can you tell me what the value of the instructions is iin storage? ie the inputs only? if you wanted to use this as an arbitrary assembly machine, how much storage space would be needed to do stuff like this? i dont plan to but it is a fun thought experiment to wonder what the person playing at home could do with a controller emulator attached to storage in the late 80s and 90s
Little did you know that on a universal scale we are just tiny specks using the butteryfly effect causing minor things that are leading to a bad apple video for the gods.
You wouldn't believe how many of them are, this is literally the type of stuff black hat hackers do for fun in free time. The amount of touhou fans in black hat communities is insane
@@randomgamer-te8op sketchy telegram channels, discord channels and bb forums. it's all on clearnet. been in that comm for a while, we love touhou lol.
@@goofygoose6This uses an ACE exploit, correct. I fill in over half the NES's available RAM with the code used to update the graphics and play the audio.
When the Mario cartridge is plugged in, the PPU has a fixed character set! You can't redefine the characters with CHR-ROM! So the movie has to work with what it's got, and what its got is Mario graphics, so thats why it looks like that.
This is why I absolutely LOVE arbitrary code execution. It's awesome to see that such creativity is possible even with such limitations. And the best part is, even though this was posted on April 1, it's actually real. I love it
same, but the 25000 audio inputs a second were hard on my thumbs, it melted the controller, and weirdly, the song hadn't even been written at the time. Strangest of all was that it only put me at the end of world 7-4.
There's enough space to write code that allows me to stream the video/audio data through the controller ports. It's about 5.8 million inputs. Definitely not enough room in RAM to have the video play by its self.
i was thinking "wow i love how they used the SMB1 assets to approximate the edges for higher resolution; it's a shame they just added the music in post (but i can't complain since that's what i did for my Bad Apple)" and then i started reading the write-up and I'M HEARING THE NES RIGHT NOW?? that is *seriously* impressive!!
@@robuxyyyyyyyyyy4708imagine the kind of games that would've been published if they shipped it with a robot to spam the controller every frame to supply music
Bad apple was an obvious good choice being treated well with only four colors, but the audio. Wow. I had no idea the NES was capable of that level of quality.
this is hilarious. I had a feeling this would be possible ever since that pokemon yellow TAS where someone played a spongebob clip IN the game itself. it feels like watching Bad Apple on a really bad computer so you have to watch it at the lowest resolution lol
The fact this is all done in real time and with audio is impressive af, and makes this among the best bad apples I've seen. Really surprised it has this little views. Thank you for sharing your hard work!
ok, the ACE made sense in my mind, i guess. like i’ve seen stuff like that before, im used to it. but hearing that the AUDIO is playing through the console??? that’s seriously impressive!
ACTUALLY AMAZING !!! its super impressive how much is possible with arbitrary code execution. i honestly thought the audio was edited in at first..loved the read as well!❤️
at this point, it'd be more interesting to ask "what CAN'T play Bad Apple?" Awesome seeing how far SMB has been cracked, its pretty much to the same level as SMW flappy bird
I read the write-up for this. This is really cool. You did a good job. I don't think I've ever seen demoscene-esque programming combined with ACE like this before. "Finding a way to render 30FPS 32x24 tile videos in Super Mario Bros. has been left as an exercise for the reader." I have an idea for how to do this. I'm not super experienced with programming the 6502/Famicom and I haven't actually done any calculations, so if this concept is fanciful, feel free to ignore it. What if instead of storing tile-data in its own region of RAM and reading from it later with code run during Vblank, the tile-data was written directly into the Vblank code. The brunt of the Vblank code could just be an unrolled loop that looks like this: LDA #$ STA $2007 LDA #$ STA $2007 ... Where the constant values are written by the loop that writes tile-data from controller inputs. The tile-data writing code would obviously have to be altered to write outside of the zero-page and to only override every other address so as to preserve the LDA opcode, but I doubt such changes would affect anything. Doing it this way significantly reduces the number of cycles and bytes needed to write to the PPU during Vblank. Cycles are saved because LDA only takes 2 cycles with immediate