Super Mario Land 2 – Memory Exploration


Super Mario Land 2 for the Nintendo Game Boy
has a peculiar glitch that allows Mario to exit the normal bounds of a level and explore
the entire memory of the system. The level data is stored in a small section
of work RAM, but with this glitch Mario can visit video RAM, object memory, and even the
cartridge ROM. Each level map in the game is limited to 12288
tiles, which corresponds to 256 tiles across and 48 tiles vertically. These dimensions can be circumvented by chopping
up the level layout at room transitions, as long as all of the rooms can fit within this
rectangle. For example, Tree Zone 2 is wider than 256
tiles across, but the first room is snuggled up closer to the rest of the level in order
to fit. Since the levels can be broken into pieces,
it is important that the camera doesn’t scroll in such a way that you can see parts of the
level you shouldn’t be able to see. Each screen of 16×16 tiles has rules for the
camera to follow. They tell whether it is allowed to scroll
past the edge, or act as a barrier. Generally scrolling is allowed anywhere within
a room, but is disabled at the edges of rooms and at the edges of the level. This should ensure that Mario cannot leave
the intended level area. However, with a small glitch, the player can
have Mario fall through the floor at the start of any level, and potentially leave the intended
level area. This glitch is fairly straightforward to execute,
but it can only be done on the version 1.0 and 1.1 of the game, since it was fixed in
version 1.2 in both regions. If you exit the level while Mario is in a
downward pipe transition, this transition state will persist at the start of the next
level you enter. The two easiest ways to do this are to die
during the transition, or just exit the level via start and select once the level has been
cleared already. Then just enter another level, and Mario will
fall through the floor as if it were a vertical pipe. If there is no level data underneath, Mario
will just continue to fall through a void since there are no walls to keep him from
falling downward. And eventually he’ll stumble upon some really
messy garbage tiles. We’ll explain what exactly this is in a little
bit–in order to understand it better we need to look at the Game Boy’s memory map. The Game Boy has a 16-bit address space, which
means the CPU can access anywhere from $0000 to $FFFF–65535 unique bytes. Like most of Nintendo’s old systems, this
address space was memory mapped so anything including cartridge ROM, work RAM, video RAM,
OAM, and other hardware registers could be accessed via certain addresses. The organization of these regions in the address
space is like follows: The entire front half of memory from $0000
to $7FFF was dedicated to the ROM image located on the cartridge. The first 16 kilobytes are always mapped to
ROM bank 0, but the other 16 kilobytes can point to any ROM bank during execution. This allows for games to be larger than 32
kilobytes in total size. The next 8 kilobytes from $8000 to $9FFF are
reserved for video RAM, which holds graphics and tilemaps. Another 8 kilobytes from $A000 to $BFFF are
external RAM, which is normally memory that is found on the catridge itself. Data stored here can persist after the game
is shut off and the cartridge removed, since it is preserved by a battery in the cartridge. Yet another 8 kilobytes from $C000 to $DFFF
are the console’s general work RAM. The next 7.5 kilobytes from $E000 to $FDFF
is what is called Echo RAM, which is just a copy of the first 7.5 kilobytes of work
RAM. Nintendo discouraged developers from using
this area of memory, probably so it could possibly be used for something else in the
future. The next 160 bytes from $FE00 to $FE9F contained
the Object Attribute Memory, or OAM. This area denotes which objects are displayed
on top of the background, and where they are located. The 96 bytes located from $FEA0 to $FEFF are
not mapped to anything, so they stay unused. From $FF00 to $FF7F are the console’s hardware
registers, which include things like the controller, display, and audio registers. The 127 bytes from $FF80 to $FFFE are High
RAM, which is very fast since this memory sits within the processor. Finally, the single byte located at $FFFF
is the processor’s interrupt switch. If we step back and color code the different
regions, this is what the entire address space looks like. Let’s see how Super Mario Land 2 utilizes
the different memory regions. The ROM region, video RAM region, and all
the small regions near the end of the address space are trivial, but the External RAM and
work RAM are interesting. The first half of the external RAM contains
not only data relating to the save file, but also contains things you would normally see
