TASBot Overwrites Super Mario World Memory to Run Games on Live SNES

invalidation

Exploiting sprite memory tables through custom eight-controller wiring allows players to commandeer console hardware and execute entirely new games without cartridge modifications.

AI-assisted summary of Super Mario World: Arbitrary Code Injection At AGDQ 2014, Performed Live — original source. Check the original for full context.

Source published: 2014-01-21

Key ideas

At AGDQ 2014, a TASBot demonstration used arbitrary code execution in Super Mario World to reprogram the console into running playable versions of Snake, Pong, and Tetris. (1:40)
Custom cables utilizing all 7 pins of both SNES controller ports emulated two multi-taps, effectively streaming input data across eight controllers simultaneously to inject game logic into RAM on the fly. (3:06)
The project originally aimed for 'Total Control' by attempting to inject and play the entire original NES Super Mario Bros. inside Super Mario World, but it was scrapped due to per-frame data transmission bandwidth limits. (3:06)

Detailed notes

## Background Published on YouTube by invalidation on January 21, 2014, this video documents a live demonstration titled "Super Mario World: Arbitrary Code Injection At AGDQ 2014, Performed Live." The description provides no extensive summary, directing viewers to the Games Done Quick website for further information.

## TL;DR At AGDQ 2014, a top-secret tool-assisted run of Super Mario World authored by Master Jun demonstrated live Arbitrary Code Execution on an unmodified Super Nintendo console. By performing frame-perfect sprite and P-Switch manipulations in Yoshi's Island 2, the run corrupted the console's Object Attribute Memory to redirect the processor into running custom code. Utilizing custom seven-pin wiring to emulate two multitaps and stream eight controllers' worth of input per frame, TASBot injected entirely separate playable games—including Snake, Pong, and Tetris—directly into console RAM on the fly.

## Atmosphere & style The presentation opens with palpable mystery and nervous tension amid a false start and uncleared save data, compounded by the fact that almost no one in the room knew what was planned. That suspense explodes into stunned disbelief and roaring cheers the second Super Mario World glitch-cuts into a fully working arcade game. The mood is electric, technical, and celebratory, shifting from frantic technical explanations to communal delight as attendees are invited up to play the freshly injected games live.

## Bulletin - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) At AGDQ 2014, a TASBot demonstration used arbitrary code execution in Super Mario World to reprogram the console into running playable versions of Snake, Pong, and Tetris. - [03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) Custom cables utilizing all 7 pins of both SNES controller ports emulated two multi-taps, effectively streaming input data across eight controllers simultaneously to inject game logic into RAM on the fly. - [03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) The project originally aimed for 'Total Control' by attempting to inject and play the entire original NES Super Mario Bros. inside Super Mario World, but it was scrapped due to per-frame data transmission bandwidth limits.

## Key takeaways - [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) The secret TAS run was finalized at midnight just hours before its AGDQ 2014 showcase, with only two people in the room knowing what payload would execute. - [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) Before the run could begin, operators had to reset the SNES and clear existing cartridge save data to ensure proper synchronization. - [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) The initial chaotic movements in Yoshi's Island 2 were intentional manipulations required to set up the exploit rather than player mistakes. - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) The exploit manipulated the SNES Object Attribute Memory (OAM) table by controlling sprite rendering and enemy interactions in precise sequences. - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) Stunning a flying item box tricked the game engine into assigning it Koopa shell properties, helping reshape memory tables into executable machine instructions. - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) Redirecting execution into manipulated memory transferred complete CPU control over to the injected payload, immediately transforming the game into Snake. - [03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) No ROM patches or cartridge modifications were used; all injected mini-game data was streamed directly through the console's standard controller ports. - [03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) Standard retail SNES controller cords wire only 5 lines, but custom wiring hooked up all 7 pins to exploit the secondary data line and I/O select pin. - [03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) Emulating two multi-taps provided TASBot with the bandwidth of eight simultaneous controllers to write new game code directly into SNES RAM frame by frame. - [03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) Live audience members and attendees were able to plug in controllers and actively play the injected games like Pong on stream. - [03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) Hardware throughput limits prevented the team from achieving their original 'Total Control' goal of streaming and playing the complete NES Super Mario Bros. live.

