[TAS] NES Super Mario Bros. 3 "arbitrary code execution" by Lord_Tom in

[@spaghettiking653]

Old TAS: Clearing the game in 5 minutes This TAS: Making the game badass and flipping gravity and spawning things at will with a console...

[@adventureoflinkmk2]

@CyanCreeper we colouring, grab the crayons!

[@adjuntas0990]

Hahaaa

[@tjthr]

New TAS: literally finishes in a blink of an eye

[@ryansample6016]

This is not a TAS. This is art.

[@hri7566]

It's a work of TArt!

[@mrincodi]

Seriously, it is.

[@blayeg8716]

Hri7566 mm tart

[@uraldamasis6887]

Why can't it be both?

[@nameisChannelID]

Oh, TARter Sauce...

[@MWSin1]

"I think I broke Mario." "What button did you push?" "All of them. Very fast."

[@zanefell469]

when you glitch your character by just playing the game

[@XanthinZarda]

I just witnessed a magical thing. I thought Mario 3 couldn't be more broken, and yet...here it is.

[@fders938]

Ikr and i thought super mario world was the most broken of the 2d sidescrollers

[@nutin123a]

It's just a hack to glich the game

[@azestical6566]

XanthinZarda then they beat the game before the game even started

[@luisangelcastillo289]

@Binary Code salty

[@alfiegordon9013]

@@luisangelcastillo289 how are they being salty?

[@renakunisaki]

It's really amazing that they're able to not just take over the game program, but actually patch their own subroutine in and then resume the game as normal while retaining control.

[@johnwest6690]

Rena Kunisaki What is your steam?

[@jenbooob]

If you watch the controller input visuals at the bottom, thats probably how they're managing to do all that.

[@LeBabol]

that profile picture 💀💀💀

[@sharpfang]

"I reject your reality and substitute it with my own."

[@master_matthew]

Dude, Nice! Dungeon Master!

[@donovanmahan2901]

Literally.

[@calciferblack2409]

sharpfang Those eyes... Whose are they?

[@RandomFluff]

my religion teacher told me that quote. nice reference!

[@kostb4238]

@@master_matthew What? No, Mythbusters! What the Hell is Dungeon Master?

[@chedruid]

Imagine a kid playing like this in "Nintendo World Championship" back in the '90! Would watch 11/10.

[@BlazeHN]

They would burn him for witchery for sure.

[@hiimemily]

The Wizard would have been a much better movie, that's for sure.

[@miwunni]

it's TAS only, you need two controlers mashing in super speed

[@renewings]

@@miwunni thank you for explaining the joke

[@oeo.2024]

@@miwunni r/whoooosh or whatever idc anymore

[@AlephNullHFTF]

I wish Shigeru actually put the backdoor in.

[@MaskedChaos]

Aleph Null what do you mean?

[@skylan031]

@@MaskedChaos he mean the secret console. that teleports you to codes.

[@jmonster7186]

manlego031 ?

[@Titanic4]

If that console could exist, how could be possible to input something into it? NES does not have proper keyboard accessory, which would allow that to happen.

[@randomgaming6436]

@@Titanic4 Plenty of classic games similar to Mario had on-screen keyboards.

[@literallylegendary]

3:09 the moment everything happens... those two controllers be giving a 16-bit stream of straight-up 6502 assembly

[@tomypower4898]

Yes drugs yes alcohol yes victims

[@thepikachugamer]

Check out my new IDE guys

[@thatviewer-4142]

@@thepikachugamer "What IDE?" You're holding half of it. "This controller?" Mash them buttons as fast as you can, and I'll mash mine, and just watch.

[@colderosion]

Most of you probably didn't even realize how much more amazing this video is with the subtitles turned on.

[@AccountInactive]

Oh shit thank you

[@therealzhenplaz200]

very helpful thanks

[@DPantherful1]

"WE COLORING, GRAB THE CRAYONS" Can't even watch the rest of the video, I'm dying over here rofl!

[@jaimesolaybar1256]

xd

[@dwaynethecumjohnson3911]

This aged well

[@keithivey627]

dwayne the cum johnson yes 2020 is very different then 2016

[@chaos_omega]

@@keithivey627 Man, you should see 1916!

[@dionwalton6963]

I died when it said "Sudo draw-a-dinasaur".

[@n_3719]

"sudo" didn't exist in 1990.

[@LiEnby]

Khoi Sousa its still funny AF. . .

[@zlnmestone737]

Dion Walton I

[@humbertoquackenbush3932]

*WE COLORIN’, BUST OUT THE CRAYONS!*

[@zaphod77]

@@n_3719 actually, it did. :) su and sudo were first made in the 80s.

[@jenbooob]

I love how the controller inputs go nuts at one point. ACE at its finest

[@vincenzofranchelli2201]

at many points

[@koopakape]

I'd love to have been the kid in like 1990 who somehow did juuuuuust the right insane button presses somehow fast enough at the right place to make this kinda thing happen. Next-level cheat codes; just make the game behave however you want with jazz hands and an imagination!

[@renakunisaki]

Only takes about 28000 frame-perfect inputs in a row, on two controllers, sometimes pressing opposite/all 4 directions. Still easier than Battletoads.

[@leomadero562]

on the bottom it shows the exact combinations

[@faragaroruga3229]

hip indeed Ugh, you can't even imput codes while mashing in GTA, i'd think it would be pretty impossible with all the imputs shown right here.

[@fractalgem]

this is how you do it if you want to do it yourself: kzbin.info/www/bejne/nnOZloxtaNh_jJI

[@linguicaguy]

@@fractalgem Was definitely expecting a rick roll lol

[@browsertab]

That moment when Mario becomes The One.

[@15silverblade]

If you watch carefully you realize that at 0:17 he finds something that is not an common item... Probably was the red pill.

[@vuurniacsquarewave5091]

Normally this would be very hard to do with an NES game because the NES has 2kB of RAM, and most games make use of all of it or close to all of it. SMB3 however has an extra 8kB of RAM inside the cartridge which is used to store the level maps because they have breakable blocks, so the maps can't stay in ROM, which is static.

[@adienthebee]

VuurniacSquarewave Neat! What will happen if you overload the storage with coding?

[@LiEnby]

AidenMaiden 2004 you can't write anything more to it.

[@kargaroc386]

The ROM chips in the cartridge have the data encoded as physical wires, so its impossible to write to them without actually changing the chips themselves. You can stream data into RAM though, in this case from the controller which is what this TAS does. Every disk based console does this too, though from an optical disk instead of from the controller port.

[@TaiFerret]

The level data is also heavily compressed in ROM because it's a lot of data. The data gets decompressed into RAM.

[@rachelrpl]

ROM files are 40K, so technically the NES has 40k, the VIC-20 has 5K, 2K used by the system, and that doesn't support sprites and is very limited unlike the NES.

[@ryanruff13]

There's something surreal about seeing 3:39-4:04 and knowing that all of that is still taking place in the Super Mario Bros. 3 cartridge.

[@fivetales2672]

if im not mistaken then SMB3 is canonically a show like you may whitness in a theatre so this whole TAS was mario changing the script and having fun doing so.

[@doomikusz]

This is the best TAS I've ever seen and I follow regularly. Thanks!

[@schalasmagic]

Wow.This is mind blowing and incredible. I think that I've watched this at least 10 times, and I never get tired of it.

[@seronymus]

same

[@adjuntas0990]

SaMe

[@kayden2975]

Breaking news: World 7 closed for various cases of breaking reality

[@Icesan4096]

So Lord Tom can write a paint program, level select, and a new Mario powerup in an NES game. Pretty cool.

[@dsproductions19]

I watched this several times, and I never noticed that the "Color a Dinosaur" part was actually running a paint-like program (I thought it was like a hard-coded cutscene, or something).

[@Dextergec413]

"What's he doing?" "He's beginning to believe"

[@TheSuckerOfTheWorld]

This is legit? WTF? How must that have gone down? "I'm bored.... Let's play Super Mario Bros. 3 and heavily reprogram it from INSIDE THE GAME! With a console and everything. Let's add elements from Super Metroid and stuff! YEAH!!"

[@LordTom77]

+TheSuckerOfTheWorld That's pretty much how it happened. :D

[@TheSuckerOfTheWorld]

+Lord Tom I applaud you, this was really great to watch :)

[@LordTom77]

+TheSuckerOfTheWorld Thanks, glad you liked it!

[@TheSuckerOfTheWorld]

+Lord Tom In the Author's comments in the video you state that the shinespark works in 5 directions. Why didn't you go the full 8 directions? To save coding time?

[@LordTom77]

+TheSuckerOfTheWorld I thought that was how the Super Metroid one worked; can you do one downward in SM? All 8 wouldn't have been more work particularly.

[@omerresnikoff3565]

"What OS do you have?" My family: Windows 10 My friends: Linux Me: sUpEr MarIo BrOS 3

[@x2fi]

i use Windows 7

[@fuseegelee]

@@x2finobody asked

[@Anixlo-h4m]

​@@fuseegeleewho asked you to say a useless meme.

[@fuseegelee]

@@Anixlo-h4m wasn’t a meme.

[@Anixlo-h4m]

@@fuseegelee oh you're serious sorry

[@TempestWay]

The Game Give Up!

[@DragonMals]

Hi

[@JohnSmith-dy6sb]

This TAS is just literally ridiculous in so many ways. The "color-a-dinosaur" is literally a work of art for NES programming. Also, changing the pattern banks is so LOL. I didn't even know NES Mario 3 even had Speed Booster mechanics from Super Metroid for executing this arbitrary code. It may have also predated said game as well. There's also this "ShellShield" which may just be an early mockup of the actual Shell Shield from Paper Mario: The Thousand-Year Door for that matter, but these debug features can also allow you to shift between forms. Those messed up auto-scrolls really do put things out of place. And of course, you can also disable them too! Last but not least, Bowser taking over 30 fireball hits? He would be toast instead with one Koopa shell! This apparently did predate a very similar feature included in the limited-time battle royale game Super Mario Bros. 35, or did it? And also, I noticed that the life counter jumped straight to 99 at the end of the TAS.

[@RetroArcadeGuy]

Just look at the small amout of data sent when mario shoots that final hammer towards the shell. Like "Oh yeah, I forgot, 99 lives!"

[@legionmammal9785]

Lol, look at the input when it's inserting the actual code :P

[@3lH4ck3rC0mf0r7]

It flips out in JUST the correct way.

[@Ender_Onryo]

I really like the implementation of the VVVVVV movement system

[@PhoenixClank]

I love how the button input symbols flicker like disco lights whenever arbitrary code is programmed!

[@portalfreak7628]

3:20 Eeeeeeeeeeh you're only off by about 12 years Shiggy.

[@randomguyontheinternet7940]

Honestly I wish games still had this type of stuff in them. Too bad the internet would ruin it now. I never knew about this untill today. And thats how it should be. But now everything is found like in a week or few days of release

[@terminalcreature1560]

Wait, 12 or 22 years? Or was it found 10 years before this upload?

[@retroedit_]

Well the Shigeru Miyamoto stuff was a joke; that screen was entirely programmed by the TAS creator. There's no "real" debug screen, just whatever the TAS creator can program into the game using the game's inputs.

[@randomguyontheinternet7940]

@@retroedit_ Was Color a Dinosaur real though?

[@retroedit_]

@@randomguyontheinternet7940 I mean, sort of? It wasn't in the original game, but the way the TAS works, it basically recreated Color a Dinosaur within the game.

[@blanketfortressofsolitude5270]

This was like watching inter-dimensional cable.

[@diamondflummox6246]

I like how you see the controllers going nuts when righting code for the RAM.

[@dekogo]

4:22 The last Metroid is in captivity, the galaxy is at peace

[@mistercookboom1899]

Who gave mario the speed boots?

[@TiggerTheTiger112]

its crazy how moving some koopa shells around and pressing buttons can let you colour a dinosaur

[@Bitzy]

5:24 Mario had ascended into a higher state of being that our puny human minds could never understand.

[@UniqueYui]

I never thought a mario game could be so messed up without game genie codes or rom hacks

[@a1d3n_isme]

>Does some random things >Breaks everything >Becomes God >Beats the game >Doesn't elaborate further >🗿

[@angryladgd]

2:12 this is when the madness starts

[@xchronox0]

by Lord To[...], because by Lord Tom would've been too long to fit.

[@blobthecloud7]

i love how the captions describe everything, like how it works, and even talks about the cool stuff with the arbitrary code execution :)

[@invalid_user_handle]

Basically, if you can reroute execution to something easy to manipulate, such as controller input, you can pretty much do anything you want.

[@brasscojones4291]

The true power of Speedrunner Mario.

[@jeremyryannoel]

Deep down, I really hoped Miyamoto purposely inserted the backdoor.

[@DanielTheRobot]

Shinespark confirmed 4:26

[@wakyzaky2012]

8:26 well that was certain, i was watching this on april fool's day

[@DrewPicklesTheDark]

When you adds Metroid's speed booster and Megaman's leaf shield as power ups to Mario.

[@TinDinoGamer]

I didn't know we were playing Geometry Dash...7:37

[@Coaster42]

Congratulations, my second favorite TAS video

[@prexot2341]

What's the first? Watch for Rolling Rocks or something?

[@johnwest6690]

CoasterKing love the pp

[@ksubswithnovideos-us7bn]

CoasterKing what’s your first favorite then

[@LedYouAshtray]

4:16 Mario over here using the speed booster and shine spark

[@Meepy27]

is nobody gonna mention the sheer amount of inputs during most sections where mario isnt moving? thats NUTS.

[@tg1304]

5:37 Turn on your subtitles! "Hey! That's not what the leaf does!"

[@SwagGamer9750]

4:47 Hello, Sonic the Hedgehog called, he wants his Super Sonic form back.

[@ConcreteObelisk]

i didn't know Mario was a better sorceror than Gandalf and Dumbledore combined.

[@stevenpavelish6017]

The Back Door thing is awesome!

[@Twenteeeee]

Oldest form of homebrewing

[@ImXyper]

*hits controller with hammer multiple times* lord tom : *perfect.*

[@real_bonfire]

This video makes way more sense with the captions lol

[@monotonedmika17]

holy frick the inputs on those two controllers during the code execution.

[@godwin972]

I've watched multiple videos about this kind of stuff, and I still don't know how they do it.

[@3lH4ck3rC0mf0r7]

They take advantage of very precise frame and pixel perfect automated gameplay that allows them to write the console's random access memory exactly the way they want to through gameplay. Then, their final glitch before the console goes completely nuts allows them to run what they've written by playing the game as if it were actual processor (computer) binary language. This bit of code starts listening for controller inputs and treating them as new applications to run. Those random controller presses you see displayed in the lower left corner are not random. They are telling the console what to run next. They still have the cartridge on, so they can also call real game functions and elements through their glitch as well. It's insane.

[@3lH4ck3rC0mf0r7]

This is possible because RAM memory is just a reeeeaaalllly large string full of data, and old games have no error-handling. This can be exploited to force the console to read pieces of data in the wrong format. Imagine... A computer trying to play a picture as if it were audio (I'm sure you can't, it's not really easy lol). In this case, it reads sprite/gameplay data as if it were code. But unlike the previous picture example, where it'd just actually play a lot of cybernetic computery noise and blow your eardrums, the gameplay data here has been cleverly manipulated to be actually fucking meaningful. This makes it mesmerizing to see in action.

[@3lH4ck3rC0mf0r7]

tl;dr They reprogram the game while it is running by playing through it with juuuusst the perfectly right set of controller keypresses.

[@ThrowedGenji]

@@3lH4ck3rC0mf0r7 yeah its insane to think for someone like me who dosnt know coding but I kind of get it because with the cartridge its not like the levels are already made on the cartridge right, its just the string of data and then when played it gets told what to show n how to play. They take this way too far though wow

[@zoltano_cortez]

5:21 the prophecy has been fulfilled, glitched llama Mario has come to save us all 😭

[@TheBlackScatPack]

This TAS reminds me of the episode of Ed, Edd, n Eddy when the Ed’s break reality 😂😂

[@YTDeepshock]

The sorcery begins (visibly at least) around 2:30 or so.

[@arfansthename]

"WE COLORING, GRAB THE CRAYONS!" Did Miyamoto wrote that?

[@ElephantMariotheRHDNhater3293]

Mario on steroids! Did he play some Megaman X before this adventure!?!

[@zushi3493]

Nothing too crazy. This happens to me all the time.

[@Icesan4096]

Same. *uses a Shell Shield*

[@autumn_basil]

As a Metroid fan that speed boost was holy crap

[@azriperisiben4]

4:20 moment mario become the one

[@alphabetsoup8628]

I have no idea what happened in this video but it was amazing

[@BasFish14]

He’s not cheating He just has a good gaming chair

[@luigimario6354]

This TAS scares me and fascinates me

[@kbhasi]

When I first watched this, I couldn't believe it was actually being emulated. I thought someone had just animated it! Clearly, I didn't see the rapid button inputs in the bottom left as I didn't realise the 6502 code execution pointer had jumped to the memory address of the controllers. This was clearly before I had discovered 'Retro Game Mechanics Explained', and before subtitles were added to this video. Also, I never knew the NES ran on Unix. (joking) (7:53) Hmm yes Mario just casually sliding through a wall.

[@OfficialChavis97]

I hope we see more of these arbitrary code executions down the road.

[@Wapako]

Me: Nice, some Super Mario 3 gameplay! Me: *Seeing the drawing of a dinosaur* Me: Wel that was an attempt!

[@fourtrifiveo4350]

ah yes, my favorite tasser *Lord To[...]*

[@romajimamulo]

So, AGDQ run, but ending it instead of handing it off to a human?

[@LordTom77]

+Romaji Correct, the Mitch hand-off was just for AGDQ

[@Pokechu22]

+khanglegos You could end playback of the input file in either of the levels (shine spark or shell shield) and mess around with it.

[@skyeschlueter9877]

You know, it's been awhile since i laughed so hard that I started crying. It's a nice change of pace.

[@skyeschlueter9877]

I actually lost it when Mario started Shinesparking.

[@Gernou5]

bro its literally what inspired peppino's moveset in pizza tower (talking about 4:22)

[@Sasha_K29]

So this is what inspired the creators of Pizza Tower

[@Youtuber-xi6qo]

Evolution of yoshi 1988 - 2019

[@ruler_of_everything]

you've seen the moonwalk but now get ready for the backwards jump

[@lZeroTwol]

The truth.... when I saw it in the Awesome Games Done Quick 2016 it was a masterpiece

[@user-TheTrueGibly]

3:36 For one frame you can see the message "Thank you Carrie, Geoffy, Abby and Sammy!"

[@Lover117-v6l]

Wow!

[@xhalved]

2:40 This normally named "Wrong Warp into Princess`s Room"

[@Kowalth]

Very convenient IRL.

[@cyanisnicelol]

But it wrong warped... Somwhere

[@Alaskaxp2]

The buttons have a mind of their own

[@mr.whimsic6902]

I would like to see this verified on a real console, if possible.

[@artman40]

By the way, this run is console-verified.

[@AwsomeGamerDude233]

Did you look at the controller inputs?

[@artman40]

Mkoijn3 Yes. So do you mean human-powered console verification?

[@AwsomeGamerDude233]

artman40 It isn't possible to press those buttons that fast.

[@mr.whimsic6902]

artman40 noo, i mean i wanted this to see played out on a real NES. :P no ACE runs have done this yet.

[@birdweon]

“reality can be whatever i want it to be”

[@wakkowarner5357]

color a dragon any%

[@its_4life]

Miyamoto: someone will find this in 1994. Video's release date: 2016

[@MrXabungle]

*cue Blueglass losing his shit over every single person in the crowd*

[@itachixmaster]

wow this is awesome :D great job tom!

[@mega_micro]

7:35 Wait a minute... **Positive Force starts playing**

[@CutmanResumenes]

Mario Special Movements: Jackson of the future: clears the level backwards Glitch: Can do the glitch Color a Dinosaur: Replaces his adventure with a dinosaur Clone summon: Summons some clones Clone Vanish: Splits the clones Speed Float: Runs with no gravity Fly Roll: Can fly away Frog Swim: Flies fine Fly Speed: Speed float and fly roll fusion Stone Frog: Turns into a frog of stone Phy Mario: Can make float some objects Glitch Hammer: Throws a hammer with trash graphics Trashario: Turns into a glitched piranha plant Piranhario Plantos: Turns into a piranha plants invisiblario: Comes Invisible THE LUCKY RETURN: Revives with a big jump Summons Objects: I dont wanna give this a description Flies by: FLIES BY SLJ: Super Long Jump Turn gravity: TURN GRAVITY

[@edward9487]

*Cue "What if I told you" memes*

[@volkanik3070]

5:34 I love how it collects the leaf as tanooki and turns into small mario

[@SqweegeeYT]

Hey! That’s not what the leaf does!

[@ArthurTheEagle]

It's Mario Galaxy for the NES 7:28

[@mr.s4ndman]

This is the craziest thing I've ever seen in a Mario Bros game

[@JustinHallPlus]

I wish I was a fraction as good at assembly programming as you guys. Any advice on how to get better?

[@superpancakebros.8962]

ITS A TAS DUMMY

[@superpancakebros.8962]

I reported you. JK

[@superpancakebros.8962]

Nevermind

[@vuurniacsquarewave5091]

ASM for old processors is fun! But for modern ones it can be your death sentence... start out with something simple... just make something that can play different sounds based on button presses or something like that. Maybe put something on the screen!

[@noodlesplash1295]

3:50 creepy yoshi