5 ms·

Beating Super Mario Bros 3 in 19 frames (2021)

27 points by streblo 4y ago

CM30 4y ago
For those who want to see what those frames look like, Supper Mario Broth posted images of all 19 on Twitter: https://twitter.com/MarioBrothBlog/status/1585644239073193984 https://twitter.com/MarioBrothBlog/status/158564423907319398...
- lupire 4y ago
  Why aren't they Souper Mario Broth?
lupire 4y ago
Really quick summary: A hardware bug causes the NES to misread inputs sometimes (losing 1bit), if music is playing. To work around the bug, the game only accepts inputs if the same key is pressed for two consecutive input cycles (an input cycle is much shorter than one frame) If the inputs don't match, the game loops and tries again. This loop has no hard coded limit, so if you spam changing inputs fast enough for long enough (using a computer; your fingers aren't fast enough), the game keeps trying to read inputs until it's time for next frame to be drawn to screen. The NES clock sends an interrupt to prompt the drawing code to run. The input code and the drawing code use overlapping areas of memory, and the game didn't do what it needs to do (at a low level in memory) to be ready draw the frame properly, and ends up reading drawing instructions from input bytes instead of what the game was designed to put into that area of memory. (This part is where the real dirty magic is; it requires understanding of assembler and interrupts to properly explain how it works. Basically one function interrupts another and starts running before the first one finished, and the functions use different invocation logic, so the second function ends up exiting "the wrong way" and the program jumps to a wrong return location when it's done.) Thus the attacker can write run semi-arbitrary code that makes the game jump to the instruction that starts playing the ending/credits scenes.
- manc_lad 4y ago
  that is a great explanation and just what I was looking for thank you. I don't often see complexity broken down so eloquently.
LocalH 4y ago
what in the fuck, literal assembly fu, amazing
- ThrowawayTestr 4y ago
  These kinds of speedruns are called arbitrary code execution runs. There's also speedruns on the SNES that do this.
  - NobodyNada 4y ago
    Some highlights/historically significant examples of this: Super Mario World (TAS, 2014): https://tasvideos.org/3957S https://tasvideos.org/3957S Super Mario Bros. 3 (TAS, 2014): https://tasvideos.org/4288S https://tasvideos.org/4288S - The same run performed RTA (i.e. by a human using a real controller) at AGDQ 2015: https://www.youtube.com/watch?v=mUeozQtSmrg https://www.youtube.com/watch?v=mUeozQtSmrg Super Mario World (RTA, 2015): https://www.youtube.com/watch?v=14wqBA5Q1yc https://www.youtube.com/watch?v=14wqBA5Q1yc Super Mario World "total control" (RTA, 2015): https://www.youtube.com/watch?v=hB6eY73sLV0 https://www.youtube.com/watch?v=hB6eY73sLV0 Pokemon Yellow total control (TAS, 2017): https://tasvideos.org/5384S https://tasvideos.org/5384S The Legend of Zelda: Ocarina of Time (RTA, 2019-ish?): https://www.youtube.com/watch?v=RoEmGCNsbno https://www.youtube.com/watch?v=RoEmGCNsbno Ocarina of Time total control/"Triforce%" (TAS, 2022): https://www.youtube.com/watch?v=PNbkv_DJ0f0 https://www.youtube.com/watch?v=PNbkv_DJ0f0 (explanation: https://www.youtube.com/watch?v=qBK1sq1BQ2Q https://www.youtube.com/watch?v=qBK1sq1BQ2Q)
    - The_SamminAter 4y ago
      My god Pokemon Yellow total control is on a whole different level
  - LocalH 4y ago
    Yeah I know what ACE is but good lord this is a new extreme
bitwize 4y ago
They should get like, a million P-Wings for this.
- lupire 4y ago
  That'd be like giving a billion dollars to someone who just got into heaven. They don't need it.
wly_cdgr 4y ago
Not bad, but...aah, who am I kidding, this is some power level 9000 macromancer shit
- deleted 4y ago
  [deleted]

