Super Mario World Exploited By Raspberry Pi Robot, Programs Pong

Super Mario World Exploited By Raspberry Pi Robot, Programs Pong

A new glitch allows arbitrary code to run on the official Nintendo cartridge.

Last week, the Awesome Games Done Quick charity marathon wrapped up. It featured a host of talented players showing off their best speedruns in front of a live audience, both streaming and in-person. During a session of tool-assisted speedruns, an awesome new glitch was demonstrated which allowed a Raspberry Pi-powered robot to program a game of Pong and Snake into a factory-official cartridge of Super Mario World.

It looks like an exceedingly random game of Mario, but that robot is actually triggering sprites to spawn in a specific order, manipulating the game's Object Attribute Memory buffer. It's around 1:40 that the bot triggers a stun glitch which executes the objects in the memory buffer as code, which causes it to leap to the memory location for the controller. From there, the robot inputs assembly code using eight virtual controllers to program games of Pong and Snake, using SMW's sprites. Complicated? Yes. Impressive? Hell yes.

While normal speedruns are all about testing the limits of human performance, the tool-assisted speedrun (TAS) removes the meatbag from the equation. It's all about finding odd glitches and bugs, most of which would be impossible for a human to duplicate. While most TASs are run in emulators, this impressive hack is running on real SNES hardware.

You can watch the entire live demonstration here. While most TAS's are impressive engineering feats that are almost invisible to the human eye, this one was so surprising that it leaves the audience cheering. Even better, you can see that the bot's built into the body of an NES R.O.B.

Source: YouTube via Ars Technica

Permalink

Very impressive, I never would have thought that the SNES would have even been set to register controller inputs from controllers not in use for Mario, let alone that it was possible to program a game by exploiting the memory buffer.

All I can say is some people are way to imaginative and motivated with their free time.

i just don't understand what i just watched. so, by acting like an extremely ADD-addled mario, that somehow programmed those games in the cartridge? this doesn't real life.

martyrdrebel27:
i just don't understand what i just watched. so, by acting like an extremely ADD-addled mario, that somehow programmed those games in the cartridge? this doesn't real life.

That's what I thought at first too, but re-read and re-watch. Being an ADD-addled Mario freaked out the RAM, forcing it to request input from the controllers in an odd fashion, allowing the robot to use this input to program it. All the ADD stuff was was a way to fry out the memory and allow it to accept the code for Snake and Pong.

MrPhyntch:

martyrdrebel27:
i just don't understand what i just watched. so, by acting like an extremely ADD-addled mario, that somehow programmed those games in the cartridge? this doesn't real life.

That's what I thought at first too, but re-read and re-watch. Being an ADD-addled Mario freaked out the RAM, forcing it to request input from the controllers in an odd fashion, allowing the robot to use this input to program it. All the ADD stuff was was a way to fry out the memory and allow it to accept the code for Snake and Pong.

okay, i can kinda accept that, but then what happens to program the letters, the menu, the game mechanics? that all seems far too complex to program with a controller on a freaked out cartridge.

Yeah, I call, um... whatever the equivalent of "photoshop" would be in this situation.

I saw this on the feed for AGDQ. I was absolutely stunned.

@ Neta,
They did it on a real cartridge. They had a Nintendo ROB holding a device that was sending the scripted inputs.

Oh I love TAS so much!
Thanks for letting me know about this IanDavis!

martyrdrebel27:

MrPhyntch:

martyrdrebel27:
i just don't understand what i just watched. so, by acting like an extremely ADD-addled mario, that somehow programmed those games in the cartridge? this doesn't real life.

That's what I thought at first too, but re-read and re-watch. Being an ADD-addled Mario freaked out the RAM, forcing it to request input from the controllers in an odd fashion, allowing the robot to use this input to program it. All the ADD stuff was was a way to fry out the memory and allow it to accept the code for Snake and Pong.

okay, i can kinda accept that, but then what happens to program the letters, the menu, the game mechanics? that all seems far too complex to program with a controller on a freaked out cartridge.

The inputs on all 8 controllers (their exploiting the multitap support) were putting in machine code that was executed when they did the final frozen flying box glitch. All the glitches before the final one were done in a way to load and arrange the game sprites in a specific order for their custom code to properly reference in memory.

It's all inhuman since it requires button presses to occur on specific frames. All the setup and programming of the bot to do the run was done on custom emulation software that allows for frame by frame emulation. The hardest part is keeping the controller inputs in sync with the game; they did two failed Galaga runs that kept desyncing just by the nature of the processor variances and cable length induced lag to the NES. The timing of everything really is insane to imagine.

Their original plane was to program all of the original Mario Brothers for NES and then speed run that, but they didn't have a large enough window to do all the programming so they settled for pong and snake.

It's absolutely insane that this is even possible. I remember watching it live last week (AGDQ was really awesome by the way guys, tons of fantastic highlights, the final rush to a million in donations was crazy) and when this happened out of nowhere in a very odd SMW run, I just went slackjawed, then clapped at home alone in my bedroom.

Bravo, TAS-ers.

 

Reply to Thread

Log in or Register to Comment
Have an account? Login below:
With Facebook:Login With Facebook
or
Username:  
Password:  
  
Not registered? To sign up for an account with The Escapist:
Register With Facebook
Register With Facebook
or
Register for a free account here