Revision as of 01:31, 26 January 2020

ACE RTA is a category where you beat the game using Arbitrary Code Execution. Basically we're writing code to SNES memory, then making the SNES execute our code to go to the Triforce Room.

Route

Magic

• Talk to Uncle

• Stair clip or SQ for EG

• Arm void EG at key guard 1

• Rescue Zelda

• Get hit to re-enter EG (can SQ to respawn BnC)

• Walk to sanc

• After cutscene, transition up

• Grab Somaria

• Grab full magic

• S+Q to Sanctuary

Bombs

• Walk to Kak, and set up the Search Index to 8 by using Lantern and Somaria

1. Use lamp 3 times (sets Search Index to $10)

2. Put out your sword, and with a certain rythm press Y 4 times (placing and popping a Somaria twice)

3. Release B, and do the last step again. I find the last Y press should be slightly delayed for the second time you do this.

If you press Y while a Somaria is ready to be popped, but nothing happens, it means you mistimed your Y presses, and need to reset, as you don't have enough Magic with this route.

By using the practice hack w/ACE hud (see below), you can see what the Search Index is set to on the top left number.

• Jump into Kak cave

• Place a Somaria southwards as you land

• Grab Bombs chest

• Misslot a bomb into slot 6, and make it blow up the bombable wall

1. Position yourself ready to put down a bomb on the bombable wall

2. Hold your sword out

3. Pop the Somaria and Menu to Bombs

4. Place 2 bombs down

5. Pick up one bomb, and throw it away

• Grab the 3 rupee chests (need 50 rupees).

• Go out and buy 10 bombs.

• S+Q to Sanc

Possible improvements: It's possible to skip the magic refill in Mire, and instead use the Somaria magic return glitch (that's not an actual name) to fill your magic.

Setting up memory for ACE

• Walk to the screen with the cave to Hera and Tree rupees. You want to transition on the right side of it.

• Walk immediately towards the Rupee tree, and grab it. You can avoid the birds by doing a <^ before grabbing the tree (see vod).

• Grab the Hoarder bush. You can throw it immediately if you want, the important thing is to activate the Hoarder.

• Walk towards the transition southwards, and transition only after the hoarder is done giving away rupees (you can transition as soon as he poofs).

Sometimes he will walk ^> quite a bit, and if you don't follow him rightwards, he might despawn, and you need to set everything up again. So make sure to scroll the screen with him if he does that.

The main thing we're accomplishing here, is setting $0C9A-$0CA0 to $0A.

This is an array (with 16 slots) where the game puts "which map was this Sprite spawned on".

You can see these values in the ACE practice hack on the bottom line of numbers (16 numbers, 2 characters each).

• Transition south, then left. Slash your sword (this is just a waiting buffer) once when you enter, and then go back to the previous screen.

This clears out all the $0A's that were left in slot 7+. We need only slot 0-6 to have the value $0A.

• You need to pick up at least one bush to clear slot 14, so you can throw it at the guard, then do one slash to kill him.

Possible improvements: It might be faster to activate the Hoarder before pulling the tree. This is untested, and might not work.

Doing the ACE

This involves standing on specific coordinates, in a specific direction, and using a combination of Somaria, Somaria pop's and Spins.

When I write to "Stand on x89", I mean to place Link on the Y coordinate that ends with "89" (hex).

You will need to use cues for these in a run - I will mention some of the ones I use. If you end up using camera cues, it's important that you do not touch a Somaria block at all. Moving a Somaria block will mess with the camera's alignment, and your cues will suddenly not work.

• Stand on x89, facing ^: Hold sword out; Somaria; Pop; Somaria; Spin

Cue: Shadow one pixel above the green line.

• Stand on x89, facing ^: Hold sword out; Pop; Somaria; Spin

You're just doing the same thing again, except a Somaria is already out now.

• Stand on x98, facing v: Hold sword out; Pop; Somaria; Spin

Pop the somaria afterwards (this is just to get rid of it, coords etc. doesn't matter)

Cue: Hat aligned with the big rocks.

• Stand on x18, facing v: Hold sword out; Somaria; Pop; Somaria; Spin

Cue: You can use a bush to align with x18 easily. See vod.

You can also put down the Somaria first, it doesn't matter.

You should also pop the Somaria afterwards. Usually the next step fails if you reuse the same Somaria.

• Stand on x65, facing ^: Hold sword out; Somaria; Pop; Spin

Cue: Shadow one pixel above the grass roots.

• Stand on x51, facing ^: Somaria (do not pop it!)

Cue: Shadow aligned with the top of the green grass near the bottom-most flower.

• Stand on x44, facing v: Pop

Cue: Hat aligned with the grass roots near the top-most flowers.

Note that this bomb explosion that spawns will only be there for a limited time. When it's gone, you need to have completed the full ACE, if not you'll need to reset.

• Don't move. Wait for all sparks to go off screen, then put down 2 bombs.

You should watch the bottom-most spark. Make sure it's fully gone before putting down your bombs.

You should also put them down pretty quickly, and immediately go on to the next step.

Your time is very limited after this step, since either the bombs will explode and hit Link, or the bomb explosion will despawn, if you're wasting more than 5-9 frames after this step. Use select buffers from now on.

• Walk upwards (while holding a spin) until you're on x16, then Spin.

Cue: I use a camera cue here, it's bad, feel free to find your own.

• Walk downwards, start a spin on the way, until you're at x71, then Spin.

Cue: I have 3 cues. 2 camera cues (bad) and one based on Link's shadow (one pixel below the dark green grass).

Route

Magic

• Talk to Uncle

• Stair clip or SQ for EG

• Arm void EG at key guard 1

• Rescue Zelda

• Get hit to re-enter EG (can SQ to respawn BnC)

• Walk to sanc

• After cutscene, transition up

• Grab Somaria

• Grab full magic

• S+Q to Sanctuary

Bombs

• Walk to Kak, and set up the Search Index to 8 by using Lantern and Somaria

1. Use lamp 3 times while facing leftwards (sets Search Index to $10)

2. Put out your sword, and with a certain rythm press Y 4 times (placing and popping a Somaria twice)

3. Release B, and do the last step again. I find the last Y press should be slightly delayed for the second time you do this.

If you press Y while a Somaria is read to be popped, but nothing happens, it means you mistimed your Y presses, and need to reset, as you don't have enough Magic with this route.

By using the practice hack w/ACE hud (see below), you can see what the Search Index is set to on the top left number.

• Jump into Kak cave

• Place a Somaria southwards as you land

• Grab Bombs chest

• Misslot a bomb into slot 6, and make it blow up the bombable wall

1. Position yourself ready to put down a bomb on the bombable wall

2. Hold your sword out

3. Pop the Somaria and Menu to Bombs

4. Place 2 bombs down

5. Pick up one bomb, and throw it away

• Grab the 3 rupee chests (need 50 rupees).

• Go out and buy 10 bombs.

• S+Q to Sanc

Setting up memory for ACE

• Walk to the screen with the cave to Hera and Tree rupees. You want to transition on the right side of it.

• Walk immediately towards the Rupee tree, and grab it. You can avoid the birds by doing a <^ before grabbing the tree (see vod).

• Grab the Hoarder bush. You can throw it immediately if you want, the important thing is to activate the Hoarder.

• Walk towards the transition southwards, and transition only after the hoarder is done giving away rupees (you can transition as soon as he poofs).

Sometimes he will walk ^> quite a bit, and if you don't follow him rightwards, he might despawn, and you need to set everything up again. So make sure to scroll the screen with him if he does that.

The main thing we're accomplishing here, is setting $0C9A-$0CA0 to $0A.

This is an array (with 16 slots) where the game puts "which map was this Sprite spawned on".

You can see these values in the ACE practice hack on the bottom line of numbers (16 numbers, 2 characters each).

• Transition south, then left. Slash your sword (this is just a waiting buffer) once when you enter, and then go back to the previous screen.

This clears out all the $0A's that were left in slot 7+. We need only slot 0-6 to have the value $0A.

• You need to pick up at least one bush to clear slot 14, so you can throw it at the guard, then do one slash to kill him.

Doing the ACE

This involves standing on specific coordinates, in a specific direction, and using a combination of Somaria, Somaria pop's and Spins.

When I write to "Stand on x89", I mean to place Link on the Y coordinate that ends with "89" (hex).

You will need to use cues for these in a run - I will mention some of the ones I use. If you end up using camera cues, it's important that you do not touch a Somaria block at all. Moving a Somaria block will mess with the camera's alignment, and your cues will suddenly not work.

• Stand on x89, facing ^: Hold sword out; Somaria; Pop; Somaria; Spin

Cue: Shadow one pixel above the green line.

• Stand on x89, facing ^: Hold sword out; Pop; Somaria; Spin

You're just doing the same thing again, except a Somaria is already out now.

• Stand on x98, facing v: Hold sword out; Pop; Somaria; Spin

Pop the somaria afterwards (this is just to get rid of it, coords etc. doesn't matter)

Cue: Hat aligned with the big rocks.

• Stand on x18, facing v: Hold sword out; Somaria; Pop; Somaria; Spin

Cue: You can use a bush to align with x18 easily. See vod.

You can also put down the Somaria first, it doesn't matter.

You should also pop the Somaria afterwards. Usually the next step fails if you reuse the same Somaria.

• Stand on x65, facing ^: Hold sword out; Somaria; Pop; Spin

Cue: Shadow one pixel above the grass roots.

• Stand on x51, facing ^: Somaria (do not pop it!)

Cue: Shadow aligned with the top of the green grass near the bottom-most flower.

• Stand on x44, facing v: Pop

Cue: Hat aligned with the grass roots near the top-most flowers.

Note that this bomb explosion that spawns will only be there for a limited time. When it's gone, you need to have completed the full ACE, if not you'll need to reset.

• Don't move. Wait for all sparks to go off screen, then put down 2 bombs.

You should watch the bottom-most spark. Make sure it's fully gone before putting down your bombs.

You should also put them down pretty quickly, and immediately go on to the next step.

Your time is very limited after this step, since either the bombs will explode and hit Link, or the bomb explosion will despawn, if you're wasting more than 5-9 frames after this step. Use select buffers from now on.

• Walk upwards (while holding a spin) until you're on x16, then Spin.

Cue: I use a camera cue here, it's bad, feel free to find your own.

• Walk downwards, start a spin on the way, until you're at x71, then Spin.

Cue: I have 3 cues. 2 camera cues (bad) and one based on Link's shadow (one pixel below the dark green grass).

Little bit of explanation

It helps if you know a little bit about how misslotting works, and in particular the search index.

• In most of these steps, you're first filling ancilla slot 0-4 with Somaria sparks and Somaria blocks, and then using a Spin.

• Since slot 0-4 is occupied, the game is supposed to use the Search Index to go through slot 5-9 instead, and if it finds an arrow ancilla there, for example in slot 8, then it will just remove the arrow and spawn the Spin ancilla into slot 8 instead. That's what is supposed to happen.

• Since the Search Index have such a high value (from the misslot we did in Kak cave), it will search slot 5-111 instead.

It does this search in reverse, so it will look through a lot of invalid slots, looking for arrows. If it finds something that looks like an arrow, for example in slot 95, it will stop the search and spawn the Spin ancilla into that slot.

In this example, slot 95 would correspond with the address $0CA9, which has nothing to do with ancillae. It's part of an array of values where sprites puts their room/screen number, so the game can keep track of which screen they initially spawned in.

• When we did the "Setting up memory for ACE" part, we basically filled this array with the value $0A. That is the screen number of the tree rupees screen, AND it's the ancilla index for arrows.

• So what ends up happening, is that the game thinks it found an arrow ancilla it can replace in slot 80+, then it will replace it with a Spin ancilla. This will write Spin ancilla data into the wrong memory.

• One of the bytes that is written, is the Y coordinate of where the Spin ancilla should be spawned. The Y coordinate of the spin, is obviously based on the coordinate and direction of Link.

Since it's writing this value into slot 80+, it will go past the Y coordinate array, and instead be written to $0C4A+, which is the main Ancilla array. The one that tells the game which ancillae are spawned and not.

It's where the game was supposed to spawn the Spin ancilla in the first place. But now it will spawn whatever ancilla corresponds with the Y coordinate of that spin instead.

• To summarize: For each spin, we are spawning a specific ancilla, based on Link's coordinate and direction.

Here's the order of which ancillae is spawned during the setup, and which ancilla they are:

1. $A9: Pendant/Crystal

2. $90: Unused (stable)

3. $10: Unused (stable)

4. $85: Boomerang

5. $3A: Super bomb explosion

6. $0E: Unused (stable)

7. $69: Unused (not stable)

• In fact, the game only made "room" for $44 ancillae. So any numbers above that, will execute unintended code every frame.

Generally this crashes the game. But for $90 and $85, this is not a problem, because the game mirrors $80 to $0, $81 to $1 etc. So $85 is really $5, which is Boomerang, as noted above.

• The last one, $69, on the other hand, does not exist, and spawning it will execute unintended code.

It just so happens that this unintended code ends up executing from memory $0C4A. $0C4A, as you may remember from above, is the main ancilla array. It is the list of all the currently spawned ancillae.

At the moment of the ACE, it will have the values $69, $0E, $3A, $85, $10, $90, $A9 (the list from above, but in reverse). This corresponds to the code: ADC #$0E : DEC : STA $10 : BCC $A9.

Basically it ends up setting "game mode" to "Triforce room", then branching to nearby code. That particular nearby code is something we have manipulated with the last bomb, to have the value $60 (RTS, meaning "return from subroutine"), and is just something that is required so that the game does not crash.

tl;dr we're spawning ancillae that spawns different ancillae that executes itself as code.

Resources

• https://www.twitch.tv/videos/541802125 a full run of the route

• https://milde.no/public/alttp/lttphack-ace.sfc practice hack w/ACE memory watch

• https://milde.no/public/alttp/lttphack_SD2SNES-ace.sfc same, but with SD2SNES savestates