Ancilla Misslotting

Ancilla misslotting is a glitch where an ancilla is loaded into a position in the game's memory it wasn't meant to occupy. Because ancillae read and write to various addresses depending on what their slot number is, this can produce various bugged ancillae behavior.

Due to how broken misslotting can get, the community classifies it as a major glitch.

Explanation

For understanding this glitch, it's recommended to read through the page on ancillae mechanics. This way, you can understand the vocabulary this page will use. Another helpful page to read is ancilla overload, as overloading the front slots is an important component of all misslot setups.

With those prerequisites out of the way: the game was coded to have certain items in certain ancillae slots. Bombs, for example, will load into either slot 0 or slot 1. Most items in Link's inventory were only coded to be in slots 0, 1, 2, 3, or 4 (the front slots). The back slots (slots 5-9) are typically reserved for less significant ancillae, such as the sparkle effects that appear while Link is holding a sword charge. However, there are ways to force a front slot ancilla to spawn into a back slot. Because this was unintended from the developers and doesn't really happen in normal gameplay, unintended things happen.

We call this concept of putting an item into a slot it was not intended for misslotting. Broadly, misslotting requires the following:

• Set the ancilla search index to a value at least one digit higher than the value of the slot that you want to misslot to. So for example, if you want to misslot an ancilla to slot 9, you want the search index to be greater than 9.
• Occupy slots 0-4 with ancillae.
• Occupy the slot you want to misslot to with a particle ancilla.
• Load the ancilla you wish to misslot. When you do this, the game will see slots 0-4 occupied. It will then enter the particle search routine to attempt to find a particle ancilla to delete and replace with the new ancilla.

If all of this happens, the ancilla will be misslotted.

Effects

The consequences of ancilla misslotting are generally going to be the result of the arrays that front slot ancillae use to hold their state don't have enough elements for back slot ancillae. This means that when front slot ancillae are loaded into a back slot, the memory addresses they modify as part of their behavior will be the "wrong" addresses.

For example, memory address $0394,X (X being the ancilla slot number) is a location where front slot ancillae may store some miscellaneous information—frequently timers for animations or behaviors. When Link places a somaria block, it'll store 0x0B (11 in decimal) at $0394,X and count that value down towards 0 on every frame. When it reaches 0, the game will begin drawing the somaria block. This is a way to sync the block visually appearing with the somaria animation Link does when the player presses Y. The cane of somaria is a front slot ancilla, so if no other ancilla are on screen and a block is placed, it'll load into slot 4. This means the actual address this timer will use is $0398 (take the base address of $0394 and add 4).

Meanwhile, the hookshot uses memory address $039D to cache the slot number of the hookshot while Link is getting dragged by it. The community has named this address the hookslot, and its value is crucial for having the hookshot drag routine read the correct information for how far and in what direction Link should be getting pulled by the hookshot.

But what if we can place a somaria block into slot 9? Well, now the game adds 9 to our base address of $0394 and gets $039D—and that's the same address as the hookslot. This happens because $0394 only has space for 5 elements, or the total amount of front slots. Addresses past that are on to different things. Due to this, a somaria block in slot 9 is capable of controlling how Link is pulled by the hookshot, and this is how hookpushing works via somaria misslot.

Hookpush

Hookpushing is a trick that involves manipulating the duration and direction that Link is dragged in while the hookshot is pulling him. Because the game doesn't check Link's collision with the tilemap while he's being dragged by the hookshot, this allows the player to clip through walls. It can also be used to enter EG.

There are two main ways the trick is done: using slot 9 somaria blocks or through misslotting a hookshot. Both are discussed in its main article.

Overworld conveyor

By transitioning right after dropping either a bomb or somaria block (misslotted to slot 9) from taking damage, Link can be placed under a conveyor effect while in the overworld. This can either give Link an upwards or downwards conveyor effect depending on the setup.

When this effect is active, you can nudge against any slope and automatically clip from one side of the overworld map to the other, without anything colliding with Link. You can even use your sword and some items while in this noclip mode, while other actions like dashing or moving will let Link collide with things again.

Another application of this is transitioning into an underworld entrance. This gives the same effect as mirroring while on a conveyor belt, except the setup is outside the entrance and can easily be done for all entrances.

Fanfare skip

Fanfare skip is a glitch that can be done while collecting pendants. It will skip most of the cutscene that typically follows after grabbing them. For it to work, the following conditions must be met:

• The pendant is collected with ancilla slots 0-4 filled.
• A somaria block is misslotted 8 slots higher than the slot the pendant is in. Typically this is done by ensuring the pendant spawns in slot 1 (it will normally try to spawn in slot 3), and then misslotting a somaria block to slot 9.

Murderbomb

By putting a bomb into slot 9, the explosion duration timer used by bombs can be reset indefinitely by using a hookshot or producing sword beams.

Overworld ancilla persistence

By misslotting a bomb (or anything else), it will still be active after Link transitions the screen.

Arbitrary misslotting

So far, misslotting has been used to place ancilla into unintended ancilla slots. But there's also a way to place items outside the region of memory dedicated for ancillae altogether. This could be thought of as using slots 10+, and it ends up allowing the player to write values to arbitrary memory at will.

This is really broken and allows for arbitrary code execution.