Famicom Super Mario Bros / Tennis cart swap trick

Famicom Super Mario Bros / Tennis cart swap trick
by noattack on 2012-06-08 (#95195)

I was looking up some info about the NES Super Mario Bros. localization and came across this site that explains a Famicom-specific cart swapping technique for accessing the 256 'minus worlds' in SMB. Since the trick involves removing the cartridge while the game is playing, the CIC precludes duplicating it on an NES.

There are two techniques described in the article (scroll down to the 'Super Secret Worlds' section for more details):

- Remove the SMB cart during gameplay. Insert a Tennis cartridge, reset, play a bit, then remove the cart. Insert SMB, reset, then use the A+Start stage select to begin play in a corrupted world.

- Version 2 uses a similar method, but involves the Family BASIC cart, keyboard, and a snippet of BASIC code executed during play:

Code:

FOR I=&H7D3 TO &H7DC：POKE I,0：NEXT
POKE &H7FF,&HA5
INPUT "WORLD=";A
POKE &H7FD,A+255AND255

The author includes a subtitled Japanese video of the first technique, which looks legitimate. The technique is also backed up by significant documentation in several Japanese SMB guides in the 1980s. Apparently this trick was well known.

Anyone heard of this before? Technique 2 seems almost like a homemade Game Genie. Could this be replicated on a top-loader (or a CIC-disabled front-loader)?

And, more importantly, how does this work? I find this fascinating.

by mikejmoffitt on 2012-06-08 (#95196)

If I'm not mistaken, this works simply because by hoding A+Start as you begin a game in SMB, it does not clear the values in ram associated with the current world. Normally, the value in ram will simply be the world you were previously in. By starting another game, which uses that address for a totally different reason, and pulling it and resetting, that value is never reset, so SMB uses whatever was there.

I believe it's the same principle behind Streets of Unbridled Fury:
http://www.youtube.com/watch?v=u1EmgeAXB-4

This should work with many games, with potentially different results - you may find yourself in a legitimate world like 2-8, even. On a toploader NES, this should work, as well as a CIC-disabled toaster.

by 3gengames on 2012-06-08 (#95197)

It apparently corrupts all the right RAM. And you should be able to do it on an NES too. CIC doesn't affect RAM, don't know how you came to the conclusion it won't work in a toaster.

by noattack on 2012-06-08 (#95200)

Turns out I had both Tennis and SMB. It took a bit of wrangling (my Tennis cart wasn't working well), but I can confirm this works on a top loader. Two of the minus worlds I arrived in crashed within a few seconds of play. The others were merely copies of valid levels.

I notice in the video from the article that, after removing the cart, the background tiles appear to slowly 'melt away.' I noticed this happening a few times for me too. What causes that effect?

And it was neat to swap carts mid-game and have their name tables update with tiles from the new pattern tables!

by Movax12 on 2012-06-08 (#95201)

40 POKE &H7FD,A+255AND255

What the heck does 255AND255 mean?
It doesn't look like Valid BASIC code, but I don't know Family Basic.

Maybe: A+255 AND 255

I can understand ANDing - to get a byte value only.. not sure about adding 255, assumimg the above the same as: (A+255) AND 255

If Order of Operations is AND first then it should just be: A+255

by tepples on 2012-06-08 (#95203)

Movax12 wrote:
assumimg the above the same as: (A+255) AND 255

Correct.

Quote:
If Order of Operations is AND first then it should just be: A+255

Variables in a lot of these old BASIC implementations are larger than 8 bits. Thus A+255 would be in the range 255 to 510, most of which would fail the range-check of the POKE statement.

by Movax12 on 2012-06-08 (#95205)

Yes, if family basic does range checking. I was guessing it may just take the low byte of the value and the code worked despite the error. But anyway, cool trick.

by Grapeshot on 2012-06-09 (#95250)

This probably wouldn't work on a toaster even with the CIC disabled just because it's difficult to insert and remove cartridges quickly.

The other important aspect of this trick is that Super Mario Bros only clears RAM on startup when any of the bytes used to store the score is greater than 10 or the value of the last byte of RAM is anything other thn $A5. Tennis, being another early Nintendo game, uses the same place to store the high score and the same signature byte, so the RAM is not cleared. The same trick might work with some of the other Nintendo black box games as well depending on how much code was reused.

by infiniteneslives on 2012-06-09 (#95251)

noattack wrote:
I notice in the video from the article that, after removing the cart, the background tiles appear to slowly 'melt away.' I noticed this happening a few times for me too. What causes that effect?

And it was neat to swap carts mid-game and have their name tables update with tiles from the new pattern tables!

Yeah I see the same thing when swapping games on the NESDEV1. It effectively does the same thing by tristating the cart's data busses and CIRAM inputs. IDK if it's really what's going on, but I always attributed the 'melting' effect to bus capacitance holding values that leak away.

by mikejmoffitt on 2012-06-10 (#95285)

My famicom will do that with removed games. After a few minutes, where it starts to become unstable with the data, moving my hand closer and further from the cartridge slot very visibly affects the data. It's a neat theramin-type effect.

by ccovell on 2012-06-11 (#95339)

Funny you should mention empty cart slots and Theremins... I made an NES "Theremin" program way back in 2001 that let you make music by waving your hands about a cartless NES unit:

http://www.chrismcovell.com/data/Theremin.zip

by mikejmoffitt on 2012-06-14 (#95516)

This is fantastic. Thank you.

Should I burn it to an NROM cart, or what? I'm assuming I can disregard vertical/horizontal mirroring

by ccovell on 2012-06-15 (#95536)

Yes, you can ignore mirroring and NROM will do fine. It's nowhere near as controllable or melodic as a real Theremin, so don't set your expectations high (at all).

by mikejmoffitt on 2012-06-15 (#95545)

Oh, I know - it's just neat to have feedback at all from it. It might make a fun demo unit at the game store I'm working at this summer.

Re: Famicom Super Mario Bros / Tennis cart swap trick
by zeroone on 2017-01-18 (#187040)

Well, that apparently actually works:

Re: Famicom Super Mario Bros / Tennis cart swap trick
by zeroone on 2017-01-18 (#187048)

The other hack also works:

Re: Famicom Super Mario Bros / Tennis cart swap trick
by Pokun on 2017-01-19 (#187099)

I have SMB, Tennis and Family BASIC but I never dared to try this trick. If there's a chance I'll fry something I rather not do it. Plus there's a hack somewhere that allows you to choose any one of the 255 "levels" to start at.

Re: Famicom Super Mario Bros / Tennis cart swap trick
by Myask on 2017-01-19 (#187105)

Or use game genie codes to uncap the level select.

Re: Famicom Super Mario Bros / Tennis cart swap trick
by zeroone on 2017-01-19 (#187110)

Pokun wrote:
I have SMB, Tennis and Family BASIC but I never dared to try this trick. If there's a chance I'll fry something I rather not do it. Plus there's a hack somewhere that allows you to choose any one of the 255 "levels" to start at.

We can safely mess around in emulation.

Since this trick requires you to reset Tennis and SMB, it is surprising that it works at all. Why didn't they program it to fully clear out memory on reset? Were they saving precious NROM bytes? SMB needs to remember the last world number to provide the continue option, but that value did not necessarily need to survive a reset.

While I have an emulator rigged up to do this, are there any other experiments I should try?

Re: Famicom Super Mario Bros / Tennis cart swap trick
by Myask on 2017-01-19 (#187115)

The reason they don't is posted earlier in the topic…
Grapeshot wrote:
The other important aspect of this trick is that Super Mario Bros only clears RAM on startup when any of the bytes used to store the score is greater than 10 or the value of the last byte of RAM is anything other thn $A5. Tennis, being another early Nintendo game, uses the same place to store the high score and the same signature byte, so the RAM is not cleared. The same trick might work with some of the other Nintendo black box games as well depending on how much code was reused.

Reset, then, doesn't clear high-score tables.

Re: Famicom Super Mario Bros / Tennis cart swap trick
by zeroone on 2017-01-19 (#187118)

Myask wrote:
The reason they don't is posted earlier in the topic…

Ah. Thanks.

It sounds like this trick is quite limited then. I was hoping to use Famicom BASIC like a game genie. That doesn't sound like it's going to happen.

Re: Famicom Super Mario Bros / Tennis cart swap trick
by Pokun on 2017-01-19 (#187156)

Family BASIC is fun for other things though.

It could work with other games that have reset-persistent data if you figure out how it detects a reset to avoid clearing RAM. Funny we just discussed clearing RAM in another thread.

zeroone wrote:
Pokun wrote:
I have SMB, Tennis and Family BASIC but I never dared to try this trick. If there's a chance I'll fry something I rather not do it. Plus there's a hack somewhere that allows you to choose any one of the 255 "levels" to start at.

We can safely mess around in emulation.

Always wanted to try this on real hardware though. But nope, not worth the risk.

Re: Famicom Super Mario Bros / Tennis cart swap trick
by rainwarrior on 2017-01-19 (#187175)

I think it's relatively safe (though I'm no doctor). I've hotswapped cartridges hundreds of times, haven't broken any yet.

Re: Famicom Super Mario Bros / Tennis cart swap trick
by zeroone on 2017-01-20 (#187211)

rainwarrior wrote:
I think it's relatively safe (though I'm no doctor). I've hotswapped cartridges hundreds of times, haven't broken any yet.

Any suggestions for experiments then?

Re: Famicom Super Mario Bros / Tennis cart swap trick
by rainwarrior on 2017-01-20 (#187240)

zeroone wrote:
Any suggestions for experiments then?

I do it to run tests on various mappers, mostly it's been to do with famicom expansion tests.

I don't really have any suggestions, unless there's something you want to know about the hardware inside a cartridge you have. (Easier and maybe safer than socketing ROMs etc.)