SeedBorn
This is a proof of concept aimed at removing the large hover normally used to dupe skulltulas in Lost Woods (e.g. youtube.com/watch?v=53sZP75c__o). Ideally we would produce a good setup for clipping out and landing in the walkway to the Goron City loading zone, as I do here, either with a low height hover or bomb push.
updated 5 years ago
Below I'll outline the full method for doing this trick, but if you're just interested in messing around with the custom RAM editor (missing textures and all), you can simply write the following values (addresses for version 1.2) to replicate the result of the rta setup without the hassle:
Set 800F9238 to 8001EC00
Set 800E8720 to 800E8730
Set 800E8728 to 800E8732
Doing this glitch requires 4 applications of lightnode srm (some technical information about which is available here docs.google.com/document/d/1Xf0mTcGwxbuBBFX1TYhKuRdfdH34wW9492RN-1YmIUM/edit).
Each srm has the same heap setup, shown here youtube.com/watch?v=Udk4ckbeucY.
The first srm uses the file 1 name, 800FC550 803F0F0A
(file names can be converted from hex to characters with lemon32767.github.io/ootfname). The angle for dropping the rock is ACA0, and a setup is shown here youtube.com/watch?v=vZA7u2XCsoE.
Each time you do lightnode srm it breaks the actor heap, so you'll need to transition areas (to deku tree) before doing anything.
After the first srm, die and quit back to title (you can save) and enter 016C0080 800F9235 as file 3. You'll know your srm was successful if Saria greets you when you start file 1 again.
Now file name 3 should be copied to the inf_table flags (at 8011BB8E specfically). Performing another lightnode srm with angle BB8A (setup youtube.com/watch?v=plY441oAe7M) should open the event editor (at the cost of textures).
Now we can do the same srm with the same angle, except beforehand we'll use the event editor to write 800E8718 800E8730 to 8011BB8E. In binary this looks like
inf_table[11] inf_table[12]
8 0 0 E 8 7 1 8
1000 0000 0000 1110 1000 0111 0001 1000
inf_table[13] inf_table[14]
8 0 0 E 8 7 3 0
1000 0000 0000 1110 1000 0111 0011 0000
Repeating the srm with these values should cause inf_table[0] to read 1000 0000 0001 0001 and the label of inf_table[2] to become a huge mess of English and katakana.
Now do the same thing again, except this time we write 800E8720 800E8732 to 8011BB8E. In binary,
inf_table[11] inf_table[12]
8 0 0 E 8 7 2 0
1000 0000 0000 1110 1000 0111 0010 0000
inf_table[13] inf_table[14]
8 0 0 E 8 7 3 2
1000 0000 0000 1110 1000 0111 0011 0010
If this final srm is done correctly, inf_table[1] should read 1011 1011 0111 1100 and the label for inf_table[2] should have disappeared.
At this point, scrolling down past inf_table[2] will crash the game. So don't do it. Note that while this can be taken between areas, the function that we hijack to run the event editor does not run everywhere, so it won't be available in some places.
Huge thanks to the OoT discord for finding this. As far as I'm aware, the people who participated in discussing/testing are
MrCheeze
Savestate
Natalyahasdied
Blini
Yanis
Mephisto
MutantAura
Evilas
Iyce
Primary file 8くマズCヂツァ (hex 08117898AD9C6B88)
Secondary file 87Sはッヂツt ( hex 0807BD238D9C6BD8)
The heap manipulation steps are identical to any%, except that any time between entering the observatory and pressing ocarina you'll need to open the pause menu, place the mask screen cursor over the Blast Mask or All-Night Mask slot, and place the quest status screen cursor over New Wave Bossa Nova. This forms the requisite 4 byte value which the ACE copies to menu status, opening the debug menu.
A translated version of the menu is available at tcrf.net/Proto:The_Legend_of_Zelda:_Majora%27s_Mask/Debug_Version/Inventory_Editor
This is a tool-assisted demonstration of a Majora's Mask 100% speedrun performed with Arbitrary Code Execution (ACE). Briefly, ACE allows players to modify the game's code while playing it, which allows for an unprecedented level of control over the speedrun.
The run begins, as all Majora's Mask runs do, with first cycle. For those interested in skipping past the cutscene-heavy introduction, here are some timestamps:
22:42 Start of Meaningful Gameplay
24:05 Setup for SRM/ACE
24:49 All Hell Breaks Loose
At 37 minutes in there are some rapidly flashing colors for ~10 seconds. Viewers who are photosensitive may wish to skip this part.
Additionally, I've prepared a Q&A to cover the questions I anticipate will be most common:
Q: Is this a modified version of the game?
A: No! Everything that's happening here is occurring on an unmodified copy of Majora's Mask, and the video is of a continuous playthrough. It was recorded on an emulator (Bizhawk) which allows me to select the inputs I require each frame. In principle the entire run could be recreated on a real N64 console (though the inputs would be unrealistic for a human).
Q: What are you doing to this poor game?
A: During the ~12 seconds that Link plays the ocarina in the graveyard, controllers 2, 3 and 4 write a chunk of assembly code into RAM that essentially serves as the 'cheat codes' for the rest of the run. Those codes are activated by controllers 2-4 during the course of the run, and basically control everything that happens.
