[TAS] NES Super Mario Bros. 3 "arbitrary code execution" by Lord_Tom in

[@spaghettiking653]

Old TAS: Clearing the game in 5 minutes This TAS: Making the game badass and flipping gravity and spawning things at will with a console...

[@adventureoflinkmk2]

@CyanCreeper we colouring, grab the crayons!

[@adjuntas0990]

Hahaaa

[@tjthr]

New TAS: literally finishes in a blink of an eye

[@MWSin1]

"I think I broke Mario." "What button did you push?" "All of them. Very fast."

[@zanefell469]

when you glitch your character by just playing the game

[@ryansample6016]

This is not a TAS. This is art.

[@hri7566]

It's a work of TArt!

[@mrincodi]

Seriously, it is.

[@blayeg8716]

Hri7566 mm tart

[@uraldamasis6887]

Why can't it be both?

[@nameisChannelID]

Oh, TARter Sauce...

[@sharpfang]

"I reject your reality and substitute it with my own."

[@master_matthew]

Dude, Nice! Dungeon Master!

[@donovanmahan2901]

Literally.

[@calciferblack2409]

sharpfang Those eyes... Whose are they?

[@RandomFluff]

my religion teacher told me that quote. nice reference!

[@kostb4238]

@@master_matthew What? No, Mythbusters! What the Hell is Dungeon Master?

[@renakunisaki]

It's really amazing that they're able to not just take over the game program, but actually patch their own subroutine in and then resume the game as normal while retaining control.

[@johnwest6690]

Rena Kunisaki What is your steam?

[@jenbooob]

If you watch the controller input visuals at the bottom, thats probably how they're managing to do all that.

[@LeBabol]

that profile picture 💀💀💀

[@AlephNullHFTF]

I wish Shigeru actually put the backdoor in.

[@MaskedChaos]

Aleph Null what do you mean?

[@skylan031]

@@MaskedChaos he mean the secret console. that teleports you to codes.

[@jmonster7186]

manlego031 ?

[@Titanic4]

If that console could exist, how could be possible to input something into it? NES does not have proper keyboard accessory, which would allow that to happen.

[@randomgaming6436]

@@Titanic4 Plenty of classic games similar to Mario had on-screen keyboards.

[@XanthinZarda]

I just witnessed a magical thing. I thought Mario 3 couldn't be more broken, and yet...here it is.

[@fders938]

Ikr and i thought super mario world was the most broken of the 2d sidescrollers

[@nutin123a]

It's just a hack to glich the game

[@azestical6566]

XanthinZarda then they beat the game before the game even started

[@luisangelcastillo289]

@Binary Code salty

[@alfiegordon9013]

@@luisangelcastillo289 how are they being salty?

[@literallylegendary]

3:09 the moment everything happens... those two controllers be giving a 16-bit stream of straight-up 6502 assembly

[@tomypower4898]

Yes drugs yes alcohol yes victims

[@thepikachugamer]

Check out my new IDE guys

[@thatviewer-4142]

@@thepikachugamer "What IDE?" You're holding half of it. "This controller?" Mash them buttons as fast as you can, and I'll mash mine, and just watch.

[@dionwalton6963]

I died when it said "Sudo draw-a-dinasaur".

[@n_3719]

"sudo" didn't exist in 1990.

[@LiEnby]

Khoi Sousa its still funny AF. . .

[@zlnmestone737]

Dion Walton I

[@humbertoquackenbush3932]

*WE COLORIN’, BUST OUT THE CRAYONS!*

[@zaphod77]

@@n_3719 actually, it did. :) su and sudo were first made in the 80s.

[@chedruid]

Imagine a kid playing like this in "Nintendo World Championship" back in the '90! Would watch 11/10.

[@BlazeHN]

They would burn him for witchery for sure.

[@hiimemily]

The Wizard would have been a much better movie, that's for sure.

[@miwunni]

it's TAS only, you need two controlers mashing in super speed

[@renewings]

@@miwunni thank you for explaining the joke

[@oeo.2024]

@@miwunni r/whoooosh or whatever idc anymore

[@colderosion]

Most of you probably didn't even realize how much more amazing this video is with the subtitles turned on.

[@AccountInactive]

Oh shit thank you

[@therealzhenplaz200]

very helpful thanks

[@browsertab]

That moment when Mario becomes The One.

[@15silverblade]

If you watch carefully you realize that at 0:17 he finds something that is not an common item... Probably was the red pill.

[@jenbooob]

I love how the controller inputs go nuts at one point. ACE at its finest

[@vincenzofranchelli2201]

at many points

[@DPantherful1]

"WE COLORING, GRAB THE CRAYONS" Can't even watch the rest of the video, I'm dying over here rofl!

[@jaimesolaybar1256]

xd

[@dwaynethecumjohnson3911]

This aged well

[@keithivey627]

dwayne the cum johnson yes 2020 is very different then 2016

[@chaos_omega]

@@keithivey627 Man, you should see 1916!

[@koopakape]

I'd love to have been the kid in like 1990 who somehow did juuuuuust the right insane button presses somehow fast enough at the right place to make this kinda thing happen. Next-level cheat codes; just make the game behave however you want with jazz hands and an imagination!

[@renakunisaki]

Only takes about 28000 frame-perfect inputs in a row, on two controllers, sometimes pressing opposite/all 4 directions. Still easier than Battletoads.

[@leomadero562]

on the bottom it shows the exact combinations

[@faragaroruga3229]

hip indeed Ugh, you can't even imput codes while mashing in GTA, i'd think it would be pretty impossible with all the imputs shown right here.

[@fractalgem]

this is how you do it if you want to do it yourself: kzbin.info/www/bejne/nnOZloxtaNh_jJI

[@linguicaguy]

@@fractalgem Was definitely expecting a rick roll lol

[@vuurniacsquarewave5091]

Normally this would be very hard to do with an NES game because the NES has 2kB of RAM, and most games make use of all of it or close to all of it. SMB3 however has an extra 8kB of RAM inside the cartridge which is used to store the level maps because they have breakable blocks, so the maps can't stay in ROM, which is static.

[@adienthebee]

VuurniacSquarewave Neat! What will happen if you overload the storage with coding?

[@LiEnby]

AidenMaiden 2004 you can't write anything more to it.

[@kargaroc386]

The ROM chips in the cartridge have the data encoded as physical wires, so its impossible to write to them without actually changing the chips themselves. You can stream data into RAM though, in this case from the controller which is what this TAS does. Every disk based console does this too, though from an optical disk instead of from the controller port.

[@TaiFerret]

The level data is also heavily compressed in ROM because it's a lot of data. The data gets decompressed into RAM.

[@rachelrpl]

ROM files are 40K, so technically the NES has 40k, the VIC-20 has 5K, 2K used by the system, and that doesn't support sprites and is very limited unlike the NES.

[@fivetales2672]

if im not mistaken then SMB3 is canonically a show like you may whitness in a theatre so this whole TAS was mario changing the script and having fun doing so.

[@ryanruff13]

There's something surreal about seeing 3:39-4:04 and knowing that all of that is still taking place in the Super Mario Bros. 3 cartridge.

[@doomikusz]

This is the best TAS I've ever seen and I follow regularly. Thanks!

[@Dextergec413]

"What's he doing?" "He's beginning to believe"

[@kayden2975]

Breaking news: World 7 closed for various cases of breaking reality

[@TempestWay]

The Game Give Up!

[@DragonMals]

Hi

[@Icesan4096]

So Lord Tom can write a paint program, level select, and a new Mario powerup in an NES game. Pretty cool.

[@JohnSmith-dy6sb]

This TAS is just literally ridiculous in so many ways. The "color-a-dinosaur" is literally a work of art for NES programming. Also, changing the pattern banks is so LOL. I didn't even know NES Mario 3 even had Speed Booster mechanics from Super Metroid for executing this arbitrary code. It may have also predated said game as well. There's also this "ShellShield" which may just be an early mockup of the actual Shell Shield from Paper Mario: The Thousand-Year Door for that matter, but these debug features can also allow you to shift between forms. Those messed up auto-scrolls really do put things out of place. And of course, you can also disable them too! Last but not least, Bowser taking over 30 fireball hits? He would be toast instead with one Koopa shell! This apparently did predate a very similar feature included in the limited-time battle royale game Super Mario Bros. 35, or did it? And also, I noticed that the life counter jumped straight to 99 at the end of the TAS.

[@RetroArcadeGuy]

Just look at the small amout of data sent when mario shoots that final hammer towards the shell. Like "Oh yeah, I forgot, 99 lives!"

[@dsproductions19]

I watched this several times, and I never noticed that the "Color a Dinosaur" part was actually running a paint-like program (I thought it was like a hard-coded cutscene, or something).

[@a1d3n_isme]

>Does some random things >Breaks everything >Becomes God >Beats the game >Doesn't elaborate further >🗿

[@schalasmagic]

Wow.This is mind blowing and incredible. I think that I've watched this at least 10 times, and I never get tired of it.

[@seronymus]

same

[@adjuntas0990]

SaMe

[@omerresnikoff3565]

"What OS do you have?" My family: Windows 10 My friends: Linux Me: sUpEr MarIo BrOS 3

[@x2fi]

i use Windows 7

[@fuseegelee]

@@x2finobody asked

[@Anixlo-h4m]

​@@fuseegeleewho asked you to say a useless meme.

[@fuseegelee]

@@Anixlo-h4m wasn’t a meme.

[@Anixlo-h4m]

@@fuseegelee oh you're serious sorry

[@Ender_Onryo]

I really like the implementation of the VVVVVV movement system

[@legionmammal9785]

Lol, look at the input when it's inserting the actual code :P

[@3lH4ck3rC0mf0r7]

It flips out in JUST the correct way.

[@PhoenixClank]

I love how the button input symbols flicker like disco lights whenever arbitrary code is programmed!

[@blanketfortressofsolitude5270]

This was like watching inter-dimensional cable.

[@TheSuckerOfTheWorld]

This is legit? WTF? How must that have gone down? "I'm bored.... Let's play Super Mario Bros. 3 and heavily reprogram it from INSIDE THE GAME! With a console and everything. Let's add elements from Super Metroid and stuff! YEAH!!"

[@LordTom77]

+TheSuckerOfTheWorld That's pretty much how it happened. :D

[@TheSuckerOfTheWorld]

+Lord Tom I applaud you, this was really great to watch :)

[@LordTom77]

+TheSuckerOfTheWorld Thanks, glad you liked it!

[@TheSuckerOfTheWorld]

+Lord Tom In the Author's comments in the video you state that the shinespark works in 5 directions. Why didn't you go the full 8 directions? To save coding time?

[@LordTom77]

+TheSuckerOfTheWorld I thought that was how the Super Metroid one worked; can you do one downward in SM? All 8 wouldn't have been more work particularly.

[@portalfreak7628]

3:20 Eeeeeeeeeeh you're only off by about 12 years Shiggy.

[@randomguyontheinternet7940]

Honestly I wish games still had this type of stuff in them. Too bad the internet would ruin it now. I never knew about this untill today. And thats how it should be. But now everything is found like in a week or few days of release

[@terminalcreature1560]

Wait, 12 or 22 years? Or was it found 10 years before this upload?

[@retroedit_]

Well the Shigeru Miyamoto stuff was a joke; that screen was entirely programmed by the TAS creator. There's no "real" debug screen, just whatever the TAS creator can program into the game using the game's inputs.

[@randomguyontheinternet7940]

@@retroedit_ Was Color a Dinosaur real though?

[@retroedit_]

@@randomguyontheinternet7940 I mean, sort of? It wasn't in the original game, but the way the TAS works, it basically recreated Color a Dinosaur within the game.

[@Bitzy]

5:24 Mario had ascended into a higher state of being that our puny human minds could never understand.

[@brasscojones4291]

The true power of Speedrunner Mario.

[@invalid_user_handle]

Basically, if you can reroute execution to something easy to manipulate, such as controller input, you can pretty much do anything you want.

[@diamondflummox6246]

I like how you see the controllers going nuts when righting code for the RAM.

[@angryladgd]

2:12 this is when the madness starts

[@blobthecloud7]

i love how the captions describe everything, like how it works, and even talks about the cool stuff with the arbitrary code execution :)

[@dekogo]

4:22 The last Metroid is in captivity, the galaxy is at peace

[@mistercookboom1899]

Who gave mario the speed boots?

[@xchronox0]

by Lord To[...], because by Lord Tom would've been too long to fit.

[@UniqueYui]

I never thought a mario game could be so messed up without game genie codes or rom hacks

[@TinDinoGamer]

I didn't know we were playing Geometry Dash...7:37

[@jeremyryannoel]

Deep down, I really hoped Miyamoto purposely inserted the backdoor.

[@tg1304]

5:37 Turn on your subtitles! "Hey! That's not what the leaf does!"

[@DanielTheRobot]

Shinespark confirmed 4:26

[@wakyzaky2012]

8:26 well that was certain, i was watching this on april fool's day

[@DrewPicklesTheDark]

When you adds Metroid's speed booster and Megaman's leaf shield as power ups to Mario.

[@TiggerTheTiger112]

its crazy how moving some koopa shells around and pressing buttons can let you colour a dinosaur

[@Coaster42]

Congratulations, my second favorite TAS video

[@prexot2341]

What's the first? Watch for Rolling Rocks or something?

[@johnwest6690]

CoasterKing love the pp

[@ksubswithnovideos-us7bn]

CoasterKing what’s your first favorite then

[@LedYouAshtray]

4:16 Mario over here using the speed booster and shine spark

[@SwagGamer9750]

4:47 Hello, Sonic the Hedgehog called, he wants his Super Sonic form back.

[@bensharpe64]

2:43 mario enters the pipe to hell

[@ConcreteObelisk]

i didn't know Mario was a better sorceror than Gandalf and Dumbledore combined.

[@ImXyper]

*hits controller with hammer multiple times* lord tom : *perfect.*

[@YTDeepshock]

The sorcery begins (visibly at least) around 2:30 or so.

[@Meepy27]

is nobody gonna mention the sheer amount of inputs during most sections where mario isnt moving? thats NUTS.

[@Twenteeeee]

Oldest form of homebrewing

[@stevenpavelish6017]

The Back Door thing is awesome!

[@azriperisiben4]

4:20 moment mario become the one

[@tehdrago]

"who took my super emeralds?" hyper mario: 4:22

[@BasFish14]

He’s not cheating He just has a good gaming chair

[@monotonedmika17]

holy frick the inputs on those two controllers during the code execution.

[@zushi3493]

Nothing too crazy. This happens to me all the time.

[@Icesan4096]

Same. *uses a Shell Shield*

[@luigimario6354]

This TAS scares me and fascinates me

[@arfansthename]

"WE COLORING, GRAB THE CRAYONS!" Did Miyamoto wrote that?

[@InessaMaximova]

I cannot find any info on this aside from TAS videos website. Can someone explain the history aspect of this? 8:30 ah damnit, gg guys

[@real_bonfire]

This video makes way more sense with the captions lol

[@Sasha_K29]

So this is what inspired the creators of Pizza Tower

[@ElephantMariotheRHDNhater3293]

Mario on steroids! Did he play some Megaman X before this adventure!?!

[@user-TheTrueGibly]

3:36 For one frame you can see the message "Thank you Carrie, Geoffy, Abby and Sammy!"

[@Lover117-v6l]

Wow!

[@godwin972]

I've watched multiple videos about this kind of stuff, and I still don't know how they do it.

[@3lH4ck3rC0mf0r7]

They take advantage of very precise frame and pixel perfect automated gameplay that allows them to write the console's random access memory exactly the way they want to through gameplay. Then, their final glitch before the console goes completely nuts allows them to run what they've written by playing the game as if it were actual processor (computer) binary language. This bit of code starts listening for controller inputs and treating them as new applications to run. Those random controller presses you see displayed in the lower left corner are not random. They are telling the console what to run next. They still have the cartridge on, so they can also call real game functions and elements through their glitch as well. It's insane.

[@3lH4ck3rC0mf0r7]

This is possible because RAM memory is just a reeeeaaalllly large string full of data, and old games have no error-handling. This can be exploited to force the console to read pieces of data in the wrong format. Imagine... A computer trying to play a picture as if it were audio (I'm sure you can't, it's not really easy lol). In this case, it reads sprite/gameplay data as if it were code. But unlike the previous picture example, where it'd just actually play a lot of cybernetic computery noise and blow your eardrums, the gameplay data here has been cleverly manipulated to be actually fucking meaningful. This makes it mesmerizing to see in action.

[@3lH4ck3rC0mf0r7]

tl;dr They reprogram the game while it is running by playing through it with juuuusst the perfectly right set of controller keypresses.

[@ThrowedGenji]

@@3lH4ck3rC0mf0r7 yeah its insane to think for someone like me who dosnt know coding but I kind of get it because with the cartridge its not like the levels are already made on the cartridge right, its just the string of data and then when played it gets told what to show n how to play. They take this way too far though wow

[@alphabetsoup8628]

I have no idea what happened in this video but it was amazing

[@kbhasi]

When I first watched this, I couldn't believe it was actually being emulated. I thought someone had just animated it! Clearly, I didn't see the rapid button inputs in the bottom left as I didn't realise the 6502 code execution pointer had jumped to the memory address of the controllers. This was clearly before I had discovered 'Retro Game Mechanics Explained', and before subtitles were added to this video. Also, I never knew the NES ran on Unix. (joking) (7:53) Hmm yes Mario just casually sliding through a wall.

