Reprogramming Super Mario World from Inside The Game

[SethBling] recently set a world record speed run of the classic Super Nintendo game Super Mario World on the original SNES hardware. He managed to beat the game in five minutes and 59.6 seconds. How is this possible? He actually reprogrammed the game by moving specific objects to very specific places and then executing a glitch. This method of beating the game was originally discovered by Twitch user [Jeffw356] but it was performed on an emulator. [SethBling] was able to prove that this “credits warp” glitch works on the original hardware.

If you watch the video below, you’ll see [SethBling] visit one of the first available levels in the game. He then proceeds to move certain objects in the game to very specific places. What he’s doing here is manipulating the game’s X coordinate table for the sprites. By moving objects to specific places, he’s manipulating a section of the game’s memory to hold specific values and a specific order. It’s a meticulous process that likely took a lot of practice to get right.

Once the table was setup properly, [SethBling] needed a way to get the SNES to execute the X table as CPU instructions. In Super Mario World, there are special items that Mario can obtain that act as a power up. For example, the mushroom will make him grow in size. Each sprite in the game has a flag to tell the SNES that the item is able to act as a power up. Mario can either collect the power up by himself, or he can use his friendly dinosaur Yoshi to eat the power up, which will also apply the item’s effects to Mario.

The next part of the speed run involves something called the item swap glitch. In the game, Mario can collect coins himself, or Yoshi can also collect them by eating them. A glitch exists where Yoshi can start eating a coin, but Mario jumps off of Yoshi and collects the coin himself simultaneously. The result is that the game knows there is something inside of Yoshi’s mouth but it doesn’t know what. So he ends up holding an empty sprite with no properties. The game just knows that it’s whatever sprite is in sprite slot X.

Now comes the actual item swap. There is an enemy in the game called Chargin’ Chuck. This sprite happens to have the flag set as though it’s a power up. Normally this doesn’t matter because it also has a set flag to tell the game that it cannot be eaten by Yoshi. Also, Chuck is an enemy so it actually hurts Mario rather than act as a power up. So under normal circumstances, this sprite will never actually act as a power up. The developers never programmed the game to properly handle this scenario, because it was supposed to be impossible.

If the coin glitch is performed in a specific location within the level, a Chargin’ Chuck will spawn just after the coin is collected. When the Chuck spawns, it will take that empty sprite slot and suddenly the game believes that Yoshi is holding the Chuck in his mouth. This triggers the power up condition, which as we already know was never programmed into the game. The code ends up jumping to an area of memory that doesn’t contain normal game instructions.

The result of all of this manipulation and glitching is that all of the values in the sprite X coordinate table are executed as CPU instructions. [SethBling] setup this table to hold values that tell the game to jump to the end credits. The console executes them and does as commanded, and the game is over just a few minutes after it began. The video below shows the speed run but doesn’t get too far into the technical details, but you can read more about it here.

This isn’t the first time we’ve seen this type of hack. Speed runs have been performed on Pokemon with very similar techniques. Another hacker managed to program and execute a version of single player pong all from within Pokemon Blue. We can’t wait to see what these game hackers come up with next. Continue reading “Reprogramming Super Mario World from Inside The Game”

Teaching Mario to Play Pong and Snake Through Innumerable Exploits

This is the coolest classic Super Nintendo Entertainment System (SNES) hack we’ve seen in quite a while. What you’re seeing is called “Super Mario World (Total Control)” by [Masterjun]. Our first recommendation is that you watch the video, then come back here for an explanation. Similar to what we saw for Pokemon Yellow on Gameboy, [Masterjun] created entire Pong and Snake clones within Super Mario World. He also created a menu and ending screen, along with his trademark smiley face graphic. Even more amazing is that this was unveiled live on a real SNES running an unmodified game cartridge. [Masterjun] actually used dual multitap cables, effectively connecting 8 controllers to a SNES. This gave him enough bandwidth to quickly download his new binary through the controller ports alone.

Welcome to the world of Tool Assisted Speedruns (TAS), where emulators and scripts are used to create high-speed runs through video games. The runners often work frame by frame, painstakingly inputting commands to create the perfect run. Game bugs and glitches are often exploited in these speed runs. In fact, in runs such as this one, the speed run takes second place to showing off the exploit. The output of speed run creation is a script file of control inputs which can be executed on an emulator to “re-run” the TAS at any time. This script can also be saved to a PC or Raspberry Pi and played back into the controller port of a real game system. A PIC based hardware translator is used to convert the data to NES or SNES controller format. As one might expect, these scripts run open loop. With no feedback from the running game, they can and do become desynchronized due to differences in console hardware, such as the tolerance of the oscillator crystal. When everything is in sync and does work , the results are awesome.

Continue reading “Teaching Mario to Play Pong and Snake Through Innumerable Exploits”

Wireless SNES Controller for Logitech Receiver


A while back, Logitech introduced their version of a wireless interface for keyboards, mice, and other human-oriented peripherals. Yes, they could have used Bluetooth, but that’s neither here nor there. What we do know, though, is that it’s now possible to stuff one of these Logitech transmitters into a Super Nintendo controller, allowing it to operate with your fancy-schmancy wireless keyboards and mice.

