(Link to video)

Game objectives

  • Emulator used: lsnes rr2-β23
  • Aims for fastest time
  • Uses glitched password
  • Corrupts memory
  • Executes arbitrary code

Executing $00F9

Big characters and small characters

Generally, big characters are placed in inside of the field. And small characters are in outside. Big characters aren't placed in outside if you play this game normally. (Sometimes small characters are in inside.)

Placing a big character in outside by using password

You can use a password at "スーパーバトルリーグ:Super Battle League" or "激闘対戦モード:VS Mode" for organization of the team and fix ability of each character. It depends on whether the 39th and 40th letter of a password who enters the outside. Before the start of the match, Graphic data is loaded from rom. But if a big character is placed in outside, memory corruption may be occured. It's depend on some characters. Perhaps it is unexpected that a big character enters the outside.

How to executing $00F9

Outside player: Grate Kaminarimon(グレートかみなりもん)
Stage: Moon
Opponent: Knight Gundam team(ナイトドラゴンズ)
This combination makes stack corruption, and executing $00F9 occured.

Jumping to password area

Usable memory address

$00F9 = a number of times attract mode match is watched
$00FA = a number of times cursor is moved
$00FB = a number of times A or B are pushed at password mode.
$00FC = a number of times sounds when cursor is moved
$00FD = a number of times sounds when A or B are pushed at password mode.
$1F80-$1FB1 = password

A barrage

As you barrage the A with a password mode, $00FD will not catch up with $00FB, because the sound is not in time. If the difference between $00FB and $00FD is set to 1 at the moment when screen gliches, it is possible to make the instruction for jump to password area.
Address Bytes Instruction Comment
$00/00F9 01 80 ORA ($80,x)
$00/00FB 20 80 1F JSR $1F80 Jump to password area

Jumping to ending

Password

ノノノぼご ルじKぐチ ニニワおネ ネネネネネ
ネヤlネず ミ ネネネ ネネネネネ ネネネテテ
テテテテテ テテテテせ
Address Bytes Instruction Comment
$00/1F80 59 59 59 EOR $5959,y
$00/1F83 4A LSR A
$00/1F84 0E 99 1F ASL $1F99 $1F99 is shifted left of 1
$00/1F87 9C 0C 42 STZ $420C $420C is set to 0(to stop HDMA)
$00/1F8A 56 56 LSR $56,x
$00/1F8C A9 04 LDA #$04 The accumulator is set to 0x04
$00/1F8E 58 CLI
$00/1F8F 58 CLI
$00/1F90 58 CLI
$00/1F91 58 CLI
$00/1F92 58 CLI
$00/1F93 58 CLI
$00/1F94 58 CLI
$00/1F95 85 C2 STA $C2 $00C2 is set to 0x04
$00/1F97 58 CLI
$00/1F98 20 74 C0 JSR $C074 0x74 will be shifted left of 1 to 0xE8
becomes...
$00/1F98 20 E8 C0 JSR $C0E8 Call final scene

Password Text Table

000102030405060708090A0B0C0D0E0F10111213
1415161718191A1B1C1D1E1F2021222324252627
28292A2B2C2D2E2F303132333435363738393A3B
3C3D3E3F404142434445464748494A4B4C4D4E4F
505152535455565758595A5B5C5D5E5F60616263
6465666768696A6B6C6D
6E6F707172737475767778797A7B7C7D7E7F8081
A B C D E F G H I J
82 83 8485 86 8788898A8B8C8D8E8F9091
K L M N O P Q R S T
92939495969798999A9B9C9D9E9FA0A1A2A3A4A5
U V W X Y Z
A6 A7 A8A9 AA ABACADAEAFB0B1
B2B3B4B5B6B7B8B9BABBBCBDBEBFC0
C1 C2 C3C4 C5 C6
C7C8

Other comments

This ending is not for "スーパーバトルリーグ:Super Battle League". This is for "真・闘球王伝説:Shin Toukyuou Densetsu".

Samsara: Judging.
Samsara: Changing branch to just "game end glitch" and accepting to Moons.
Samsara: Hopefully replacing with a file with the blank SRAM removed.
Guga: Processing...

