SNES Code Injection -- Flappy Bird in SMW

I don't know about the run shown in the OP, but there are a fair number of memory-manipulation/ACE speedruns that are feasible in RTA ("real-time attack", a.k.a. something a human could pull off, as distinct from TAS). Off the top of my head I can think of such routes for Pokemon Red/Blue, Ocarina of Time, and Super Mario World. To answer your question of "how likely is one to pull this off" for those three, the Pokemon one requires no almost advanced execution, other than turning off the console at a precise point to corrupt the save data you otherwise just need to follow a simple (though long) series of steps. The Mario one requires some pixel-perfect precision, and runners often used hacked ROMs that display coordinates in order to train. The Zelda one requires exact angles to be held on the analog stick, and I've heard of people creating guides out of cardboard and rubber bands in order to help them achieve the angles more reliably. Sorry that I don't have any video links on hand, but you could almost certainly find examples of these in the GDQ archives. EDIT: Found a good video for the SMW example, by SethBling, which actually goes a step further and manually reprograms SMW into Flappy Bird: [this video] EDIT 2: Here's an excellent explanation of the Zelda ACE: [link]

Just to add some context, arbitrary code execution in Super Mario World is nothing new, it has been known since 2014. There was a tool assisted demonstration at Awesome Games Done Quick 2014 [1] where they inject a pong and a snake game using a TASBot (a robot controller that replays input scripts to the console). And in 2016 a streamer performed it manually to inject a flappy birds game [2] (this second video is really good, he goes into detail of the process). So, what this newer demonstration brings is the use of the known arbitrary code execution capabilities of "Super Mario World" to help finish all 5 games in "Super Mario All-Stars + Super Mario World" as quick as possible. [1] [link] [2] [this video]

I'm a speedrunner, and I'm pretty sure this is well known -- and accepted as standard in some categories! It's a pretty well accepted standard (to the point of the headline being almost a mild offense!). In the gaming world, undefined software behavior is critical to this sort of thing, we see this especially in some games like the legendary exploits found in the Ocarina of Time speedruns for example. I mean, in Super Mario World, SethBling did code injection to manually run a version of Flappy Bird (how ironic given the origin of the pipes!) in the game. By hand. No savestates. It took forever and the run through is really and truly fascinating: [this video] I speedrun things other than games as well -- and so the generalization is not just that we are security researchers, we are people who fundamentally learn the "shape" of a thing very, very well, and ways that this shape can be used to get from one state on that shape to another. In conclusion -- yes, it can be something as simple as security research! But the joy and the beauty of speedrunning is something so much bigger and beautiful than that -- though it certainly is one outcome that can be had!

There are undoubtedly major benefits in the war against cheaters by completely removing user access to the underlying system. However I think there are two fundamental points to keep in mind on why it's not going to be an ultimate solution. 1) Unless cross-platform play is forbidden or the game is exclusively streamed-only, the cheaters will just use a different platform and will still ruin your game the same old way. It's the cheater's platform of choice that matters. 2) Games are some of the least security conscious pieces of software out there [1], primarily written in C++. There are bugs, lots of bugs. Process-takeover enabling bugs. I'm sure Google sandboxes the game to protect their systems, however cheaters only need access to the game process to enable most of their desires. Yes this would raise the bar in how easy it would be to cheat. Average Joe Cheat Engine users would be gone, but more skilled cheat makers will continue business as usual and their released cheats will do the exploits hidden from the actual people doing the cheating. Bonus: See this cute hack that injects flappy bird into Super Mario World. [this video] -- [1] Even AAA developers are clueless about threat models. Games like Tom Clancy's The Division [2] and Fallout 76 [3] are multiplayer games that put extreme trust into the client. Trust that nobody would modify their script files, trust that the client is always telling the honest truth. [2] [link] [3] [link]

> using tools and rigorous methods Lots of speedrun strategies require surprisingly sophisticated tools. People will decompile/disassemble code to figure out what is going on. They'll run the game in an emulator and peek at memory values to figure out how the game works and how to manipulate it. They'll use these tools to set up their game state so that there's a sequence of bytes in RAM, then cause program execution to jump to these bytes, to run arbitrary code execution. Here's a video of a speedrunner explaining some of the things he did to get two arbitrary code executions working together to speedrun Super Mario All-Stars + Super Mario World: [link] (it's about 15 minutes) Here's the same runner using one of those arbitrary code executions to inject Flappy Bird into Super Mario World instead of just warping to end credits: [this video] (it's about 6 minutes) He didn't get to that point just by random pressing buttons until something interesting happened. He got to that point because he understands the Super Mario World memory layout well enough to manipulate it and execute the instructions that he chooses for it. That's vulnerability research any way you want to slice it.