## Detailed walkthrough ### [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) Setup, False Starts, and Introduction of the Secret Run

The run opens with an air of mystery and tension as the commentators scramble to get the console properly prepared. The announcer confesses that even the event staff were kept in the dark about what was about to happen: “Whatever this run is, they wouldn't even tell me what it was.” After counting down to power on the system, the operators realize that the save file has not been cleared from the cartridge. Wondering if the wrong game cartridge was inserted, they quickly reset, restart the console, delete the necessary save data, and switch the display feed back over to the Super Nintendo.

Once the display syncs, the nature of the demonstration is officially revealed. The commentary explains that this run is a *Super Mario World* tool-assisted speedrun (TAS) authored by Master Jun. While earlier remarks suggested it might already be archived online, the speaker corrects the record, noting that this run was not yet featured on the TASVideos site. The run had literally been completed around midnight the previous evening, with the team testing it late into the night. Because of the extreme secrecy surrounding the run, only two people present in the room knew what was actually about to unfold on screen: Allan and the co-host. As Mario enters Yoshi's Island 2 and begins executing bizarre movements, the audience is warned not to dismiss the chaos as mistakes: “Everything that you're going to see here is seemingly random, completely intended, despite what it might what it might look like.”

```mermaid flowchart TD accTitle: TAS Execution Setup and Initialization accDescr: Sequence showing setup fixes leading into Master Jun's Super Mario World TAS run at AGDQ 2014. subgraph Setup ["Setup & Console Reset"] A["Console Power On"] --> B{"Save File Deleted?"} B -->|No| C["Reset & Clear Save Data"] C --> D["Switch Video Feed"] end subgraph RunStart ["Live Execution"] D --> E["Initialize Master Jun TAS"] E --> F["Enter Yoshi's Island 2"] end ```

- The run was finalized at midnight just the day before its AGDQ 2014 appearance. - Only Allan and his co-presenter were aware of what the payload would do when executed.

---

[01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) Glitching OAM and Executing Arbitrary Code Live

Mario begins executing frame-perfect item manipulations inside the level, prompting baffled reactions from the room. The commentator explains that Mario is deliberately manipulating the Object Attribute Memory (OAM), a memory table inside the SNES hardware that governs the visual and physical properties of all active sprites and tiles currently displayed on screen. By manipulating items and enemies in a exact sequence, the run forces specific numerical data directly into memory addresses that normally handle gameplay objects.

A critical mechanic of the setup involves a P-Switch. Mario manipulates a flying item box by stunning it, causing the game engine to treat the box as though it were a standard Koopa shell. By carrying, throwing, and interacting with these glitched entity states in tandem with coin transformations and block positions, the player can reshape the internal memory tables into executable machine instructions. The moment execution jumps from the level code into the manipulated memory buffer, the game violently glitches out and cuts away from *Super Mario World* entirely. The console screen turns into a fully functional clone of the classic arcade game *Snake*, drawing stunned gasps and a massive round of applause from the crowd. Over the applause, a $500 donation from "Tommy ref friends" is read: “I'm loving this TASBot run, great work everybody.”

- **OAM Table Manipulation:** The precise positioning and spawning order of on-screen sprites forces specific byte values into the SNES's Object Attribute Memory. - **Flying Box Glitch:** Stunning a flying item box forces the engine to handle it with Koopa shell properties. - **Arbitrary Code Execution (ACE):** Shifting program execution into memory written by player inputs hands full processor control over to the injected payload.

---

[03:06](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=186s) Multi-Game Mini-Games, Custom Multitap Wiring, and the "Total Control" Vision

As the *Snake* demo plays out on screen, the presenters invite an attendee named Tampa to grab an extra controller, hook it into the console, and play along. The commentator admits that the sequence escalated far too quickly to explain all the technical intricacies in real time: “I guess I'll take this opportunity to say I was hoping to be able to explain this in more detail, but I forgot how quickly everything happens.” Through arbitrary code injection, TASBot did not merely beat the game or trigger the credits—it took over the Super Nintendo's CPU to dynamically write and run completely separate games, including *Snake*, *Pong*, and *Tetris*, directly through the standard controller ports without any cartridge hardware modification or ROM patching.

To pump enough data into the console fast enough to assemble whole games on the fly, Allan had to construct custom controller cables. A standard retail Super Nintendo controller cable contains five functional wires, but seven physical pins exist. Allan wired up custom cables utilizing all seven lines to exploit the extra data line and I/O select pin found in multi-tap peripherals. By emulating two multi-taps via TASBot, the setup simulated eight SNES controllers simultaneously:

> “Each multi-tap can serve four controllers, so if you're keeping score, that means we just hooked up eight controllers to a Super Nintendo with really interesting results.”

This massive injection bandwidth made it possible to write new game logic directly into console RAM frame by frame. Once *Pong* appears on screen, players begin competing head-to-head on the live broadcast.

