Earlier this year, we revealed the story of a skilled NES Tetris player who achieved the game’s “kill screen” for the first time, resulting in a crash after an impressive 40-minute, 1,511-line performance. Now, some players are leveraging this kill screen and utilizing complex memory manipulation to program new behaviors into versions of Tetris on unmodified hardware and cartridges.
We have previously discussed similar glitches involving “arbitrary code execution” in games like Super Mario World, Paper Mario, and The Legend of Zelda: Ocarina of Time. The method for introducing outside code into NES Tetris has been a topic of interest since at least 2021, as players dug into the game’s decompiled code. A prominent member of the community, HydrantDude, has also indicated a privately known method for taking full control of Tetris’ RAM.
A recent video from Displaced Gamers has brought this idea from theory to practice, providing a detailed explanation of how NES Tetris can be manipulated to read the game’s high-score tables as machine code instructions.
The takeover of a NES Tetris copy is made possible primarily due to the specific crash mechanism of the game. Without delving too deeply into the technical details, the crash occurs when the score handler takes too long to calculate a new score between frames, typically after level 155. This delay interrupts a portion of the control code and causes it to jump to an unintended part of the game’s RAM, triggering the crash.
One unique aspect of the Japanese Famicom is that it featured two hardwired controllers, with the ability to connect third-party controllers through an expansion port. Tetris reads inputs from this additional controller port, providing a means for players to control where the game code goes after the crash is triggered.
By manipulating the controller inputs, players can direct the game to read the high-score table as machine code instructions, allowing for further manipulation of the game’s behavior. However, due to the limited symbols available in the high-score table, only a small portion of the NES’s opcode instructions can be encoded in this manner.
