[TAS] NES Super Mario Bros. 3 "arbitrary code execution" by Lord_Tom in

This is a tool-assisted speedrun. For more information, see tasvideos.org/...
TAS originally published on 2016-01-13
Super Mario Bros. 3 is a very famous and popular game for the NES. There are normally two main ways to beat it: the quick way using warp whistles to skip worlds ( tasvideos.org/... ), and the longer way which goes through all the worlds ( tasvideos.org/... ).
Lord_Tom ( tasvideos.org/... ) goes the same route as the this game end glitch run ( tasvideos.org/... ). However, he achieves total control ( en.wikipedia.o... ) of the game, pushing the run to a whole new level. He gives himself new powers, like the speed booster and the suit-swap, to name a few. Read the author's comments for more details ( tasvideos.org/... ).
This run was shown at Awesome Games Done Quick 2016 ( tasvideos.org/... ) during the TAS block. You can see it here ( • TAS Block at AGDQ 2016... )
--------
WARNING: This run includes flashing lights that may trigger epilepsy.
Note: The official encodes for this run include commentary from the author. The second KZbin stream also features input display.
#tas #tasvideos #toolassisted #toolassistedspeedrun #speedrun

[@MWSin1]

"I think I broke Mario." "What button did you push?" "All of them. Very fast."

[@zanefell469]

when you glitch your character by just playing the game

[@spaghettiking653]

Old TAS: Clearing the game in 5 minutes This TAS: Making the game badass and flipping gravity and spawning things at will with a console...

[@adventureoflinkmk2]

@CyanCreeper we colouring, grab the crayons!

[@adjuntas0990]

Hahaaa

[@tjthr]

New TAS: literally finishes in a blink of an eye

[@dionwalton6963]

I died when it said "Sudo draw-a-dinasaur".

[@n_3719]

"sudo" didn't exist in 1990.

[@LiEnby]

Khoi Sousa its still funny AF. . .

[@zlnmestone737]

Dion Walton I

[@humbertoquackenbush3932]

*WE COLORIN’, BUST OUT THE CRAYONS!*

[@zaphod77]

@@n_3719 actually, it did. :) su and sudo were first made in the 80s.

[@sharpfang]

"I reject your reality and substitute it with my own."

[@master_matthew]

Dude, Nice! Dungeon Master!

[@donovanmahan2901]

Literally.

[@calciferblack2409]

sharpfang Those eyes... Whose are they?

[@RandomFluff]

my religion teacher told me that quote. nice reference!

[@kostb4238]

@@master_matthew What? No, Mythbusters! What the Hell is Dungeon Master?

[@ryansample6016]

This is not a TAS. This is art.

[@hri7566]

It's a work of TArt!

[@mrincodi]

Seriously, it is.

[@blayeg8716]

Hri7566 mm tart

[@uraldamasis6887]

Why can't it be both?

[@nameisChannelID]

Oh, TARter Sauce...

[@AlephNullHFTF]

I wish Shigeru actually put the backdoor in.

[@MaskedChaos]

Aleph Null what do you mean?

[@skylan031]

@@MaskedChaos he mean the secret console. that teleports you to codes.

[@jmonster7186]

manlego031 ?

[@Titanic4]

If that console could exist, how could be possible to input something into it? NES does not have proper keyboard accessory, which would allow that to happen.

[@randomgaming6436]

@@Titanic4 Plenty of classic games similar to Mario had on-screen keyboards.

[@XanthinZarda]

I just witnessed a magical thing. I thought Mario 3 couldn't be more broken, and yet...here it is.

[@fders938]

Ikr and i thought super mario world was the most broken of the 2d sidescrollers

[@nutin123a]

It's just a hack to glich the game

[@azestical6566]

XanthinZarda then they beat the game before the game even started

[@luisangelcastillo289]

@Binary Code salty

[@alfiegordon9013]

@@luisangelcastillo289 how are they being salty?

[@renakunisaki]

It's really amazing that they're able to not just take over the game program, but actually patch their own subroutine in and then resume the game as normal while retaining control.

[@johnwest6690]

Rena Kunisaki What is your steam?

[@jenbooob]

If you watch the controller input visuals at the bottom, thats probably how they're managing to do all that.

[@LeBabol]

that profile picture 💀💀💀

[@literallylegendary6594]

3:09 the moment everything happens... those two controllers be giving a 16-bit stream of straight-up 6502 assembly

[@tomypower4898]

Yes drugs yes alcohol yes victims

[@thepikachugamer]

Check out my new IDE guys

[@William-nw4sk]

@@thepikachugamer "What IDE?" You're holding half of it. "This controller?" Mash them buttons as fast as you can, and I'll mash mine, and just watch.