in work RAM such as overworld and music data. The second half of external RAM, along with
the entire work RAM, holds the entire 12 kilobytes of level data. 7.5 kilobytes in the middle of that is mirrored
into the Echo RAM below. Each byte corresponds to one tile in the level,
so we can effectively map out the entire address space by turning each byte into one tile. If we move outside the level data area, you
can see how other memory regions would be interpretted as level data. As we move up, we see the rest of external
RAM, video RAM, and eventually the cartridge ROM. When we hit the end of ROM at $0000, everything
wraps around and we see the top of the address space including OAM, High RAM, and hardware
registers, before returning to the actual level data again. Using the pipe persistance glitch, we can
actually exit the intended level area and explore the rest of memory if we are careful. We can actually modify some of the memory
addresses if they contain values that correspond to tiles that can be manipulated by Mario. For example, if a value corresponds to a brick
block (with a value of $00), we can break it with Super Mario to change the value to
an empty tile (with a value of $60). There are a few points that need to be made
about this out of bounds area. Since these memory values were never intended
to be drawn to the screen as tiles, they can act really strange if you don’t know what’s
going on. The game can even crash if certain tiles are
interacted with. First of all is the fact that some tiles don’t
match up with the tile that is shown on the screen. In normal gameplay, tiles only change state
when they are interacted with by Mario or other sprites. So once they are drawn to the screen, their
visual appearence won’t change even if the underlying value does, unless, say, Mario
jumps into it. A good way of showing this off is the first
layer of garbage tiles that show up after falling out of bounds–these tiles correspond
to OAM. Their underlying values correspond to the
current objects on screen, which are Mario and the fireballs he shoots. But down here out of bounds, these values
also correspond to the first row of blocks. Every time Mario’s image changes or he shoots
fireballs, these tiles change how they act, but not how they look. That is, unless a tile is interacted with
like this coin, in which the object’s data is updated along with the tile’s data. That’s why it looks like Mario can just randomly
phase through some of these blocks–they are actually disappearing and reappearing behind
the scenes. If the game refreshed every tile on screen
every frame, this is what this section would look like. The second thing to be careful of is modifying
values that are crucial for the game to continue running smoothly. Modifying data in video RAM can cause weird
graphical glitches, and messing with anything in the stack or memory mapper can easily crash
the game. However, if you know what memory value you
are looking for, you can really take control of the game. The memory address $A2D5 holds an unused debug
flag that triggers the ending sequence of the game. It is never written to directly, but it is
read from every time Mario enters a level from the overworld. As long as this value is set to some non-zero
value, it will instead load the credits. Remember how blocks correspond to the value
of $00, and breaking them sets the value to $60? By finding the tile that corresponds to memory
address $A2D5, and breaking the block that sits there, the credits can be triggered prematurely. Indeed, this is possible to do thanks to the
pipe persistance glitch. Looking at the map we made, memory address
$A2D5 is actually above the level. However, since the whole thing wraps around
vertically, we can reach this tile by falling through the entire address space and digging
down to break the block. Here we can watch as Mario enters Pumpkin
Zone 1 and makes his way downwards towards the address in question. Among the mess of tiles are some tiles that
act like pipes, which can help manuver Mario through the garbage, especially if there are
a lot of solid blocks in the way. Just like how all the tiles are read from
unintended memory, the camera screen values are also read from uninteded memory. This causes the camera to act a little odd,
and in some cases you really need some persistance to get through to the next screen. Finally when the block is broken, the level
can be exited by dying or pressing start and select. Reentering the same level will now just trigger
the credits since the flag was set to $60. As of the creation of this video, the fastest
someone has triggered the credits in real-time was 2 minutes and 42 seconds by Oh-DeeR. If you would like to watch these speedruns,
a link to the leaderboard can be found in the description below.

