This video is another part of the series where I abuse various jump tables to trigger ACE. As usual, this doesn't save time in a speedrun and requires prior ACE to make the setup possible.
Fire cards: Sprites with an ID 8 or greater are collected as cards when colliding with the player. The kicked blue blocks have an ID of 0x0B, but the usual code for that sprite doesn't have player collision, so it cannot be picked up. However, when battle mode is paused, all sprite slots, even inactive ones, set their "Halt Timers" to FF every frame. Regardless of what type of sprite it is, if the halt timer is non-zero, it runs a very specific function, which also checks for collision against the player. I assume this is to make sure the player can be killed even if they pause the game on the frame they collide with an enemy. In any case, it allows the player to collide with the kicked blue block, and collect it as a card.
Sprite 0x1C is obviously never supposed to spawn under normal conditions, but by giving Luigi Card 0x15, we can force sprite 1C to spawn in, which reads the jump table for sprite behavior out of bounds and jumps execution to $1720 (simplified as $720 in the video due to RAM Mirroring). In the past I've used the RNG bytes to jump elsewhere, though I've decided it's much easier to just branch around them and use $7AD, the point bubble X positions, to write a payload instead.
A complete list of where sprites jump execution to based on ID can be found here: pastebin.com/DmT04GGi
Mushrooms, OAM, and the pipe glitch? The pipe glitch crosses over OAM from $200 to $24F (and due to odd behavior with player collision at vertical level screen boundaries, for a single frame Mario can collide with $250 - $25F) But most importantly, Mario will cross over $24D, which will hold a value corresponding with the appropriate "pattern" for a specific object. In the event that a mushroom is in that space, the pattern in question is the bottom half of a mushroom, with a value of $51 (the bottom half of a mushroom). If 51 is read as tile data, it's a pipe corner. In short, I collect the mushroom and then have the Koopa overwrite the mushroom's pattern data to prevent a pipe corner from appearing.
The Bizhawk movie file can be found here: drive.google.com/file/d/1L7wP...
Alternate title: Beating up your little brother to trigger arbitrary code execution.