If you're interested in an in-depth technical explanation of how this is possible, see youtube.com/watch?v=RoEmGCNsbno.
Also, youtube.com/watch?v=AUVfgZnQLRk provides an introductory explanation of total control ACE in MM.
Q: Is this a real speedrun category?
A: Sort of. The ruleset I'm using here is that of the 100% speedrun (the full rules for which are available at speedrun.com/mm#100). That speedrun bans ACE, however (this video should be enough of a justification as to why).
Q: How does source requirement interact with ACE
A: ¯\_(ツ)_/¯
...but seriously. The 100% speedrun has a stipulation that requires items be obtained from their original source in the game (to ensure that some amount of gameplay is preserved in the presence of glitches that can place items directly into one's inventory). What exactly satisfies this requirement when we have full control over the game is up for interpretation and (since this glitch isn't legal for leaderboard submissions) has no conclusive answer. I've done my best to respect this requirement while creating this run, erring on the conservative side.
Q: Is this run as fast as possible?
A: Not even close! This relates a bit to the previous question, as a notion of 'fastest' or 'optimal' only exists when there is a rigorous set of rules governing things you can and can't do. However, even with the way I decided to interpret the rules for this run, the goal was never to create something that's optimal. While any speedrun that makes full use of ACE is naturally going to outpace non-ACE runs, in creating this video I opted for viewability over speed. At the end of the day this is meant to be an entertaining 'what if' sort of video. If I were cutthroat about optimizing it, I could easily see the post-ACE gameplay being 90+% load screens, with only a few frames spent in each scene. Not only would that have been unfun to watch, I wouldn't have enjoyed making it.
Q: Why make this video?
A: A few reasons. First, ACE is an incredibly cool glitch, but it's a little too broken for RTA runs. It also is infeasible for human runners to showcase its full potential due to the incredibly precise nature of the inputs required; it's much more at home in a tool-assisted environment. Even though ACE has existed for the better part of a year in the Zelda64 games, no one had used it for any sort of large-scale project. The idea of doing a longer speedrun with it -- something that wouldn't end immediately after performing ACE -- was lucrative.
Additionally, the existence of the source requirement rule is what made this project so interesting. That rule (at least in my interpretation of it) prevents using ACE to completely break the game apart, and relegates it to an insane speedup tool. It was a fun challenge to essentially have access to a RAM editor and have to come up with quick ways to obtain everything from its intended source.
The goal here is to get the word at 80400A74 (this is the watch I have on screen) to read 08141B57. The steps used are
1. Target the wall in front of the rock circle for angle 1078.
2. (Optional) Move into the center of the rock circle. This costs some time, but I find the visual cues from the center to be much better than standing up against the wall.
3. Go into C-up and hold a full left input for 2 frames
4. Exit C-up and press B to aim the deku shooter. Hold a full left input for 13 frames, then a full right input for 12 frames. This will put you at angle 1B57.
5. Cancel out of first-person mode and target. Even though you're already at that angle, the target is required to set the target memory address correctly.
6. Press A to deku spin
7. Press B to go back into aiming mode. Hold a full right input for 8 frames and then switch to a full left input for 3 frames.
I show this setup both with kz's frame advance and with pause buffering. Note that any visual cues will depend at least somewhat on exactly where you stand, so you may be well off finding some cue for a consistent position. Also note that you can practice this setup on kz on VC just as well as N64 if you don't have an everdrive. The equivalent addresses on the other versions are 80400D34 (JP 1.1) and 80400884 (Eng).
Active file 8さもベッィテて (hex 08142CA3 8D896C1C)
Secondary file 8くマゾCィツh (hex 0811789A AD896BCC).
As before I recommend using this lemon-sherbet.github.io/ootfname to help ensure your file names are correct.
A translated screen along with some description of what is available from the debug menu is available at tcrf.net/Proto:The_Legend_of_Zelda:_Majora%27s_Mask/Debug_Version/Inventory_Editor. I also have a video which describes some of the interesting results one can get from this menu youtube.com/watch?v=oQqOHQBL3Ts.
Don't forget that file name is important. Your active file needs to be named 8さもベひてぼ0 (hex 08142CA3 241C5400), and after resetting post-SoT you need to create a file named 8きんYピウ0f (hex 081037C3 A65C00CA). kz is great for practicing this trick (I would say ram watch is basically necessary), but even on N64 the trick will not work on kz because of the way it modifies the heap. If you don't have access to an Everdrive, I would still recommend using kz on vc to practice the angle setups. I also recommend using this tool lemon-sherbet.github.io/ootfname to help make sure you're typing in your file names correctly. The watch used in this video is 80400A74, x32.
This run also takes advantage of MM's ability to have two file names in memory at once. The file name for the file I'm actually playing on is 8さもベひてぼ0 (hex 08142CA3 241C5400), but during the reset after obtaining Song of Time I created a file with the name 8きんYピウ0f (hex 081037C3 A65C00CA). Having both files opens up enough leniency in what sort of heap manipulations are allowed, which in turn lets us use the above-mentioned angles instead of zora fins.
I've put together another video explaining how one would perform these setups rta youtu.be/EMQzCaEVEjo.
Here are some other videos on ACE and related topics in Zelda64 that you might want to check out:
Original SRM discovery video
youtube.com/watch?v=6Q2Goj6DYOE
Original OoT ACE video
youtube.com/watch?v=RoEmGCNsbno
Explanation of SRM and ACE
youtube.com/watch?v=SPi_d0zhNFc
Replacing draw functions with SRM
youtube.com/watch?v=TXnPDeG2dWQ
ACE in MM
youtube.com/watch?v=xb9yijgukak
Using two file names in MM
youtube.com/watch?v=tG0-HlmW2QI
Thanks to MrCheeze for helping me find where to enable the other controllers.
The file names used in this video are 8さもベぉてラせ and 8きぢぽEラさず.
Setting up memory to allow this trick to work in Astral Observatory (including obtaining zora mask for the prerequisite fins) required searching through millions of permutations, which was possible entirely due to FullGrownGaming's Project Oceanside heap simulator github.com/fullgrowngaming/Project-Oceanside. We were even fortunate enough to get heap manipulations which are, in my estimation, quite simple.
In terms of any%, this should be faster than the current route which does moonwarp from Deku Palace. All of the strats shown in this video are rta viable (though of course some may benefit in consistency from pause buffers). I've written up a text document describing all of the steps (aimed at rta), available here pastebin.com/Z0BB87gB.
Due to using ACE, the only official version this is possible on is N64. The file name used here is 8きぽヌピば0f.
This video isn't meant for learning to do this trick rta, as we don't have setups for all of the steps yet. However, for people who want to attempt to reproduce it or work on setups, I'll try to give an overview of the steps, especially the parts that might not be obvious from watching.
The chest srm setup (by FullGrownGaming) is
(Begin from a void or entrance after the bad bats have been defeated and the chest spawned)
Load room 0
Load room 1
Allocate bomb
Load room 0
Deallocate all three pots
Allocate bomb
Allocate bomb
Load room 1
Deallocate the pot on the left as you enter and the pot by Flat's door
Load room 0
Allocate bomb
Load room 1
The rupee cluster needs to be handled carefully during this setup. Any time room 0 is entered from room 1, it is assumed that the rupees will load after room 1 has unloaded. This is why I keep my camera facing away from the rupees any time I enter room 0, and make sure that I load them before going back into room 1.
If this setup is done correctly, the pot farthest from the load plane will allocate at 80415C00, and upon reentering the room after SRM the chest will load at 80415AA0. To get zora mask without opening the chest, Link needs an angle of FF86 after SRM.
The heap setup for the credits warp in the graveyard is
Load room 0
Load room 1
Break all of the bushes, collect all their drops
SoDT (night 1)
Reload room 1 twice
There should now be a rock loaded at 80415280 -- this is the one we want to use for SRM (see video for which rock it is). Break the rock loaded at 80414970 (again see video) before doing the superslide. Once the SRM is set up, load room 1. One of the flame gates (Bg_Botihasira, id 01F0) should now be loaded at 801F5200, and you should be writing to its draw function with your angle. Get an angle of BC24 and drop the unloaded rock.
Now the draw function is set correctly, but we have yet to manipulate the data where it's pointing. If you uncull the gate at this point, the game will crash. Certain parts in the northeast corner will uncull the gate, depending on your camera angle. The movement I use in the video is designed to avoid that. Before a fin can load where the draw function is pointing, some space needs to be made on the heap. This is why I hit the lantern, to deallocate the hidden rupee spawner (En_Hit_Tag, id 0265), and then collect the rupees it spawns. After this is done there is space for a fin to load at 8040BC10, so its initial rotation values will be at 8040BC24 (which is exactly where the draw function is pointing).
Next I throw zora fins, making sure that the left fin spawns with an initial rotation of 08141B57 (this jumps to the copy of the file name stored at 80506D5C, not the one in save context). The fins' initial rotations are copied from Link's rotation (Link + 48), except 190 is subtracted from the left fin's horizontal rotation and added to the right fin's. This means Link has to have a rotation of 08141CE7 before throwing fins.
With everything set up, SoT has to be played while the gate is attempting to draw. This actually has to be accomplished while the left fin is still allocated -- if the fin is gone, the SoT effect will load over that fin and destroy the command that we manipulated. I've found that a consistent way to make sure the gate is drawing is to take off zora (so that you have freedom of camera movement), target the wall to the left of the sign and turn left (as usual, see vid). Pulling ocarina from this position/angle seems to put the camera in a good place to keep the gate active.
Watching this back I realized that I was talking about cutscene 7 when the 'current cutscene' address I had up shows 8. Conventionally alternate scene setups are numbered starting from 0, so what I should have said is that scene setup is 7 but cutscene value is 8.
Related videos, in roughly chronological order:
Original SRM video (youtube.com/watch?v=6Q2Goj6DYOE)
ACE in OoT (youtube.com/watch?v=RoEmGCNsbno)
Replacing draw functions with SRM (youtube.com/watch?v=TXnPDeG2dWQ)
ACE credits warp in OoT (youtube.com/watch?v=YlADOm4G6pM)
OoT any% explanation (youtube.com/watch?v=wdRJWDKb5Bo)
Explanation of SRM and related glitches (youtube.com/watch?v=SPi_d0zhNFc)
Here are the steps used in this video in text form (pastebin.com/55dN8i9S)
Here are the entrance values that would work for this warp (pastebin.com/wXGde96M)
Thanks to FullGrownGaming and Imbued for looking into setups for this. We should have something suitable for speedruns soon.