[@chedruid]

Imagine a kid playing like this in "Nintendo World Championship" back in the '90! Would watch 11/10.

[@BlazeHN]

They would burn him for witchery for sure.

[@hiimemily]

The Wizard would have been a much better movie, that's for sure.

[@miwunni]

it's TAS only, you need two controlers mashing in super speed

[@renewings]

@@miwunni thank you for explaining the joke

[@oeo.2024]

@@miwunni r/whoooosh or whatever idc anymore

[@browsertab]

That moment when Mario becomes The One.

[@15silverblade]

If you watch carefully you realize that at 0:17 he finds something that is not an common item... Probably was the red pill.

[@DPantherful1]

"WE COLORING, GRAB THE CRAYONS" Can't even watch the rest of the video, I'm dying over here rofl!

[@jaimesolaybar1256]

xd

[@dwaynethecumjohnson3911]

This aged well

[@keithivey627]

dwayne the cum johnson yes 2020 is very different then 2016

[@chaos_omega]

@@keithivey627 Man, you should see 1916!

[@vuurniacsquarewave5091]

Normally this would be very hard to do with an NES game because the NES has 2kB of RAM, and most games make use of all of it or close to all of it. SMB3 however has an extra 8kB of RAM inside the cartridge which is used to store the level maps because they have breakable blocks, so the maps can't stay in ROM, which is static.

[@adienthebee]

VuurniacSquarewave Neat! What will happen if you overload the storage with coding?

[@LiEnby]

AidenMaiden 2004 you can't write anything more to it.

[@kargaroc386]

The ROM chips in the cartridge have the data encoded as physical wires, so its impossible to write to them without actually changing the chips themselves. You can stream data into RAM though, in this case from the controller which is what this TAS does. Every disk based console does this too, though from an optical disk instead of from the controller port.

[@TaiFerret]

The level data is also heavily compressed in ROM because it's a lot of data. The data gets decompressed into RAM.

[@rachelrpl]

ROM files are 40K, so technically the NES has 40k, the VIC-20 has 5K, 2K used by the system, and that doesn't support sprites and is very limited unlike the NES.

[@colderosion]

Most of you probably didn't even realize how much more amazing this video is with the subtitles turned on.

[@AccountInactive]

Oh shit thank you

[@therealzhenplaz200]

very helpful thanks

[@omerresnikoff3565]

"What OS do you have?" My family: Windows 10 My friends: Linux Me: sUpEr MarIo BrOS 3

[@x2fi]

i use Windows 7

[@fuseegelee]

@@x2finobody asked

[@fivetales2672]

if im not mistaken then SMB3 is canonically a show like you may whitness in a theatre so this whole TAS was mario changing the script and having fun doing so.

[@koopakape]

I'd love to have been the kid in like 1990 who somehow did juuuuuust the right insane button presses somehow fast enough at the right place to make this kinda thing happen. Next-level cheat codes; just make the game behave however you want with jazz hands and an imagination!

[@renakunisaki]

Only takes about 28000 frame-perfect inputs in a row, on two controllers, sometimes pressing opposite/all 4 directions. Still easier than Battletoads.

[@leomadero562]

on the bottom it shows the exact combinations

[@faragaroruga3229]

hip indeed Ugh, you can't even imput codes while mashing in GTA, i'd think it would be pretty impossible with all the imputs shown right here.

[@fractalgem]

this is how you do it if you want to do it yourself: kzbin.info/www/bejne/nnOZloxtaNh_jJI

[@linguicaguy]

@@fractalgem Was definitely expecting a rick roll lol

[@ryanruff13]

There's something surreal about seeing 3:39-4:04 and knowing that all of that is still taking place in the Super Mario Bros. 3 cartridge.

[@TempestWay]

The Game Give Up!

[@DragonMals]

Hi

[@kayden2975]

Breaking news: World 7 closed for various cases of breaking reality

[@jenbooob]

I love how the controller inputs go nuts at one point. ACE at its finest

[@vincenzofranchelli2201]

at many points

[@TheSuckerOfTheWorld]

This is legit? WTF? How must that have gone down? "I'm bored.... Let's play Super Mario Bros. 3 and heavily reprogram it from INSIDE THE GAME! With a console and everything. Let's add elements from Super Metroid and stuff! YEAH!!"

[@LordTom77]

+TheSuckerOfTheWorld That's pretty much how it happened. :D

[@TheSuckerOfTheWorld]

+Lord Tom I applaud you, this was really great to watch :)

[@LordTom77]

+TheSuckerOfTheWorld Thanks, glad you liked it!

[@TheSuckerOfTheWorld]

+Lord Tom In the Author's comments in the video you state that the shinespark works in 5 directions. Why didn't you go the full 8 directions? To save coding time?

[@LordTom77]

+TheSuckerOfTheWorld I thought that was how the Super Metroid one worked; can you do one downward in SM? All 8 wouldn't have been more work particularly.

[@JohnSmith-dy6sb]

This TAS is just literally ridiculous in so many ways. The "color-a-dinosaur" is literally a work of art for NES programming. Also, changing the pattern banks is so LOL. I didn't even know NES Mario 3 even had Speed Booster mechanics from Super Metroid for executing this arbitrary code. It may have also predated said game as well. There's also this "ShellShield" which may just be an early mockup of the actual Shell Shield from Paper Mario: The Thousand-Year Door for that matter, but these debug features can also allow you to shift between forms. Those messed up auto-scrolls really do put things out of place. And of course, you can also disable them too! Last but not least, Bowser taking over 30 fireball hits? He would be toast instead with one Koopa shell! This apparently did predate a very similar feature included in the limited-time battle royale game Super Mario Bros. 35, or did it? And also, I noticed that the life counter jumped straight to 99 at the end of the TAS.

[@RetroArcadeGuy]

Just look at the small amout of data sent when mario shoots that final hammer towards the shell. Like "Oh yeah, I forgot, 99 lives!"

[@legionmammal9785]

Lol, look at the input when it's inserting the actual code :P

[@3lH4ck3rC0mf0r7]

It flips out in JUST the correct way.

[@dsproductions19]

I watched this several times, and I never noticed that the "Color a Dinosaur" part was actually running a paint-like program (I thought it was like a hard-coded cutscene, or something).

[@xchronox0]

by Lord To[...], because by Lord Tom would've been too long to fit.

[@portalfreak7628]

3:20 Eeeeeeeeeeh you're only off by about 12 years Shiggy.

[@randomguyontheinternet7940]

Honestly I wish games still had this type of stuff in them. Too bad the internet would ruin it now. I never knew about this untill today. And thats how it should be. But now everything is found like in a week or few days of release

[@terminalcreature1560]

Wait, 12 or 22 years? Or was it found 10 years before this upload?

[@retroedit_]

Well the Shigeru Miyamoto stuff was a joke; that screen was entirely programmed by the TAS creator. There's no "real" debug screen, just whatever the TAS creator can program into the game using the game's inputs.

[@randomguyontheinternet7940]

@@retroedit_ Was Color a Dinosaur real though?

[@retroedit_]

@@randomguyontheinternet7940 I mean, sort of? It wasn't in the original game, but the way the TAS works, it basically recreated Color a Dinosaur within the game.

[@Dextergec413]

"What's he doing?" "He's beginning to believe"

[@Icesan4096]

So Lord Tom can write a paint program, level select, and a new Mario powerup in an NES game. Pretty cool.

[@generaljimmies3429]

....................................the fuck did I just watch?

[@PhoenixClank]

I love how the button input symbols flicker like disco lights whenever arbitrary code is programmed!

[@GoldenGamerFox7272fromYT]

2:44 for lazy people

[@Ender_Onryo]

I really like the implementation of the VVVVVV movement system

[@zushi3493]

Nothing too crazy. This happens to me all the time.

[@Icesan4096]

Same. *uses a Shell Shield*

[@blanketfortressofsolitude5270]

This was like watching inter-dimensional cable.

[@wakyzaky2012]

8:26 well that was certain, i was watching this on april fool's day

[@wakkowarner5357]

color a dragon any%

[@doomikusz]

This is the best TAS I've ever seen and I follow regularly. Thanks!

[@Bitzy]

5:24 Mario had ascended into a higher state of being that our puny human minds could never understand.

[@romajimamulo]

So, AGDQ run, but ending it instead of handing it off to a human?

[@LordTom77]

+Romaji Correct, the Mitch hand-off was just for AGDQ

[@Pokechu22]

+khanglegos You could end playback of the input file in either of the levels (shine spark or shell shield) and mess around with it.