[Warrior_Rocker] wanted to retain as much of the stock appearance of the original controller as possible. To do this, he salvaged the Logitech transmitter from an old handheld Logitech keyboard/touchpad combo. The membrane of the keyboard connected directly to the transmitter, meaning tracing out the connections of the membrane to each pin was required to get a button mapping that made sense.

Once the lines of the SNES controller were wired up to the transmitter, [Warrior] needed a way to power his new wireless controller. The old keyboard used a pair of AA cells wired in parallel. With two AA cells, the keyboard had about a year of battery life, so with a single AAA cell, [Warrior]’s SNES controller should last a few months or more.

Except for a switch and a missing cable, [Warrior]’s wireless controller looks exactly like a stock controller. Pretty impressive, given this build is the product of stuff he just had lying around.

How the Game Genie Works

Those of us old enough to remember blowing into cartridges will probably remember the Game Genie – a device that plugs in to an NES, SNES, Sega Genesis, or Game Boy that gives the player extra lives, items, changes the difficulty, or otherwise modifies the gameplay. To someone who doesn’t yet know where the 1-up is in the first level of Super Mario Bros., the Game Genie seems magical. There is, of course, a rhyme and reason behind the Genie and [The Mighty Mike Master] put together a great walkthrough of how the Game Genie works.

There are two varieties of Game Genie codes – 6-character codes and 8-character codes. Both these types of codes translate into a 15-bit address in the game ROM (from 0x8000 to 0xFFFF for the 6502-based NES) and a data byte. For the 6-character codes, whenever the address referenced by the Game Genie code is accessed, a specific data byte is returned. Thus, infinite lives become a reality with just a 6-character code.

Some games, especially ones made in the late years of their respective systems, use memory mapping to increase the code and data provided on the cartridges. Since areas of data are constantly being taken in and out of the CPU’s address space, merely returning a set value whenever a specific address is accessed would be disastrous. For this bank-switching setup, the Game Genie uses an 8-bit code; it’s just like the 6-bit code, only with the addition of a ‘compare’ byte. Using an 8-bit code, the Game Genie returns a specific byte if the compare bytes are equal. Otherwise, the Genie lets hands off the original data to the CPU.

Of course, all this information could be gleaned from the original patent for the Game Genie. As for the circuitry inside the Game Genie, there’s really not much aside from an un-Googleable GAL (general array logic) and a tiny epoxied microcontroller. It’s an amazingly simple device for all the amazement it imbued in our young impressionable minds.

Continue reading “How the Game Genie Works”

SNESoIP: It’s exactly what it sounds like


Here’s a cool hack for those of you wishing to play some retro multiplayer SNES games online!

[Michael Fitzmayer] is a resident hacker at shackspace; der hackerspace in StuttgartHe’s come up with this clever little ethernet adapter network-bridge that can share local controller-inputs over the internet. The entire project is open-source, and readily available on github. It’s still in the early stage of development, but it is already fully functional. The firmware is small and will fit on an ATmega8, and by the looks of the component list it’s a fairly easy build.

He’s even integrated a switch mode (hold B and Y during boot), which avoids trying to figure out which controller will be player one! After all, don’t you remember untangling the controller cords, trying to figure out which one is which?

We know you had a favorite controller and would give the other “crappy” one to your guest.

Example video is after the break.

Continue reading “SNESoIP: It’s exactly what it sounds like”

Hackaday Links: Sunday, June 9th, 2013


This week we saw an interesting animated motorcycle tail light over on Reddit. But there wasn’t really enough background to get its own feature.

The NeuroKnitting project captures brainwaves by weaving them into a scarf.

On Semiconductor is showing off an 8x8x8 LED cube which they claim as 12,000 LEDs. We can’t figure out where all those LEDs are used in the design, but maybe you can. Here’s one that we know has 4096 LEDs in its matrix.

[Jeff] used hard drive platters as the disc section of his original Enterprise desk model.

Play around with an SNES controller and Arduino by following [Damon’s] guide.

Hackaday Alum [Jeremy Cook] posted an update of his laser graffiti project. His earlier effort used camera tricks to capture the image but this time around he’s exciting phosphorescent glow material to make a persistent display visible to the human eye.

This server hides in plain sight after being wrapped in a hard cover book binding. Hopefully this won’t cause heat dissipation problems.

[Trumpkin] built his own Nixie tube wristwatch which we think has the potential to be as neat as the one [Woz] wears.


SNES headphones scream out for Bluetooth control

Here’s a build that just exudes nerd cred. It’s an SNES controller modified into a pair of headphones, straight from the workshop of [lyberty5].

The build began by stealing a controller from a PAL SNES and carefully dremeling the buttons and d-pad loose from their plastic frame. The PCB was cut in half, and the remaining plastic was carefully crafted into round speaker enclosures with the help of some epoxy. hot glue, and possibly a few pieces of styrene.

The result is a perfectly formed pair of SNES headphones, with a build quality right up there with the best case mods we’ve seen. Unfortunately, while the buttons are still attached to the PCB, they don’t do anything. We’re thinking a small Bluetooth adapter – or even repurposing a set of Bluetooth headphones with volume and play controls – would be a wonderful use for the 20-year-old, candy-like buttons.

Still, an awesome build, and [lyberty5] really shows off his craft by constructing these wonderful headphones. You can see the time-lapse of the build after the break.

Continue reading “SNES headphones scream out for Bluetooth control”