Arbitrary Code Execution in Animal Crossing

Arbitrary code execution, the holy grail of video game exploits… Is it possible in Animal Crossing? There may be more to it than you might think…

‣ Support on Patreon:   / hunter_r  
‣ Become a channel member:    / @hunter-r.  
‣ Follow me on Twitter:   / achunterr  

- Corrections -
‣ At 09:23, I mention you can go to any address with QDS/BBR tags, but realistically you are limited by the size of the structured ROM without the PAT tag.
‣ At 18:52, I mention Link's rock "despawning" with a camera exploit, but this is an oversimplification. The real way to get empty hands and abuse SRM has to do with setting up culling and loading triggers to unload the rock while it's in your hands, rather than "despawning" it.
‣ In general, multiple objects can be used to overwrite pointers in Ocarina of Time, but for the specific human-viable setup with the file select, LightNode SRM is used. This was glossed over in the video; more information can be found here: https://docs.google.com/document/d/1X...
‣ It's mentioned at 19:49 that the Japanese version of the game is required, but it is theoretically possible to use SRM to switch languages to the included Japanese within the US versions. This would allow for Japanese inputs on a US disc.

~ FURTHER READING ~
James Chambers’ NES injection discovery:
https://jamchamb.net/2018/07/11/anima...
Cuyler’s NES patch loader:
https://cuyler36.github.io/2018/07/14...
Ocarina of Time’s true ACE setup by MrCheeze:
   • Ocarina of Time - Setting up Total Co...  

Technical credits:
Cuyler / James Chambers / MrCheeze / Savestate / Glitches0and0stuff / FIX94

Animation credits:
Wyvarie
  / wyvarie  
   / wyvarie  

Footage credits:
GamesDoneQuick / Savestate / MrCheeze / Sethbling

Music credits:
Starmonized / Qumu / Mesmonium / The Noble Demon / irikachana

• Rainbow Road (Remix) - Mario Kart Wii:
   • ♪ Mario Kart Wii- Rainbow Road (Remix)  
• Happy New Year! - Animal Crossing New Horizons:
   • Happy New Year Everyone! - Animal Cro...  
• 5 P.M. (Faithful Cover) - Animal Crossing:
   • 5PM (Faithful Cover) || Dōbutsu no Mo...  
• 9 A.M. - Animal Crossing:
   • 9 AM   Animal Crossing Gamecube OST 61  
• Go K.K. Rider! (Qumu Remix):
   • Animal Crossing - Go K.K. Rider! [Remix]  
• Prologue (Phase 7) - Animal Crossing New Horizons:
   • Prologue (Phase 7) - Animal Crossing:...  
• K.K. Cruisin’ (True Remix):
   • Animal Crossing - K.K. Cruisin' True ...  
• 10 P.M. - Animal Crossing New Horizons:
   • 10 PM - Animal Crossing: New Horizons...  
• Hyrule Field (Qumu Remix) - Ocarina of Time:
   • Legend of Zelda: Ocarina of Time  - H...  
• Dark World (Orchestral Remix) - Link to the Past:
   • A Link to the Past: Dark World Orches...  
• Animal Crossing Title Theme - Nintendo Sound Selection Vol. 2:
   • Nintendo Sound Selection Vol.1 ~ Peac...  

Assets and other information were pulled from the Animal Crossing GameCube community megasheet:
https://docs.google.com/spreadsheets/...

This video was recorded with an HD community texture pack for the game ran through Dolphin emulator:
https://forums.dolphin-emu.org/Thread...

0:00:00 Introduction
0:02:02 Explaining ACE
0:06:50 ACE in Animal Crossing
0:12:45 ACE Achievements
0:14:00 True ACE?
0:16:15 Exploiting Ocarina of Time
0:21:29 Conclusions
0:22:16 Credits
0:23:48 Hmm...