Super Mario Bros. 3: Running ACE by jumping in water

In this video, I explain how a glitch powerup state can lead to running arbitrary code when you splash into a pool of water.
I call this video a sequel to the Glitch Item ACE video I made, due to the similarities in how the ACE is being triggered. In the Glitch Item ACE video, the game jumps to a specific routine (PRG_31 $FE99) to handle the jump table, though interestingly enough, for this specific jump table they just wrote the code a second time as opposed to simply running JSR $FE99.
In any case, the end result could be done in any level that has water in it, and is possibly RTA viable if someone were to put in the time to make an easier route. Though rest assured, as I have no way of entering powerup state 8E without additional ACE, this route is in no way faster than simply winning the game inside 7-1.
To figure this out, I wrote a program to write every address this jump table could produce if indexed beyond the intended range. to see the list, check this link here : pastebin.com/M...
Technically, the game is jumping to $1FAD and not $07AD, but due to mirroring, the contents of those regions in RAM are identical, so I simplified it as $07AD in the video.
A copy of the bizhawk movie file can be found here: drive.google.c...

[@DaveDemers69]

Amazing video, had a blast watching

[@100thCoin]

Thanks! I also appreciate you helping me try to find another way to collect Item 83 back when I was routing this out! I'm glad you like the video!

[@tom2722]

Thanks those videos are so interesting !

[@100thCoin]

Thanks! I'm glad you like it!

[@robuxyyyyyyyyyy4708]

Does warping to the end always break it visually?

[@aya-hl5bk]

Coming Soon: How 100th Coin ran ace by waiting on the title screen doing nothing. That would be epic if it actually happened though

[@100thCoin]

You know... I did find a way to crash the game on the title screen by waiting for it to loop after doing a trick I called "RAM Storage". Basically I just reload the title screen while skipping the part that clears RAM, (this is done through ACE in 7-1) and I never looked into why the crash occurs. It's possible that due to the whole "storing RAM" of it all, it could be manipulated, though I'm probably not going to look into it. At least not right now.

[@aya-hl5bk]

@@100thCoin You never cease to amaze me!

[@100thCoin]

@@aya-hl5bk I decided to look into that crash. Due to the odd behavior that Ram Storage provides, when restarting the title screen after idly waiting for it to loop, the IRQ happens with the wrong banks loaded in, very similar to what happens in my 13 frame TAS, but a different bank. This makes an "infinite" loop of BRK instructions, which keep pushing things onto the stack until the IRQ mode is overwritten. Since the IRQ mode was overwritten, the game can now properly reach an RTI instruction, but the data being pulled off the stack isn't supposed to be used as a return address, which ends up executing code from $A836, which leads into an unavoidable game crash.

[@aya-hl5bk]

@@100thCoin So no ACE. Ok

[@masoncamera273]

Smb3 is full of ace glitches

[@onyxhalo441]

You really need more subscribers :D I decided to be one, this is quality content!

[@genblinko589]

1:46 What level is that and/or how do I access that part of the level?

[@100thCoin]

That's world 5 level 2. It's where you end up if you fall all the way down the very large vertical section.

[@genblinko589]

@@100thCoin Thanks! I'll look into that.