




















































































































































Need 1 more
Bullet barely too late
Koopas barely too early
Normally could turn them around with damage… doesn’t happen underwater
Could turn them around by being on the right side of them when they land…. They are not high up.
The goomba is…. Goombas dont turn around.
Exactly 1 enemy too late, the buzzy beetle you can turn around
Bloopers could come down and turn koopas around but blooper is too late
Actually… enemies never turn each other around when underwater
Assuming this is done so bloopers dont turn cheep cheeps around
..is what i thought. But they never turn around regardless. Why???
Could do it later but run out of time lol
Could maybe do it with earlier firebar? But it’s actually not a full double firebar….
Could maybe turn enemies around with firebar glitch but firebar isn’t next to enemies on the ground
Test if COULD turn cheep cheep around…. But cheep is too slow lol!! Out of time
Hammer bros chase you after a while….. But NOT to the right!
Earlier bowser??? How close is that. Oh… powerup slot
Midway, different bowser?
If you could keep fire from midway with the vine glitch it’s possible (apparently?)
Killing bowser turns into a fireflower that hurts you lol??










































































































































6E8, at 6FC is the joypad inputs.. but the values that are right between there just can never line up so you make it through. :)














































9D : Write $20 to address $9D9E is a lot of fun.
















%0x800, or the easier approach.. just F => 7





lda enemy_id,x will be loading like.. $16,$17,$18,$19 or whatever.. but only $16 is documented.














































0B06D B5 1E lda Enemy_State,x ;if d5 in enemy state is not set
0B06F 29 20 and #%00100000 ;then branch elsewhere to run bowser
0B071 F0 14 beq BowserControl
it is a dying flag, but i have no idea why it's getting set













































10 FOR I=&H7D3 TO &H7DC:POKE I,0:NEXT
20 POKE &H7FF,&HA5
30 POKE &H7FD,&H16
40 DATA &HA9, &H07, &H8D, &H5F, &H07, &HA9, &H57, &H48, &HCE, &H72, &H07, &HA9, &H03, &H8D, &H5C, &H07, &H20, &H5A, &H86, &H4C, &H78, &H81
50 FOR I=0 TO 21:READ X:POKE I+&H181, X:NEXT
i think is the actual basic to do what the SMB3 setup did.


























































































































L_8056:
LDA $E
BEQ L_8090
ASL A
TAX
LDA $600,X
you have to really think about every last instruction and piece together what's happening in your head. then when it says like..
LoadEnemyRoutine:
LDA ActiveEnemyRoutine
BEQ EmptySlot
ASL A
TAX
LDA EnemyHandlerRoutines,X
you start just scanning through assuming the code is right because it reads ok




A:00 X:05 Y:36 S:F7 P:nvUbdiZC $9C98: AD 47 07 LDA $0747 = #$00
A:00 X:05 Y:36 S:F7 P:nvUbdiZC $9C9B: D0 43 BNE $9CE0
A:00 X:05 Y:36 S:F7 P:nvUbdiZC $9C9D: 08 PHP ;;; this is our modification
A:00 X:05 Y:36 S:F6 P:nvUbdiZC $9C9E: 39 F0 11 AND $11F0,Y @ $1226 = #$00
A:00 X:05 Y:36 S:F6 P:nvUbdiZC $9CA1: C9 03 CMP #$03
worked out pretty nice and stable.. like, LDA $747 is the timercontrol, and it waits until it's zero, then does the PHP that we replaced with the luigi PPU stuff.. and then a 3 byte AND which does nothing since A is always 0. and then it's aligned with the normal instructions again and just runs through until it returns from that routine, which will to to $0F33 where '33' are the CPU flags that were set when the PHP hit. which should always be the same. (edited)
33 0F, when the RTS hits it takes 2 values off the stack, and returns to the byte after whatever that value is, so $0F34











7B : Write $50 to address $7B859B : Write $00 to address $9BA5
is also kinda fun when you hit coin blocks, think its this one














9 - long firebar
A - "86"
B - "209"
C - "166" / upward lift
D - red koopa
E - "181" glitchy spring object
F - "15" glitchy red parakoopa
G - "16" glitchy green parakoopa
H - red cheep
I - glitchy falling platform that throws a hammer
J - "15" glitchy red parakoopa
K - "170" glitchy surf platform
L - "181" glitchy spring object
M - firework
N - crash (jump to ram :)
O - bowser
P - crash (jump to ram??)
Q - podoboo
R - "166" / upward lift
S - red koopa
T - "181" glitchy spring object
U - firework
V - crash (jump to ram?)
W - buzzy beetle
X - crash (jump to ram?)
Y - crash (jump to ram?)
Z - crash (jump to ram?)
blank / minus world - bowser
other color tile - "208", nothing?






























































































: jsr FDSBIOS_VINTWAIT
jsr FDSBIOS_READPADS
ldx TRAMP_INDEX
lda READPADS_CTL1
sta EXEC_LOCATION,x
inc TRAMP_INDEX
bpl :-
jmp EXEC_LOCATION
which is just a loop that waits for a frame, reads the controller, writes its value to ram, and does that 127 times, regardless of the size of the actual code to load.. then it jumps to where it stored it. the code that writes in is the actual payload:
lda #7
sta $075f
lda #3
sta $075c
lda #$65
sta $0750
lda #17
sta $0751
lda #0
sta $301
sta $7b1
sta $F5
sta $F6
dec $14
lda #$80
sta $2000
jmp $605C
that is "easy" to modify in that the controller inputs can be changed to whatever it is you want to enter
































.res EXEC_LOCATION-*,$00
.org EXEC_LOCATION+1
lda #0
tay
sta PPU_CTRL_REG1
sta PPU_CTRL_REG2
sta SND_MASTERCTRL_REG
sta $10
sta $11
;; copy $400-$7FF
lda #4
sta EXEC_SRC_HI
lda #8
sta EXEC_END
jsr ramcpy
; copy PRG
lda #$60
sta EXEC_SRC_HI
lda #$E0
sta EXEC_END
jsr ramcpy
; copy PPU
lda #0
sta EXEC_SRC_HI
lda #$20
sta EXEC_END
: jsr nextframe
lda EXEC_SRC_HI
sta PPU_ADDRESS
lda EXEC_SRC_LO
sta PPU_ADDRESS
lda READPADS_CTL1
sta PPU_DATA
lda READPADS_CTL2
sta PPU_DATA
jsr advance
bcc :-
jmp ($fffc)
ramcpy:
: jsr nextframe
lda READPADS_CTL1
sta (EXEC_SRC_LO),y
iny
lda READPADS_CTL2
sta (EXEC_SRC_LO),y
dey
jsr advance
bcc :-
rts
nextframe:
jsr FDSBIOS_VINTWAIT
jmp FDSBIOS_READPADS
advance:
clc
inc EXEC_SRC_LO
inc EXEC_SRC_LO
bne :+
inc EXEC_SRC_HI
lda EXEC_SRC_HI
cmp EXEC_END
: rts
.res (EXEC_LOCATION+$80)-*,$EA
this is how the full loads word, so, to do multiple inputs per frame the only difference is removing 'jsr FDSBIOS_VINTWAIT' ldx #0
: lda Message,x
sta WarpzoneMessageLocation,x
inx
cpx #MessageEnd-Message
bne :-
: jmp :-
Message:
.byte "SUBSCRIBE TO KOSMIC"
MessageEnd:
then you could let it run, reset after and it should stay swapped out. (edited)




































lda #7
sta WorldNumber
lda #3
sta LevelNumber
lda #$65
sta AreaPointer
lda #16
sta EntrancePage
lda #0
sta VRAM_Buffer1
sta MusicData
sta MusicData+1
lda #$80
dec $14 ; disable powerup
sta PPU_CTRL_REG1
ldy #2 ; side entry pipe
jsr $9218
jmp $605C
is what i coded up for it anyway, could be maybe that you needed to put it somewhere else in the inputs





































































0BA16 SetupFloateyNumber:
0BA16 9D 10 01 sta FloateyNum_Control,x ;set number of points control for floatey numbers
0BA19 A9 30 lda #$30
0BA1B 9D 2C 01 sta FloateyNum_Timer,x ;set timer for floatey numbers
0BA1E B5 CF lda Enemy_Y_Position,x
0BA20 9D 1E 01 sta FloateyNum_Y_Pos,x ;set vertical coordinate
0BA23 AD AE 03 lda Enemy_Rel_XPos
0BA26 9D 17 01 sta FloateyNum_X_Pos,x ;set horizontal coordinate and leave
0BA29 60 ExSFN: rts
0BA2A
which almost works except - there's an empty padding byte between the X and Y pos. if there wasn't we could probably get out of 1-1 if we could kill some enemies at the right Y pos and collect a powerup at the right X pos. it would of course be much slower than what we're doing now with the powerup.



