I just did some more -*test*-('")ing. I went back to the original enable code (the one-line one that GCNrd gave), and entered in P1's script only the first 32-bit addresses for each of the pad data addresses. So my script was as follows: 04145120 00000000 // Controller data 041A9E6C 00000000 // Controller data I then recorded myself moving through the menus, starting at game boot, and when I played back the recording, it didn't crash, and, what's more, the game saw the pad data and moved around in the menus! Obviously, it wasn't synced, since I had update frequency at 4, and nothing else in the scripts, but at least now it works somewhat! So, this means that one of the last two 32-bit parts of the pad data that ControlSim syncs is screwing it up. And now that I think of it, when I was looking at those addresses last time with GCNrd, the third part (which I recall is supposed to be an error value) had a value in it when the controller was plugged in (I recall there was a 2 in there), which I *think* was different for the two locations. So maybe that third part isn't related to pad data at all in SMB2, which is why it's crashing. So, is it possible to rig GCARS-CS to not use the last one or two parts of the pad data? Or should I continue just putting it in the script and keep the pad address at 80000000?