addressing (as opposed to 3 with zero page addressing and 4-6 with other forms). Bytes are saved because you no longer need to designate space for the tile buffer - the tile data will occupy where the address part of the LDA instructions use to be. Also, every LDA instruction will only be 2 bytes long since the longer LDA instructions needed to read RAM from off the zero-page will no longer be necessary. Perhaps the concept of self-modifying code interweaved with graphics data could be extended beyond the no audio case to expand the resolution during the main video. What if instead of writing packets into RAM that are processed by code during Vblank, the controller reading loop wrote code (or more likely modified pre-written code) that would later be jumped to during Vblank. You could have a bunch of loops like this: LDA #$ STA $2006 LDA #$ STA $2006 LDX #$ LDA #$ Loop: STA $2007 DEX BNE Loop followed by the previous unrolled loop where the values that would have formerly comprised the packet instead are written as the constants in angle brackets. Obviously this could be refined to skip code that isn't used on a given frame so as to dedicate as many cycles as possible to the audio. I don't know how practical or possible any of this would be. You'd essentially be leveraging unused RAM for cycles, but its likely that there isn't enough RAM for all the unrolled loops that would be necessary. I honestly have no idea. All of this is just my 2 cents after seeing what you have done.
Ooh, using immediate addressed LDA instructions is a really good starting point! This would still take up 1920 bytes, and 2304 CPU cycles, which would fit inside Vblank! One key issue here: We're swiftly running out of bytes. 62 of these bytes are the initial code-writing payload, so we're down to 66 remaining bytes in RAM. We could rewrite the code-writing code at another location in RAM, so we don't need to jump/branch around it. With 66 bytes, we would need to set up the PPU address to set which nametable we're looking at, loop to read the controller, automatically change where we're storing that value to overwrite the operands of the LDA instructions, prevent the $2002 race condition, and return to the code-writing payload once the video ends. Here's some pseudocode I wrote. It doesn't exit the loop, and it barely uses too many bytes. It's a huge improvement over my previous attempt though! Thanks for the help! AddressZero:
;-4 bytes of available space Nametabler: LDA # STA $2006 LDA # STA $2006 LDA # STA $2006 LDA # STA $2006 ; ... ; -snip- ; This would be the 1920 bytes for updating the nametables. ; We have about 70 CPU cycles before VBlank ends. ; Update the PPU address to look at the correct nametable LDX #20 ; 2 bytes INC
I read through the write-up, and WOW this is so amazing!!! I mean, I can barely understand the exact intricacies (I felt smart reading that one tiny section written in C# since I actually have some knowledge of that language XD) BUT the things I could piece together were PHENOMENAL!! (The stuff I couldn't was also phenomenal, it just also included a lot more bewildered yet impressed head-scratching from me XD) I LOVE ACE and all of its applications! Honestly, I didn't even know that SMB had ACE implementations until this video, so that alone is very exciting to me! I knew about how SRM could lead to new worlds, but I hadn't thought about how Bowser's death sprite would change in those instances, that's SO cool!!! Also, I have to say that the way you used R value comparisons between the Bad Apple frames and the SMB sprite table characters to find the closest match was SO insanely cool, like genuinely I am SO amazed by that, that is SO cool!! Sorry, I'll stop geeking out now! ^^; I'm honestly not THAT knowledgeable about code (ESPECIALLY video game code, I really only have experience in C# and python, plus a TINY bit of JS) BUT I'm in school to become a computer engineer and I've always loved code and, furthermore, I've always loved glitches and exploits in video games, especially ones like ACE where things get so insane that they don't even seem real! I just wanted to leave a comment to show you my appreciation of this, this is SO SO cool I seriously love this, keep up the amazing work!!! (Ok now it's time for me to go to bed it is WAY too early in the morning XD)
Though, don't get me wrong. I adore this type of TAS, and am floored at the work you put into them. I can't believe I forgot to check out TASVideos this year to see what contributors had been cooking. This is definitely one I would vote for, unlike the more troll-y April Fool's TASes. This is the type that could appear at SGDQ. In fact, I very much hope it can get console verified and is shown there. Though that would be another reason to work on an 8-bit audio version to avoid the copyright BS.
Not massively shocked you were able to ACE the game. Am massively shocked you were able to get video and audio renderers into the RAM available and still be able to restore the game state (unless you cheated on that?) when you were done. I once saw a NES Bad Apple with bordered tiles that broke up the "pixels", IMO that style looked better but no other sprite tiler port of Bad Apple (including the NES versions that followed) use it. I liked that screened effect. Most amazed you were rendering the singing until I realized you were streaming the one sound channel. Still it means you kept the music in sync, many 8 bit ports didn't accomplish that.
The way I restore the game afterwards was pretty simple, actually. I just overwrite the entirety of RAM (except for the uninitialized RAM where my code-writing-payload exists), which is similar to loading a savestate. Then I enable the Non Maskable Interrupt, and jump to where SMB1 waits for the next VBlank.
Once again, the potential of arbitrary code execution has been showed off wonderfully. I had no idea it was even possible to do in the original Super Mario Bros.!
I can tell by the way the song was shortened to match the animation that this probably used the image sequence of Alstroemeria Records upscaled version from internet archive It includes audio that was shortened accurately
Also I shortened the song to match the original animation with 100% accuracy after finding out the 2008 EXSERENS release was the audio used in the animation I also got a source of the animation close to what Minoshima upscaled. Minoshima got the original master video from a friend of anira and I contacted that friend and wasn't allowed to have it so I found a game that the friend sent the animation to and it's better than the nicovideo upload but worse than what Minoshima got.
@user-on9kq9wg6z I'm not really an expert on this stuff, but I'm pretty sure you need a very specific set of circumstances for an ACE exploit. Like SMB3 for instance. While it does have an ACE exploit, it has no method to actually inject code.
![[TAS] Pokémon Yellow - Arbitrary Code Execution](http://i.ytimg.com/vi/Vjm8P8utT5g/mqdefault.jpg)
This TAS has been console verified by Alyosha!
ua-cam.com/video/OJXxmD_Qk2o/v-deo.html
can you tell me what the value of the instructions is iin storage? ie the inputs only? if you wanted to use this as an arbitrary assembly machine, how much storage space would be needed to do stuff like this? i dont plan to but it is a fun thought experiment to wonder what the person playing at home could do with a controller emulator attached to storage in the late 80s and 90s
Ye
imagine minding your own business and suddenly the entire fabric of reality collapses and the only thing you can see is bad apple playing
i wouldn't be too surprised actually
And it’s made out of the mangled parts of everything you’ve ever known smashed together in a horrible sickening mess
Only a matter of time at this point
It's more probable that suddenly the universe began to run doom
Little did you know that on a universal scale we are just tiny specks using the butteryfly effect causing minor things that are leading to a bad apple video for the gods.
speedrunning is a well-oiled wheel-reinventing machine with a massive amount of ontological inertia.
.
i like your funny words, magic man
We should be thankful these TAS researchers aren't black hat hackers.
I mean for all we know some of them could be
Same techniques
You wouldn't believe how many of them are, this is literally the type of stuff black hat hackers do for fun in free time. The amount of touhou fans in black hat communities is insane
@@774 just wondering, where did you get that data from
@@randomgamer-te8op sketchy telegram channels, discord channels and bb forums. it's all on clearnet. been in that comm for a while, we love touhou lol.
this is the most fucking insane thing i have ever seen. the audio is ACE'd in as well??? jesus christ this coin is going places
Mario is about to drop him into the lava and Bowser sees his entire life flashing before his eyes, but his life is Bad Apple
I've got a video in the works to explain everything about how this works, and how it was made. It will be out "soon".
