In a previous video I went over a few
different ways levels in Super Mario World could be completed prematurely.
At the end, I mentioned that a Reznor can be spawned and defeated to
end a level, and that a message block can used to trigger a switch palace.
Let's finally take a look into these, along with a third glitch that involves getting the
double secret and triple secret exits in a level.
All three of these glitches have one
thing in common--they all use Yoshi.
Yoshi is pretty much the underlying
cause of most glitches in this game, so it's no surprise that he's at fault here.
In fact, they are special cases of the item swap, double tongue, and stunned sprite spawning
glitches, which I covered in the previous video.
I suggest you go back and watch the
previous level end glitches video if you haven't seen it yet--a card should
appear on your screen right now, and there's also a link to it in the video description.
Here is a short overview of the important stuff involving sprite slots,
Yoshi's tongue, and stun spawning.
The game has memory allocated to load
in 12 sprites at once--conventionally these are referred to as sprite slots,
and they are numbered $00 to $0B in hex.
Certain slots can be reserved for certain
things--most notably slots $0A and $0B being reserved for items coming out of the item box.
But in general, when a sprite spawns, it looks for the highest numbered slot that it is allowed to
fill and is not used already by another sprite.
If there are no available slots left, then
the sprite just doesn't spawn at all.
Each sprite slot has a bunch of different
memory values it can use to store various information about the sprite in it--this
all depends on what sprite it is.
Some tables are used for a general purpose, like
whether the sprite is facing left or right.
But some tables are for more
miscellaneous information that only pertain to specific sprites.
For example, the same table is used by the P-switch to tell whether it is blue or gray,
and Yoshi to tell how long his tongue is.
In this video there's only a few
important memory locations though.
The first of which is the sprite status table.
This table just keeps track of what the current
status each currently loaded sprite is in.
If the slot is empty, this value is zero, which
is really what it means for a slot to be empty.
Once a sprite is deleted or despawned
or whatever, this value becomes zero so that another sprite can take its slot.
On the first frame a sprite is loaded from ROM, this status is set to 1, which
means it needs to be initialized.
When a sprite is spawned, the game
crudely loads it's information from the level data in the ROM to work RAM, but
it goes through a frame of initialization first.
Then there are a handful of other
statuses the sprite can be in.
States 2, 3, 4, and 5 are the different
death states for enemies, like falling off the screen or turning into a puff of smoke.
States $06 and $0C are from turning into a coin and powerup respectively at the end of a level.
State 8 is the default state where the sprite is functioning normally.
A sprite is put into state 9 if it is stunned and able to be picked up by Mario.
This will update to state $0B when he picks it up, and then set to state $0A if he
kicks it to start it sliding around (which is used by Koopa shells).
The last state here, state 7, is for when a sprite is in Yoshi's mouth.
This state exists just so that the game knows not to despawn the sprite quite yet,
even though it's not in the level anymore; it will get put into its kicked or carriable
state when Yoshi spits it back out.
Speaking of Yoshi, Yoshi uses a
memory address in a different table in order to keep track of which sprite slot is
currently attached to his tongue or in his mouth.
This gets set to -1 when he
doesn't have ahold of an enemy.
This is important to know, because
this means there is a two-way relation for Yoshi tongue-enemy interactions.
Yoshi needs to know which sprite he is eating, and the sprite needs to know that it is being eaten.
Weird things can happen when these two values get desynced from one another,
which we'll see shortly.
The last table to talk about is the one
that holds each sprite's stun timer.
All that's important to know about this
one is that it's used for two purposes: as a timer to keep track of how long a sprite
should be a puff of smoke in sprite status 4 before being deleted; and as a timer to keep track
of when a Koopa in a shell that's in sprite status 9 should wake up and jump out of the shell.
If the Koopa shell sprite is in the stunned state (state 9), and the stun timer runs
out to zero, the shell sprite will spawn a shell-less Koopa sprite next to it, to make
it look like it has jumped out of the shell.