```mermaid flowchart LR accTitle: Custom Hardware Data Pipeline for Arbitrary Code Injection accDescr: TASBot routing data across eight emulated controllers into the SNES hardware. subgraph Inputs ["TASBot Interface"] TB["TASBot Replay Rig"] --> MT1["Emulated Multitap 1 (4 Controllers)"] TB --> MT2["Emulated Multitap 2 (4 Controllers)"] end subgraph Hardware ["Custom Cables"] MT1 --> C1["7-Pin Controller Port 1"] MT2 --> C2["7-Pin Controller Port 2"] end subgraph SNES ["Console Execution"] C1 --> RAM["SNES RAM / OAM Buffer"] C2 --> RAM RAM --> Games["Injected Games:\nSnake, Pong, Tetris"] end ```

Allan then reveals that he just received permission to discuss the original ambition behind the project, internally known as "Total Control." The developers had originally intended to stream the entirety of the original NES *Super Mario Bros.* game into *Super Mario World*'s memory and TAS it live on stream. However, the bandwidth limitations of the SNES hardware ultimately prevented this feat: “We don't have enough time per frame to be able to do it, to be able to write the whole game.” Despite scaling back from a full NES emulator injection to a suite of classic arcade titles, the crowd and commentators celebrated the historic demonstration, with Allan taking a moment to thank the entire development and TASBot team who made the live run possible.

- Standard SNES controller cords wire only 5 pins, whereas Allan's custom cables wired all 7 to read the secondary data line and I/O select line. - Simulating two 4-player multi-taps allowed 8 controller inputs worth of data to be transmitted concurrently on every video frame. - The original "Total Control" goal of assembling and running all of NES *Super Mario Bros.* inside *Super Mario World* was scrapped due to per-frame data transmission constraints.

## Mentioned Super Mario World, AGDQ 2014, Master Jun, TASVideos, Allan, Tampa, TASBot, Tommy ref friends, Super Nintendo Entertainment System, Nintendo Entertainment System, Super Mario Bros., Snake, Pong, Tetris, Yoshi's Island 2

## Video description See http://gamesdonequick.com/ for more information.

[Source](https://www.youtube.com/watch?v=jnZ2NNYySuE)

中文简报

TASBot覆写《超级马里奥世界》内存并在实机SNES上运行其他游戏通过定制八手柄接线利用精灵内存表漏洞，玩家可在不改装卡带的情况下接管主机硬件并运行全新游戏。在AGDQ 2014上，由Master Jun制作的一段高度机密的《超级马里奥世界》工具辅助通关（TAS）展示，在未经改装的超任（SNES）实机上演示了实时任意代码执行。该演示通过在“耀西岛2”关卡中执行逐帧精准的精灵与P开关操作，损坏了主机的对象属性内存（OAM），从而诱导处理器运行自定义代码。TASBot利用定制的7针引脚接线模拟了两个多路分线器，每帧传输相当于八个手柄的输入数据，直接将《贪吃蛇》、《乒乓球》和《俄罗斯方块》等完全独立的可玩游戏实时注入到主机的RAM中。在AGDQ 2014上，TASBot演示利用《超级马里奥世界》中的任意代码执行漏洞，重新对主机进行编程，使其运行可玩版本的《贪吃蛇》、《乒乓球》和《俄罗斯方块》。 (1:40) 利用SNES两个手柄端口全部7个引脚的定制线缆模拟了两个多分线器，能够同时传输八个手柄的输入数据，从而实时将游戏逻辑注入RAM。 (3:06) 该项目最初旨在实现“完全控制”（Total Control），曾尝试在《超级马里奥世界》中注入并游玩完整的NES原版《超级马里奥兄弟》，但由于每帧数据传输带宽的限制而被迫放弃。 (3:06)

