This vulnerability is patched in Slippi Playback Dolphin 3.5.2, released January 14th, 2026. The launcher automatically updates it. Super Smash Bros. Melee is a very popular party fighting game for the Nintendo GameCube. Despite three other entries (four if you're weird and count Smash 4 as two games) in the nearly 25 years since its release, Melee still enjoys a healthy competitive scene to this day due to its rushed development unintentionally leading to a fast-paced playstyle rarely seen in later, more casual-focused games. Major tournaments gather hundreds of players and sometimes even outnumber those playing the latest entry, Super Smash Bros. Ultimate! Nowadays, most people want to play games with their friends over the internet, but since the GameCube was released when most people didn't have broadband, online play didn't exist for most of its library, including Melee. Of course, given that this is a game released on an old Nintendo console, it's safe to assume the majority of its players aren't playing exclusively on original hardware. Instead, people play on Slippi. Slippi is a Melee mod that deeply integrates with its own fork of the Dolphin GameCube/Wii emulator to bring automatic matchmaking, modern rollback netcode , and other quality-of-life improvements to an otherwise ancient console-only game. It's widely regarded as one of the main reasons Melee has maintained a consistent playerbase nowadays since it greatly lowers the barrier to entry for newcomers. Its netcode is also much, much better than the official online code in the later games (if you've ever played Ultimate against someone on Wi-Fi, you know how it feels). Naturally, I wondered the same thing I do with anything else that interacts with random people on the internet: Is there anything to exploit here? Guest Code Execution The first step toward any emulator escape shenanigans is getting my own code running inside the emulator in the first place. (Un)fortunately, I couldn't find anything exploitable in the main matchmaking modes, so instead I took a look at Slippi's replay system. The specification for Slippi's .slp replay format is publicly documented and available here . One of the event types caught my eye: Gecko codes are cheat codes, much like Action Replay or Game Genie codes. Despite being "cheat" codes, Gecko codes also get used as a general-purpose way of modding GameCube and Wii games. Slippi is no different here, as almost all of the patches it applies to Melee are applied as Gecko codes . Slippi also lets you use your own Gecko codes online, provided that they either don't change any gameplay mechanics or are also being used by your opponent (as scary as letting people use their own mods sounds, there aren't any random Super Pichus online since that would just lead to a desync) . Storing Gecko codes in the replay file itself lets you play them back without needing to memorize what codes were used to record it, which is convenient for watching matches that used gameplay-altering codes. Since Slippi happily loads any Gecko codes stored in a replay, running my own code from a replay file is fairly trivial because it's basically just a feature. All I have to do is write some shellcode to a random spot in memory and write a branch to it somewhere in game code. Easy! Writing a big Gecko code list manually is annoying, so I used the gecko tool that's also used in Slippi's build system. Also, instead of writing my exploit code as self-contained shellcode, I decided to be lazy and use FIX94's gc-exploit-common-loader to chain from being in the middle of game code to loading a normal .dol executable I hardcoded somewhere else in memory. This lets me run my exploit code on its own during testing, then just copy it over to the replay loader later. This gives me one really, really long Gecko code list: $Entrypoint [] C216E750 00000007 #entry.S 7C6000A6 5463045E 7C600124 4C00012C 3C208000 60213000 38000000 9401FFC0 3C608000 60631800 7C6803A6 4E800020 60000000 00000000 04001800 7C6000A6 04001804 5463045E 04001808 60632000 0400180C 7C600124 04001810 4C00012C ... Now, how exactly does this get written into the replay file? Unfortunately, the specification is a bit vague about how this gets formatted internally, so I had to do some poking around on my own. I used the peppi library to read and write Slippi replays, but it also doesn't fully parse the Gecko code section. Fortunately, the Gecko code event format is basically just a binary version of what's normally in a Gecko code file, with the size aligned to 512 bytes. use std :: {fs :: File , io :: BufReader }; use peppi :: {game :: GeckoCodes , io :: slippi}; // Maybe it would be easier to use the GCT output here, idk fn convert_codes () -> GeckoCodes { let file = std :: fs :: read_to_string ( "../entry.txt" ) . unwrap (); let mut bytes = vec! []; for line in file . lines () { let line = line . trim (); if line . starts_with ( '$' ) { continue ; } let mut parts = line . split_once ( ' ...