SethBling
9 HN recommenders · recommended in 15 months, 2016–2025
6:31 · 3M views · Mar 28, 2016
SethBling uses Super Mario World glitches to inject and run Flappy Bird code on an unmodified SNES, entering it purely with controller inputs. It was the first time a human completed this kind of exploit by hand.
Constantly cited as the canonical example of arbitrary code execution through gameplay and of deep system knowledge among speedrunners.
20 comments from Hacker News
This reminds me of the incredible Flappy Birds SNES Code Injection into Super Mario World. A must-see video. this video
I don't know about the run shown in the OP, but there are a fair number of memory-manipulation/ACE speedruns that are feasible in RTA ("real-time attack", a.k.a. something a human could pull off, as distinct from TAS). Off the top of my head I can think of such routes for Pokemon Red/Blue, Ocarina of Time, and Super Mario World. To answer your question of "how likely is one to pull this off" for those three, the Pokemon one requires no almost advanced execution, other than turning off the console at a precise point to corrupt the save data you otherwise just need to follow a simple (though long) series of steps. The Mario one requires some pixel-perfect precision, and runners often used hacked ROMs that display coordinates in order to train. The Zelda one requires exact angles to be held on the analog stick, and I've heard of people creating guides out of cardboard and rubber bands in order to help them achieve the angles more reliably. Sorry that I don't have any video links on hand, but you could almost certainly find examples of these in the GDQ archives. EDIT: Found a good video for the SMW example, by SethBling, which actually goes a step further and manually reprograms SMW into Flappy Bird: this video EDIT 2: Here's an excellent explanation of the Zelda ACE: [LINK]
I'm a speedrunner, and I'm pretty sure this is well known -- and accepted as standard in some categories! It's a pretty well accepted standard (to the point of the headline being almost a mild offense!). In the gaming world, undefined software behavior is critical to this sort of thing, we see this especially in some games like the legendary exploits found in the Ocarina of Time speedruns for example. I mean, in Super Mario World, SethBling did code injection to manually run a version of Flappy Bird (how ironic given the origin of the pipes!) in the game. By hand. No savestates. It took forever and the run through is really and truly fascinating: this video I speedrun things other than games as well -- and so the generalization is not just that we are security researchers, we are people who fundamentally learn the "shape" of a thing very, very well, and ways that this shape can be used to get from one state on that shape to another. In conclusion -- yes, it can be something as simple as security research! But the joy and the beauty of speedrunning is something so much bigger and beautiful than that -- though it certainly is one outcome that can be had!
Just to add some context, arbitrary code execution in Super Mario World is nothing new, it has been known since 2014. There was a tool assisted demonstration at Awesome Games Done Quick 2014 [1] where they inject a pong and a snake game using a TASBot (a robot controller that replays input scripts to the console). And in 2016 a streamer performed it manually to inject a flappy birds game [2] (this second video is really good, he goes into detail of the process). So, what this newer demonstration brings is the use of the known arbitrary code execution capabilities of "Super Mario World" to help finish all 5 games in "Super Mario All-Stars + Super Mario World" as quick as possible. [1] [LINK] [2] this video
My understanding is that they're glitching the game to inject data into memory, in this case processor instructions. And then they use another glitch to jump to and execute that code. No modifications needed to the hardware or ROM, you're just being extremely selective about how to play the game to cause memory to get flipped. This video is done by hand and explains a bit more about how and why it works: this video