Rust Programming Language RustConf 2020, 21 Aug 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: RustConf 2020 - Closing Keynote by Siân Griffin

Description

Closing Keynote by Siân Griffin

A

Oh hi, there I didn't see you want to tell you a story. 20 years ago, in the year 2000 a game came out for the nintendo 64 called hey you pikachu for christmas. That year I was hoping to get the special pikachu edition n64, but my mom told me that in a few years I wouldn't even still be into pokemon here I am 20 years later, still playing pokemon, and today I want to share that love with you and mom. This talk is for you.

A

Hey everybody, my name is sean griffin text encoding is hard, so sometimes it's spelled like that. Let's my pronouns. Are they them? Let's talk about pokemon, the first pokemon game was made by a small team for japanese audiences. The game was made on a tiny budget, and the programming team was only four people in 1996, pokemon, red and green were released and sales vastly exceeded expectations later that year an updated version was released in japan, with improved graphics and more polish after it was clear that this game was far more popular than anybody expected.

A

There was a mad rush to localize it for international audiences.

A

Two years later, in 1998, pokemon, red and blue were released to the rest of the world and would go on to be the highest grossing media franchise of all time, eclipsing, even mickey mouse and hello kitty. In fact, it became so popular that even if you've never played pokemon I'll wait. You've seen this one before this is an actual picture of ryan reynolds from 1998.

A

Okay, not really. This is pikachu by far the most famous pokemon, but there was a close second. This is missing, though misigno is a glitch pokemon and you could only encounter it through a glitch, but the thing is everybody knew about this.

A

One of the things I find so fascinating about missingno is just how widespread it was in a survey. I ran 87 percent of people who owned the game knew about the glitch when it was relevant and 80 percent of those people heard about it through word of mouth, not the internet, and there was good reason.

A

Missingno could duplicate items now. Glitch had a lot of names. The missingno glitch or the item duped glitch at my school it was called the rare candy glitch since most people used it to duplicate an item with that name. It made your pokemon more powerful whenever you used it, so it was a really desirable item to duplicate.

A

Let's take a look at how you performed the glitch. First, we're going to start off in viridian city, one of the earliest areas in the game, and we talked to this old man he's going to ask if we're in a hurry and we're going to tell him no in response to that he's going to say, oh cool, why don't I show you a tutorial about how to catch pokemon and he's gonna go into this battle and find a weedle and he's going to attempt to catch the weedle.

A

We actually are in a little bit of a hurry, so we're not going to sit through and watch this next. We need to fast travel to an area called cinnabar island.

A

Now, this being the generation 1 pokemon games, the way fast travel worked. Is we transform into a bird and just fly away once we get there? We want to go on to this water, so we're going to do that by opening up the menu and this being the generation one pokemon games we're going to transform into a giant seal thing. I don't really know if we go up and down this coast and eventually we'll get a wild encounter.

A

If you played these games, you might notice this pause right here is way longer than it's supposed to be, and we're going to go into why that is a little later on. So here we see our friend missing. No, it's level 168, which is higher than you're supposed to be able to encounter in the game. The maximum level is 100..

A

We're gonna immediately run away from missing no open up our inventory and when we go down to the sixth slot in our inventory, which is where I had the rare candies we'll see that I now have flat flower too.

A

I had four rare candies in my inventory before this started, and this clearly was not meant to render numbers larger than 99. So I guess the way it renders 13 is flour, because 4 plus 128 is 132.

A

If you've never seen this glitch before this probably seems like an extremely random sequence of events for such a specific outcome- and it is let's break down each piece of this as with most major glitches. There's no single bug, that's responsible here.

A

This happens because of a bunch of different bugs and in most cases you can't even really call them bugs just properties of the code being used in unexpected ways.

A

Now I want state up front, I did not work on this game, nor have I interviewed the programmers who did.

A

I have spent a lot of time looking at disassemblies of the game, and I think we can infer a lot about what was intended from reading the code and knowing about the constraints that they worked under, but I want to make it clear that a lot of this is speculation without the way, let's start going through each of these, each of the pieces of this glitch, I'm going to go through them in the order that I think they were initially discovered.

A

So the first thing you might be wondering is: what's up with those coast tiles. Why do we go to that spot specifically and go up and down the coast in the pokemon games? There's sort of a grid system that the player occupies. This is one tile that the player is standing on and they can move one tile up down, left right, etc.

