Super Mario World Speedrunner "Beats" Game in Under a Minute

Speedruns are nothing new. It's an interesting way for gamers to test their skills, challenge what we know about games and their code, and even use this method of beating a title in record time to raise money for charity! There are a lot of different reasons to speedrun, but mainly - it's just a cool badge for bragging rights. With the previous world record for Super Mario World set at 1 minute and 13 seconds (32 milliseconds, if you're counting), a new challenger has arisen with a different means to "beat" the game.

Enter SethBling. Seth used a method referred to as "arbitrary code execution." Basically this means that the player in question does certain things in-game to coerce the title's memory into bringing up the end credits prematurely. Does it count? Well, technically.

In the video at the top of the article, you can see the YouTuber in action as he makes these moves in-game to get to those end credits fast enough. Through a series of jumps, four controllers, and his wits - Seth triggers the specific memory leap that makes those end credits role. It's impressive for the execution, but does take the joy a bit out of watching a speedrun. We do have to hand it to him for innovation, though ... speedrunners are known for getting creative when looking to achieve their goals.

If you're interested in trying to take on the master at his own game, SethBling has uploaded how to do this via a GoogleDoc. He also explained the technical side of everything involved as well for those interested in the more mechanical side to his methods.

Just a taste of what his technical explanation has to offer:

Performing the item swap with the chargin' chuck causes Yoshi to eat the chuck, which is normally disallowed. As a result, an out-of-bounds function table lookup causes processor execution to jump to $014A13. This is in a region of the address space called open bus, which is not mapped to any device, so all reads will just return the contents of MDR (memory data register), which will contain whatever memory value was last written/read.

Since the data bank of the JMP to $014A13 was the last byte read, the MDR contains $01, so the instruction is ORA ($01,x). The x register is determined by the sprite slot of the chargin' chuck that's being eaten, which is 9. So the indirect lookup uses the address at $01+9=$0A. $0A was most recently set as the high byte of Yoshi's x-coordinate and $0B as the high byte of his y-coordinate. In this case, $0A=$0107. So the instruction will OR the "a" register with the contents of memory address $0107. This RAM address contains $17. OR a with $17. Now the MDR contains $17.