Runners planted code via Ocarina of Time, then hot-swapped cartridges to crack Paper Mario

In January 2021, Paper Mario speedrunner Morpheus stumbled on a mysterious game crash mid-livestream. The community traced it to the 'effects matrix,' a data structure storing details of visual effects like hammer-smoke: via a menu glitch that permanently stores normally temporary effects, a player can overflow the matrix into unrelated memory, which the console executes as garbage machine code.

Turning that crash into useful code meant positioning Mario so precisely that his 3D coordinates would land at exact offsets in the matrix — brutal, because gravity constrains his vertical position. By mid-February, runner Fray had done the positional math and demonstrated code execution with emulation tools; days later, Rain posted a complete tool-assisted speedrun that warped to the credits faster than any previous glitch run. But the positioning was beyond human capability — and that's where Ocarina of Time entered.

Streamer JCog explained the hinge: the overflow happens to jump execution near player flags and an idle timer. 'If we let that idle timer reach anywhere from 0x810 to 0x81f, which is 69 seconds, before releasing the stored effects, then execution jumps to expansion pak memory, which Paper Mario doesn't use.' The trick: use an existing Ocarina of Time ACE method — the same family as the famous Arwing-insertion glitch, repeated twice with carefully constructed file names — to load a chosen assembly instruction into that expansion-pak memory first.

The final ingredient is a hardware quirk: early N64s keep expansion-pak RAM alive for a few seconds after power-off — the same idiosyncrasy behind Rare's abandoned 'Stop n' Swop' cross-cartridge unlock system. Play Ocarina, plant the instruction, power down, hot-swap to Paper Mario, and its overflow jumps into memory that now contains your code. Neither game officially uses the expansion pak; together they turned it into an execution channel.

It composes three independent flaws — an effects-matrix overflow, a second game's ACE write, and post-power-off RAM persistence — into a cross-cartridge attack nobody designed against.

The idle-timer trick converts a humanly impossible precision requirement into a wait timer, making the exploit conceptually performable on real hardware.

It resurrects Stop n' Swop — a cancelled 1990s feature — as an offensive primitive, two decades later.

Discovery was community-sequential: one runner's accidental crash, another's math, a third's TAS, and a streamer's memory-map explanation.

Attack surfaces compose: a bug in one game, a write primitive in another, and an uncleaned hardware state between them can add up to arbitrary code execution no single component exposes alone.

Rain's tool-assisted run warped Paper Mario straight to the credits faster than the fastest human-viable glitch routes. The Ars Technica write-up framed the method as record-setting for TAS; a real-time human execution remains out of reach due to the positional precision required.