Reading summary

At AGDQ 2014, a tool-assisted speedrun demonstrated arbitrary code execution in Super Mario World, commandeering an unmodified Super Nintendo console live to run external games purely through controller inputs. Hijacking Console Execution via Sprite Memory (1:40) In a run authored by Master Jun, exact frame-perfect manipulations within Yoshi's Island 2 targeted the console's Object Attribute Memory (OAM), the hardware table regulating active sprites and tiles. The runner exploited an entity glitch by stunning a flying item box, tricking the engine into treating it as a standard Koopa shell. Interacting with these glitched item states alongside coin transformations forced specific numerical values into memory addresses that normally manage game objects. When the processor redirected its execution path into this altered memory buffer, the Super Mario World environment abruptly terminated, replaced immediately by an injected, functional clone of the arcade game Snake. Multiplying Input Bandwidth with Custom Wiring (3:06) Writing entire games into console memory in real time required significantly more data throughput than standard inputs provide. While standard retail Super Nintendo controller cables use only five functional wires, presenter Allan constructed custom cables utilizing all seven physical pins. This configuration connected the secondary data line and I/O select pin found in multi-tap peripherals, allowing the TASBot replay rig to emulate two multi-taps at once. By simulating eight controllers concurrently across both ports, the setup multiplied the data transmitted to console RAM on every video frame. This high-throughput pipeline allowed TASBot to construct and execute complex program logic dynamically—including multiplayer Pong and Tetris—without requiring cartridge modifications or ROM patches. Hardware Constraints and the Total Control Vision (3:06) The demonstration represented a scaled-down execution of an internal project named "Total Control," which was kept under strict secrecy and finalized at midnight just hours before the event. Allan revealed that the developers initially planned to stream the entirety of the original NES Super Mario Bros. into the Super Nintendo's memory and run a live TAS of it. However, the team encountered hard bandwidth bottlenecks: the SNES hardware simply lacked sufficient write time per frame to deliver an entire NES game live, prompting them to pivot to self-contained arcade minigames. The demonstration confirmed that stock SNES hardware could be completely reprogrammed on the fly using standard controller ports, though per-frame data throughput constraints established a definitive limit on the size and complexity of games that could be dynamically injected.

