Frieze
2 HN recommenders · recommended in 4 months, 2015–2025
11:55 · 638K views · Feb 21, 2015
A speedrunner-made explanation of the Super Mario World credits warp, an arbitrary code execution glitch that jumps the game straight to the ending. It simplifies the underlying assembly and memory behavior with animations so non-experts can follow.
HN people cite it as the clearest explanation of how the credits warp exploit works.
4 comments from Hacker News
Here's the author taking the world record (now superseded) at glitching mario world into the credits to "win" the game in 3:07: [LINK] This is on a real console, not an emulator. They overflow the snes into the controller registers to achieve arbitrary code execution by hand. They do this by placing koopa shells at pixel-perfect locations to spell out ASM, overflow to the controller registers, and press a specific combination of buttons to jump to the sprite table and their literal shellcode. At the start of this year there was a crazy few weeks where different speedrunners were competing to execute the "credits warp" in the quickest and most efficient way. It started at around 6 minutes, now it's down to around 2 I think, most of which is the game's intro. Fun stuff. SethBling was the first person to ever execute it on a real console. Here's a video explaining it, from a different speedrunner: this video
The most interesting speedrun I've ever seen is the Super Mario World credits warp, which requires the player to write + execute arbitrary code in game by carefully positioning koopa shells. At first thought to only be possible with tools in an emulator, this has been done on an actual console! Summoning Salt video about the overall history of SMW speedruns: [LINK] Detailed explanation of how the credits warp exploit works: this video
Open bus quite literally means that the data bus lines are an open circuit -- the CPU has placed an unmapped or write-only address on the address bus, and no hardware on the bus has responded, so the bus lines aren't being driven and are just floating. Thus, nominally, this is a case of undefined behavior at the hardware level. In order to understand what actually happens, we need to look a little closer at the physical structure of a data bus -- you have long conductors carrying the signals around the motherboard and to the cartridge, separated from the ground plane by a thin layer of insulating substrate. This looks a lot like a capacitor, and in fact this is described and modeled as "parasitic capacitance" by engineers who try to minimize it, since this effect limits the maximum speed of data transmission over the bus. But this effect means that, whenever the bus is not being driven, it tends to stay at whatever voltage it was last driving to -- just like a little DRAM cell, producing the "open-bus reads return the last value transferred across the bus" effect described in the article. It's not uncommon for games to accidentally rely on open-bus effects, like DKC2. On the NES, the serial port registers for connecting to a controller only drive the low-order bits and the high bits are open-bus; there are a few games that read the controller input with the instruction LDA $4016 and expect to see the value $40 or $41 (with the 4 sticking around because of open-bus). There's a
There are some games where you can modify the program state to glitch to the end, like Super Mario World: this video The explanation for the glitch is really interesting. But something like this has to be given its own category. There's a Super Mario World category that allows for that "Credits Warp" glitch. The other categories have different rules for what you can and can't do. So it's possible that Todd did something funky, but that would still make his scores illegitimate.