[@TinDinoGamer]

I didn't know we were playing Geometry Dash...7:37

[@schalasmagic]

Wow.This is mind blowing and incredible. I think that I've watched this at least 10 times, and I never get tired of it.

[@seronymus]

same

[@adjuntas0990]

SaMe

[@TheBlackScatPack]

This TAS reminds me of the episode of Ed, Edd, n Eddy when the Ed’s break reality 😂😂

[@arfansthename]

"WE COLORING, GRAB THE CRAYONS!" Did Miyamoto wrote that?

[@DanielTheRobot]

Shinespark confirmed 4:26

[@brasscojones4291]

The true power of Speedrunner Mario.

[@godwin972]

I've watched multiple videos about this kind of stuff, and I still don't know how they do it.

[@3lH4ck3rC0mf0r7]

They take advantage of very precise frame and pixel perfect automated gameplay that allows them to write the console's random access memory exactly the way they want to through gameplay. Then, their final glitch before the console goes completely nuts allows them to run what they've written by playing the game as if it were actual processor (computer) binary language. This bit of code starts listening for controller inputs and treating them as new applications to run. Those random controller presses you see displayed in the lower left corner are not random. They are telling the console what to run next. They still have the cartridge on, so they can also call real game functions and elements through their glitch as well. It's insane.

[@3lH4ck3rC0mf0r7]

This is possible because RAM memory is just a reeeeaaalllly large string full of data, and old games have no error-handling. This can be exploited to force the console to read pieces of data in the wrong format. Imagine... A computer trying to play a picture as if it were audio (I'm sure you can't, it's not really easy lol). In this case, it reads sprite/gameplay data as if it were code. But unlike the previous picture example, where it'd just actually play a lot of cybernetic computery noise and blow your eardrums, the gameplay data here has been cleverly manipulated to be actually fucking meaningful. This makes it mesmerizing to see in action.

[@3lH4ck3rC0mf0r7]

tl;dr They reprogram the game while it is running by playing through it with juuuusst the perfectly right set of controller keypresses.

[@ThrowedGenji]

@@3lH4ck3rC0mf0r7 yeah its insane to think for someone like me who dosnt know coding but I kind of get it because with the cartridge its not like the levels are already made on the cartridge right, its just the string of data and then when played it gets told what to show n how to play. They take this way too far though wow

[@tg1304]

5:37 Turn on your subtitles! "Hey! That's not what the leaf does!"

[@jeremyryannoel]

Deep down, I really hoped Miyamoto purposely inserted the backdoor.

[@UniqueYui]

I never thought a mario game could be so messed up without game genie codes or rom hacks

[@cowgaming7186]

FAKE VIDEO! TAS is cheating… Emulator used, not on a console! Just kidding Ha ha ha… Bye!!!

[@invalid_user_handle]

Basically, if you can reroute execution to something easy to manipulate, such as controller input, you can pretty much do anything you want.

[@milkyproduxions]

when mario bros actually runs on linux

[@BasFish14]

He’s not cheating He just has a good gaming chair

[@Ike12]

Oldest form of homebrewing

[@kbhasi]

When I first watched this, I couldn't believe it was actually being emulated. I thought someone had just animated it! Clearly, I didn't see the rapid button inputs in the bottom left as I didn't realise the 6502 code execution pointer had jumped to the memory address of the controllers. This was clearly before I had discovered 'Retro Game Mechanics Explained', and before subtitles were added to this video. Also, I never knew the NES ran on Unix. (joking) (7:53) Hmm yes Mario just casually sliding through a wall.

[@dekogo]

4:22 The last Metroid is in captivity, the galaxy is at peace

[@mistercookboom1899]

Who gave mario the speed boots?

[@angryladgd]

2:12 this is when the madness starts

[@masoncamera273]

Its insane to me this video was 8 years ago, like i remember when this was still a relatively new glitch, now ACE is barely a novelty and its just kinda like "ok? They reprogrammed the entire game from within, so what?"

[@azriperisiben4]

4:20 moment mario become the one

[@oscarjimenez2174]

Mario become TURBO D=

[@Wapako]

Me: Nice, some Super Mario 3 gameplay! Me: *Seeing the drawing of a dinosaur* Me: Wel that was an attempt!

[@Maks7594]

executing arbitrary code just by pressing buttons is crazy

[@Meepy27]

is nobody gonna mention the sheer amount of inputs during most sections where mario isnt moving? thats NUTS.

