Super Mario Bros.: [TAS] Custom cutscenes through ACE

Video Description

In this video I showcase what can be done with Arbitrary Code Execution in Super Mario Bros. This TAS is a work in progress, and will likely be much longer. I'll likely make a video breaking down how this works after the TAS is finished, but in the meantime, here's the basics... As a brief note before I explain how this works, I've been making a video game and if you would wishlist it on Steam it would really help me out! Thanks! https://store.steampowered.com/app/2119470/Fantastic_Fist/ Anyway, let's talk about how Super Mario Bros. can be transformed into a video player, playing a NES port of the Travelling Salesman Problem. In a previous video I used ACE to win the game in N-2, which sets the stage to 8-4 about a minute and 15 seconds after turning on the console. Running the arbitrary code in this TAS will have the same setup, but the payload is obviously different. For more information on how this run is set up, why and how I'm in world 'N', please refer to this video: https://www.youtube.com/watch?v=xoDakIA31jc For this TAS, the code I write lets me read the controllers and store that data at a target address in RAM. Essentially I have complete control over what the console will execute, except I'm limited to 2 kibibytes of space. I'm overwriting most bytes in the stack here, but the idea is: Read the controller twice to set up the pointer to the target address, read the controller to determine the length of the code I wish to write, then read the controller n times to write the data there. Read the controller once more to determine if the PC should redo this loop, or read the controller 2 more times to set up one more pointer and jump that that target address. Bowser is defeated with fireballs triggering the ACE. I begin by blanking the screen and drawing a box, which I later fill in with text. During this time, I'm also writing a more sophisticated loop which let's me play custom music, but for this scene I'm simply using the existing code in SMB1 to play the victory music. My custom music engine works by reading the controller over and over again to set up the data for the NES APU. For any frame playing custom music, there's an average of 12 inputs dedicated just to the audio. After the custom Title Screen for Travelling Salesman is fully colored, I expand my loop to also allow OAM modifications (again, exclusively through reading the controller multiple times), which allows me to animate Mario running across the screen. In later sections of the TAS, I have around 56 inputs per frame, so optimizing the controller reading routine was absolutely critical. I can read an upwards limit around 230 inputs per frame, which is rarely needed, but it's nice to have it as efficient as possible. One of the fun challenges was to draw a custom character. The Super Mario Bros pattern table does not include a graphic for an 8x8 pixel question mark, yet I ask "Are you familiar with the travelling salesman problem?" To add that graphic, I assembled a series of sprites using a 2x2 pixel box into the shape of a question mark. Some of the boxes are sky colored to overlap other boxes and allow for thinner sections of the question mark. The section of Mario running to all the houses was the hardest part to make, as every frame has custom music, Mario moves (positions, animation frames...) and when he reaches a Toad House I change the color. A lot of work went in long before animating that section just so I could set up the palette information. If you look closely, each house is in a 16 pixel box without any "grass". I wanted to add some neat dithering details, but due to color palettes being divvied up into 16 pixel chunks, I wanted to attempt to seamlessly put houses among the grassy field. Anyway, the noisy patterns I used for the grass is actually compressed data the game uses for setting up the title screen. Who knew it could make for some nice dithering? Animating that section of the TAS was also a fun puzzle to work out, as I needed to get a good solution for the TSP with that arrangement of points. I intentionally kept the 2nd best route I found so when Toad says "Your route was suboptimal!" that is in fact true. For the 6502 savvy, you should know that I cannot use the NMI to wait for the next frame, as SMB1's NMI routine would run for thousands of CPU cycles before I could exploit an indirect jump back to RAM (wasting most of V-Blank). In order to wait for a new frame while maximizing CPU cycles, I'm running a loop that reads from address $2002, which is a PPU Register that can yield false negatives. To work around the false negatives, I wrote a function designed to waste exactly 1 CPU cycle when needed, which can prevent the race condition. If there is anything else that needs to be explained, I will attempt to answer in the comments. Anyway, here's a link to the TAS File: https://tasvideos.org/UserFiles/Info/638398423526853571 This TAS was made for Bizhawk 2.9.1 using the Subneshawk core.