Bad Apple but it's played inside Super Mario Bros. [TAS]

For more information, read the write-up on the TASVideos submission: tasvideos.org/8991S
This is not a joke, this is a real TAS.

[@100thCoin]

This TAS has been console verified by Alyosha! kzbin.info/www/bejne/hXu7qaB6lLaeaNE

[@feminaproletarius7815]

can you tell me what the value of the instructions is iin storage? ie the inputs only? if you wanted to use this as an arbitrary assembly machine, how much storage space would be needed to do stuff like this? i dont plan to but it is a fun thought experiment to wonder what the person playing at home could do with a controller emulator attached to storage in the late 80s and 90s

[@LgiidOakLeaves]

Ye

[@_Guigui]

imagine minding your own business and suddenly the entire fabric of reality collapses and the only thing you can see is bad apple playing

[@nebuluna78]

i wouldn't be too surprised actually

[@ianweckhorst3200]

And it’s made out of the mangled parts of everything you’ve ever known smashed together in a horrible sickening mess

[@approblade]

Only a matter of time at this point

[@s.s.r.s2641]

It's more probable that suddenly the universe began to run doom

[@AlienAnthony]

Little did you know that on a universal scale we are just tiny specks using the butteryfly effect causing minor things that are leading to a bad apple video for the gods.

[@gentronicus]

We should be thankful these TAS researchers aren't black hat hackers.

[@MaxonerousX]

I mean for all we know some of them could be

[@rogercruz1547]

Same techniques

[@774]

You wouldn't believe how many of them are, this is literally the type of stuff black hat hackers do for fun in free time. The amount of touhou fans in black hat communities is insane

[@randomgamer-te8op]

@@774 just wondering, where did you get that data from

[@774]

@@randomgamer-te8op sketchy telegram channels, discord channels and bb forums. it's all on clearnet. been in that comm for a while, we love touhou lol.

[@kargaroc386]

speedrunning is a well-oiled wheel-reinventing machine with a massive amount of ontological inertia.

[@ncrecc6040]

this would happen all the time on my NES :/

[@mischiefthedegenerateratto7464]

Same, especially when I was about to hit world record...

[@NotNotGrumm]

mine always played the logan paul apology video

[@KatTheOneAndOnly]

@@NotNotGrummmine would always play Super Mario Bros 1993 😔

[@JoMaABC]

same, but the 25000 audio inputs a second were hard on my thumbs, it melted the controller, and weirdly, the song hadn't even been written at the time. Strangest of all was that it only put me at the end of world 7-4.

[@MelloBoo44]

this is crazy - nice work - didn't even realize ACE was possible with cartridge swapping

[@kargaroc386]

When the Mario cartridge is plugged in, the PPU has a fixed character set! You can't redefine the characters with CHR-ROM! So the movie has to work with what it's got, and what its got is Mario graphics, so thats why it looks like that.

[@100thCoin]

I've got a video in the works to explain everything about how this works, and how it was made. It will be out "soon".

[@goofygoose6]

Is it built off of ACE?

[@100thCoin]

@@goofygoose6This uses an ACE exploit, correct. I fill in over half the NES's available RAM with the code used to update the graphics and play the audio.

[@goofygoose6]

@@100thCoin I thought the audio was put in for post, that's wayyyy more impressive! I can't wait for the explanation video, that's gonna be very hype.

[@korumann]

​@@100thCoin This might be my new favorite thing done with ACE, right up there with Sethbling's SMW Flappy Bird.

[@mylescorley1978]

@@100thCoinI can see the how the graphics would work but what about the music?

[@sarysa]

Bad apple was an obvious good choice being treated well with only four colors, but the audio. Wow. I had no idea the NES was capable of that level of quality.

[@superparadox]

this is the most fucking insane thing i have ever seen. the audio is ACE'd in as well??? jesus christ this coin is going places

[@Vegas242]

Mario is about to drop him into the lava and Bowser sees his entire life flashing before his eyes, but his life is Bad Apple

[@SpringySpring04]

This is why I absolutely LOVE arbitrary code execution. It's awesome to see that such creativity is possible even with such limitations. And the best part is, even though this was posted on April 1, it's actually real. I love it

[@LandonEmma]

It’s not real, I can tell

[@100thCoin]

@@LandonEmmaYou can download the TAS yourself. This is 100% real. tasvideos.org/UserFiles/Info/638479355124534524

[@MadContendery]

@@LandonEmma "i can smell the fakeness..."

[@1unar_eclipse]

​@@MadContenderyGuy's a troll. Do not look at their comments in Splatoon 3 Side Order OST videos, crud's wild

[@睷]

the best part about april fools is getting these impressive real videos

[@Drdoodoot]

this has become the next "can it run doom?"

[@user-on9kq9wg6z]

this has not just became, it became even later before, can't tell when

[@saltedmutton7269]

​you'll like bill wurtz - he's a very observant sentence constructor like you, he'll be there in your avenue

[@char-kun6069]

Doom is for hardware, bad apple is for software

[@BriamGzz]

Always has been The three horsemen of " Can you..." Doom for Gameplay Bad Apple for Video Megalovania for Audio

[@GoofyGooberlyv2]

@@BriamGzz Can't wait for 100th coin to import a video of the Sans fight into SMB1 🤑🤑🤑🤑🤑🤑

[@sauzeefy]

lmaoooo, streaming audio through the controller ports is insaaaneee

[@legoboy7107]

I didn't even know Arbitrary Code Execution was possible in Mario 1!

[@woobgamer5210]

if it has a memory index it can modify, it can have ACE

[@eepyEden]

it freaking blew my mind when I found out that the music isn't edited in like I thought it was, this is actually incredible

[@ketchuplover6160]

i cant believe stop n swap and killing bowser with fireballs worked together to grant us this

[@Penguin_Spy]

i was thinking "wow i love how they used the SMB1 assets to approximate the edges for higher resolution; it's a shame they just added the music in post (but i can't complain since that's what i did for my Bad Apple)" and then i started reading the write-up and I'M HEARING THE NES RIGHT NOW?? that is *seriously* impressive!!

[@failedattempt2]

I was thinking the exact same thing lol. When I saw all the backup plans I was shaken to my core

[@robuxyyyyyyyyyy4708]

Imagine the kind of games that would've been published if they had as good of an understanding of the nes back then

[@devanbrowne8706]

​@@robuxyyyyyyyyyy4708that's not how this works.

[@ncrecc6040]

@@robuxyyyyyyyyyy4708imagine the kind of games that would've been published if they shipped it with a robot to spam the controller every frame to supply music

[@Vegas242]

​@@ncrecc6040New version of R.O.B. 😆

[@rubengoldman5830]

Me: "Super Mario Bros has such awesome music" The music in question:

[@TannerJ07]

There are two types of people: 1 This is an April fools joke 2 Oh arbitrary code execution 3 Wait why are there three people

[@qqwui9989]

The third person contains an insyruction to wrong warp to the 1st of January 1970

[@andermium]

that's how you get ace obv

[@valshaped]

Segmentation fault (core dumped)

[@dragon1130]

​@@andermium I think you're thinking if poly.

[@Hutch2Much]

ok, the ACE made sense in my mind, i guess. like i’ve seen stuff like that before, im used to it. but hearing that the AUDIO is playing through the console??? that’s seriously impressive!

[@LeKukie]

I'm so glad that this is actually real omg you're a legend for coding all of this I read through all of the submission notes and i do not regret it

[@MBCollector672]

this is the most insane bad apple video i have seen and i struggle to think of something that could ever surpass it

[@elvacioisepic8045]

bad apple in a particle accelerator?

[@GoofyGooberlyv2]

Bad Apple but it's tattoos when?? 🙏🙏

[@Pixelcraftian]

How do you get such smooth audio running on an NES? That's awesome love this

[@100thCoin]

I'm writing PCM audio to the APU every 71 CPU cycles! That's about 25 Khz!

[@Bro3256]

praying this gets console verified someday

[@100thCoin]

It has just been verified! kzbin.info/www/bejne/hXu7qaB6lLaeaNE

[@michaelgoff4504]

Bowser: That blasted Mario has foiled my plans 1000 times before, but this time I've figured his tricks and am ready for anything. Bowser: ...

[@devonodevon]

I thought I was done getting surprised by new versions of Bad Apple but here we are.

[@BizerkPixel]

I'm shocked that there's enough memory space to have the whole video tbh. I wonder how that was accomplished

[@100thCoin]

There's enough space to write code that allows me to stream the video/audio data through the controller ports. It's about 5.8 million inputs. Definitely not enough room in RAM to have the video play by its self.

[@BizerkPixel]

@@100thCoin that's even more fascinating actually :0

[@Kosmicd12]

Is the joke that it's actually real?

[@100thCoin]

The joke is that you need to read 50 whole pages to understand how this works.

[@GuanlongX]

@@100thCoin this is true, i just finished it up

[@thisnameisbad3609]

hi kosmic you're a cool guy but please don't profit over misinformation related to mental health okay thank you 👍

[@Riolupai]

Wait what ​@@thisnameisbad3609

[@GoodTato]

@@thisnameisbad3609 aw shit did he promote betterhelp or something?

[@shirosata]

I thought it was an April Fool's joke, until I read the documentation...It’s absolute genius.

[@fernandocalvo1250]

How does this not have millions of views already? It's been a while since I've been so blown away by something. Terrific work!

[@arabidllama]

In this case "TAS" stands for "Touhou Assisted Speedrun"

[@user-on9kq9wg6z]

In this case "TAS" stands for "Tool Assisted Superplay"

[@emilyy03]

ACTUALLY AMAZING !!! its super impressive how much is possible with arbitrary code execution. i honestly thought the audio was edited in at first..loved the read as well!❤️

[@alecrutz6979]

this is hilarious. I had a feeling this would be possible ever since that pokemon yellow TAS where someone played a spongebob clip IN the game itself. it feels like watching Bad Apple on a really bad computer so you have to watch it at the lowest resolution lol

[@RealZerenaFan]

How does he do that???

[@alecrutz6979]

@@RealZerenaFan you might wanna read the documentation in the description

[@McNibbler]

Reading through the writeup was quite a journey. Super impressive work, I’d love to see a video demonstrating each part

[@PretzelBS]

I hate it when I’m about to beat smb but I drop my controller and accidentally press all the buttons in such a way that bad apple plays

[@Gustyguy]

Imagine showing this to someone in the 1980s where the nes was in its hight.

[@ItssTasha1010]

This is the sort of the thing I'd want to put on one of the Voyager space probes.

[@aphidaks]

Arbritrary Code Execution Is Fucking Crazy

[@bekfstman9841]

at this point, it'd be more interesting to ask "what CAN'T play Bad Apple?" Awesome seeing how far SMB has been cracked, its pretty much to the same level as SMW flappy bird

[@alriune]

This is... incredible???! I'm flabbergasted but also really impressed! Lovely work for an April Fools joke

[@Patralgan]

I'm convinced that since day someone hacks reality and turn it into Bad apple

[@Poyostar]

Once again, the potential of arbitrary code execution has been showed off wonderfully. I had no idea it was even possible to do in the original Super Mario Bros.!

[@GermanPeter]

Yeah, this is gonna have like 100k views in a few months, good job.

[@iroxudont]

The audio was NOT added in post. Mind fucking blown.

[@punishedkid]

WHAT DO YOU MEAN THE AUDIO ISN'T EDITED IN

[@TheCrappyCompletionist]

I can't believe the NES's PCM channel was capable of this... Amazing!

[@TheOfficialHerb]

This is so cool! Thanks for linking the submission note, it was fascinating to understand how much work went into this

[@Snidbert]

After 39 years, Super Mario Bros 1 has finally been beaten.

[@dmr6043]

The immaculate level of creativity and problem solving of this... thing? Is beyond my comprehension. Thank you for cooking this up man.

[@1floccinaucinihilipilification]

If it exists, it is inevitable that bad apple is to be played on it.

[@Aqwy73]

pure quality content

[@lowpolyzoe]

I'm just amazed that the game insta-recovers

[@yukko_parra]

i genuinely thought it was a joke sort of thing i didn't realise you'd document the entire process for the arbitrary code execution. bravo

[@ZealanTanner]

Well done, added to my playlist

[@BeyElder]

Mind blowing! Great work!!

