Famicom Super Mario Bros / Tennis cart swap trick

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems. See the NESdev wiki for more information.

Moderator: Moderators

User avatar
noattack
Posts: 147
Joined: Tue Feb 13, 2007 9:02 pm
Location: Richmond, VA

Famicom Super Mario Bros / Tennis cart swap trick

Post by noattack »

I was looking up some info about the NES Super Mario Bros. localization and came across this site that explains a Famicom-specific cart swapping technique for accessing the 256 'minus worlds' in SMB. Since the trick involves removing the cartridge while the game is playing, the CIC precludes duplicating it on an NES.

There are two techniques described in the article (scroll down to the 'Super Secret Worlds' section for more details):

- Remove the SMB cart during gameplay. Insert a Tennis cartridge, reset, play a bit, then remove the cart. Insert SMB, reset, then use the A+Start stage select to begin play in a corrupted world.

- Version 2 uses a similar method, but involves the Family BASIC cart, keyboard, and a snippet of BASIC code executed during play:

Code: Select all

10 FOR I=&H7D3 TO &H7DC:POKE I,0:NEXT
20 POKE &H7FF,&HA5
30 INPUT "WORLD=";A
40 POKE &H7FD,A+255AND255
The author includes a subtitled Japanese video of the first technique, which looks legitimate. The technique is also backed up by significant documentation in several Japanese SMB guides in the 1980s. Apparently this trick was well known.

Anyone heard of this before? Technique 2 seems almost like a homemade Game Genie. Could this be replicated on a top-loader (or a CIC-disabled front-loader)?

And, more importantly, how does this work? I find this fascinating.
User avatar
mikejmoffitt
Posts: 1353
Joined: Sun May 27, 2012 8:43 pm

Post by mikejmoffitt »

If I'm not mistaken, this works simply because by hoding A+Start as you begin a game in SMB, it does not clear the values in ram associated with the current world. Normally, the value in ram will simply be the world you were previously in. By starting another game, which uses that address for a totally different reason, and pulling it and resetting, that value is never reset, so SMB uses whatever was there.

I believe it's the same principle behind Streets of Unbridled Fury:
http://www.youtube.com/watch?v=u1EmgeAXB-4

This should work with many games, with potentially different results - you may find yourself in a legitimate world like 2-8, even. On a toploader NES, this should work, as well as a CIC-disabled toaster.
Last edited by mikejmoffitt on Fri Jun 08, 2012 7:47 am, edited 1 time in total.
3gengames
Formerly 65024U
Posts: 2284
Joined: Sat Mar 27, 2010 12:57 pm

Post by 3gengames »

It apparently corrupts all the right RAM. And you should be able to do it on an NES too. CIC doesn't affect RAM, don't know how you came to the conclusion it won't work in a toaster.
Last edited by 3gengames on Fri Jun 08, 2012 8:17 am, edited 1 time in total.
User avatar
noattack
Posts: 147
Joined: Tue Feb 13, 2007 9:02 pm
Location: Richmond, VA

Post by noattack »

Turns out I had both Tennis and SMB. It took a bit of wrangling (my Tennis cart wasn't working well), but I can confirm this works on a top loader. Two of the minus worlds I arrived in crashed within a few seconds of play. The others were merely copies of valid levels.

I notice in the video from the article that, after removing the cart, the background tiles appear to slowly 'melt away.' I noticed this happening a few times for me too. What causes that effect?

And it was neat to swap carts mid-game and have their name tables update with tiles from the new pattern tables!
User avatar
Movax12
Posts: 541
Joined: Sun Jan 02, 2011 11:50 am

Post by Movax12 »

40 POKE &H7FD,A+255AND255

What the heck does 255AND255 mean?
It doesn't look like Valid BASIC code, but I don't know Family Basic.

Maybe: A+255 AND 255

I can understand ANDing - to get a byte value only.. not sure about adding 255, assumimg the above the same as: (A+255) AND 255

If Order of Operations is AND first then it should just be: A+255
tepples
Posts: 22708
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

Movax12 wrote:assumimg the above the same as: (A+255) AND 255
Correct.
If Order of Operations is AND first then it should just be: A+255
Variables in a lot of these old BASIC implementations are larger than 8 bits. Thus A+255 would be in the range 255 to 510, most of which would fail the range-check of the POKE statement.
User avatar
Movax12
Posts: 541
Joined: Sun Jan 02, 2011 11:50 am

Post by Movax12 »

Yes, if family basic does range checking. I was guessing it may just take the low byte of the value and the code worked despite the error. But anyway, cool trick.
Grapeshot
Posts: 85
Joined: Thu Apr 14, 2011 9:27 pm
Contact:

Post by Grapeshot »

This probably wouldn't work on a toaster even with the CIC disabled just because it's difficult to insert and remove cartridges quickly.

The other important aspect of this trick is that Super Mario Bros only clears RAM on startup when any of the bytes used to store the score is greater than 10 or the value of the last byte of RAM is anything other thn $A5. Tennis, being another early Nintendo game, uses the same place to store the high score and the same signature byte, so the RAM is not cleared. The same trick might work with some of the other Nintendo black box games as well depending on how much code was reused.
User avatar
infiniteneslives
Posts: 2104
Joined: Mon Apr 04, 2011 11:49 am
Location: WhereverIparkIt, USA
Contact:

Post by infiniteneslives »

noattack wrote:I notice in the video from the article that, after removing the cart, the background tiles appear to slowly 'melt away.' I noticed this happening a few times for me too. What causes that effect?

And it was neat to swap carts mid-game and have their name tables update with tiles from the new pattern tables!
Yeah I see the same thing when swapping games on the NESDEV1. It effectively does the same thing by tristating the cart's data busses and CIRAM inputs. IDK if it's really what's going on, but I always attributed the 'melting' effect to bus capacitance holding values that leak away.
User avatar
mikejmoffitt
Posts: 1353
Joined: Sun May 27, 2012 8:43 pm

Post by mikejmoffitt »

My famicom will do that with removed games. After a few minutes, where it starts to become unstable with the data, moving my hand closer and further from the cartridge slot very visibly affects the data. It's a neat theramin-type effect.
ccovell
Posts: 1045
Joined: Sun Mar 19, 2006 9:44 pm
Location: Japan
Contact:

Post by ccovell »

Funny you should mention empty cart slots and Theremins... I made an NES "Theremin" program way back in 2001 that let you make music by waving your hands about a cartless NES unit:

http://www.chrismcovell.com/data/Theremin.zip
User avatar
mikejmoffitt
Posts: 1353
Joined: Sun May 27, 2012 8:43 pm

Post by mikejmoffitt »

This is fantastic. Thank you.

Should I burn it to an NROM cart, or what? I'm assuming I can disregard vertical/horizontal mirroring :P
ccovell
Posts: 1045
Joined: Sun Mar 19, 2006 9:44 pm
Location: Japan
Contact:

Post by ccovell »

Yes, you can ignore mirroring and NROM will do fine. It's nowhere near as controllable or melodic as a real Theremin, so don't set your expectations high (at all).
User avatar
mikejmoffitt
Posts: 1353
Joined: Sun May 27, 2012 8:43 pm

Post by mikejmoffitt »

Oh, I know - it's just neat to have feedback at all from it. It might make a fun demo unit at the game store I'm working at this summer.
User avatar
zeroone
Posts: 939
Joined: Mon Dec 29, 2014 1:46 pm
Location: New York, NY
Contact:

Re: Famicom Super Mario Bros / Tennis cart swap trick

Post by zeroone »

Well, that apparently actually works:

Image
Post Reply