More Level End Glitches in Super Mario World

Video Statistics and Information

Video
Captions Word Cloud
Reddit Comments
Captions
In a previous video I went over a few  different ways levels in Super Mario   World could be completed prematurely. At the end, I mentioned that a Reznor   can be spawned and defeated to  end a level, and that a message   block can used to trigger a switch palace. Let's finally take a look into these, along   with a third glitch that involves getting the  double secret and triple secret exits in a level.   All three of these glitches have one  thing in common--they all use Yoshi.   Yoshi is pretty much the underlying  cause of most glitches in this game,   so it's no surprise that he's at fault here. In fact, they are special cases of the item swap,   double tongue, and stunned sprite spawning  glitches, which I covered in the previous video.   I suggest you go back and watch the  previous level end glitches video   if you haven't seen it yet--a card should  appear on your screen right now, and there's   also a link to it in the video description. Here is a short overview of the important   stuff involving sprite slots,  Yoshi's tongue, and stun spawning.   The game has memory allocated to load  in 12 sprites at once--conventionally   these are referred to as sprite slots,  and they are numbered $00 to $0B in hex.   Certain slots can be reserved for certain  things--most notably slots $0A and $0B being   reserved for items coming out of the item box. But in general, when a sprite spawns, it looks for   the highest numbered slot that it is allowed to  fill and is not used already by another sprite.   If there are no available slots left, then  the sprite just doesn't spawn at all.   Each sprite slot has a bunch of different  memory values it can use to store various   information about the sprite in it--this  all depends on what sprite it is.   Some tables are used for a general purpose, like  whether the sprite is facing left or right.   But some tables are for more  miscellaneous information   that only pertain to specific sprites. For example, the same table is used by the   P-switch to tell whether it is blue or gray,  and Yoshi to tell how long his tongue is.   In this video there's only a few  important memory locations though.   The first of which is the sprite status table.   This table just keeps track of what the current  status each currently loaded sprite is in.   If the slot is empty, this value is zero, which  is really what it means for a slot to be empty.   Once a sprite is deleted or despawned  or whatever, this value becomes zero   so that another sprite can take its slot. On the first frame a sprite is loaded from ROM,   this status is set to 1, which  means it needs to be initialized.   When a sprite is spawned, the game  crudely loads it's information   from the level data in the ROM to work RAM, but  it goes through a frame of initialization first.   Then there are a handful of other  statuses the sprite can be in.   States 2, 3, 4, and 5 are the different  death states for enemies, like falling   off the screen or turning into a puff of smoke. States $06 and $0C are from turning into a coin   and powerup respectively at the end of a level. State 8 is the default state where the   sprite is functioning normally. A sprite is put into state 9 if it   is stunned and able to be picked up by Mario. This will update to state $0B when he picks it up,   and then set to state $0A if he  kicks it to start it sliding around   (which is used by Koopa shells). The last state here, state 7,   is for when a sprite is in Yoshi's mouth. This state exists just so that the game   knows not to despawn the sprite quite yet,  even though it's not in the level anymore;   it will get put into its kicked or carriable  state when Yoshi spits it back out.   Speaking of Yoshi, Yoshi uses a  memory address in a different table   in order to keep track of which sprite slot is  currently attached to his tongue or in his mouth.   This gets set to -1 when he  doesn't have ahold of an enemy.   This is important to know, because  this means there is a two-way   relation for Yoshi tongue-enemy interactions. Yoshi needs to know which sprite he is eating, and   the sprite needs to know that it is being eaten. Weird things can happen when these two values get   desynced from one another,  which we'll see shortly.   The last table to talk about is the one  that holds each sprite's stun timer.   All that's important to know about this  one is that it's used for two purposes:   as a timer to keep track of how long a sprite  should be a puff of smoke in sprite status 4   before being deleted; and as a timer to keep track  of when a Koopa in a shell that's in sprite status   9 should wake up and jump out of the shell. If the Koopa shell sprite is in the stunned   state (state 9), and the stun timer runs  out to zero, the shell sprite will spawn   a shell-less Koopa sprite next to it, to make  it look like it has jumped out of the shell.   Since this is a way of spawning a sprite,  like usual, if all the sprite slots are full,   the new Koopa sprite just won't spawn and it  looks like he just vanishes out of the shell.   