9/2004
Posts: 4588
Location: In his lab studying psychology to find new ways to torture TASers and forumers
This movie is so good, you really should've submitted it to TASVideos Pro. Also, the way this works is quite similar to the pipe system in the original SMB. So similar things may be possible there, time to beat: 3:24.02 ;)
Warning: Opinions expressed by Nach or others in this post do not necessarily reflect the views, opinions, or position of Nach himself on the matter(s) being discussed therein.
GoddessMaria
She/Her
Reviewer, Experienced player (849)
Joined: 5/29/2009
Posts: 514
Location: Hell...
At last it has been submitted! I've been anticipating this run since the discovery in the SMB3 topic. I first thought that the run was going to be in the 3 minute range, but you both blew it out of the water! The glitches and optimization were wonderful and like the others, I've been greatly entertained throughout the run. Powerful Yes Vote!
Current projects: failing at life
Joined: 5/13/2009
Posts: 141
WHAT HAVE YOU DONE TO THE GAAAAME yes.
Guga
He/Him
Joined: 1/17/2012
Posts: 838
Location: Chile
lol
Fortranm
He/Him
Editor, Experienced player (780)
Joined: 10/19/2013
Posts: 1115
Two glitched runs in a row in less than 12 hours. Yes.
mklip2001
He/Him
Editor
Joined: 6/23/2009
Posts: 2224
Location: Georgia, USA
I'm not sick of total control runs yet! This had an incredible-looking setup too. Spectacular. As for obsoletion matters, can we call the current any% "warped, no memory corruption"? Or maybe we just call this run the "memory corruption" run, though I think that spoils the punchline of the run...
Used to be a frequent submissions commenter. My new computer has had some issues running emulators, so I've been here more sporadically. Still haven't gotten around to actually TASing yet... I was going to improve Kid Dracula for GB. It seems I was beaten to it, though, with a recent awesome run by Hetfield90 and StarvinStruthers. (http://tasvideos.org/2928M.html.) Thanks to goofydylan8 for running Gargoyle's Quest 2 because I mentioned the game! (http://tasvideos.org/2001M.html) Thanks to feos and MESHUGGAH for taking up runs of Duck Tales 2 because of my old signature! Thanks also to Samsara for finishing a Treasure Master run. From the submission comments:
Shoutouts and thanks to mklip2001 for arguably being the nicest and most supportive person on the forums.
Mecha_Richter
He/Him
Joined: 10/11/2011
Posts: 53
Wow.
Joined: 5/2/2006
Posts: 1020
Location: Boulder, CO
I am impressed! huge yes vote. Really cool discovery.
Has never colored a dinosaur.
Techokami
He/Him
Joined: 6/23/2008
Posts: 160
Welp, RIP Super Mario Bros. 3 You had a good life. Yes vote!
Buddybenj
He/Him
Joined: 1/12/2013
Posts: 166
Location: USA
OK... Yay glitched SMB3 TAS!
Projects: Interested in TASing N64 Mario Golf. GBA Mario Tennis: Power Tour is on hold.
Active player (422)
Joined: 9/27/2004
Posts: 650
Location: Canada
JSR $8FE1    ;    jump to yes vote routine
sack_bot
He/Him
Player (111)
Joined: 11/27/2011
Posts: 394
Location: Massachusetts
Inzult wrote:
JSR $8FE1    ;    jump to yes vote routine
Voting yes. Now we need a executes arbitrary code run.
Message me here for my discord. Current Project: Psycho Waluigi Project on wait list: None?
Joined: 5/2/2009
Posts: 656
So, I should expect someone programming something in SMB3 to next April Fools, AGDQ marathon or pi day?
My first language is not English, so please excuse myself if I write something wrong. I'll do my best do write as cleary as I can, so cope with me here =) (ノಥ益ಥ)ノ
Experienced player (630)
Joined: 11/23/2013
Posts: 2208
Location: Guatemala
Instant Yes vote.
Here, my YouTube channel: http://www.youtube.com/user/dekutony
Emulator Coder, Skilled player (1141)
Joined: 5/1/2010
Posts: 1217
OmegaWatcher wrote:
So, I should expect someone programming something in SMB3 to next April Fools, AGDQ marathon or pi day?
Using this bug for ACE is prbably quite hard if possible at all. This run needed to program only 3 bytes (a single jump instruction). The ACE input routines are far larger than that. I expect that very few games that aren't: - SNES games (because of controller autopoll registers). - Have serious inventory (one could write code to inventory) have ACE bugs. Credits glitches (like this one) are much less demanding (but still can require nontrivial amounts of code). E.g. PSX Castlevania: Symphony of the Night run had to use inventory as code.
Lord_Tom
He/Him
Expert player (3274)
Joined: 5/25/2007
Posts: 399
Location: New England
Ilari wrote:
OmegaWatcher wrote:
So, I should expect someone programming something in SMB3 to next April Fools, AGDQ marathon or pi day?
Using this bug for ACE is prbably quite hard if possible at all. This run needed to program only 3 bytes (a single jump instruction). The ACE input routines are far larger than that. I expect that very few games that aren't: - SNES games (because of controller autopoll registers). - Have serious inventory (one could write code to inventory) have ACE bugs. Credits glitches (like this one) are much less demanding (but still can require nontrivial amounts of code). E.g. PSX Castlevania: Symphony of the Night run had to use inventory as code.
Actually, I do have a prototype routine (see the SMB3 forum topic) that could be used for total control - though due to the limitations imposed by the NES and SMB3 a fairly elaborate setup is required. Basically, the 7-1 glitch can be used to implement a 9-byte setup loop (P1) that uses controller input to write a larger, but still small, program on the zero page (P2). P2 is able to use both controllers to write larger routines (P3) anywhere in memory to implement total control. I'm planning to do a run based on it, but will take my time to try to show off the maximum effects possible.
Joined: 2/1/2011
Posts: 88
Sweet! Yes vote! That was awesome.