The Legend of Zelda Ultimate Glitch Explained [Arbitrary Code Execution] - Warp Straight to Zelda!

This glitch will only work on version 1.1 of the Famicom version of the game. Don't try this on the NES because it won't work.
Shout-outs again to Sockfolder for discovering the glitch and writing this code. Sockfolder is a brilliant glitch hunter and programmer who does similar stuff for other things. If you're interested, follow him on Twitter at / sockfolder and on Twitch at / sockfolder .
Like this video? Subscribe for more awesome content at / magicscrumpy and follow me on Twitter for behind-the-scenes stuff and bonus content at / magicscrumpy

[@MagicScrumpy]

Here's my shot at making serious, non-Smash content. I really enjoyed making this video. What do you think of it?

[@ethanmarais1156]

Pretty good

[@dooty2010]

Looks pretty cool.

[@dezdlefoo278]

Make more content like this!

[@godslayerbiotch43]

awesome af

[@MrDannyloco]

thats pretty good

[@ronnygeis895]

the entirety of this video went right over my head so I'll just take your word for it

[@snitchbug]

same

[@hdef6602]

I don't even know why I'm watching this xD because I don't understand half of it

[@luisburgos7365]

glad i'm not the only one lol

[@theflamincheetoh3474]

lmao same here I tried paying but I couldn't

[@TheInvaderDust]

Im pretty tech savvy and somewhat sharp. But this was WAY beyond me. ..

[@zehahaha5630]

But first, let's talk about parallel universes.

[@mini-_]

First we need to gather up speed for 10 hours straight

[@Yutopeia]

It's actually 12 hours

[@mini-_]

LordSodium 12 hours is way too much, the chances of becoming QPU misaligned is way too high.

[@scooter9537]

Im half pressing A

[@zehahaha5630]

Oh my gosh, I've never had this many likes. Brb gonna masturbate on the streets of Hollywood.

[@RiskyBiscuit]

How many spawned sprites would a spawned sprite spawn if a spawned sprite could spawn sprites?

[@t1glistenerelf]

69

[@RiskyBiscuit]

made it myself, I plan to start streaming eventually. Just see what happens.

[@t1glistenerelf]

***** Walfas www.walfas.org/flash/create.swf I made it myself using the template and resources that are available there.

[@t1glistenerelf]

***** No problem. There's a Link costume, in case that suits your fancy (given your profile pic and all.)

[@t1glistenerelf]

***** Oh, I haven't taken a picture of it. I just know that it has assets like the hat and outfit.

[@JacobKinsley]

The whistle actor thing is like if someone really needs the toilet but all 11 cubicles are taken so they shit in the urinal out of desperation, then later on the janitor quits their job and the person in charge of the kitchen has to clean it up but accidentally uses the wrong handbook and so makes a meal out of the shit in the urinal which the original person who shit in the urinal's partner then is just about to eat but the original person is at an angle where they can warn the partner just as about they're to eat it and as the partner spits it out some person walking past gets it in their face and it turns out that person finds it delicious and the partner and the original person get tons of money as thanks

[@shady4091]

Jacob Rendall Exactly.

[@hasslevania8138]

Yes

[@dolst]

This has got to be one of the best descriptions of this kind of glitch I have ever read. Well done.

[@ruviknoproblem]

what

[@Gamesfan34260]

@@ruviknoproblem This is an appropriate response, I would also like to ask that, but I'm also too scared to get an answer...

[@lucasmark2000]

Finally, an easy way to beat the game.

[@kyleviolette5258]

Lmao

[@SuperShadow]

First off, I admire your attention to detail and amount of effort. That being said... Watch for Rolling Rocks is not arbitrary code execution. It's a exhibition of engine quirks. It's 50% setup and 50% execution. It's visually apparent. It's easy to follow along. This glitch is different because there's nothing to act as a visual aid when explaining the finer details of memory manipulation. It can't be reliably explained to every audience, they must need background in programming... unless you omit those finer details. Everyone knows Mario 64 game mechanics better than they know NESdev and the Zelda memory map. So an explanation requires that you pick an audience (assembly programmer, casual gamer, pannenkoek subscriber) and write everything just for them, even if some details are omitted. I hear "the game freaks out/gets confused" and "rotate left at offset $10" both in the same video, it makes me wonder to which audience you were aiming. Thank you for making this video.

[@Larry]

Are you the guy who also worked out the music loop glitch in Startropics?

[@Chaotix_]

oh hello there

[@xenxander]

Hello, you!

[@sabata414]

Hey Larry!

[@radaf4429]

You didn't even build up speed for 12 hours

[@SlingingHashSlasher]

What if viable kirby could copy a characters whole moveset

[@MrDannyloco]

DANGG! that would be dope

[@7tales357]

but, you gotta make his grabs and specials combo into most movesets that would be hard

[@Thelangster5]

so ditto

[@Zadamanim]

Not really, set the upthrow angle to 80 and knockback to something decent with low knockback growth and it would combo. The real problem is that hitboxes are attached to animation bones, and every character has a different skeleton. This creates surprisingly straightforward issues like "how would Kirby use the knee if Kirby has no knees?"

[@7tales357]

Kirby could use "the foot" xD

[@MultiYoshiman]

But first we need to talk about parallel universes

[@emilydioptase]

TJ Henry Yoshi is very depressing and naive

[@HorkSupreme]

"Henry"

[@furfagyiffininhell3525]

Because everytime I post a video, """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""Henry"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" strategically builds up speed for 12 hours

[@Dudeman23rd]

gosh dang it, I came to the comments _just_ to make this joke

[@zolika1351]

i really dont get how this became a meme

[@snowblack90]

This is so damn insane from a coder pow. I'm seriously amazed by the whole process and you are stupidly good at describing this stuff. Pure, total awesonemess from subject to delivery. Bravo, sir!

[@Anomatron]

Sniffling around 0:55 scared me Scrumps

[@InFamousStickFigure]

The explanation at 2:10 reminds me of what I'm learning in data structure for C++. And here I thought that those concepts were useless when I was learning them, thanks!

[@ZalvadorZali]

Maybe its because I am a Computer Science major, but this was AWESOME!!!

[@josh.ryan.]

Thank you for this, Scrumpy. Glad to see you branch into other games. This was awesome!

[@metaboss7567]

Well, it's official, you earned yourself a new subscriber.

[@thebananamelon5065]

And a Nobel prize for knowledge

[@pearlywhites3025]

What if Marth had a projectile

[@Gamer-sf5ce]

WHAT IF IKE HAD A PROJECTILE XDDDDDDDDDDDD

[@denji8766]

Eccentric Kookie what if six more Marth joins the game, Then it’ll be a fire emblem Parallel game

[@hasslevania8138]

ROY

[@doomfatlikesbluesphere9984]

wow, this is up there with "watch for rolling rocks in 0.5 a presses"... the way you explain such complicated subjects so simply, is quite amazing!

[@larryinc64]

I love these videos, you make the complex code so easy to understand.

[@David-ql8cn]

this video made me feel stupid

[@mohamedadel7111]

this was awesome ( I'm a huge coding enthusiast btw)

[@nickshafterplays7003]

+You Suck chill troll

[@PokefreakofBACON]

So that's how arbitrary code execution works. I was always curious about how the hell that could happen. 10/10 video.

[@KingofCrusher]

This is a great series, unique on youtube as far as I can tell. Keep them coming! I did a few romhack translations so I it's super interesting when you have a basic understanding of how shit works.

[@zealot246]

how do people even find stuff like this?

[@1001011011010]

Code mining?

[@fnybny]

The person who discovered the glitch probably found the sprite table overflow and then carefully constructed the rest.

[@KiRAyylmao]

its not uncommon for people to look for ways to overflow memory for useful things so there are established ways of searching and known areas that are likely to contain errors that allow the game memory to overflow. from there its just experimenting plus an understanding of assembly language

[@tygamike]

Overflow stuff is really common in hacking. I guess people just took that code theory and applied it to old games since the code for those is usually really simple and full of easily exploitable bad/dated code.

[@kopjjipj5743]

almost the exact same thing is used in SMW to warp to the credits.

[@mistyfront]

Arbitrary code execution is awesome, looking forward to seeing this video when YT mobile recognizes it :p

[@zealot246]

it's up on mobile

[@eppssilon]

It was only 5 years ago when videos wouldn't immediately appear on mobile? Damn

[@G.Aaron.Fisher]

This is the cleanest most accessible explanation involving assembly code I've ever seen. How long did it take you to draft and edit the script?

[@Geliot-oe2sb]

I really enjoyed this video! I hope you continue to make more of these!

[@VinceOfAllTrades]

While I generally dislike this question, I think it's more applicable here than elsewhere: How did Sockfolder discover this? This glitch (more of an exploit, really?) requires intimate knowledge of the entire game code at both low and high levels. It's not as simple as looking for a RAM location (the ghost setup using action states would take a TON of dedication to watch in RAM), but it also takes more than looking at the high level code (which probably doesn't specify how events are handled in memory). It also seems too unlikely to fall into the "found it by accident" category.

[@proxy1035]

love that early games were literally using the raw Data from the ROM and when people found a way to manipulate the RAM to do shit liek this

[@KazeMemaryu]

Whoa, this is great, man! Would be really interesting to have you break down other glitches like that, it's a lot of fun to learn about!

[@G_U_STHEBESTE]

This is seriously the coolest thing, keep it up dude

[@Zinfidel1]

2:09 How much sprite can a sprite slot spawn if a spawn sprite spot sprite slot spawn?

[@ken-fr4fc]

genius

[@Kaijudomage]

Good ol' in game hex editing. :D You can do something similar to this in the Gen 1 Pokemon games and get any Pokemon you want, including Mew.

[@MagicScrumpy]

I'm actually editing a video about the Missingno. glitch right now. It'll be up either tomorrow or Thursday. I want to make a little series of Pokemon Red/Blue glitch videos and end it with a finale of a really neat speedrun route that abuses a ton of glitches.

[@Kaijudomage]

Oh? An actually speedrun or just the 0:00 timer glitch? :P Are you going to cover how the missingno glitch actually works and what the various missingno actually do to your game? And I've seen other videos and the amount of in game hex editing you can do with the inventory alone is astounding.

[@RobertPendell]

People have done amazing things in Pokemon. Have you seen the hack where it showed the twitch stream chat?

[@KarjamP]

Technically not a hack. Unless you count the times where they did do ROM hacks. Or the time where they hacked the 3DS hardware just so that they could play the sixth generation games.

[@RobertPendell]

Well I tend to group hacks/exploits together. Depends on how you look at it.

[@fantaboy1589]

Really nice video dude, I would definetely watch more of this

[@GamerLMA]

Super cool video Scrumpy. Hope to see more like this in the future.

[@Mayoncheese]

Great video, albeit I understand close to nothing of it lmao. On that note, what if Roy is Marth's Nana? (IC)

[@TheHeineHouse]

Ho Le FUCK! Where was this guy when Apollo 13 was coming down?? This guy needs to be at NASA writing code to launch a space ship in the sky or something! Beautiful explanation, admirable dedication, I didn't understand a fucking word of it. It's really awesome to see this amount of work go into these games, keep finding cool stuff! :)

[@andrew4042]

"Beautiful explanation, admirable dedication, I didn't understand a fucking word of it." this made my day

[@syrelian]

He pretty much wrote some code, then used some bugs in the system to make it read the wrong section of memory where this code was and warp him to winning the game

[@vaiyt]

Assembly code is complicated yo

[@LiEnby]

vaiyt assembly is actually really easy

[@joshuahawkett100]

this video reminded me of cosmo when he explained that Zelda glitch that it took years to discover. I love it.

[@davidspring8884]

Stunning video, chap. Very nicely explained.

[@niggapendeluxe1682]

Take a drink every time he says spawn or Sprite

[@benjaminm.860]

Or byte, code, or glitch.

[@zac50333]

I was sent here by a man who wants to make Sonic great again.

[@DerpsGW]

Fantastic video. I took a class in college on assembly language and it was great to be able to follow along and see how assembly was used in creating these classic video games. Interesting topic and well explained. I love content like this! I'd also like to add that it's nice to see you do something interesting outside of Melee. Melee is great of course, but it definitely helps in terms of the variety of your content. Well done!

[@andrew4042]

can you explain assembly to me, ive been seeing assemblys a lot on this video and i dont know what they are

[@DerpsGW]

andrew4043 Um, well you're probably better off googling it. In super, super short, Assembly Language is one step above machine language in terms of creating code you can compute. Languages like Java or C++ are much more higher level in that the code one write in those languages gets converted and translated eventually into a Assembly Language, which a computer understands.

[@tonik8977]

I'd love to see more of this kind of stuff, reminds me of how fascinating the 0/0.5 A press M64 runs are

[@ericpeterson6520]

I realize this is much less versatile than the equivalent Super Mario World glitch, since you have much less room to write code. So you probably can't do stuff like make the game play Snake, Pong, or Flappy Bird. But is there any other crazy stuff you could do with this arbitrary code execution?

[@Jba03]

If we look how the game is built, it is actually possible to make an ACE that allows for snake or pong. This is a really small routine in the game code that allows the player to change the position of link and the screen. So, you could basically do the exact same glitch as seen here, but write to other locations where more open data in the BUS values. I don't know if the OAM takes place in this ACE but other games are definitely possible. You could also re-write the whole game with ACE if you would like because the ROM portion doesnt really make anything harder in this game. Hope this answers your question :)

[@ericpeterson6520]

It does, thanks! Hopefully people pick up on this and use it like the SMW glitch. I feel like Zelda always gets ignored in the wake of Mario

[@Deretythe]

ZELDA = 23 0E 15 0D 0A 2E1DA I see what you did there, Nintendo.

[@leolaserbolt]

i dont.

[@gisibah]

@@leolaserbolt Me neither

[@laurinneff4304]

To everyone that doesn't see it: 23 = 2 0E = E 15 = 1 0D = D 0A = A 2E1DA ZELDA

[@gisibah]

@@laurinneff4304 No, hex 23 = dec 35 which corresponds to Z and hex 15 =dec 21 which corresponds to L. It directly says ZELDA.

[@nathangamble125]

They did nothing. Those parts of the file name don't matter, because you haven't pulled from the stack yet. There are thousands of other combinations of characters you could put in the place of "ZELDA" that would have exactly the same effect (i.e. nothing), it's just that "ZELDA" is used in this example because it's contextually appropriate.

[@FRIEDEATH]

I really enjoyed this video. Please do more videos breaking down speed running strats!

[@Tapion013]

Thanks to the Pepsi man and Sonic videos, I thought there was going to be some crazy reveal at the end... turns out you were being serious and I found myself entranced after the third minute and couldn't take my eyes off of what was happening. Why haven't I subscribed to you yet I look for your vids every day... *subscribes*

[@XxthefailnessxX]

did I understand even 5% of this? no. did I really enjoy this? yes. I love at least getting a slight grasp of what happens in coding during glitches

[@waz9758]

Try an episode on some original pokemon glitches, Idk which glitch I guess that could be up to you

[@junietwoknees]

Mew glitch and lvl 100 pokemon early are good.

[@MishaHivemind]

+Mijquaza "original pokemon glitches"

[@E-102_Gamma]

Those are just the tip of the iceberg when it comes to Gen I glitches. Watch some of ChickasaurusGL's videos some time and you'll see what I mean.

[@geozop]

Nicely done (and explained). Looks like it was a puzzle to get those few instructions to perform the operations needed.

[@TheUKNutter]

Now you should look up the dog house glitch, (known as) the exploration glitch. Literally every time you go in there the world completely changes randomly into a glitchless world, and each world is different depending on how many enemies you kill. But like the minus world, but for zelda.

[@DCice13]

I was sent here by a man that will keep doing infinite loops, happily.

[@SuperFromND]

I wonder, would this make the swordless challenge possible?

[@MagicScrumpy]

Nope! You have to press A and B at the same time to get the glitch to work right.