Is it built off of ACE?
@@goofygoose6This uses an ACE exploit, correct. I fill in over half the NES's available RAM with the code used to update the graphics and play the audio.
@@100thCoin I thought the audio was put in for post, that's wayyyy more impressive! I can't wait for the explanation video, that's gonna be very hype.
@@100thCoin This might be my new favorite thing done with ACE, right up there with Sethbling's SMW Flappy Bird.
@@100thCoinI can see the how the graphics would work but what about the music?
When the Mario cartridge is plugged in, the PPU has a fixed character set! You can't redefine the characters with CHR-ROM!
So the movie has to work with what it's got, and what its got is Mario graphics, so thats why it looks like that.
this is crazy - nice work - didn't even realize ACE was possible with cartridge swapping
lmaoooo, streaming audio through the controller ports is insaaaneee
This is why I absolutely LOVE arbitrary code execution. It's awesome to see that such creativity is possible even with such limitations. And the best part is, even though this was posted on April 1, it's actually real. I love it
@@LandonEmmaYou can download the TAS yourself. This is 100% real. tasvideos.org/UserFiles/Info/638479355124534524
@@LandonEmma "i can smell the fakeness..."
@@MadContenderyGuy's a troll. Do not look at their comments in Splatoon 3 Side Order OST videos, crud's wild
@@LandonEmma trolling is pointless, but thanks for the laugh!
i cant believe stop n swap and killing bowser with fireballs worked together to grant us this
this would happen all the time on my NES :/
Same, especially when I was about to hit world record...
mine always played the logan paul apology video
@@NotNotGrummmine would always play Super Mario Bros 1993 😔
same, but the 25000 audio inputs a second were hard on my thumbs, it melted the controller, and weirdly, the song hadn't even been written at the time. Strangest of all was that it only put me at the end of world 7-4.
this has become the next "can it run doom?"
this has not just became, it became even later before, can't tell when
you'll like bill wurtz - he's a very observant sentence constructor like you, he'll be there in your avenue
Doom is for hardware, bad apple is for software
Always has been
The three horsemen of " Can you..."
Doom for Gameplay
Bad Apple for Video
Megalovania for Audio
@@BriamGzz Can't wait for 100th coin to import a video of the Sans fight into SMB1 🤑🤑🤑🤑🤑🤑
the best part about april fools is getting these impressive real videos
How do you get such smooth audio running on an NES? That's awesome love this
I'm writing PCM audio to the APU every 71 CPU cycles! That's about 25 Khz!
I'm so glad that this is actually real omg you're a legend for coding all of this
I read through all of the submission notes and i do not regret it
I'm shocked that there's enough memory space to have the whole video tbh. I wonder how that was accomplished
There's enough space to write code that allows me to stream the video/audio data through the controller ports. It's about 5.8 million inputs. Definitely not enough room in RAM to have the video play by its self.
@@100thCoin that's even more fascinating actually :0
this is the most insane bad apple video i have seen and i struggle to think of something that could ever surpass it
bad apple in a particle accelerator?
Bad Apple but it's tattoos when?? 🙏🙏
>put a giant, enourmous screen in the middle of the ocean
>go to the moon
>bad apple but it's played on planet earth and its watchable from the moon
There are two types of people:
1 This is an April fools joke
2 Oh arbitrary code execution
3 Wait why are there three people
The third person contains an insyruction to wrong warp to the 1st of January 1970
that's how you get ace obv
Segmentation fault (core dumped)
@@andermium I think you're thinking if poly.
I didn't even know Arbitrary Code Execution was possible in Mario 1!
if it has a memory index it can modify, it can have ACE
praying this gets console verified someday
It has just been verified! ua-cam.com/video/OJXxmD_Qk2o/v-deo.html
i was thinking "wow i love how they used the SMB1 assets to approximate the edges for higher resolution; it's a shame they just added the music in post (but i can't complain since that's what i did for my Bad Apple)"
and then i started reading the write-up and I'M HEARING THE NES RIGHT NOW?? that is *seriously* impressive!!
I was thinking the exact same thing lol. When I saw all the backup plans I was shaken to my core
Imagine the kind of games that would've been published if they had as good of an understanding of the nes back then
@@robuxyyyyyyyyyy4708that's not how this works.
@@robuxyyyyyyyyyy4708imagine the kind of games that would've been published if they shipped it with a robot to spam the controller every frame to supply music
@@ncrecc6040New version of R.O.B. 😆
Is the joke that it's actually real?
The joke is that you need to read 50 whole pages to understand how this works.
@@100thCoin this is true, i just finished it up
hi kosmic you're a cool guy but please don't profit over misinformation related to mental health okay thank you 👍
Wait what @@gamertypeawesome
@@gamertypeawesome aw shit did he promote betterhelp or something?
Me: "Super Mario Bros has such awesome music"
The music in question:
pcm audio via controller ACE is the craziest thing ive seen in a long time, bravo man. bad apple lives on
it freaking blew my mind when I found out that the music isn't edited in like I thought it was, this is actually incredible
I thought I was done getting surprised by new versions of Bad Apple but here we are.
Bad apple was an obvious good choice being treated well with only four colors, but the audio. Wow. I had no idea the NES was capable of that level of quality.
this is hilarious. I had a feeling this would be possible ever since that pokemon yellow TAS where someone played a spongebob clip IN the game itself.
it feels like watching Bad Apple on a really bad computer so you have to watch it at the lowest resolution lol
How does he do that???
@@RealZerenaFan you might wanna read the documentation in the description
@@alecrutz956Their comment was a reference to the Pokémon Yellow TAS.
@@mariorockysonicmegasochjag I may be stupid
The fact this is all done in real time and with audio is impressive af, and makes this among the best bad apples I've seen. Really surprised it has this little views. Thank you for sharing your hard work!
Well done, added to my playlist
ok, the ACE made sense in my mind, i guess. like i’ve seen stuff like that before, im used to it. but hearing that the AUDIO is playing through the console??? that’s seriously impressive!
Reading through the writeup was quite a journey. Super impressive work, I’d love to see a video demonstrating each part
I hate it when I’m about to beat smb but I drop my controller and accidentally press all the buttons in such a way that bad apple plays
I thought it was an April Fool's joke, until I read the documentation...It’s absolute genius.
How does this not have millions of views already? It's been a while since I've been so blown away by something. Terrific work!
In this case "TAS" stands for "Touhou Assisted Speedrun"
In this case "TAS" stands for "Tool Assisted Superplay"
@@АннаЗахматова-б7ф you didn't get the joke... have you never heard of "Touhou" before?!
ACTUALLY AMAZING !!! its super impressive how much is possible with arbitrary code execution. i honestly thought the audio was edited in at first..loved the read as well!❤️
This is... incredible???! I'm flabbergasted but also really impressed! Lovely work for an April Fools joke
Yeah, this is gonna have like 100k views in a few months, good job.
The immaculate level of creativity and problem solving of this... thing? Is beyond my comprehension.
Thank you for cooking this up man.
This is beautiful. Looking forward to when you make it run Doom
This is one of the coolest easter eggs ever found in an old video game! Only took someone 39 years to find it!
i genuinely thought it was a joke sort of thing
i didn't realise you'd document the entire process for the arbitrary code execution.
bravo
at this point, it'd be more interesting to ask "what CAN'T play Bad Apple?"
Awesome seeing how far SMB has been cracked, its pretty much to the same level as SMW flappy bird
I'm convinced that some day someone hacks reality and turn it into Bad apple
i mean, computers are basically our hacks of reality
After 39 years, Super Mario Bros 1 has finally been beaten.
I read the write-up for this. This is really cool. You did a good job. I don't think I've ever seen demoscene-esque programming combined with ACE like this before.
"Finding a way to render 30FPS 32x24 tile videos in Super Mario Bros. has been left as an exercise for the reader."
I have an idea for how to do this. I'm not super experienced with programming the 6502/Famicom and I haven't actually done any calculations, so if this concept is fanciful, feel free to ignore it.
What if instead of storing tile-data in its own region of RAM and reading from it later with code run during Vblank, the tile-data was written directly into the Vblank code. The brunt of the Vblank code could just be an unrolled loop that looks like this:
LDA #$
STA $2007
LDA #$
STA $2007
...
Where the constant values are written by the loop that writes tile-data from controller inputs. The tile-data writing code would obviously have to be altered to write outside of the zero-page and to only override every other address so as to preserve the LDA opcode, but I doubt such changes would affect anything.
Doing it this way significantly reduces the number of cycles and bytes needed to write to the PPU during Vblank. Cycles are saved because LDA only takes 2 cycles with immediate addressing (as opposed to 3 with zero page addressing and 4-6 with other forms). Bytes are saved because you no longer need to designate space for the tile buffer - the tile data will occupy where the address part of the LDA instructions use to be. Also, every LDA instruction will only be 2 bytes long since the longer LDA instructions needed to read RAM from off the zero-page will no longer be necessary.
Perhaps the concept of self-modifying code interweaved with graphics data could be extended beyond the no audio case to expand the resolution during the main video. What if instead of writing packets into RAM that are processed by code during Vblank, the controller reading loop wrote code (or more likely modified pre-written code) that would later be jumped to during Vblank. You could have a bunch of loops like this:
LDA #$
STA $2006
LDA #$
STA $2006
LDX #$
LDA #$
Loop:
STA $2007
DEX
BNE Loop
followed by the previous unrolled loop where the values that would have formerly comprised the packet instead are written as the constants in angle brackets. Obviously this could be refined to skip code that isn't used on a given frame so as to dedicate as many cycles as possible to the audio. I don't know how practical or possible any of this would be. You'd essentially be leveraging unused RAM for cycles, but its likely that there isn't enough RAM for all the unrolled loops that would be necessary. I honestly have no idea. All of this is just my 2 cents after seeing what you have done.
Ooh, using immediate addressed LDA instructions is a really good starting point! This would still take up 1920 bytes, and 2304 CPU cycles, which would fit inside Vblank! One key issue here: We're swiftly running out of bytes. 62 of these bytes are the initial code-writing payload, so we're down to 66 remaining bytes in RAM. We could rewrite the code-writing code at another location in RAM, so we don't need to jump/branch around it.
With 66 bytes, we would need to set up the PPU address to set which nametable we're looking at, loop to read the controller, automatically change where we're storing that value to overwrite the operands of the LDA instructions, prevent the $2002 race condition, and return to the code-writing payload once the video ends.
Here's some pseudocode I wrote. It doesn't exit the loop, and it barely uses too many bytes. It's a huge improvement over my previous attempt though! Thanks for the help!
AddressZero:
;-4 bytes of available space
Nametabler:
LDA #
STA $2006
LDA #
STA $2006
LDA #
STA $2006
LDA #
STA $2006
; ...
; -snip- ; This would be the 1920 bytes for updating the nametables.
; We have about 70 CPU cycles before VBlank ends.
; Update the PPU address to look at the correct nametable
LDX #20 ; 2 bytes
INC
pure quality content
Bowser: That blasted Mario has foiled my plans 1000 times before, but this time I've figured his tricks and am ready for anything.
