The first discovered application of SRM in Majora's Mask is to modify the actor parameters (offset 0x1C, 16-bit) of an owl statue (Obj_Warpstone, actor 0x223). The actor parameters have a different purpose for each type of actor. For owl statues, they contain only the owl statue ID. By changing the ID, we are able to make the game think that it's a different owl statue. This enables a variety of wrong warps, including most notably a wrong warp directly to Majora's room at the very end of the game.
There are 10 regular owl statues in the game. 10 is not a power of 2, so Nintendo used the next largest power of 2 (16) to index the owl statue entrance index table. This means there are 6 indices past the end of the table that we are able to overflow to access an unintended region of memory.
|0x0||0x68B0||Great Bay Coast|
|0x4||0xD890||South Clock Town|
|0xA||0x0000||The Mayor's Residence|
|0xB||0x0000||The Mayor's Residence|
|0xC||0x0000, 0x0200, 0x0400||The Mayor's Residence, Majora's Lair, Magic Hags' Potion Shop|
|0xD||0x0000||The Mayor's Residence|
|0xE||0x0000-0x0008||The Mayor's Residence, Majora's Lair, Magic Hags' Potion Shop|
|0xF||0x0000||The Mayor's Residence|
Note that the Hidden Owl Statue has index 0xF by default. This is why saving at it and reloading the save causes "Mayor's Warp".
Different effects are caused by altering the owl statue ID depending on whether the owl has been opened or not when you change its ID.
If you change the owl statue ID, then hit the statue, the owl corresponding to the new ID will be hit remotely. Hitting any overflowed owl A-F will activate Index Warp (though only owl F will visually open the hidden owl). Hitting any owl 0-9 enables soaring to the new owl, but it will kill Index Warp if you have it and will also violate source requirement rules for categories that require hitting the owl statues from source such as 100%. This method is usable on all versions of the game, since it does not require saving at the owl.
You can also use this order to save at the owl on versions other than Japanese N64 (see below for details).
This method will not cause any owl statues to be hit remotely, however it will enable you to save at the altered owl. When you reload the save, you will spawn at the specified entrance based on which owl ID you used. If you used an overflowed owl ID, you will also acquire Owl Save Storage, which is an important precursor to activating 0th Day. Using this method does not violate any source requirement rules, nor will it kill Index Warp since no owls are hit remotely. This method is not possible on the Japanese N64 releases of the game since it requires saving at the owl, but works on all other versions.
It is important to understand how the game determines where to spawn you after reloading a save in order to understand all the nuances of saving at an overflowed owl statue ID. When you save at an owl, the game takes note of which owl you saved at (0-F). When you load the save, the game indexes the owl entrance index table with this owl ID, then spawns you at whatever entrance is stored there.
Note that modifications in this area of RAM are zeroed out both through soft resets and hard power-offs. This means that no matter which overflowed owl index you save at, you can always reset or hard power-off the console to end up at The Mayor's Residence. These modifications are preserved through warps to the title screen without resetting like saving at an owl does, though.
Of the overflowed owl statue IDs, currently two are known to be manipulable.
Index 0xC of the owl statue entrance index table leads to a region of memory that appears to be controlled by the type of textbox that was most recently opened.
|Textbox Style||Entrance Index||Location|
|No textbox||0x0000||The Mayor's Residence|
|Stored Song style textbox||0x0200||Majora's Lair|
|Owl Statue style textbox||0x0400||Magic Hags' Potion Shop|
Since unfortunately there's not a known way to save at the owl statue without bringing up its textbox, Potion Shop is the only fast warp location using Owl C. If it were possible to do something similar to Monkey text skip on the owl statue to skip its text, we could warp to Majora using the stored song style textbox.
Another theoretical way to warp to Majora using Owl C would be by reading the appropriate type of textbox in a second file. The fastest way to do this under NG (not NG+) rules would be to create and start a second file, and watch the intro cutscene until the first text of the backstory appears before the Lost Woods cutscene. However, this would require being able to warp to File Select without resetting, which also isn't possible at this time.
As it is, Owl C seems to be useful only for Potion Shop and Mayor's Warp, but there's definitely potential for it to be used for Majora Warp in the future.
