SNES Code Injection -- Flappy Bird in SMW

This reminds me of the incredible Flappy Birds SNES Code Injection into Super Mario World. A must-see video. ▶ this video

My understanding is that they're glitching the game to inject data into memory, in this case processor instructions. And then they use another glitch to jump to and execute that code. No modifications needed to the hardware or ROM, you're just being extremely selective about how to play the game to cause memory to get flipped. This video is done by hand and explains a bit more about how and why it works: ▶ this video

I'm a speedrunner, and I'm pretty sure this is well known -- and accepted as standard in some categories! It's a pretty well accepted standard (to the point of the headline being almost a mild offense!). In the gaming world, undefined software behavior is critical to this sort of thing, we see this especially in some games like the legendary exploits found in the Ocarina of Time speedruns for example. I mean, in Super Mario World, SethBling did code injection to manually run a version of Flappy Bird (how ironic given the origin of the pipes!) in the game. By hand. No savestates. It took forever and the run through is really and truly fascinating: ▶ this video I speedrun things other than games as well -- and so the generalization is not just that we are security researchers, we are people who fundamentally learn the "shape" of a thing very, very well, and ways that this shape can be used to get from one state on that shape to another. In conclusion -- yes, it can be something as simple as security research! But the joy and the beauty of speedrunning is something so much bigger and beautiful than that -- though it certainly is one outcome that can be had!

Sometimes even after you've come up with the exploit, you can create something really beautiful for the console to run afterwards. Pokemon Yellow: link Super Mario World: ▶ this video

Just to add some context, arbitrary code execution in Super Mario World is nothing new, it has been known since 2014. There was a tool assisted demonstration at Awesome Games Done Quick 2014 [1] where they inject a pong and a snake game using a TASBot (a robot controller that replays input scripts to the console). And in 2016 a streamer performed it manually to inject a flappy birds game [2] (this second video is really good, he goes into detail of the process). So, what this newer demonstration brings is the use of the known arbitrary code execution capabilities of "Super Mario World" to help finish all 5 games in "Super Mario All-Stars + Super Mario World" as quick as possible. [1] link [2] ▶ this video

This one creates a Flappy Bird clone by hand from within SMW, using the controller under ordinary manual control, on an original, unmodded SNES (with a couple or other standard controllers attached with buttons taped down). Explains the process in detail, which includes creating a kind of crude "IDE" using the score table as feedback for hex values input to make the process faster and less error-prone: ▶ this video

I don't know about the run shown in the OP, but there are a fair number of memory-manipulation/ACE speedruns that are feasible in RTA ("real-time attack", a.k.a. something a human could pull off, as distinct from TAS). Off the top of my head I can think of such routes for Pokemon Red/Blue, Ocarina of Time, and Super Mario World. To answer your question of "how likely is one to pull this off" for those three, the Pokemon one requires no almost advanced execution, other than turning off the console at a precise point to corrupt the save data you otherwise just need to follow a simple (though long) series of steps. The Mario one requires some pixel-perfect precision, and runners often used hacked ROMs that display coordinates in order to train. The Zelda one requires exact angles to be held on the analog stick, and I've heard of people creating guides out of cardboard and rubber bands in order to help them achieve the angles more reliably. Sorry that I don't have any video links on hand, but you could almost certainly find examples of these in the GDQ archives. EDIT: Found a good video for the SMW example, by SethBling, which actually goes a step further and manually reprograms SMW into Flappy Bird: ▶ this video EDIT 2: Here's an excellent explanation of the Zelda ACE: link

super impressive stuff. I'm generally unfamiliar with speedrunning, but I am familiar with the billy mitchell controversies, so I'm surprised that people accept the legitimacy of streamed runs. wouldn't it be trivial-enough to fake? tangental: my personal favorite mario-related feat is sethbling injecting flappy bird into super mario world manually: ▶ this video

Youtube is full of hidden gems, all a matter of taste. Meta-programming: link Math'n'music edutainment: link Science edutainment: link Feats of incredible gaming skill: link Tidbits of hacking ingenuity: ▶ this video Looking for heart in pop culture: link You can get lost in the maze of excess information. It's great - i think...

> using tools and rigorous methods Lots of speedrun strategies require surprisingly sophisticated tools. People will decompile/disassemble code to figure out what is going on. They'll run the game in an emulator and peek at memory values to figure out how the game works and how to manipulate it. They'll use these tools to set up their game state so that there's a sequence of bytes in RAM, then cause program execution to jump to these bytes, to run arbitrary code execution. Here's a video of a speedrunner explaining some of the things he did to get two arbitrary code executions working together to speedrun Super Mario All-Stars + Super Mario World: link (it's about 15 minutes) Here's the same runner using one of those arbitrary code executions to inject Flappy Bird into Super Mario World instead of just warping to end credits: ▶ this video (it's about 6 minutes) He didn't get to that point just by random pressing buttons until something interesting happened. He got to that point because he understands the Super Mario World memory layout well enough to manipulate it and execute the instructions that he chooses for it. That's vulnerability research any way you want to slice it.

I love this kind of stuff. Reminds me of how they programmed Flappy Bird inside Super Mario World using glitches. Crazy stuff. ▶ this video

You definitely do need code execution from RAM for high-fidelity emulation. How else are people going to implement Flappy Bird in Super Mario World? :) ▶ this video