Ocarina of Time - Lightnode SRM as Adult Link @MrCheeze

MrCheeze | Ocarina of Time - Lightnode SRM as Adult Link @MrCheeze | Uploaded 3 years ago | Updated 6 minutes ago
Could be useful from time to time. If only all heap manips were this easy, huh?

Done in lost woods not just because lost woods is a very nice location for heap manips, but because Mido's fairy is one of the few actors that we know to have a lightnode pointer that we can edit as adult. (Kokiri forest SRM doesn't seem possible when we can't use the crawlspace.)

Two Homestuck musicians walk into a piano.

Ocarina of Time - Fast Lightnode SRM for title file and age change

Ocarina of Time NSR idea - Loading the title screen save

An Apple Disaster! ~ Theme of Apple Girlington

Crazy Lightnode SRM strat for Title File on Wii VC

$Cool Zelda Glitch The missing step needed for humans to create large-scale ACE payloads in Ocarina of Time has now been discovered by natalyahasdied. Therefore, it is now possible to create a demonstration of the entire process, from start to finish. This video is that demonstration. 0:08 - As a prerequisite for the technique used here, we need our main gameplay file to be file 2, and have the specific filename 08012850 A79C7F12. Much later, were also going to need file 1 to have the specific name 803B2FA0 801DD068, so Ive gone ahead and set that up as well. 0:50 - This segment is standard heap manipulation for Darunia ACE SRM, originally demonstrated by Fig02 and also worked on by others such as Blini. 2:20 - From here to the end of Goron City is the new discovery that made this video possible, and was planned and tested by natalyahasdied. The goal of this entire segment is to write the value 61E0 to a specific location in memory, at which point the character limit on filenames will be disabled. To do this, first of all we have to place the pot with rotation A390, so that talking to Darunia will cause game execution to jump to 801FA390. Then we have to setup and trigger ACE twice: - For the first ACE, game execution will jump to the seed rotation located at 801FA390. This needs to have the value 0807212D to jump the game execution again to memory that contains the values of controller 1 and 3. Both controllers need to have an exact set of held buttons and joystick input, which is the trickiest thing about this method. Using controller 1, we load the rotation value of the other seed that we shot (61E0) into the $gp register, which is unique among all registers in that the game never uses it and will retain its value from one frame to the next. Then with controller 3 we jump execution back to safety. - For the second ACE, everything proceeds the same until execution again reaches controller 1. This time, controller 1 is an instruction that sets up the upper half of the needed write address, controller 3 jumps execution to our filename, and the filename writes the value of $gp to the target address (which is 800CE0F2). With all this done, weve now successfully removed the bounds checks on filenames, and can return to the title screen. 5:48 - If we hadnt done so already, we would start by entering File 1s name here. Instead, we go into a standard setup to write a payload into RAM. 6:02 - This is the point where we actually write our chosen payload into RAM. For this demo, Ive made a general-purpose payload that runs each frame, and based on the buttons the player presses on controllers 2,3, and 4, can pretty much write any value to any address in RAM. (source here: https://pastebin.com/1pHVRsVC) 7:12 - This section is again standard regardless of payload. We mess with the internal variables of the file select menu so that file 1 gets copied over file C6C2. The effect of this is that the game state destructor of the file select menu is corrupted to a new value based on the filename file 1 had. With the name we chose, this will cause our payload to run once, as soon as file select unloads. The payload itself is responsible for hooking itself back into the game loop to run every frame. 7:38 - The setup is complete. Now, by pressing well chosen buttons on controller 2-4, we can modify RAM as we please as we play the game. At this point the possibilities are truly endless, and I demonstrate the tiniest fraction of what is possible. For a more detailed explanation on the title screen payload entry, see my previous video: https://youtu.be/wIyEUScOMxc$

SMW Arbitrary Code Execution: Instant Bowser Kill