But what's interesting about this behavior, is  that it is the default behavior for most sprites.   Only Koopa shells ever normally  have their stun timer set   while being in the stunned  status, so you would never know.   But for pretty much any sprite, if they  are somehow put into sprite status 9   and their stun timer is set, they will spawn  another sprite when the timer runs out.   Which sprite this is is determined by a table  in ROM, but for all sprites other than Koopas,   this table is indexed out of bounds, so it's  basically junk data and could be anything;   for example, a P-switch  spawning a Cheep Cheep here.   For a sprite that Yoshi doesn't swallow  instantly, if it already uses the stun timer,   like the P-switch, we can exploit it  to force it to spawn another sprite.   If it doesn't use the stun timer, we can use  the status 4 puff of smoke to set the timer.   Otherwise, we have to get Yoshi to  think he has a sprite in his mouth,   without that sprite being in status 7.   Load another sprite into that same slot,  which will eventually end up in status 8.   Get the sprite to set its stun timer, either  on its own or by using the puff of smoke.   Spit out the enemy, which immediately puts  it into status 9 with a non-zero stun timer.   Then, when the stun timer reaches $04, the  sprite will be in status 9, which will cause   it to spawn another sprite next to it. In the previous video we saw how this   could be used to spawn a Koopaling boss which  could be defeated to beat the level instantly.   Now let's spawn a Reznor! So the premise of this glitch   is very similar to the Koopaling boss  kill glitch from the previous video.   However, Reznor has a bunch of nuances  that make it a bit trickier to deal with,   so let's go over those. The first of which is that each of   the four Reznor sprites has a hardcoded position. They only ever show up in their own little special   room in the game, so they will only appear  on the first and second screen in the level,   near the top left corner. This is high up in the sky in most levels--for   levels where the screen doesn't scroll  up, they won't even be visible.   The second nuance is that Reznor was only  really intended to be in specific sprite slots.   Again, they had their own room with no other  sprites, so they would be guaranteed to always   show up in the same slots. The slots they would spawn in   were slots 4, 5, 6, and 7. In fact, the Reznor in slot   7 is special because it handles all of the logic  the pertains to all the Reznor as a group.   This involves setting their position  correctly around the platform,   and checking whether all the Reznor have been  defeated and signaling the end of the level.   The Reznor in slots 4, 5, and 6 can only shoot  fireballs and display themselves to the screen.   So, if you could only spawn in one of the  four Reznors, you should make sure it goes   into slot 7 so that all of the logic is executed. The way that this Reznor checks to see if all the   Reznor are dead and that the level should  be completed is pretty straight forward.   Each Reznor has a flag that denotes if  it has been knocked off of its platform.   This byte will be zero if it  hasn't, and one if it has.   The Reznor in slot 7 will take the values from  the Reznor in slots 4, 5, 6, and itself in slot 7   and add them all together. If the result is greater than   or equal to four, then that means all 4 Reznor  have been defeated and the level should end.   It never even checks if the sprites in slots  4 through 6 are Reznor--or that there is any   sprite loaded in there at all--since its normally  guaranteed that Reznor will be in these slots.   This ends up being exploitable if you  can get just one Reznor in slot 7,   but anything else in the other 3 slots  that happen to use that same memory table.   In fact, this table that Reznor uses for  whether it's been defeated yet or not   is the same table I mentioned earlier about the  P-switch's color and Yoshi's tongue length.   So for example, if there were 3 blue P-switches in  sprite slots 4, 5, and 6, and a Reznor in slot 7,   defeating the Reznor wouldn't do anything  special and wouldn't end the level.   However, if these P-switches were all gray,  hitting the Reznor would end the level,   since adding up the four bytes in this table  for slots 4 through 7 would equal four.   Even simpler would be is if Yoshi  were in any of these slots.   Yoshi's tongue grows in increments of  3 pixels, so after just two frames,   the value in this table would be $06. This is already greater than 4 so the level   would be completed right then and there, even  if the other 3 slots' values were still zero.   So the biggest question to answer now is, how do  you get a Reznor in slot 7 in a normal level?   The answer lies in the fish.   The Cheep Cheep that is set to swim horizontally  will spawn a Reznor when its stun timer runs out.   So we just have to use the double tongue and  eat cancel glitches to get one of these fish in   a limbo state where it is both in Yoshi's mouth  and outside of Yoshi's mouth at the same time.   