Manual arbitrary code injection in Super Mario World [video] (opens in new tab)

(youtube.com)

145 pointsbendykstra10y ago11 comments

11 comments

11 comments · 6 top-level

smaili10y ago· 5 in thread

Just out of curiosity, are there any risks of corrupting the cartridge?

The game code itself is in ROM, so there's no risk there. There is some nonvolatile storage on the cartridge used to save games, which could potentially be corrupted. The save state is so simple that I don't think there's any risk of trouble from that, besides losing (or gaining!) saved progress.

FreeFull10y ago

The game also stores a checksum of the nonvolatile storage, so even if you do corrupt it, it will be detected and cleared.

Drakim10y ago

Actually, you could in theory craft save-data that softlocks the game when the save-data names are displayed. If the game isn't programmed to wipe bad save data you'd be in trouble.

Not saying this is the case for SMW, but there are certain cartridge games where this can happen naturally.

JonnieCache10y ago

There are exploits used by speedrunners in Donkey Kong Country 2 that can cause corruption to the nonvolatile save state which will "brick" the cart. It can be fixed by opening the cart up and disconnecting the battery.

jtolmar10y ago

I hope someone eventually finds a way to perform arbitrary code execution based on SRAM.

Probably not on SMW, but Pokemon is getting broken enough that it may some day be possible. There's already inventory-based exploits that can get saved across resets, but someone still has to play the game and open up the inventory screen for that.

BHSPitMonkey10y ago

Really scary stuff. I hope the SNES Security team is taking this seriously and gets a patch out to customers quickly.

josso10y ago

Really impressive job by SethBling and p4plus2.

The notes for how to replicate it can also be found in this Google Document[1] and the payload for the injected game itself is also available[2].

[1]: https://docs.google.com/document/d/1TJ6W7TI9fH3qXb2GrOqhtDAb...

[2]: http://paste.ofcode.org/EiTmWXkmqJ4eAcJBvqEDwz

leeoniya10y ago

this one is also pretty crazy:

Super Mario World Credits Warp Explained

https://www.youtube.com/watch?v=vAHXK2wut_I

pbkhrv10y ago

Reminds me of what it takes to debug a dozen microservices talking to each other.

matt_morgan10y ago

My 9 year old son, a SethBling fan (like me), got home from school right when I clicked on this. I had to explain why I was watching YouTube while "working." Great video for us to watch together!

j / k navigate · click thread line to collapse