A

This is that same tile when we remove the player from it now, even though, from a gameplay point of view, this grid system occupies single tiles. The code actually sees the game a little more fine-grained than that. It sees this tile as four subtiles and for the tile the player is standing on. These are the coordinates. The upper left, subtile of where the player is standing, is coordinate. Eight eight and the bottom right is coordinate nine nine.

A

Now, whenever you're moving along these tiles in the game, it's going to continuously be checking to see. If you can encounter a wild pokemon, there's two main ways that you could encounter pokemon in the first in the first generation of games, you could be surfing on water or you could be walking through tall grass. There was also fishing, but it worked completely differently and is unrelated to this glitch, so we're just gonna pretend it doesn't exist.

A

This is what the code for that looked like first thing. We're gonna do is load up the tile at nine nine, so the bottom right subtile, where the player was standing, then we're gonna check to see what kind of tile it is. We need to figure out how likely we are to run into a wild pokemon if the tile's grass we're going to use the grass encounter rate for the current area.

A

If the tile's water we're going to use the water encounter rate for the current area, and if it's neither, then the player cannot have an encounter with a wild pokemon here, so we just exit out, then we actually need to compare this to a random number generator which isn't actually random, but we're not going to get into that today to determine if we actually get an encounter I've com. I've left that code commented out here, because it's not actually relevant to why this bug occurs.

A

Next they're going to load up the tile, the player's standing on again, but this time, they're loading, the bottom left subtile and then we're going to determine which kind of pokemon they can encounter.

A

So if the tile's water we're going to select one from the list of water pokemon for the area, otherwise we're going to select one from the list of grass pokemon for the area and so because they load up the tile, the player's standing on twice and the second time they use a different sub-tile whenever we're moving on when wherever we're on a tile. That looks like this, where the right side is water and the left side is land every time. It's doing one of these checks.

A

It thinks we can do an encounter because we're on water, but because the bottom left subtile is not water. It's going to load up the grass pokemon.

A

Now, when we look at this bug in rust, I think this is the easiest bug that we're going to look at today to scoff at say. This should have been caught in code review or I wouldn't have written this, and it really does stand out in rust, you're assigning the same variable twice and there it's on the same screen and it's different numbers like this just sticks out like a sore thumb to me, but they didn't write this program in rust.

A

They wrote it in assembly and rust loses some of the nuance of what happened here. You wouldn't have written this code in rust in the first place. There's absolutely no reason that you would have assigned tile a second time, but in assembly you don't just have, however, many local variables you want.

A

When you write a program in rust, the compiler is going to determine where to store every variable that you write. It's either going to assign it to a register sort of like a global variable that your cpu uses, or it's going to put it on the stack now in the pokemon games. They did have a stack, but it was really tiny, only 207 bytes, so they basically never used it unless it was absolutely necessary. The main place it was used was for audio playback.

A

Now in this bit of code that I commented out, this is where a lot of the context gets lost. First of all, these two lines just don't appear on the same screen that in the assembly version of this they're actually about 50 lines apart, so you wouldn't see them both at the same time.

A

That alone to me makes it much more reasonable that this would have just slipped through code review. If I can't see both of these at the same time, I'm much more likely to just not spot that now the game boy used a variant of what's called z80 assembly and we're not going to go too into too much into the minutia of what that means.

A

What's important about uh the differences between various assemblies is different types of assemblies have a different number of general purpose registers the sort of global variables that your cpu can use for, literally anything and on the z80. They only had four registers that were truly general purpose and in this code that I commented out, they used all of them, so they had to load up the tile again. They could have stuck it on the stack.

A

Maybe, but you don't want this to be the one place where oops we don't have enough stack anymore, so they just reloaded it, and that seems perfectly reasonable to me. Frankly, if you had to work on his constraint, could you write your whole program with only four global mutable variables and nothing else and avoid bugs like this? I sure, as hell couldn't okay, so the end result of all this is on these tiles.

A

Specifically, the game tries to have us encounter a wild pokemon because it's water, but we instead encounter grass pokemon, but that's not by itself particularly useful. So, let's move on to the second piece of this.

