Skip to content

amaurea/sm_eac

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

The recent discovery of arbitrary code execution in Super Metroid opens up
the possibility for entertaining playaround TASes of the game that reprogram
the game on the fly. However, quite a bit of bootstrapping is necessary before
that can be done, and tools for doing that are quite lacking. When I started
trying to implement this, I found that to set up the main resident code, I had
to fist write it in assembly, then assemble it, then write new assembly code
for loading those bytes, then assemble that code, and convert the result into
lsnes input. That's not something you want to do manually if you can avoid it!

So instead of doing things that way, I wrote a lsnes input file pre-processor
that allows you to insert assembly code inline in input files using a simple
macro language. As a simple example, the end of the current any% movie
looks like

F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|......l.AX......|................|................|................
F.|........AX......|................|................|................
F.|.........X......|................|................|................
F.|...Su...A.L.0..3|....ud...XL.0...|B...ud.r.X....2.|.Ys......XLR0.2.
F.|................|................|................|................
F.|..s..dl.A.L.0..3|....u..rA..R0...|B...ud.r........|.........XL.....
F.|................|................|................|................
F.|B.......A.L.0..3|BY.Su.....L....3|B...udlr........|.Ys......XLR012.
F.|................|................|................|................
F.|BY..udlrA.L.0..3|....u..rAX..0...|B...ud.r...R..2.|.........XL.....
F.|................|................|................|................
F.|.Y......A..R01..|................|.Ys.........01..|................

The normal controller input ends on line 6 - the rest corresponds to
assembly code. This can be generated using

F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|......l.AX......|................|................|................
F.|........AX......|................|................|................
F.|.........X......|................|................|................
@inline 1
 lda #$4218
 sta $0c68
 ply
@inline 1
 lda #$26
 sta $998
@inline 1
 lda #$80
 sta $7ed821
@inline 1
 lda #$12cf
 sta $09c8
@inline 1
 stz $0c40

For something as simple as this, there isn't much of an improvement. A
more realistic example is

F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|......l.AX......|................|................|................
F.|........AX......|................|................|................
F.|.........X......|................|................|................
@global
 main            = $f440
 main_long       = $7ef440
 bufaddr         = $f500
 run_every_frame = $f600
 tbuffer         = $01df
# Make sure we're called repeatedly
@inline 1
 lda #$4218
 sta $0c68
 ply
# Bootstrap the following code, placing it at the previously defined
# main_long, which is a region of free space in ram.
# This will be our main loop later.
@boot main_long 1
 ldx #bufaddr
 ldy $421a
 dataloop
 jsr read_controller_bytes
 jsr bufaddr
 tya
 bne dataloop
 jsr run_every_frame
 jmp @$90e695

 read_controller_bytes
 recloop
 lda #1
 sta $4016
 stz $4016
 phy
 ldy #$10
 bitloop
 lda $4016
 lsr
 rol 0,x
 lsr
 rol 4,x
 lda $4017
 lsr
 rol 2,x
 lsr
 rol 6,x
 dey
 bne bitloop
 ply
 txa
 clc
 adc #8
 tax
 dey
 bne recloop
 rts
# Set up our per-frame jump to the main loop
@boot tbuffer 1
 jmp main_long
@inline 1
 lda #tbuffer
 sta $a42
# At this point we're fully bootstrapped. We can now return control to the
# game (but it will now call our resident function every frame)
@inline 0
 stz $0c40
# We can now play the game normally...
F.|.........X......|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|................|................
# And run large amounts of code any frame we want, at a far greater
# speed than the bootstrapping code. This does not interfer with normal
# input during this frame. For example, this code jumps to the end of the
# game. But since we're now dealing with subframe input, we can easily
# do much more now.
@code
 lda #$26
 sta $998

This assembles into the following input. The repeated patterns are
due to the repeated lda-sta-rts pattern involved in the bootstrapping
procedure (which is all handled transparently by the @boot macro).
The amount of lag-frames to insert are controlled by the last argument
of @inline and @boot. These were 1 in this case, hence all the empty
lines. Towards the end, you can see some subframe input from the
@code macro. Notice how the previous frame's controller two input
has been changed to indicate the number of subframes to read. That's
done automatically by @code.