Bowser: ...
congrats, you hit the algorithm
I read through the write-up, and WOW this is so amazing!!! I mean, I can barely understand the exact intricacies (I felt smart reading that one tiny section written in C# since I actually have some knowledge of that language XD) BUT the things I could piece together were PHENOMENAL!! (The stuff I couldn't was also phenomenal, it just also included a lot more bewildered yet impressed head-scratching from me XD)
I LOVE ACE and all of its applications! Honestly, I didn't even know that SMB had ACE implementations until this video, so that alone is very exciting to me! I knew about how SRM could lead to new worlds, but I hadn't thought about how Bowser's death sprite would change in those instances, that's SO cool!!! Also, I have to say that the way you used R value comparisons between the Bad Apple frames and the SMB sprite table characters to find the closest match was SO insanely cool, like genuinely I am SO amazed by that, that is SO cool!!
Sorry, I'll stop geeking out now! ^^; I'm honestly not THAT knowledgeable about code (ESPECIALLY video game code, I really only have experience in C# and python, plus a TINY bit of JS) BUT I'm in school to become a computer engineer and I've always loved code and, furthermore, I've always loved glitches and exploits in video games, especially ones like ACE where things get so insane that they don't even seem real! I just wanted to leave a comment to show you my appreciation of this, this is SO SO cool I seriously love this, keep up the amazing work!!!
(Ok now it's time for me to go to bed it is WAY too early in the morning XD)
This is so cool! Thanks for linking the submission note, it was fascinating to understand how much work went into this
Just read through the whole submission. That math got so close multiple times but it wasn’t quite enough. However this end result is still amazing!
I can't believe the NES's PCM channel was capable of this... Amazing!
This is the sort of the thing I'd want to put on one of the Voyager space probes.
Though, don't get me wrong. I adore this type of TAS, and am floored at the work you put into them. I can't believe I forgot to check out TASVideos this year to see what contributors had been cooking. This is definitely one I would vote for, unlike the more troll-y April Fool's TASes.
This is the type that could appear at SGDQ. In fact, I very much hope it can get console verified and is shown there. Though that would be another reason to work on an 8-bit audio version to avoid the copyright BS.
It is console verified now!
Not massively shocked you were able to ACE the game. Am massively shocked you were able to get video and audio renderers into the RAM available and still be able to restore the game state (unless you cheated on that?) when you were done.
I once saw a NES Bad Apple with bordered tiles that broke up the "pixels", IMO that style looked better but no other sprite tiler port of Bad Apple (including the NES versions that followed) use it. I liked that screened effect.
Most amazed you were rendering the singing until I realized you were streaming the one sound channel. Still it means you kept the music in sync, many 8 bit ports didn't accomplish that.
The way I restore the game afterwards was pretty simple, actually. I just overwrite the entirety of RAM (except for the uninitialized RAM where my code-writing-payload exists), which is similar to loading a savestate. Then I enable the Non Maskable Interrupt, and jump to where SMB1 waits for the next VBlank.
i read a bit of the TAS submission. this is wild dude. very cool
Imagine showing this to the crew who made Mario back in the day
Once again, the potential of arbitrary code execution has been showed off wonderfully. I had no idea it was even possible to do in the original Super Mario Bros.!
The audio was NOT added in post.
Mind fucking blown.
I read the write up and only fully understood about half of it but it's so cool I love this
Nah man this is crazy
I was not expecting a Bad Apple video
Very excited for the explanation video!
The audio not only sounds shockingly good for an NES, it actually has a really nice gritty saturation to it.
3:44
Dang, bro changed reality and changed it back for no reason
I think you need to blow in the cartridge
you gotta be pretty good at hypertapping to replicate this in RTA. ;)
Its always nice when touhou music needs a ramdom boost on popularity even if it gets forgotten and deligated to the neiche shortly after
Imagine showing this to someone in the 1980s where the nes was in its hight.
I can tell by the way the song was shortened to match the animation that this probably used the image sequence of Alstroemeria Records upscaled version from internet archive
It includes audio that was shortened accurately
Also I shortened the song to match the original animation with 100% accuracy after finding out the 2008 EXSERENS release was the audio used in the animation
I also got a source of the animation close to what Minoshima upscaled.