The angle required on both the JP Collector's Edition and MQ disc versions is 0x862C, for which I show a setup in the video. After performing the setup, get item value will be determined by the byte at 801EC9B7.
The steps, in text form, are
-- Drop a fish
-- Drop a bomb
-- Catch the fish
-- Drop a chu
-- Drop the fish again
-- Let the bomb explode
-- Enter Darunia's room with the chu and fish still loaded
-- Allow the chu to explode and leave Darunia's room
-- Re-enter the main room
-- Destroy the 3 pots on the middle level
-- Superslide off the bottom left pot (the bottom right pot can either be loaded or destroyed, but its dropped item must not be loaded)
-- With the unloaded pot in hand, get the required angle
-- For angle 0x862C, target the wall where shown (0x3FD7), do 2 ess turns right (0x31C7), release target and flick up to snap Link to the camera angle (0x31CC), 12 ess turns left (0x862C).
-- Leave Darunia's room at that angle, drop the unloaded pot when in between the two rooms
-- In order to manipulate get item value, you can drop a chu, drop a fish and then pull hookshot. Item value will be determined by the least significant byte of a z coordinate in the hookshot (not truncated -- this is different than the address used in the non-GCN setup).
-- If you have bow, you can instead drop a chu, fire an arrow then pull hookshot to manipulate get item value.
Timestamps for easy navigation
(0:00) Introduction
(1:07) Identifying where the loading planes are
(2:45) Allocation setup
(4:54) Superslide
(5:26) 1.2 angle setup
(6:36) Note about gz savestates
(7:44) What goes wrong with the actor list
(9:32) Fixing the actor list
(10:15) Finishing the SRM
(11:33) Manipulating get item value
(12:01) Warning about positive get item values
(12:41) Example item setup
(14:08) Manipulating with bomb instead of hookshot
(14:37) Some more warnings
Here's a shorter video focused on explaining how/why the this trick works, if you're curious (youtube.com/watch?v=lyfQ8XF_ML0).
Watches used in the video, along with display type for gz:
Link's facing angle 801DB3A6, x16 (1.2) / 801DAAE6, x16 (1.0)
Pointer to next actor after pot chest 801EBF08, x32 (1.2) / 801EB648, x32 (1.0)
Get item value of pot chest 801EC2F7, x8 (1.2) / 801EBA37, x8 (1.0)
(Get item value is at pot chest + 0x584, and when manipulated will be hookshot/bomb + 0x1B7)
The angle at which you need to drop the unloaded pot is 0x7E70 (1.2) / 0x75B4 (1.0) / 0x7774 (1.1)
Some more points of caution that didn't make it into the video
-- Entering from Lost Woods is the same as entering from DMT or shop for allocation purposes, I just forgot to mention it.
-- While manipulating get item value, be sure that your bombchus don't hit things (walls and bomb flowers in particular) or your allocation may get messed up.
-- Once you're doing item setups, if you're going to use sword for setting up position, drop chus and pull hook after you've used sword.
-- When opening the chest, the game will write some data just beyond the pot's instance (that would be meant for a normal treasure chest). This is where the second bombchu used for manipulating item value loads, and if the chu is still loaded this will corrupt that chu's x coordinate. On N64 this will crash the game, but can be prevented by letting that chu explode before opening the chest.
Useful links related to the trick:
Whole trick performed more optimally, front to end youtube.com/watch?v=rISna9mV16w
Hookshot setups for obtaining items docs.google.com/spreadsheets/d/1gTyeY8ko0QEspd3wqL6czZVlpYjQ7Sr9KA9LIhbeIXw
Chu superslide setup youtube.com/watch?v=dD1aa4IXINg
1.0 angle setup youtube.com/watch?v=ob_xGEvUgds
Items obtainable from the chest pastebin.com/APHKs6cv
This video is an overview/summary of using draw function replacement (youtube.com/watch?v=TXnPDeG2dWQ) to get items in Goron City. For details on how to set the trick up, here is a tutorial for setting up the trick with a fish replacing the slingshot seed shown here (youtube.com/watch?v=4KwOhXSLb6o).
Big thanks to GlitchesAndStuff for the Project Zelda's Letter heap simulator (github.com/AdamKiddle/Project-Zeldas-Letter) which allowed me to find the heap manipulation used here, and also for discovering SRM in general. Thanks to Imbued for pestering me to actually use a script to find a setup, Tharo for helping look for setups, and Potato and DannyB for the idea to use Silver Gauntlets as a warp.
Here's a list of items we can receive with this (pastebin.com/APHKs6cv)
I show an example here in which I use SRM to change a bush's draw function to the function that runs when skull kid gives you the Saria's Song heart piece (which will be present wherever a skull kid overlay is loaded). The bush, after causing us to receive a heart piece, breaks (most actors, if we overwrote their draw function instead, would just give us infinite heart pieces...). This isn't a particularly useful example but it should be a good proof of concept.
