5 ms·
Arbitrary Code Execution in Super Mario All-Stars [video]
- rockbruno 4y agoI love these, they are always really impressive. They've done the same with Ocarina of Time in the same event[0] to inject entirely new levels into the game on the fly and even give it Wi-Fi capabilities (sort of) [0] - https://www.youtube.com/watch?v=2x_pqyrf9lA https://www.youtube.com/watch?v=2x_pqyrf9lA
- birracerveza 4y agoThat is pure insanity, the in-engine custom ending with BotW shading is mind blowing.
- elldoubleyew 4y agoI don't understand how they got a network connection to load in the chat on an unmodified console. Was the TASBot connected to the network and pushing the messages via controller inputs? If so that is pretty insane.
- raldi 4y agoYes; the four controller ports allow a total of like 60 bytes per read.
- gfaure 4y agoActually, they progressively inject faster bootstrappers and end up with about 4.8 kB/s: https://youtu.be/qBK1sq1BQ2Q https://youtu.be/qBK1sq1BQ2Q
- raldi 4y agoBut still about 60 bytes per read, an insurmountable limit.
- VyseofArcadia 4y agoI'm pretty impressed all the stuff they patched in the game at just 4.8 kB/s. TASBot was not active for all that long.
- bdonlan 4y agoTASBot was only controlling controller 1 for a short time, but it remained connected to controllers 2-4 for the entire run, giving it time to download additional content as the showcase was going on.
- VyseofArcadia 4y agoAh, I was under the impression that it had stopped. That makes more sense.
- NobodyNada 4y agoYes, TASBot is controlled by a PC connected to the network, and was pushing chat messages over the controller port in addition to ACE payloads. Everything is on GitHub, so here's the code that was injected into the game to read commands from TASBot over the controller port: https://github.com/triforce-percent/triforce-percent/blob/01db4cbdf360bc20a378f5956b17a07125599679/loader/fast_loader/fast_loader.c#L223 https://github.com/triforce-percent/triforce-percent/blob/01...
- 7373737373 4y agoRecommended: Pokémon Yellow Total Control Hack: https://www.youtube.com/watch?v=p5T81yHkHtI https://www.youtube.com/watch?v=p5T81yHkHtI
- ComputerCat 4y agoBrings back so many memories
- peterkelly 4y agoRelated: https://www.youtube.com/watch?v=hB6eY73sLV0 https://www.youtube.com/watch?v=hB6eY73sLV0
- SkeuomorphicBee 4y agoJust to add some context, arbitrary code execution in Super Mario World is nothing new, it has been known since 2014. There was a tool assisted demonstration at Awesome Games Done Quick 2014 [1] where they inject a pong and a snake game using a TASBot (a robot controller that replays input scripts to the console). And in 2016 a streamer performed it manually to inject a flappy birds game [2] (this second video is really good, he goes into detail of the process). So, what this newer demonstration brings is the use of the known arbitrary code execution capabilities of "Super Mario World" to help finish all 5 games in "Super Mario All-Stars + Super Mario World" as quick as possible. [1] https://www.youtube.com/watch?v=jnZ2NNYySuE https://www.youtube.com/watch?v=jnZ2NNYySuE [2] https://www.youtube.com/watch?v=hB6eY73sLV0 https://www.youtube.com/watch?v=hB6eY73sLV0
- CSMastermind 4y agoDisclaimer: I didn't watch the linked video but I did watch some of Sethbling's older videos about the All-Stars exploit which I assume this post is in reference to. I think the bigger exploit here is not only the Super Mario World ACE but the Mario 3 save file exploit.
- s3r3nity 4y agoAwesome to watch, and I recommend listening to the technical explanations if you have time. I love some of the YouTube videos coming out recently explaining not just this exploit, but also some of the Zelda: Ocarina of Time applications of ACE, including a new category called "Triforce%," in which speedrunners use a program to input millions of inputs that essentially code a _new game_ within the _original, un-modded cartridge._ I feel like I've learned more about assembly and architecture concepts from those videos in the past year or so than I had reading any other book over the course of my career.
- brink 4y agoTopic aside; GDQ seems to be getting more political every year. Sad to see.
- minimaxir 4y agoWhat exactly is the politics you're referring to?
- skyyler 4y agoI have two guesses: When runners are being featured, their preferred pronouns are displayed on screen. Their events were remote during the pandemic, the recent event last week required everyone attending to wear masks.
- danparsonson 4y agoThe end of civilisation as we know it!
- skyyler 4y agoWon't someone think of the transphobic gamers and their needs???
- randomhodler84 4y agoCalling people by their preferred pronouns isn’t politics, it’s not being an asshole.
- thebitstick 4y ago"Oh no, someone prefers being called by a pronoun they weren't born with, the humanity!" Grow up.