Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Arbitrary code execution on SMW

Name: Anonymous 2014-06-11 21:08

This guy found an exploit on the game Super Mario World for the SNES that allowed him to run code on memory. Giving certain input for the game he manages to program the pong & snake games inside super mario world and then play them.

Video: http://www.youtube.com/watch?v=OPcV9uIY5i4
Article: http://arstechnica.com/gaming/2014/01/how-an-emulator-fueled-robot-reprogrammed-super-mario-world-on-the-fly/

I thought it was damn impressive!

Name: Anonymous 2014-06-11 23:01

>>1
This is old, and not super impressive. It was good though. Sprite slot exploits for SMW have been known for a long time, this is just a variation on the ones that jump directly to the end. More impressive was the machine they built to do it on a real console at AGDQ, but even that lost sync on several games and seemed to be only moderately well done.

>>8
The Pokemon exploit is different. It relies on turning the game off during a save while standing at the right position. When the corrupted save is loaded, most of the file is full of 0xFF or something, so the game things that you have 255 of every possible thing in your inventory. Since you can't normal have, for example, a Pokemon in your inventory, by rearranging them you can access raw memory. By rearranging them in certain orders, you can reprogram the game. But really, almost everything about Pokemon is broken and exploitable.

The SMW exploit is different (SMW is much better programmed). It relies on the fact that sprites are spawned in certain slots, and some slots are reserved for certain sprites (Yoshi, P-Switch, etc) that can kick other sprites out. It also uses a second glitch where blocks can be duplicated. The studdering in the game when Mario mounts Yoshi is because he is actually mounting several invisible Yoshi's at the same time. Also, anything that is moved is a sprite, so when they grabs the blocks, the are deleted from the background and a new sprite spawns. Total control is achieved here by fucking with the sprite slots in such a way that they overwrite other memory (difficult, because each frame is a new cycle in which all the game logic executes (also why the timer passes slower hen Mario is moving faster, in case you never noticed), so sprites must either be spawned or destroyed in the exact same frame) and jump to it that causes it to read the next 65k or so of controller inputs in to memory and execute them.

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List