This can be put into action in Goron City to create a manipulable chest (youtube.com/watch?v=lyfQ8XF_ML0). Another possibility for using this profitably includes skipping the frog HP in MM (twitter.com/TVand/status/1208624737599008773) by changing the frog's draw function to the HP reward one (pastebin.com/BBKi8qB4).
The setup (not shown) that I used to get the SRM comes from Discoverino/FGG (youtube.com/watch?v=HcpZOdjVN-E)
Exodus compiled an excellent spreadsheet with all things related to manipulation of get item values (docs.google.com/spreadsheets/d/1KwuvEWxijcRxigwJZVL3JnB9760FJIIH8tjTKcjck1k)
At (4:20) I said to put the chest down, of course I meant the 'unloaded pot.'
The address of the collision angle used in this video is 8077FFB6 (2 bytes) on NTSC-U. The first byte gives item value, the second determines flags.
To recap, two get item values that give easily manipulable item values are 112E and 1134. This video focuses on 1134 because I found it more convenient to work with. The item value given by 112E (located at 8077FF92 on NTSC-U) will, if you get a 'large chest' opening animation (which will happen if the game considers the associated item slot to be empty, as can happen for bottled items), change as Link opens the chest. It also does not change in a consistent way (i.e. standing in different places when you open the chest will give different results). The value given by 1134 is entirely consistent. Since it's a positive relative angle we can only get item values up to 80 with it, but that should cover all of the useful things on the item list.
As for the flag (second byte in the get item table entry) that determines when something turns into a rupee, it does so based on a determination of what's occupying the 'item slot' in which the item goes. If the slot is non-empty (value other than FF), a flag which includes the 0x20 bit will cause the item to be replaced with a rupee. Empty slots will be replaced with a blue rupee if the flag includes the 0x40 bit. For the purposes of this determination, most items past the normal inventory screen (this includes songs) check the Ocarina slot (each item's associated slot table entry is displayed in the spreadsheet linked above). When the inventory has empty bottle space, bottled items are regarded as having an empty slot; when there is no space they are regarded as full. More details on these item slot calculations are available at (pastebin.com/FMdekVwT).
The summarized version of the above is that for songs, the flag byte needs to not include 0x20. When aiming for a bottled item (e.g. Deku Princess), if you have full bottles the flag byte must not include 0x20, and if you have empty bottle space it must not include 0x40 instead.
Setup for the glitch:
0. Be playing on the Japanese version.
1. Enter Deku Palace *either* from the swamp or from getting caught.
2. Enter the room that's on the right side (relative to the Palace entrance), leave and reload it once.
3. Collect the rupee shown in the video.
4. Hover onto the barrier and boomerang the rupee shown into roughly the same position. The rupee's location is not precise; all that matters is that it's on the left fin's path.
5. Go the the door frame as shown, target it to get a straight angle, and make sure you are firmly in the corner. For those of you with access to ram watch, Link's angle should be 0x8000 and his X and Z coordinate should be an even 334 and 1752, respectively.
6. Holding target, press B to slash three times, then jumpslash.
7. Turn straight left, put away sword.
8. Dry roll, release target and press B to do a horizontal slash.
9. Target again to straighten the camera.
10. Put on Zora Mask and hold B to go info first-person mode.
11. Hold straight down (in my commentary I forgot about inverted controls and said to hold up) on the control stick for one frame.
12. Release fins. On the first frame that they are detached from Link's arms, take off Zora Mask and hold straight down on the control stick.
13. As Link runs, look for the frame shown in the video. On that frame, pause, switch to straight up on the control stick, and buffer a target out of unpause.
14. Link should stutter and then run straight into the next room. Once you've caught the fins the precise part is complete and you can wait for an opportunity to get caught by the guard on the left.
If you'd like to know more about the glitch used here, its discoverer GlitchesAndStuff has an in-depth video on using it to manipulate chest contents (youtube.com/watch?v=_7E4dFD8Bmw).
This savestate began by getting caught by a guard. From there, the steps to set up the heap correctly are
1. Enter the right side room, then leave and re-enter once.
2. Collect the single rupee that I collected in the video
3. Boomerang the other rupee as shown up onto the barrier (I did this so that the fins traveled farther, so that I had more time to change rooms)
4. Changing the camera so that the rupee culls, move into the opposite room.
The resulting entrance value after you get thrown out is based on the two least significant bytes of the last x position that the boomerang writes as it returns to you (a table of all the possibilities is here docs.google.com/spreadsheets/d/1UabGnFx4WY8AjRrkXre_uQnv3ufSG57hJMhCih3NJQ0/edit#gid=659446526). The part of this trick that's currently not RTA-viable is catching the boomerang in a consistent position.
8011B4C0 on 1.0 and
8011BB70 on 1.2.
Ignore what I said about the fish causing collection delay. While technically true, it doesn't matter in a 100% setting because at that point you haven't done the RBA yet so the game isn't trying to give you the quiver at that time.
Unfortunately the audio from my capture card descyned from the video over the course of the run, so by the end there's a noticeable separation between the two.
It's also perfectly reasonable to skip using the deku stick to line up and instead get in position manually. Just make sure you know where a good place to stand is that gives you a consistent visual cue.
