For a walkathon do people think that grabbing shells/blocks should be forbidden, since it uses the B button, even if walking speed is not exceeded?
Useless, but yet again beautiful! Keep 'em coming.
Could I get an encode? (Don't have a way to play it back on emulator atm)
Total control is definitely possible with this bug. After it writes $80 to $9c70, it starts executing completely wrong things and then it returns to $0081. A BRK is then needed to get the PRG layout back to normal. So, by manipulating some bytes between $0088 and $00ff to read 20 e3 8f, you can get to the ending scene. Note that the stack pointer is overflowing, so a JSR is needed to get it back where it should be (or the ending will be bugged and get stuck when the carpet goes up).
target = 0xae
lengths={2,2,2,2,2,2,2,2,1,2,1,2,3,3,3,3,
2,2,0,2,2,2,2,2,1,3,1,3,3,3,3,3}
while true do
addr=0x81
j=0
y=0
b=0
while y<16 do
op=memory.readbyte(addr)
l=lengths[AND(op,31)+1]
color='#ffffff'
if op==0x20 or op==0x4c then color='#ff0000' l=3 b=b+1 end
if l==0 or AND(op,0x8f)==2 or op==0x40 or op==0x60 then color='#ff0000' l=1 b=b+1 end
if AND(op,31)==0x10 then color='#c0c000' end
if addr==target then color='#00ff00' end
for i=0,l-1 do
x=memory.readbyte(addr)
if b>1 then color='#502020' end
gui.text(j*20,y*8,string.format('%02X',x),color)
color='#bf9090'
addr=addr+1
j=j+1
if j==12 then j=0 y=y+1 end
if b==1 then b=2 end
end
if addr>target or addr<0x80 then break end
end
FCEU.frameadvance()
end
Total control is definitely possible with this bug. After it writes $80 to $9c70, it starts executing completely wrong things and then it returns to $0081. A BRK is then needed to get the PRG layout back to normal. So, by manipulating some bytes between $0088 and $00ff to read 20 e3 8f, you can get to the ending scene. Note that the stack pointer is overflowing, so a JSR is needed to get it back where it should be (or the ending will be bugged and get stuck when the carpet goes up).