Since this is a way of spawning a sprite,
like usual, if all the sprite slots are full, the new Koopa sprite just won't spawn and it
looks like he just vanishes out of the shell.
But what's interesting about this behavior, is
that it is the default behavior for most sprites.
Only Koopa shells ever normally
have their stun timer set while being in the stunned
status, so you would never know.
But for pretty much any sprite, if they
are somehow put into sprite status 9 and their stun timer is set, they will spawn
another sprite when the timer runs out.
Which sprite this is is determined by a table
in ROM, but for all sprites other than Koopas, this table is indexed out of bounds, so it's
basically junk data and could be anything; for example, a P-switch
spawning a Cheep Cheep here.
For a sprite that Yoshi doesn't swallow
instantly, if it already uses the stun timer, like the P-switch, we can exploit it
to force it to spawn another sprite.
If it doesn't use the stun timer, we can use
the status 4 puff of smoke to set the timer.
Otherwise, we have to get Yoshi to
think he has a sprite in his mouth, without that sprite being in status 7.
Load another sprite into that same slot,
which will eventually end up in status 8.
Get the sprite to set its stun timer, either
on its own or by using the puff of smoke.
Spit out the enemy, which immediately puts
it into status 9 with a non-zero stun timer.
Then, when the stun timer reaches $04, the
sprite will be in status 9, which will cause it to spawn another sprite next to it.
In the previous video we saw how this could be used to spawn a Koopaling boss which
could be defeated to beat the level instantly.
Now let's spawn a Reznor!
So the premise of this glitch is very similar to the Koopaling boss
kill glitch from the previous video.
However, Reznor has a bunch of nuances
that make it a bit trickier to deal with, so let's go over those.
The first of which is that each of the four Reznor sprites has a hardcoded position.
They only ever show up in their own little special room in the game, so they will only appear
on the first and second screen in the level, near the top left corner.
This is high up in the sky in most levels--for levels where the screen doesn't scroll
up, they won't even be visible.
The second nuance is that Reznor was only
really intended to be in specific sprite slots.
Again, they had their own room with no other
sprites, so they would be guaranteed to always show up in the same slots.
The slots they would spawn in were slots 4, 5, 6, and 7.
In fact, the Reznor in slot 7 is special because it handles all of the logic
the pertains to all the Reznor as a group.
This involves setting their position
correctly around the platform, and checking whether all the Reznor have been
defeated and signaling the end of the level.
The Reznor in slots 4, 5, and 6 can only shoot
fireballs and display themselves to the screen.
So, if you could only spawn in one of the
four Reznors, you should make sure it goes into slot 7 so that all of the logic is executed.
The way that this Reznor checks to see if all the Reznor are dead and that the level should
be completed is pretty straight forward.
Each Reznor has a flag that denotes if
it has been knocked off of its platform.
This byte will be zero if it
hasn't, and one if it has.
The Reznor in slot 7 will take the values from
the Reznor in slots 4, 5, 6, and itself in slot 7 and add them all together.
If the result is greater than or equal to four, then that means all 4 Reznor
have been defeated and the level should end.
It never even checks if the sprites in slots
4 through 6 are Reznor--or that there is any sprite loaded in there at all--since its normally
guaranteed that Reznor will be in these slots.
This ends up being exploitable if you
can get just one Reznor in slot 7, but anything else in the other 3 slots
that happen to use that same memory table.
In fact, this table that Reznor uses for
whether it's been defeated yet or not is the same table I mentioned earlier about the
P-switch's color and Yoshi's tongue length.
So for example, if there were 3 blue P-switches in
sprite slots 4, 5, and 6, and a Reznor in slot 7, defeating the Reznor wouldn't do anything
special and wouldn't end the level.
However, if these P-switches were all gray,
hitting the Reznor would end the level, since adding up the four bytes in this table
for slots 4 through 7 would equal four.
Even simpler would be is if Yoshi
were in any of these slots.
Yoshi's tongue grows in increments of
3 pixels, so after just two frames, the value in this table would be $06.
This is already greater than 4 so the level would be completed right then and there, even
if the other 3 slots' values were still zero.
So the biggest question to answer now is, how do
you get a Reznor in slot 7 in a normal level?
The answer lies in the fish.
The Cheep Cheep that is set to swim horizontally
will spawn a Reznor when its stun timer runs out.
So we just have to use the double tongue and
eat cancel glitches to get one of these fish in a limbo state where it is both in Yoshi's mouth
and outside of Yoshi's mouth at the same time.
Again, the last video goes into much more
detail about this step, so I recommend peeking back there if you need too.
In the case of the Koopaling Boss Kill, the stun timer from the puff of smoke
was used to set the stun timer.
It turns out that the Cheep Cheep already uses the
stun timer when in its normal sprites status 8, which it uses as a timer to
determine when to turn around.
So since the timer is already
set to something non-zero, we can spit out the Cheep Cheep
and transform it into its stunned state 9 at basically any time and it will
spawn the Reznor after enough time passes.
Then from here we just stick out Yoshi's
tongue and the level is completed.
This next glitch turns a level into a
switch palace and makes yellow switch blocks fly out on the overworld.
Though it doesn't really fill in all of the dotted yellow blocks everywhere.
It all has to do with how the message boxes work.
Each message that appears in the game in
one of these text boxes has a unique ID.
The IDs 0 through 3 are assigned to the messages
for the four switch palaces after you hit the big switch, telling you that it will fill in all
of the same colored switch block outlines.
The game does another check if
the message ID is less than 4--it will set a timer and start counting down.
When it hits zero, the level is completed and the corresponding colored blocks will
fly out of the level tile on the overworld.
Now normally, it's the big switch palaces switches that are the only thing that can
trigger messages 0 through 3.
All of the other messages in the
game have IDs of four or greater.
But, if you could just somehow manage
to get a message with an ID of 0, 1, 2, or 3 to appear, the level would be cleared
after the message goes away, since it thinks a switch palace is being completed.
It turns out of course you can, by exploiting how the message blocks
work in some of the normal levels.
There is a table in the game's ROM
that assigns each of the message's IDs to the level they appear in.
Each byte corresponds to one message ID--the lower seven bits hold the
level number that message can appear in.
Each level can have two messages, so the
highest bit is used to differentiate the first message from the second.
So when a message block is hit, the game scans this list, starting at the end and
working backward until one of the entries matches the level number that is currently loaded.
If it does match, then that one extra bit is checked to see if this message block
should correspond to this message box.
The way this value is determined is by the
message block's horizontal position in the level.
If the message block is at an even position,
it will correspond to the message with this bit cleared, if it has an odd position, it
will look for the message with the bit set.
This method of figuring out which
message to display is sort of convoluted, but it works when you can guarantee that
there is always a match in this list.
Let's see what happens if there
ends up being no match in the list.
This can happen if a level
was never assigned a message, so it doesn't appear in this list at all, or if
the level was assigned only a single message, and the message block with
the opposite parity was hit.
There is no logic to handle if the game reaches
the end of the list without finding a match.
In fact, the loop just falls through normally
when this index into the list reaches zero.
This means that the message
with ID 0 will be displayed.
And we know from earlier that message number 0 is a message for completing a switch palace
(the Yellow Switch Palace specifically), and that the level will be completed
when the message is dismissed.
So, now the question becomes, where
is this possible and how is it done?
There are theoretically two ways to do it.
The first way is to use a glitch to spawn a message block into a level that
doesn't normally have one already.
Maybe by using an item swap to get
a message block into the item box, or by using the sprite stun spawning like with
the Reznor kill to make a message block appear so you can hit it and end the level.
Unfortunately it just so happens that there is no combination of powerup
states that allows a message block to be put into the reserve item box.
And there is only one sprite that can spawn a message block via stun timer
spawning, which is the revolving net door.
These only appear in two levels: Iggy's
Castle (which already has two message blocks, so this wouldn't work), and Front Door of
Bowser's Castle, but getting both a Yoshi and a sprite that Yoshi can eat but not swallow
instantly into this room is basically impossible.
So, the second way is to go to a level that has
only one message assigned to it, and somehow move the message block to a different position so it
tries to fetch the message that doesn't exist.
In the last video, we saw how an item swap
could be used to have Yoshi swallow any sprite, even if he can't normally stick it on his tongue.
Well in this case, we can use the same glitch to get the message block to warp to
Yoshi's tongue, changing its position.
It's just important to activate the
message block before Yoshi can swallow it, either by hitting it really quickly, or by
canceling his eating animation by getting hit.
And of course, it's important that the block ends
up on the opposite parity horizontal position so that it tries to trigger
the message that doesn't exist rather than the one originally
intended for the level.
There is a small caveat that occurs with this
glitch that I may as well mention because it actually behaves slightly differently
on different versions of the game.
So, the message at the end of a switch palace
has that timer that keeps track of how long the message displays before you can leave the level.
And it's the switch palace switch that is responsible for setting the
timer to its initial value, then the message box ticks it down to zero.
Since this glitch doesn't involve a switch palace switch, the message box just uses whatever value
happens to be in memory for that timer last.
Most of the time this is zero, since
it's a timer that counts down.
This means that the timer wraps around and
has to count all the way down to zero again, which takes about 17 seconds in game.
The exception is if you are coming straight from the title screen, since the spotlight only
makes this timer count down to 1 instead of 0.
Of course, the intro cutscene uses this timer
too, and makes it count down to zero again.
This means, you can get the message
to go away pretty much instantly, but you have to load the game, pick a save
file that isn't empty so that you skip the intro cutscene, and also not beat a single
switch palace before performing the glitch.
However, everything I just described regarding this timer is only relevant
to the Japanese version.
In the English versions of the game, the way
message boxes were handled changed a bit.
Essentially, if the timer is zero when the message
appears, it will always behave like a normal message box and not clear the level afterward.
This change was made in order to make it so the player had to press a button to dismiss the intro
cutscene instead of it going away on its own.
This just means that if you try to do this glitch
when the timer is zero, it just won't work at all instead of taking 17 seconds of waiting.
Instead you are required to get this timer to start at some value other than zero, which
is only possible by visiting the title screen and not seeing the intro cutscene
or completing a switch palace.
There are 5 levels that only have
one message associated with them, two of which are Ghost Houses which prevent you
from bringing Yoshi in (normally, that is).
The remaining 3 levels are pretty simple to
perform this glitch in to beat the level.
The last thing to talk about is how to glitch
a goal tape to trigger an unused third exit, and an unintended fourth exit to a level.
The goal tape sprite, and all sprites really, store their initial X and Y positions in the
level data that is held in the game's ROM.
When Mario gets near this location,
the sprite's data is copied into RAM where it will exist until
it unloads at some point.
In the level data, each
sprite takes up three bytes.
This third byte is the 8-bit sprite ID, which
just denotes which type of sprite it is.
For the goal tape, this is $7B.
The highest four bits in the second byte are the sprite's X position within the screen.
The lower four bits, along with this single bit in the first byte will tell what
screen this sprite will spawn on.
And these five bits determine the
sprite's Y position in the level.
These last two bits are what are
referred to as the 'extra bits.'
No sprite other than the goal tape
uses these, which it uses to denote which exit it is linked to.
00 is for the normal exit, and 01 is for the secret exit.
The values 10 and 11 are never used.
Interestingly, the value 10 is checked
for in the game's code as a third exit.
If the third exit is triggered, the normal exit is
unlocked, but Mario is teleported on the overworld to go to one of the six submaps
instead of the main world map.
This functionality is only half
implemented, so it usually ends up with Mario warping to a spot on the
overworld where he can't move any more.
If the fourth exit is triggered, it just acts
like the normal exit, nothing special happens.
In addition to all this, each level tile on the
overworld assigns a direction for Mario to move when each exit type is cleared.
For example, in Donut Plains 1, the normal exit would take Mario to the left,
while the secret exit would take him upwards.
Each direction is encoded as two bits, and
these directions are stored in a single byte.