100 comments

  • Brookie uwu

    This is fascinating! Thank you for the video.

    Reply
  • Zero Black

    A game inside a game.
    Cool video

    Reply
  • AKDProducts45

    why did you add reverb?

    Reply
  • Zye1984

    Interesting. I'm amazed how you were able to create an image of the entire memory like that. Heck at one point I wanted to make maps for Blaster Master: Enemy Below and was screen shooting and pasting things together; that took forever and I gave up..
    Anyway, I'd like to see Metroid II's "secret world" the same way you did this for this game. I'm not sure if anyone has ever mapped the whole thing out before..

    Reply
  • Rachel Awkward

    .

    Reply
  • BambooShadow

    awesome video! Thank you so much for doing this!

    Reply
  • The Tomato Watcher

    The START+SELECT method of pipe continuation only works on v1.0 of the game. In v1.1 you must perform the frame perfect pipe death.

    Reply
  • Yes yes

    Can anybody else hear something in the background whilst he's talking

    Reply
  • N

    Very enjoyable video. I work as a microcontroller programmer for industrial control boards (Mainly NXP / ST) and sometimes AVR for smaller projects. Debugging would be so much more enjoyable if you could use Mario to literally walk around the code.

    Reply
  • SlykeThePhoxenix

    Are the other levels stored in the ROM swap area?

    Reply
  • Stephen Mireles

    programmer vs mario

    Reply
  • Louie Clarke

    Can you do a video explaining how Race Drivin' on Gameboy works?

    Reply
  • Mound'N

    On this video your voice has a weird ghosting effect, i dunno why its some sort of echoing hall effect.

    Reply
  • Trash King

    "Really messy garbage tiles"
    🙁

    Reply
  • J P

    Super Mario Land – Bit Explorer

    Reply
  • J P

    This dude talking in a gymnasium?

    Reply
  • Michael Darrow

    Please, mess with the graphics.

    Reply
  • Scott Prian

    I'm looking for confirmation that I wasn't dreaming as a child. My game would glitch out when the batteries started to get low (GBC only). This was the only game I experienced that with, I'm curious if it had something to do with the memory in game.

    Reply
  • Vyruz64

    I always wondered, if you change the ROM, does that actually remain stored on the ROM? Can you corrupt your cartridge that way?

    Reply
  • PiercingSight

    So question! Are the interaction changes to the ROM persistent or is that just a temporary change?

    Reply
  • Comptare

    I remember finding a glitch exit doing this as a kid.

    Reply
  • Mick Gorro

    What if you mess with tiles read from the ROM? Can you even interact with any of those?

    Reply
  • Alex Nolla

    Your videos inspire me.

    Reply
  • Matthias König

    Can you hit the interrupt byte by manipulating a tile located there? And what would happen?

    Reply
  • butterflyspirit

    What exists at address FFFF which is the interrupt switch?

    Reply
  • Lycanroc Dusk

    So can you edit the cartridge too or just the ram?

    Reply
  • trash meme

    How to hack your Gameboy.

    Reply
  • Gamer's Trivia

    GAME NAME
    Bucky O'Hare
    ( NES game)

    faling bug in the game

    Blue planet

    can you fix it??
    i wanna play

    Reply
  • a spai

    inb4 someone makes this in mario maker

    Reply
  • Blood Bath and Beyond - Pop Goes Metal Covers

    2nd row, next to the X…she cute

    Reply
  • Mr. HEck

    2:22 , I was programming a game on a Ti-84 plus SE (it’s a calculator you can make games on) and made an 8-bit tilemap test. The game was pretty straightforward you could move around and not bump into trees or house tiles, however I actually glitched out of the map and after a bit of wandering I started seeing random tiles scattered everywhere looking exactly like this. It’s so cool how a calculator and console run so similarly

    Reply
  • good

    this video really blew my mind. i finally understand why this happens. mario is literally walking on codes and has the ability to modify them. that's so fascinating.

    say, if mario found a tile outside the game map that corresponds to his x or y position, would you be able to modify it and have mario be transfered somewhere else in the map? i'm just curious.

    Reply
  • brocoli

    No mention of the TAS time?

    Reply
  • Ohead

    Gonna be honest this is my favorite episode 🙂

    Reply
  • Hargey _

    Super interesting, and the memory “world map” you made makes it really easy to understand. Thanks for the video.

    Reply
  • Дмитрий Забудченко

    So, have this game built-in debuging options?

    Well, yes but actually no 🙂

    Reply
  • David Royston

    You can enter 0160D5A2 with a GameShark just to see the credits.

    Reply
  • Ocarinaot 4

    It's videos like these that remind me that I am not cut out for software design

    Reply
  • bubbaloo bub

    Could you code with this?

    Reply
  • theone

    LUIGI IM IN THE GAME!!

    Reply
  • Captain Satwon

    Your voice is very echoey…are you recording this from the GB Ram?

