Arbitrary unit possession
From Halopedia, the Halo wiki
Arbitrary Unit Possession is a glitch in Halo 2 and Halo 1. It allows players to play as any character in the game, and even play as vehicles. While playing as a different character, such as a Marine, you can even pilot the Pelican on the level Metropolis. The glitch is caused by Stale Reference Manipulation in the games Object Pool Array. Whenever an object is created, it creates a reference in memory to the actual object. An object is defined by 2 parts using Hexadecimal, a Salt and an index. The Salt is a number that is increased every single time something new spawns, and it can only increment. The Index however, simply lists how many objects there are currently loaded on the map, and because of the Pooling, can be increased, and decreased if an object has been removed from the map. If you are able to get into a very small space and prevent your Coop player from respawning, and restart the level, the glitch will begin.
Discovery
On November 23rd, 2019, Dr. Bizz was in the middle of making a video showcasing the Dead and Alive glitch, where a player can inhibit a dead body in first person. However, while filming, he had become Dead Alive in a way no one had seen before. He seemingly just killed his player twice, normally, and respawned Dead Alive on the level Quarantine Zone. Dr. Bizz reached out to Harc and Monopoli, who began messing with it on the same level. Acting on a small hunch, Monopoli had delayed Harcs' respawn until an Enforcer spawned, and Harc respawned as the Enforcer. From there, they would enlist the help of several modders who would help them understand the glitch better. By the end of that day, they had spawned as the following "new" characters: The Enforcer, Combat Form Flood, Grunt, Jackal, and Elite. Over the following months they had successfully been able to control nearly every single character in the game, except for the boss characters.
Preventing a Respawn
In order to prevent the respawn, you will need to find a very low ceiling that extends outwards. Whenever you have done this, the other player will be stuck in a permanent 3rd person camera with no text (such as Teammate in Combat) on screen. This creates an invisible biped that is stashed at a very specific location on the map. The reason for this is believed to be to reduce lag in this situation, as Halo: CE did not have this feature and whenever you would try to respawn in this state, the game lagged heavily. However, there exists a flaw in the respawn code that allows Arbitrary Unit Possession to happen. The game first checks if the area is safe and/or large enough, if it is, it creates the invisible biped and attempts to teleport it to his partner and completes the respawn. Bungie designed this code without thinking of what would happen if we restarted in the teleporting process. Therefore, the game keeps loaded in memory that a player is ready to respawn with a specific Salt and Index. If, after restart, we kill our partner and load a character in at the exact same Salt and Index, the game will hijack that character and give it to the player.
Predicting the Object Pool
If you want to take control of a specific character, you need to predict the object pool precisely. Things that will increase the Salt by itself include Projectiles and thrown Grenades. Using the Envy skull for invisibility will help, but the further you progress into a level, the harder it is to control the Object Pool. Therefore, things near the start of the level will always be the easiest. Delta Halo and High Charity, however, are extremely difficult because of the near instant shooting that occurs at the start of these levels.
Salt Overflow
If something is loaded at the very start of a level, this would usually mean it is impossible to become that object because of the fact that the Salt cannot decrease. However, if we shoot 32,767 bullets, the salt will overflow back to 8,000 (Hex), and then continue from there. The reason that this works is because the Array uses a unsigned 16-bit integer, and therefore, has a max size of 32,768 possible integers before it overflows. For example, if we wanted to possess a character at the salt 500, but the total salt is already at 1,200, we would need to shoot exactly 32,068 bullets to make the salt wrap back around 500. This takes a lot of time, however. If you are on a map with dual SMGs, it would still take you around 40 minutes to shoot that many bullets. This idea of overflow had been theorized by Mister Monopoli and Nibre, and had been proven to work on April 8, 2020.
The Result
When you do the glitch, you can become any character and vehicle in the game. These characters include, but are not limited to; Phantoms, Pelicans, Marines, Elites, Jetpack/Ranger Elites, Grunts, Jackals, Hunters, Brutes, Drones, Machine Gun Turrets, Wraith Turrets, Constructor Sentinels, and Scarab Turrets. Just keep in mind that the further into a level something is, the harder it will be to predict the object pool. The best way to try to predict late level characters is to overload the map so nobody can shoot bullets.
AUP in Halo 1
On Sept 22, 2024, Monopoli and Amadeus were able to reproduce the glitch in Halo 1 using a similar technique and take control of an Elite.
Trivia
- When you become a different biped, the players HUD appears very different. There is a less detailed motion radar, and no shield bar.