Conceptual explanation for opening the debug menu with glitches youtube.com/watch?v=_bEhd55rteI
Debug menu on Wii U twitch.tv/videos/422796023
Documentation of the basic features of the debug menu is available at tcrf.net/Proto:The_Legend_of_Zelda:_Majora%27s_Mask/Debug_Version/Inventory_Editor
As I said at the start of the video, research is still quite active in making the debug menu viable for main speedrun categories, but whether or not that happens the fact that it's accessible at all without cheats means there's a bevy of new things we can finally access!
This works in OoT as child, using the glitchy animation that happens at the end of the slide when you release the stick. Adult's animations don't quite get 'weird' enough for this. In MM, Link has similar animations to child in OoT, but due to that game's proclivity towards crashing out of weirdslides I wasn't able to get a solid example.
Edit: Dropping bombs out of weirdshots is something that's known, see youtube.com/watch?v=keLCh7cWik4 and youtube.com/watch?v=fB1dwVEBTks
Procedure:
-- Get isg
-- Target the wall, 1 ess turn right
-- Get inverted camera
-- Backflip 4x into the corner (required for a consistent starting position)
-- Sidehop (screen) left, instant drop a bomb
-- Sidehop (screen) right, pull a bomb
-- With the bomb fully above Link's head, shield drop and backflip
-- Sidehop (screen) left (note: don't hold shield during this sidehop, or the way Link interacts with the bomb's collision will give you a different position)
-- Backflip for a hover on big blue from the first bomb and first explosion from the second (both frame perfect)
-- Place a bomb and draw stick
-- On big red or any of the first three explosion frames, press stick
-- On the first frame that Link is completely off screen (the second frame of damage from the bomb), equip hover boots and hold up
Note: Additionally, if you do this without shield turning, you can preserve isg for subsequent duping.
Steps:
-- Get in the corner (isg is helpful)
-- Face the skull, dry roll
-- Turn around, 1 ess left
-- Backflip, hold target
-- During the backflip, equip hovers and hold right
-- On the first frame that Link is standing up from the backflip, input an A press to sidehop
-- On the next frame, equip Kokiri Boots and press Ocarina to delay the token
-- When you land, go over to the wall and target it. This ensures a camera angle that keeps the skulltula inactive.
-- Stay targeted and hold left. Once you are unfrozen and able to move, you can accept the textbox and sidehop out.
Steps:
-- Enter the door where shown
-- Target and turn left, sidehop right
-- Pull a bomb and begin to sidewalk on the same frame
-- On the frame shown, input your cutscene item. Don't mash it; if you hit the item a second time after this frame before hitting the ground, it will cancel the OI.
-- Once the camera starts to pan (which is shortly after the 'stop' text comes up on B) you can cancel the OI.
Steps:
-- Target the wall to get its angle.
-- Roll into the corner of the vines, as shown. Rolling into the corner repeatedly gives you a consistent position. I would recommend at least two rolls, as I did in the video.
-- Shield turn right. I draw my sword here to save a few frames.
-- Target and do a short roll (flick the control stick forward and press A).
-- Shield turn left. It's important that you are targeting as you crouch for your shield turn to keep a consistent camera angle. I recommend holding target through the first short roll, then beginning to hold shield before you release target. If you don't hold target your camera will begin to pan and this will mess up your angle after the shield turn.
-- Target and short roll again.
-- Remaining targeted, perform two vertical slashes (just press B twice).
-- Now you are in position to shield turn right, drop a bomb and turn goron for the clip.
Heart pieces are stored as the first digit of a byte (0x801EF51C on JP 1.0), so one heart piece would be 0x10, two would be 0x20, etc. Upon picking up your fourth heart piece this value is set to 0x40. Then, the next time you complete a text box, that digit will be zeroed and you will receive a new heart. Normally closing the heart piece's own text box does this for you.
One way to avoid closing a heart piece's text box is to change or reload areas while the collection text is up. Particularly convenient is the Blast Mask event, which does this for you. Unfortunately the bomb shop lady's text, which follows right after, will cause you to gain the heart. We can avoid that by using a stored SoDT to day reset as the event ends. This allows us to get away with having our heart piece counter set at 0x40.
From here, collecting more heart pieces increments the counter. The corresponding text boxes also increment, so we get some unintended text boxes when receiving hearts. The text boxes that come up are:
0x50 Receiving magic for the first time
0x60 Getting deku nuts for the first time as deku
0x70 Learning great spin
0x80 Double defense
0x90 Double magic
0xA0 Filling your bottle with milk
0xB0 through 0x00 Blank
If you collect heart pieces past this, the value will be back at 0x10 and function normally.
This glitch does not work on the English version because of a change to the way hearts are added. If you pick up a heart piece with heart count 0x30, it is immediately zeroed out and you receive a new heart. The counter never reaches 0x40.
(Note that the lowest bit of the heart piece byte is the flag for lullaby intro, so sometimes that byte will be 0x_1.)
youtube.com/watch?v=uVT21aOA_kI -- original action swap video
youtube.com/watch?v=Gxfxr-CcTIc -- Türkenheimer's no sound glitch video
wiki.cloudmodding.com/oot/Sound_Effect_Ids -- Sound effects in OoT
Here are some of the addresses I used, in case other people would like to mess with this:
Deku stick timer 0x803DB280 (OoT 1.0) / 0x80400AC8 (MM JP 1.0)/ 0x804008D8 (MM Eng)
Ranged weapon draw sound table 0x803AABF6 (OoT 1.0)/ 0x8077A3BA (MM JP 1.0) / 0x8077A43E (MM Eng)
I should note that at (10:14) I stipulate that we need to find something of the form 2X26 with X even and greater than or equal to 4. X does not have to be even, but regardless the working command I find in the video is the first working one.
