15

Background Info

So on Windows 7 and later there is a menu that opens when one presses control + alt + delete while logged in. This menu pops up a GUI with various options. This is the control alt delete (or CAD) menu. When you attempt to run any program in administrator mode, a popup called the “UAC Consent UI” appears that asks for user confirmation of the desired admin privileges.

The Game

The specific program I am seeing this occur in is Nintendo Nightmare, an old game from May 2009. However, the game was most likely recompiled as internally the game reports it was compiled with Game Maker 8, which did not exist in May of 2009.

The Exploit

For unknown and unclear reasons, opening either the CAD menu or the Consent UI dialog results in the game failing to execute portions of the game’s code. This includes collision detection and whatever code handles frame rate capping. I was only able to check on Windows 7, but this has also been confirmed to work on Windows 10 as well. I would ask around if anyone can run on Windows 8, but the game doesn’t even run on Windows 8 due to some Windows 8 midi bug.

Why This Would Even Be Useful To Understand

So me and other people speedrun this game... or at least try to. I in particular am absolutely horrible at it. Regardless there is actually a useful way this glitch could be potentially used to save time in a run. Actually there are six locations that come to mind almost immediately.

Here is a video of a TAS I made about a month back for reference on what the current speedrun route is: [TAS] Nintendo Nightmare in 24:04 by Typhon

Within the route there are the following key points:

  1. A scripted death in the first boss fight.
  2. Final Mario level Death Egg section.
  3. Link dying as fast as possible after getting Jetpack to warp to dungeon entrance.
  4. Link dying as fast as possible to warp out of the secret Arwing level.
  5. Link dying as fast as possible after getting Hookshot to warp to dungeon entrance.
  6. Link dying as fast as possible after getting Hammer to warp to dungeon entrance.

For five of these simply invoking a bug to instantly fall through the floor would be the fastest way to die, so those would have minor time saves just by using the bug without anything fancy.

The second point though is the one that is more useful and having far greater implications. The Death Egg segment with Mario is simultaneous the hardest segment in a run and also the longest by far, purely because of the sheer number of enemy entities. Most of the time spent in that area is killing enemies. However, by invoking this bug for a precise number of frames, the player could hypothetically jump and then allow all of the enemy entities to fall through the floor thereby instantly killing everything in the room. Doing this might very well cut a fifth of the time in the entire run.

Skipping point 2 has actually been a primary point of interest for quite some time and finding a way to skip that is probably the single highest priority.

So I am attempting to both determine why this bug occurs at a technical level and also how to potentially replicate it with exact timing (I.e. without actually opening one of those intrusive pop ups).

The Story So Far

So some other people I asked apparently know a bit more about the internals of the Game Maker 8.0 engine and apparently this bug affects all Game Maker 8.0 games, although this doesn’t say much as in the same vein the bug no longer exists in current releases. So asking the developer is about as useful as asking anyone else familiar with the engine.

Using some mining tools (don’t ask me, I have no idea), they found that in the main gameLoop an exception gets thrown with code “ 0EEDFADE” which apparently equates to some unknown Delphi exception. This in turn causes the gameLoop to skip the rest of the frame execution. Game Maker 8 is supposedly written in Delphi so all that tells us is that something received something unexpected or invalid. Similarly between the two points they narrowed the exception down to have to have happened between, they found that that the only windows API they could locate was a call to joyGetPosEX, which is apparently used for joystick functionality. Apparently even in games without joystick it still gets called.

So now I am just trying to figure out what about these dialogs is causing joystick(?) functionality to break and whether there is an easier way to “break joystick functionality”.

Improve this question
15
  • 7
    Do you also get similar issues when the full-screen UAC (Administrator) dialog pops up?
    – u1686_grawity
    Dec 15, 2020 at 17:45
  • 1
    @user1686 I can confirm it also triggers similar behavior (hard to tell for sure without running exhaustive tests), but it sure looks that way.
    – user64742
    Dec 15, 2020 at 17:58
  • 1
    It is definitely the exact same issue, which is even more strange since this implies that the program would break if it ever requested admin privileges... yikes.
    – user64742
    Dec 15, 2020 at 18:18
  • 1
    Is there a reason you do not want to reveal the name of this program? Since you're talking about speed runs and frame rates, I assume it's a video game. But more information about that program might help a lot.
    – sbecker
    Dec 16, 2020 at 12:59
  • 2
    Yes, the name of the program should be included. And no, questions do not necessarily need to be generic and nonspecific. Often that makes the underlying problem difficult or impossible to solve. It's always better to give more detail.
    – Michael Hampton
    Dec 16, 2020 at 16:00

1 Answer 1

Reset to default
29

The Ctrl + Alt + Delete combination, more formally known as the Secure Attention Sequence, brings up the Windows Security dialog on a Secure Desktop. This is a completely separate desktop from the one all other applications run on (\Sessions\1\Windows\WinSta0\Winlogon vs \Sessions\1\Windows\WinSta0\Default)1. Further information is available in Microsoft documentation.

This behaviour has existed since the Secure Desktop was introduced in Windows Vista. A similar process is used for UAC elevation prompts by default.

The desktop switch can cause issues with some applications, especially those using 3D graphics. In the early days of Vista, it was particularly slow due to how it interacted with early WDDM graphics drivers.

As an alternative, if your requirement is to open the Task Manager, you can do so with Ctrl + Shift + Esc or by right-clicking on the taskbar. This will not cause a desktop switch.

1 From Chapter 7 of Windows Internals 7th Ed Part 1

Improve this answer
4
  • By any chance does that book or source at all imply the joyGetPosEx might throw an exception? Someone else looking into the same issue managed to see a generic exception thing go through and they could only find that windows API call in that area. I’m skeptical but open minded. docs.microsoft.com/en-us/windows/win32/api/joystickapi/…
    – user64742
    Dec 16, 2020 at 5:57
  • 3
    @user64742 I suspect(!) what's happening is that because the input desktop is changed during this process, the ancient multimedia joystick API gets a bit unhappy. Note that modern software would tend to use DirectInput (also legacy) or XInput for joysticks. You might(?) get a more in-depth answer on Stack Overflow (though you might need a reproducible/minimal code example) or even Retrocomputing. The WinMM APIs were introduced in Win95/98 and haven't really been updated since then.
    – Bob
    Dec 16, 2020 at 6:14
  • 2
    @user64742 Depending on the age and nature of the program, you might also have more luck running it within a virtual machine (VirtualBox, etc.) with an older OS (XP, Win98). Or through WINE on Linux, which supports some old Windows APIs better than modern Windows does. There are also WINE on Windows implementations available that might help.
    – Bob
    Dec 16, 2020 at 6:18
  • I had not thought to try seeing if behavior changes on Windows XP. That would be interesting, since IIRC this thing should be essentially built for Windows 7. Win 95/98 compatibility mode probably won’t effect anything either, but it is worth a shot.
    – user64742
    Dec 16, 2020 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .