Room Duplication: The Deku Stick Upgrade Crash

While room duplication is a trick that has been known for ages, there are many mysteries to this glitch that haven't been looked into. Today I looked into one of those mysteries...

MikeKatz45: oh yeah I randomly remembered something in case someone is curious enough to investigate
MikeKatz45: so for some reason
MikeKatz45: the dupe to get the 30 deku stick upgrade in lost woods crashes if you enter lost woods from goron city or zora's river (white transition)
MikeKatz45: and it doesnt with black transition (sacred forest or kokiri forest)

Taking it all in, my first thought was that Mike had to be wrong about the crash being dependent on the transition animation, since only the only transition known to crash is the "sandstorm" transition since it relies on non-global assets. Rather, the fact that the crash seemed to occur due or not depending on where you spawn suggested that the crash depended on where the room file is allocated during duplication.

So how are room files allocated?

First the game starts by finding the minimum space needed to store either the largest room file, or the largest two room files connected by a room transition actor and reserves that on the game heap. Then, the first room you spawn into in a scene will be allocated at the start of the reserved block. When you move into the next room, that next room file will be allocated at the end address of the space, minus the size of the file.

In this case, Spectrum revealed that the NTSC 1.0 Lost Woods allocates 0xD020 bytes for room files, and the room being duplicated is 0x6FF0 bytes. This means the room file will be allocated at either offset 0x0000 or offset 0x6030 from the start of the space reserved for rooms... an 0x0FC0 byte overlap. This means that when the room is duplicated, either the first or last 0xFC0 bytes will be overwritten by the copy of the room loaded. The first 0xFC0 bytes is far more critical, as it contains the room header and the start of the display lists for the room itself (likely the ultimate crash cause), whereas the last 0xFC0 is relatively unknown but is presumed to contain texture data.

So in order to crash the game, we need to load room 5 into offset 0x6030 and duplicate the room. To simplify things, we can think of the "head" allocated room as being slot 0, and the "tail" allocated room as being slot 1. Furthermore, since Kokiri Forest does not form a loop, the only way to manipulate what "slot" a room loads into is by changing the spawn used.

If you spawn on the bridge between Kokiri Forest and Hyrule Field... well you're already in the room being duplicated, thus the game won't crash.

If you spawn at the "normal" entrance to the Lost Woods from Kokiri Forest (0), you pass through the rooms in this order:

• Saria's Song Skull Kid (1)
• Bridge Room (0, no crash)

If you spawn at the shortcut to Goron City, you pass through the rooms in this order:

• Bullet Bag Upgrade, Ocarina Minigame Room (1)
• "Normal" entrance to the Lost Woods (0, thus no crash)

If you spawn at the shortcut to Zora River:

• Goron City shortcut (1, thus crashes)

If you spawn outside the Forest Stage grotto:

• Four-way branching room (1)
• Zora River shortcut (0, thus crashes)

If you spawn from Sacred Forest Meadow or outside the grotto under the boulder:

• Room with boulder and bushes (1)
• Four-way branching room (0, thus no crash)