TASVideoAgent
They/Them
Moderator
Joined: 8/3/2004
Posts: 14875
Location: 127.0.0.1
Site Admin, Skilled player (1236)
Joined: 4/17/2010
Posts: 11268
Location: RU
Great stuff, voted yes.
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Joined: 6/4/2009
Posts: 893
good finding, yes vote too
Skilled player (1706)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
If not for the fact this uses arbitrary code execution, I'd complain about the Spiderman 2 glitched password thing being rejected. With that said, this is the first time I've seen a password screen used as an exploit. I wonder any other games with passwords have exploits?
Former player
Joined: 6/30/2010
Posts: 1093
Location: Zurich, Switzerland
jlun2 wrote:
If not for the fact this uses arbitrary code execution, I'd complain about the Spiderman 2 glitched password thing being rejected. With that said, this is the first time I've seen a password screen used as an exploit. I wonder any other games with passwords have exploits?
[2059] SNES Mega Man X "password glitch" by FractalFusion in 16:56.88
Current project: Gex 3 any% Paused: Gex 64 any% There are no N64 emulators. Just SM64 emulators with hacky support for all the other games.
Skilled player (1706)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
andypanther wrote:
[2059] SNES Mega Man X "password glitch" by FractalFusion in 16:56.88
I meant ACE, but my fault for not mentioning. Also, No vote, since my ears. :/ Sorry about that. Good effort finding this however.
Ford
He/Him
Joined: 3/5/2013
Posts: 183
Location: California
jlun2 wrote:
If not for the fact this uses arbitrary code execution, I'd complain about the Spiderman 2 glitched password thing being rejected. With that said, this is the first time I've seen a password screen used as an exploit. I wonder any other games with passwords have exploits?
Maybe Ecco 1? I once glitched it in real time by entering a wrong password, though I wasn't able to finish the game.
Joined: 9/8/2014
Posts: 19
What's with the dirty sram? isn't that usualy not allowed (except with gameplay modes that need clear data, and even then only when a verification movie is provided, which does not seem to be the case here)?
Active player (434)
Joined: 2/5/2012
Posts: 1687
Location: Brasil
hum i don't really understand,i don't think this has dirty sram,just uses password to glitch the game(which is totally different)
TAS i'm interested: megaman series: mmbn1 all chips, mmx3 any% psx glitched fighting games with speed goals in general
Skilled player (1706)
Joined: 9/17/2009
Posts: 4952
Location: ̶C̶a̶n̶a̶d̶a̶ "Kanatah"
grassini wrote:
hum i don't really understand,i don't think this has dirty sram,just uses password to glitch the game(which is totally different)
http://tasvideos.org/Lsnes/Movieformat.html
Savestate / SRAM / clean detection If file named "savestate" is present, it is a savestate, otherwise If file named "savestate.anchor" is present, it starts from savestate, otherwise If file with name starting with "moviesram." is present, it starts from SRAM, otherwise It starts from clean state
This btw. Not sure if it affects sync if deleted.
londonb415
He/Him
Player (37)
Joined: 2/14/2016
Posts: 1
Location: Japan
A sram file got mixed unintentionally. No need to be written to the sram something in advance. I confirmed it works without sram file at my environment.
Masterjun
He/Him
Site Developer, Skilled player (1970)
Joined: 10/12/2010
Posts: 1179
Location: Germany
No, it's not the fault of the author. The SRAM is just a problem with the parser of TASVideos.
jlun2 wrote:
http://i.imgur.com/hsJKwit.png This btw. Not sure if it affects sync if deleted.
The file is literally 0 bytes.
Warning: Might glitch to credits I will finish this ACE soon as possible (or will I?)
Active player (372)
Joined: 9/25/2011
Posts: 652
The Movie Rules explicitly state: No skipping to the end with a password The point is to beat the full game, skipping major sections of the game with a password defeats the purpose. No vote. -->Just kidding! That was great. Yes vote! ;)
Site Admin, Skilled player (1236)
Joined: 4/17/2010
Posts: 11268
Location: RU
I dunno if you're being serious or not, but that rule refers to actual passwords that actually skip to actual game end. Here the password doesn't skip, it's used as RAM that contains arbitrary code, and then the game is glitched to make execution jump to there. And the code written there is skipping to the game end.
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.
Joined: 2/1/2008
Posts: 347
feos wrote:
I dunno if you're being serious or not, but that rule refers to actual passwords that actually skip to actual game end. Here the password doesn't skip, it's used as RAM that contains arbitrary code, and then the game is glitched to make execution jump to there. And the code written there is skipping to the game end.
There's text hidden between the --> and ;) So that wasn't being serious.
<ccfreak2k> There is no 'ctrl' button on DeHackEd's computer. DeHackEd is always in control.
Active player (372)
Joined: 9/25/2011
Posts: 652
feos wrote:
I dunno if you're being serious or not, but that rule refers to actual passwords that actually skip to actual game end. Here the password doesn't skip, it's used as RAM that contains arbitrary code, and then the game is glitched to make execution jump to there. And the code written there is skipping to the game end.
The password contains code that is used to skip to the end. No matter how you look at it, this TAS skips major sections of the game using a password. Look Here!! -->Yeah, I am completely joking. :) However, I do think the rules should be updated. More and more TASses (this one, for example) are not about beating the full game.;)
Post subject: Movie published
TASVideoAgent
They/Them
Moderator
Joined: 8/3/2004
Posts: 14875
Location: 127.0.0.1
This movie has been published. The posts before this message apply to the submission, and posts after this message apply to the published movie. ---- [3099] SNES Battle Dodge Ball "game end glitch" by londonb415 in 00:56.21
MESHUGGAH
Other
Skilled player (1888)
Joined: 11/14/2009
Posts: 1349
Location: 𝔐𝔞𝔤𝑦𝔞𝔯
I'm not really sure but I think "Uses level password" should be added or removed from [2059] SNES Mega Man X "password glitch" by FractalFusion in 16:56.88 too. From judgement notes of the latter: On the other hand, it abuses the password system, and while not actually using a password, the use is questionable.
PhD in TASing 🎓 speedrun enthusiast ❤🚷🔥 white hat hacker ▓ black box tester ░ censorships and rules...
Site Admin, Skilled player (1236)
Joined: 4/17/2010
Posts: 11268
Location: RU
Only if the password that is entered can take you to a later level.
Warning: When making decisions, I try to collect as much data as possible before actually deciding. I try to abstract away and see the principles behind real world events and people's opinions. I try to generalize them and turn into something clear and reusable. I hate depending on unpredictable and having to make lottery guesses. Any problem can be solved by systems thinking and acting.