MrCheeze | Majora's Mask - Moon Warp 2 @MrCheeze | Uploaded 4 years ago | Updated 3 hours ago
Like the first moon warp, this new discovery is based on Stale Reference Manipulation, a recently discovered and ludicrously powerful glitch in Ocarina of Time and Majora's Mask. SRM allows us to write to what the game thinks is an actor being held by Link, after that actor has already unloaded from the game heap. This means we can have a new actor load into the same part of memory and corrupt the new actor's data.
For this warp, the basic principle is that every Deku Palace guard contains a certain field that determines where they send you when you get caught. This field determines which entrance of the CURRENT scene the guard sends you to. (In the vanilla game, all guards have this field set to the same value.) You'd think this would mean that corrupting this field only lets you warp within Deku Palace, but in fact the game ends up combining the scene and entrance values into a single number when loading an area. If the entrance value is larger than is supposed to be possible, it overflows into the scene value and you get a wrong warp. So that's exactly what we do here.
The entrance warp value is positioned at 0x226-0x227 within the palace guard actor instances. When Link is carrying an actor, the game writes to its X position at 0x24-0x27. Doing math, this means we first have to load a pot, unload it while triggering SRM, then load a guard 0x200 bytes earlier in memory. That way we can overwrite the guard's entrance value with our X position.
The first part of the setup is just to switch up the arrangement of things in memory so that the above useful alignment will happen. It turns out that going back and forth between the rooms in the pattern shown, along with firing a single bubble, is enough for this.
The next step is to bomb hover up to the pots. Not included in this video because I never learned to do it, go ask literally any MM runner instead.
To get the SRM, we need to superslide on the pot without breaking it, and twist the camera around so that the pot is culled before the central hallway is loaded. (The unload always needs to happen while the actor is culled for SRM to work, because for certain reasons the unload code is different for culled actors and doesn't null out as many fields.) Getting the camera twist is a little weird but there are setups to make it consistent.
Finally, we reach the left side of the palace. Everything is lined up so that our position gets copied over the entrance value each frame. If Link is just standing, this position varies randomly due to breathing, but if we drop or throw the actor then it's consistent. To get exactly the right position, there's a setup involving squeezing into a corner, waiting a while for the camera to totally stop, then moving the control stick EXACTLY to the left for a small number of frames (this can be pause buffered).
Then we just drop the unloaded pot, and our work is mostly done: the last value we write corresponds to one of the entrance values that overflows into the moon's Goron Trial once we get caught. All that remains is to navigate the palace and make sure not to get caught by the guards - except, of course, the single one who now plans to take us to his new jail in the middle of the moon.
Overall, this saves several minutes over the original moonwarp because it lets us skip both Zora Mask and the bottle used in the original moonwarp setup, along with the fact that we can use Alternate Exit glitches to reach Deku Palace very quickly from Clock Town.
Many people contributed to this discovery, including:
- Initial discovery that Deku Scrub guards can be modified with SRM to wrong warp: Me (youtube.com/watch?v=YYMfXnpg3pA)
- Finding the heap manipulation at the beginning that makes the SRM corrupt the right field: Kyle/FullGrownGaming (youtube.com/watch?v=xdzkOxwD0fY)
- SRMing off the pots with twisty camera: Fig (youtube.com/watch?v=0Gqzhoi8S7I)
- Documenting which actor drop positions correspond to goron trial moonwarps: Exodus (docs.google.com/spreadsheets/d/1UabGnFx4WY8AjRrkXre_uQnv3ufSG57hJMhCih3NJQ0/edit)
- Easy setup for for the drop: Gigopler (youtube.com/watch?v=vGkOtoGImPU) (also an earlier one by Imbued)
Amazingly, it took only a single day between the initial idea to use deku guards, the MM community contributing all the necessary pieces, them recording tutorials, and doing complete runs with this trick (speedrun.com/mm/run/zp4w71rz). Huge props to the great community for this game.
Like the first moon warp, this new discovery is based on Stale Reference Manipulation, a recently discovered and ludicrously powerful glitch in Ocarina of Time and Majora's Mask. SRM allows us to write to what the game thinks is an actor being held by Link, after that actor has already unloaded from the game heap. This means we can have a new actor load into the same part of memory and corrupt the new actor's data.
For this warp, the basic principle is that every Deku Palace guard contains a certain field that determines where they send you when you get caught. This field determines which entrance of the CURRENT scene the guard sends you to. (In the vanilla game, all guards have this field set to the same value.) You'd think this would mean that corrupting this field only lets you warp within Deku Palace, but in fact the game ends up combining the scene and entrance values into a single number when loading an area. If the entrance value is larger than is supposed to be possible, it overflows into the scene value and you get a wrong warp. So that's exactly what we do here.
The entrance warp value is positioned at 0x226-0x227 within the palace guard actor instances. When Link is carrying an actor, the game writes to its X position at 0x24-0x27. Doing math, this means we first have to load a pot, unload it while triggering SRM, then load a guard 0x200 bytes earlier in memory. That way we can overwrite the guard's entrance value with our X position.
The first part of the setup is just to switch up the arrangement of things in memory so that the above useful alignment will happen. It turns out that going back and forth between the rooms in the pattern shown, along with firing a single bubble, is enough for this.
The next step is to bomb hover up to the pots. Not included in this video because I never learned to do it, go ask literally any MM runner instead.
To get the SRM, we need to superslide on the pot without breaking it, and twist the camera around so that the pot is culled before the central hallway is loaded. (The unload always needs to happen while the actor is culled for SRM to work, because for certain reasons the unload code is different for culled actors and doesn't null out as many fields.) Getting the camera twist is a little weird but there are setups to make it consistent.
Finally, we reach the left side of the palace. Everything is lined up so that our position gets copied over the entrance value each frame. If Link is just standing, this position varies randomly due to breathing, but if we drop or throw the actor then it's consistent. To get exactly the right position, there's a setup involving squeezing into a corner, waiting a while for the camera to totally stop, then moving the control stick EXACTLY to the left for a small number of frames (this can be pause buffered).
Then we just drop the unloaded pot, and our work is mostly done: the last value we write corresponds to one of the entrance values that overflows into the moon's Goron Trial once we get caught. All that remains is to navigate the palace and make sure not to get caught by the guards - except, of course, the single one who now plans to take us to his new jail in the middle of the moon.
Overall, this saves several minutes over the original moonwarp because it lets us skip both Zora Mask and the bottle used in the original moonwarp setup, along with the fact that we can use Alternate Exit glitches to reach Deku Palace very quickly from Clock Town.
Many people contributed to this discovery, including:
- Initial discovery that Deku Scrub guards can be modified with SRM to wrong warp: Me (youtube.com/watch?v=YYMfXnpg3pA)
- Finding the heap manipulation at the beginning that makes the SRM corrupt the right field: Kyle/FullGrownGaming (youtube.com/watch?v=xdzkOxwD0fY)
- SRMing off the pots with twisty camera: Fig (youtube.com/watch?v=0Gqzhoi8S7I)
- Documenting which actor drop positions correspond to goron trial moonwarps: Exodus (docs.google.com/spreadsheets/d/1UabGnFx4WY8AjRrkXre_uQnv3ufSG57hJMhCih3NJQ0/edit)
- Easy setup for for the drop: Gigopler (youtube.com/watch?v=vGkOtoGImPU) (also an earlier one by Imbued)
Amazingly, it took only a single day between the initial idea to use deku guards, the MM community contributing all the necessary pieces, them recording tutorials, and doing complete runs with this trick (speedrun.com/mm/run/zp4w71rz). Huge props to the great community for this game.
