Previously on Proof of Concept:
*The theoretical minimum score to get in Super
Mario Bros. is 500.
*Jump over the first two, move back slightly
so the third parakoopa lands, then run underneath
it and jump to the next section.
*So all we need to do is manipulate Mario
so that he is further to the right of the
screen than normal to get into the warp pipe
before the level data reloads to the correct
target.
*A subpixel frame perfect wall jump to get
underneath the coins.
*We just proved that we can beat Super Mario
Bros. with only 500 points (or 600 in PAL).
*... at least until we explore all 256 worlds.
So, is it possible to get lower than the theoretical
minimum score in Super Mario Bros.?
Well, yes.
However, we're going to need to understand
more than just game mechanics.
We're going to need to dive in to inner workings
to get to the Minus World and all 256 worlds
in the game.
We're going to need to understand the mechanisms
of the world index.
We're going to need to explore another version
of the game.
And finally, we're going to need to take a
break...to play Tennis.
So, this is ChampionAsh5357, and you're logging
into Proof of Concept.
So, why are there 256 worlds when you can
only play eight?
Let's look at the PRG ROM of the game.
Starting at address 0x1CB4, the world code
for the programmed eight levels are laid out
followed by the area codes for each world
in order of which the player can reach first.
Not all worlds contain four levels.
This is because the transitions are their
own level.
To determine which area the game is supposed
to load, three things occur.
First, the world value is updated during the
loading screen.
Second, the world pointer starts counting
from 1 at 0x1CB4 until it reaches the specified
world.
Finally, the area pointer starts counting
from 0 at 0x1CBC to not take the eight world
codes into account.
The area pointer will then keep cycling forward
one each time a flagpole is touched until
an axe is touched to redo the world pointer
and area pointer calculation again.
Since the world reader is just a simple byte
pointer, it can technically read all 256 values
for the world and area.
So, the world pointer and area pointer will
start from the correct address offset, but
will have values pointing to unregistered
worlds causing some degree of arbitrary code
execution to occur.
So, now that we have an understanding on how
the game chooses which areas to load, let's
go back to routing the game.
In game, there is one arbitrary code execution
able to occur: the Minus World.
The Minus World is technically world 36-1
according to the game.
However, the look on screen has a blank space
followed by a -1.
This is because of the tiles stored in the
Picture Processing Unit or PPU.
To make life easier on the developers, they
mapped the number count directly to its PPU
tile since they didn't intend for worlds past
eight to exist.
In this case of 36, the tile takes the color
of the current background to use like a spacer
or air in worlds.
So, it appears blank when viewing on the world
screen.
Now how do we get to the Minus World?
Well, we are going to need to use the Alternate
Pipe Glitch once again in the warp zone in
1-2.
For an unknown reason, the default warp zone
loaded into memory is the one in 4-2.
However, there is only one pipe leading to
world 5 in the middle.
There are two other pipes are there, however,
they have been blanked out using tile 36.
So, if we don't trigger the scroll lock to
update the warp zone, then we can go into
the first or last pipe in the 1-2 warp zone
to get taken to 36-1 or the Minus World.
Lucky for us, speedrunners have already found
a method to do this.
However, this does require frame perfect accuracy.
When you get to the pipe at the end of 1-2,
stop for a moment and line up at the beginning
of the 6th blue tile from the pipe.
Then, start walking towards the pipe.
When you start to pass the 2nd blue tile from
the pipe, input jump for one frame.
If you hold it more than one frame, you'll
land on top of the pipe.
If you're too far away from or close to the
pipe, you'll just hit the pipe border.
However, if done perfectly, you'll clip about
halfway into the pipe.
Now, start holding left so that the wall pulls
you in instead of pushes you out.
As soon as you land, start holding right again
and you should make it through to the warp
zone without loading it.
Jump into the leftmost pipe and you'll be
taken to the Minus World.
Now, as most people know, in the NES versions
of the game, the Minus World leads to the
underwater section of 7-2 because of the pointers
to the enemy layout data.
You can never complete this world as any pipe
not set cycles back to the beginning of the
loaded area.
However, in the Famicom Disk System (FDS)
Version, there is a different story.
This is because the starting pointers for
the world and area data is offset eight more
than the NES versions causing the enemy layout
data pointers to be eight different as well.
This allows the pipe to take Mario to an underwater
version of 1-3 with an enemy layout of 8-4.
When completing this level, it takes you to
World -2: a identical replica of 7-3.
Upon completing this level, you will be taken
to World -3: an underground version of 4-4
with an enemy layout of 7-2 I think.
Upon completing this level and touching the
axe, you will be taken back to the title screen
with it being treated like you completed the
game.
So, we now have a new route through the game
in the FDS version.
In this route, we only need to play five levels:
1-1, 1-2, -1, -2, and -3.
So, the theoretical minimum is 500 points
again.
Eliminating the warp zone and castle level
points like last time brings us down to 300
points.
There is also one more point save in -1 because
of a quirk with flagpoles.
In Super Mario Bros., flagpoles are only in
an overworld setting.
However, since we forced the flagpole to appear
in a different pallette, the game doesn't
recognize it as a flagpole, rather just a
level progressor.
This means that the flagpole won't give any
points when Mario touch it.
This brings our theoretical minimum down to
200 points.