Again, the last video goes into much more  detail about this step, so I recommend   peeking back there if you need too. In the case of the Koopaling Boss Kill,   the stun timer from the puff of smoke  was used to set the stun timer.   It turns out that the Cheep Cheep already uses the  stun timer when in its normal sprites status 8,   which it uses as a timer to  determine when to turn around.   So since the timer is already  set to something non-zero,   we can spit out the Cheep Cheep  and transform it into its stunned   state 9 at basically any time and it will  spawn the Reznor after enough time passes.   Then from here we just stick out Yoshi's  tongue and the level is completed.   This next glitch turns a level into a  switch palace and makes yellow switch   blocks fly out on the overworld. Though it doesn't really fill in   all of the dotted yellow blocks everywhere. It all has to do with how the message boxes work.   Each message that appears in the game in  one of these text boxes has a unique ID.   The IDs 0 through 3 are assigned to the messages  for the four switch palaces after you hit the big   switch, telling you that it will fill in all  of the same colored switch block outlines.   The game does another check if  the message ID is less than 4--it   will set a timer and start counting down. When it hits zero, the level is completed   and the corresponding colored blocks will  fly out of the level tile on the overworld.   Now normally, it's the big switch palaces switches   that are the only thing that can  trigger messages 0 through 3.   All of the other messages in the  game have IDs of four or greater.   But, if you could just somehow manage  to get a message with an ID of 0,   1, 2, or 3 to appear, the level would be cleared  after the message goes away, since it thinks a   switch palace is being completed. It turns out of course you can,   by exploiting how the message blocks  work in some of the normal levels.   There is a table in the game's ROM  that assigns each of the message's IDs   to the level they appear in. Each byte corresponds to one   message ID--the lower seven bits hold the  level number that message can appear in.   Each level can have two messages, so the  highest bit is used to differentiate the   first message from the second. So when a message block is hit,   the game scans this list, starting at the end and  working backward until one of the entries matches   the level number that is currently loaded. If it does match, then that one extra bit   is checked to see if this message block  should correspond to this message box.   The way this value is determined is by the  message block's horizontal position in the level.   If the message block is at an even position,  it will correspond to the message with this   bit cleared, if it has an odd position, it  will look for the message with the bit set.   This method of figuring out which  message to display is sort of convoluted,   but it works when you can guarantee that  there is always a match in this list.   Let's see what happens if there  ends up being no match in the list.   This can happen if a level  was never assigned a message,   so it doesn't appear in this list at all, or if  the level was assigned only a single message,   and the message block with  the opposite parity was hit.   There is no logic to handle if the game reaches  the end of the list without finding a match.   In fact, the loop just falls through normally  when this index into the list reaches zero.   This means that the message  with ID 0 will be displayed.   And we know from earlier that message number 0   is a message for completing a switch palace  (the Yellow Switch Palace specifically),   and that the level will be completed  when the message is dismissed.   So, now the question becomes, where  is this possible and how is it done?   There are theoretically two ways to do it. The first way is to use a glitch to spawn   a message block into a level that  doesn't normally have one already.   Maybe by using an item swap to get  a message block into the item box,   or by using the sprite stun spawning like with  the Reznor kill to make a message block appear   so you can hit it and end the level. Unfortunately it just so happens that   there is no combination of powerup  states that allows a message block to   be put into the reserve item box. And there is only one sprite that   can spawn a message block via stun timer  spawning, which is the revolving net door.   These only appear in two levels: Iggy's  Castle (which already has two message blocks,   so this wouldn't work), and Front Door of  Bowser's Castle, but getting both a Yoshi   and a sprite that Yoshi can eat but not swallow  instantly into this room is basically impossible.   So, the second way is to go to a level that has  only one message assigned to it, and somehow move   the message block to a different position so it  tries to fetch the message that doesn't exist.   In the last video, we saw how an item swap  could be used to have Yoshi swallow any sprite,   even if he can't normally stick it on his tongue. Well in this case, we can use the same glitch   to get the message block to warp to  Yoshi's tongue, changing its position.   