to be assigned so let's just call this the next event id this counter is incremented every time an event is queued this way there's no fear that a given id will accidentally refer to multiple events if the game wants to queue up an event it first finds where in the queue it can place it it takes next event id and adds it to the id table and increments next event id then the game determines where in memory it can store the new event and stores an index in the index table that corresponds with this memory location event indices represent what position in memory an event is located at to find where the event is stored you first take the index and multiply by NUMBER_TOKENbNUMBER_TOKEN which is the size of one event it then adds this result with the start of the event memory region the result is the location of the desired event the game will then read the event information to determine if it should run and what script code it should execute so let's simulate what solidified gaming did by cueing a door pause hammering filling up the event queue and then unpausing when we unpause and the door event generates two additional events the ids for the additional events are actually written into the first two slots of the index table the id table and the index table are right next to each other in memory so when event ids are written past the end of the id table they are instead written to the start of the index table now that the door event ran in the first slot of the queue the game will now try to run the second event in the queue when the game does so it will associate the second id in the id table with the second index in the index table which is now an incredibly high value compared to what the normal indices are the game will take this really large number multiply by NUMBER_TOKENbNUMBER_TOKEN and add it to the start of the event memory region as a result it will start reading memory located way past the normal event memory region the game is now reading data from other data structures as if it's event data for example it's possible that the game starts reading event data from mario's data structure and interprets mario's coordinates as the event flags opcode or next command pointer now that we know that it's possible for the game to read event data from unintended memory locations the question is well what exactly can we do with that knowledge through reverse engineering we know that to change to a different map the game calls the map change function and specifies the desired room to load one such map is the credit sequence if we can cause the game to read event data that is interpreted as a map change function call to the credit sequence then we would be able to work to the credits with all of that out of the way let's talk about the actual route that we began looking into
NO_SEGMENT_TOKEN