    Reply
  • Hugh Janus

    I'll just nod and pretend I know what he's talking about

    Reply
  • Musekek

    Super memory land 2

    Reply
  • Neoxus, WhoYouCanTrustToGiveQualityJojoreferences

    Mario, the man who travels through parallel universes, can literally hold the concept of victory on his hands, get the fruit back and walk through the code of reality while also keeping his job as a plumber)

    Reply
  • Neoxus, WhoYouCanTrustToGiveQualityJojoreferences

    Also, i thing i may have to find a way to let players do that when i make a game one day)

    Reply
  • Daniel

    imagine having to traverse through a shifting mass of reality to change the course of the universe

    Reply
  • Kieran Culliton

    The echo / reverb in this episode leaves a creepy demon voice in the background.

    Reply
  • Cyanide

    If you listen closely while he talks, you can hear a second voice. Deeper, mechanical almost. Like a whisper made by a weak speaker. Could he actually be controlled by a YouTube robot? FiNd OuT nExT tImE oN dRaGoN bAlL z

    Reply
  • Abyssal Boy

    I had a GBA game that would a similar thing. If you changed your position on the world map right after selecting a "mode 7" displayed level, you'd enter a weird small glitched area with incorectly displayed objects and tiles (which would show up as one colored tiles), but still easily explorable. If only I knew how to use an hex viewer and make sense of all the hex code…

    Reply
  • Samuel Voltz

    So when Mario falls to his death, he actually falls into the inner workings of the console? Neat

    Reply
  • Renan Stephano Barbosa Souza Rodrigues

    Your channel is wonderful. Thank you.

    Reply
  • SRG // ???

    So what if I do this on Virtual Console on my 2DS?

    Reply
  • batuhan şekeroğlu

    Memory exploration crashes paper mario

    Reply
  • DanAtuch

    Can use please show the full map in HD quality?

    Reply
  • ioletsgo

    this reminds me of that one pokemon glitch in the 1st generation

    Reply
  • Henrique Ourives

    Mario is literally inside the game cartridge

    Reply
  • Flamey HD

    technically you are always going through the code on normal play, but we just are in the space allocated to levels. its weird thinking about it.

    Reply
  • Ayasluna

    the subtle echo in the background freaks me out -_-

    Reply
  • Domi Crni

    This new SML2 level editor looks cool

    Reply
  • ur4n1um

    amazing tyhanks for the time you put into making this.!

    Reply
  • Amy Carter

    3:33 That's A-zero-zero-zero. When talking in hex figures, there's no ten/hundred/thousand/etcetera; each digit is pronounced individually (a lot of people get this wrong so it's just a matter of re-learning), so F90A7800 is F-nine-zero-A-seven-eight-zero-zero, or 5F0B is five-F-zero-B. (unintentional unrelated game reference)
    This was rather interesting, and it most certainly would be useful the next time I play Mario Land 2. I wonder if this works with the fan-made DX version…

    Reply
  • RaggedyStar

    Is this perhaps related to the original Sonic the Hedgehog's Special Stage? If you use the debug mode to exit the main course and fall for a bit, you end up in a weird mass of random tiles, though nowhere near as glitchy and probably not influenced by the coding of the game

    Reply
  • kargaroc386

    The corruption diarrhea master!

    Reply
  • Dominik Römer

    SMW players: To be fair you need a fairly large brain to understand Kaizo:
    SML2 players: hold my RAM

    Reply
  • Koohiisan

    Fascinating! Thanks for putting so much detail into this explanation!

    Reply
  • Thomas Andrew

    I have seen a "dog house glitch" in the legend of zelda: Link's Awakening that looks similar to this. Could you make a video on that glitch, too?

    Reply
  • MZX_MrXANA91

    Omg i think i fell in love with this kind of videos

    Reply
  • SueDonym

    Soooo… This is an unintentional game corruptor tool within the game itself… Perfection!

    Reply
  • Tactical Milkman

    are you alright? throughout the video it sounds like you're gonna cry. We are here for you

    Reply
  • John Guastavino

    This is so much more interesting to me than how it took 60 people 1000 hours to animate one scene in the new God of War or whatever

    Reply
  • Pxl Games

    6:35 REALLY COOL EFFECTS!

    Reply
  • Goof Brush

    Super mario land 2 was so buggy!

    Reply
  • Jakov Sarić

    The 1 question persists
    How the fuck did someone figure that out
    Trial and error?
    Reading thru code and trying to visualise?
    Blind luck?

