Wrong Warp Explained

Explaining how Wrong Warping works in full is incredibly difficult, as there are an absurd number of aspects of the game engine and quirks that come into play that determine how any wrong warp plays out, from basic spawning mechanics to map loadouts, dangling pointers and memory allocation patterns, to cutscene data structures and corrupted frame buffers, and in a bizarre case a spawn into the Shooting Gallery map that causes the map exit to change depending on whether you've spawned in a pre-rendered room or not... somehow.

Entering the Game

It begins with the entrance table. The table is a sizable list of 1556 records that defines, among other things, what scene to load and what position to place Link at. One logical entrance to an area (the main entrance to a temple for example) will actually have at least 4 records on the entrance index table, one for every combination of day/night, child/adult. If a scene also has a number of cutscenes that play when the scene loads, then there will be an extra entrance record for each cutscene after the first 4 for the first logical entrance to the scene.

Now there are two ways the developers reference a record within the table, of which both are indirect references. They will either set just a Base Entrance Index (or Base Index for short) value to the entrance table (which is the index of the first record for a logical entrance), or they will set a Base Index paired with a Cutscene Entrance Offset (also known as cutscene offset or cutscene number; causes the game to load and play a certain type of cutscene). The base index becomes important later, as this is the value used for things like resetting when falling out of bounds, and is the value stored by Farore’s Wind.

When just the base index is set, the final entrance record will be determined by the time of day, and Link’s Age.

For example, if you walk from Hyrule field into the Market, the base index passed in will almost always be 0x0033 (the child version of the Market entrance) regardless of age or time. Then, +2 is added if Link is an adult, and +1 is added if it’s night, giving us 4 different entrance records to one base.

If both base index and cutscene offset are set, then a constant +4 is added to the base to skip over the normal entrance records, and the cutscene number stored in the cutscene offset is added on.

For example, when the game plays the title cutscene, the base index is set to 0x00CD and plays cutscene 3. CD + 4 + 3 gives us index 0x00D4.

With the final index calculated, the game pulls the appropriate entrance record containing our scene and a position number (which is later translated into coordinates), and starts to load the scene.

This second method of retrieving an entrance record, the passing in of a cutscene number to play, is the method that we can exploit to achieve the wrong warping effect. It is done by performing some trick to change the next entrance index after the proper value has been set, allowing the entrance index and cutscene offset pair to take us somewhere completely unintended.

Loading the Scene

Now there exists two types of scenes: scenes which contain command 0x18 in their header, and scenes which don’t. The 0x18 command defines the alternate scene setup list. Alternate scene setups exist to create different variations of an area. For example, Kakariko has 4 scene setups for child day, night, and adult day, night. Scene setups are also used for setting up an area for a cutscene. Every scene with a cutscene only entrance on the entrance index table also has the 0x18 command. The only two areas that do not have any cutscene entrances but still have the 0x18 command are Zora River and Lots ‘O Pots.

The alternate scene setup list is accessed in almost the same way as the entrance table is. The first four scene setups (0-3) for a scene are always gameplay related setups (used for day/night child/adult combinations by default), while scene setup 4 and on are reserved for cutscenes, where setup 4 is for cutscene 0, 5 for cutscene 1, and so on. Cutscene setups are different from normal setups in that they have their own command that sets the Cutscene Pointer (a value intended to point to the start of a cutscene in memory), to point to the cutscene that will play once the setup is loaded.

The existence of the 0x18 command is an important factor for determining if a wrong warp will crash.

When it exists in the scene being wrong warped to, the game will try to load an alternate setup for one of the cutscenes, leading to two possible scenarios:

• If no alternate setup exists for the given cutscene number, the wrong warp will cause the game to access data outside the list of alternate scene setups, resulting in a crash.
• If the setup does exist, then the cutscene setup will be loaded, which in turn will update what is known as the Cutscene Pointer, allowing the cutscene to play it more or less normally.

When the 0x18 command doesn’t exist, the game will load the only setup it has (setup 0). However, as with every successful wrong warp, the game will attempt to play a cutscene afterwards. Since all setup 0s lack the proper command to update the cutscene pointer, the cutscene pointer will remain pointed at the memory where the last cutscene was located. Sometimes this ends up actually being the previous cutscene, still sitting there in memory while other times it could be data for something else completely. Either way, both situations can either end in a softlock, a crash, or if you’re lucky, simply fail to play any cutscene and resume normally.

The Warp Results By Scene page contains a list of all scenes that have or don't have the 0x18 command, along with what cutscene (if any) will be played when wrong warping to those that have it.

Loading the Map

Once the game determines the proper scene setup to load, and it hasn't already crashed, it then determines which map and position in that scene to load. Normally the position number stored in the entrance record determines which map and coordinates to place Link at. However, when returning to a Farore’s Wind point, the map number and position are determined by the values captured by Farore’s Wind instead.

Putting It All Together

To put everything together, let’s step into the Deku Tree blue warp without any tricks.

