If only Siegfried Kircheis were here — jadagul: prokopetz: repost-this-image:...

1.5M ratings
277k ratings

See, that’s what the app is perfect for.

Sounds perfect Wahhhh, I don’t wanna
jadagul
prokopetz

The fun thing about speedrunning is that you can respond to literally any piece of information about a video game in any context whatsoever with “implications for the speedrun?” and there’s a non-zero chance that’s actually a cogent question.

prokopetz

A couple of personal favourite examples of extremely silly things affecting the speedrun route:

The Legend of Zelda: Twilight Princess low% route where a one-frame synchronisation error in Link’s idle animation allows an additional eight items to be skipped compared to the any% route by spending 17 hours standing motionless while staring at a rupee.

The Paper Mario unrestricted any% route where a seemingly trivial memory management oversight in the Nintendo 64 hardware permits a route that saves 75 minutes over the normal any% route, dropping the overall time from 101 minutes to 26, but requires you to spend the first nine of those 26 minutes playing Ocarina of Time.

repost-this-image

the “first 9 minutes” intrigues me. What does playing OoT do to affect Paper Mario?

prokopetz

The TL;DR version probably isn’t going to make any sense unless you’re a computer programmer, but in brief:

  • The Nintendo 64 has a plug-in accessory called the Expansion Pak that adds 4MB of extra RAM to the system. Most N64 games don’t use it; a small number require it.
     
  • Paper Mario suffers from several bugs related to menu loading that, in combination, can cause the execution pointer to go shooting off to gods-know-where. One of the places the it can go shooting off to is a normally nonexistent memory address that happens to correspond to a particular block of RAM on the Expansion Pak, if it’s installed.
     
  • By itself, this isn’t helpful. Jumping the execution pointer to weird places often allows for arbitrary code execution, but Paper Mario is one of the games that doesn’t use the Expansion Pak, so there’s no way to write data to it during normal play.
     
  • However, because it doesn’t use the Expansion Pak, it also doesn’t initialise the Expansion Pak’s memory on boot. This is important because the Expansion Pak consists of a relatively high-persistence type of RAM that can retain its contents for several seconds without power.
     
  • If you know what an execution pointer is, you’ve probably already figured out where this is going: we need to deposit a useful payload on the Expansion Pak using a different game, then quickly swap cartridges to Paper Mario and do the menu glitch that jumps the execution pointer to the Expansion Pak’s address.
     
  • It turns out that the quickest game to set this up with is Ocarina of Time. By doing some very stupid tricks involving stale reference manipulation of a linked list structure containing data about fairy sparkles, you can drop a few bytes of arbitrary code on the Expansion Pak. It’s not much, but it’s enough for the next step.
     
  • Swap cartridges to Paper Mario and do the menu thing. When that crafted payload is carried out, it causes the execution pointer to jump again, this time to the memory address containing the name of your save file.
     
  • The name of the save file in turn contains a series of nonsense characters corresponding to instructions to update your story progress flags to right before the end credits cutscene, autosave, then crash the console.
     
  • Restart console, load doctored save file, watch credits.

Or, to TL;DR the TL;DR: you use a glitch in Ocarina of Time to deposit a logic bomb made of fairy dust on the N64 Expansion Pak, then boot up Paper Mario and do stupid tricks with the menus to ricochet the execution pointer off that payload and start executing your save file’s name as code, thereby enabling arbitrary code execution.

Clear as mud?

jadagul

For what it’s worth, they decided that the Ocarina of Time-enhanced version doesn’t count as an any% run. But now they’ve gotten a similar glitch to work using just the PM64 cartridge, and that record is under 45 minutes. (Edit: sorry, it’s a 48:30)

It does involve plugging a controller into the third slot and holding down the analog stick with a rubber band, though.

official-kircheis

From the comments on the Twilight Princess video:

I used to really wonder how bread was ever invented. The process of making bread always seemed like so many weird steps that are each meaningless to try without the final result already in view: why would people even try to grow wheat, then grind it, then make dough, then put it into the oven unless they already knew what would happen from the start, especially when there were other crops they could grow instead? But now that I have seen this video (and others on the speedrunning community at large) I am not puzzled by this at all. The speedrunning community is living proof that humans will literally just keep trying the most random shit, at tremendous cost of time and energy, just to see what happens, and then record the results with hair-splitting precision, and then build off of each others findings with no conceivable reward in sight. And to me, that’s actually kind of inspiring.