A

Whenever you enter a new area, the game has to load up the encounter tables for the area that you're currently at there's one spot in memory. That's just this: is the current area's grass encounter information, so the first thing it's going to do is grab how likely you are to encounter grass pokemon in the current area. It's going to grab that from just some global section of rom.

A

I've made that a constant here in the in the rust translation and that's going to check if that number is greater than zero, and if it is it's going to copy the encounter table over and it does the same thing for water. What's important here, though, is what happens when the grass encounter rate is zero when zero? We just don't do anything, it doesn't zero out the the table doesn't replace it with some dummy data. It just leaves whatever was there before.

A

So this means that, in these areas with these coast tiles, as long as that area doesn't itself have grass pokemon, we can use this to encounter grass pokemon from other areas and that's why we specifically do this glitch on cinnabar island, as opposed to anywhere else in the game that has these coast tiles with the land on the left side, because we can fast travel to any town and cinnabar island is a town.

A

It's easy for us to fast travel there and get to this coast in particular, without ever passing through an area with grass pokemon. So that means as long as we can use the game's fast travel system. We can use this glitch to encounter the grass pokemon from any other area now that by itself isn't necessarily the most useful thing in the world. It was used for something very specific.

A

There's a place in the game called the safari zone, where there's a bunch of really rare pokemon that you kind of want to get, but it uses its own special encounter mechanic that was really annoying and everybody hated.

A

But with this glitch you could just go into the safari zone, travel to cinebar island and go on these coasts, and then you would be able to encounter the pokemon from the safari zone with the normal, uh with the normal wild pokemon encounter mechanics, and this was really useful and people. This wasn't as widespread as missing. No, but a lot of people did know about it, and this was called the the fight safari pokemon glitch.

A

We don't just want to catch safari's own pokemon, like that's cool, and all we want more. We want 128 rare candies if we're going to do that. We need to do this glitch when the grass encounter table contains information that isn't a real pokemon encounter table.

A

Now, when this glitch was originally discovered, it actually wasn't done the way I demonstrated it to you. It was done by trading with an npc in the lab on cinebar island npc stands for non-player character.

A

The pokemon games have a system where you can send a pokemon to another trainer and get one back in return, and there are a few npc characters. Who will do this without you having to have any friends in real life?

A

Now this game was really constrained on memory and everything had a very specific spot in memory where it was stored and often times those addresses were reused, and this is one of those cases whenever you traded with another player or npc. That person's name was stored in the same spot as the grass and counter table.

A

So to see why this is useful to us. Let's look at why at how encounter tables are actually stored in memory.

A

So, like I said, everything in this game just has a very specific address and the address for the grass encounter table for the current area the player is in is d887. That zero x means it's hex notation.

A

Now this is a table with 10 entries. The first byte is the encounter rate. How likely you are to run into a wild pokemon the lower? This number is the more likely you are to have an encounter.

A

Then we have uh for each of these 10 slots a pair of two bytes. The first byte is the level of the pokemon in that slot, and the second byte is the id of the pokemon in that slot, and each of these slots have a fixed percentage chance of running into them. So the first two are about 20, the next one's about 15 percent and then about 10 percent and so on and so forth.

A

So let's take a look at what a real encounter table looked like address. Cfa3 you'll find the encounter table for an early game area called mount moon, so we copy over the encounter rate. 10 is really low, so we're likely to run into a lot of pokemon and then three most common pokemon that you'll run into is the pokemon zubat. And then, after that that looks like a rocky zubat to me.

A

I don't know so then we finish this once we copy over this whole encounter table. Well, actually for this one in particular, something might stand out to you, it's all zubat. I don't know. I guess the game developers were like hey. Should we maybe put some pokemon here and like oops nope, all we've got is zubat. That's all we got sorry and so kids would go through this area and every two steps they would see. Another zubat and they've got and they'd go sleeping in their dreams.

A

All they could see is these horns of zubat and they would hear actually I'm sorry y'all. Can you can you hold on one? Second: hey: hey, have you not seen the news? There is a pandemic going on outside come on.

A

A

Sorry about that soup hats, I swear all right so, as I said once we once we've got the encounter cable copied over. This is what it looks like for mount moon, but of course we don't want to run into a lot of zubats because well. That would just make me sad.

A

So let's look at what happens when we copy over this trainer's name now, all npcs I can trade with you in the game are for some reason just named trainer and nothing else. So we're going to look at what happens when you copy over the string trainer. Now pokemon blue used its own custom text encoding. So trainer is actually only a single byte. There is a control character that is print the word trainer and then the end of name. Marker control character is 80 in decimal, so we copy this over.

A

We copy over trainer, which is the first byte and that just gets ignored because we're using the water encounter anyway and then 80 happens to be the idea of missing no, and so this is a really great way to do the glitch, because you get an encounter table. That's just all missing, though all level 80 missing knows specifically and it's great, but the problem with doing it. This way is that when you trade with an npc, you can only do it once and once you've traded with that npc. You can never do it again.

A

So you can. You can encounter a lot of missingno's this way, but as soon as you go to an area with grass pokemon you're not going to be able to do the glitch this way again, so we want something that we can actually repeat, because we don't just want 128 rare candies. We want 128 rare candies as many times as we want, because rare candies are delicious.

A

So that's where the old man glitch comes into play. Now it's called the old man glitch because well, his name is old man, and it's really this. What his name specifically is isn't that important, what's important here is that he has a name, because this game was optimized for code size they didn't want to have.

A

They didn't want to uh have the code be too large on the cartridge or they might have to double the size of the rom available to them on the cartridge and given the budget they were working under, they just couldn't afford to do that, so everything was optimized for code size, so this tutorial could have been implemented as go to a completely separate piece of code that goes through this tutorial or you could do what they did, which is have it go through the normal battle code and just add, like three or four conditionals to the battle code of hey is the?

A

Is this the tutorial? If so, don't accept player input here now the problem with doing that is there's stuff, there's code in there, that does things like print the player's name. But since the player is not in control here we don't want to print the player's name. We want to print old man, so they caught. They need to copy over old man to where the player's name is stored, which means they need to store the player's name somewhere, and where did they decide to do it?

A

You guessed it the grass encounter table so for this demonstration I set my name to hi sean and let's take a look at what happens when we interpret that as an encounter table.

A

So the h is going to get copied over into the rate and that just doesn't matter again because that's just ignored and then I is 168 a is hey, that's a missing, no and then another 168. and hey another missing. No, and then we got level 174 and wouldn't you know it they're all missing, though it's almost like. I specifically picked a name that only had missingno characters in it to make it easier to to demonstrate this glitch to y'all.

A

What a coincidence now, of course, each of these missing note came from a different letter in my name, which is weird because those are different ids, and so therefore they should be different pokemon. They shouldn't just all be missing. No, let's talk about what even is a missingno contrary to what you might think, it's not a single pokemon.

A

There are actually 39 distinct pokemon, which are called missingno. It's not just reading garbage data, even though it's sprite is clearly garbage data. It has a well-defined name, it's printing missing! No there not just random garbage, and it's not like in the code. They could say. Hey! Is this garbage, if so print missing? No, you can't really detect what garbage data is at runtime, so this is clearly in a table somewhere that it's expecting to print.

A

This word out a lot of other attributes that has are well defined as well to understand why some of its attributes are garbage, but others aren't. We need to see how pokemon are stored in the code when most people think of a list of pokemon, they think of the order that they appear in the pokedex, the in-game encyclopedia every pokemon has a number associated with it and they're loosely ordered in the order that you would encounter them in the game.

A

That's not how they're stored in the game when most people think of pokemon number one they think of bulbasaur, because that's the first in the pokedex, but actually the pokemon with the id of one is called rydon in the code. Most of the data related to the pokemon is stored in the order they were originally created.

A

The game was supposed to ship with 190 pokemon at one point in development. 40 of those got either cut or saved for another generation, and then one got added at the very last second and so missing no is what's stored in the slots where the cut pokemon were supposed to be now. For the most part, those entries where mystic knows data is is just zeroed out. It's all zeros.

A

There are some exceptions like its name, but, for example, it's pokedex idea zero. It's cry the sound that it makes when you encounter. It is almost always zeroed out so for anything, that's ordered by internal id. We're gonna get well-defined but zeroed data, but for anything that's stored in pokedex order. We're going to get garbage. Let's look at why that is one of the things. That's stored in pokedex order is the pokemon based stats table. This includes things like its attack and defense and hp what it can evolve into what moves it can learn.

A

And importantly, it also contains the pointer to the sprite.

A

So the first thing that the game is going to do is look up the pokemon's pokedex number from its internal id and for missing. No that's zero.

A

Now, because pokedex numbers start at one, they subtract one from that to turn it into an index into an array.

A

This is a unsigned 8-bit integer, so this is going to underflow and we're going to get 255. or you could think about this, like we were trying to get the pokedex entry for a hypothetical 256th pokemon.

A

Now the array that we're indexing into only has 151 elements in it. So we read way past the end of the array and in the case of missingno's sprite or ends up reading, is the middle of some data for npc trainer is in an area called route 17.

A

and when you interpret that as a pointer, it points to some code related to the safari zone and so missingno's glitched out. Sprite is what you see when you interpret that code as if it were an image, but most data in the game isn't stored in pokedex order. That's the exception, not the rule.

A

Ironically, the pokedex itself is one of the things that isn't stored in pokedex order, so missingno even has a valid pokedex entry. Well, almost you can see. It's got a name and a description and a height that looks like a placeholder, but then the weight is just sort of a random number.

A

Its entry wasn't localized and the structure of pokedex entries in the japanese version of the game was a little bit different than the english version.

A

If we look at the japanese version, though we can see- oh yes, no, there's clearly valid data here for this version of the game. It's the question mark question mark question: mark pokemon, its weight is 10, its height is also 10, because height was in decimeters for some reason, and then that description translates to comment to be written.

A

There are some differences between the different missing nose, though in fact a lot of them have unique data, the cry that a pokemon has the sound it makes when you first encounter. It is stored as three bytes one, that's just sort of the base sound and these are shared between multiple pokemon and then another byte for a pitch adjustment and then another byte for speed adjustment and nine of the missing notes have cries that aren't zeros and a few of those actually have bass.

A

Sounds that aren't heard anywhere else in the game, and this supports that missing note. Some of these missing no's are in fact pokemon that were just cut during development.

A

There's also a few places in the game where they needed to display a sprite as if it were a pokemon, but the sprite they want to display, isn't associated with any real pokemon, and so some of the missing no entries are where they stored those sprites.

A

These would only show up if you had a lowercase w, x or y in your name, though so most folks never saw these, and this is really important, which version of missingno you saw was based on your name.

A

This is also why, if you did this glitch in addition to missing no, you would see some high-level real pokemon printable characters in pokemon blue's text encoding start at 128 sort of the opposite of ascii.

A

So, no matter what your name was, the characters that would end up in the level spots for the encounter table would be higher than you're supposed to be able to reach in the game. They would always be higher than 100.

A

You could also get some glitched trainer battles this way, but those would only appear if you had punctuation in your name. So most people were unaware of that. I certainly had no clue that was a thing until I started doing research for this talk now you might be asking if the encounter table is based on your name. Why could everybody do this glitch?

A

Surely it'd be possible to have a name that didn't map to missingno at all? This is sort of true. It was possible to have a name that didn't include missingno, but even if that was the case, you could still get 128 rare candies.

A

It was pretty unlikely that you would have a name that didn't include missingno for a few reasons.

A

The control character used for the end of your name was stored as 80 in decimal, which is one of the ideas of missing now. So, if your name was an even number of characters, you could always encounter a missingno.

A

A lot of players didn't even pick their own name. They just used one of the preset ones. The game offered you by pure luck. Every single one of these names has the right characters for a missing to encounter, except it wasn't even luck, because the missingno characters were really common.

A

They included uppercase s, h and m, and most lowercase vowels. So the odds of you having one of these in the right place were really high. But even then there was a catch-all.

A

Every custom name could at least encounter missingno's sister pokemon tick m, and we call it tick m, because those are the only characters in its name that you can actually say now, even though they have the same sprite tick m is different, as you can probably tell from the weird characters in its name and its decision not to wear a mask. Everything about tick m is garbage.

A

The graphics that appear in its name are going to be based on things like your party's stats, or your position on the map.

A

Tick m is what you get for internal id0, so you're going to get garbage even for data that isn't in pokedex order, even when it's looking up by internal id, it's gonna, underflow and read past the end of whatever data. It's trying to read now. Tikam had some interesting differences from missingno, it's cry being garbage data would randomly change based on what screen you're on it could evolve into kangaskhan.

A

So you know, I guess this is what a baby kangaskhan looks like.

A

You could also lock up your game by catching it, but if your goal was to get just get 128 rare candies, it didn't matter if you saw a missingno or tick m.

A

So now, let's talk about why the sixth item in your inventory gets duplicated. This has to do with what happens after you encounter a pokemon.

A

This all comes back to that pokedex that we mentioned earlier.

A

Its function in the game is to keep track of every pokemon, you've seen or caught any pokemon that appears on this list is one that you've seen before and the little ball icon next to its name means it's been caught.

A

This is stored in memory as a bitmap one bit per pokemon, it's sort of like an array of booleans, but instead of each entry in the array taking up one byte, it takes up one bit, so one byte represents eight entries in the array.

A

Now, as you might have guessed, this array is stored in pokedex order.

A

So when you encounter a missingno, it tries to mark that you've encountered a hypothetical 256th pokemon, but since there are only 151 pokemon in the game, this ends up writing way. Past the space used for this, the bitmap has to be rounded up to a number- that's divisible by eight, since it has to fit in a byte. So what ends up happening here is there's 152 bits for real pokemon and where it ends up. Trying to write is the high bit of the 13th byte after the end of your pokedex.

A

Now the inventory is what's stored immediately after your pokedex in ram, the inventory is stored as one byte for the number of items that you have and then for each item, there's one byte for its id and then one byte for its quantity.

A

So that means the byte that it tries to write to corresponds with the six. The quantity of the sixth item in your inventory and another way of saying it sets the high bit of the quantity of the sixth item in your inventory is it adds 128 of that item as long as you had less than 128 before now, one other side effect of encountering missingno is, if you had beaten the game when you performed the glitch you'd notice that the place where it stored, the team that you used to beat the game was now corrupted.

A

This is caused by misigno's sprite. Remember when I pointed out that the pause at the start of the fight was abnormally long. This corruption is why that happens due to the amount of space they needed to decompress these sprites. They can't do it on the console's ram, so instead they do it on the cartridge's persistent storage.

A

The space they use for this is large enough for a 7x7 sprite, which is the largest that appears in the game, but the data that represents missing no sprite says that it's 13 by 13., so they write way past the end of that buffer, and the next thing on the cartridge's storage is the hall of fame, but because missingno sprite was read from rom, not ram. That means that the sprite data never changed, and so everybody who did this glitch would see the same corrupted hall of fame.

A

Although you wouldn't know it immediately, because some of the names of the pokemon would include things like the control character for printing your rival's name. So a lot of people would see an ammonite named gary, because gary was a really common rival name, but it would. It would change a little bit now. This bug would have been avoided if there was some bounds. Checking in the sprite decompression code, like I mentioned before, everything in this game was optimized for code size if you're only dealing with a known set of trusted inputs.

A

Omitting, these checks seems perfectly reasonable. When the code received real sprites, it always behaved perfectly. The only reason this code misbehaved was because of a completely unrelated bug that caused it to get garbage data.

A

Now those are the only two abnormal effects of encountering a missingno compared to encountering any other pokemon. Remember that the main way this glitch spread was through word of mouth. That means that there were a lot of untrue or half true rumors that spread around I'd like to debunk a few of those.

A

The biggest piece of misinformation, you might have heard is don't catch, missingno, it'll, corrupt, your save- and this is just straight up- false there's, no ill effects of catching missingno and there's really nothing about it that can't be saved normally.

A

I think the source of this misinformation was a very specific problem that can arise with tick m in the games. You can bring up to six pokemon with you in your party if you catch another one, when your party is full, it gets sent to a storage system, and when you open up this storage system later, the game has to recompute the stats for all of those stored, pokemon and there's a bug in this calculation where, if it tries to compute them for a level zero pokemon, it gets into an infinite loop.

A

Now, you're never supposed to be able to encounter a level zero pokemon. But if you did this glitch with a custom name, you could always encounter a level zero tick m. It would always occupy the bottom two spots in that encounter table and since at the point you did this glitch, you probably had six pokemon in your party. That means it probably went to storage. So I think this was the source of that rumor.

A

Another thing you might have heard is that catching missingno would cause all sorts of graphical glitches, nintendo even put out a statement saying to try releasing it to fix the scrambled graphics. If that doesn't work, you need to restart your game, and just all of this is nonsense.

A

There's a specific, mirroring effect you can cause if you view the stat screen from missingno. What happens here is on the stat screen. The sprite for the pokemon is displayed mirrored and there's a byte that sets that says just render the sprite mirror and for whatever reason, when you view this screen for missing, no, it doesn't set that byte back to zero afterwards, but only front-facing sprites are supposed to be rendered mirrored so anytime, it's a sprite that represents something's back.

A

It gets this weird jagged effect, but this would go away if you, if you viewed the stat screen for any other pokemon, because it would set that byte back to zero correctly.

A

There were some bigger glitches if you had missingno in the follow-up game, pokemon and yellow, but in that game they also fixed the bug that let you encounter missingno in the first place, so I don't think that's the source of this.

A

Finally encountering missingno wouldn't save your game. This is a really weird rumor and I'm not I'm surprised. It even got started because it's so easy to verify it's false. You just do a missing no encounter and reset without saving and see yeah. No, that did not save.

A

I think the source of this one is an n64 game called pokemon stadium. It included an emulator and let you play the first two generations of pokemon games and whenever the cartridge's storage was written to in that emulator, it would display the word saved on screen.

A

So when that buffer overrun happened, that corrupted the hall of fame, that would cause the n64s emulator to display saved on screen, and I think that's where this one came from.

A

So now, we've seen every piece of this glitch. We can see that it was just a bunch of small, seemingly benign interactions between unrelated bits of code.

A

No individual piece of this glitch stands out to me as insane or something that obviously would have been stopped in code review.

A

When you combine all this together, you get one of the most famous glitches of all time, but it's not the result of some horrendously bad coding or lack of qa or any of the other things you might hear. People say about this game.

A

Every piece of this glitch by itself was relatively benign or just due to completely unrelated parts of the code, interacting in ways that nobody would have expected, and this was hand written in assembly under massive space constraints.

A

Every instruction mattered.

A

I certainly don't think I would have done any better than they did, and I don't think anybody watching this would have either a phrase that I've heard from folks making fun of the glitches in this game is completely broken. I think we should just remove that from our vocabularies entirely in this case, and many others where you would try and use that terminology.

A

It's like more likely. The software is developed under some constraints that you weren't, aware of, and you wouldn't do better in the same circumstances, sure these days, they're less likely to be technological constraints, but every single one of us worked on a project where, two days before the deadline, the requirements change out from underneath you or your company, suddenly pivots and now you'd make. Now you do medical services and you have to figure out how to make a bunch of code relevant for that.

A

To me, though, a lot of this glitch just boiled down to because assembly, it's really easy for us to take the technologies we have at our disposal today for granted today.

A

Code size is rarely a hard constraint, you're unlikely to ever work on a project where this binary has to be 27k or smaller, or we can't ship at all when code size matters today, it's usually because of cpu caches and it's a thing we find while optimizing our code and we run our code on machines powerful enough to just include all sorts of safety checks and never give it a second thought, but in 1996, just use rust, wasn't an option and even using c wasn't an option.

A

I'm really glad that we don't live in that world anymore.

A

There's a really high quality, disassembly of the game available, which I used to research. This talk called poker red.

A

It doesn't have the comments in it that the real source code would have, but this team took the the machine code from the game, disassembled it and went from there and figured out where all of the labels would have been and where they would have used macros and turned it into something that resembles real source code. Somebody would have written it's uh amazing project and it was invaluable for preparing this talk. So a huge shout out to the team who worked on that.

A

I also want to shout out the organizers. This has been a great conference and doing a virtual conference like this is a lot of work. I want to give an up a special shout out to nell shamrell, who led the program committee and made it a point to do multiple run-throughs of every talk with the speakers before they before they presented them, that that means that you got a much higher quality conference than you would have otherwise. So thank you so much.

A

Finally, this talk was co-authored with my partner tess and she also helped me with a ton of the slides tess. I love you. Thank you so much for working on this talk with me. It was a blast.

A

If you have any questions, I will be in the discord immediately after this, if you're, watching, if you're watching this in europe, if you're watching this in europe live, go to bed, it's like 3 a.m. What are you doing if you're watching a recording- and you want to ask me a question- here's my contact info feel free to reach out and I'm happy to answer any questions you might have. Thank you so much for watching and bye.