Final Fantasy glitched

  • As fast as possible
  • Memory corruption
  • Executes arbitrary code (not total control though)
  • Encodes a message with an ancient cipher

Stair glitch

Certain staircases in Final Fantasy push a state on to the stack to keep track of where you have gone. Take enough of those and you can overflow the stack. Hitting start to bring up the menu triggers a glitch that jumps into a range of memory used when entering your party's names. There actually aren't many staircases that use this but one of them is in Castle Coneria right where you start.
Since it is the name entry that sets the memory up, multiple glitches can be executed by starting a new party, hitting reset and loading up your actual party. In some cases you don't need to reset because the savegame memory gets corrupted.
The Japanese version has a larger character set than the English version even though it only supports the phonetic Hiragana alphabet and a few other characters. Turns out that some of the character codes not available in English are needed to execute some of the more interesting glitches.
For a full explanation see the forum discussion.

How to use the glitch

Welcotar posted this on the forums after Gyre [dead twitch link removed] found this out and used it to make some realtime runs. This run is basically a TAS-optimized version of Gyre's fastest method [dead twitch link removed].
The first plan was to jump right to the credits. Gyre figured out a way to do that by jumping to the memory of the item list. The item list had to be set up for this and even with some underflow glitches it still took a while [dead twitch link removed].
Another interesting but much longer plan involved gaining access to the final dungeon and completing it [dead twitch link removed]. The stairs glitch was used to corrupt one character's level to 102. At that level most normal enemies flee and bosses flee about 2/3 of the time. It took close to an hour but that was good enough to beat the current any% TAS by over 10 minutes.
The fastest method used here first uses that same level corruption trick. A second glitch causes the next NPC to trigger the final boss fight vs Chaos. As we already know, making Chaos run is good enough to get the credits to roll.

Easter Eggs

Only the second and last hero names matter. You need to name the first and third though. Since you can move the cursor one step without losing time I enter something besides just ああああ (aaaa). If I am getting this right the names sound like 'akasai' and 'waiwai'.
You need to step off the stairs and back on many times. It doesn't matter which direction so I felt like I had to do something to play with that. So I used the direction to encode a message. The message in the first stair glitch is the names of the authors and the second one is a special Final Fantasy-related message.

TheAxeMan's comments

Thanks to everyone who posted on the forums. Welcotar, Gyre and others did most of the work investigating the glitch. Inzult posted a mostly optimized run that I just cleaned up a little for this submission. I was finishing up my Ultima 4 NES run.

Noxxa: Judging.
Noxxa: Walking up and down stairs repeatedly for five minutes is a repetitive affair, but results in an oddly comedic effect for this run. It's also nice to see how that action ends up breaking the game entirely. Accepting for Moons as a new branch.
sheela901: Processing.

TASVideoAgent
They/Them
Moderator
Joined: 8/3/2004
Posts: 14856
Location: 127.0.0.1
Patashu
He/Him
Joined: 10/2/2005
Posts: 4014
It took a while, but FF1 has finally joined the elite inner circle of games that are truly broken.
My Chiptune music, made in Famitracker: http://soundcloud.com/patashu My twitch. I stream mostly shmups & rhythm games http://twitch.tv/patashu My youtube, again shmups and rhythm games and misc stuff: http://youtube.com/user/patashu
Invariel
He/Him
Editor, Site Developer, Player (169)
Joined: 8/11/2011
Posts: 539
Location: Toronto, Ontario
I am very happy to see this done.
I am still the wizard that did it. "On my business card, I am a corporate president. In my mind, I am a game developer. But in my heart, I am a gamer." -- Satoru Iwata <scrimpy> at least I now know where every map, energy and save room in this game is
Skilled player (1705)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
Console verify please that would be amazing lol. Edit: Oh, and I thought the site didn't used "glitched" any more. It's technically not a "game end glitch" either since you do fight the boss, sorta, so what do?
Banned User, Skilled player (1165)
Joined: 12/26/2006
Posts: 231
Location: Lonely City
What a stunning discovery.Yes voted of course.
work hard
Spikestuff
They/Them
Editor, Publisher, Expert player (2283)
Joined: 10/12/2011
Posts: 6336
Location: The land down under.
Temp encode needed? Temp encode needed. Creating a temp encode. Supercut needed? Supercut needed. Also creating a supercut encode. Normal: Link to video Supercut: Link to video There. I saved your "holding down TAB button extravaganza" for you.
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. Something better for yourself and also others.
adelikat
He/Him
Emulator Coder, Site Developer, Site Owner, Expert player (3584)
Joined: 11/3/2004
Posts: 4738
Location: Tennessee
Why was the J version used? Does the glitch only work on this version?
It's hard to look this good. My TAS projects
Player (79)
Joined: 8/5/2007
Posts: 865
adelikat wrote:
Why was the J version used? Does the glitch only work on this version?
From the submission text:
The Japanese version has a larger character set than the English version even though it only supports the phonetic Hiragana alphabet and a few other characters. Turns out that some of the character codes not available in English are needed to execute some of the more interesting glitches.
They're injecting arbitrary code via the player names. The Japanese (hiragana) character set includes a character ("ko", I believe) that corresponds to hexadecimal $4C, the invaluable JMP command in the 6502 processor. I played around with the US version but the only characters that affect the program counter correspond to BCC and BCS (branch on carry clear and branch on carry set), which can only send the program counter somewhere in the VRAM, if I remember correctly. Believe me, I'd like to see the American version of the game broken, but it's not going to happen any time soon barring a major breakthrough. I may toy with it some more at a later date.
ars4326
He/Him
Experienced player (764)
Joined: 12/8/2012
Posts: 706
Location: Missouri, USA
And thus, the four legendary Light Warriors set out on their epic adventure. The wind stopped. The sea was wild. And their hamstrings were mighty sore from perpetually scaling the stairways of Corneria Castle. Again and again they climbed...creating a time loop that warped them back to the beginning, when Chaos was a mere castle guard. He ran away. The world was saved. and a 'yes' vote was added.
"But as it is written, Eye hath not seen, nor ear heard, neither have entered into the heart of man, the things which God hath prepared for them that love him." - 1 Corinthians 2:9
Spikestuff
They/Them
Editor, Publisher, Expert player (2283)
Joined: 10/12/2011
Posts: 6336
Location: The land down under.
My vote is Meh. Just watching something that is better than Die Hard (stairs) for a quite a long time, doing something then continuing doing the stairs, I really don't find entertaining.
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. Something better for yourself and also others.
Skilled player (1149)
Joined: 5/11/2011
Posts: 425
Location: China
Oh men, I really want to watch the GBA version next time. Amazing glitch. Yes vote for Vault.
Active player (405)
Joined: 3/22/2006
Posts: 708
Four guys walk up and down stairs for 6 minutes: The game.
Editor, Skilled player (1504)
Joined: 7/9/2010
Posts: 1317
Yes for vault! Voted no.
Favorite animal: STOCK Gt(ROSA)26Sortm1.1(rtTA,EGFP)Nagy Grm7Tg(SMN2)89Ahmb Smn1tm1Msd Tg(SMN2*delta7)4299Ahmb Tg(tetO-SMN2,-luc)#aAhmb/J YouTube Twitch
Player (12)
Joined: 6/17/2006
Posts: 501
Arbitrary code execution runs are the best runs, so easy Yes vote for me! Sure it's a bit boring to watch the screen transition for 3 minutes twice, but it helps building the suspense and the payoff is so worth it! By the way, considering the stairs overflow glitch was already known for Final Fantasy IV for a while now, I'm surprised that it took so long to find the same glitch in the original Final Fantasy. I wouldn't be surprised if the same glitch also exists in other games in the series.
Former player
Joined: 2/15/2015
Posts: 12
The problem with certain stairs in FF1 have been known for many years. Until recently it was believed that it could only be used to crash the game. Although both FF1 and FF4 have large glitches related to stairs the two bugs are actually very different.
Techokami
He/Him
Joined: 6/23/2008
Posts: 160
10/10 would stair again RIP Final Fantasy Yes vote, but I think this might be more or less vault material
Joined: 9/1/2014
Posts: 58
Voting yes, sadly due to the long wait of the stairs I could see a problem with the whole "entertainment" value to keep it out of the vault. Perhaps the abridged version linked above if it were an issue could help out with that somehow.
Enjoys speedruns but hasn't actually tried making any yet.
Former player
Joined: 2/15/2015
Posts: 12
Some more technical details for people that like to geek out. The game uses memory from $0300-$033F for constructing many of the menus. Walking up and down stairs repeatedly corrupts a list of return locations used to remember what floor you came from past a reasonable number of entries the programmer expected to need. Because of that, opening the menu afterwards causes the instruction pointer to jump to "code" at $030A which is actually data. This runs through some garbage instructions for a while until reaching the name of our second player. In the first trip the second player name corresponds to the instructions: LDA $A356 BCS xxxx The load instruction puts the value $66 into the accumulator. The address we're pulling from is just an arbitrary ROM location that has the right value and can be constructed using our limited alphabet of names. The branch instruction will be taken. We don't control where the branch goes because character names are only 4 bytes long but the next byte happens to be a value that sends us to $032C which is a little before the fourth player name. This again runs through some garbage instructions for a while until reaching the fourth player name corresponding to the instructions: TAX JMP $9385 The tax instruction copies the value $66 from the accumulator to the X register. We then jump into the middle of a routine that's normally used for updating character data. This stores the value of the accumulator at an offset specified by the X register so we write $66 to address $6166 in memory. That memory address is the level of our second character who the game now thinks is level 103. In the second trip our second and fourth character names correspond to the instructions: LDA $83AA BCS xxxx --- JMP $90A0 The load instruction puts the value $1A into the accumulator. The jump instruction then takes us into another copy routine that's normally used for updating map data. We haven't set the X register but it will be $10 based on the menu code run previously. The result is that we write $1A to the address $6F10. $6F10 controls the NPC dialog for the guard standing next to the staircase and $1A is the ID for Garland's final message before you fight Chaos. That message is programmed to automatically start the Chaos fight. When Chaos takes his turn, like any enemy he first checks whether to run from battle. This uses a morale calculation: 80 + 2 * [Party Level] - Random[0..50] > [Enemy morale] As a boss, Chaos has 255 morale which is normally impossible to overcome. In TheAxeMan's previous TAS he showed off making Chaos run by reducing his morale using multiple critical hits with the FEAR spell. Here, we instead use our level 103 party leader and a lucky roll through RNG manipulation to cause the same effect. And so Chaos runs away and the world is saved.
Synahel
She/Her
Former player
Joined: 1/19/2011
Posts: 259
Location: France
Very happy to see this as a TAS Been watching Gyre_ streams with a lot of interest Sweet sweet sweet
Banned User, Former player
Joined: 3/10/2004
Posts: 7698
Location: Finland
Even at the risk of sounding like a broken record and a contrarian, I got sick of ACE like a year ago, and this didn't change my mind. But as long as this doesn't replace the actual game completion TAS, it's ok.
Joined: 10/11/2010
Posts: 19
Yes vote, a very good effort to publish alongside the existing runs. The "plot" is great - the Light Warriors go up and down the stairs until they are really buff, and it turns out that a nearby guard was Chaos all along. He freaks out at how tough the party is, and runs so far away (maybe he hits the planet's escape velocity?) that his sway over the world vanishes entirely.
Sir_VG
He/Him
Player (39)
Joined: 10/9/2004
Posts: 1911
Location: Floating Tower
Great job. Not very entertaining, but still cool to see. Voting for the vault.
Taking over the world, one game at a time. Currently TASing: Nothing
EgixBacon
He/Him
Player (181)
Joined: 4/15/2013
Posts: 331
Location: In the attic
Oh man, it's Anubis II all over again... and by that, I mean it's only entertaining if you watch the supercut. Aside from that, I believe the names of the first and third heroes were romanised incorrectly in the submission: they are 'Akakaki' and 'Yayuyayu'. If it were possible to use the naming script to change them to Akasai and Waiwai without affecting sync, I think it would be worth making that change - it would satisfy all the hiragana-knowing easter egg hunters :)
FanFiction|Youtube Still on Win7! Take that, Microsoft!
Skilled player (1705)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
So...has anyone addressed how to branch the TAS and the current published movie? Or just going back to using "glitched" (which is rather odd considering the current published TAS has the "Heavy glitch abuse" tag lol)
Spikestuff
They/Them
Editor, Publisher, Expert player (2283)
Joined: 10/12/2011
Posts: 6336
Location: The land down under.
If we're giving it a branch it has to be "Die Hard"
WebNations/Sabih wrote:
+fsvgm777 never censoring anything.
Disables Comments and Ratings for the YouTube account. Something better for yourself and also others.