Salvage Item Manipulation

Technical Explanation

Explanation by LagoLunatic

On the frame the grappling hook hits the sunken treasure: if forest water expires; or if a cutscene is cancelled with storage (†) ; then the salvage point tag you're about to salvage will no longer count as the active one, but it still triggers the salvage. Because there's no active tag, the active index is set to -1. There's no sanity check in place to prevent the chest from coming up when the index is negative. This means that the game tries to read some data before the start of the list in RAM instead. The item ID is read with offset -4, the salvage Kind (treasure chart, light ring, full moon light ring...) is read with offset -5, and the SaveNo (where should the game save progression) is read with offset -7. While the salvage Kind and SaveNo are always set to 0 on stage load (see picture below), this is not the case with the item ID which could contain data unrelated to the sunken chest, so it could be literally anything. This allows for salvaging any of the 255 (used and unused) items in the game.

field4_0x78 contains both the kind and SaveNo, and is always initialized to 0

TWW Salvage instance heap creation

After closing the textbox for the item, the game normally crashes because it reads the salvage to be the kind of salvage corresponding to treasure charts (kind 0). It then fails to to save the treasure chart information, because it ends up in an invalid range (SaveNo 0 again, whereas it's only valid between 1 and 128). This crash can however be avoided by cancelling out of the item get cutscene, which this page shows a couple method for. Below can be seen the valid and invalid ranges for each kind of salvage as found in dSalvage_control_c::entry.

TWW SIM Crash Invalid Ranges

(†) A crash can also occur when salvaging a treasure and triggering a cutscene without storage at the same time. The causes the grapple to disappear, and there’s a check on the grapple's height to transition into the next part of the cutscene, causing the game to hang. This is avoided by fishing up the treasure chest with storage.

Heap Setup

No matter the method used, the memory must first be setup in order for you to salvage the item you want. At 0x803EA014 on JP and at 0x803F6B44 on US there is a pointer to an address located in the GAME heap, and 4 bytes before that pointed address is what is read to be an item ID. If you can control that byte then you can obtain any item that you want early. Currently, there are no good setups that are not luck-reliant. Once that byte has the value you want, you can proceed with performing the glitch.

Generally, on any given file, the pointer will be quite consistent for each island load. Your goal is to write stale data from some actor at that pointed address and then reload the stage on the island you want to perform SIM at.

Example of luck-reliant setup to get the Hookshot

Method 1 - With Cutscene Storage

To perform SIM, you must be able to trigger a cutscene with storage at the same time the grappling hook makes contact with a salvageable chest. The cutscene that activates and gets stored on the same frame the grappling hook hits the chest must be a cutscene entirely cancelled from having storage. Cutscenes that are known to work are:

  • Shooting the Windfall Lighthouse with a fire arrow
  • Making a chest spawn at a platform (remotely using Tingle Bombs)
  • Breaking the wall to Jabun's Cave
  • Receiving Mail (closing a postbox textbox by pressing B when there is mail) (†)
  • Starting the spectacle island canon shooting minigame (†)
  • Starting the mapfish shooting minigame
  • Delayed get item cutscenes (for example the red rupee reward from the pig minigames on Outset or Windfall)

Except for cutscenes marked with (†) where the grappling hook is automatically put away by the game, you generally also need to release the grappling hook right before it makes contact with the chest. Finally, you will also need a way to escape from the get item cutscene, as closing the item textbox normally crashes the game. Known ways to escape the crash are the following:

  • Cancelling out of the salvaging cutscene using a textbox (these are the same specific textboxes that allow Door Cancel)
  • Triggering a loading that activates by looking at a npc after closing a textbox (Tetra during the Prologue, Loot on Boating Course)
  • Triggering a GAME Fadeout (after some form of actor duping and using salvage cruising)
  • Unloading the chest actor using Actor Unloading

Below are a couple different methods for performing SIM from start to finish without crashing.

With the Lighthouse cutscene and the Password text

Get Storage and store the pirate ship password door at Windfall, climb in the boat and get ready to salvage a sunken treasure (it can be any kind of treasure, one from a chart or one from a light ring). Salvage the chest and activate a cutscene on the same frame the grappling hook hits the chest. You must also release the grappling hook button right as it hits the chest or a little bit before (the frame window can vary). Then close the password text to cancel the salvaging animation. Reload the area to obtain the item, just like with chest storage.

The password text is necessary because it is one of the rare textboxes that can be used to cancel the salvaging animation alltogether, kind of like Door Cancel. Cancelling the salvaging animation is required to avoid the crash. The chest spawning cutscene after the lighthouse cutscene can also be delayed by looking away from it with the camera, and it also works to get SIM.

With Platform Chests and GAME Fadeout

Get Storage and either place a tingle bomb or shoot a bomb at the last canon or enemy on a platform that spawns a chest. Salvage a sunken treasure and have the grappling hook hit the sunken chest on the same frame the platform chest spawning cutscene starts, and release the grapple right as it hits the chest or a little bit before to perform SIM.

To avoid the crash, you can perform Salvage Cruising on the japanese version of the game in order to keep moving while obtaining the item. If you are moving towards a large island (such as Windfall, Outset or FF2 for example), it is possible if the heap is setup correctly to trigger a GAME fadeout (for example by performing any form of duping for the right amount of time). This will reload the ocean during the get item animation and thus avoid the crash since you then don't have to close the item textbox. The cutscenes starting usually put you to a halt, so you cannot salvage cruise at 3 speed with this, but it is still possible to salvage cruise at some very low speed, about 0.1.

The GAME Fadeout is used instead of a simple loading zone (such as the Islet of Steel loading zone for example) because these loading zones generally don't trigger while in the get item cutscene, so they don't work to get out of this cutscene.

Note: While other cutscenes can potentially be used for this method instead of platform chest spawning cutscenes, the mailbox cannot be used because it doesn't allow you to perform salvage cruising.

With a Pig Minigame reward and the Cutscene of leaving Outset in the Prologue

Store Tetra's text to leave Outset island and go through it while having control over Link. Close the last textbox by pulling out an item like the sail or a letter, then store Rose's text in order to get the red rupee reward from bringing a pig to her. The trick is that the load into the leaving Outset cutscene will only start if your camera is facing towards Tetra. If you perform the SIM glitch now using the red rupee reward cutscene, you will trigger the stage transition towards the leaving Outset cutscene, which will allow you to escape from the get item cutscene and avoid the crash.

With Dalways Unloading

Using the Actor Unloading glitch, it is possible to unload the Dalways arc in the ACT heap, which will prevent the salvaging cutscene from completing. This will still give you the item. See ACT Fragmentation for more info.

Method 2 - With Forest Water

Have a bottle with forest water close to expiry. Get Storage, climb in the boat and get ready to salvage a sunken treasure (it can be any kind of treasure, one from a chart or one from a light ring). Salvage the chest and have forest water expire on the exact same frame as the grappling hook hits the chest. You must also release the grappling hook button right as it hits the chest or a little bit before (the frame window can vary). The forest water text will then appear and you can close it to cancel the salvaging animation. Reload the area to obtain the item, just like with chest storage.

Method to avoid the crash

This trick relies on a frame perfect forest expiry and a small frame window for releasing the grappling hook, it is thus very difficult. The downside of this method is of course that it relies on forest water expiring, which takes 20 minutes. The upside is that the forest water expiry text acts both as the cutscene to store and a way to escape from the get item cutscene at once, and that can be quite convenient.

Uses in Speedruns

The main use of this trick is to obtain late game items very early. It is indeed possible to obtain many useful items such as Hookshot, Light Arrows, Mirror Shield... Here is a list of items you can get with this glitch:

  • All main inventory items (including bags and bottles)
  • All quest items except the various master swords: all pearls, songs, triforce shards, shields, power bracelets, pirate's charm, hero's charm
  • All bag content (spoils, letters, pedestal trade items, hyoi pear, bait)
  • All charts (including deciphered charts)
  • Heart pieces and heart containers
  • Most item drops (rupees, hearts, bomb drops, arrow drops, magic drops)
  • Small keys (you can transfer them to dungeons)
  • Tingle statues

Items you cannot obtain with this glitch are:

  • Master Sword
  • Half Charged Master Sword
  • Fully Charged Master Sword
  • Bottle content (such as potions, soup, bottled fairy, bottled water...)
  • Hero's Tunic
  • Hurricane Spin
  • Magic and Double Magic
  • Legendary Pictographs

However, due to the volatilness of the known setups to get any specific item and the difficulty of the trick, it is currently considered TAS-only.