Beating Illusion of Gaia in 17 Minutes

- Video Games, Security

Latest revision:

Illusion of Gaia logo

I crafted a tool-assisted speedrun (TAS) of the Super NES action-adventure game Illusion of Gaia (also known as Illusion of Time in Europe) which beats the game as fast as possible on the American version.

The final time is 16:48 when using TAS timing (from initial power on to the last input) and 16:27 when using RTA timing (from selecting Start Journey up to the last boss receiving the last hit). For reference, as of this writing, the current human world record is 1:18:09 when using RTA timing, performed by solarcell007.

The general strategy I used is to duplicate 50 Red Jewels without leaving the first town through save data corruption in order to warp to the last boss of the game and defeat it.

The TAS can be downloaded here and can be played back on emulator lsnes rr2-β23 with SGB Core. It was also accepted and published on TASVideos, which includes a YouTube video encode for those who just want to watch the end result.

Below is a full technical explanation of the TAS, along with acknowledgments.

Version

The American version of the game is used instead of the Japanese version, as even though the latter has a shorter wait time before being able to advance to the file select screen, the former has instant text boxes which saves a lot more time overall.

As for the European versions, they are slower than the American version due to a lazy NTSC to PAL conversion, making them poor choices for speedrunning purposes.

Diary data

Understanding how the game saves data is critical to understand the route described below.

Each Diary takes 0x0200 bytes of data. They are stored next to each other in SRAM, starting from 0x0200. The game can save up to 3 Diaries. In addition, there is also the active Diary stored in WRAM at address 0x0A00 while the game is running.

Here is the Diary layout relevant to this route:

Here are the relevant inventory item values:

Note that the attract mode flags are not unset when starting a new game, so they are listed here as they interact with the checksum and were taken into consideration during routing.

Also note that the random number generator (RNG) state is not stored in a Diary, and is therefore reset each time a Diary is started.

Tricks and techniques

SRAM bit swap

This exploit is what allows the route described below to be possible in the first place.

When saving a Diary, the game appends a checksum at the very end of it. Its first half is calculated by adding all non-checksum 16-bit words of the Diary with a magic number. Its second half is calculated by XORing all non-checksum 16-bit words of the Diary with a magic number. This checksum is used to determine whether the saved Diary is valid or not.

An interesting property of this checksum is that if 2 bits in the same 16-bit position are swapped between 2 different 16-bit words, the checksum does not change, allowing such a corrupted Diary to still be valid.

Since Diaries are saved linearly in chunks of 16 bits in SRAM, such a corruption is possible to achieve by performing a precise mid-frame reset while saving a Diary in-between the 2 desired 16-bit words. Note that the required timing appears to be too precise to be viable for speedruns performed by humans.

Diary recycling

After performing a mid-frame reset while saving or deleting a Diary, if its calculated checksum does not match its saved checksum, the main menu behaves as if the Diary does not exist, allowing the slot to be available for a new game.

It is, however, possible to partially restore such a corrupted invalid Diary by overwriting its beginning with another save, and interrupt said save in a way that will cause the old checksum to match again, resurrecting the corrupted Diary as valid and playable. The easiest way to do this is to start copying a different valid Diary over the corrupted one and immediately perform a precise mid-frame reset in-between the 2 desired bytes before the copy operation completes.

Item duplication

By using SRAM bit swap with or without Diary recycling, it is possible to duplicate items in any of the following ways:

This run optimizes item duplication by combining all of these techniques simultaneously with the following procedure:

  1. Save a Diary with empty item slots to be filled with duplicated items at or near the beginning of the inventory.
  2. Set up Diary bits by playing the game normally and reordering items correctly.
  3. Reset in the middle of a save while the inventory is only partially overwritten.
  4. Recycle the Diary to complete SRAM bit swap while unsetting possible item collection flags.

Note that it is possible to SRAM bit swap the contents of an item slot to have the equipment pointer mismatch the copied equipped item value. Unfortunately, the pointer has priority when attempting to use the equipped item, so this does not appear to be useful.

Main menu cursor management

On the Diary select screen, the cursor defaults to the last Diary started. However, when selecting to copy a Diary, the cursor defaults to Diary 1 even if it is empty. As such, it is possible to abuse this behavior by making sure Diary 1 is the most copied Diary throughout the run to save a few frames.

Inventory management

With the exception of Mystic Statues which have their own dedicated slots, the inventory is managed from a 4x4 grid. Here is the position of each slot in said grid:

 1  2  3  4
 5  6  7  8
 9 10 11 12
13 14 15 16

Horizontal movements go through all 16 slots in order, with the 16th slot connected to the 1st. Meanwhile, vertical movements are restricted to their columns, with the bottom of a column connected to its top. Diagonal movements are not possible. This means that moving the cursor around from one arbitrary slot to another only requires up to 3 moves. As cursor movements in the inventory are frame-perfect, and because all directions on the Control Pad have to be effectively released in order to move the cursor in a specific direction twice, the worst case scenario requires 4 frames.

Meanwhile, whenever Will receives an item, it will fill the first available slot in his inventory. However, the resulting positioning may not be in optimal for selecting it afterwards. In addition, the 1st and 3rd item slots sometimes need to be empty in this run for duplicating items in them. On top of that, items in the 2nd and 4th slots sometimes need to be filled with fixed items as well to successfully pull off an SRAM bit swap. As such, ordering of items in the inventory is carefully calculated throughout the run for optimal cursor movements.

One way to mitigate this issue is to consider that while reordering items, the cursor remains at its final position after a swap, which may save some frames when chaining multiple inventory swaps.

Also, considering the equipment cursor defaults to the 1st slot while unequipped, another possible mitigation is to place a Red Jewel at an inconvenient slot to reach in the inventory from the 1st slot, equip it, and use SRAM bit swap to make sure that the equipped Red Jewel gets duplicated after use. Since the equipped slot data is stored after the inventory data in a Diary, the Red Jewel will remain equipped after duplication, potentially saving the time to re-open the inventory menu and re-equip the Red Jewel afterwards each duplication.

Here are the symbols used below to represent inventory slots in the diagrams shown in the Route section below:

Here are the symbols used to represent actions on the inventory in the diagrams shown in the Route section below:

Note that whenever reordering is performed immediately before an SRAM bit swap in the route below, it is combined with equipping the last Red Jewel to be sent to Jeweler Gem for the current duplication cycle. This is to avoid needlessly closing and reopening the inventory after using the Red Jewel just for that. This detail is omitted from the diagrams below for readability, even though the resulting illustrated flows are slightly inaccurate due to this.

South Cape routes

From the South Cape Dark Space, there are a few paths to choose from to leave the School. They are:

  1. Going back down the stairs, running through the School and exiting through the front door.
  2. Jumping off the School's roof, then running alongside the School's exterior wall.
  3. Jumping off the School's roof, then jumping again on the next roof where Jeweler Gem is located.

The route going back through the School is about half a second slower than the one alongside the exterior wall even without collecting the Red Jewel, so it is never a good idea to use the former.

The difference is not so clear between the other two routes if talking to Jeweler Gem is not required. It turns out that the only locations that are faster to reach by the Jeweler Gem route are Seth's House and Seaside Cave. All other locations are faster by using the School exterior wall route. In particular, it is 4 frames faster to enter Lance's House that way compared to the other route according to my tests.

Doorway cutscene skip

Normally, attempting to enter specific doorways in South Cape for the first time triggers the linked introduction cutscene. It is however possible to skip such a cutscene by opening the related door, then start running into the doorway. This skips the cutscene trigger on the way in, and also on the way out since Will is placed outside of the doorway when exiting the house normally.

This technique is used to skip Lance's House introduction cutscene multiple times throughout the run. Even though it is only a few frames long at best, this technique actually ends up saving about half a minute. This is because if this skip was not possible, an extra round trip around South Cape would be necessary prior to the initial save to trigger it in order to ensure that the associated flag in SRAM does not break checksum validation after corrupting a Diary.

Note that this run sometimes requires Will to slow down a bit when entering doorways to ensure the cutscene skip is not accidentally performed whenever the trigger is required for an SRAM bit swap. Also note that doing so may or may not trigger entering the doorway, depending on the house. This is why Will must enter his house but not Erik's during the run.

Erik's House cutscene trigger

Erik's House introduction cutscene can be triggered either from its front door or its roof entrance. Using the front door to do so is always faster throughout the run however due to the shorter detour.

Map transition lag management

Depending on the order in which areas are entered and exited, lag may increase by about a second per map transition, which may potentially affect routing. I did not find a relevant case where a longer walking/running distance would result in a shorter travel duration due of this phenomenon however.

Route

While there are many ways to duplicate Red Jewels, this particular route does so by minimizing running distance to 8 trips around South Cape, and the number of resets to 14, all without triggering any cutscene longer than a map transition.

Note that it is important to not collect any unnecessary Red Jewels on the way in order to follow the route properly.

Initial setup (round trip 1)

A new game is started in Diary 1 with the default sound and buttons settings, and immediately saved by talking to Gaia at the nearest Dark Space. It is then copied over Diary 2 and Diary 3. Diary 3 is then started only to have Will trigger Erik's House introduction cutscene before going back to the Dark Space to save the game.

Diary 1 will stay as-is for the rest of the run. Its purpose is to unset flags when recycling Diary 2 with it later.

Diary 2 will be the Diary used to beat the game. Thoughout the rest of the run, only Diary 2 will be started and played.

Diary 3 will stay as-is for the rest of the run. Its purpose is similar to Diary 1, except that it can also set Erik's House flag when used to recycle Diary 2, which will be used to manage Jeweler Gem's Red Jewel counter during a specific SRAM bit swap later.

Current relevant state of Diary 1 and Diary 2:

Current relevant state of Diary 3:

Reaching 1 Red Jewel (round trip 2)

Will collects the Red Jewel in Lance's House's basement, which is reordered at the end of the inventory before saving. This is done while ensuring that Lance's House introduction cutscene is skipped here and in every following instances of collecting this Red Jewel.

_ _ _ _     J _ _ _     _ _ _ _
_ _ _ _  +  _ _ _ _  R  _ _ _ _
_ _ _ _  →  _ _ _ _  →  _ _ _ _
_ _ _ _     _ _ _ _     _ _ _ J

Current relevant state of Diary 2:

Reaching 2 Red Jewels (SRAM bit swap 1)

The Red Jewel is reordered back to the 1st slot before performing a mid-frame reset during a save just as the 1st and 2nd slots get overwritten.

_ _ _ _     J _ _ _     J _/_ _
_ _ _ _  R  _ _ _ _  S  _ _ _ _
_ _ _ _  →  _ _ _ _  →  _ _ _ _
_ _ _ J     _ _ _ _     _ _ _ J

The Diary is recycled by overwriting it with Diary 1 up until the collected Red Jewel flags are cleared.

Resulting SRAM bit swap:

Current relevant state of Diary 2:

Reaching 4 Red Jewels (round trip 3)

Will collects the School Red Jewel and Lance's House Red Jewel, then reorders the one from the 1st slot to the 9th before equipping it and saving. Note that the 9th slot will remain equipped on the saved Diary until the end of the run, which ends up saving a few frames by the end.

J _ _ _     J J J _     _ J J _
_ _ _ _  +  _ _ _ _  R  _ _ _ _
_ _ _ _  →  _ _ _ _  →  J _ _ _
_ _ _ J     _ _ _ J     _ _ _ J

Current relevant state of Diary 2:

Reaching 7 Red Jewels (SRAM bit swap 2)

Will sends 2 Red Jewels to Jeweler Gem and reorders one Red Jewel back to the 1st slot before performing a mid-frame reset during a save just as the 1st and 2nd slots get overwritten.

_ J J _     _ J _ _     J J _ _     J J/J _
_ _ _ _  -  _ _ _ _  R  _ _ _ _  S  _ _ _ _
J _ _ _  →  _ _ _ _  →  _ _ _ _  →  J _ _ _
_ _ _ J     _ _ _ J     _ _ _ _     _ _ _ J

The Diary is recycled by overwriting it with Diary 1 up until the collected Red Jewel flags are cleared.

Resulting SRAM bit swap:

Current relevant state of Diary 2:

Reaching 8 Red Jewels (round trip 4)

Will collects the Red Jewel in Lance's House, triggers Will's House introduction cutscene and reorders the Red Jewel from the 1st slot before saving.

J J J _     J J J J     _ J J J
_ _ _ _  +  _ _ _ _  R  J _ _ _
J _ _ _  →  J _ _ _  →  J _ _ _
_ _ _ J     _ _ _ J     _ _ _ J

Current relevant state of Diary 2:

Reaching 13 Red Jewels (SRAM bit swap 3)

Will sends 4 Red Jewels to Jeweler Gem and reorders one Red Jewel back to the 1st slot before performing a mid-frame reset during a save just as the 1st and 2nd slot get overwritten.

_ J J J     _ J _ _     J J _ _     J J/J J
J _ _ _  -  _ _ _ _  R  _ _ _ _  S  J _ _ _
J _ _ _  →  _ _ _ _  →  _ _ _ _  →  J _ _ _
_ _ _ J     _ _ _ J     _ _ _ _     _ _ _ J

The Diary is recycled by overwriting it with Diary 1 up until the collected Red Jewel flags are cleared. Note that doing so also resets all introduction cutscenes flags.

Resulting SRAM bit swap:

Current relevant state of Diary 2:

Reaching 15 Red Jewels (round trip 5)

Will collects the School Red Jewel and Lance's House Red Jewel, triggers Erik's House introduction cutscene, and reorders the Red Jewels from the 1st and 3rd slots before saving.

J J J J     J J J J     _ J _ J
J _ _ _  +  J J J _  R  J J J _
J _ _ _  →  J _ _ _  →  J _ _ J
_ _ _ J     _ _ _ J     J _ _ J

Current relevant state of Diary 2:

Reaching 22 Red Jewels (round trip 6 + SRAM bit swap 4)

Will meets Jeweler Gem. As Will delivered 6 Red Jewels to him so far, Jeweler Gem rewards him with an Herb for delivering 3 Red Jewels, and +1 DEF for delivering 5 Red Jewels. Will then leaves without giving him his remaining Red Jewels in person. However, he sends him 6 Red Jewels immediately afterwards and reorders one more Red Jewel back to the 3rd slot before performing a mid-frame reset during a save just as the 3rd and 4th slots get overwritten. Note that the +1 DEF is not saved because of this.

_ J _ J     H J _ J     H J _ J     H J J J     H J J J
J J J _  +  J J J _  -  _ _ J _  R  _ _ _ _  S /J J J _
J _ _ J  →  J _ _ J  →  _ _ _ _  →  _ _ _ _  →  J _ _ J
J _ _ J     J _ _ J     _ _ _ _     _ _ _ _     J _ _ J

The Diary is recycled by overwriting it with Diary 1 up until the collected Red Jewel flags are cleared. Note that doing so also resets all Jeweler Gem reward flags, in addition to the introduction cutscene flags.

Resulting SRAM bit swap:

Current relevant state of Diary 2:

Note that there exists a faster alternate route to reach the same state minus the Herb by triggering Seth's House and Will's House introduction cutscene flags at the previous save instead of the extra South Cape trip to talk to Jeweler Gem during this phase of the run, but the Herb will be needed to swap out two 0x0400 bits simultaneously later, and getting it now skips the detour to trigger and watch these cutscenes in addition to skipping an extended dialog with Jeweler Gem later for the rewards at 8 Red Jewels and 12 Red Jewels.

Reaching 24 Red Jewels (round trip 7)

Will collects the School Red Jewel, then does a detour to trigger the Seaside Cave introduction cutscene before collecting Lance's House Red Jewel, then triggers Will's House introduction cutscene, and reorders items away from the first 3 item slots before saving. The Herb is specifically placed at one of the slowest slots to equip since it never needs to be.

H J J J     H J J J     _ _ _ J
J J J _  +  J J J J  R  J J J J
J _ _ J  →  J J _ J  →  J J H J
J _ _ J     J _ _ J     J J J J

Note that there is an opportunity to spawn and acquire the fisherman Red Jewel on the way, but it is skipped because it cannot be easily duplicated this early in the game, and the required manipulation of the pseudo-random number generator to spawn it requires several seconds to complete, while picking up an additional School Red Jewel later takes less than a second.

Current relevant state of Diary 2:

Reaching 35 Red Jewels (SRAM bit swap 5)

Will sends 10 Red Jewels to Jeweler Gem and reorders one Red Jewel to the 1st slot and the Herb to the 3rd slot before performing a mid-frame reset during a save just as the 3rd and 4th slots gets overwritten.

_ _ _ J     _ _ _ J     J _ H J     J _ H J
J J J J  -  _ _ _ _  R  _ _ _ _  S /J J J J
J J H J  →  _ _ H _  →  _ _ _ _  →  J J H J
J J J J     _ _ _ J     _ _ _ _     J J J J

The Diary is recycled by overwriting it with Diary 3 (not Diary 1) up until the collected Red Jewel flags are cleared. Note that this also resets all introduction cutscene flags except for the one for Erik's House which becomes set.

Resulting SRAM bit swap:

Current relevant state of Diary 2:

Reaching 36 Red Jewels (round trip 8)

Will collects the School Red Jewel, then triggers Will's House introduction cutscene before saving.

J _ H J     J J H J
J J J J  +  J J J J
J J H J  →  J J H J
J J J J     J J J J

Current relevant state of Diary 2:

Reaching 50 Red Jewels (SRAM bit swap 6)

Will sends all of his 14 Red Jewels to Jeweler Gem as it is faster to do so than going back outside to deliver them in person. A mid-frame reset during a save is then performed just as the counter of Red Jewels delivered to Jeweler Gem gets overwritten.

J J H J     _ _ H _    /J J H J
J J J J  -  _ _ _ _  S  J J J J
J J H J  →  _ _ H _  →  J J H J
J J J J     _ _ _ _     J J J J

The Diary is recycled by overwriting it with Diary 1 up until the introduction cutscene flags are cleared (instead of up to the collected Red Jewel flags).

Resulting SRAM bit swap:

Current relevant state of Diary 2:

The final stretch

Will now has collected enough Red Jewels to claim Jeweler Gem's secret reward. Note that since Will needs to talk to him anyway to claim it, it is faster this time to hand over all the Red Jewels directly to him instead of sending them over one by one. However, Will cannot talk to Jeweler Gem immediately as the option to hand over the Red Jewels only appears after Jeweler Gem is able to give Will the Herb reward again first, which would fail as his inventory is full.

As such, Will sends the equipped Red Jewel first to free up an item slot, then talks to Jeweler Gem. By doing so, Will immediately collects his first six rewards in one go: an Herb, +1 DEF, +1 maximum HP, +1 STR, a Psycho Dash upgrade, and a Dark Friar upgrade. Unfortunately, these rewards are completely useless at this point in the run.

Afterwards, Will can then finally hand over all of his remaining Red Jewels at once to unlock the seventh and final reward, achieved by delivering 50 Red Jewels: a secret warp to Jeweler Gem's mansion. Exiting it through the nearby front door causes an additional warp to the last floor of the Tower of Babel. This allow Will to skip almost all of the game.

J J H J     J J H J     J J H J     _ _ H _
J J J J  -  J J J J  +  J J J J  -  _ _ _ _
J J H J  →  _ J H J  →  H J H J  →  H _ H _
J J J J     J J J J     J J J J     _ _ _ _

Note that from this point, an alternate route exists where Will can warp to Dao by talking to the nearby spirit, then travel all the way to the Great Wall of China to acquire Spin Dash, then backtrack to Mt. Temple to acquire Aura Barrier, then finally use it by manipulating acid spiders in a precise manner in the room containing the Aura Barrier Dark Space to overflow the memory reserved for sprites to trigger an arbitrary code execution exploit to warp directly to the end screen. While this exploit can be used to skip Dark Gaia and the credits, it is not worth the long detour to do so.

Instead, Will simply runs directly to the last room of the Tower of Babel and collects the 6th Mystic Statue from Olman before being warped to the top of the tower. Fortunately, Kara is present there even though Will never met her beforehand, and the game does not check if Will is in possession of all 6 Mystic Statues before merging with her, so after quickly talking to all the other spirits there in the order they appear, Will is allowed to proceed to the final battle against Dark Gaia.

Dark Gaia

Will transforms into Shadow and unlocks the Firebird just before confronting Dark Gaia, so the fight is pretty much normal. However, Will's HP and DEF are so low that all of Dark Gaia's attacks kill Shadow in one hit, and Aura cannot be used as it was never acquired, so dodging is critical.

While phase 1 of the fight is trivial to optimize, phase 2 has a few important considerations.

First, if Shadow is positioned properly, it is possible to land up to 5 attacks every time Dark Gaia opens their mouth during phase 2, with just barely enough time to dodge their incoming mouth beam attack even without Aura, allowing for a 3-cycle kill.

Second, the length of phase 2 is pseudo-random. Indeed, while Dark Gaia is guaranteed to attack with energy balls once during the first cycle and 4 times during follow-up cycles, there is a defined 1/4 probability that Dark Gaia may perform additional energy ball attacks instead of opening their mouth every cycle. Fortunately, no manipulation of the pseudo-random number generator is necessary to achieve this outcome with this route.

Special thanks

Post image: © 1994 Quintet/Enix

Related content I wrote

Fireworks

The New Open Source Video Game Randomizer List Is Now Live

- Video Games, Programming

Time to update your bookmarks! After a few months of work behind the scenes, the new open source version of The BIG List of Video Game Randomizer is now live for your enjoyment, with dark mode support and a brand new UI for better readability! The new URL is: https://randomizers.debigare.com/ (The…
Open treasure chest with a question mark in it

The Future of the Video Game Randomizer List

- Video Games, Programming, Anecdotes

It's hard to believe that it's been almost 8 years since I first posted on the ROMhacking.net forums a list of video game randomizers that I found online, and that it would evolve into the massive project it has become today, with almost 900 entries currently being listed. It's always a strange…
Playing with an Xbox controller

My Personal Video Game Completion List

- Anecdotes, Video Games

I thought it would be fun to track the long list of video game that I have beaten and/or completed for reference, so I've done just that! There may be a few mistakes here and there due to secret features unknown to me, or due to misremembering details of my past gaming experiences, but I believe the…
Field of CG-rendered disembodied arms pointing at a dark sky at sunrise

Current Generative AIs Have Critical Quality Issues

- Business, Quality Assurance, Security

The hype for generative AI is real. It is now possible for anybody to dynamically generate various types of media that are good enough to be mistaken as real, at least at first glance, either for free or at a low cost. In addition, the seemingly-creative solutions they come up with, and the…
Brandon Dillon's portrait in Hack 'n' Slash

After 8 Years, Double Fine's Hack 'n' Slash Secret Room Has Finally Been Cracked

- Video Games, Security

In the history of obscure video game secrets, not many has been quite infamous as the SecretRoom.lua puzzle in 2014's computer hacking game Hack 'n' Slash by Double Fine. Since the game's release, a mysterious encrypted file was found in the game files, yet despite the very nature of the game being…

See all of my articles