Index 0xE of the owl statue entrance index table leads to a region of memory that's controlled by how many notes you played the last time you played ocarina. Once you play 8 notes, the next note you play will be considered note 1. Also, pulling ocarina will reset the count to 0. Playing/Storing entire songs also counts for this, as does the "playback" of the song after you play the notes. This works with Ocarina While Walking (getting non-ocarina timestop at a gossip stone) as well as Ocarina Items, or playing a real Ocarina.
|Number of notes played||Entrance Index||Location|
|0||0x0000||The Mayor's Residence from ECT|
|1||0x0001||The Mayor's Residence from meeting|
|2||0x0002||The Mayor's Residence from unknown (crash)|
|3||0x0003||Invalid scene (crash)|
|4||0x0004||Invalid scene (crash)|
|5||0x0005||Invalid scene (crash)|
|7||0x0007||Invalid scene (crash)|
|8||0x0008||Magic Hags' Potion Shop|
Using Zora Fin SRM, it was possible to modify the Actor Parameters of the Owl Statue using Z position. The initial demo did not modify it to the 0xE value needed for Moonwarp, however.
By SRMing the ID of an owl statue to be 0xE then saving at it and reloading the save, it's possible to warp directly to Majora's Lair (assuming you played 6 notes the last time you played ocarina). This is the first materialization of Moonwarp, an eternally mythologized method of reaching the moon without playing Oath to Order on top of the clock tower.
Perhaps the most confusing part of this process is why playing 6 notes (entrance index 0x0006) yields an entrance to Majora's Lair, considering that the normal entrance the game sets when talking to the Majora Kid on the moon is 0x0200. This is due to quirks of Majora's Mask entrance index system. The short of it is that the offset (last hexit/nybble of the entrance index) can index past the boundaries of the table, just like with owl statue IDs. It turns out that Mayor's Office (0x0000) with an offset of 0x6 yields the same region in memory as Majora's Lair (0x0200). This video by Jimmie1717 explains this phenomenon in a much higher level of detail.
Note that since the actor parameters are offset 0x1C (16-bit), we must modify them using Z-Position (offset 0x2C). Since this is a 32-bit value, it also overwrites offset 0x1E (8-bit), which is the Object Bank index. The object bank has 35 slots, but for the third time in Owl SRM, we are able to index past the bounds, this time both before and after the bank. The original value this has in a given scene is the only option for the owl remaining visible after you SRM it. There's several dozen additional values that will cause the owl to be invisible but still interactable, most of which are in the bank proper (and thus scene-dependent), but a dozen or so are overflowed indices. The vast majority of options will cause the owl to deallocate and be completely unusuable. As such, any owl SRM setup must take Object Bank Index into account. Fortunately, of the 8 nybbles of data overwritten by the Z-Position, the first 3 and the last 2 do not matter, which makes SRMing with a floating-point value (which we can't fully control) like Z-Position viable.
The first demonstration of moonwarp was tool-assisted, and thus used techniques not possible in real time speedruns. A setup was found for Wii VC that allowed a player to obtain a precise position to drop the rupee by making heavy use of basic movement options like rolls, slashes, and crouches that all alter Link's position by consistent amounts. This setup might not work on N64 because it uses 08 for the object bank index instead of the correct 0B for the southern swamp owl statue, and due to inaccuracies of the emulators packaged in the rereleases, a larger number of incorrect object bank indices are handled gracefully.
While the original setup for Owl Statue Majora Warp (Moonwarp 1) used Zora fins, Türkenheimer found a Z Position throw setup for a held stale reference, and fullgrowngaming found a heap manip to make the owl statue line up at the proper offset in the heap.
The original heap manip had a step with 3 bombs and the hookshot. Hookshot can be substituted for an extra bomb due to both actors being the same size in memory, but the game will only let you have 3 explosives out at once, not 4. As such, swamp owl SRM was not viable in categories that don't get hookshot such as Defeat Majora. However, a new heap manip was found by fullgrowngaming that did not require hookshot (although in the video he does use it to save bombs), enabling swamp owl SRM in virtually any category that wanted to.
By doing a different heap manip (original by Imbued, improved by ADruck) and different Z position setup (original by fullgrowngaming, improved by Türkenheimer), it's possible to owl statue warp from Spring Mountain Village in addition to Southern Swamp, which opens up new routing options, especially for All Dungeons.
Part of the heap manip requires manipulating the camera in such a way that spawners get deactivated. A goron roll without spikes into the blue zone and out of the red zone should be sufficient. However if you have problems with that, rolling into the blue zone, c-upping towards the loading zone, turning around, and targeting should work extremely consistently.
The address of the owl params and the stale reference Z coordinate should be 0x42B4FC if the heap manip was successful.