    Reply
  • Joonie thebest

    Guess mario had a trip down memory lane…

    Also, I got my gbc and mario land two (the old version after researching) let's try to do this!

    Reply
  • Great Canadian Moose

    Is there a way to tell what version I have?

    Reply
  • TheMrRuttazzo

    I tried this on my copy and it works!
    Unfortunately, it's a mine field, I haven't been able to get past the first ~20 layers because I always hit something that either crashed/froze the game or made Mario's sprite permanently invisible. Guess I gotta move more carefully when descending.
    But I also found some awesome stuff. In Macro Zone, I somehow hit the part where the game thought I exited the stage through the secret door, triggering the alternate outside route to the attic. Another cool thing I found was a block that raised my coin count rapidly when I was touching it, until I had 999. It's a cool new "feature" for my 30 years old game. 😛

    Reply
  • Colin M

    What version of the game is being played on 3ds virtual console?

    Reply
  • FlyingFish

    I honestly don’t understand this quality of editing I just can’t

    Reply
  • ComputerDefeated

    wait, the gameboy is 16-bit my life has been a lie

    Reply
  • Fattata

    FFFF, or F-thousand, F-hundred and Fty-F

    Reply
  • Toast Kirby

    Would this count as a Wrong Warp?

    Reply
  • FinalManaTrigger

    Thanks so much for this, it helps me visualize how custom code was made for Super Mario World as well!

    Reply
  • Cosmo_Plays

    I know this is Mario, but……….

    Work RAM Zone Act 1

    Reply
  • Ariez

    I did this glitch years ago only it was different how I got to the garbage tiles. The game eventually crashes. One of the tree levels you get a bee to follow you back to the beginning then jump off the bee into some logs that your not suppose to reach. From there you get the garbage tiles you speak of. 🤪

    Reply
  • Michael Darrow

    What do you imagine Mario thinking?
    "Wait, did I just… phase through… the… ground?"
    "What is this?"
    "Can I go through here?"
    "I'm on this… series of blocks."
    "Imma… break this one, m-hm, and this one, m-hm, and this one."
    "Wait, did I… win?"

    Reply
  • Michael Darrow

    "$8000 to $9FFF is VRAM, which is used for graphics and tilemaps."
    And subtitles! (I dragged them there, just drag them.)

    Reply
  • Matteo Fazio

    Is this a pre-alpha version of The Matrix?

    Reply
  • trash meme

    So, we can now hack the Gameboy via. Super Mario Land 2?

    Reply
  • Fahrenheit4051

    Jack in, JumpMan.exe, transmit!

    In all seriousness, doesn't this mean that you could theoretically make a high-level programming language where an on-screen character or AI you control explains what a piece of data is for? I.E. something similar to NetNavis from MegaMan?

    Reply
  • Extrascript662

    Wow. I really want to see a game with a similar mechanic, like maybe a sandbox game where you directly modify the game, or something. You’d probably want to run it in a virtual machine, though. Don’t want your CPU catching fire.

    Reply
  • James Kowal

    This is simply fascinating

    Reply
  • TheEmeraldBoat

    I wonder: what would happen if you went down to FFFF and messed with the processor interrupt switch?

    Reply
  • AL_O0

    What lever are you playing?

    Me: RAM

    Reply
  • zergmaster22

    Wow…

    Reply
  • KineticManiac

    I noticed a small mistake in 2:34, a 16-bit address space has 65536 unique bytes, not 65535. 65535, which is 0xFFFF in hexadecimal, is the highest possible address. Since lowest possible address is 0, this results in a total number of 65536 unique addresses. Not a huge deal, but I wanted to point it out. 🙂

    Reply
  • Firepal

    It feels crazy seeing the game's as represented by the game itself, let alone modifying the game itself through in-game interaction !
    This is nuts.

    Reply
  • adam1984pl

    IS it working on 1 level?,
    On Java phone emulator there`s some glitches if you beat first level and next level ,it takes you to Mario world,but he got no eyes.It creepy.Pumupin world is not working.It restes the game.

    Reply
  • Silica

    what happens if you try modify the ROM?

    Reply
  • Yash Singhal

    Why Os dosent trap the operation. Segmentation fault

    Reply
  • Coffeemancer

    "running smoothly"

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *