Super Mario Bros’ Wildest Glitch: How Speedrunners Cracked the Code

Nearly four decades after Super Mario Bros first launched on the Nintendo Entertainment System (NES), speedrunners have uncovered what many are calling the “holy grail” of glitches: a reliable way to perform arbitrary code execution (ACE) in the game. This discovery doesn’t just shave a few frames off a record – it effectively lets players reprogram parts of Mario’s world on the fly and skip straight to the ending.

This article unpacks what that means, why this glitch is so extraordinary compared with previous exploits, and how a mix of obscure mechanics, the infamous Minus World, and deep technical sleuthing led to one of the biggest breakthroughs in retro gaming history.

Why Glitches Matter So Much in Speedrunning

Speedrunning is the practice of completing games as quickly as possible, often under strict category rules. In this culture, glitches aren’t just bugs; they are tools. Every oddity in the code can be turned into a shortcut, and in a game as studied as Super Mario Bros, those shortcuts are incredibly rare.

Over the years, runners have catalogued a wide variety of tricks in Mario’s first NES adventure, including:

• Wall clips – passing partially through blocks to reach areas faster.
• Flagpole tricks – manipulating how the game counts level completion.
• Wrong warps – entering one pipe or warp zone and emerging somewhere unexpected.

These tricks rely on how the game stores positions, handles collisions, and loads level data. But all of them still operate within the boundaries of the game’s original logic: Mario’s movement, level transitions, and victory conditions remain mostly intact.

The newly discovered glitch is in a different league. Instead of simply confusing the game, it teaches Mario’s world to run new instructions altogether.

What Is Arbitrary Code Execution in a Video Game?

The term arbitrary code execution comes from computer security. It usually describes a vulnerability where an attacker can make a system run code of their choosing. In retro games, ACE is a similarly powerful concept: players manipulate memory and data so the console starts executing unintended instructions stored in RAM or other memory areas.

For a speedrunner, ACE is like gaining developer-level access mid-run. With a successful ACE setup, it becomes possible to:

• Warp directly to the game’s end credits.
• Change Mario’s stats or items on the fly.
• Write mini-programs using controller inputs as the “code.”

In practice, speedrunners almost always use ACE for one thing: reaching the end as fast as possible. Rather than play through every level, they engineer conditions so the game jumps straight to the ending sequence.

ACE glitches have shown up in other classic titles too, such as The Legend of Zelda: Ocarina of Time, where runners inject data through item manipulation and save-warp behavior to instantly trigger the final boss or credits. Nintendo’s own documentation notes that the NES and SNES hardware left plenty of room for unusual memory interactions because the original developers never anticipated players would probe these systems in such depth.¹

The NES, the PPU, and Why Memory Matters

To understand what makes the new Super Mario Bros glitch possible, it helps to know a little about how the NES works. The console’s architecture is simple by modern standards, but its limitations are exactly what enable these exploits.

Under normal circumstances, the CPU executes code that lives in the cartridge ROM. It reads and writes numbers in RAM to keep track of Mario’s state and the enemies around him. The PPU is a separate chip responsible for drawing pixels on the screen, but it also stores structured data the CPU can read or write.

Most glitches boil down to one thing: the game reading or writing to an address it was never meant to touch. The U.S. National Institute of Standards and Technology notes that out-of-bounds memory access is one of the most common and dangerous classes of software flaws because it can redirect program execution or corrupt data in unpredictable ways.²

When that happens in a 1980s platformer, you don’t get a security breach—you get warp zones, duplicated enemies, or an unexpected trip to the credits.

The Minus World: From Urban Legend to Technical Key

If you’ve spent time around retro gaming, you’ve probably heard of the Minus World: the famous “World -1” glitch in Super Mario Bros. By entering a specific pipe in World 1-2 under unusual conditions, Mario can end up in a looping underwater stage labeled “World -1.”

Nintendo’s own official materials and re-releases acknowledge this glitch as a quirky artifact of how warp zones are implemented in the game.³ But for speedrunners, Minus World has usually been more of a novelty than a tool. It’s fun, it’s bizarre, and it’s utterly useless for going fast—at least, until now.

The new ACE route changes that perception. In this setup, the Minus World isn’t just a random curiosity; it’s a vital environment where the game loads a unique mix of enemies and tiles that make the exploit possible.

Why the Minus World Matters for the New Glitch

The newly explored route relies on having a very specific combination of enemies and objects present at the same time. That combination simply never occurs in normal levels. Minus World, especially in the Famicom Disk System version and under certain conditions, happens to provide the perfect density of enemies and loads them in a way that stresses the game’s memory management.

By reaching Minus World under controlled circumstances, players can set up the exact kind of memory overflow that pushes the program into uncharted territory—and ultimately into ACE.

How Speedrunners Turned a Crash into a Credits Warp

In its raw form, the underlying bug that enables ACE often starts as a crash: the game tries to read enemy data that isn’t where it expects, or it writes enemy IDs too far in memory, causing invalid instructions to be executed. For most players, this is the end of the run. For glitch hunters, it’s the beginning of an opportunity.

The breakthrough came when runners realized they could steer this crash into a stable, reproducible sequence of actions that redirects execution in a predictable way. Instead of crashing to a black screen or lock-up, the game can be guided to:

• Jump into a region of memory tied to the PPU’s graphics data.
• Use the position of an enemy sprite (like a Blooper) as a key value.
• Alter a critical routine that handles power-ups.

That last step is crucial. By subtly corrupting the power-up routine, speedrunners can cause the game to jump to RAM when a mushroom appears from a block, rather than continue with normal behavior. When that happens, whatever numbers are in RAM at those addresses are treated as CPU instructions.

To control those numbers, runners use carefully timed controller inputs. Each button press translates into bits in memory, and with patient, frame-precise inputs, they construct a miniature program that tells the game: “Play the end credits now.” This concept of using input to write payloads echoes techniques found in security research, where attackers manipulate data buffers to inject executable code.²

The Long, Delicate Setup Behind the Glitch

While the high-level idea sounds almost magical, actually performing the glitch in a run is complex and unforgiving. The full route involves a chain of conditions that must be met, each one setting up memory in just the right way for the next event.

Key Steps in the ACE Route (Conceptual Overview)

Exact inputs vary among runners, but conceptually, the route includes:

1. Completing an initial run to adjust how some enemies and stages behave on a second quest or reset.
2. Triggering Minus World under precise circumstances so a specific collection of enemies load simultaneously.
3. Manipulating enemy behavior so their IDs and positions produce an out-of-bounds write into important memory.
4. Causing a controlled crash that redirects execution to data associated with the PPU, where sprite heights and tile values become meaningful numbers.
5. Corrupting the power-up handler so that when a mushroom spawns later, the game jumps to RAM instead of the usual logic.
6. Using controller inputs to write a small “program” into RAM that plays the credits or ending cutscene.
7. Spawning and collecting the modified mushroom, which triggers that program and completes the run.

Because the NES doesn’t wipe every byte of RAM on reset, certain changes persist longer than you might expect. This behavior, a side effect of how the hardware initializes, effectively lets runners prime the console’s memory so their later actions have the desired outcome.

Why This Discovery Is Such a Big Deal

From the outside, a glitch that sends Mario straight to the ending might sound like just another weird trick. Within the speedrunning and retro gaming communities, though, this discovery is monumental for several reasons.

1. It Arrives After 40 Years of Study

Super Mario Bros is one of the most dissected games ever created. ROM hackers, tool-assisted speedrun authors, and competitive runners have analyzed its memory layout, physics, and frame data for decades. The fact that a glitch this powerful remained hidden for so long underscores how deep even “simple” 8-bit games can be.

2. It Gives Runners a True Programmable Toybox

With ACE, the game becomes, in effect, a tiny virtual machine controlled by the player. Theoretically, runners can write code to:

• Teleport Mario to arbitrary coordinates.
• Spawn unusual combinations of enemies and power-ups.
• Create custom demos or visual effects inside the original ROM.

While not all of these ideas are practical for timed runs, they open a creative frontier similar to what other communities have achieved in games like Pokémon Red/Blue, where players have used ACE to draw text, images, and even mini-games inside the original cartridge environment.⁴

3. It Forces a Rethink of Leaderboards and Categories

Speedrunning communities depend on clear, agreed-upon rules. When an ACE glitch effectively lets you jump straight to the credits, questions immediately arise:

• Should this technique be allowed in the main Any% category?
• Does it deserve its own separate category, like Any% ACE or Credits Warp?
• How do you compare older records that didn’t have access to this glitch with new ones that do?

Other speedrunning communities have navigated similar debates. For example, when “wrong warp” glitches were discovered in Ocarina of Time, they led to distinct categories separating runs that use them from more traditional playthroughs. Esports and competitive gaming organizations often apply similar logic, treating major engine-level exploits as grounds for separate formats or bans.⁵

Impact on the Super Mario Bros Speedrunning Scene

The immediate effect of the glitch is a wave of experimentation. Runners and tool-assisted speedrun creators are racing to refine the ACE route, minimize its setup, and search for alternate ways to trigger it that might be more consistent or faster.

We can expect several outcomes:

• New world records in categories that allow ACE, with times that look almost surreal compared with historical records.
• Split leaderboards distinguishing traditional Any% runs from ACE-enabled runs.
• Educational content – detailed breakdown videos, diagrams, and guides explaining the glitch to new runners.

More broadly, this discovery reinforces a core truth of retro gaming: no matter how old a game is, there are still secrets waiting to be uncovered, especially when dedicated communities push the boundaries of what seems possible.

Frequently Asked Questions

Does this glitch work on all versions of Super Mario Bros?

Not necessarily. Different regional releases, revisions, and ports can handle memory differently or include small code changes. The known ACE route depends on precise behavior in specific versions, such as the original Famicom or NES releases. Emulated or modern re-release versions may not behave the same way.

Can this glitch damage my console or cartridge?

No. The glitch manipulates values in volatile memory and uses the game’s own logic in unintended ways, but it does not rewrite the cartridge ROM or firmware. Once the console is powered off, all of the manipulated data is cleared.

Is arbitrary code execution unique to Super Mario Bros?

ACE has been found in several other classic games, including certain Pokémon titles and Ocarina of Time. However, each game’s exploit is unique, based on its engine and memory layout. The Super Mario Bros discovery is notable because of the game’s age and the extent to which it has been examined already.

Will this glitch change how casual players experience the game?

For most players, not really. The setup is too intricate and demanding for casual play. Its impact will primarily be felt in speedrunning, glitch-hunting, and technical analysis circles, though it may spark renewed interest in the game’s hidden mechanics.

How do speedrunners find glitches like this?

Discovering a glitch of this magnitude typically involves a combination of accidental crashes, deliberate stress testing, emulator tools (like memory viewers and frame advance), and deep knowledge of the game’s code. Communities collaborate, share findings, and build on each other’s work over months or years.

What This Says About the Future of Retro Game Exploration

The new Super Mario Bros ACE glitch is more than a novelty—it’s a reminder that systems from the 1980s still have unexplored depth. Emulation, open documentation, and community collaboration have created an environment where hobbyists can perform the kind of reverse engineering and behavioral analysis once limited to professional developers and researchers.

As preservation efforts continue and more official archives of classic hardware and software behavior are released, we can expect even more intricate discoveries. Whether you’re a speedrunner chasing the next world record or a fan who just loves seeing old games pushed to their limits, this glitch marks a historic moment in one of gaming’s most enduring titles.

Forty years on, Mario’s first big adventure has become something new: not just a platformer to be beaten, but a programmable playground where the line between player and developer blurs, one memory address at a time.

Similar Articles

ARC Raiders and the Art of the Extraction Shooter

Arc Raiders: Dust on the Wires Quest Explained

Shift Up Acquires Shinji Mikami’s Unbound Studio

Pragmata, Mega Man, and Capcom’s Perfect April Fools Tease

Building a Better PS1 Mini from Classic Hardware

Arc Raiders Canto SMG Blueprint Guide

Author

Sneha TeteBeauty & Lifestyle Writer

 

Sneha is a relationships and lifestyle writer with a strong foundation in applied linguistics and certified training in relationship coaching. She brings over five years of writing experience to cuisinecraze,  crafting thoughtful, research-driven content that empowers readers to build healthier relationships, boost emotional well-being, and embrace holistic living.

Read full bio of Sneha Tete