[@Zorothegallade-gg7zg]

"How does he doooo that?" --Patrick Star

[@Lorenz17]

I read the write-up for this. This is really cool. You did a good job. I don't think I've ever seen demoscene-esque programming combined with ACE like this before. "Finding a way to render 30FPS 32x24 tile videos in Super Mario Bros. has been left as an exercise for the reader." I have an idea for how to do this. I'm not super experienced with programming the 6502/Famicom and I haven't actually done any calculations, so if this concept is fanciful, feel free to ignore it. What if instead of storing tile-data in its own region of RAM and reading from it later with code run during Vblank, the tile-data was written directly into the Vblank code. The brunt of the Vblank code could just be an unrolled loop that looks like this: LDA #$ STA $2007 LDA #$ STA $2007 ... Where the constant values are written by the loop that writes tile-data from controller inputs. The tile-data writing code would obviously have to be altered to write outside of the zero-page and to only override every other address so as to preserve the LDA opcode, but I doubt such changes would affect anything. Doing it this way significantly reduces the number of cycles and bytes needed to write to the PPU during Vblank. Cycles are saved because LDA only takes 2 cycles with immediate addressing (as opposed to 3 with zero page addressing and 4-6 with other forms). Bytes are saved because you no longer need to designate space for the tile buffer - the tile data will occupy where the address part of the LDA instructions use to be. Also, every LDA instruction will only be 2 bytes long since the longer LDA instructions needed to read RAM from off the zero-page will no longer be necessary. Perhaps the concept of self-modifying code interweaved with graphics data could be extended beyond the no audio case to expand the resolution during the main video. What if instead of writing packets into RAM that are processed by code during Vblank, the controller reading loop wrote code (or more likely modified pre-written code) that would later be jumped to during Vblank. You could have a bunch of loops like this: LDA #$ STA $2006 LDA #$ STA $2006 LDX #$ LDA #$ Loop: STA $2007 DEX BNE Loop followed by the previous unrolled loop where the values that would have formerly comprised the packet instead are written as the constants in angle brackets. Obviously this could be refined to skip code that isn't used on a given frame so as to dedicate as many cycles as possible to the audio. I don't know how practical or possible any of this would be. You'd essentially be leveraging unused RAM for cycles, but its likely that there isn't enough RAM for all the unrolled loops that would be necessary. I honestly have no idea. All of this is just my 2 cents after seeing what you have done.

[@100thCoin]

Ooh, using immediate addressed LDA instructions is a really good starting point! This would still take up 1920 bytes, and 2304 CPU cycles, which would fit inside Vblank! One key issue here: We're swiftly running out of bytes. 62 of these bytes are the initial code-writing payload, so we're down to 66 remaining bytes in RAM. We could rewrite the code-writing code at another location in RAM, so we don't need to jump/branch around it. With 66 bytes, we would need to set up the PPU address to set which nametable we're looking at, loop to read the controller, automatically change where we're storing that value to overwrite the operands of the LDA instructions, prevent the $2002 race condition, and return to the code-writing payload once the video ends. Here's some pseudocode I wrote. It doesn't exit the loop, and it barely uses too many bytes. It's a huge improvement over my previous attempt though! Thanks for the help! AddressZero: ;-4 bytes of available space Nametabler: LDA # STA $2006 LDA # STA $2006 LDA # STA $2006 LDA # STA $2006 ; ... ; -snip- ; This would be the 1920 bytes for updating the nametables. ; We have about 70 CPU cycles before VBlank ends. ; Update the PPU address to look at the correct nametable LDX #20 ; 2 bytes INC

[@knghtbrd]

Not massively shocked you were able to ACE the game. Am massively shocked you were able to get video and audio renderers into the RAM available and still be able to restore the game state (unless you cheated on that?) when you were done. I once saw a NES Bad Apple with bordered tiles that broke up the "pixels", IMO that style looked better but no other sprite tiler port of Bad Apple (including the NES versions that followed) use it. I liked that screened effect. Most amazed you were rendering the singing until I realized you were streaming the one sound channel. Still it means you kept the music in sync, many 8 bit ports didn't accomplish that.

[@100thCoin]

The way I restore the game afterwards was pretty simple, actually. I just overwrite the entirety of RAM (except for the uninitialized RAM where my code-writing-payload exists), which is similar to loading a savestate. Then I enable the Non Maskable Interrupt, and jump to where SMB1 waits for the next VBlank.

[@sofia.eris.bauhaus]

you gotta be pretty good at hypertapping to replicate this in RTA. ;)

[@SpyroTheEternalNight]

i read a bit of the TAS submission. this is wild dude. very cool

[@ProfJamie20]

I read through the write-up, and WOW this is so amazing!!! I mean, I can barely understand the exact intricacies (I felt smart reading that one tiny section written in C# since I actually have some knowledge of that language XD) BUT the things I could piece together were PHENOMENAL!! (The stuff I couldn't was also phenomenal, it just also included a lot more bewildered yet impressed head-scratching from me XD) I LOVE ACE and all of its applications! Honestly, I didn't even know that SMB had ACE implementations until this video, so that alone is very exciting to me! I knew about how SRM could lead to new worlds, but I hadn't thought about how Bowser's death sprite would change in those instances, that's SO cool!!! Also, I have to say that the way you used R value comparisons between the Bad Apple frames and the SMB sprite table characters to find the closest match was SO insanely cool, like genuinely I am SO amazed by that, that is SO cool!! Sorry, I'll stop geeking out now! ^^; I'm honestly not THAT knowledgeable about code (ESPECIALLY video game code, I really only have experience in C# and python, plus a TINY bit of JS) BUT I'm in school to become a computer engineer and I've always loved code and, furthermore, I've always loved glitches and exploits in video games, especially ones like ACE where things get so insane that they don't even seem real! I just wanted to leave a comment to show you my appreciation of this, this is SO SO cool I seriously love this, keep up the amazing work!!! (Ok now it's time for me to go to bed it is WAY too early in the morning XD)

[@VsevolodKhusid]

This is beautiful. Looking forward to when you make it run Doom

[@DrNo64]

Imagine showing this to the crew who made Mario back in the day

[@MiirioKing]

Just read through the whole submission. That math got so close multiple times but it wasn’t quite enough. However this end result is still amazing!

[@GuanlongX]

Nah man this is crazy I was not expecting a Bad Apple video Very excited for the explanation video!

[@justacat6993]

I read the write up and only fully understood about half of it but it's so cool I love this

[@lain_web2000]

What an April fools joke, incredible.

[@pugchamp419]

now do it with handcam

[@artsycinccino6330]

Wow, this is very impressive!

[@ZipplyZane]

Though, don't get me wrong. I adore this type of TAS, and am floored at the work you put into them. I can't believe I forgot to check out TASVideos this year to see what contributors had been cooking. This is definitely one I would vote for, unlike the more troll-y April Fool's TASes. This is the type that could appear at SGDQ. In fact, I very much hope it can get console verified and is shown there. Though that would be another reason to work on an 8-bit audio version to avoid the copyright BS.

[@Yaroslav_kot3181]

Dear mario 流れてく 時の中ででも 気だるさが ほらグルグル廻って 私から 離れる心も 見えないわ そう知らない？ 自分から 動くこともなく 時の隙間に 流され続けて 知らないわ 周りのことなど 私は私 それだけ 夢見てる？ なにも見てない？ 語るも無駄な 自分の言葉？ 悲しむなんて 疲れるだけよ 何も感じず 過ごせばいいの 戸惑う言葉 与えられても 自分の心 ただ上の空 もし私から 動くのならば すべて変えるのなら 黒にする こんな自分に 未来はあるの？ こんな世界に 私はいるの？ 今切ないの？ 今悲しいの？ 自分の事も わからないまま 歩むことさえ 疲れるだけよ 人のことなど 知りもしないわ こんな私も 変われるのなら もし変われるのなら 白になる？ 流れてく 時の中ででも 気だるさがほら グルグル廻って 私から 離れる心も 見えないわそう 知らない？ 自分から 動くこともなく 時の隙間に 流され続けて 知らないわ 周りのことなど 私は私 それだけ？ 夢見てる？ なにも見てない 語るも無駄な 自分の言葉？ 悲しむなんて 疲れるだけよ 何も感じず 過ごせばいいの 戸惑う言葉 与えられても 自分の心 ただ上の空 もし私から 動くのならば すべて変えるのなら 黒にする 無駄な時間に 未来はあるの？ こんな所に 私は居るの？ 私のことを 言いたいならば 言葉にするのなら 「ろくでなし」 こんな所に 私はいるの？ こんな時間に 私はいるの？ こんな私も 変われるのなら もし変われるのなら 白になる？ 今夢見てる？ なにも見てない？ 語るも無駄な 自分の言葉？ 悲しむなんて 疲れるだけよ 何も感じず 過ごせばいいの 戸惑う言葉 与えられても 自分の心 ただ上の空 もし私から 動くのならば すべて変えるのなら 黒にする 動くのならば 動くのならば すべて壊すわ すべて壊すわ 悲しむならば 悲しむならば 私の心 白く変われる？ 貴方の事も 私のことも 全ての事も まだ知らないの 重い目蓋を 開けたのならば すべて壊すのなら 黒になれ Yours truly -Princess Toadstool

[@Kirbman]

SMB has ACE?!

[@user-on9kq9wg6z]

i think every 8 and 16 bit game has ACE, for example SMB, SMB3, SMW and others

[@Kirbman]

@user-on9kq9wg6z I'm not really an expert on this stuff, but I'm pretty sure you need a very specific set of circumstances for an ACE exploit. Like SMB3 for instance. While it does have an ACE exploit, it has no method to actually inject code.

[@RealAlexShows]

arbitrary code execution really is something

[@CillmaCuvas]

congrats, you hit the algorithm

[@Tr0lliPop]

Now that you managed to somehow figure THIS out... Can SMB1 run DOOM?

[@No_True_Scotsman]

This is incredibly impressive

[@Spidapida006]

Holy people, this is actually real

[@MrMegaManFan]

Now I want to see this ACE in Mega Man 2.

[@andrewzhang8512]

you absolute god

[@MrLlama-gl2hk]

This is art.

[@EdwardoFE]

The power of World N.

[@mr.cauliflower3536]

Bro's an ACE.

[@animowany111]

For a second I got excited about having actual ACE in SMB, before realizing it's world **N**

[@gavinrolls1054]

it is actual ACE though?

[@elijah44gd79]

getting to world n was also done in ace

[@TehDude]

how is the audio quality so good what

[@ukalik]

The fact that this was done while the game was seemingly being played normally instead of doing random-looking inputs is mind-boggling to me.

[@Sonictheoofhog4]

3:44 Dang, bro changed reality and changed it back for no reason

[@seanbrownlee9474]

This is so cool

[@spongefan155]

I Love ACE It's Beautiful

[@Disgustedorite]

Arbitrary code execution has peaked

[@sesukun2064]

Bro thats sick!

[@alexbenh]

An input display with this would be interesting

[@McGoomba]

Imagine you're speedrunning smb and this happens

[@rassilontdavros3004]

Batshit insane. I love it.

[@YuutaTogashi0707]

I can tell by the way the song was shortened to match the animation that this probably used the image sequence of Alstroemeria Records upscaled version from internet archive It includes audio that was shortened accurately

[@YuutaTogashi0707]

Also I shortened the song to match the original animation with 100% accuracy after finding out the 2008 EXSERENS release was the audio used in the animation I also got a source of the animation close to what Minoshima upscaled. Minoshima got the original master video from a friend of anira and I contacted that friend and wasn't allowed to have it so I found a game that the friend sent the animation to and it's better than the nicovideo upload but worse than what Minoshima got.

[@100thCoin]

@@YuutaTogashi0707 I definitely got the image sequence from internet archive, though I don't recall the uploader. That sounds correct though.

[@ZacharyTheRealOne]

poor mario had to lose the power up for this

[@LucasWills]

ACE in smb1?? Amazing.

[@HomeofLawboy]

The game just resumes at the end what the hell

[@TheosTechTime]

This is insane.