27 points by streblo 4y ago

CM30 4y ago

For those who want to see what those frames look like, Supper Mario Broth posted images of all 19 on Twitter: https://twitter.com/MarioBrothBlog/status/1585644239073193984 https://twitter.com/MarioBrothBlog/status/158564423907319398...

lupire 4y ago
Why aren't they Souper Mario Broth?

lupire 4y ago

Really quick summary: A hardware bug causes the NES to misread inputs sometimes (losing 1bit), if music is playing. To work around the bug, the game only accepts inputs if the same key is pressed for two consecutive input cycles (an input cycle is much shorter than one frame) If the inputs don't match, the game loops and tries again. This loop has no hard coded limit, so if you spam changing inputs fast enough for long enough (using a computer; your fingers aren't fast enough), the game keeps trying to read inputs until it's time for next frame to be drawn to screen. The NES clock sends an interrupt to prompt the drawing code to run. The input code and the drawing code use overlapping areas of memory, and the game didn't do what it needs to do (at a low level in memory) to be ready draw the frame properly, and ends up reading drawing instructions from input bytes instead of what the game was designed to put into that area of memory. (This part is where the real dirty magic is; it requires understanding of assembler and interrupts to properly explain how it works. Basically one function interrupts another and starts running before the first one finished, and the functions use different invocation logic, so the second function ends up exiting "the wrong way" and the program jumps to a wrong return location when it's done.) Thus the attacker can write run semi-arbitrary code that makes the game jump to the instruction that starts playing the ending/credits scenes.

manc_lad 4y ago
that is a great explanation and just what I was looking for thank you. I don't often see complexity broken down so eloquently.

LocalH 4y ago

what in the fuck, literal assembly fu, amazing

ThrowawayTestr 4y ago
These kinds of speedruns are called arbitrary code execution runs. There's also speedruns on the SNES that do this.
- NobodyNada 4y ago
  Some highlights/historically significant examples of this: Super Mario World (TAS, 2014): https://tasvideos.org/3957S https://tasvideos.org/3957S Super Mario Bros. 3 (TAS, 2014): https://tasvideos.org/4288S https://tasvideos.org/4288S - The same run performed RTA (i.e. by a human using a real controller) at AGDQ 2015: https://www.youtube.com/watch?v=mUeozQtSmrg https://www.youtube.com/watch?v=mUeozQtSmrg Super Mario World (RTA, 2015): https://www.youtube.com/watch?v=14wqBA5Q1yc https://www.youtube.com/watch?v=14wqBA5Q1yc Super Mario World "total control" (RTA, 2015): https://www.youtube.com/watch?v=hB6eY73sLV0 https://www.youtube.com/watch?v=hB6eY73sLV0 Pokemon Yellow total control (TAS, 2017): https://tasvideos.org/5384S https://tasvideos.org/5384S The Legend of Zelda: Ocarina of Time (RTA, 2019-ish?): https://www.youtube.com/watch?v=RoEmGCNsbno https://www.youtube.com/watch?v=RoEmGCNsbno Ocarina of Time total control/"Triforce%" (TAS, 2022): https://www.youtube.com/watch?v=PNbkv_DJ0f0 https://www.youtube.com/watch?v=PNbkv_DJ0f0 (explanation: https://www.youtube.com/watch?v=qBK1sq1BQ2Q https://www.youtube.com/watch?v=qBK1sq1BQ2Q)
  - The_SamminAter 4y ago
    My god Pokemon Yellow total control is on a whole different level
- LocalH 4y ago
  Yeah I know what ACE is but good lord this is a new extreme

bitwize 4y ago

They should get like, a million P-Wings for this.

lupire 4y ago
That'd be like giving a billion dollars to someone who just got into heaven. They don't need it.

wly_cdgr 4y ago

Not bad, but...aah, who am I kidding, this is some power level 9000 macromancer shit

deleted 4y ago
[deleted]