Through the Warp Zone

Did you ever play Nintendo? I mean the original thing, the Nintendo Entertainment System that made its way to North America in 1985. It was the first kind of video game I ever had experience with, and I still play it today. It’s really rare that I pull out the actual hardware my family got back in the 80s to use, though that happens from time to time. So I use an emulator.1

The first game we had, which came with the system, was the combination cartridge with Super Mario Brothers and Duck Hunt in one. We picked up others along the way, but Super Mario Brothers was first for me and always felt like the default game, the Platonic ideal of games. I played it enough to etch every one of its nooks and secrets indelibly into my memory, and I can play it with muscle memory today. After the early 90s, I stopped forming any sort of attachment to video games and mostly stopped bothering, but before that, I played Mario with dedication, enough that it feels like every part of the game is carved in stone. Super Mario Brothers is the same everywhere and will never change—or so it seemed when I was younger.

I also heard rumors of glitches, ways to make the game do unintended things, which came built into every copy. The most famous one that I know of is the Minus World. There are warp zones throughout the game which allow you to skip from an earlier world to a later one by going down a pipe. The Minus World glitch required you to get near the first warp zone and then do some weird maneuver that lands you in a glitched version of that warp zone, such that two of the pipes can take you to a world labeled  –1, a bizarre Mario hinterland which doesn’t ordinarily exist.

I tried and tried, but I never could get that damn glitch to work. Several years ago, though, I figured out a way to get to the Minus World so that I wouldn’t have to bother with the glitch. I did it by directly manipulating the contents of the Super Mario Brothers ROM. In fact, I was able to tell that warp zone to take me anywhere I liked, including existing and nonexistent worlds apart from the Minus World altogether. I’ll explain in a moment, but first I want to explain the Minus World glitch.

In the course of the glitch, the game ends up showing the warp pipe, as you’d expect, and instead of the familiar number above it, instead, it puts a space, and then the game goes on to use that space as the destination world when you warp. Why a space? That’s because of the way the NES games store numbers and letters.

I said above that the game cartridges get dumped to data in a file, and like any other file, that data is just made up of numbers. Some of those numbers are instructions, and others represent data, such as words, or what Mario and his world look like. Literal numbers you’d see on screen are stored simply as the numbers from zero to nine. Numbers ten through thirty-five represent the letters of the alphabet. Finally, the very next number, thirty-six, is a space, or blank tile. (Other numbers represent tiles of background terrain, buildings, and so on.)

How does it choose the number thirty-six? This is conjecture on my part, but the telling aspect of the original glitch is that either of the side pipes take you to the Minus World while the middle pipe takes you to world 5–1. This tells me that the glitch somehow mistakes the game into thinking you’re at the warp zone you’d otherwise encounter in world 4–2. In that warp zone, there is only a single pipe which takes you to world 5–1. Mario uses the same code instructions to display three numbers above the pipes in every warp zone, but for the sake of those warp zones with only a single pipe, the game designers used blank tiles (number thirty-six) so that you wouldn’t see useless numbers hanging above pipes that aren’t there. This allowed them to reuse the same bit of code for each warp zone to show the destinations, and where they only needed one destination, they just hid the others.

There is a lot of creative code reuse in Mario. This served to keep the game very, very small—as all early NES games were. I see that my ROM, in fact, is only 40,976 bytes. That’s smaller than most webpages. Code reuse probably also guided the decision to use the labels above the pipes as the actual destinations as well. Mario would check out what number was above the pipe in a warp zone and plug that number directly into the world to which it sent you.

Returning to the glitch, you’d see the three warp pipes built into world 1–2, but with the labels from warp zone you’d see in world 4–2, which included two blanks. Given the thrifty assembly code with which Mario was made, it didn’t bother checking you were doing something which made sense. It simply tried to make sense of the situation in which the player found itself, so when you went down a pipe there, it’d look at the label, see a thirty-six, and blissfully send you to world 36–1, which looked like  –1.

At this point, I’m unclear about what happens on the level of the code, but the experience, as many have learned, is that of the Minus World: you find yourself swimming through a glitched version of world 7–2 which never ends. Probably, Mario tries to look up which data corresponds to world 36–1 in order to build it and somehow ends up with the wrong one. I’m guessing that the code takes the number thirty-six and tries to count up through a table to look up the world it wants, overflowing and wrapping back around as it goes. (It’s interesting, if maybe irrelevant, to observe that thirty-six divides by seven with a remainder of one.) Whatever the case, those are the details I know about how the Minus World works.

Like I said, I never managed to get that glitch to work. I wasn’t dextrous enough, I guess. You can find videos of it online, but back when I was attempting it, I never managed it. I did get curious about how it all worked, enough to figure out what I said above.

I realized then that within the ROM, there must be a kind of table, with three-number combinations describing the possible destinations for each warp zone. The Mario ROM being itty-bitty, as I said, I just opened it up in a hex editor (a program that lets you edit the data in a file directly in numerical form) and searched for the sequence of numbers representing the first warp zone: four, three, and two, in that order read from left to right in the actual game.

Hex editor screenshot showing the warp tableIt didn’t take too long to find such a sequence, and luckily, this three-number sequence only recurs a few times. Look at the screenshot up above. It’s in hexadecimal2, but the number sequence looks pretty straightforward. For those who can’t see the screenshot, the line of numbers reads FF 15 1E 10 12 04 03 02 00 24 05 24 00. Among the seeming garbage, the sequence 04 03 02 is easy to spot.

But look, there’s another clue! Right after the numbers I wanted, there’s a zero, and after that, a thirty-six, a five, and another thirty-six3. Does that sound familiar? It’s the next warp zone! In fact, it’s the one we get if we trigger the glitch.4 So we’re definitely on the right track. But if we want to be sure, there’s only one real way to know. I changed 04 03 02 to 08 03 02 and ran the game. Sure enough, I saw what I was looking for!

Screenshot of Super Mario Brothers with edited warp table leading to world 8

And just to make sure the hack did indeed work, I had to go down the pipe, of course.

Screenshot of Super Mario Brothers in world 8-1

Success! I can hack the warp table and go to any world I want from the first warp zone. This has possibilities!

Screenshot of Super Mario Brothers with hacked warp zone to world nineI realized I could then edit 08 03 02 to be anything I wanted, including the Minus World (24 03 02). But even more, I can put in numbers to worlds nobody has ever seen. I wanted to see world nine and play it, so I put in 09 03 02.

Screen Shot 2014-05-05 at 11.41.38Haha, world nine, as it turns out, is ridiculous. You can actually swim through the world all the way to the end. It’s kind of wild. I tried several other worlds, most of which were alphabetical. Each one is different and broken in its own way.

Some strongly resemble existing worlds with little twists (weird gray blocks all over, gray spits from the castles in random places). Some are like world nine, something which should never have seen the light of day and which only barely work (I note that my emulator I used for making screenshots actually froze up). Some are blank and don’t work at all.

I won’t spoil these other worlds with screenshots. You know enough to see these worlds for yourself now. All you need is a Super Mario Brothers ROM, an emulator (I recommend OpenEmu on OS X), and a hex editor. Go hack!