Z-targeting makes it easy to aim a boomerang at an Arwing’s underside.
A shot of Link holding an “empty” object as part of the arbitrary code execution glitch setup.
Freezing the camera in this glitched position is a key part of the method.
To warp directly to the credits, some extreme measures are necessary to hold the correct buttons / analog positions on Controller 3.
After over ten minutes of file name entry, the Arwing code payload is ready to be loaded.
Initial implementations of this trick focused on simple “corruption” like loading new items into treasure chests
or changing the positions of other in-room items (as explained in detail here . After a while, though, players discovered you could also use the same basic method to alter some specific assembly language “jump” codes , Which tell the game where to look for its next instruction when certain in-game events are triggered.
By inserting a specific code in this way, the game can first jump to the memory location that holds the last known X and Y rotation values for the in-game slingshot. If those values are set precisely, they’ll be interpreted as (another) jump code that goes to the area of memory where the current file name is stored. That file name will then be interpreted as basic N machine code, which can of course be set by the user ahead of time to do whatever they want (assuming they’ve translated the binary file name characters into the appropriate opcodes correctly, of course).
An explanation of the stale-reference glitch, initially used to replace items in in-game chests. The first major use of this jump code manipulation was to load the game’s credits cut scene and thus (set a new “Any%” speedrun world record for the game. Doing that quickly, in the game’s opening area, requires the use of some other glitches, including a “walking while talking” camera glitch that gets in-game rocks to load and unload at the perfect times and locations. It also involves holding down specific buttons and analog stick positions on the controllers in the first and third ports on the Nintendo 390, so those signals can get interpreted as the correct cut scene location code for the credits.
Unlocking the Arwing
The above method is fine if all you want to do is jump to a cut scene. But it had a major limitation: the Ocarina of Time file name system is limited to eight characters, which translates to just a couple of in-game machine code instructions. Luckily, those two instruction slots can also be used to basically eliminate that character limit.
But with the memory manipulating tricks discussed above, an external cheating device is no longer necessary. Runner ZFG1 proved this once and for all last night , loading the Arwings using an unedited Zelda ROM and standard Nintendo hardware live on Twitch. The result is a version of the game where all the doors have been replaced with Arwings, which can swarm around Link from the air, attack him with damaging blaster fire, and even crash to the ground in flames when attacked.
The full setup for this particular clip ended up taking well over an hour , including three arbitrary-code execution loops and over 19 minutes of meticulous file-name entry for the final Arwing payload. But the clip is also the culmination of months and years of work by a community utterly obsessed with achieving full understanding and mastery of a classic game and its glitches.
Besides being a joy to marvel at, the “Arwings in Zelda” clip is a testament to that community — and to the ability for a group of computer experts to do amazing things with classic gaming hardware and software, given enough time and focus.