Super Mario World · SNES · 1990 · Arbitrary Code Execution · Discovered by Speedrunning community
By manipulating the game's memory through precise sprite interactions, players can make Super Mario World execute arbitrary instructions of their choosing — letting them jump straight to the ending or even reprogram the game live. What began as a sequence break became one of the most spectacular demonstrations of console exploitation ever performed in front of an audience.
Super Mario World stores information about on-screen objects in fixed regions of the SNES's memory. By carefully positioning sprites, grabbing and releasing items, and exploiting the way the game handles a stunned or held object, players discovered they could write specific values into memory addresses the game later reads as executable code. Because the SNES does not separate data from instructions in the way modern systems do, values placed into the right addresses are run as a program — a class of exploit known as arbitrary code execution, or ACE. The technique was first demonstrated in tool-assisted speedruns, where frame-perfect inputs could be planned in advance, before players learned to perform simplified versions in real time. In 2015 a live performance jumped Super Mario World directly to its credits seconds after the level began, and later demonstrations went further still — reprogramming the running game into entirely different games such as Snake and Pong without any hardware modification. The exploit reframed the cartridge not as a fixed product but as a programmable computer whose behaviour a sufficiently knowledgeable player could rewrite from the controller.
The SNES runs a 65c816 processor that fetches instructions from the same memory it uses to store game data. Super Mario World keeps a table describing the sprites currently loaded, and certain player actions — picking up, carrying, and releasing objects in a specific order — let the player control the exact bytes written into parts of that table. If the program counter can then be redirected into those bytes, the processor executes them as machine code.
Setting this up requires placing the right values into the right addresses, which players accomplish by positioning items and triggering interactions with frame-level precision. The "payload" is small, so live performers typically write a short routine that jumps to the credits or loads a larger program from controller input read on subsequent frames.
Credits warping collapsed the fastest completion of Super Mario World from minutes to seconds, fracturing the speedrun community into categories that permit the glitch and categories that ban it to preserve a conventional playthrough. The "any%" leaderboard became a contest of execution consistency on a setup most players never fully understand.
Beyond speedrunning, the exploit became a centrepiece of live technical demonstrations at events like Awesome Games Done Quick, where performers reprogrammed a stock console mid-run into playable versions of other games. These performances turned an obscure memory bug into one of the most widely shared illustrations of how thoroughly a determined community can master a closed system.