[@brekedekdang39]

So, I have been watching Final Fantasy NES speedruns, and came across a tool-assisted speedrun from this channel. I was searching the channel for a video that I could watch in not so long a time. I also enjoyed SMB3 as a kid, so this video seemed like one I would enjoy. Now, I am watching this, and thinking "WHAT THE HELL IS GOING ON!?!?!" 😂

[@Gernou5]

bro its literally what inspired peppino's moveset in pizza tower (talking about 4:22)

[@ruler_of_everything]

you've seen the moonwalk but now get ready for the backwards jump

[@Youtuber-xi6qo]

Evolution of yoshi 1988 - 2019

[@zoltano_cortez]

5:21 the prophecy has been fulfilled, glitched llama Mario has come to save us all 😭

[@Wapako]

Me: Nice, some Super Mario 3 gameplay! Me: *Seeing the drawing of a dinosaur* Me: Wel that was an attempt!

[@sniper9395]

"The interdimensional toilet!"

[@xhalved]

2:40 This normally named "Wrong Warp into Princess`s Room"

[@Kowalth]

Very convenient IRL.

[@cyanisnicelol]

But it wrong warped... Somwhere

[@itachixmaster]

wow this is awesome :D great job tom!

[@romajimamulo]

So, AGDQ run, but ending it instead of handing it off to a human?

[@LordTom77]

+Romaji Correct, the Mitch hand-off was just for AGDQ

[@Pokechu22]

+khanglegos You could end playback of the input file in either of the levels (shine spark or shell shield) and mess around with it.

[@autumn_basil]

As a Metroid fan that speed boost was holy crap

[@TheBlackScatPack]

This TAS reminds me of the episode of Ed, Edd, n Eddy when the Ed’s break reality 😂😂

[@fourtrifiveo4350]

ah yes, my favorite tasser *Lord To[...]*

[@mega_micro]

7:35 Wait a minute... **Positive Force starts playing**

[@edward9487]

*Cue "What if I told you" memes*

[@ama1212]

Awesome work!!!

[@Apalapan97]

I understand that the effects of the glitch are caused by the X position of the enemies in 7-1, and the code is activated by touching the glitched music note, but what I never saw explained is, what causes the wrong warp itself? It's the act of going down the pipe from that glitched position at 2:44 what causes it?

[@NOT_A_ROBOT]

you clip into the pipe and press down

[@RetroArcadeGuy]

By playing the game normally you're already doing arbitraty code execution with controller inputs but at a user level that it won't harm a normal game play. That and the fact levels do not let you stay long enough to see things going apeshit once things reaches 999999999 or 255, which, takes almost a life time through normal means (see the 256 error in PacMan, or how Yoshi and Mario NEEDS to cross a certain gate to keep the game's balance due to dev's overlook as an example). Only glitches let you get things go apeshit faster. In this case, the wrong warp can result in infinite endings if some part of the code has been touched up already (moving to X location, knocking X enemies in X positions, etc). And since the devs didn't overlook the warps at the pipes, you can glitch through them almost anywhere. Carrying whatever code mentioned above with them with epic proportion results. That means if you can somehow manage to get 28000 lines of code in the brief moment the wrong warp happens, you are literally writting a new game in ram using existing data off the cart. Edit. Didn't check the comment was 4 years old. YOu might know about all this by now. :P

[@joshth647]

The fucking madlad did it

[@wakkowarner5357]

color a dragon any%

[@birdweon]

“reality can be whatever i want it to be”

[@mr.whimsic6902]

I would like to see this verified on a real console, if possible.

[@artman40]

By the way, this run is console-verified.

[@AwsomeGamerDude233]

Did you look at the controller inputs?

[@artman40]

Mkoijn3 Yes. So do you mean human-powered console verification?

[@AwsomeGamerDude233]

artman40 It isn't possible to press those buttons that fast.

[@mr.whimsic6902]

artman40 noo, i mean i wanted this to see played out on a real NES. :P no ACE runs have done this yet.

[@smilenowsmileforever4226]

This is the best of all TAS

[@MrXabungle]

*cue Blueglass losing his shit over every single person in the crowd*

[@OfficialChavis97]

I hope we see more of these arbitrary code executions down the road.

[@clichayed]

6:42 bro did the blj before it was cool