G-Mode Save Station
During G-Mode, the game behaves in some ways as though X-ray scope were still active. The most noticeable are that the game does not process PLMs or projectiles. Stepping on a save station in G-Mode, and subsequently activating X-Ray to leave G-Mode, can execute a wide amount of code, most often crashing the game if done blindly, but can grant Samus any item in the game. This is used in the Glitched RBO world record route to obtain Gravity Suit.
Contents
Functioning
The game stores lists for each PLM, located in bank $84, of pointers to functions, and arguments for those functions. These are called instruction lists. There is a section of RAM from $1D27 through $1D76 where the game loads these pointers for running functions related to processing PLMs. For the save station, the pointer is loaded into $1D75 (the game starts at the top of this range and works downwards. Since save rooms have two PLMs that are processed when entering the room: first the door, and then the save station). In G-Mode PLMs aren't processed, and when Samus steps on the save station, $1D75 starts increasing by $02 every other frame, starting with whatever PLM instruction the game was last trying to execute. When entering a save room, $1D75 will contain $AFEC, which is a pointer to a sleep instruction (save station does nothing until Samus attempts to interact with it).
After stepping on a save station in G-Mode, and X-Ray is activated, and G-Mode left, the game will look at whatever value is in $1D75, and interpret those two bytes as a location of a pointer in bank $84. For collecting items, you'll need to stop on a correct byte in order to be granted the item (see list below). Every item in the game has three variants: normal, hidden, and in a chozo orb; and either of these will work for obtaining the item. However, the instruction lists for these variants are so far apart in the ROM that it is irrelevant. Therefore, using the one that appears first in the ROM (the normal, not hidden or orb variant) makes the most sense. The game will either crash or do something else unexpected if X-Ray is not pressed in the two-frame window. It can also matter how long the dash button is held down to activate X-Ray.
It is also possible to spawn energy refill and map stations (though unusable as they will spawn too close to the floor, on the left tile of the bottom of the save station), Samus Eaters (Vileplumes), shot blocks, door caps, and basically any other PLM. It is also possible to execute a lot of other code, with mostly unknown or undocumented results (or most likely, a crash).
Because $1D75 increases by two every frame (or every other frame if standing half on the save station PLM) and starts on an even address, it is only possible to execute instructions whose pointers exist at an even address.
Executing
The save station platform is made of 2 blocks, the one on the right is solid, while the one on the left is the PLM block. There are two ways to stand on the save station platform to make the PLM value change:
- land solely on the left block to make the PLM value advance by 2 every frame: AFEC, AFEE, AFF0, AFF2, AFF4, AFF6, ...
- land in the middle of the platform, which makes the PLM value advance by 2 every 2 frames: AFEC, AFEE, AFEE, AFF0, AFF0, AFF2, AFF2, AFF4, AFF4, AFF6, AFF6, ...
Given a certain wanted value, say E2F6, the number of values between that and AFEC is 330A, or 13066 in decimal. For 1), those values are covered twice per frame, so it takes 6533 frames to reach the address wanted, and it is a frame-perfect trick. For 2), it takes twice as long to reach that same value, 13066 frames, but it has a 2-frame window since the next frame would also have the same value. Landing in the proper position can be made easier using normalized movement, such as a buffered spin jump or using a bomb.
To end G-mode and execute the value, X-ray must be activated. For case 1), the X-ray activation can be done right there on top of the block, and the correct value will be run provided the correct frame. For case 2), due to the collision oscillator and possibly other reasons, activating X-ray in the middle of the platform can execute the next value sometimes; therefore, it is recommended to jump out of the platform in the correct frame, and only then activate X-ray (alternatively, hold an angle in the correct frame, walk off the platform, and only then activate X-ray). To properly activate X-ray or jump, visual cues can be used, like auto-firing shots or using a timer; reaction time and input delay matter, which means going for some frames earlier.
Activating X-ray for exactly 4 frames can have unintended consequences, like spawning extra (including bad-transition) blocks out of bounds. For most uses, it is recommended to activate X-ray for more than 4 frames.
Relevant Locations
In RAM, $1D27 through $1D76 are related to this glitch, though $1D75 seems to be the more relevant address. After entering the room, its value stays at 'AFEC' (hexadecimal).
Pointer locations for collecting items
When watching $1D75 in RAMwatch, it should contain the following location in order to obtain the item
Energy Tank $E0B6 Missile $E0D6 Super Missile $E100 Power Bomb $E120 Bomb $E152 Charge Beam $E180 Ice Beam $E1AE Hi-Jump Boots $E1DC Speed Booster $E20A Wave Beam $E238 Spazer $E266 Spring Ball $E294 Varia Suit $E2C8 Gravity Suit $E2F6 Plasma Beam $E358 Grapple Beam $E386 Space Jump $E3B8 Screw Attack $E3E6 Morphing Ball $E414 Reserve Tank $E442
Out of Bounds
Some of the values will promote big "block-shuffles", which effectively puts Samus OoB and spawns a bunch of different blocks. This can be used, for example, in Any% Glitched. Some of the earlier values that can be used for this are: B020, B022, and B024.
TODO: add other pointer locations that are known to at least do something other than crash, or potentially could do something useful.