Since we've already gone over 1-1 and 1-2,
let's start with -1.
-1 is like an underwater level without anything
that can make it difficult.
The only caviat is that when you touch the
flagpole at the end.
Do not swim too high or you'll land above
the trigger block that tells the game that
Mario has completed the level, essentially
softlocking the game.
-2 is pretty much the same running experience
as 4-1 with a tight jump near the middle of
the level.
Mario has to jump over the coins to land on
the platform and then either move to the left
or jump over the koopa moving towards him.
You should barely be able to do one of these
two options.
Finally -3 introduces the newest challenger
to the game: the Blooper.
Bloopers in this level are incredibly annoying
and you have to take your time manipulating
them to the right location so that you don't
accidentally die or kill them.
It is the most annoying thing in the world
to play this level over and over and over
again.
But, it's still beatable.
So, is it possible to get 0 points in Super
Mario Bros.?
Well, three things need to be true.
First, the points score must be at zero obviously.
Mario needs to touch an axe to trigger the
world pointer to update.
Finally, the world needs to be 8 or higher
since the game ends whenever the world value
is greater than or equal to 8 when the world
change is triggered.
Looking at 1-1 again, it's impossible to meet
any of these three requirements.
There is only one pipe in the entire level,
and it is not a warp zone pipe.
The pipe also doesn't allow us to change its
warp location since there is only one warp
location in the entire level.
The flagpole also rejects any cheese thrown
at it making it impossible to complete 1-1
without getting at least 100 points.
However, we still have one more trick up our
sleeve: Tennis.
"Uhhh...how does Tennis have anything to do
with Super Mario Bros.?"
Well, it doesn't, unless we do some cartridge
tilting.
Cartridge tilting is when you wiggle a cartridge
from side to side until it enters a state
where its not fully connected to the console
but not completely disconnected.
This can freeze, hang, crash, erase your data,
corrupt your data, ruin your cartridge, or
damage your hardware.
I highly recommended not doing this unless
you absolutely want to pull off what I'm about
to do.
The reason this works is that NES games only
clears RAM if their score byte is higher than
10 or if their signature byte (the last byte
in RAM) is different than the game's.
Tennis and Super Mario Bros. both have the
same score storage and signature byte causing
RAM not be cleared when cartridge tilting
between them.
This means that we can store RAM values from
either game and use it in Super Mario Bros.
Now, before explaining what I did to make
this work, I have a confession to make.
I do not own an NES-101 to perform this glitch.
So I can't accurately say that this is possible
from my own testing.
However, I can prove that it is completely
possible to pull it off on console while I
pull it off on emulator, and I'll explain
why later.
So how did I get around the console limitation?
Well, using BizHawk, I can copy the RAM values
between each game and soft reset causing it
to act like I just cartridge tilted.
Now for the details.
In Super Mario Bros., 0x07FD in the RAM stores
the last world the player was in before they
died in game.
When holding A + Start, the game warps the
player back to last world they were playing.
In Tennis, 0x07FD stores how many steps the
player took in the game.
This means that we can choose which world
to load based on how many steps the player
takes in Tennis.
So, now we have a new condition on the list.
We need to load a world in which the first
level has an area code of a castle level.
The good thing is 39 out of the 256 worlds
or roughly 15% start with a castle level.
That number is actually more like 10% due
to some levels with enemy layout data that
crash altogether.
The first playable castle level is C-1.
So, we need to take 12 steps in Tennis to
correctly load up the world with the level
we want.
Let's get started.
First, load up Super Mario Bros.
Start the game and then start cartridge tilting
until you get a glitched screen.
If you are emulating this process just copy
the RAM values in the hex editor and open
the other ROM.
The reason we start a game in Super Mario
Bros. is that the A + Start method can only
be accessed if the player has been in a game.
So, by doing this, we tell the game that we
have played at least one game so the A + Start
should be allowed if we get back to the title
screen.
After cartridge tilting, put in Tennis and
soft reset.
Load up whichever difficulty you want and
serve the ball (press A twice).
The easiest way to line up the 12 steps is
to go forward until your feet just touch the
midline and then go right until you stand
on the intersection of the three white lines.
This will set the last level data correctly.
Start cartridge tilting once again or copy
the RAM data.
Hold A before soft resetting with Super Mario
Bros. in so that you can A + Start into the
world set.
If you did all this correctly, you should
load into C-1: an underwater version of 1-4.
Swim to the axe and finish the game.
Now, what about console verification?
Well, lucky for us, Business Insider posted
an article about this glitch back in 2015
with a GIF of C-1 with zero points after cartridge
tilting.
This means that someone else has verified
on a console that it is possible to beat the
game on console.
Yeah!
We just proved that Super Mario Bros. can
be beaten with 0 points.
Also, this is completely viable in a speedrun.
The rules of Super Mario Bros.
Any% say to beat the game as fast as possible
by 'any means necessary'.
Now, they do have the end goal at the axe
in 8-4, but all you have to is not go right
when you reach the line in Tennis and then
soft reset into Super Mario Bros. to load
into World 8.
Even if you have to start the timer from before
cartridge tilting, its still much faster than
any run currently on the leaderboard.
So, technically, we can set a world record.
This is ChampionAsh5357 logging out.
I'll see you next time!
