Deku Guard SRM

Discovered by MrCheeze

When a Deku Guard (En_Look_Nuts, 0x17A) catches you, the entrance to which it "kicks you out" is determined by a combination of the current scene (Deku Palace) and a 16-bit value stored at Offset 0x226 in the actor instance representing the Spawn Index. While we don't have a way of making Deku Guards spawn in other scenes, the value in Offset 0x226 is entirely manipulable with the lower half of the X Position (Offset 0x26) of a stale reference. This means we can wrong warp from Deku Palace to a subset of all possible locations in the game.

Deku Guard Entrance Index Calculation

An entrance index in Majora's Mask is composed of the following three components.

0xFE00 = External Scene Index

0x01F0 = Spawn Index

0x000F = Offset

The External Scene Index is the ID of the scene in the external scene table. In our case, this always the value for Deku Palace, 0x28. However note that in the composite entrance index, this will appear to be twice as large (0x50) due to shifting left 1 bit to accommodate the Spawn Index.

The Spawn Index typically sets which scene load you came from (for instance, which loading zone or cutscene). This is the value that's manipulable in a Deku Guard.

The Offset is typically used by the game when loading alternate setups of a scene. Note that that the converse however is not true; ie. loading an entrance with a nonzero offset does not automatically load the alternate setup. This value is not stored anywhere in the Deku Guard, nor is it relevant to the calculation of the Guard's entrance index.

The way the calculation works for Deku Guards is as follows.

Entrance = Scene << 9 | Spawn << 4 = 0x28 << 9 | Spawn << 4 = 0x5000 | Spawn << 4

This is exactly the calculation one would wish to perform to compute the entrance index... assuming that Spawn was bounded to be 5 bits in size like it normally is. However, the field in the Deku Guard is a full 16 bits in size. So we can produce a sizable overflow into Scene portion of the entrance index by simply writing a value larger than 31 (0x1F). This enables us to wrong warp to scenes other than Deku Palace.

However... there's a catch. Because this is being bitwise ORed with Deku Palace's scene ID, we cannot wrong warp anywhere. If there were a way to spawn Deku Guards in The Mayor's Residence (scene 0x00), the effect of the OR would be nulled out, enabling wrong warp anywhere. This, however, is almost certainly impossible to achieve with only Level 1 SRM. As such, we will have to get by with only the wrong warps available in Deku Palace.

Possible Wrong Warps

Discovered by notwa, Exodus

Since the Spawn Index is stored in a 16-bit integer inside the Deku Guard, there's 2^16 = 65536 possible wrong warps (though many are duplicates, and not all locations are achievable). This is far too many to list on a simple webpage, so the list of warps is provided as a spreadsheet.

Compendium of X Position Setups

Discovered by Rylie

By brute force testing, it was possible to find left Palace setups for nearly every useful wrong warp that involved only targeting a wall, doing a small number of ESS, then dropping/throwing the stale reference in a corner. That information is also provided in a spreadsheet.

Proof of Concept

Discovered by MrCheeze

By hacking Link's held actor pointer (Link + 0x388) to be 0x200 higher than the Deku Guard, MrCheeze was able to write the lower half of the pot's X coordinate (offset 0x26) to the Spawn Index inside the Deku Guard (offset 0x226), thus demonstrating the viablity of Deku Guard Wrong Warps.

Deku Guard Goron Trial Warp (Moonwarp 2)

Discovered by MrCheeze, fullgrowngaming, Fig, Exodus, Gigopler

A large number of community members each contributed a small piece to make the full process of Deku Guard wrong warping viable without cheats. This included a heap manip by fullgrowngaming, a camera manipulation by Fig, a list of possible warps by Exodus, and an X position setup by Gigopler.

Moonwarp 2 on JP

Discovered by SeedBorn

The Japanese N64 versions of the game have 4 extra grottos in Deku Palace. This causes the pots to never line up with the Deku Guards in memory how they need to. As such, Zora Fin SRM must be used to achieve Moonwarp 2 on JP. Note that this is actually the first instance of Moonwarp on JP because the original method required saving at an Owl Statue, a feature which was added to the game with the US version.

Moonwarp 2 on N64

Discovered by Türkenheimer, Rylie

The standard Moonwarp 2 setup does not work on N64. This is because the N64 will crash if attempting to do an operation with a denormalized float. The angle of the stale reference writes to the lower half of a zero-valued float in the Deku Guard, causing a denormal number for any angle other than 0. This is a setup that can be done entirely with an angle of 0.

There's an alternate method that doesn't require pause buffering. This involves doing a chain warp to the graveyard, then hovering to suitable coordinates, and playing SoDT to set your coordinates and reload the scene. This method would not work on JP N64 because SoDT reloading the scene was added in the US version, however it might be possible to die instead to achieve the same effect.

Better Heap Manip

Discovered by fullgrowngaming, Imbued

The original heap manip for Deku Guard SRM was rather slow, and it also modified one of the furthest away guards. This is an improved heap manipulation that only requires 2 unloads of right side Deku Palace, and modifies one of the closest guards.