F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|........AX......|................|................|................
F.|......l.AX......|................|................|................
F.|........AX......|................|................|................
F.|.........X......|................|................|................
F.|...Su...A.L.0..3|....ud...XL.0...|B...ud.r.X....2.|.Ys......XLR0.2.
F.|................|................|................|................
F.|B.s...l.A.L.0..3|BYsS.d...X......|B...udlr........|.Ys......XLR012.
F.|................|................|................|................
F.|BYsS.d.rA.L.0..3|BYsS.d...X....2.|B...udlrA.L.01..|.Ys......XLR012.
F.|................|................|................|................
F.|...Su.l.A.L.0..3|BYsS.d...X...1..|B...udlr.X....2.|.Ys......XLR012.
F.|................|................|................|................
F.|..s.....A.L.0..3|BYsS.d...X...12.|B...udlr...R.12.|.Ys......XLR012.
F.|................|................|................|................
F.|...S....A.L.0..3|BYsS.d...X..0...|B...udlr..L.....|.Ys......XLR012.
F.|................|................|................|................
F.|........A.L.0..3|BYsS.d...X..0.2.|B...udlrAXLR.1.3|.Ys......XLR012.
F.|................|................|................|................
F.|B..Su...A.L.0..3|BYsS.d...X..01..|B...udlrAX.R....|.Ys......XLR012.
F.|................|................|................|................
F.|BYsS.dlrA.L.0..3|BYsS.d...X..012.|B...udlr..L.....|.Ys......XLR012.
F.|................|................|................|................
F.|........A.L.0..3|BYsS.d...X.R....|B...udlrAXLR.12.|.Ys......XLR012.
F.|................|................|................|................
F.|.Y.Sud..A.L.0..3|BYsS.d...X.R..2.|B...udlrA..R.1.3|.Ys......XLR012.
F.|................|................|................|................
F.|BYs..dl.A.L.0..3|BYsS.d...X.R.1..|B...udlrA..R....|.Ys......XLR012.
F.|................|................|................|................
F.|B.s.u..rA.L.0..3|BYsS.d...X.R.12.|B...udlr.......3|.Ys......XLR012.
F.|................|................|................|................
F.|........A.L.0..3|BYsS.d...X.R0...|B...udlrA...01.3|.Ys......XLR012.
F.|................|................|................|................
F.|...S.dl.A.L.0..3|BYsS.d...X.R0.2.|B...udlr.X......|.Ys......XLR012.
F.|................|................|................|................
F.|B..Sud..A.L.0..3|BYsS.d...X.R01..|B...udlr...R.12.|.Ys......XLR012.
F.|................|................|................|................
F.|.Y......A.L.0..3|BYsS.d...X.R012.|B...udlr.X.R0.2.|.Ys......XLR012.
F.|................|................|................|................
F.|B.s.....A.L.0..3|BYsS.d...XL.....|B...udlr...R....|.Ys......XLR012.
F.|................|................|................|................
F.|........A.L.0..3|BYsS.d...XL...2.|B...udlrA.L.01.3|.Ys......XLR012.
F.|................|................|................|................
F.|...S.dl.A.L.0..3|BYsS.d...XL..1..|B...udlr.X......|.Ys......XLR012.
F.|................|................|................|................
F.|.Y..u.l.A.L.0..3|BYsS.d...XL..12.|B...udlr..LR.12.|.Ys......XLR012.
F.|................|................|................|................
F.|........A.L.0..3|BYsS.d...XL.0...|B...udlr.X..0.2.|.Ys......XLR012.
F.|................|................|................|................
F.|..sS.dl.A.L.0..3|BYsS.d...XL.0.2.|B...udlr.....1..|.Ys......XLR012.
F.|................|................|................|................
F.|B.s.ud.rA.L.0..3|BYsS.d...XL.01..|B...udlr...R.123|.Ys......XLR012.
F.|................|................|................|................
F.|.Y......A.L.0..3|BYsS.d...XL.012.|B...udlr.X..0.2.|.Ys......XLR012.
F.|................|................|................|................
F.|..sS.dl.A.L.0..3|BYsS.d...XLR....|B...udlr......2.|.Ys......XLR012.
F.|................|................|................|................
F.|.Y..u.l.A.L.0..3|BYsS.d...XLR..2.|B...udlr..LR.12.|.Ys......XLR012.
F.|................|................|................|................
F.|.....dl.A.L.0..3|BYsS.d...XLR.1..|B...udlrA...0...|.Ys......XLR012.
F.|................|................|................|................
F.|BY.S....A.L.0..3|BYsS.d...XLR.12.|B...udlrAXL.0.23|.Ys......XLR012.
F.|................|................|................|................
F.|.YsSu.l.A.L.0..3|BYsS.d...XLR0...|B...udlrA...0.2.|.Ys......XLR012.
F.|................|................|................|................
F.|...Su...A.L.0..3|BYsS.d...XLR0.2.|B...udlr.XL.0..3|.Ys......XLR012.
F.|................|................|................|................
F.|....u...A.L.0..3|BYsS.d...XLR01..|B...udlr........|.Ys......XLR012.
F.|................|................|................|................
F.|B.s.u.l.A.L.0..3|BYsS.d...XLR012.|B...udlrA...0...|.Ys......XLR012.
F.|................|................|................|................
F.|BY.S....A.L.0..3|BYsS.d..A.......|B...udlrAX.R.1..|.Ys......XLR012.
F.|................|................|................|................
F.|.Ys.....A.L.0..3|BYsS.d..A.....2.|B...udlr........|.Ys......XLR012.
F.|................|................|................|................
F.|.Y.Sud..A.L.0..3|.......rAX.R0123|B...ud.r.X......|.........XL.....
F.|................|................|................|................
F.|BYsS.d..A.L.0..3|.......rAXL....3|B...ud.r.XLR012.|.........XL.....
F.|................|................|................|................
F.|BY.SudlrA.L.0..3|....u.l..X....2.|B...ud.r.......3|.........XL.....
F.|................|................|................|................
F.|.Y......A..R01..|................|.Ys.........01..|................
F.|................|................|................|................
F.|.........X......|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|................|................
F.|B......r........|................|..............2.|................
..|..s..dl.A.L.0..3|....u..rA..R0...|B...ud.r........|........A.L.....
..|.Ys.............|................|................|................

About

Super Metroid Arbitrary Code Execution

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages