It is possible to hit the ESW plane (or in this case, the death plane) without using FireBlast.

Just need lucky memory allocations that form a line intersecting ESW plane.

I was able to hit ESW plane once without FireBlast, but do not have it on video

I want to try and find an RTA K5E setup.

Requirements:

1. Finding a semi-consistent way to leave IM with the same heap memory every time
2. Finding a semi-consistent setup to overwrite mount coordinates with FireBlast once we reach K5

I think #1 is possible:

I am not 100% sure yet, but this shows that we can consistently overwrite the bike coordinates with 15/40/15, which is promising.

Steps in video:

• Console reset after bike flag glitch
• Enter game
• Hold L to minimize camera movement
• Hotkey fireblast for later
• Ride bike into Fuel Cell from behind
• Memorize inputs to get the bike to the gate (wait for ~1s, 4 quick taps left, wait, 1-2 quick taps left)
• Spam zoom and clip through gate

Some possible failure cases:

• Messing up the inputs, so the bike does not get to the gate
• Sometimes the bike goes through the gate entirely, messing up the RNG manip
• Camera is RNG, so you may need to try multiple times for a good camera

Loses 45s per failed attempt

swag

I mentioned this result in one of my first posts, but now I have a recording. Memory leak can bypass cutscene voids (emulator only, MMU disabled).

Similar to Rocket Boost Warp, this is an emulator only strat. but still worth looking into in case Nintendo releases an emulated version of SFA on a future console.

I've done various testing with MMU enabled (ie console), and as far as I can tell, it's always a soft-lock when the heap memory is exhausted.

Also, it is very hard (impossible?) for the memory leak to effect any other zone except for TTH and CC. Every other map uses considerably less memory as far as I can tell.

Here is the TAS playback of K5E with heap viewer enabled:

Glowing red line in the 2nd row = Bike memory is unfilled Glowing green line in the 2nd row = Bike bike memory is filled by another object

I could not spot any meaningful patterns. By the time TAS gets here, the memory is very fragmented.

At 0:52, we walk into the room and get lucky, freeing the bike memory. Then we get lucky again, and a Fireblast overwrites the bike memory. Finding setups that do not involve luck/savestates seems really hard.

Edit: I have since learned that my heap viewer had bugs and was showing some FREE memory as ALLOCATED. So this video is useless.

Useless, starting from glitched bike state

Destroying the bikes early does not seem to do anything. Reloading map with a zoom restores the bikes.

If you hit the race start + race end trigger, you can win the race, but this is possible without destroying bikes.

When throwing the barrel, while moving upwards it appears the barrel can bounce. It may be possible to perform a cannonless explosive barrel clip in TAS if you can get a perfect bounce.

Edit: Maybe not possible, I think Fox cannot be pushed while doing his throwing animation.

I released a new heap visualizer tool that builds off of Rena's python scripts. Ported to a C# WPF/.NET 5.0 project

Here is a link to the tool if anyone wants it: https://github.com/zcanann/K5E

The visualization for the memory leak is not really what I was expecting though:

It kinda looks like the memory in TTH is always full, but maybe some of these regions are placeholders?

Here is how to perform the Void Walking section in WC.

By moving the camera OOB, it lets you use the left trigger again for some reason.

This was my 3rd attempt (two soft-failures), but I think I got lucky. It's honestly a very hard trick to do.

Types of failures: Hard failure = console reset Soft failure = end up back at K5 instead of SunStone temple, and you can retry the trick. Loses a couple minutes.

If you mess up the trick and fall too low = hard failure If you zoom too early after the rolls (Fox will fall very far down in this case) = hard failure If you exit too slowly (end up too low) = hard failure If you exit too quickly (missing the ESW trigger) = soft failure If you botch the initial height setup = soft failure If you are even slightly off when executing the trick, could end up being either hard/soft failure.

In my experience, if you walk near the river and can see water near the camera, then you are too high, and are likely to miss the ESW trigger. If you can see the terrain (at 0:35) then you have a good height.

A Life-Force door can be used to cancel a cutscene, and it does not have any vertical checks:

I had to use hacks to unset the "discovered" flag. This flag is set during the Krystal segment when approaching the Life-Force door, even if the door is gone/already open.

This would be a very useful discovery if someone found a way to keep this flag unset for Fox, because if an RTA viable K5E was discovered, this would be a very easy way to cutscene cancel in WC.

I can't think of a way to make this viable in RTA: Life-Force door => can't keep flag unset (even with ESW strats) Bomb spore plants/patches => disabled during cutscene voids Explosive barrel pads => too high to hit during WC void walk Mana plants => not collectable Food => not collectable Scarabs => collectable, but can't see a way to do this

The current WC void walk strat would be too hard in RTA (roughly 1 in 25 chance, unless we can find a setup)

Useless, but Fox can push the Ocean Force Point Temple block while underwater

Here is a LOTAD of the route, which skips almost everything, even Tricky. This builds from of the start of LobsterZelda's TAS:

The TAS is until K5E. Afterwards I spliced the rest of the run up to the start of Andross. The entire TAS run should be under 1h.

Route notes: 22:28 - End of LobsterZelda's segment, start of LOTAD 28:20 - Barrel Clip 28:45 - Bike State Glitch 30:00 - Hotkey FireBlast, ride glitched bike, Fuel Cell dismount 30:15 - RNG Manipulation #1 - My goal is to keep the bike memory unaffected by the zoom. I think this helps increase the chances of a FireBlast overwriting our mount coords later. 30:30 - Zoom clip 31:15 - Intentional damage. Trying to lower Fox's HP to 2 for K5E. 31:30 - Void Traveling (about 6 minutes of swimming, not optimized fully) 37:45 - K5 Shrine loaded + RNG manipulation #2 38:40 - Stale Mount Trigger with FireBlast <End of TAS, start of Splice> 41:00 - Walled City Void Walking 41:40 - Sun Stone ESW trigger 41:45 - !! Hack used to change Y coordinate because I was too lazy to do this optimally. This normally requires a very precise run angle / zoom to hit the trigger and escape fast enough to lock Fox's Y position at an acceptable height. 42:20 - Moon Temple death trigger 42:25 - Ice Mountain Warp. This works because we only hit ESW triggers, not save triggers. The rest of the run is normal from here. 46:45 - Death warp. This is now possible since we never increase our max HP.

TAS DTM file (up to K5) https://drive.google.com/file/d/1We7xprwUwm0f9kHWJwXaEvjJypcnk4pz/view?usp=sharing

Here is the TAS Route PDF: https://drive.google.com/file/d/1GbtR0_mxB-q0ew97ld2UkrbllxXVYR0R/view?usp=sharing

Got it! It is possible to get FireBlast to allocate to the mount coords

This means with heap RNG manipulation, we can just fire a FireBlast shot into the ESW trigger

I used hacks once in this route, but it should still be possible. I will verify with absolutely no hacks and post a DTM later.

This should result in roughly 2.5 to 3 hours saved on TAS.

Might even be possible RTA, but the odds are not favorable (my guess is 1 in 200, but can't say for sure until we measure it)

A new idea -- I think this is our best option. I've tested it with hacks, and it works. The odds are reasonable enough that a TAS should be able to get this.

1. Move the bike to coords (2814.6816, 0, 0) and zoom to unload bike. It is okay to be off by a little bit.
2. Navigate to K5 with Void Traveling, using RNG manipulation to avoid overwriting bike coordinates
3. Load the final K5 room. As the room loads, we need to get coordinates (X, Y, -X) to overwrite the bike coords where:
   • X is larger than 16000.7617
   • Y is 0 or any small decimal number

This is why this works:

I don't know what the odds are of getting this, but on a byte level it looks reasonable, because we mostly need zeros. For example 4C 00 00 00 | 00 00 00 00 | CC 00 00 00 00 works.

This one was discovered/suggested by BvqRzxi5

In FireBlast/Freeze Blast stance, use Rocket Boost while shooting at the same time (A + Y on same frame).

In an emulator with MMU Disabled, Fox will warp to coordinates (0, Fox Y, 18), allowing Fox to hit triggers from far away.

This will likely crash on a console. However, if Nintendo ever releases an emulated version of SFA for a future console, then this glitch might work.

While the Fuel Cell dialog is open, we can control the bike and fly all the way to the top of Krazoa Palace. When the Fuel Cell dialog closes, Fox warps to the bike location (but the bike will unload afterwards)

Some notes:

• Even if we found a way to hit the save trigger up here, the cage will respawn.
• Once the bike leaves the map, you cannot steer it while dialog is open
• It is difficult to land on top of Krazoa Palace, most bike coordinates cause a crash. I think Fox needs to fall into Krazoa Palace -- but not warp directly inside.

Edit: This idea is bad and doesn't work very well.

We need to find initial bike coords that will pass through the ESW plane when overwritten with (0, 0, 0)

Step 1) Manipulate the bike coordinates to a value on one side of the plane (ie 16000, -8000, -13200 -- we will need to do a bunch of math to find out the ideal coords) Step 2) Swim near the ESW trigger, and get an allocation that sets new values to (0, 0, 0)

If the line between the first coords and 2nd coords intersect ESW plane, then the trigger gets hit!

=============================

One idea:

1. TAS a route all the way to K5E. At first, we get the bike OOB, but do not worry about manipulating coordinates yet.
2. Do RNG manipulation until we get reasonable stale mount coordinates. For example, (0, 50000, 0) is good.
3. Then all we have to do is load an earlier save state, navigate the bike into a position that intersects with ESW plane, and then follow that exact route again. In this example, we would then just navigate our bike to (32001.5234, -50000, -26372.1602)
4. Follow the exact same route as before. We should get the same stale mount coordinates.
5. The bike should "warp" to the new stale coordinates, intersecting the ESW trigger.

It seems that this game uses some math to determine if a trigger should be hit. This makes it easier for us, as we do not need to manipulate exact coordinates.

Frame 1: Mount coordinates (x1, y1, z1) Frame 2: Mount coordinates (x2, y2, z2)

Then check if the line from Frame 1 to Frame 2 intersects the ESW trigger. This means instead of exact coordinates, we just need the line from Frame 1 to Frame 2 to intersect the ESW plane.

I think this might work:

• Manipulate specific (x, y, z) coordinates using bike. This is pretty easy (but Y will be a large negative number)
• Load K5, and get (0, 0, 0) to overwrite X/Y/Z -- if we pick the correct initial coordinates, a line will pass through the ESW plane, allowing us to hit the trigger.

More related info

I think we can sometimes get the pause menu to start writing to the mount coordinates:

Edit: Found a simple solution using FireBlast. See Post #6. Edit: Found a semi-reliable RTA setup. See my final post.

When doing the Ice Mountain bike glitch, we can Fuel Cell dismount and ride the bike out of bounds. In other words, we can manipulate the X/Y/Z coordinates.

Then, once we zoom, the bike is unloaded, but we retain a stale reference to the bike. New allocations can overwrite the bike memory, allowing us to change the stale reference coordinates.

When void traveling to K5, if we manipulate the real bike coordinates and stale bike coordinates to intersect the ESW trigger, then we can activate the ESW and collect K5E.

We will need to figure out how to manipulate 3 valid float values. There are many techniques to manipulate these. We just need something reliable.

In v1.0, the size of the ESW trigger is roughly: X: 803428F8 offsets 908, 18 => between 15933.0f and 16069.0f Y: 803428F8 offsets 908, 1C => between -26.0f and 110.0f Z: 803428F8 offsets 908, 20 => roughly -13186.0f (TODO)

Here is my Dolphin Memory Engine file: https://drive.google.com/file/d/1eQZFBNSMYiD0GszC-tmSjb4WFnlWGvjE/view?usp=sharing

We can set these values in the following ways:

• We can set 2 out of 3 of these values (X and Z) using the bike. Just ride to the correct coordinates, then swim OOB as Fox to lock the values in place.
• Sometimes, these values can change when unloading/reloading the IM map
• Sometimes, these values can change when loading/reloading the K5 map
• Sometimes, these values can change when hitting triggers in the K5 map, or facing the camera certain ways.
• Sometimes, these values can change from pausing
• Sometimes, these values can change on the death menu

In this video, I only used hacks to change the X coordinate to intersect the ESW plane, we need to find a way to do this with luck or manipulations.

In this video, I got 2 out of 3 coordinates set by flying the bike before Zooming as Fox: