ฝัง
- เผยแพร่เมื่อ 14 มี.ค. 2021
- This video explains the process that went into discovering a buffer overflow exploit and using it to execute any script command at will, including a warp to the credits sequence.
For the original low-optimized tool-assisted demonstration of this credits warp: • [LOTAD] Paper Mario: T...
Thanks to:
SolidifiedGaming: / solidifiedgaming and / solifiedgaming
PistonMiner: / pistonminer and github.com/PistonMiner
Zephiles: / zephiles_ github.com/Zephiles
---- Paper Mario 64 ACE ----
Original proof-of-concept explanation: • (Proof of Concept) ACE...
The discovery: / 1363071307521265664 • Pm64 ACE
Rain: / rainchus / @rainchus
Fray: / @frayssb
MrCheeze: / mrcheeze_
Masterjun's SMW ACE Demo: • [TAS] Super Mario Worl...
Japanese subtitle translation by Discord user: 𝓓𝓲𝓼𝓬𝓸𝓻𝓭✓ᵛᵉʳᶦᶠᶦᵉᵈ 0554
_____________________________
Twitter: / tasmalleo
Twitch: / tasmalleo
Join my Discord! / discord
Intro/Outro by TheSneakySpy: / thesneakyspy and / thesneakyspy
Check out Mario Kart Wii TASes: mkwtas.com - เกม
![[Vowel]물고기는 물에서 살아야 해🐟🤣Fish have to live in the water #funny](http://i.ytimg.com/vi/3G9MH063Cx4/mqdefault.jpg)
I'll be updating this comment with information that should clarify any frequently asked questions or mistakes that are discovered in the video.
- At 36:17, the fake EVT structure shown is actually the data stored in the fake structure the frame AFTER the credits mapchange function call is executed... This causes nextCmdPtr to be updated to what the game expects to be the location of the next command to be executed. Also, since the game executed this event, it updates timeScheduleToRun, which tracks how long the event should run for. This means it will lower timeScheduleToRun's value because of this.
Dont forget to pin this comment 😊
^^^
pin this
@@wynteranju every time he edits it it unpins, but as long as it has enough likes to be near the top it’s good
so it's not ACE, but ASE? nice, both can be pronounced the same way
As it turns out, this whole time, the secret to defeating the Shadow Queen was hidden deep into the 100+ page terms and conditions of some random store's reward system; it's just that nobody ever bothered reading that far before Mario.
Please let this be a popular comment
@@Kierio04 you jinxed it
@@TreeFlob Id say that was an antijinx
The shadow queen is wise to hide secrets in the TOS
@@Kierio04 such a wise lad
The history of breaking Paper Mario 2, aka figuring out how to take Frankly literally everywhere, including the Credits
When the video is longer than the run itself.
Finally, the 17 year journey of keeping Frankly, the best partner, even until the end credits, is complete. And in the process, we managed to complete the game pretty quick, too. Neat.
this is flavio erasure
Friendship with Flavio ended
Now Professor Frankly is my new best friend
frankly >>>>>>>>>>>>>>>>> flavio
This is fucking insane, I remember 3 years ago that I watched the 2:25:28 tas and thought that was the peak of the game, but a few years later, it went down to sub-2 hour, and then I thought that was the holy grail and nothing could ever beat it forever, 8 months later, 25 minute tas
The cherry on top would be EFF Overflow Palace Skip
Now we need to figure out how to ACE flavio into the party for the credit warp, just so he's there
42:07 Cannot believe I was mentioned in a TASMalleo video. Shaking rn.
17 YEARS later. Godspeed, this is one of my favorite games ever, and seeing ACE discovered on it was the highlight of my day.
Don’t wanna ruin the comment or get flamed but TECHNICALLY it isn’t ACE
@@Kierio04 Yes and no. This definitely opens up the door to it, and I'd argue it's certainly a rudimentary form without having full control, but I see what you're saying
@@celestialowl8865 agreed 😃
there's also the insane PM64 ACE
I didn't understand a word of what I just watched, but I know by the tone of Malleo's voice how excited he is about this discovery and I couldn't help but feel the infectious energy emanating from every description throughout the entire video. As we say on twitch, long time lurker of your channel. You're amazing!
I respect that you always have subtitles on your vids. I personally don't need them, but it's kinda annoying that even the biggest youtubers write scripts and don't bother to put subs up. Great stuff Malleo!
I literally just copy-paste it and TH-cam automatically times it. It boggles my mind that other people don't do it
@@Malleo my experience with writing scripts for things is like, i typically dont follow them verbatim, or i change things as im recording different takes (typically if i notice a phrase being used too much), so what i say doesn't always match what i wrote exactly. tho i dont have a youtube channel for this kind of stuff so i dunno
It's an essential accessibility feature.
