The Famicom Cart Swap Trick

Replicating a Japanese glitch

While researching my chapter on the US NES launch and subsequent game localizations, I came across Mato Tree’s site. Mato does Japanese-to-English videogame translations for a living. He also does a fantastic series of localization comparisons on vintage NES/SNES games called ‘Legends of Localization.’ The Super Mario Bros. article exhaustively details the translation choices made to bring the famous platformer to the states, such as changing the ‘Great Demon King Koopa’ to the more American-friendly ‘Bowser.’

In the article’s ‘Miscellaneous’ section, Mato explains a well-known trick among Japanese Famicom players for accessing Super Mario Bros.’s infamous Minus World. In the US version of SMB, players could make a precise reverse jump prior to the entrance of the Warp Zone in World 1-2 to stymy the game’s warp code and access an infinite underwater level. Since the level display read ‘World -1,’ players dubbed it the Minus World.

http://www.youtube.com/watch?v=rgohnDkyTZM

The Famicom trick is far weirder. Players could insert the SMB cart, play for a bit, then slowly prise it from the console without powering down. They would then insert the Tennis cart, play a few points, then remove the cartridge. Finally, they would insert the SMB cart once again, hold A+Start at the title screen (to ‘resume’ play), and transport to all manner of weird Minus World alternates.

The Mato article explains that the fan excitement surrounding the Minus World and the cartridge trick in Japan culminated in an official statement from Miyamoto (in short: there are no hidden worlds, just glitches) and a detailed breakdown of how the trick worked. Mato has a screenshot of the article, but sadly, it is not translated.

So, this begs the obvious question: WTF?

I knew about the Minus World trick since elementary school, but I had never heard of the cart swap trick. Of course, there is a hardware reason. As a piracy and licensing protection scheme, Nintendo devised the CIC chip as a hardware addition to all international NES consoles and game paks. It essentially used a lock-and-key ‘handshake’ algorithm to verify authentic NES cartridges. If either end didn’t match, the console would drop into the trademark NES reset loop. In the long run, this ended up causing more problems than not–unlicensed developers like Tengen and Color Dreams devised workarounds to mimic or disable the CIC, while the faulty spring-loaded design of the NES toaster, coupled with the touchy lockout chip, left millions of gamers with blinking screens.

The CIC also precludes swapping carts in and out of the system while the game is running, thus no cart swap trick.

However, in the early 1990s, Nintendo introduced a revised model of the NES called the NES-101, more commonly called the top-loader. If fixed many of the NES’s issues, notably by removing the lockout circuitry and replacing the toaster design with a standard top-loading card edge connector. It is a far more reliable machine. But thanks to its late debut and being overshadowed by the SNES, it is rarer than the standard model and thus still sought after by NES collectors. And since it is similar to the Famicom design, the cart swap trick is now possible. In fact, I reproduced the trick and captured it from my NES. See the video below:

So how and why does this work? I posed the question on the NesDev forums and got a number of helpful answers. User mikejmoffitt said:

If I’m not mistaken, this works simply because by hoding A+Start as you begin a game in SMB, it does not clear the values in ram associated with the current world. Normally, the value in ram will simply be the world you were previously in. By starting another game, which uses that address for a totally different reason, and pulling it and resetting, that value is never reset, so SMB uses whatever was there.

And Grapeshot added:

The other important aspect of this trick is that Super Mario Bros only clears RAM on startup when any of the bytes used to store the score is greater than 10 or the value of the last byte of RAM is anything other thn $A5. Tennis, being another early Nintendo game, uses the same place to store the high score and the same signature byte, so the RAM is not cleared. The same trick might work with some of the other Nintendo black box games as well depending on how much code was reused.

Since Nintendo was developing most of their games in-house during the early years of the Famicom, programmers likely shared a lot of code. Scoring a few points in Tennis updates a location in RAM that happens to coincide with SMB’s current world. However, that value can exceed the normal range of variables expected to plop Mario into a valid level. The reason behind the Minus World is a bit too complex to recap here, but the summary is this: SMB’s engine is incredibly flexible with the data it can handle to generate level maps. If you point it at an arbitrary block of bytes, it will chug along, dropping objects into a level until it reaches a valid terminating byte (if ever). The engine doesn’t care if the world makes sense. A water-filled overworld stage with spinning fire bars? No problem.

Another interesting point not covered in the forum thread is what is happening during the cartridge swap. Notice in the video that removing the cartridge leaves strange graphical remnants onscreen. This frame in particular is pretty great:

The color palette should still be recognizably Mario-esque, even if the constituent graphics aren’t correct. If you look carefully, you might notice that Mario’s sprite is now a monstrous amalgam of tennis player parts and the pipe is built from pieces of net. This graphical substitution is a result of how Nintendo cartridge hardware is designed.

NES games are divided into (at least) two parts: the character read-only memory (CHR-ROM) and program read-only memory (PRG-ROM). In general, the latter holds the game’s code, while the former contains all the graphics. The NES’s limited picture processing unit (PPU) can see up to two pattern tables of tiles, as they are called, one for background elements and the other for sprites. Each pattern tables can hold 256 individual pixel mosaics apiece.

When a cart is removed mid-game, VRAM is stable enough to hold some information onscreen–the palette, for instance. However, once the cartridge is removed, the PPU no longer has access to the actual CHR-ROM data. Removing the cart physically removes the background and sprite tiles. But since the machine is still on, the PPU is still busy displaying the information it still has, however incomplete. If you reconnect the circuit by inserting a new cart, the PPU substitutes the tiles from the new pattern tables into the locations previously reserved for the tiles from the prior pattern tables. Notice above that much of the status bar text is still intact. This is because NES programmers commonly stored alphanumeric tiles in the same locations in CHR-ROM. Thus the ‘M’ tile from SMB is located is the same pattern table location as the ‘M’ tile from Tennis.

I find this process especially fascinating because it is effectively impossible to capture in emulation. We can reproduce the Minus World behavior by manually corrupting RAM locations with the same values that Tennis does, but these weird interstitial states are wholly locked in the analog realm, subject to the interaction and decay of real circuits and volatile RAM.