[@SuperFromND]

MagicScrumpy BibleThump

[@linkthepringlesman3951]

Actually, yes! You don't have to collect the sword to press A.

[@Manavine]

You need another item in that slot. Because if you press A without an item... You get back 00.

[@NotLe0n]

MagicScrumpy you can do it in x0.5 A presses

[@lisianthusfanjackofallcard4649]

I found this enjoyable and interesting to watch. Thanks Scrumps

[@rapidrotation]

And I tell you what, this whole bit at 6:00? Exactly like being the Navigator in a game of Rogue Trader (Warhammer 40K). There's a million ways to mess up, and if you do, everything goes horribly, *horribly* wrong.

[@MegamikazeMoriko]

ZELDAAAA MAHSODSODSOD MAISODRAKAROKUNO ^this is the chanting spell to cast zelda

[@KratosAurionPlays]

Seriously how do people find these? It's crazy.

[@E-102_Gamma]

Theory-crafting and brainstorming.

[@Vim_Tim]

Id actually guess that it was part theory-crafting, then a ton of debugging through machine code with a debugger on an emulator. It's not terribly hard to watch what's going on in memory while running the game, which is why they know that address XX corresponds to state Y.

[@sune9578]

Overloading a game is quite a common way to find an opening in a game. There's bound to be some unchecked variable that will cause overflow. I reckon that if you can overload a game and consistently freeze it doing a specific set of actions, you're bound to run arbitrary code if you can examine what the game is doing near or at that point of freezing. If you can find a way to direct that arbitrary code execution to a way of your liking, you're bound to control the game fully, and maybe even the console if the OS doesn't do any safe-guarding of its own (and thus, hacked consoles).

[@p1nkfreud]

Sun E Exactly. It's mind-boggling that some viewers believe these exploits were found by accidentally having all save files prenamed like this for no reason.

[@iGamingAlliance]

Lots of drugs

[@Weavi_]

Wow Scrumps this is quite the video. Amazing work

[@spidermcgavenport8767]

Thank you for the much more in depth explanations... Greatly appreciated.

[@SNESJW]

Great video, but something's getting at my OCD... Any chance you could use a monospace font next time you put code on-screen? Bothers me when stuff doesn't align...

[@MagicScrumpy]

+Carvool For sure! Thanks for pointing that out :D

[@RemiBoyz]

I have always wondered about this stuff. BTW if you like TAS stuff, look up Masterjun3. He's pretty cool, and he has a video of a similar route on his channel. Also shoutouts to Omni for being Scrumpy's inspiration :P

[@FantasyJared]

This video is so in depth, amazing! :)

[@ganggreen1983]

“I don’t know what the fuk you just said little kid! But you’re special, man. You reached down, and touched me by the heart.”

[@neil340]

11 minute video explaining every detail and ends with "we don't know why it puts us in Zelda's room". lol

[@thecoolv130]

wish I knew what he was talking about...

[@ultraatari9298]

TheCoolV (CraftyChicken) It basically is saying the programming back than was like a series of doors you had to go through to come out another door. You can confuse the script because there is a limited number of doors and you're making knobs for doors that don't exist it shows how we've developed in computing cause this game took years to make, now could be developed in weeks

[@fryingpan6952]

can't wait till you reach 100k subscribers ! ;D

[@SinsOfScience]

I love videos like this! Would you perhaps be planning to explain the Relm Sketch Glitch, or the Mario World speed run glitch? Looking forward to more!

[@Chichirumiru]

0:55 who is that guys with the running nose in the background?

[@m4r1o148]

Could have been an editing error. He doesn't do the whole video in one take, and must have mistakenly left in the remainder of one of the clips.

[@brucewayne4172]

What if the knee had the knee?

[@VideoFeverShow]

The coding that goes into an NES game is staggering. Considering that they were all written in assembly and the storage space was so limited, getting a complex game like Zelda to function at all would be impossibly difficult by today's coding standards. This may shed some light on why internally developed Nintendo games are so beautifully polished, since they were written by programmers who could write a sprawling adventure into 128 kilobytes.

[@game2late518]

Hi MagicScrumpy, well done on the video. Question: do you do any tampering with the cartridge? When you say "writing the code" do you refer to simply writing the savenames in the save slots? Is that all?

[@Gabiscis]

I hope we get to see this at AGDQ2017

[@BEEEELEEEE]

I actually understand a tiny bit of this. Do I get a cookie?

[@lukecreator]

I understand all of it. Does that mean I get a cookie too?

[@SpamDestroyer]

You get a slice of cake

[@voxelfusion9894]

was that a lie?

[@BEEEELEEEE]

VoxelFusion No, I took a programming course over summer, and I actually learned something because everyone involved actually wanted to be there.

[@lukecreator]

+SpamDestroyer yay... XD

[@nicklemay8056]

It's always a treat to get a non-shitpost Scrumpy video

[@Kiet1]

THIS IS AMAZING! DO MORE OF THESE!

[@RockLegend2A]

Great job, man. Soon enough, you'll be giving pannenkoek2012 a run for his money.

[@BebinhoXD]

i want to see it done in real time

[@Unk0wnHope]

This all was amazingly done; you explained very well. While it was still would be difficult to perfectly follow this as someone who doesn't understand code well, there's not much you could of done about it, and it is still understandable.

[@meskeels1]

Color coding is really nice and makes it so easy to follow everything.

[@PilGrimmm]

you lost me at "filename"

[@shoopy44]

Can anyone link me to some more code execution explanations/tutorials?

[@D20d_]

Oh

[@shoopy44]

+AldiePezeh thanks man!

[@dustindacus967]

watch cosmowright's SotN one

[@WolfXGamerful]

*does this* "I'm a coder now. I am the smartest being to ever exist."

[@jeffjimmy6892]

great job explaining how/why it works. reminds me of cosmo's old oot wr vid

[@SSBane]

What if zelda was a girl?

[@RogueBoyScout]

Calm down Incel, they're only computer drawings...

[@brainslushie666]

First let's talk about parallel universes

[@jellopuddington]

Yes, I completely understand all of this. I concur with your analysis.

[@daptor1427]

I understood maybe a third of it, but it was still interesting to see how these kinds of glitches work.

[@ApolloLegend]

You sniped my video idea

[@44absol]

BUT FIRST WE NEED TO TALK ABOUT PARALLEL UNIVERSES

[@t1glistenerelf]

I could have sworn that this was going to be another "Mario with zero A presses" type video. I am glad that I was wrong. ^-^

[@DankLordDemaar]

Anyone else noticing the sniffling sound after "We are naming the files weirdly because..." (0:54)?

[@ChibiTails]

you lost me at "the"

[@RuthlessMeteors]

is this math o_o

[@IMGhost589]

Its data

[@trbotimmmmmmmeh]

hexidecimal and binary code

[@___8241]

KUMA

[@Chromedeguenther]

Memory systems, largely. You will need to know this to be a good programmer who can work with memory allocation. If you're interested in learning more, look into programming in C and then what's called assembly language, after learning C well enough. Then you'd have a good understanding of this stuff :P

[@theorangeslice9678]

Start with a better documented instruction set like X86 or ARM if you're gonna get into Assembly.

[@NotSpoondere]

Reminds me a lot of dotsarecool's Super Mario World tutorials. Very nicely done.

[@supersmashbros123654]

Really cool video! If you made one about the arbitrary code execution in Symphony of the Night to end the game early, that would be super cool.

[@lorelaitodd-watkins7203]

>casual players a couple days hahahahah hahahah hhahaahahAHHAHAHAHAHA it's been months send help pls

[@NowOnAFM]

It's very similar to what has been recently achieved with the Super Mario World in-game code execution to warp to the credits. Quite a brilliant discovery which in technical terms goes way over my head, but getting the general concept of it is good enough for me.

[@FarNoGaming]

I like game glitch videos but I love videos that explain why it happens on a software level. Great Content 10/10.

[@ZSharp94]

Really loved this video! I think it would be really helpful if while explaining the code you wrote on the name screen, you showed the memory that the code was manipulating at the same time (i.e. showed the values of addresses $10, $11, etc. while explaining what and how the code writes values to them).