Reprogramming Super Mario World from Inside The Game

[SethBling] recently set a world record speed run of the classic Super Nintendo game Super Mario World on the original SNES hardware. He managed to beat the game in five minutes and 59.6 seconds. How is this possible? He actually reprogrammed the game by moving specific objects to very specific places and then executing a glitch. This method of beating the game was originally discovered by Twitch user [Jeffw356] but it was performed on an emulator. [SethBling] was able to prove that this “credits warp” glitch works on the original hardware.

If you watch the video below, you’ll see [SethBling] visit one of the first available levels in the game. He then proceeds to move certain objects in the game to very specific places. What he’s doing here is manipulating the game’s X coordinate table for the sprites. By moving objects to specific places, he’s manipulating a section of the game’s memory to hold specific values and a specific order. It’s a meticulous process that likely took a lot of practice to get right.

Once the table was setup properly, [SethBling] needed a way to get the SNES to execute the X table as CPU instructions. In Super Mario World, there are special items that Mario can obtain that act as a power up. For example, the mushroom will make him grow in size. Each sprite in the game has a flag to tell the SNES that the item is able to act as a power up. Mario can either collect the power up by himself, or he can use his friendly dinosaur Yoshi to eat the power up, which will also apply the item’s effects to Mario.

The next part of the speed run involves something called the item swap glitch. In the game, Mario can collect coins himself, or Yoshi can also collect them by eating them. A glitch exists where Yoshi can start eating a coin, but Mario jumps off of Yoshi and collects the coin himself simultaneously. The result is that the game knows there is something inside of Yoshi’s mouth but it doesn’t know what. So he ends up holding an empty sprite with no properties. The game just knows that it’s whatever sprite is in sprite slot X.

Now comes the actual item swap. There is an enemy in the game called Chargin’ Chuck. This sprite happens to have the flag set as though it’s a power up. Normally this doesn’t matter because it also has a set flag to tell the game that it cannot be eaten by Yoshi. Also, Chuck is an enemy so it actually hurts Mario rather than act as a power up. So under normal circumstances, this sprite will never actually act as a power up. The developers never programmed the game to properly handle this scenario, because it was supposed to be impossible.

If the coin glitch is performed in a specific location within the level, a Chargin’ Chuck will spawn just after the coin is collected. When the Chuck spawns, it will take that empty sprite slot and suddenly the game believes that Yoshi is holding the Chuck in his mouth. This triggers the power up condition, which as we already know was never programmed into the game. The code ends up jumping to an area of memory that doesn’t contain normal game instructions.

The result of all of this manipulation and glitching is that all of the values in the sprite X coordinate table are executed as CPU instructions. [SethBling] setup this table to hold values that tell the game to jump to the end credits. The console executes them and does as commanded, and the game is over just a few minutes after it began. The video below shows the speed run but doesn’t get too far into the technical details, but you can read more about it here.

This isn’t the first time we’ve seen this type of hack. Speed runs have been performed on Pokemon with very similar techniques. Another hacker managed to program and execute a version of single player pong all from within Pokemon Blue. We can’t wait to see what these game hackers come up with next. Continue reading “Reprogramming Super Mario World from Inside The Game”

Teaching Mario to Play Pong and Snake Through Innumerable Exploits

This is the coolest classic Super Nintendo Entertainment System (SNES) hack we’ve seen in quite a while. What you’re seeing is called “Super Mario World (Total Control)” by [Masterjun]. Our first recommendation is that you watch the video, then come back here for an explanation. Similar to what we saw for Pokemon Yellow on Gameboy, [Masterjun] created entire Pong and Snake clones within Super Mario World. He also created a menu and ending screen, along with his trademark smiley face graphic. Even more amazing is that this was unveiled live on a real SNES running an unmodified game cartridge. [Masterjun] actually used dual multitap cables, effectively connecting 8 controllers to a SNES. This gave him enough bandwidth to quickly download his new binary through the controller ports alone.

Welcome to the world of Tool Assisted Speedruns (TAS), where emulators and scripts are used to create high-speed runs through video games. The runners often work frame by frame, painstakingly inputting commands to create the perfect run. Game bugs and glitches are often exploited in these speed runs. In fact, in runs such as this one, the speed run takes second place to showing off the exploit. The output of speed run creation is a script file of control inputs which can be executed on an emulator to “re-run” the TAS at any time. This script can also be saved to a PC or Raspberry Pi and played back into the controller port of a real game system. A PIC based hardware translator is used to convert the data to NES or SNES controller format. As one might expect, these scripts run open loop. With no feedback from the running game, they can and do become desynchronized due to differences in console hardware, such as the tolerance of the oscillator crystal. When everything is in sync and does work , the results are awesome.

Continue reading “Teaching Mario to Play Pong and Snake Through Innumerable Exploits”

Wireless SNES Controller for Logitech Receiver


A while back, Logitech introduced their version of a wireless interface for keyboards, mice, and other human-oriented peripherals. Yes, they could have used Bluetooth, but that’s neither here nor there. What we do know, though, is that it’s now possible to stuff one of these Logitech transmitters into a Super Nintendo controller, allowing it to operate with your fancy-schmancy wireless keyboards and mice.

[Warrior_Rocker] wanted to retain as much of the stock appearance of the original controller as possible. To do this, he salvaged the Logitech transmitter from an old handheld Logitech keyboard/touchpad combo. The membrane of the keyboard connected directly to the transmitter, meaning tracing out the connections of the membrane to each pin was required to get a button mapping that made sense.

Once the lines of the SNES controller were wired up to the transmitter, [Warrior] needed a way to power his new wireless controller. The old keyboard used a pair of AA cells wired in parallel. With two AA cells, the keyboard had about a year of battery life, so with a single AAA cell, [Warrior]’s SNES controller should last a few months or more.

Except for a switch and a missing cable, [Warrior]’s wireless controller looks exactly like a stock controller. Pretty impressive, given this build is the product of stuff he just had lying around.

SNESoIP: It’s exactly what it sounds like


Here’s a cool hack for those of you wishing to play some retro multiplayer SNES games online!

[Michael Fitzmayer] is a resident hacker at shackspace; der hackerspace in StuttgartHe’s come up with this clever little ethernet adapter network-bridge that can share local controller-inputs over the internet. The entire project is open-source, and readily available on github. It’s still in the early stage of development, but it is already fully functional. The firmware is small and will fit on an ATmega8, and by the looks of the component list it’s a fairly easy build.

He’s even integrated a switch mode (hold B and Y during boot), which avoids trying to figure out which controller will be player one! After all, don’t you remember untangling the controller cords, trying to figure out which one is which?

We know you had a favorite controller and would give the other “crappy” one to your guest.

Example video is after the break.

Continue reading “SNESoIP: It’s exactly what it sounds like”

SNES headphones scream out for Bluetooth control


Here’s a build that just exudes nerd cred. It’s an SNES controller modified into a pair of headphones, straight from the workshop of [lyberty5].

The build began by stealing a controller from a PAL SNES and carefully dremeling the buttons and d-pad loose from their plastic frame. The PCB was cut in half, and the remaining plastic was carefully crafted into round speaker enclosures with the help of some epoxy. hot glue, and possibly a few pieces of styrene.

The result is a perfectly formed pair of SNES headphones, with a build quality right up there with the best case mods we’ve seen. Unfortunately, while the buttons are still attached to the PCB, they don’t do anything. We’re thinking a small Bluetooth adapter – or even repurposing a set of Bluetooth headphones with volume and play controls – would be a wonderful use for the 20-year-old, candy-like buttons.

Still, an awesome build, and [lyberty5] really shows off his craft by constructing these wonderful headphones. You can see the time-lapse of the build after the break.

Continue reading “SNES headphones scream out for Bluetooth control”

Hacking a PAL SNES to output 50Hz or 60Hz with a single switch


[Derecho] grabbed a PAL format Super Nintendo but wanted to make it play nicely with a 60 Hertz NTSC screen. His hack added a single switch to choose between 50 Hz and 60 Hz.

Take a look at the image above to see his alterations to the mainboard. The jumpers soldered to the two chips at the top are by far the trickiest part of the project. Each of the pins he soldered to needed to first be lifted from the PCB pad so that they no longer make contact with the etched traces. The technique he used involves heating the pin with an iron, then gently lifting it with a pin or a razor knife/blade. If you’ve got some experience populating SMD boards with a handheld iron this shouldn’t prove too difficult. The rest of the hack involves adding a 3-position switch (along with a 2k2 resistor) to choose between output modes based on what format game is being played.

Retro gaming just in-case


You can look and look, but you won’t find a Super Nintendo inside of this retro gaming rig. [Webrow] is giving his vintage hardware a rest, and taking this all-in-one game emulator suitcase wherever he goes.

The machine at the heart of his build is of course a Raspberry Pi. You really can’t beat the ubiquitous board for cost, power, and hardware extensibility. An LCD panel from a broken laptop comes along for the ride having been mounted in the lid. For a long time there was no hope for reusing these panels, but [Webrow] found an adapter board (for nearly the same price as the RPi) which converts the DVI from the Pi to the LVDS needed by the screen. The connections and mounting scheme for the screen were where most of the project work was done. Connecting the controllers simply involved soldering some SNES controller sockets to an RPi breakout connector. We do have to compliment him on the red bezel which hides all of the power cords and other unsightly bits. The case look sturdy and ready to play!