Minoshima got the original master video from a friend of anira and I contacted that friend and wasn't allowed to have it so I found a game that the friend sent the animation to and it's better than the nicovideo upload but worse than what Minoshima got.
@@YuutaTogashi0707 I definitely got the image sequence from internet archive, though I don't recall the uploader. That sounds correct though.
Arbritrary Code Execution Is Fucking Crazy
WHAT DO YOU MEAN THE AUDIO ISN'T EDITED IN
Dear mario
流れてく 時の中ででも 気だるさが ほらグルグル廻って 私から 離れる心も 見えないわ そう知らない？ 自分から 動くこともなく 時の隙間に 流され続けて 知らないわ 周りのことなど 私は私 それだけ 夢見てる？ なにも見てない？ 語るも無駄な 自分の言葉？ 悲しむなんて 疲れるだけよ 何も感じず 過ごせばいいの 戸惑う言葉 与えられても 自分の心 ただ上の空 もし私から 動くのならば すべて変えるのなら 黒にする こんな自分に 未来はあるの？ こんな世界に 私はいるの？ 今切ないの？ 今悲しいの？ 自分の事も わからないまま 歩むことさえ 疲れるだけよ 人のことなど 知りもしないわ こんな私も 変われるのなら もし変われるのなら 白になる？ 流れてく 時の中ででも 気だるさがほら グルグル廻って 私から 離れる心も 見えないわそう 知らない？ 自分から 動くこともなく 時の隙間に 流され続けて 知らないわ 周りのことなど 私は私 それだけ？ 夢見てる？ なにも見てない 語るも無駄な 自分の言葉？ 悲しむなんて 疲れるだけよ 何も感じず 過ごせばいいの 戸惑う言葉 与えられても 自分の心 ただ上の空 もし私から 動くのならば すべて変えるのなら 黒にする 無駄な時間に 未来はあるの？ こんな所に 私は居るの？ 私のことを 言いたいならば 言葉にするのなら 「ろくでなし」 こんな所に 私はいるの？ こんな時間に 私はいるの？ こんな私も 変われるのなら もし変われるのなら 白になる？ 今夢見てる？ なにも見てない？ 語るも無駄な 自分の言葉？ 悲しむなんて 疲れるだけよ 何も感じず 過ごせばいいの 戸惑う言葉 与えられても 自分の心 ただ上の空 もし私から 動くのならば すべて変えるのなら 黒にする 動くのならば 動くのならば すべて壊すわ すべて壊すわ 悲しむならば 悲しむならば 私の心 白く変われる？ 貴方の事も 私のことも 全ての事も まだ知らないの 重い目蓋を 開けたのならば すべて壊すのなら 黒になれ
Yours truly -Princess Toadstool
"How does he doooo that?"
--Patrick Star
arbitrary code execution really is something
Holy people, this is actually real
This is incredibly impressive
Mind blowing! Great work!!
how is the audio quality so good what
I'm just amazed that the game insta-recovers
This is so cool
you absolute god
SMB has ACE?!
i think every 8 and 16 bit game has ACE, for example SMB, SMB3, SMW and others
@user-on9kq9wg6z I'm not really an expert on this stuff, but I'm pretty sure you need a very specific set of circumstances for an ACE exploit. Like SMB3 for instance. While it does have an ACE exploit, it has no method to actually inject code.
This is art.
IN SUPER MARIO BROTHERS?
I Love ACE It's Beautiful
First, Mario turned his world into Flappy Bird.
Now bad apple?
we need to stop this Italian
this might be epic in super mario world, if possible.
Batshit insane. I love it.
The power of World N.
This is insane.
when a yokai tilts my cartridge
Imagine you're speedrunning smb and this happens
Wow, this is very impressive!
The fact that this was done while the game was seemingly being played normally instead of doing random-looking inputs is mind-boggling to me.
An input display with this would be interesting
Bro's an ACE.
Now that you managed to somehow figure THIS out...
Can SMB1 run DOOM?