Super Mario Bros. 3: ACE by kicking the goal around

In this video, I'm going to demonstrate how a series of new discoveries almost lead to ACE.
In summary, when the goal spawns in, it overwrites anything in the first bumped block sprite slot. When an object spawns in (including the goal) it's sprite state get's incremented by one. Normally this is done to set state 0 to state 1, but in this case, we can use a bumped block in a different state to make some wild things happen. This is called Sprite State Incrementation.
The goal uses address $DF to track its internal state. This address is also used for tile detection if the sprite could be in states 3 through 6. If the goal wakes up while detecting tiles, the goal's internal state will keep this information from the tile detection, and use that as its new goal state.
By waking the goal up while it detects a ceiling, the jump table is indexed out of bounds, which begins executing code at $5A5. It's most certainly TAS only, but from there I can write jumps and branches to enemy X positions where I write JSR $8FE3 and win the game.
----------------
What's the deal with the koopa in slot 2?
There are 8 sprite slots, and a large list of variables that these sprites can use, such as their ID, Internal Timers, and other variables. Some of these are only intended for certain sprite slots, so there might be only 5 bytes allocated for these variables instead of 8. There isn't any space between these tables, so a sprite in slot 7 utilizing a table with only 5 entries will bleed into the table after it.
In the video, address $6AC is the wiggle timer of slot 2, but I'm using it as the wake up timer for slot 7, since the table for wake up timers is only 5 entries long. This lets me wake up the goal any number of frames after I set it into state 3, which lets me time the wake up to a frame while it detects a ceiling.
----------------
What's the code that kicks slot 7?
Using the X and Y positions of the "point bubbles" I write: (using southbird's disassembly's name for variables)
LDA Pad_Holding (zero page)
STA Player_Suit (zero page)
LDA #5
STA $676 (Slot 7 State)
RTS
I ran out of space with the video description to go into detail with that the code does for people who don't program in 6502 Assembly, but for those of you who can follow along, this code should make perfect sense.
----------------
What was that at the end about goal state 2 running ACE?
Okay, so this one is kinda exciting, but also really dumb. So the game is trying to draw fireworks, but the pointer to the fireworks graphics data was never set, and is currently being used for another purpose. Using it as a pointer points to garbage data, and it will keep drawing until it hits a terminator. Now, this drawing routing happens inside the NMI but in bank 26, and it takes so long that a new frame begins, firing another NMI. This happens for many frames, but at the end, it will eventually finish drawing garbage, which is where the problem occurs. at the end of the NMI, the game swaps out the $A000 and $C000 banks to bank 7 and 8, and then we hit RTI. But the RTI is supposed to point back inside the drawing routing from bank 26, but bank 26 isn't loaded anymore, bank 7 is! Depending on where the execution pointer was during the graphics loop inside bank 26, the pointer could land inside an operations arguments, and read those as code instead. That has a good chance of crashing the game, but there's the possibility that it hits a TXS instruction if the RTI takes us to address $B2BF, which destroys the stack pointer, and then hits RTS which will point us to $0000. Now from there you would think you need to be holding start or whatever to make a branch past the majority of the zero page, but get this, (and this is the really cool part) the data on address $0009 happens to write JSR $007A, which skips all the parts that could cause a crash or jump elsewhere, and it just happens to land right before the X position of enemies! All of that without any manipulation with the level timer, or frame perfect button presses! Now, I doubt it would be possible to manipulate the clock-cycle-perfect NMI that lands on the TSX when running RTI, but if it could be manipulated and there's an RTA viable method to kick a bumped block, you could probably see some route changes to the any% run.
----------------
So why does any of this matter?
I could've just won the game inside 7-1, or even with the glitch powerup. Why go through all the effort to kick a block, just for another way to win the game?
It's fun. I like thinking up new ways to break this game, and if by some miracle, any of these outrageous setups could be achieved without prior ACE, then we have a golden ticket to a new speedrun route. I don't know if this will be the one, but my goodness it's so close!
----------------
Here's the bizhawk movie file for the TAS that I show at the end of the video.
drive.google.c...

[@Kosmicd12]

:o super cool, would be incredible if it's possible to get ACE in a world 1 level!

[@100thCoin]

That's the dream, ha!

[@nekogirlsr]

@@100thCoin I need to watch Storster's ACE CW (Credits Warp) video again, there was something about mashing inputs and CWing that way IIRC

[@nekogirlsr]

@@100thCoin kzbin.info/www/bejne/pGqWnHVtZc6XbNk (If links are enabled)

[@100thCoin]

@@nekogirlsr Oh trust me, I've seen that video! I recreated that run a while back in an attempt to shave off a few CPU cycles (with no luck.) It's been a while though, and I've learned more about 6502. I might consider giving it another try. I've strayed away from the DPCM audio bug workaround in my videos, as the goal is to find a new RTA viable ACE, which that bug in particular will never be viable for a human to pull off.

[@KabAudio]

@@100thCoin ahh so is this the inspiration for your DPCM runs? ;)

[@Bobomb1000]

local plumber holds and kicks around the pure embodiment of nothingness and uses it to break the universe again

[@kenoz765]

My head went overflow when processing all that information

[@renakunisaki]

Using the goal to win the game is quite fitting.

[@Patashu]

The universe of ACE methods that only barely don't work without bootstrapping grows by one...

[@robuxyyyyyyyyyy4708]

5:49 That would've been a really cool feature

[@Crafty_Jumper]

What 100th coin sees: Performing ACE What I see: B U T T O N M A S H

[@Titanic4]

That dark colored Koopa @ 10:00 mark looks rather nice.

[@100thCoin]

Yeah, I'm not sure why, but most sprites in the bumped block slots use the same color palette as the player. It certainly looks cool! That's also why the goal has a pink tone when held by the player.

[@KabAudio]

Amazing video man, as always! always looking forward to you finding new ways to break the game :D -kab

[@_polpon]

Interesting video! I like seeing what happens behind the scenes :)

[@mx_seitan2627]

woah this is so cool. Thanks for the great video. The sound effects at 9:15 are 9:35 can also be heard if you softlock in world -1 Famicom Mario Bros. I haven't checked the code but I imagine it has to do with the channel that's used when the sound effect is triggered. In -1, If you wrong warp with fire and kill Bowser, you have a high likelihood of soft locking just before the flag is spawned. If you shoot a fireball or swim exactly at the softlock, you'll trigger the sounds. HappyLee has a video with a good example of 9:15. I have one on my twitch page of 9:35... different games but they sure sound alike.

[@100thCoin]

That's because the audio chip keeps going after the CPU halts! To make the bump sound effect, the audio chip can bend the pitch of the square wave, and it keeps getting pitch shifted because nothing can tell it to stop after the CPU halts. It's a pretty common effect in NES games, after all why not use the abilities of the sound chip? I imagine the same thing happens in your other example.

[@emaaaaax]

This is really cool! You are very underrated, earned a sub!

[@DaveDemers69]

Amazing content has always. Great job

[@fan0]

I know no one cares but I am your 300th subscriber!

[@shadygrove424]

Awesome stuff as usual, thanks for the cool video

[@matthewmccaman4904]

This is super neat! Great video :)

[@Alexs23743]

*U L T R A W I D E - O - V I S I O N* 14:02: Mario has ascended to godhood. 16:10: But our Princess is in another castle! Luckily, Mario can walk right through to it! This looks a LOT like a Super Mario World 1 hacking video. I wonder if it and SMB3 are actually two halves of the same game.

[@scaryice82]

Fascinating stuff!

[@thekantim]

9:15 Ayo, mario maker sound effect?

[@josephD32]

I was going to ask what would happen if you collected the goal to clear the level, but on the way to the right, there was a pit and Mario died. but since it already showed Mario walking straight in mid-air, I think I know.

[@user-pk8kh7lm9l]

Amazing!

[@clonefighter1996]

7:38 the very brief stops to music

[@SwagRum76_]

nice

[@mx_seitan2627]

What's going on with the red 100 that pops up at 11:37 and 13:16?

[@danielsiu929]

So i found the SMB3's pannen? Ty youtube algorithm :o

[@yelir64]

The input file didn't work for me :(

[@100thCoin]

Does it desync somewhere or simply not run at all? It was make with Bizhawk 2.4.3 with the PRG_1 version of the game. Also, make sure you download the entire .bk2 file. They're technically just a .zip with a couple files in it, but you need the full .bk2. I just redownloaded the file and checked; The input file works fine on my end.

[@kales901]

9:18 why does that sound happen durrong a crash???

[@kales901]

9:38 or that one

[@ethanfranzen8684]

What occurs if the goal wakes up in one of the other goal states?

[@100thCoin]

If it wakes up in the "drawing Fireworks" state, the screen becomes flooded with garbage tiles, and then the game crashes. If you're extremely lucky, this crash can be manipulated, and I explain in the description how that could even lead to an easier way to run the ACE, assuming you 're lucky enough. Returning to the map works as intended, but the most interesting ones were highlighted in the video.

[@aya-hl5bk]

Maybe take a look at the channel name, there might possibly be a way to run ACE with coins.

[@100thCoin]

It's unlikely. I mean, collecting coins in a PU would work, as that's the same deal as bumping a block out there. Other than that, most of the methods I've discovered involve taking a jump table out of bounds, and there aren't any jump tables that use the coin counter.

[@aya-hl5bk]

@@100thCoin Ah ok

[@pondorien]

What means ACE?

[@100thCoin]

ACE stands for Arbitrary Code Execution. In this instance, I'm writing code by carefully manipulating bytes in RAM and executing them as code.