Hey there! So, you want to perform that sweet instant time trial win glitch and be the talk of town? No problem! We got you covered in this guide. Let's dive into it!
Glitch Explanation
So, the gist of it is that the game has 2 internal values, which we will call g_NumWP and g_TestWP.
g_NumWP (Int32, address 0x891CA0)
This value is static in the context of a level and in essence tracks the amount of waypoints present in the current level. Changes whenever you load into a new level.
g_TestWP (Int32, address 0x892154)
This value is an index into the array of waypoints. It gets incremented 6 times in each frame, except when the game is paused. When its value reaches the number of waypoints, it gets reset to 0. The code for this looks like the following:
...
++g_TestWP;
if (g_TestWP == g_NumWP) g_TestWP = 0;
...
Note that it checks for g_TestWP == g_NumWP, not g_TestWP >= g_NumWP! This means it doesn't reset values greater than the number of waypoints in a level, in which case the value will keep incrementing to infinity and beyond, and when this happens you can trigger the instant wins.
Now, you might be thinking something along the lines of "well, if the value always wraps back around to 0 everytime it is equal to the amount of waypoints, how do we get past that?", which is a fair concern.
The answer relies on another glitch: certain levels (particularly, all time trials and XR challenges) forget to reset g_TestWP to 0 when you enter them, meaning that you can take a g_TestWP value from one level that has a higher amount of waypoints to another one that has less, which would land us in said scenario.
Waypoints per Level
Knowing all that info is great and all but, how on earth do we know the amount of waypoints in each level? The game certainly doesn't tell us that info.Well, not to worry, as we have already been exploring that with Cheat Engine and we noted down said values so that you don't have to (thanks @Steb!). Here's the values for each level:
- Jo-Ad 1: 103
- Flamar 1: 98
- Canis Lunis 1: 149
- Karn 1: 146
- Trade World 1: 229
- Jo-Ad 2: 116
- Karn 2: 161
- Ice World: 164
- Bathyos: 149
- Flamar 2: 132
- Trade World 2: 153
- Canis Lunis 2: 206
- Planet Z: 185
- Zurg's Throne Room: 10
As you probably noticed, Flamar 1 has the lowest amount of waypoints while Trade World 1 has the highest, making them ideal levels to setup this glitch!
Flamar 1 having the lowest also explains how we were randomly getting the glitch going on that specific level, since entering Flamar 1 TT from any other level has a chance of triggering it (since any other level has a chance of leaving g_TestWP above Flamar 1's tiny amount of waypoints).
Glitch Setup Steps
Given our current knowledge, the steps to perform the glitch are as follows:
- Identify two levels, one of them with less waypoints than the other (the greater this difference, the better the odds of pulling this off). • I recommend using Trade World 1 and Flamar 1 for being the levels with the highest and the lowest amount of waypoints, respectively.
- Enter the level with the higher amount of waypoints. For this step, it doesn't matter which version of the level you use, it can be either the regular level or time trial/XR. • If you want to be safer, my personal suggestion is to use the regular level, as it'll reset g_TestWP to 0 and thus will make your timing consistent, no matter what level you're coming from.
- Leave the level when g_TestWP has a value greater than the amount of waypoints of the other level. With the rapid increments this value has, this usually doesn't take more than half a second, so really you want to leave the level ASAP, literally.
- Now enter the level with less waypoints, but making sure you only pick either Time Trial or XR.
- Stay until g_TestWP has a value greater than the amount of waypoints in any other level (we'll talk about this shortly). This usually takes 1-2 seconds at most (and there's no harm overshooting it, so no harm in staying longer if feeling unsure).
- Leave the level.
If you follow these steps correctly, you should now have the glitch active! You can now enter Trade World 1 Time Trial and (if you managed to pull this off correctly) you should be able to get that coveted 00:00:00 medal.
List of levels affected by this glitch
- Trade World 1: You instantly beat the Time Trial.
- Trade World 2: You automatically beat the Time Trial if you go through the pipes to your left, right at the very beginning of the level. However, if you enter Trade World 2 right after setting up the glitch for the first time since launching the game, you instantly win as soon as you enter the level and skip the usual prompts at the beginning.
- Canis Lunis 2: You automatically win the Time Trial once you reach the first bomb room.
- Planet Z: You automatically win the Time Trial by getting hit by a bomb under you while under the third drone on the ramp with the ledge grab (middle of the level). VERY FINNICKY. Photo of the spot: https://imgur.com/Js4JaAh
- Planet Z (bis): If you're unfortunate enough to miss the timing for that first spot on Planet Z, you can have a second chance by going to this next spot on this photo: https://imgur.com/XjG19mh
No other levels (as far as I can tell) are affected in this way by this glitch. As stated previously, regular Boss levels reset the values in question (meaning they'd never be affected by this) and since XR versions of the levels don't work on the basis of "getting to a waypoint" but rather "gathering parts", they aren't affected either.
Proposed optimal Any% route for this glitch
- Jo-Ad 1 - Boss, Aliens, GACs
- Jo-Ad 1 - Time Trial
- Jo-Ad 1 - XR
- Flamar 1 - Boss, Aliens, and GACs
- Flamar 1 - Time Trial
- Flamar 1 - XR
- Canis Lunis 1 - Boss, Aliens, GACs
- Karn 1 - Boss, Aliens, GACs
- Trade World 1 - Boss, Aliens, GACs
- Jo-Ad 2 - Boss, Aliens, GACs
- Jo-Ad 2 - XR
- Karn 2 - Boss, Aliens
- Ice World - Boss, Aliens, GACs
- Bathyos - Boss, Aliens, GACs
- Flamar 2 - Boss, Aliens, GACs
- Trade World 2 - Boss, Aliens
- Setup Waypoints Glitch
- Trade World 2 - Time Trial (with skip)
- Trade World 1 - Time Trial (with skip)
- Canis Lunis 2 - Boss, Aliens
- Setup Waypoints Glitch (again, got reset on previous Canis Lunis 2)
- Canis Lunis 2 - Time Trial (with skip)
- Planet Z - Boss, Aliens
...with this route in mind, you'll be performing this glitch's setup right after doing regular Canis Lunis 2. At this point, you can proceed to go to regular Trade World 1 and take it from there.
Notice I'm not using Trade World 2 TT. This is by design, since it takes longer to reach the instant win point for TW2 TT than to just finish any other challenge level in this route.
Thanks to @MasterLeoBlue we have found that Trade World 2 TT is actually faster than Canis Lunis 2 TT, so now it's included into the route. Great stuff!
With this new route, the idea is that you'll perform the glitch setup two times: once after beating regular Trade World 2 (which you'll use to beat both Trade World 1 TT and Trade World 2 TT instantly) and then another time after beating regular Canis Lunis 2 (to beat Canis Lunis 2 TT quickly).
• The reason you have to set it up 2 times is that if you try to do all 3 challenges after Canis Lunis 2 to do it only once you won't be able to access Canis Lunis 2 at all (since it requires 30 medals and you'll be just 1.5 short of that goal by that time).
Special Thanks
- Thanks to @PhoenixOfGrunvale for bringing awareness to this glitch/skip!
- Thanks to @Steb for providing the first clips for the glitch and the list of waypoints per level!
- Big thanks to @hdc0 for providing info and insight into the inner workings of the game and explanation of the glitch!
- Thanks to @MasterLeoBlue for discovering a new instant win at Trade World 2!