[@WiFi-qj5kr]

I feel like I'm watching drugs

[@SwagGamer9750]

4:47 Hello, Sonic the Hedgehog called, he wants his Super Sonic form back.

[@mr.whimsic6902]

I would like to see this verified on a real console, if possible.

[@artman40]

By the way, this run is console-verified.

[@AwsomeGamerDude233]

Did you look at the controller inputs?

[@artman40]

Mkoijn3 Yes. So do you mean human-powered console verification?

[@AwsomeGamerDude233]

artman40 It isn't possible to press those buttons that fast.

[@mr.whimsic6902]

artman40 noo, i mean i wanted this to see played out on a real NES. :P no ACE runs have done this yet.

[@DrewPicklesTheDark]

When you adds Metroid's speed booster and Megaman's leaf shield as power ups to Mario.

[@OGuiBlindao]

At this point were gonna make doom in smb3 using arbitrary code execution

[@ConcreteObelisk]

i didn't know Mario was a better sorceror than Gandalf and Dumbledore combined.

[@Howureadis]

W E C O L O R I N G , G R A B T H E C R A Y O N S

[@ElephantMariotheRHDNhater3293]

Mario on steroids! Did he play some Megaman X before this adventure!?!

[@InessaMaxinova]

I cannot find any info on this aside from TAS videos website. Can someone explain the history aspect of this? 8:30 ah damnit, gg guys

[@Gernou5]

bro its literally what inspired peppino's moveset in pizza tower (talking about 4:22)

[@Robloxclips-bm9ji]

I wish the backdoor was actually in SMB3, that would’ve been fun snd definitely multiple people would find it.

[@diamondflummox6246]

I like how you see the controllers going nuts when righting code for the RAM.

[@anaalvesdoamaral1789]

Did he submerge his cartridge into nuclear waste?

[@clichayed]

6:42 bro did the blj before it was cool

[@CoinClever]

Come on man, you cant just put that at the end because now i dont know if its real!

[@JustinHallPlus]

I wish I was a fraction as good at assembly programming as you guys. Any advice on how to get better?

[@superpancakebros.8962]

ITS A TAS DUMMY

[@superpancakebros.8962]

I reported you. JK

[@superpancakebros.8962]

Nevermind

[@vuurniacsquarewave5091]

ASM for old processors is fun! But for modern ones it can be your death sentence... start out with something simple... just make something that can play different sounds based on button presses or something like that. Maybe put something on the screen!

[@tehdrago]

"who took my super emeralds?" hyper mario: 4:22

[@YTDeepshock]

The sorcery begins (visibly at least) around 2:30 or so.

[@Sasha_K29]

So this is what inspired the creators of Pizza Tower

[@real_bonfire]

This video makes way more sense with the captions lol

[@denelson83]

SMB3 What-The-Hell Edition.

[@LedYouAshtray]

4:16 Mario over here using the speed booster and shine spark

[@marcusharper8980]

Grab the crayons

[@Youtuber-xi6qo]

Evolution of yoshi 1988 - 2019

[@joshth647]

The fucking madlad did it

[@pharaohboy8657]

6:30 How mario maker shitty levels look like

[@WolfCraft08]

4:24 Mario It literally turned into Peppino spaghetti.

[@edward9487]

*Cue "What if I told you" memes*

[@a1d3n_isstupid]

>Does some random things >Breaks everything >Becomes God >Beats the game >Doesn't elaborate further >🗿

[@hooski99]

Guys I think I found a glitch "What did you do?" Everything

[@xhalved]

2:40 This normally named "Wrong Warp into Princess`s Room"

[@Kowalth]

Very convenient IRL.

[@cyanisnicelol]

But it wrong warped... Somwhere

[@funnywahooboi]

How is this possible. AND PEACH JUST BROKE THE FORTH WALL!! WTF 8:29

[@tarekcat1]

Bro the everything is broken not only the 4th wall

[@Coaster42]

Congratulations, my second favorite TAS video

[@prexot2341]

What's the first? Watch for Rolling Rocks or something?

[@johnwest6690]

CoasterKing love the pp

[@ksubswithnovideos-us7bn]

CoasterKing what’s your first favorite then

[@elweewutroone]

Weird ROM hack you got there!

[@joechristo2]

ram*

[@joechristo2]

I know it’s a joke

[@somerandomguyontheinternet3233]

He passed through the block at 0:13

[@MattTheCommenter]

Some Random Guy on The Internet clipping is a thing

[@tjthr]

bro its just lag calm down Bros lag: 5:22