Super Mario World · SNES · Arbitrary code execution · Saves: The entire game — full runs reduced to under a minute · Documented: 2015
By arranging Koopa shells at pixel-perfect positions, runners write machine code into the SNES's sprite table and make Super Mario World execute it, jumping straight to the credits from the first level.
The credits warp is arbitrary code execution performed by hand, in real time, with a game's own objects as the input device. The insight is that Super Mario World's sprite table — the region of memory tracking every active object's position and state — is just memory, and that the values in it are determined by where the sprites are. A runner who can place sprites with pixel precision can therefore choose the bytes in that table. Choose the right bytes and they are not data describing shells; they are valid SNES machine code. Getting the console to run them requires a second exploit. Eating a Chargin' Chuck at the correct moment causes the game to treat that region of memory as executable and jump into it, at which point the runner's hand-assembled program takes over and directs the game to its ending. The setup is as strange as the theory. Runners play with two five-player multitaps, each holding two controllers — four in total. Only one is used to play; the other three have buttons held down with elastic bands, because the controller registers themselves are read as part of the exploit, and the held buttons supply specific values the code depends on. The result is a category in which Super Mario World is completed without being played in any conventional sense: the world record stood at 41.02 seconds, set by the runner FURiOUS in June 2020.
The credits warp rests on a fact true of nearly all computers and rarely visible to their users: memory has no inherent type. A byte does not know whether it is a sprite's X coordinate or a processor instruction — that is determined entirely by whether something reads it as data or jumps to it as code. Super Mario World stores its sprite positions in memory, and the processor is perfectly capable of executing that region if pointed at it. Nothing prevents this except that, ordinarily, nothing points at it.
What the runners found was both halves of the exploit: a way to control the bytes, by placing shells with pixel precision, and a way to make the game jump to them, via the Chargin' Chuck. Neither is useful alone. Together they convert Super Mario World from a game into a programmable machine, and the player from someone following the game's rules into someone writing new ones. The shells are not being used cleverly within the game; they have stopped being shells.
The four-controller setup is the detail that makes the category legible as a physical act rather than a theoretical one. The exploit reads controller registers as part of the data it operates on, which means the buttons being held at that instant are effectively parameters to the program. A human cannot hold the required combination across four controllers while also playing, so runners hold them mechanically — elastic bands around three pads, buttons permanently depressed, feeding constants into an exploit while the fourth controller does the actual playing.
This is where the credits warp stops resembling speedrunning and starts resembling hardware hacking. The performer is not demonstrating mastery of Super Mario World; they are executing a precise physical procedure that happens to be mediated by a Mario game, with rubber bands as part of the toolchain. Whether this counts as playing the game is a question the speedrunning community has largely resolved by separating such categories from conventional ones — the 41.02-second record is not competing against runs where someone actually goes through the levels. It is its own discipline, and its object is not Mario but the SNES.