精炼阅读摘要

在 AGDQ 2014 现场，演示人员借助 TASBot 与 Master Jun 制作的工具辅助速通（TAS），通过在《超级马力欧世界》（Super Mario World）中精细操纵对象属性内存（OAM）触发任意代码执行（ACE），在未经修改的游戏卡带上现场注入并运行了《贪吃蛇》、《乓》和《俄罗斯方块》等独立游戏。秘密演示筹备与开场波折 (0:05) 该速通演示由 Master Jun 制作，在 AGDQ 2014 登台前一晚午夜才刚刚完成，现场仅有 Allan 及其联合主持人知晓注入代码的具体内容。甚至现场活动人员在开场前也未获知详情。演示开始时由于卡带内留存有旧存档，操作人员不得不快速重置主机、清除存档数据并重新切换 SNES 视频信号。解说人员向观众强调，马力欧在“耀西岛 2”（Yoshi's Island 2）中呈现的混乱移动并非失误，而是精密计算且完全符合预期的操作。 OAM 内存篡改与任意代码执行 (1:40) 演示通过马力欧在关卡中执行逐帧精准的物品互动，直接操纵 SNES 内部管理活动精灵和图块物理与视觉属性的对象属性内存（OAM）表。关键机制包括利用 P 开关，以及将击晕的飞行道具箱使其被引擎识别为普通库巴龟壳。通过携带、投掷这些处于异常状态的实体，并结合金币变换与图块位置，玩家输入将特定数值写入负责处理游戏对象的内存地址，最终将程序执行跳转至被篡改的内存缓冲区，引发游戏崩溃并直接接管处理器控制权，使画面即时切换为完整可玩的《贪吃蛇》游戏。自制七芯线缆与八手柄带宽突破 (3:06) 为了在每帧时间内向主机写入组装完整游戏所需的庞大数据量，Allan 改造了手柄线缆。标准零售版 SNES 手柄线仅连接了 5 根有效导线，但接口物理上存在 7 个引脚。Allan 制作了利用全部 7 条线路的定制电缆，调用了分流器（multi-tap）外设的次级数据线与 I/O 选择引脚。通过 TASBot 模拟两个四人分流器，该方案能够同时模拟 8 个 SNES 控制器的输入信号，从而在未经硬件改装或 ROM 打补丁的情况下，依托标准手柄端口将《贪吃蛇》、《乓》（Pong）和《俄罗斯方块》（Tetris）的运行逻辑实时写入内存，并支持现场观众接入普通手柄进行对战。 “完全控制”构想与硬件吞吐限制 (3:06) Allan 在演示中透露，该项目最初代号为“完全控制”（Total Control），团队原本构想将整部 FC 平台《超级马力欧兄弟》（Super Mario Bros.）的数据直接流式传输到《超级马力欧世界》的内存中并在直播中实时 TAS 运行。然而，受限于 SNES 硬件每帧允许写入的数据传输吞吐上限，团队无法在每帧时限内写完整个游戏的代码，最终只得缩减规模，转为动态注入数款经典的街机小游戏套件。该演示证实了通过标准手柄端口进行高带宽数据注入并夺取 SNES 主机控制权的可行性，但受每帧硬件通信带宽的硬性限制，在未改动卡带的情况下实时重现完整红白机游戏等更复杂的载荷仍无法实现。

Detailed notes — zh

## Background 该视频由 invalidation 于 2014 年 1 月 21 日发布在 YouTube 平台上。视频记录了 AGDQ 2014 现场进行的一场经典的实机任意代码注入（ACE）表演，视频简介附上了 Games Done Quick 的官方网站链接以供了解更多活动信息。 ## TL;DR 在 AGDQ 2014 现场，TAS 团队展示了知名制作人 Master Jun 刚刚完成调试的全新《超级马力欧世界》速通路线。马力欧在关卡中通过一系列精确到像素的道具互动与图块生成，操控 OAM 属性表劫持了主机的程序计数器，触发了任意代码注入。为了突破实机传输数据的带宽瓶颈，团队手工焊制了 7 针全通线缆，模拟接入 8 支手柄并发灌入机器码，成功在原版卡带实机上凭空编写并运行了贪吃蛇与 Pong 等自制小游戏。 ## Atmosphere & style 现场弥漫着黑客破解秀般的极客狂欢与紧张神秘的氛围。开场时因卡带存档确认导致的小插曲让全场捏了一把汗，解说半遮半掩的预告更拉满了悬念；而当原版游戏画面瞬间撕裂、凭空变出自制经典游戏的刹那，整个现场爆发出了极具感染力的惊呼与掌声。解说随后举起改装线缆揭秘底层技术硬核细节，观众的情绪也随之从困惑震撼转变为对软硬件极致创新的纯粹赞叹。 ## Bulletin - [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) 在 AGDQ 2014 现场，TAS 团队公开展示了由 Master Jun 压哨制作的《超级马力欧世界》任意代码注入（ACE）演示，此前从未对外公开。 - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) 演示在未修改卡带和主机硬件的前提下，通过游戏中极精确的图块生成与 OAM 内存操作，成功将程序计数器重定向至手柄端口输入区域。 - [03:18](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=198s) 团队通过自制 7 针全通线缆模拟两个 Multitap 分线器，实现 8 个手柄端口并联并发输入，攻克了向 SNES 内存快速传输自制游戏代码的带宽瓶颈。 - [03:18](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=198s) 受限于主机单帧手柄数据吞吐量，团队放弃了在游戏内从零编写初代《超级马力欧兄弟》的原定计划，改为载入并实机运行贪吃蛇与 Pong 等经典小游戏。 ## Key takeaways - [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) 演示由知名 TAS 制作人 Master Jun 制作，在活动前一天半夜才最终调试完成，现场除少数核心人员外无人知晓具体内容。 - [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) 开场前因卡带存档清理与卡带确认问题导致第一次倒数中断，经重置主机后演示方才正式开始。 - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) 马力欧在关卡内表面混乱的操作实际是精密设计的序列，用于在极严格的时序下生成特定图块以操纵 OAM 属性表。 - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) 利用蓝色 P 开关使被击晕的飞行道具箱在内存中呈现龟壳属性，最终触发像素级碰撞撕裂了原本的游戏执行流程。 - [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) 漏洞触发后处理器的指令计数器被重定向至手柄端口数据区，使原版游戏画面瞬间切换为实机内存注入的全新游戏。 - [03:18](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=198s) 该方案被称为“完全控制”（Total Control），纯靠手柄输入将机器码灌入主机内存，无需任何卡带作弊器或控制台硬件 Hack。 - [03:18](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=198s) 普通 SNES 手柄线仅连接 5 根线，团队手工焊制了包含额外数据线与 I/O 选择引脚的 7 针全通线缆以模拟两台 Multitap 分线器。 - [03:18](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=198s) 通过 8 个手柄端口的高频并发按键输入，团队成功突破了数据传输瓶颈，实现了在实机内存中凭空载入贪吃蛇、Pong 及俄罗斯方块。 - [03:18](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=198s) 团队原终极构想是在《超级马力欧世界》中从零构建完整的红白机初代《超级马力欧兄弟》并由 TAS 通关，但受限于每帧物理读取上限而退而求其次。 ## Detailed walkthrough ### [00:05](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=5s) 开场调试与前所未见的 TAS 演示在 AGDQ 2014 的舞台上，解说席与技术团队在开场阶段仍带着一丝神秘与手忙脚乱。现场甚至连解说都表示事先完全不知道这一场速通的具体内容。在准备通电开机时，操作人员突然发现卡带可能没有正确清除存档，甚至怀疑是否插错了卡带，导致第一次倒数尝试中断。在重新确认并重置主机、完成信号切换后，演示正式进入正轨。解说向观众隆重介绍了这次速通的作者是知名 TAS 制作人 Master Jun。与以往展示已经公开的成熟录像不同，这一段 TAS 演示此前从未在 TASVideos 网站上发布过，而是前一天半夜刚刚完成压哨制作的新作品。解说坦言现场只有极少数的核心参与人员确切知道接下来会发生什么，并提前打预防针提醒观众：“你将在这里看到的一切看似完全随机，但不管看起来多么混乱，全都是经过精密计算的既定操作。” - **录像状态**：由 Master Jun 制作的全新 TAS 路线，活动前一天午夜才最终完成调试。 - **保密程度**：全场除极少数技术人员外无人知晓具体内容，开场时还因确认存档清理而短暂重启了一次。 --- ### [01:40](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=100s) 内存破坏与任意代码注入（ACE）的触发游戏正式开始后，马力欧在关卡内展开了一连串常人看来不可理喻的操作。解说解释道，游戏画面上看似混乱的跑动和道具互动，实际上是在以极其严格的顺序生成图块（Tiles）。马力欧通过操作游戏中的对象属性内存（OAM 表，用于管理屏幕上所有精灵和图块的物理与图形属性），让特定图块加载到精确的内存地址中。其中的核心道具是蓝色的 P 开关（P-Switch）。马力欧在特定时机击晕了一个飞行道具箱，使其在内存中表现得像一个普通的库霸龟壳（Koopa Shell）。紧接着，一系列像素级的碰撞与道具交互直接撕裂了原版的执行流程，将处理器的指令计数器重定向到了由手柄端口喂入的数据区。刹那间，原版《超级马力欧世界》的关卡完全消失，取而代之的是直接运行在实机内存中的自制游戏——贪吃蛇（Snake）与乒乓球（Pong）画面赫然出现在屏幕上，引爆了全场热烈的欢呼与掌声。在此期间，后台也念出了一笔来自 Tommy 和朋友们的 500 美元赞助，对 TASBot 的惊艳表现大加赞赏。 ```mermaid flowchart TD accTitle: 任意代码执行触发流程 accDescr: 展示从马力欧游戏内操作到完全控制实机内存的流程 subgraph Setup ["游戏内内存布置"] A["精确生成图块序列"] --> B["操控 OAM 属性表"] B --> C["利用 P 开关击晕飞行箱使其表现为龟壳"] end subgraph Execution ["代码劫持与注入"] C --> D["触发内存越界并跳转 PC 指针"] D --> E["从手柄端口读取自制程序代码"] end subgraph Payload ["全新游戏运行"] E --> F["直接在 SNES RAM 中运行贪吃蛇与 Pong"] end ``` --- ### [03:18](https://www.youtube.com/watch?v=jnZ2NNYySuE&t=198s) 八手柄改装线缆与“完全控制”的极限伴随着新游戏的启动，解说立刻招呼台下的嘉宾 Tampa 上台拿手柄即兴对战。解说借机向观众系统剖析了这套被称作“完全控制”（Total Control）的任意代码注入（ACE）黑科技：TASBot 并没有使用任何卡带作弊器或硬件 Hack，而是仅仅依靠向标准 SNES 手柄接口发送高频按键数据，在游戏运行过程中将全新的代码直接“写”进了超级任天堂的主内存中，从而凭空编写并运行了贪吃蛇、Pong 以及俄罗斯方块。为了在极短时间内向主机灌入足以运行一整款游戏的数据量，团队攻克了巨大的硬件带宽瓶颈。解说拔出特制的转接线向观众展示，普通的 SNES 手柄线缆内部只连接了 5 根线，而他们手工专门焊制了全通的 7 根线缆。多出来的两根线对应的是外接分线器（Multitap）所需的数据线与 I/O 选择引脚，从而欺骗主机同时挂载了两个四人分线器，相当于“在这一台超级任天堂上手柄接口同时接入了整整 8 支手柄”。借助这 8 个通道的并发带宽，TASBot 才能把海量机器码顺着手柄插孔生生塞进主机。解说还在现场透露了一个此前未获准公开的技术内幕：“整套计划原本的终极设想，是在《超级马力欧世界》里面从零编写出完整的初代《超级马力欧兄弟》，然后再由 TAS 自动通关它。”但由于 SNES 每一帧能从手柄读取的数据量依然存在物理上限，传输整款红白机游戏所需的时间超出了单帧负荷，团队最终退而求其次，实现了贪吃蛇、Pong 和俄罗斯方块的多合一展示，这一成果依然震撼了整个游戏速通界。 - **线缆硬件改装**：利用 7 针全接线缆模拟两台 Multitap，实现 8 个手柄端口并联输入数据。 - **数据传输目的**：纯靠手柄输入将机器指令灌入内存，无需修改卡带或控制台硬件。 - **未实现的终极构想**：原本计划利用注入代码在游戏内完整重构 NES 版《超级马力欧兄弟》并由 TAS 自行通关，因帧率带宽受限而改用多款经典小游戏替代。 ## Mentioned Super Mario World, AGDQ 2014, TASBot, Master Jun, Tampa, Tommy, TASVideos, 超级任天堂, 红白机, 贪吃蛇, Pong, 俄罗斯方块, 超级马力欧兄弟 ## Video description See http://gamesdonequick.com/ for more information. [Source](https://www.youtube.com/watch?v=jnZ2NNYySuE)

