DK64 ACE idea #1

DK64 ACE idea #1

Disclaimer: Not actively looking for ACE, but I had this idea come into my mind that I had to test. I know ACE has a bit of a negative aura around it.

So, a bug came up in the dev version of the practice ROM. I was attempting to assign model indexes past the normal intended boundaries to an actor. The actor spawned fine, but upon reloading the area, I noticed that the game was attempting to run some code at 0x6Byyyyyy. Something had to be going wrong here. Turns out, it was trying to run the actor code for actor 0xCACCC000 which pointed outside the bounds of the regular actor function pointer table (Starts at 0x8074C0A0, has about 343 entries).

This got me thinking that perhaps, if we can spawn an actor with a very specific index, we can let it run a function which is stated outside of the table's bounds as the game clearly doesn't check.

There are a few ways to spawn a custom actor, most notably is by using null pointer grab to bring an object with an ID determined by free memory.

Unfortunately, our desired code doesn't run. Mostly because it tries to assign a drawing code to the new object by looking up a shortlist of acceptable actors. Our custom actor index isn't part of this shortlist and so doesn't get assigned drawing code. When it then tries to run the drawing code, the game finds out there is none, so crashes. This takes place earlier in the frame than where it runs actor-specific code.

I've tried a couple other ways of spawning the actor. Unfortunately all crash before they reach our desired code.

Actor ID: 0x24A1
Function pointer location: 0x80755324