Paper Mario - Itemless NPC Clipping @MrCheeze

MrCheeze | Paper Mario - Itemless NPC Clipping @MrCheeze | Uploaded 2 years ago | Updated 2 hours ago
(Recommend watching at 2x speed)

It's been known for many years that in Paper Mario, hammering when squeezed between an NPC and a wall will clip you into the wall. Spin Jump and Tornado Jump also have the same effect. The reason for this is that wall collision is temporarily disabled during those actions (see here: youtube.com/watch?v=h2c8VG54270 ).

This is pretty nice in itself, but it would be nice to be able to do it without needing any items at all. As it turns out, we can! It seems that every useful NPC clip can be done just by talking to the NPC while squeezed close enough between them and the wall, or even just by turning Mario around. (Actually, I think the reason talking to NPCs even works is that it makes Mario turn instantly, but I'm not sure about this.)

A speedrun would generally always have Hammer anyway, but this is pretty useful for Paper Mario Randomizer. In particular, the itemless entry to Toy Box and escape from Goomba Village seem like they would come up frequently when playing randomizer with glitches. Most of the others are useful for rando as well.

Note that some NPC clips require using Bombette to push an NPC somewhere else, and Bombette is still required in those cases. It's only doing the clip itself that never needs any item.

This video features the following:

- goomba village escape
- black toad skip
- sushieless toad town star piece
- oaklie skip
- blue house skip
- toybox early
- storeroom early
- yellow, red, bubble, blue berry gate skip
- murder solved early

This actually obsoletes several of my recent videos, which show other ways to goomba village escape and toybox early that require items/partners.

Crazy Lightnode SRM strat for Title File on Wii VC

$Cool Zelda Glitch The missing step needed for humans to create large-scale ACE payloads in Ocarina of Time has now been discovered by natalyahasdied. Therefore, it is now possible to create a demonstration of the entire process, from start to finish. This video is that demonstration. 0:08 - As a prerequisite for the technique used here, we need our main gameplay file to be file 2, and have the specific filename 08012850 A79C7F12. Much later, were also going to need file 1 to have the specific name 803B2FA0 801DD068, so Ive gone ahead and set that up as well. 0:50 - This segment is standard heap manipulation for Darunia ACE SRM, originally demonstrated by Fig02 and also worked on by others such as Blini. 2:20 - From here to the end of Goron City is the new discovery that made this video possible, and was planned and tested by natalyahasdied. The goal of this entire segment is to write the value 61E0 to a specific location in memory, at which point the character limit on filenames will be disabled. To do this, first of all we have to place the pot with rotation A390, so that talking to Darunia will cause game execution to jump to 801FA390. Then we have to setup and trigger ACE twice: - For the first ACE, game execution will jump to the seed rotation located at 801FA390. This needs to have the value 0807212D to jump the game execution again to memory that contains the values of controller 1 and 3. Both controllers need to have an exact set of held buttons and joystick input, which is the trickiest thing about this method. Using controller 1, we load the rotation value of the other seed that we shot (61E0) into the $gp register, which is unique among all registers in that the game never uses it and will retain its value from one frame to the next. Then with controller 3 we jump execution back to safety. - For the second ACE, everything proceeds the same until execution again reaches controller 1. This time, controller 1 is an instruction that sets up the upper half of the needed write address, controller 3 jumps execution to our filename, and the filename writes the value of $gp to the target address (which is 800CE0F2). With all this done, weve now successfully removed the bounds checks on filenames, and can return to the title screen. 5:48 - If we hadnt done so already, we would start by entering File 1s name here. Instead, we go into a standard setup to write a payload into RAM. 6:02 - This is the point where we actually write our chosen payload into RAM. For this demo, Ive made a general-purpose payload that runs each frame, and based on the buttons the player presses on controllers 2,3, and 4, can pretty much write any value to any address in RAM. (source here: https://pastebin.com/1pHVRsVC) 7:12 - This section is again standard regardless of payload. We mess with the internal variables of the file select menu so that file 1 gets copied over file C6C2. The effect of this is that the game state destructor of the file select menu is corrupted to a new value based on the filename file 1 had. With the name we chose, this will cause our payload to run once, as soon as file select unloads. The payload itself is responsible for hooking itself back into the game loop to run every frame. 7:38 - The setup is complete. Now, by pressing well chosen buttons on controller 2-4, we can modify RAM as we please as we play the game. At this point the possibilities are truly endless, and I demonstrate the tiniest fraction of what is possible. For a more detailed explanation on the title screen payload entry, see my previous video: https://youtu.be/wIyEUScOMxc$

SMW Arbitrary Code Execution: Instant Bowser Kill

SMW Item Box Dino Rhino - Consistent Method

[S] Act 7 redubbed with more fitting music.

Ocarina of Time Glitch - Prevent Dark Link from ever attacking

Bypass Goomba Village yellow block from left (NPC Lure + Super Boots)