I personally like to have subs on so if I miss something I can just glance down instead of having to rewind constantly. My hearing's fine, but my attention wanes and it helps a lot with comprehending this kinda stuff.
It’s Mullkaw 👀
I love how the video explaining how you can win the game in 25 minutes is longer than the entire theoretical playthrough would've been.
"Mr. Shopkeeper, tear down this door!"
More seriously, great work, this is wild!
This method of ace is super cool, because it combines traditional ace - memory manipulation and understanding of execution - with something akin to mario 64’s cloning. Great stuff!
That reminds me, why haven't we found ace and or a credit warp in mario 64 yet? Millions of ways of crashing without cheats, notoriously glitchy, an *almost* unlimited cloning bug, but no ace and or credits warp? Strange. Maybe it wouldn't be any faster? I don't know.
Sometimes I wonder whether the internet and technology was a good addition to mankind. But the complexity and methods with which some communities navigate simple creations like TTYD to me resembles the beauty of chaos in the universe itself. Keep that passion alive.
21:34 "Eight zero four zero F zero D zero"? I think you mean "Eighty Fourty F-ty D-ty"
I love myself a good arbitrary code execution, even if it's technically just a script.
I'm not sure you realize just how fucking hyped I was to hear about this after the perfectly timed drop in The Ultimate Show.
Same
Honestly, all of this is basically archmage-tier sorcery to me, and unlike a magic trick explaining it actually makes it more interesting, even though i barely understand a goddamn thing you're saying since it's vastly outside of my realm of awareness.
Keep on making these, they're beautiful
I can't figure the people who feel that having an ACE or buffer exploit or the sort to credits warp 'negates' the point of speedrunning. As mentioned, it just makes a new category fork. It's like saying that the existence of TASrunning negates the point of a person speedrunning a game on the console. Your category exists, the game is still there, and there's still untapped saves and tricks and glitches to find. It doesn't negate the work for routing a no-credits-warp run or finding new tricks to save tremendous gaps of time for a 100% run or whatever you prefer to run or watch... just as having people playing the game for fun doesn't negate the sheer amount of research and work and planning that went into this. So kudos on this. An amazing achievement!
underrated comment
I feel like Toadette wondering if this is the last time we'll ever see a video of TTYD on Malleo''s channel :(
Hopefully not. I'm sure there will be more TAS developments in other categories, such as 100%, or any further developments in Any% No ASE.
Other time saves might still be found in the Prologue, like a plane panel skip or being able to do ACE on the NTSC version, allowing Goomba Trio skip
2011: What ticking?
2021: BEEEEEEEEEEEEEEEEEEE
User Funk sounds like a fun genre of music.
But seriously, this is phenomenal. I LOVE hearing all the specifics behind these glitches, the pure Rube Goldberg Machine of actions that make it work is bizarre and compelling. Great job!
User Funk is the smell of gamer.
This is literally insane! Super high quality video, thanks for the dedication. Greetings from Germany.
"By no stretch of the imagination is this humanly viable" So.. Give it a year, then?
Now if only speedrunners could find how to skip to the credits of my work shift.
Great video malleo!
This game should be run at a GDQ Event now with these new discoveries.
If this is console verifiable it absolutely should be! Although they usually stick to shorter or more understandable things for the crowd who don't understand the techy stuff.
Gdq doesn't deserve this.
Unless something has changed, many of the inputs required in the credits warp are literally impossible to perform on an unmodified controller. Notice how many of the control stick inputs are outside the normal range of possible input, and how on at least one controller every single direction is held down at the same time. That mixed with incredible precision makes this current route not viable to ever be shown at gdq in an rta run. GDQ's tas block is not particularly favorable for tases, and reading a sign for 9 minutes doesnt seem "flashy" enough for them.
26:58 Mario in sync with the music, nice
I really want to see a history of Solidified Gaming and all the contributions she has made to finding info on this game. I hear her name all the time
And every other game
Love the use of Super Paper Mario music here. The finality of The Ultimate Show for the holy grail of glitches. The way Count Bleck's theme takes hold as you reach what can only be considered the end of an era, the end of what we know as TTYD TASes, and hoping that from the ashes a new world will rise from the framework you laid out. And as you approched your goal, A manic glee settles over the crowd, a triumpahnt fanfare as the chaos heart does its magic, as you exit the menu from pause hammering.
That was what you wanted, right? To destroy the world, to destroy TTYD Speedrunning in order to reshape it into something better?
But you know your task is not nobel. There are those who will be hurt. Runners who dislike games with credits warps. But once you started down this path, you knew there was no stopping; someone else will simply pick up where you left off. The Dark Prognosticus is the true prophecy, after all, and nothing will stop the community from finding the ultimate time save.
And in your final moments, you acknoledge what you did may cause strife in the community, just as Blumiere reflected on his own actions.
Oof, sorry, got a little poetic there. SPM is a good story, okay?
TL;DR: Super Paper Mario has some Bops.
(a) I'm pretty sure this is currently humanly impossible, no-one's going to do it anytime soon unless there's some new discoveries.
(b) Even if they do... new category, just like every humanly possible credits warp.
Edit: Malleo said the exact same thing at 37:33. It's just a simple understanding of how speedrunning works.
@@btf_flotsam478 @BTF_Flotsam I know, I just wanted to write something that sounded cool :V
also, just because its not human viable doesnt mean it wont be soon. It took the OOT community a few weeks tops to make human-replicable strats once they found SRM.
Also, even just having a credits warp is enough to turn runners off certain games, even when they are separate categories. The fact i
I’m pretty sure the sum of all human knowledge has been applied to TTYD speedrunning
That's discounting the work put into SM64
Has there ever been a moment where they found something significant after a credits warp was discovered? Wording's got me curious.
Really depends on your definition of "significant". Generally after credits warp is found, a few months to a year of optimizing the credits warp route happen, after that people generally return to warpless or 100% categories. As a general rule of thumb, the longer a speedrun is, the more opportunities for time save, new discoveries, and general improvement there are.
I mean, SMB3 has a faster TAS only credits warp that was discovered later, which is the exception
If the EFF Overflow is found to be possible, would you consider doing a new "no credits warp" TAS?
I'll generalize your question to: If a Yoshi-less Palace Skip is found, would I consider doing a new any% no Arbitrary Script Execution TAS? Yep, I would!
@@Malleo awesome! I really love the commentary on your ttyd tases, so i would have been sad if you wouldn't want to continue them.
This reminds me of class. I just did an entire lesson and I don't think I learned a single thing.
Not because the video is bad mind you, I'm just dumb.
same it just blew over my head lol
yeah man either your brain is able to process this stuff or it isn’t. mine unfortunately isn’t but damn if it isn’t fun to watch
You're not dumb, you just don't have any background in computer science. If you had, I'm confident everything would make more sense. I don't have one either, I tried to follow and pause for a while to figure stuff out but there's just too much you don't know when you have zero knowledge of programming.
I'm sure Malleo did a great job of explaining it but you need to have a basic understanding of coding/programming to really appreciate it I think. (Or I'm just dumb but I don't seem to be the only one)
Someone with a bit of programming and computer science knowledge here
I was spacing out the majority of the video :^)
I don’t even have TTYD, but watching the premiere of this was insane. Epic work!
When I heard Fault Lines, I was like, "Holy shit, he's using Mudeth music!"
Time to look for a credit warp on the Switch version!
Thank you for taking the time to make this video so in-depth and informative. Great job!
glad to see you found a better blimp ticket skip
I love hearing about games that you can overflow memory with and perform ACE. It’s the most benign version of hacking you could do.
Oh no, this is gonna give me headache, but its gonna be super cool
Edit: this is precisely what happened
the inclusion of the isaac antibirth ost in this vid got me way more hyped than it should have lmao
What a phenomenal video and explanation! Seeing the credits warp happen on stream was a surreal experience, and honestly the second it happened I was wondering when this video would be made, lol. Congratulations on having all of your hard work pay off! This is no small feat, and I can’t wait to see how this develops further in the future
Guess you could say you've finally aced TTYD.
But on a more serious note holy shit this is amazing
Ased*
lmao, it's so fascinating seeing people take apart and utterly dissect games and manipulate them to do some crazy shit. It's one of the reasons why i love watching speedruns, especially TASes
An incredible breakthrough!! Great work - can't wait to see this in a future TAS.
wow, the time save over even the previous holy grail of paper mario speed run skips makes this look like the first major bug to ever really save time
You lost me at the beginning and I was paying a lot of attention. I don’t think he started out “zoomed out “enough, you’re explaining the complicated talk to a fighting game to my dad or something, who doesn’t even know what neutral or advantage is. however, I must admit that this video is so genius that I was entertained the whole time even though it was practically in a different language. It’s an honor and a pleasure to see this. Thank you so very much
on one hand, I LOVE learning about how video games work under the hood, especially with your vids, since they're easy to follow for the uninitiated! on the other, I got so easily distracted during what would otherwise be laser focus that at 21:38, I caught myself yelling aloud, completing the sentence with "in the balls."
Being in chat for this reveal was truly special. Awesome work to everyone involved
I always love good detailed ACE explanations!
How wild. Very cool, thank you for the hard work to everyone involved.
I came across one of your TTYD vids a while ago and it introduced me to a world i never knew existed to the point where i might even one day get into speed running :) thank you so much for everything, you’re amazing
Incredible and historic as always. Amazing work!
Bro, this video was better put together than my Masters thesis I present next month. Great work!
I never understand videos like this that you post. Yet, every time you post one I literally get out snacks and drinks and set myself up to watch. I actually retain a thing or two.
Hope we get to see your 100% TAS soon!
Good job! Keep working hard and posting TTYD content!
this video does an excellent job at explaining this very complex topic. thanks for going to the effort of putting this together
love the content!
i've never played any paper mario games yet i adore discovering more and more about it
I've been looking forward to this video daily since I missed the livestream haha Thank you for all of your hard work!
Awesome Video as always, these make my day when they come out
26:59 Mario jumping in sync to the music
Got some grooving music choices in this video, man!
This is awesome. It’s incredible to see how my favorite game has developed so much over the past two decades.
Also so excited to see the commentated 100% TAS when it comes :D
This is wild. Amazing video, great explanations!
Love your stuff Malleo, keep it coming
Wow, very impressive! Inb4 there's code execution in Rogueport's Inn (the water drop possibly being the effect) - I'm sure there's going to be another area found, even earlier than the first chapter. Good luck optimizing!
Not sure why this was only recommended to me now, but holy shit what a video. That introduction hyped me up enough to watch through the entire thing in one sitting lol
Yo I ACTUALLY understood this *very* slightly. This is so cool! Well done!
This is insane, great video of explaining it, even if i still dont get 100% of it, its still extremely entertaining to watch!
This is some parallel universes type advanced shit. Amazing work.
So awesome! One of your greatest achievements I'd say!
Im learning CS and I love rewatching these videos to see if I understand a bit more than the last time i watched it
My favorite game has finally been cracked through and through. Jorb well done.
the work this community does is continuously mind-blowing. Thank you so much for the explanation Malleo! Deeply enjoyed your sentiment at the end, too.
Ace? Now I thought that was the place with the helpful hardware folks
This is super cool but it's also so nice you have friends who are interested and involved in your interests
21:26 I was quite surprised to hear this banger of a song in this video. Nice.
Amazing video, great technical explanations
I never understand a single thing Malleo says but holy shit everything in his videos are so cool
this was so cool, can't wait to see an RTA viable method in the future!
It is hard to believed when I was 8, I got addicted to this game. I would stay up all night playing ttyd. Im 16 now and still kinda addicted to the game. I think in my first play through when I was younger it took me 3 years to beat the game. Now when i play the game it takes me 8-10 days because I try to do a chapter a day but now we can do it in 30 minutes. My 8 year old mind would have blown up.
I was at the reveal stream, and I still am in shock!
very fascinating watch TASmalleo, cant wait to see what else this community had too offer
Me watching this video: "Ah yes, numbers and letters are simple and totally not complicated"
Also, congrats on further breaking my favorite RPG. While I'm not big into speed running, seeing people pour months, if not years of their lives into breaking down this game to it's absolute most basic structure is beautiful. Seeing as this has only been done because the game is worth the effort
Pressing down to increment your X position float by exactly 1. That is something else, man! I assume that's 1 in a million or 1 in a few hundred thousand at that position. Still better than subplanck-perfect!
Confirmed, TTYD is as broken as PM64. Glad to have made it for the premiere!
1:17 not gonna lie, the music sync is unbelievably satisfying
19:41 I was hoping Frankley would fall in the water again
Technically, this is another way to run homebrew on the GCN without any additional hacks.
That was amazing! Also, for some reason I didnt know SG was a girl 😅 Girl power!
Hell yea more power for us all
I hope ACE gets found in every game :)
That this takes place in Petalburg of all places definitely seems like the first thing that's likely to change in the future. Sure, that's only chapter one, but TTYD offers quite a bit more maps to experiment with even before then, and surely one of them has the potential to mix the right batch of EFFs and EVTs just as a matter of probability.
Are the four file names adjacent in memory? They seem like the most immediate location that specific data could be written to for later usage.
We don't have a wide range of (what are essentially ASCII) values to write to the filenames to do what we need. So the filenames don't offer much for us sadly
This is absolutely mind blowing. Loved every moment despite being confused at many points. Genuine question though, how long do this take to figure out? Im just curious of how much it'd take to find this with such a complex process.
My guess is over 6 months. I recommend asking on his discord though
Absolute madness
Heck yeah, uncached RAM is OP for this! I can definitely see it used in more GC and Wii memory exploits in the future!
Didn’t expect you here
Yo, new content from Malleo, very noice
I would guess that the change of exactly 1 floating point value when moving down is the result of some float rounding error when transforming controller input from camera space to world space, with some vector math giving 0x00001 when it should give 0. Especially likely because the reverse isn't true for going upward, indicating that the camera angle isn't at any significant offset that should cause a noticeable change.
When you’re adding the Id to your fake event data structure, if events are loaded from earlier to later, how do you get an event to skip the part you’ve already written to? Is it because the effect to load is too large to fit? If so, there must be an event still loaded after the op code/flags - what effect could be so persistent?
We're at the endgame now. GG.
Incredible.