• Walking into the blue warp locks Link in place, and starts a count up timer driven by the blue warp itself.
• The count-up timer hits a certain value, causing the blue warp to set the variable that stores the “next entrance” to the base entrance index value for the next intended start point (0x00EE in this case), and the variable that stores the “next cutscene number” to the the next cutscene (0xFFF1 for cutscene 1 in this instance).
• The final entrance index is thus calculated to be 0x00EE + 4 + 1 or 0x00F3.
• The entrance record at index 0x00F3 tells the game to load scene 85 and to place Link at position 0.
• Scene 85 is Kokiri Forest, which exists within a commercial release rom. Thus the file for Kokiri Forest is loaded into memory.
• Kokiri Forest has the 0x18 command, so the game chooses to load scene setup 5 from the alternate setups list for cutscene 1.
• Setup 5 exists, and contains the command that updates the cutscene pointer. It then looks into scene setup 5 for the definition of position 0.
• Position 0 places you on map 1 in front of the Deku Tree.
• The game copies the “next entrance” over to the “current last entrance” variable. This variable is used for reloading the scene when falling out of bounds, or for setting Farore’s Wind return point properly.
• The game copies the “next cutscene number” over to the “current cutscene number” variable. This is what causes the game to attempt to play a cutscene.
• The game looks into the data pointed to by the Cutscene Pointer. It’s a valid cutscene, so everything plays normally.

Now that you have more or less a general idea as to how the game loads an area and places Link normally, let’s introduce the first type of wrong warp: Ganondoor.

Ganondoor

With Ganondoor, you perform the Ocarina Items glitch as a means to be able to maintain control of Link once you step on blue warp. Then if you open the door on the right frame, you will overwrite the “next entrance” variable with the base value of the entrance back into the Deku Tree (0x0252) rather than the value set by the blue warp, but with the “next cutscene number” set to 0xFFF1 (cutscene 1). This causes you to end up at 0x0257, which loads the Inside of the Tower Collapse scene.

The Inside the Tower Collapse scene does not have the 0x18 header command, so it instead attempts to play whatever is being pointed to by the cutscene pointer. Depending on what’s there, you can end up not playing any cutscene, get stuck in an “infinitely long” cutscene, play the previous cutscene, or crash the game.

Temporary Flags

There is another factor that comes into play: Temporary Flags. These are temporary states that are used to keep track of anything that isn't permanently saved. There are two different types of temporary flags: temporary switch flags which store the states of things like blue switches and Temple of Time blocks, and temporary collectible flags that store trivial stuff like what pots have been broken.

Temporary flags are located in the same spot in memory for all scenes, and can keep their values between scenes. The flags appear to be reset based on which exit was used to leave a scene. Because of this, we can set a temporary flag in one area, then wrong warp to transfer the state of the temporary flag, which may be mapped to something else.

For example, moving from a main dungeon scene into the boss room and back in the Deku Tree will not reset the temporary flags, but exiting back to Kokiri Forest via the main exit or the blue warp will. This has an effect with Ganondoor: Any temporary flags set in the Deku Tree are preserved because you are leaving the boss room scene via a door back to the main temple. Because of this, knocking down the ladder in the Slingshot room in the standard quest will cause one of the gates on the outside of the tower collapse to already be set down.

Death Wrong Warping

The next type of wrong warping is Death Wrong Warping. This type is very similar to Ganondoor, except instead of opening a door to overwrite the “next entrance” variable, you die on a particular frame, then choose to continue. Death Wrong Warping relies on the blue warp count-up timer ticking up after continue is selected. This wrong warp will always set the “next entrance” value to the base entrance index of the main entrance of the dungeon. Lastly, temporary flags will be preserved.

Farore’s Wind Wrong Warping

When wrong warping via Farore’s Wind, the process changes a bit. When you set a Farore’s Wind restore point, you record the base index value for the last entrance you used, your coordinates and direction, the internal number of the map you’re in, and lastly the state at which the temporary flags for the room were set at when first entering the room. When you choose to return back to your return point with a Farore’s Wind wrong warp, you restore all of these values.

Depending on what room you set Farore’s Wind in, the game can crash when Farore’s Wind wrong warping if the scene you’re warping to has fewer maps than the the map number Farore’s Wind is attempting to restore. For example, since the Fire Temple has 27 maps, while the Forest has only 23, there exists 6 rooms in the Fire Temple that you can’t set a warp point at and not crash the game with a Farore’s Wind Wrong Warp.

Lastly, a Farore’s Wind wrong warp can also fail if the stored coordinates do not place you in-bounds, and you fall. However, if you end up in a dungeon and no cutscene is playing, saving before you fall oobs will allow you to end up back at the start of that dungeon.

Out of Bounds / Reverse Wrong Warping

As you should know, when you normally touch an entrance to a scene, a base index value to the appropriate entrance record is stored in the “next entrance” variable, and then that value is copied over to the “current last entrance” variable. If you fall out of bounds after any type of wrong warp, but before leaving the current scene, then the game will load a scene based only on the “current last entrance” variable, or the entrance you were suppose to go to when you wrong warped.

Falling out of bounds acts much like returning from a Farore’s Wind point. The game loads the scene based on “current last entrance” variable, but the map and coordinates are set based on the last door (if any) that was used, and the temporary flags are preserved.

Title Screen / Death Hole Wrong Warping

Title Screen wrong warping (also sometimes called “Beta Quest”) and Death Hole Wrong Warping are a different form of wrong warping altogether. There exists a byte which stores what mode the game is in, and has three known states:

• 00 - Normal Gameplay
• 01 - Attract Mode (Title Screen, Demo cutscenes)
• 02 - File Select

This form of wrong warp occurs when the game mode is set to Attract Mode.