It's just important to activate the  message block before Yoshi can swallow it,   either by hitting it really quickly, or by  canceling his eating animation by getting hit.   And of course, it's important that the block ends  up on the opposite parity horizontal position   so that it tries to trigger  the message that doesn't exist   rather than the one originally  intended for the level.   There is a small caveat that occurs with this  glitch that I may as well mention because   it actually behaves slightly differently  on different versions of the game.   So, the message at the end of a switch palace  has that timer that keeps track of how long the   message displays before you can leave the level. And it's the switch palace switch that is   responsible for setting the  timer to its initial value,   then the message box ticks it down to zero. Since this glitch doesn't involve a switch palace   switch, the message box just uses whatever value  happens to be in memory for that timer last.   Most of the time this is zero, since  it's a timer that counts down.   This means that the timer wraps around and  has to count all the way down to zero again,   which takes about 17 seconds in game. The exception is if you are coming straight   from the title screen, since the spotlight only  makes this timer count down to 1 instead of 0.   Of course, the intro cutscene uses this timer  too, and makes it count down to zero again.   This means, you can get the message  to go away pretty much instantly,   but you have to load the game, pick a save  file that isn't empty so that you skip the   intro cutscene, and also not beat a single  switch palace before performing the glitch.   However, everything I just described regarding   this timer is only relevant  to the Japanese version.   In the English versions of the game, the way  message boxes were handled changed a bit.   Essentially, if the timer is zero when the message  appears, it will always behave like a normal   message box and not clear the level afterward. This change was made in order to make it so the   player had to press a button to dismiss the intro  cutscene instead of it going away on its own.   This just means that if you try to do this glitch  when the timer is zero, it just won't work at all   instead of taking 17 seconds of waiting. Instead you are required to get this timer   to start at some value other than zero, which  is only possible by visiting the title screen   and not seeing the intro cutscene  or completing a switch palace.   There are 5 levels that only have  one message associated with them,   two of which are Ghost Houses which prevent you  from bringing Yoshi in (normally, that is).   The remaining 3 levels are pretty simple to  perform this glitch in to beat the level.   The last thing to talk about is how to glitch  a goal tape to trigger an unused third exit,   and an unintended fourth exit to a level. The goal tape sprite, and all sprites really,   store their initial X and Y positions in the  level data that is held in the game's ROM.   When Mario gets near this location,  the sprite's data is copied into RAM   where it will exist until  it unloads at some point.   In the level data, each  sprite takes up three bytes.   This third byte is the 8-bit sprite ID, which  just denotes which type of sprite it is.   For the goal tape, this is $7B. The highest four bits in the second byte   are the sprite's X position within the screen. The lower four bits, along with this single bit   in the first byte will tell what  screen this sprite will spawn on.   And these five bits determine the  sprite's Y position in the level.   These last two bits are what are  referred to as the 'extra bits.'   No sprite other than the goal tape  uses these, which it uses to denote   which exit it is linked to. 00 is for the normal exit,   and 01 is for the secret exit. The values 10 and 11 are never used.   Interestingly, the value 10 is checked  for in the game's code as a third exit.   If the third exit is triggered, the normal exit is  unlocked, but Mario is teleported on the overworld   to go to one of the six submaps  instead of the main world map.   This functionality is only half  implemented, so it usually ends   up with Mario warping to a spot on the  overworld where he can't move any more.   If the fourth exit is triggered, it just acts  like the normal exit, nothing special happens.   In addition to all this, each level tile on the  overworld assigns a direction for Mario to move   when each exit type is cleared. For example, in Donut Plains 1,   the normal exit would take Mario to the left,  while the secret exit would take him upwards.   Each direction is encoded as two bits, and  these directions are stored in a single byte.   However, the third exit is defined to read  these next two bits as a direction to move.   Now, since these aren't used in  the final game, every level has   these set to 00, which corresponds to up. This means that if the third exit is cleared,   Mario will always move up on the overworld  afterwards, as long as there is a path there.   Also, just to be complete, the fourth  exit (which isn't truly implemented),   reads these two bits as a direction, which  sort of overlaps with the third exit's bits.   But again, these are all zeros,  so Mario will always move up.   So to review, a goal tape has two extra  bits that determines which exit to trigger.   Each exit will do two things: process  an overworld event, and move Mario.   The extra bits 00 correspond to the normal  exit, processes the normal exit event,   and moves Mario towards that level. The extra bits 01 correspond to the   secret exit, processes the secret exit  event, and moves Mario towards that level.   The extra bits 10 correspond to the third  exit, processes the normal exit event,   moves Mario up if he can, and additionally  will warp him to an overworld submap.   And the extra bits 11 correspond to the fourth  exit, processes the normal exit, moves Mario   up if he can, but doesn't warp him anywhere. Going back to how sprites load their data into   memory, let's see what a goal tape does. Each sprites' positions are 16-bit values,   but the high bytes and low bytes  are stored in separate tables.   The X position low byte is masked out and  stored in its table, and the X position high   byte is derived by the screen number. The Y position low byte is also masked   out and stored, but then we get  to the Y position high byte.   The common code run by all sprites will  extract the single Y bit here, but also the   extra bits as part of the Y position. Recall that for almost all sprites,   these bits are zero, so this  wouldn't affect the position at all.   Remember about the different sprite statuses? The current sprite status for this slot was zero,   since it was an empty slot with  no sprite associated with it.   It gets set to 1 during this process. Sprite status 1 is the initialization status,   and when the goal tape is in this state, the  extra bits are extracted from the Y position and   stored into a separate table where they belong. Then the sprite is put into default status 8.   So, what sort of glitch do you think could  modify a sprite's position that can't normally   be manipulated very much? The item swap of course!   We just saw this for the message block,  but now we can apply it to the goal tape.   If we get the goal tape to warp to Yoshi's  tongue, we can modify its Y position.   In fact, since sprites are processed in order of  sprite slot, from the higher slot numbers to the   lower slot numbers, if Yoshi is in a higher slot,  he will warp the goal tape to his tongue before   the goal tape can run it initialization routine. So, by overwriting the goal tape's position   with the position of his tongue, Yoshi can  effectively write to those extra bits as well.   Now, in a normal horizontal level, the highest  that the Y position can go is about $01D0.   This means the high byte of the Y  position can't get any higher than $01,   which will set the extra bits to 00. Which means if you item swap a goal tape that is   originally assigned to be a secret exit,  it will activate the normal exit instead.   But, there's something else! If you go above the top of the screen,   the Y position wraps around,  and the high byte becomes $FF.   Doing this will set the extra bits to  11, which activates the fourth exit!   And actually, in a vertical level, the Y  position can be a much higher range of values,   so theoretically you could  activate the third exit as well.   But goal tapes don't exist in any  vertical levels in the original game.   Since the third and fourth exits  process the normal exit event,   they don't increase the exit  counter on the title screen.   However, activating the fourth exit on  certain levels can get Mario to move   onto an overworld tile that is meant for a  star warp before the star is even revealed.   Entering these levels will put Mario in a  glitched test level, which can be cleared   using the orb glitch that I described in the  last video, which can increase the exit counter.   Using these end level glitches can bring  the total exit count up from 96 to 102.   Front Door, Back Door, and Yoshi's House  can be cleared using the orb glitch.   Funky, Choco-Ghost House, and Chocolate  Secret can get secret exits completed   by using sprite stun spawning and item swapping  to spawn a key and keyhole in the level.   And the fourth exits of Star  World 5 and Valley of Bowser 4   lead to test levels that can  also be cleared with the orb.   There are six more exits that can be  cleared by using wrong warping glitch   that we'll have to look at next time. Until then, thank you for watching!
Info
Channel: Retro Game Mechanics Explained
Views: 262,511
Rating: undefined out of 5
Keywords: video, game, programming, code, glitch, trick, explain, description, hack, smw, super mario world, boss, level, reznor, goal, message, assembly, snes, super nintendo, mario
Id: kkVMGu60TrQ
Channel Id: undefined
Length: 28min 14sec (1694 seconds)
Published: Fri May 13 2022
Related Videos
Note
Please note that this website is currently a work in progress! Lots of interesting data and statistics to come.