[kirjavascript]

It can and we have achieved Arbitrary Code Execution in NES Tetris.

The setup is horrifyingly complicated and precise though, involving getting some near-impossible scores and entering specific names in the highscore list, then reaching the crash on the same frame that the internal values for random number generation happen to represent a jump instruction to said highscore list (and we get lucky and various registers also happen to contain values we need).

Then from there, there is some bootstrapping before total control is achieved.

[fractal161]

However, I'm like 90% sure that this can be made easier using p3/p4 controllers through the famicom expansion port. In particular, Hydrantdude and I found a consistent enough setup using the single at 1489 lines (pushdown gives you a 50% chance, and I think).

This setup would even allow crude human-possible ACE. Right now we're limited to small payloads (I made a proof of concept that activates the unused two player mode), but more sophisticated setups might give us more power.

[ejona86]

Size-optimized, RAM-only mods. Sounds interesting...

[7373737373]

Holy shit, and massive kudos!