Void Traveling! Potential Massive Discovery
2 years ago
San Francisco, CA, USA

Edit: It looks like this trick ended up being useful for TAS, which can now save 2.5 hours through use of Void Traveling + a Stale Bike Warp

If Fox is mounted, he can bypass void-outs. This means we can get from Dark Ice Mines to Dragon Rock in 8 minutes, but we can't get anything meaningful to load.

Note: Using this method, we can only load exactly 1 untextured zone before zones stop loading altogether.

Method 1) Mammoth swim

We can get OOB with both mammoths in v1.0. We might be able to get OOB with the first mammoth in v1.1, but nobody has confirmed this.

Method 2) Bike fall

2:50 - ThornTail cutscene 3:40 - Intro BattleShip scene

============================

Differences in mammoth vs bike:

  • Mammoth unloads when leaving DIM, which is why we are forced to swim. While "detached" from mounts, Fox cannot hit loading triggers, which is why we can't make progress in Dragon Rock
  • The bike can load things, but is far below the map, which sucks. If we could gain considerable height, we could land on Dragon Rock and save a lot of time.

============================

We can potentially travel to anywhere in Grid 0, -1, or -2. Unfortunately, we will lose too much height so we cannot land on solid ground I think.

The goal is to either:

  1. Find a way to land in Dragon Rock on Grid 0. This is close, and slightly below Dark Ice Mines.
  2. Find a zone-wide trigger we can hit. Is there somewhere we can go that will set a useful game progression flag? (Then we can just save/quit)

https://cdn.discordapp.com/attachments/141969068956712960/804513208219861052/map.png

To limit what I post in this thread, most void exploration videos will be put in https://www.youtube.com/playlist?list=PLnxeygDu0pisfCh_dGm7Lt5DYcHNMheIz

Edited by the author 2 years ago
josejavier1158 likes this
San Francisco, CA, USA

Sadly, the Ice Mountain bike does not seem to be an option (hacks used in video). Leaving Ice Mountain always causes a crash.

Edited by the author 2 years ago
josejavier1158 likes this
San Francisco, CA, USA

We can also swim to orbit:

Edited by the author 2 years ago
josejavier1158 likes this
San Francisco, CA, USA

If only this went somewhere useful instead of Ice Mountain

BvqRzxi5 and josejavier1158 like this
San Francisco, CA, USA

Confirmed that this is possible in Ice Mountain.

Can also be used to get to K5 early, but game crashes due to dismount state:

I confirmed with hacks that if we can bypass the crash, we can solve the puzzle and collect K5. But we will cutscene void in WC due to not having Tricky. Can hit the Sun Temple save trigger, and void out in the Moon Temple first room to recover from this cutscene void.

Cannot interact with ESW triggers or save triggers still.

============

Steps:

  • Approach bike without watching cutscene. Approaching the bike sets address 0x803A4492 to a value of 4 in v1.1
  • Leave through the door. Cutscene is a one-way trigger, so we can avoid it.
  • Hit the save trigger near entrance. This copies the value from 0x803A4492 (active data) to 0x8112578A (save data)
  • Start the race, then save/quit/reload.
  • Now address 0x803A4492 still has a value of 4. The game is expecting 0 here, so the bike is glitched.
  • Fuel Cell dismount.
  • The gate is still closed, and the cannon is non-functional, so we cannot cannon clip. However, we can zoom to unload the zone, and when the zone is reloading we can use the lag-frames to walk through the fence easily.
  • Navigate OOB to hotspring water
  • The next zone you swim to will glitch-load. This only works for the next zone you visit.

Unlike the DIM version, with the IM version we can hotkey anything. Maybe there is a save trigger we can activate using FireBlast?

Edited by the author 2 years ago
josejavier1158 and BvqRzxi5 like this
Ontario, Canada

I have a strong suspicion (and I think others have more or less confirmed) that the reason you can't do much in this state is that Fox is still trying to interact with his mount. If it's still there and you press A, he'll warp back to it. If not, odds are, the game crashes. It's a strange glitched state, where your "riding object" variable is still set, but you're not in a "riding object" state.

Unfortunately it's likely to be nearly impossible to escape this state once you've left the original map - even trying to mount something else instead results in trying to warp back to the original mount, which, if it's unloaded, will almost certainly cause a crash.

However, this is very interesting because it's actually a use-after-free (aka stale reference manipulation) bug! It's not as powerful as OoT's, because there doesn't appear to be anything written to the target (mounted) object, but, some actions (not certain which) cause a function pointer - stored in the object instance - to be called. So it might be possible to achieve arbitrary code execution, if someone finds a very precise setup to get a useful pointer into the address that previously held whatever this function pointer is. (This is complicated by the fact that it's actually something like a pointer-to-pointer-to-pointer...)

Also, in this state, you seem to be invincible. You can walk around on lava, swim in freezing water, fall from any height, breathe posion gas, etc and not be harmed. Just a shame you seemingly can't do anything...

San Francisco, CA, USA

Also it's worth looking for triggers that can be hit while in this state. For example, you can void out near the end of the DIM Lava -- but nowhere else! This is quite strange.

We'll also want to run a memory viewer to carefully watch game flags for changes while moving around the world while void-traveling. Maybe something useful can be set.

Known hittable triggers:

  • DIM lava death trigger
  • Orbit zone trigger (also counts as a save check-point)
  • Warp map zone trigger (crashes if mount unloaded)
  • Scale's Galleon zone trigger
  • Great Fox zone trigger (soft-lock)
  • Red-Eye zone trigger (crash)
  • Maze Map Save Trigger (just entering the maze map is equivalent to hitting a save checkpoint -- useless because this stores x/y/z far below the map)
  • TTH/DIM/CRF Arwing triggers*

None of these triggers fix mount state (except for flying after orbit map)

  • Arwing cutscenes crash if mount is unloaded. These work from DIM if using the "never-deallocated" bike. These do not actually set a save point though. WC/DR arwings cannot be triggered, since the Arwings are not loaded.
Edited by the author 2 years ago
josejavier1158 likes this
San Francisco, CA, USA

Sometimes Warp Pad can have priority over bike warp

Unfortunately, Fox still warps to the bike, so if bike is unloaded, it's a crash.

josejavier1158 likes this
San Francisco, CA, USA

This was done by setting up a camera-lock in TTH, then using a low-swim to access the shop while swimming.

Normally, walking over unloaded terrain causes a soft-lock. Camera-lock allows a partial-void travel, but you still cannot leave TTH.

However, using hacks, if you get far enough away, void traveling works again.

For example, you cannot swim within ~3000 units OOB of ThornTail, but if you use hacks to teleport ~4000 units away, you can swim to the K6 shrine and load it

Edited by the author 2 years ago
josejavier1158 likes this
San Francisco, CA, USA

When Void Traveling from IM, I randomly hit this grab trigger when swimming from Ice Mountain

I'm not sure if this was due to a stale bike pointer manip. But this proves that we can potentially fall down into maps below Fox, which used to not be possible.

Edited by the author 2 years ago
josejavier1158 likes this
Game stats
Followers
214
Runs
235
Players
40
Latest news
UPDATE: Rules and Category Changes [01/23/24]

As of today, new categories and rules have been added to the leaderboard. The following has changed.

Here are the following new categories and changes added to the leaderboard:

  • Spellstone 2
  • Spellstone 1 will now be a sub-category under the new category "Spellstones" along with S
2 months ago
Latest threads
Posted 14 days ago
0 replies
Posted 2 months ago
6 replies
Posted 8 months ago
190 replies
Posted 9 months ago
25 replies