SNES Code Injection -- Flappy Bird in SMW
Why Hacker News recommends it
Constantly cited as the canonical example of arbitrary code execution through gameplay and of deep system knowledge among speedrunners.
What it is
SethBling uses Super Mario World glitches to inject and run Flappy Bird code on an unmodified SNES, entering it purely with controller inputs. It was the first time a human completed this kind of exploit by hand.
Recommended by 9 HN commenters across 9 different months, 2016 to 2025.
What Hacker News said
Strong rec qwertox · 2020-11 · on “Flappy Bird in 228 bytes”
This reminds me of the incredible Flappy Birds SNES Code Injection into Super Mario World. A must-see video. [this video]
Recommends TheLilHipster · 2016-06 · on “Crash Course – Educational course videos on YouTube”
Youtube is full of hidden gems, all a matter of taste. Meta-programming: [LINK] Math'n'music edutainment: [LINK] Science edutainment: [LINK] Feats of incredible gaming skill: [LINK] Tidbits of hacking ingenuity: [this video] Looking for heart in pop culture: [LINK] You can get lost in the maze of excess information. It's great - i think...
Recommends tribby · 2018-09 · on “'Super Mario Bros.' speedrunner hits nearly inhuman 4:55 world record”
super impressive stuff. I'm generally unfamiliar with speedrunning, but I am familiar with the billy mitchell controversies, so I'm surprised that people accept the legitimacy of streamed runs. wouldn't it be trivial-enough to fake? tangental: my personal favorite mario-related feat is sethbling injecting flappy bird into super mario world manually: [this video]
Recommends kibwen · 2020-09 · on “Super Mario Bros. 3 in 3 Minutes – World Record Speedrun Explained [video]”
I don't know about the run shown in the OP, but there are a fair number of memory-manipulation/ACE speedruns that are feasible in RTA ("real-time attack", a.k.a. something a human could pull off, as distinct from TAS). Off the top of my head I can think of such routes for Pokemon Red/Blue, Ocarina of Time, and Super Mario World. To answer your question of "how likely is one to pull this off" for those three, the Pokemon one requires no almost advanced execution, other than turning off the console at a precise point to corrupt the save data you otherwise just need to follow a simple (though long) series of steps. The Mario one requires some pixel-perfect precision, and runners often used hack
Recommends argvargc · 2021-04 · on “Hacker Exploits Bugs in Original ‘Doom’ Code to Run ‘Snake’ Inside the Game”
This one creates a Flappy Bird clone by hand from within SMW, using the controller under ordinary manual control, on an original, unmodded SNES (with a couple or other standard controllers attached with buttons taped down). Explains the process in detail, which includes creating a kind of crude "IDE" using the score table as feedback for hex values input to make the process faster and less error-prone: [this video]
Recommends SkeuomorphicBee · 2022-07 · on “Arbitrary Code Execution in Super Mario All-Stars [video]”
Just to add some context, arbitrary code execution in Super Mario World is nothing new, it has been known since 2014. There was a tool assisted demonstration at Awesome Games Done Quick 2014 [1] where they inject a pong and a snake game using a TASBot (a robot controller that replays input scripts to the console). And in 2016 a streamer performed it manually to inject a flappy birds game [2] (this second video is really good, he goes into detail of the process). So, what this newer demonstration brings is the use of the known arbitrary code execution capabilities of "Super Mario World" to help finish all 5 games in "Super Mario All-Stars + Super Mario World" as quick as possible. [1] [LINK]
Recommends Dwedit · 2024-05 · on “Hackers discover how to reprogram NES Tetris from within the game”
Sometimes even after you've come up with the exploit, you can create something really beautiful for the console to run afterwards. Pokemon Yellow: [LINK] Super Mario World: [this video]
Recommends tbalsam · 2025-03 · on “Speedrunners are vulnerability researchers, they just don't know it yet”
I'm a speedrunner, and I'm pretty sure this is well known -- and accepted as standard in some categories! It's a pretty well accepted standard (to the point of the headline being almost a mild offense!). In the gaming world, undefined software behavior is critical to this sort of thing, we see this especially in some games like the legendary exploits found in the Ocarina of Time speedruns for example. I mean, in Super Mario World, SethBling did code injection to manually run a version of Flappy Bird (how ironic given the origin of the pipes!) in the game. By hand. No savestates. It took forever and the run through is really and truly fascinating: [this video] I speedrun things other than games as