Paper Mario ACE Different Method

There are hacked things in this video but it proves this method to be possible This method of ACE uses the same setup as the current RTA ace, except instead of jumping to expansion pak memory we set up the struct that we normally immediately jump out of in a way that achieves a jump to file names. Requires: p3 holding A, C-left, C-down, C-Right, X: 121, Y: 100 on the analog stick 3 float perfect positions (2 X coords, 1 Z coord) We execute the following asm code: XPos: LL AT, 0xFFF4 (S5) ZPos: MTC0 at, epc lastLandedXPos: ERET Which is these addresses and values 0x8010F1B0 currentX: 0xC2A1FFF4 0x8010F1B8 currentZ: 0x40817000 0x8010F1CC lastLandedX: 0x42000018 We load p3 inputs to register AT with our X position. Then with our Z position we move the value of the inputs to the EPC register in coprocessor 0. When the cpu encounters and ERET instruction, it jumps to whatever is in EPC. [Small note, the MTC0 instruction that moves p3 inputs to EPC takes 2 extra cycles after the instruction to fully finish (so 3 cycles total).] With the address of p1 file names in EPC, we then use our last stored X position to produce an ERET instruction that then jumps to file names. The payload for a credits warp in ch5 requires an extra instruction so we now need to use all 4 file names to achieve this. //--filename 1-- LUI t8, 0x8007 //(instruction as hex: 0x3C188007) LH t1, 0x2C00(t8) //load the value 0010 from 80072C00 (instruction as hex: 0x87092C00) //--filename 2-- SH t1, 0x4090 (t8) //write room value (instruction as hex: 0xA7094090) NOP (instruction as hex: 0x00000000) //--filename 3-- SH r0, 0x408A (t8) //write area value (instruction as hex: 0xA700408A) NOP (instruction as hex: 0x00000000) //--filename 4-- JAL 0x802DC150 //save game (instruction as hex: 0x0C0B7054) NOP (instruction as hex: 0x00000000) Full payload 0x3C188007 0x87092C00 0xA7094090 0x00000000 0xA700408A 0x00000000 0x0C0B7054 0x00000000