When one buys a computer, it should be expected that the owner can run any code on it that they want. Often this isn’t the case, though, as most modern devices are sold with locked bootloaders or worse. Older technology is a little bit easier to handle, however, but arbitrary code execution on something like an original Nintendo still involves quite a lot of legwork, as [Retro Game Mechanics Explained] shows with the inner workings of Super Mario Brothers 3.
While this hack doesn’t permanently modify the Nintendo itself, it does allow for arbitrary code execution within the game, which is used mostly by speedrunners to get to the end credits scene as fast as possible. To do this, values are written to memory by carefully manipulating on-screen objects. Once the correct values are entered, a glitch in the game involving a pipe is exploited to execute the manipulated memory as an instruction. The instruction planted is most often used to load the Princess’s chamber and complete the game, with the current record hovering around the three-minute mark.
If you feel like you’ve seen something like this before, you are likely thinking of the Super Mario World exploit for the SNES that allows for the same style of arbitrary code execution. The Mario 3 hack, however, is simpler to execute. It’s also worth checking out the video below, because [Retro Game Mechanics Explained] goes into great depth about which values are written to memory, how they are executed as an instruction, and all of the other inner workings of the game that allows for an exploit of this level.
Continue reading “Arbitrary Code Execution Is In Another Castle!”


The electronics are based on a Teensy LC programmed to appear as a USB keyboard, and the buttons are standard push buttons. The insides are wired together with nylon conductive tape. LEGO was an appropriate choice because the Teensy and switches are built on top of LEGO compatible PCBs, so components are just snapped in place. The system is called 

Time marches on, and after a while, the Raspberry Pi 2 was released. By this time, retro emulation was hitting the big time, and [Liam] decided it was time for an upgrade. He disassembled this Nintendo console again, routed new wires and inputs to the original controller ports, and used a Dremel to route a few holes for the HDMI and SD card slot.