Original transcript

[0:05] whatever this run is they wouldn't even [0:07] tell me what it was can we power without [0:08] yeah go for it okay three two [0:14] one okay okay you delet the file right [0:18] uh I sure hope so looks like [0:20] it no oh no you didn't oh did you use a [0:23] different cartridge no okay we got to [0:25] delete the same maybe [0:28] maybe I can grab [0:31] yes okay is that restarted okay 3 two [0:38] 1 I think I forgot to [0:43] switch there we go that's better all [0:46] right uh this is a Super Mario World [0:48] task by Master [0:50] June contrary to what I said a few [0:52] minutes ago this one task is not [0:55] featured on task videos yet this is a [0:58] brand new task um it was finished [1:01] yesterday uh midnight so we've done [1:04] extensive testing we know exactly what's [1:06] going to happen all right um the only [1:10] two people who know what's going to [1:11] happen is me and alen here so I'm [1:15] looking forward [1:17] to everything that you're going to see [1:19] here [1:21] is seemingly random seemingly random [1:24] completely [1:26] intended despite what you might what it [1:28] might look like [1:40] whoa what is that that was that was Del [1:44] oh what he's actually doing is spawning [1:47] a spawning tiles in a specific order um [1:51] there's this thing called the oam which [1:52] is just a table which um contains all [1:57] the physical Graal um properties of [2:00] all [2:03] the of all the tiles on [2:09] screen the P switch is really the key [2:11] factor here what he just did right here [2:14] he stunned one of those flying item [2:16] boxes which basically means that he made [2:18] it act like a Koopa [2:20] shell and then he [2:26] [Applause] [2:41] [Music] [2:43] oh [2:47] my this is a snake run yes it's a good [2:50] time to uh say that Tommy ref friends uh [2:54] donated $500 I'm loving this tazbot run [2:58] great work everybody [3:06] that smiley place is [3:18] M hey hey Tampa he hey Tampa okay Tampa [3:22] go grab a controller plug it in I'm I'm [3:26] SC I guess I'll take this opportunity to [3:28] say I was hoping to um be able to [3:30] explain this in more detail but I forgot [3:32] how quickly everything happens uh [3:35] basically the gist of it he did a lot of [3:37] things and he was able to write his own [3:39] code for the in the game while it was [3:42] running so he was able to program both [3:44] Tetris Tetris pong and snake in the game [3:48] without hacking it through the [3:49] controller P yep and yes through the [3:52] controller P it used all eight [3:54] controllers that the SNES can support to [3:56] be able to do [3:58] that so [4:02] they are now competing against each [4:04] other who's on top wa don't answer [4:13] that so this is also a great opportunity [4:16] um I'm going to pull these out now that [4:17] I can uh these cables are a little bit [4:21] unusual um I had to fabricate these [4:25] because a normal Super Nintendo on a [4:28] controller cable only has five wires [4:30] hooked up and I needed all seven the [4:31] reason I needed all seven [4:34] is the reason I needed all seven is I [4:36] needed the extra data and the extra IO [4:38] select pen that you would normally find [4:40] on a multi-tap so this is technically a [4:42] multitap controller cable and this is [4:45] also technically a multi-tap controller [4:47] cable each multitap can serve four [4:49] controllers so if you're keeping score [4:50] that means we just hooked up eight [4:52] controllers to a Super [4:53] Nintendo with really interesting results [4:57] uh the extra controller cables were uh [4:59] allow him to shove enough data down the [5:01] line in order to program a game through [5:02] the controller Port [5:05] alone [5:14] okay I just got approval to be able to [5:16] talk about this the original plan for [5:19] this um whole thing by the way this is [5:21] to called total control um for apt [5:25] reasons uh the original idea for this [5:29] was to um create all of Super Mario [5:32] Brothers inside of this game and then T [5:35] it [5:38] um that ended up not being possible uh [5:42] we don't have enough uh time per frame [5:45] to be able to do it uh to be able to [5:48] write the whole [5:49] game so it's unfortunate but it would [5:53] have been nice and this is pretty good [5:55] too [5:57] yes um so now is a really good time to [6:00] just say thank you to everybody who made [6:01] this possible uh I've basically been the [6:03] project manager to make this this happen [6:05] I was going to do it all