gists/rng.md

# info dump on the RNG in OoT and MM

if you find any discrepancies, please
leave a comment or tweet at [@antiformant][twitter].

[twitter]: https://twitter.com/antiformant

## the function itself

the random number generator in both games is an LCG:
https://en.wikipedia.org/wiki/Linear_congruential_generator
specifically, it uses the constants from Numerical Recipes in C.

```c
/* the C code looks something like this: */
static uint32_t rng_value = 1;
uint32_t prng() {
    /* note: intentional unsigned overflow. */
    rng_value = rng_value * 1664525 + 1013904223;
    return rng_value;
    /* note: in the game, there's some code to reinterpret the value
             as a floating point number, which I've omitted here. */
}
```

if you're interested, you can find the function(s) in any version by searching
for F35F in RAM. you should see a 660D nearby, usually a bit before.
you can find the rng_value variable
by looking at the disassembly of the RNG function.
note that there are a few different variations of the function
that are not commonly invoked; you can find these the same way.

here are some known addresses:

game, version | RNG value | RNG function | variants
------------- | --------- | ------------ | --------
OoT 1.0       | 80105440  | 800CDC90     | ?
OoT 1.2       | 80105A80  | 800CE4D0     | ?
MM (J) 1.1    | 8009E890  | 8008797C     | 80087940
MM (U):       | 80097530  | 80086FDC     | ?

## the quirks

when a new scene is loaded,
the RNG value is set directly to the CPU's cycle count.
that means, depending on all the code that has been run
up to that point, the RNG value is set to a
pseudo-unpredictable value when you enter a new area.

to clarify what a "new scene" being loaded is:

* loading the title screen
* loading a save file
* entering a new area (TODO: do rooms within a scene count?)
* **not** the N64 logo being shown
* **not** the file select screen

### other invocations

creating a new file will invoke the RNG
to determine the Bomber's Code, etc.
obviously, this does not apply to OoT.

although the GameCube versions don't have an N64 logo,
they still do similar initializations before the title screen is shown.

### emulators

as far as i know, the cycle counter in emulators
(including Virtual Console, excluding CEN64)
is very roughly approximated.
it's not a critical component to emulating most games,
so emulators can skimp on it to achieve better performance.

this means RNG should be fairly consistent, given identical inputs.
*this does not mean RNG will be consistent across emulators.*
the plugins you use might affect this as well.

## exploiting the RNG

### in Ocarina of Time

because the title screen sequence starts on Hyrule Field
with a ton of actors loaded,
the RNG value is updated many times each frame.

as far as i know, you'd have to be frame perfect to reach the file select screen
with a consistent RNG, but i haven't done a lot of testing.
maybe there's a part of the title sequence
with wider gaps between RNG invocations,
giving you a wider window to enter the inputs to reach the file select screen.

this might not be exploitable anyway due to
the reset that occurs when loading scenes, as described earlier.

### in Majora's Mask

the first title screen in this game is very simple.
only a handful of actors are loaded and executing.
as a result, the RNG is only invoked
something like every 75 frames *on average.*

this is a big window to reach the file select screen.
*in theory,* you should be able mash A and Start to reach the
file select to create a file, and that file will have the same
Bomber's code, lottery codes, and Spider House mask order.

remember that "the same" is specific to each emulator,
as described earlier.

### in practice

this needs testing.

i can somewhat consistently reach the file select screen
with the same RNG value in Project64 2.2 and Bizhawk 1.12.1.

Virtual Console and N64 have not been tested.

this might be useful for the new MM 100% ruleset
if it's found to be consistent, but don't hold your breath.