How we put the Triforce in Ocarina of Time (Use-After-Free explained)
Channel: dwangoAC, keeper of TASBot
Date: 14/10/2022

Yes, we put the Triforce into OoT using nothing but button presses via Use-After-Free exploitation. :) Here's a technical video on how we did it. Questions? Join https://discord.gg/tasbot

Triforce% OoT ACE Showcase was presented by Sauraen, Savestate, and dwangoAC with the help of TASBot under the title Ocarina of Time Beta Showcase during the SGDQ 2022 TAS block after helping raise more than $228k for Doctors Without Borders. Triforce% was performed using an original, unmodified US 1.0 release cartridge of The Legend of Zelda: Ocarina of Time on a real, original N64 (the Nintendo 64 had a passive RGB mod for a clean video signal that did not affect gameplay in any way). Everything in this run was done live in front of an audience using only button presses on controllers, ultimately achieving ACE (Arbitrary Code Execution) using Stale Reference Manipulation (SRM, the OoT community name for this Use-After-Free exploit).

In this video from Games Done Quick's Hotfix show That's Never Happened Before hosted by Kungfufruitcup, we break down each step of taking over the console starting with the human efforts of Savestate as demonstrated with the fantastic animations created by Retro Game Mechanics Explained (used here with permission). We do a deep dive into what use after free vulnerabilities are and thoroughly demonstrate how we exploited one to gain an initial Arbitrary Code Execution foothold. We then walk through how four successive bootloaders plus a hyperspeed loader combine to allow injecting data directly into the expansion memory pak all while allowing the game to behave normally.

The official Triforce% site can be found at: https://GetTriforce.Link

Partner Creators:
Retro Game Mechanics Explained  - Finally Obtaining the Triforce in Ocarina of Time: Triforce Percent Explained: https://youtu.be/qBK1sq1BQ2Q 
SwankyBox - How Players Finally Obtained the Triforce 23 Years Later in Ocarina of Time (Zelda): https://youtu.be/1_RighmL04g
Hard4Games  - Triforce%: https://youtu.be/f9cCtRYMKm4

Partner Reactors:
HMK - Zelda: Ocarina of Time Beta Showcase | FULL REACTION!: https://youtu.be/mk1WwOu_AQQ
TetraBitGaming - Crazy Ocarina of Time Unused Content Showcase! (Legend of Zelda OoT Triforce% Reaction): https://youtu.be/gJ1hSMClhMI

OST Published By SiIvaGunner:
YouTube - Trailer (Beta Mix) - The Legend of Zelda: Ocarina of Time: https://www.youtube.com/watch?v=E1OYYi2Vzro&list=PLL0CQjrcN8D3qRiR5WUL5l_bPo2sIzdfr&index=155
Soundcloud - https://soundcloud.com/sauraen/sets/triforce-percent
Wiki page - https://siivagunner.fandom.com/wiki/Triforce%25_SGDQ_Run
Joke explanations - https://gettriforce.link/siiva_jokes

Thank you to Summer Games Done Quick 2022 for helping us showcase this wonderful TAS as presented by SaveState, Sauraen, and dwangoAC Here Together with the help of TASBot!

TASBot / dwangoAC:
Discord - http://Discord.TAS.Bot 
Twitch - https://Twitch.tv/dwangoAC 
Twitter - https://Twitter.com/MrTASBot 
Patreon - https://Patreon.com/dwangoAC 
Web - https://TAS.Bot 

Intro / outro Music by: JohnGabrielUK
Video Editor: Boone Cavender
Intro screen text and video mentoring: AngelWind
T-shirt graphic used in title designed by: Drew Wise for https://TheYetee.com

00:00 - Intro
00:22 - Start of the run
02:28 - Arbitrary Code Execution
03:47 - Does the cartridge has to be a specific version?
05:02 - Humans and TASBot joining forces
08:00 - A tale of two clocks
09:26 - What does TASBot actually do?
11:20 - How was Triforce% made?
12:02 - Retro Game Mechanics Explained
12:42 - How does an N64 controller work?
13:22 - Executing code by pressing buttons
15:00 - Steps for setting up ACE
15:56 - Stale Reference Manipulation/Use-After-Free Exploit
16:32 - We need to talk a little bit about the heap
19:29 - Overlays in the actor heap
23:39 - Actors referencing other actors and stale references
25:04 - The boomerang explained
27:23 - The human part
31:10 - Loading the wonder item
32:35 - Jumping to the correct memory address
37:24 - The robot part
39:53 - Question Time!
40:31 - Do you need the expansion pack?
42:22 - Are some instructions impossible to input on controller?
42:43 - Data input restrictions
46:39 - Bootstrapper #1
47:59 - Bootstrapper #2
48:59 - Bootstrapper #3
49:50 - Bootstrapper #4
50:49 - Hyperspeed Loader
52:03 - Packet types
53:38 - Sending data the other way
55:25 - Framerate clarifications
56:45 - Here together! (Credits)

All Games Done Quick content is used with permission.
All TASVideos.org content used with permission under Creative Commons Attribution 2.0 (https://creativecommons.org/licenses/by/2.0/)

#triforcepercent #heretogether #tas #sgdq #tasbot