GTA SA Duping

###### SUMMARY OF GTA SA DUPING SO FAR (written by blacklev) ######

I. Introduction
Recently, people managed to abuse the replay system of GTA VC in order to do the same mission multiple times, by starting a Rampage in Replay mode while on a mission then failing it, which results in the "on mission" flag getting reset to 0, allowing us to start another instance of the mission while the previous one is still going. This way, you can complete the same mission multiple times at the same time.
Doing the things mentioned above is very useful in VC, but it would be an even strat in SA because of the way the missions are triggered (will write about this later in this pastebin).
Because of the huge potential of this strat in SA, me (blacklev), powdinet and possibly others started to experiment with this glitch. This pastebin is meant to summarize my experiences regarding my testing.
The only footage of legit mission duping that we currently have (by Joshimuz):
http://www.twitch.tv/m/607529

II. The fundamental idea behind duping in SA / why the strat is useful
In San Andreas, every mission branch has their separate "Mission Counter". For example, the variable name for Wuzi's missions is WUZIMU_TOTAL_PASSED_MISSIONS. If you complete a mission, the respective counter is increased by 1. If you dupe a mission once for completing two instances of the same mission, the mission counter gets increased by 2. This means that the game think that you are further in the mission branch than you are supposed to be, allowing you to skip lots of missions.
Now I am going to explain how the game triggers missions. Look at this code triggering "Reuniting the Families":

:LA1FIN_36
if
   Player.Defined($PLAYER_CHAR)
jf @LA1FIN_340
if
  $ONMISSION == 0
jf @LA1FIN_340
if
00FF:   actor $PLAYER_ACTOR sphere 0 in_sphere $X_SWEET_HOUSE $Y_SWEET_HOUSE $Z_SWEET_HOUSE radius 1.0 1.0 2.0 on_foot
jf @LA1FIN_340
if
  $SWEET_TOTAL_PASSED_MISSIONS == 9
jf @LA1FIN_340
if
  $SMOKE_TOTAL_PASSED_MISSIONS == 4
jf @LA1FIN_340
if
  $OG_LOC_TOTAL_PASSED_MISSIONS == 5
jf @LA1FIN_340
if
  $RYDER_TOTAL_PASSED_MISSIONS == 3
jf @LA1FIN_340
if
  $CRASH_LS_TOTAL_PASSED_MISSIONS == 2
jf @LA1FIN_340
if
  $MISSION_LOWRIDER_PASSED == 1
jf @LA1FIN_340
if
   Player.Controllable($PLAYER_CHAR)
jf @LA1FIN_340
if
  $LS_FINAL_TOTAL_PASSED_MISSIONS == 0
jf @LA1FIN_288
$ONMISSION = 1
00BA: show_text_styled GXT 'LA1FIN1' time 1000 style 2  // Reuniting the Families
gosub @SUB_CJ_GOTO_SWEET_HOUSE
start_mission 37  // Reuniting The Families

This means that to trigger this mission, you have to have Sweet's mission counter at 9, Smoke's at 4, etc... The game does not check for anything else regarding previous mission, meaning that you do NOT have to complete any particular mission to trigger this one, you just have to advance the mission counter enough. This is the basic explanation of the importance of mission duping in SA.

III. How can we test the duping glitch... without the glitch itself?
We use memory manipulation. The memory address of the "on mission flag" is 0x00A49FC4, you can manipulate this using Cheat Engine. This way, you can test duping as if the duping glitch existed.
Footage of me using this method:
https://www.youtube.com/watch?v=7Jdm6MFptpk
Footage of powdinet using this method:
http://youtu.be/H6lVwtsUPq4

IV. My overall conclusions regarding duping:
 - It works extremely well
 - It does not seem to make the game unstable
 - Occasional softlocks can happen during the duping process
 - I managed to get out of LS by using duping glitches as expected
 - This strat has incredibly huge potential

V. Already tested parts of the game:
Los Santos "route" by me (blacklev):
http://i.imgur.com/KYHikXw.png
San Fierro "route" by powdinet:
http://puu.sh/b0Tm8/f8cd1c8c17.png

VI. My experience of LS routing in detail:
The first mission and "Ryder" fails upon duping during the missions.
Tagging up Turf can be duped perfectly well, but you must not create more than three instances of it because YOU NEED TO COMPLETE 9s AND AKs to trigger the Big Smoke branch.
VERY IMPORTANT: If a mission/branch is NOT triggered my a phonecall, you HAVE TO complete the mission that would normally trigger it since otherwise you can NOT access that mission/branch. If a mission IS triggered by a phonecall, you do NOT have to complete the mission that would trigger it normally, since you get the phonecall if you advance the mission counter at least to/above the required number.
Drive-by can be duped, Burning Desire can be duped. See my "route" for more information.
I managed to get out of LS without any problems using these methods.
In conclusion, it works "as intended". However, everything I have written so far has no use whatsoever without the duping glitch being found.

VII. Finding the duping glitch
In SA, Replays have no effect whatsoever on the "on mission flag". Because of this and the lack of Rampages, VC methods are not applicable.

I see two fundamental ways of duping in SA:
Way #1:
Starting the mission normally, so the flag is set to 1 (meaning "on a mission"). Then, we have to remove the flag somehow. This strat is used in VC with the rampage replay glitch. With the lack of any kind of replay glitch in SA, I see very little use of testing this method.
How way #1 can be tested: Start a mission normally, find *anything* that can be triggered while on a mission that would set the mission flag beck to 0 after it ends, such as Rampages in VC. Questionable.
What does NOT work:
 - starting/failing a mission during a replay does not do anything
 - starting/failing Vigilante/taxi/whatever has no effect either

Way #2:
Starting the mission without setting the mission flag to 1. This has been seen in Josh's VOD.
How way #2 can be tested: Try to replicate Josh's footage somehow.
What does NOT work:
 - Standing in a mission marker while an other mission ends does nothing (I even tried pause buffer strats as well)
 - The "start a mission just as the garage door closes" strat does not seem to work.

VIII. Credits:
Powdinet for the footage and testing
Lighnat0r for the memory address for the "on mission flag"
Gael_ (iirc) for the "gta sa main original custom variable names.txt"
#gta for the glitches in VC