Some more details that I didn't quite get to in the video:
-- As far as I've experienced, trying to play sound effects that are outside the designated banks (first digit greater than 6, at least in OoT) will just crash automatically.
-- Commands that would be in valid banks but don't correspond to actual sounds are generally unpredictable. The most regular case is that of the no sound glitch on English/PAL. Other than that, weird things can happen. The same command may or may not play the same sound if repeated. Sometimes commands will work fine but crash after multiple plays, sometimes they'll just crash anyways at a delay.
-- I did get the no sound glitch to happen once on JP 1.0 on Bizhawk, but the game crashed shortly thereafter.
-- In OoT it's fairly easy to get sounds such as the indicator for going in/out of first person or the textbox sounds to stop playing. Once I got Link to not make any vocal sounds until I reloaded the area. I haven't gotten the sound to completely cut out in OoT though.
-- I mentioned that this glitch crashes on VC and GCN. More specifically, the frame that was working on N64 crashes VC and GCN. It may be that there's a different sound instruction which wouldn't crash those consoles and would cause the no sound glitch, but they're difficult to test on as is so I'm going to leave that alone for now.
Steps:
-- Target the flower bed as shown. Do not release target until you are ready to receive the wallet.
-- Line up so that Link is on the right edge of the step, again as shown (the position isn't precise).
--Input a sidehop and immediately hold up. If done correctly, Link will grab and climb the ledge out of his sidehop.
-- Hold straight forward to walk off the flower bed onto the street, and talk to the banker.
-- After depositing rupees, move into the corner and release target. The sign will prevent you from getting the banker's followup text, which in turn stops the wallet's collection flag from being set.
-- Talk will be on A while you're near the banker; do not talk, or the flag will become set. If you want to use the bank you will need to reload the area.
To do that, I collect the wallet with Return A set, so that the game treats me as being in first person mode and unable to collect items. With the wallet collection delayed, I walk over to a sign. Deactivating the collection delay, I obtain the wallet in such a way that I will be facing towards the sign afterwards. Since the ability to check the sign takes priority over the banker speaking to me, the banker's text is delayed. (At this point if I move away from the sign towards the banker, I will have Speak on A. Pressing A would then trigger the banker's text and set the collection flag.) This can be done at any sign within the banker's collection radius, though consistency of camera angles may vary. It can also be done without a sign, but I found it far easier to use one.
Now the game has no record of me having collected the wallet. In depositing 200 rupees, however, I did set the temporary flag that says I got the 200 rupee reward for this cycle. Therefore I have to come back any time after a Song of Time to claim my second wallet. I do this immediately with storage in the video, but in a run one could just as well wait until a later cycle. The next time I withdraw and deposit back up to 200 rupees, I receive the Giant Wallet.
Similar tricks also work in OoT to dupe a bullet bag (youtube.com/watch?v=iQfZdjp-B3E) and quiver (youtu.be/M6gtWPyLPMw). This trick can easily be done as deku in first cycle (youtube.com/watch?v=lH5vKOxxMa0).
In order to set this up, I've used Cojiro rba to set my quiver slot to an unintended value. As is well-known, this causes the Ass Chest glitch (youtube.com/watch?v=mjlyi-Ie3Us), which most importantly gives us a sort of collection delay (the item from the chest is irrelevant here, I just open it for fun). After repositioning myself, I rba Cojiro with a fish to give myself the normal quiver 30. This will cause the Gerudo to properly award me my upgrade. I'm now standing in a place where, depending on my camera, the Gerudo may or may not be active.
I arrange it so that the collection triggers as the camera swings around in such a way that, as I collect the item, the Gerudo is off camera/inactive (I use a bomb which I drop as the camera pans to make it easier, but it's not required). As promised, this prevents the collection flag from updating. At this point, I can't allow the Gerudo back on camera, as she will immediately set the collection flag. I go down to the main fortress to properly reload the area so I can replay the game. I can then win again for my second upgrade.
This method should work for anything you can collect whose flag is set upon collection (a counterexample is the bomb bag upgrade in Goron City, the flag for which is set upon closing the text box to trigger collection, rather than at the start of collection). It works, for example, on the heart piece from the roof guy in Kakariko. It does not seem to work in more confined spaces like grottos.
Here's an example of it being used in MM: (youtube.com/watch?v=waJXIX08TDQ).
Edit: Some neat things have come out of this. Slask thought of a way to use this glitch to do ass chest without any RBA (youtube.com/watch?v=eWkM7j4JBJc). Tob has created setups for duping the Kak roof guy HP (youtube.com/watch?v=ZI_l1UTC9dM), and I made one as well using longshot (youtube.com/watch?v=QoaKsjUoAIw).
(0:00) -- Human with goron's textures.
(0:31) -- Human with deku's textures. Easily the wildest.
(0:59) -- Human with zora's textures. There's probably a way to get a better look at this, but you can catch a few glances when I go into and out of first person.
(1:36) -- Goron with zora's textures.
(2:23) -- Zora with deku's textures. This one might be my favorite, because it's crazy but not *too* crazy. Note that zora's fins are unaffected, presumably since they're loaded separately from the rest.
Edit: SampleName_ ran into this accidentally a few years ago youtube.com/watch?v=6MpSFWR4_b8
Explanation/notes:
-- Get in the corner and target the wall as shown. Make sure to retarget once in the corner for a consistent camera angle.
-- Untargeted slash, crouch stab twice, hold straight left and crouch stab, untargeted slash. Make sure you don't rush these inputs (in particular the untargeted slashes) or you may mess up your position. The speed at which I do these slashes in the video is a rough upper limit.
-- C-up a good angle. The range for this is rather large; you can see the full range here (imgur.com/a/cwf3tVt), where I've indicated in red some brick lines that run along the wall. You can see that the range of working angles extends well to either side of those lines, so if you aim to center on those you should have no issue. Another option is 5 ess turns right.
-- Place a bomb and immediately turn goron.
-- Target immediately.
-- On the first bright red frame of the third flash, curl. I pause on this frame for clarity.
-- On the first frame that Link's hat is no longer visible, pound. I pause on this frame as well.
-- Release the curl on the frame shown (the first frame where you see multiple images of Link) or the frame after.
The method I use takes advantage of the fact that, if the deku scrub who gives us the upgrade is not loaded when we accept the text box, the corresponding flag won't be set. We can easily enough unload the room by moving into another one, but if we simply delayed collection and changed rooms the collection trigger would also unload. My solution to this is to stand just in front of the unload trigger holding a bomb (which naturally delays collection), and have the exploding bomb scoot you across the trigger just as collection begins. This means that the scrub is unloaded by the time we close the text box, so the flag for having collected the upgrade is never set, allowing us to grab a second at will.
The way I achieve all of this in the video is as follows:
- After the third shot I get on the ladder as the cutscene starts. Being on the ladder prevents item collection.
- Just before the cutscene ends, I climb up off the ladder, giving me Down A (this is 2 frames).
- Since, without a dim B button, Down A prevents me from using items, I quickly get on and off the ladder to cancel it.
- I have 1 frame after climbing off the ladder to pull a bomb, further preventing collection.
- I walk to the nearby loading plane. The bomb boosts me just across the unload trigger for the scrub's room as it explodes.
The version I've shown here isn't the most RTA-friendly; I wanted to show off the fastest version I could think of. It wouldn't be tough to create a setup for doing this RTA -- you just need a reliable method for the collection delay and some position cue for where to stand when the bomb hits you. Another option that I didn't show here is to catch something in a bottle immediately as you shoot the 3rd seed, which gives you control during the first part of the scrub's cs. One could then set up collection delay from there.
X Coordinate 8011B954/8011C004
Y Coordinate 8011B958/8011C008
Z Coordinate 8011B95C/8011C00C
Stored Scene 8011B964/8011C014
In OoT3D: youtube.com/watch?v=bwYgef1pBnI
Another cue for the child warps that works great is Link beginning to leave the ground.
For those who are interested there are actually two such flags, 0x04 and 0x08 at 80400A0D on JP1.0 (these are in the same byte as first person mode/Return A). This is the same collection delay that targeting while climbing a ledge causes.
The first clip shows an application of the pound method. We can do the business scrub cs skip that was previously done by turning human and using a bomb for Return A entirely as goron. In the second clip I show that the delay works just by targeting after rolling off a ledge. In the third clip I show that it works out of a bonk, and that one can delay collection of the powder keg, spend all their rupees elsewhere, and still collect the keg, saving 50 rupees.
Here's dannyb doing the first duplication of an equip: youtube.com/watch?v=73IJwOiJlqU
I tried to cover the basics of setting up this trick and explaining why it works, but this video is far from exhaustive. The only application I've really presented is the one that seems most relevant to runs at the moment, but as I briefly mention there are others. For instance, you can equip up to 3 items over the same slot if it's a slot you can equip swap over. In OoT this means being able to equip swap multiple child items as adult or vice versa. You could also equip a bottled item to dupe over your Bow, even when equip swap would normally not allow this.
Here's a step by step on how to dupe bottle contents without overwriting any items:
-- Equip the bottled item you want onto C-Left (This is important, it needs to be this button)
-- Equip an elemental arrow and an item that's in a slot you can use for equip swap onto your other two buttons
-- Equip swap bow over the bottled item
-- Use one of the bottles
-- Equip the item that's on the equip swappable spot such that the remaining bottled item goes back over C-Left
-- Equip another elemental arrow and repeat
-- Lining up with the chest, bomb hover backwards off of it
-- Backflip on the 2nd blue frame of the 3rd fast flash (this is the frame before a setup from the entrance hovers)
-- Do 5 first frame chu hovers (thanks Fig), untargeting on the last one
-- Turn straight right, megaflip
-- Hold right briefly as you land (this is required for all megaflip frames to prevent popping out of the wall), you may need to hold slightly longer than with a setup from the entrance
-- A long jump in the same direction as your megaflip will put you into the grotto
-- Four sidehops to your right and a roll forward should put you into the loadzone