However, the third exit is defined to read
these next two bits as a direction to move.
Now, since these aren't used in
the final game, every level has these set to 00, which corresponds to up.
This means that if the third exit is cleared, Mario will always move up on the overworld
afterwards, as long as there is a path there.
Also, just to be complete, the fourth
exit (which isn't truly implemented), reads these two bits as a direction, which
sort of overlaps with the third exit's bits.
But again, these are all zeros,
so Mario will always move up.
So to review, a goal tape has two extra
bits that determines which exit to trigger.
Each exit will do two things: process
an overworld event, and move Mario.
The extra bits 00 correspond to the normal
exit, processes the normal exit event, and moves Mario towards that level.
The extra bits 01 correspond to the secret exit, processes the secret exit
event, and moves Mario towards that level.
The extra bits 10 correspond to the third
exit, processes the normal exit event, moves Mario up if he can, and additionally
will warp him to an overworld submap.
And the extra bits 11 correspond to the fourth
exit, processes the normal exit, moves Mario up if he can, but doesn't warp him anywhere.
Going back to how sprites load their data into memory, let's see what a goal tape does.
Each sprites' positions are 16-bit values, but the high bytes and low bytes
are stored in separate tables.
The X position low byte is masked out and
stored in its table, and the X position high byte is derived by the screen number.
The Y position low byte is also masked out and stored, but then we get
to the Y position high byte.
The common code run by all sprites will
extract the single Y bit here, but also the extra bits as part of the Y position.
Recall that for almost all sprites, these bits are zero, so this
wouldn't affect the position at all.
Remember about the different sprite statuses?
The current sprite status for this slot was zero, since it was an empty slot with
no sprite associated with it.
It gets set to 1 during this process.
Sprite status 1 is the initialization status, and when the goal tape is in this state, the
extra bits are extracted from the Y position and stored into a separate table where they belong.
Then the sprite is put into default status 8.
So, what sort of glitch do you think could
modify a sprite's position that can't normally be manipulated very much?
The item swap of course!
We just saw this for the message block,
but now we can apply it to the goal tape.
If we get the goal tape to warp to Yoshi's
tongue, we can modify its Y position.
In fact, since sprites are processed in order of
sprite slot, from the higher slot numbers to the lower slot numbers, if Yoshi is in a higher slot,
he will warp the goal tape to his tongue before the goal tape can run it initialization routine.
So, by overwriting the goal tape's position with the position of his tongue, Yoshi can
effectively write to those extra bits as well.
Now, in a normal horizontal level, the highest
that the Y position can go is about $01D0.
This means the high byte of the Y
position can't get any higher than $01, which will set the extra bits to 00.
Which means if you item swap a goal tape that is originally assigned to be a secret exit,
it will activate the normal exit instead.
But, there's something else!
If you go above the top of the screen, the Y position wraps around,
and the high byte becomes $FF.
Doing this will set the extra bits to
11, which activates the fourth exit!
And actually, in a vertical level, the Y
position can be a much higher range of values, so theoretically you could
activate the third exit as well.
But goal tapes don't exist in any
vertical levels in the original game.
Since the third and fourth exits
process the normal exit event, they don't increase the exit
counter on the title screen.
However, activating the fourth exit on
certain levels can get Mario to move onto an overworld tile that is meant for a
star warp before the star is even revealed.
Entering these levels will put Mario in a
glitched test level, which can be cleared using the orb glitch that I described in the
last video, which can increase the exit counter.
Using these end level glitches can bring
the total exit count up from 96 to 102.
Front Door, Back Door, and Yoshi's House
can be cleared using the orb glitch.
Funky, Choco-Ghost House, and Chocolate
Secret can get secret exits completed by using sprite stun spawning and item swapping
to spawn a key and keyhole in the level.
And the fourth exits of Star
World 5 and Valley of Bowser 4 lead to test levels that can
also be cleared with the orb.
There are six more exits that can be
cleared by using wrong warping glitch that we'll have to look at next time.
Until then, thank you for watching!
