Cited on HN 6 times, 2015–2021, never outright recommendedscore 0
Years with an HN recommendation, 2007–2026
Cited as the classic example of arbitrary code execution inside a game, with later runs injecting Pong, Snake and Flappy Bird.
A tool-assisted speedrun of Super Mario World that achieves arbitrary code execution through frame-precise controller inputs, finishing in 2:25. It was also performed live on real hardware at AGDQ 2014.
“it involves executing the contents of the controller registers as code, which requires frame-precise inputs” (HN, 2021)
He's pointing out that although this type of thing has already been done before by automated inputs (such as this video [this video] ), this is the first time a human has done it.
Earlier automated-input version of Super Mario World arbitrary code execution.
One of the most brilliant applications of this concept is the Pokémon Yellow Total Control Hack: [link] Similarly, arbitrary code execution in Super Mario World: [this video] It's like transforming a chess game into Mikado just by playing it.
Example of arbitrary code execution inside Super Mario World.
[this video] Video is about exploiting Super Mario world, on SNES. The result is that the exploiter then proceeds to make 2 new games inside SMW: Pong and Snake. Those games don't exist inside SMW. They were uploaded using controller inputs. All it takes is 1 hack.
Exploit makes Super Mario World run Pong and Snake via controller inputs.
That's wild because Super Mario Bros contains a built-in code editor (via arbitrary code execution easter eggs), and Nintendo is OK with that. [this video]
Somewhat disappointed. I was expecting them to use the well-known arbitrary code execution exploit in this game to load their own implementation of FizzBuzz, cf. [this video] The method used by Masterjun3 is TAS-only (it involves executing the contents of the controller registers as code, which requires frame-precise inputs), but there are some other methods which are more viable for a real-time attack.
TAS-only arbitrary code execution exploit in Super Mario World.
Video list and Hacker News comment labels from HackerTube (prompted by @karpathy), released under ODC-By 1.0, built on the open-index/hacker-news archive. Hacker News data is provided by Y Combinator; comments remain the work of their authors. Video titles, channel names and thumbnails belong to their creators and are shown via YouTube. HackerTube Watch is an unofficial edition. Data export of 2026-10-31.
![Frame from [TAS] Super Mario World "Arbitrary Code Execution" in 02:25.19 by Masterjun](https://i.ytimg.com/vi/OPcV9uIY5i4/hq2.jpg)
Plays via YouTube's privacy-enhanced embed
6 Hacker News comments
From the HN archive; up to 20 kept per video, favoring different commenters. Recommendations first.