Welcome, Guest
You have to register before you can post on our site.

Username
  

Password
  





Search Forums

(Advanced Search)

Forum Statistics
» Members: 131
» Latest member: _tZ
» Forum threads: 1,156
» Forum posts: 3,031

Full Statistics

Online Users
There are currently 43 online users.
» 0 Member(s) | 41 Guest(s)
Bing, Google

Latest Threads
POW Yourself Anytime [Veg...
Forum: Online; Item
Last Post: Vega
Yesterday, 09:52 PM
» Replies: 0
» Views: 45
POW Graphic Mode Modifier...
Forum: Visual & Sound Effects
Last Post: Vega
Yesterday, 02:58 PM
» Replies: 0
» Views: 23
Mario Kart Wii Address Ma...
Forum: Resources and References
Last Post: Vega
Yesterday, 02:01 PM
» Replies: 2
» Views: 74
Easy Extender 1.1 [Y.S.]
Forum: Misc/Other
Last Post: JoshuaMK
11-20-2019, 07:45 PM
» Replies: 4
» Views: 1,225
Auto Press A at Wii Remot...
Forum: Misc/Other
Last Post: Vega
11-19-2019, 10:16 PM
» Replies: 2
» Views: 85
Code Patcher v1.0 [Joshua...
Forum: Misc/Other
Last Post: JoshuaMK
11-19-2019, 05:27 AM
» Replies: 12
» Views: 814
Disable Pause [Elias_]
Forum: Misc/Other
Last Post: JoshuaMK
11-18-2019, 07:48 PM
» Replies: 0
» Views: 42
Always Respawn at Specifi...
Forum: Misc/Other
Last Post: JoshuaMK
11-18-2019, 07:40 PM
» Replies: 0
» Views: 39
Memory Viewer (Dolphin on...
Forum: Misc/Other
Last Post: Vega
11-18-2019, 12:28 AM
» Replies: 9
» Views: 274
20100 issue on Dolphin
Forum: ALTWFC
Last Post: Vega
11-15-2019, 01:53 AM
» Replies: 2
» Views: 223

 
  POW Yourself Anytime [Vega]
Posted by: Vega - Yesterday, 09:52 PM - Forum: Online; Item - No Replies

POW Yourself Anytime [Vega]

NOTE: The effects of spinning out from the self-inflicted POW only work on Dolphin Emulator.

This code will allow you (at any time during the live race) to press your activator to POW yourself. You can set what 'graphic mode' the POW Block will be during the time it is on the screen, and you can set the time it takes for the POW to spin you out if you decided to not dodge it.

This works online. Others will see the effects (for the spinout effect when using the code on Dolphin). If used offline, it effects the CPUs, not yourself. If used in TT's, you will freeze.

M = Graphic Mode
1 = POW fully expanded
2 = POW slightly squished
3 = POW squished all the way

Any other values for M will make the POW graphic not appear at all.

The TTTT values is the time it takes for the POW to spin you out once the graphic appears.

Example TTTT values:
009F = Default
002F = Instant POW
FFFF, 0000 = No POW appears

XXXX is for the controller address and ZZZZ is your button activtor. When pressing the activator, do not press/hold any other buttons.

Final NOTE: This code makes use of memory addresses 0x81430000 thru 0x81430003. Make sure no other codes in your GCT/Cheat-Manager are using those addresses!

NTSC-U
027D9826 0000TTTT
C2790878 00000002
8063F798 3FE08143
907F0000 00000000
C0000000 0000000E
3D808034 618CXXXX
A18C0000 2C0CZZZZ
40A2005C 3D808143
818C0000 2C0C0000
4182004C 9421FF80
7D6802A6 BC610008
7D836378 7C7D1B78
38800001 3FE0807D
63EC9808 7D8803A6
4E800021 7FA3EB78
3880000M 63EC9940
7D8803A6 4E800021
B8610008 7D6803A6
38210080 4E800020

PAL
027B1DD2 0000TTTT
C2799884 00000002
80633660 3FE08143
907F0000 00000000
C0000000 0000000E
3D808034 618CXXXX
A18C0000 2C0CZZZZ
40A2005C 3D808143
818C0000 2C0C0000
4182004C 9421FF80
7D6802A6 BC610008
7D836378 7C7D1B78
38800001 3FE0807B
63EC1DB4 7D8803A6
4E800021 7FA3EB78
3880000M 63EC1EEC
7D8803A6 4E800021
B8610008 7D6803A6
38210080 4E800020

NTSC-J
027B143E 0000TTTT
C2798EF0 00000002
806326C0 3FE08143
907F0000 00000000
C0000000 0000000E
3D808034 618CXXXX
A18C0000 2C0CZZZZ
40A2005C 3D808143
818C0000 2C0C0000
4182004C 9421FF80
7D6802A6 BC610008
7D836378 7C7D1B78
38800001 3FE0807B
63EC1420 7D8803A6
4E800021 7FA3EB78
3880000M 63EC1558
7D8803A6 4E800021
B8610008 7D6803A6
38210080 4E800020

NTSC-K
027A0192 0000TTTT
C2787C44 00000002
80631CA0 3FE08143
907F0000 00000000
C0000000 0000000E
3D808033 618CXXXX
A18C0000 2C0CZZZZ
40A2005C 3D808143
818C0000 2C0C0000
4182004C 9421FF80
7D6802A6 BC610008
7D836378 7C7D1B78
38800001 3FE0807A
63EC0174 7D8803A6
4E800021 7FA3EB78
3880000M 63EC02AC
7D8803A6 4E800021
B8610008 7D6803A6
38210080 4E800020



Code creator: Vega
Code credits: NoHack2Win (POW Block Blocker)



List of Sources:

#16 bit RAM Write

#Address Ports
#NTSC-U = 0x807D9826
#PAL = 0x807B1DD2
#NTSC-J = 0x807B143E
#NTSC-K = 0x807A0192

Change '0x009F' to '0xTTTT' (part of li r0, 0x009F instruction)

==========

#1st C2 ASM

#Address Ports
#NTSC-U = 0x80790878
#PAL = 0x80799884
#NTSC-J = 0x80798EF0
#NTSC-K = 0x80787C44

.set region, '' #Set to e,p,j, or k

#Default Instruction, load the r3 arg pointer for the POW_Check function

.if (region == 'E' || region == 'e') # RMCE
    lwz r3, 0xFFFFF798 (r3)
.elseif (region == 'P' || region == 'p') # RMCP
    lwz r3, 0x3660 (r3)
.elseif (region == 'J' || region == 'j') # RMCJ
    lwz r3, 0x26C0 (r3)
.elseif (region == 'K' || region == 'k') # RMCK
    lwz r3, 0x1CA0 (r3)
.else # Invalid Region
    .err
.endif

lis r31, 0x8143 #r31 safe for use
stw r3, 0 (31) #Store pointer to Mem 81

==========

#C0 ASM

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Compilation Region Setting #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.set region, '' #set this to e,p,j, or k for compilation region

#~~~~~~~~#
# Macros #
#~~~~~~~~#

.macro set_pow_addr address
    lis r31, \address@h
.endm

.macro call_pow address
    ori r12, r31, \address@l
    mtlr r12
    blrl
.endm

.macro push_stack
    stwu sp, -0x0080 (sp)
    mflr r11 #r12 being used when this macro is called
    stmw r3, 0x8 (sp)
.endm

.macro pop_stack
    lmw r3, 0x8 (sp)
    mtlr r11
    addi sp, sp, 0x0080
.endm

#~~~~~~~~~~~~#
# Statements #
#~~~~~~~~~~~~#

#POW_Check is not used here, it's here just for personal preference
#You're suppose to call Check instead of GMode (Check auto calls GMode within), but we want the ability to spam the button activator w/o freezing

.if (region == 'E' || region == 'e') # RMCE
    .set POW_Init, 0x807D9808
    .set POW_GMode, 0x807D9940
    .set POW_Check, 0x807D9D4C
.elseif (region == 'P' || region == 'p') # RMCP
    .set POW_Init, 0x807B1DB4
    .set POW_GMode, 0x807B1EEC
    .set POW_Check, 0x807B22F8
.elseif (region == 'J' || region == 'j') # RMCJ
    .set POW_Init, 0x807B1420
    .set POW_GMode, 0x807B1558
    .set POW_Check, 0x807B1964
.elseif (region == 'K' || region == 'k') # RMCK
    .set POW_Init, 0x807A0174
    .set POW_GMode, 0x807A02AC
    .set POW_Check, 0x807A06B8
.else # Invalid Region
    .err
.endif

#~~~~~~~~~~~~#
# Start Code #
#~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Load & Check Button Activator #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.if (region == 'E' || region == 'e') # RMCE
    lis r12, 0x8034
.elseif (region == 'P' || region == 'p') # RMCP
    lis r12, 0x8034
.elseif (region == 'J' || region == 'j') # RMCJ
    lis r12, 0x8034
.elseif (region == 'K' || region == 'k') # RMCK
    lis r12, 0x8033
.else # Invalid Region
    .err
.endif

ori r12, r12, 0x3E80 #NTSC-U GCN Port 1 used just for compilation purposes, edit this to your liking
lhz r12, 0 (r12)
cmpwi r12, 0x0880 #GCN Y-Button used just for compilation purposes, edit this to your liking
bne+ the_end

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Load 'Status Word' From Mem 81 #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x8143
lwz r12, 0 (r12)
cmpwi r12, 0
beq- the_end #If null, the pointer wasn't set (not in race), don't execute code

push_stack #Backup LR and GPR's

#~~~~~~~~~~~~~~~~~~~~~~~#
# Load POW Info Pointer #
#~~~~~~~~~~~~~~~~~~~~~~~#

mr r3, r12 #Copy address to r3
mr r29, r3 #Backup r3 for later use of other function
li r4, 1 #Arg 2 for POW_Init (this is always 1)

set_pow_addr POW_Init #Set 1st half address for both function calls, doesn't matter what label out of the 2 we use for this

#~~~~~~~~~~~~~~~~~~~#
# POW_Init FUNCTION #
#~~~~~~~~~~~~~~~~~~~#

#r3 = Pointer where POW info resides (requires 3 words of space, fyi)
#r4 = 1

call_pow POW_Init

#~~~~~~~~~~~~~~~~~~~~#
# POW_GMode FUNCTION #
#~~~~~~~~~~~~~~~~~~~~#

#r3 = Pointer where POW info resides
#r4 = Mode (1 fully expanded, 2 half squished, 3 fully squished)

mr r3, r29
li r4, 1 #1 here used for example M value just for source compilation purposes
call_pow POW_GMode

pop_stack #Restore LR and GPR's

the_end:
#blr #uncomment blr if compiling w/ WiiRDGUI

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

Print this item

  POW Graphic Mode Modifier [Vega]
Posted by: Vega - Yesterday, 02:58 PM - Forum: Visual & Sound Effects - No Replies

POW Graphic Mode Modifier [Vega]

This code will allow you to set which 'mode' the POW Block Graphic is at constantly when an opponent POWs you. Works online, have not tested it on offline yet.

X values:
1 = POW fully expanded
2 = POW slightly squished
3 = POW squished all the way

Any other values will make the POW Block graphic not appear, but the POW will still take effect.

NTSC-U
C27D9940 00000002
3880000X 9421FFD0
60000000 00000000

PAL
C27B1EEC 00000002
3880000X 9421FFD0
60000000 00000000

NTSC-J
C27B1558 00000002
3880000X 9421FFD0
60000000 00000000

NTSC-K
C27A02AC 00000002
3880000X 9421FFD0
60000000 00000000

Source:

#Address Ports
#NTSC-U = 0x807D9940
#PAL = 0x807B1EEC
#NTSC-J = 0x807B1558
#NTSC-K = 0x807A02AC

li r4, 0x0X #Set the 2nd arg to the function (POW graphic mode)
stwu sp, -0x0030 (sp) #Default instruction, start the function call

Code creator: Vega

Print this item

Information Mario Kart Wii Address Map (WIP)
Posted by: JoshuaMK - 11-20-2019, 08:52 PM - Forum: Resources and References - Replies (2)

Mario Kart Wii Code Address Map (WIP)

This is an informative work-in-progress map of the addresses of known parts of the game, such as physics, timers, and such.
It also lists what the known values of registers at the addresses are for, as well as how these have been used in the past for codes. Lastly, only relevant and up-to-date addresses will be shown.



Vehicle Speed



Volderbeek Addresses:
NTSC-U = 0x805743C8
PAL = 0x8057AC2C
NTSC-J = 0x8057A5AC
NTSC-K = 0x80568C84

Known Registers:
Unknown

Summary:
Hook address for speed cap float that is ran through during live play.


JoshuaMK Addresses:
NTSC-U = 0x80571CA4, 0x80571CF4
PAL = 0x80578508, 0x80578558
NTSC-J = 0x80577E88, 0x80577ED8
NTSC-K = 0x80566560, 0x805665B0

Known Registers:
f1 = Base Speed
f0 = Max Speed

Summary:
Hook address for speed cap + speed base floats that is read from once during race boot.


Hamster35000vr Addresses:
NTSC-U = 0x8088D550
PAL = 0x80891A68
NTSC-J = 0x808910B8
NTSC-K = 0x8087FE70

Summary:
Memory Address for reverse speed float that is read from during live play.



Gravity



JoshuaMK Addresses:
NTSC-U = 0x80590400
PAL = 0x80596C24
NTSC-J = 0x805965A4
NTSC-K = 0x80584C7C

Known Registers:
f1 = Gravity float value

Summary:
Hook Address for per racer gravity changes through a special loop during live play.


Hamster35000vr Addresses:
NTSC-U = 0x808B1C80
PAL = 0x808B6540
NTSC-J = 0x808B56A0
NTSC-K = 0x808A49B8

Summary:
Memory Address for gravity float value that is read from during live play.



Handling



JoshuaMK Addresses:
NTSC-U = 0x80574220, 0x80574268, 0x805742C0
PAL = 0x8057AA84, 0x8057AACC, 0x8057AB24
NTSC-J = 0x8057A404, 0x8057A44C, 0x8057A4A4
NTSC-K = 0x80568ADC, 0x80568B24, 0x80568B7C

Known Registers:
f3 = Handling sharpness cap (First Address)
f0 = Drift(?) sharpness cap (Second Address)
f1 = Drift(?) sharpness cap (Third Address)

Summary:
Hook addresses used to modify the cap of turning sharpness. Needs a forced branch after third address if modifying the cap.
I found this function by reverse engineering a "master" float used for a lot of the games physics.



Boost Start



JoshuaMK Addresses:
NTSC-U = 0x8058E374, 0x8058F20C
PAL = 0x80594B98, 0x80595A30
NTSC-J = 0x80594518, 0x805953B0
NTSC-K = 0x80582BF0, 0x80583A88

Known Registers:
f0 = How long you've been charging up (First Address)

Summary:
Hook address to modify how long you've "charged" during countdown. Nopping the second address disables needing to hold the A button.



This can be edited by anyone wanting to add onto this, I just thought I would put this out there, with some of my addresses + a few others as a base. Tongue

Print this item

  Auto Press A at Wii Remote Strap Screen [Elias_]
Posted by: Vega - 11-19-2019, 01:16 AM - Forum: Misc/Other - Replies (2)

Auto Press A at Wii Remote Strap Screen [Elias_]

This code will make the game automatically proceed past the Wii Remote Strap Screen once it appears.

Region-Free
04007B24 380000FF

Code creator: Elias_

Print this item

  Disable Pause [Elias_]
Posted by: JoshuaMK - 11-18-2019, 07:48 PM - Forum: Misc/Other - No Replies

Disable Pause [Elias_]

Disables the game pausing, but still brings up the menu to scroll through.



(NTSC-U)
0483B4B0 60000000

(PAL)
048600FC 60000000

(NTSC-J)
0485F768 60000000

(NTSC-K)
0484E4BC 60000000



Code Creator: Elias_

Print this item

  Always Respawn at Specific Respawn Position [Elias_]
Posted by: JoshuaMK - 11-18-2019, 07:40 PM - Forum: Misc/Other - No Replies

Always Respawn at Specific Respawn Position [Elias_]



(NTSC-U)
045313BC 388000XX

(PAL)
04535F04 388000XX

(NTSC-J)
04535884 388000XX

(NTSC-K)
04523F5C 388000XX



XX = Respawn point index value



Code Creator: Elias_

Print this item

  Memory Viewer (Dolphin only) [Vega]
Posted by: Vega - 11-16-2019, 02:55 AM - Forum: Misc/Other - Replies (9)

Memory Viewer (Dolphin only) [Vega]

For Dolphin only. Does not work on the Wii console.

This code will allow you to view any section of the Game's RAM. Once the game loads past the Boot Strap screen, the Memory Viewer will appear. Use your button values to move left/right to select what digit you want to increase/decrease. Use your other button values to increase/decrease said digit. Press the ZZZZ value to update the memory viewer.

Button Keymap:
XXXX = Controller Address
RRRR = Button to increase digit in Address field
SSSS = Button to decrease digit in Address field
TTTT = Button to move left on Address field
UUUU = Button to move right on Address field
ZZZZ = Button to Update Memory View w/ new Address

The code makes use of the follow memory addresses:

0x800003A0 thru 0x800003AE
0x80000FDE thru 0x800010B0

Make sure no other codes in your GCT/Cheat-Manager are using those addresses!

NTSC-U
C200A3F0 00000007
9421FF80 BC610008
806DA358 80630044
80630000 3D808002
618C23E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009640 00000051
9421FF80 BC610008
3FA08000 3F802020
639C2020 3B60005E
3B40000A 881D03A8
2C000000 40A20024
939D0FE7 939D0FEB
9B7D0FE7 9B5D0FEF
93BD03A0 93BD03A4
38000001 981D03A8
3C608034 6063XXXX
A0030000 2C00RRRR
41820034 2C00SSSS
41820038 2C00TTTT
41820088 2C00UUUU
41820094 2C00ZZZZ
418200EC 38000000
901D03AA 981D03AE
48000108 390003AA
38E00001 4800000C
390003AB 38E00000
7C08E8AE 2C000000
41820014 2C000001
40A200AC 38000002
480000A4 38000001
887D03A9 809D03A0
3CA01000 1C630004
7CA51C30 2C070001
40A2000C 7C842A14
48000008 7C852050
909D03A0 48000070
390003AC 38A0FFFF
38C0FFFF 38E00000
48000014 390003AD
38A00001 38C00008
38E00007 7C08E8AE
2C000000 41820014
2C000001 40A20038
38000002 48000030
38000001 887D03A9
7C632A14 7C033000
40A20008 7CE33B78
987D03A9 939D0FE7
939D0FEB 63A60FE7
7F6331AE 7C08E9AE
48000030 881D03AE
2C000000 41820014
2C000001 40A20018
38000002 48000010
38000001 807D03A0
907D03A4 981D03AE
63A303A0 63A40FDE
38A00004 39400001
4800004D 9B5D0FE6
807D03A4 63A40FF0
38A00040 39400000
48000035 38600005
38800005 38A00001
63A60FDE 3FE08002
63FE1DF0 7FC803A6
4E800021 63FE1DD0
7FC803A6 4E800021
4800008C 3863FFFF
3884FFFE 39200000
8CC30001 54C7E13E
54C8073E 2807000A
4180000C 38E70037
48000008 38E70030
54E7402E 2808000A
4180000C 39080037
48000008 39080030
7CE74378 B4E40002
2C0A0001 41820028
39290001 2C090010
41A00010 39200000
38C0000A 48000008
38C00020 9CC40002
3884FFFF 34A5FFFF
4082FF90 99240002
4E800020 B8610008
38210080 81830000
60000000 00000000

PAL
C200A430 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C2480 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009680 00000051
9421FF80 BC610008
3FA08000 3F802020
639C2020 3B60005E
3B40000A 881D03A8
2C000000 40A20024
939D0FE7 939D0FEB
9B7D0FE7 9B5D0FEF
93BD03A0 93BD03A4
38000001 981D03A8
3C608034 6063XXXX
A0030000 2C00RRRR
41820034 2C00SSSS
41820038 2C00TTTT
41820088 2C00UUUU
41820094 2C00ZZZZ
418200EC 38000000
901D03AA 981D03AE
48000108 390003AA
38E00001 4800000C
390003AB 38E00000
7C08E8AE 2C000000
41820014 2C000001
40A200AC 38000002
480000A4 38000001
887D03A9 809D03A0
3CA01000 1C630004
7CA51C30 2C070001
40A2000C 7C842A14
48000008 7C852050
909D03A0 48000070
390003AC 38A0FFFF
38C0FFFF 38E00000
48000014 390003AD
38A00001 38C00008
38E00007 7C08E8AE
2C000000 41820014
2C000001 40A20038
38000002 48000030
38000001 887D03A9
7C632A14 7C033000
40A20008 7CE33B78
987D03A9 939D0FE7
939D0FEB 63A60FE7
7F6331AE 7C08E9AE
48000030 881D03AE
2C000000 41820014
2C000001 40A20018
38000002 48000010
38000001 807D03A0
907D03A4 981D03AE
63A303A0 63A40FDE
38A00004 39400001
4800004D 9B5D0FE6
807D03A4 63A40FF0
38A00040 39400000
48000035 38600005
38800005 38A00001
63A60FDE 3FE08002
63FE1E90 7FC803A6
4E800021 63FE1E70
7FC803A6 4E800021
4800008C 3863FFFF
3884FFFE 39200000
8CC30001 54C7E13E
54C8073E 2807000A
4180000C 38E70037
48000008 38E70030
54E7402E 2808000A
4180000C 39080037
48000008 39080030
7CE74378 B4E40002
2C0A0001 41820028
39290001 2C090010
41A00010 39200000
38C0000A 48000008
38C00020 9CC40002
3884FFFF 34A5FFFF
4082FF90 99240002
4E800020 B8610008
38210080 81830000
60000000 00000000

NTSC-J
C200A38C 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C23A0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C20095DC 00000051
9421FF80 BC610008
3FA08000 3F802020
639C2020 3B60005E
3B40000A 881D03A8
2C000000 40A20024
939D0FE7 939D0FEB
9B7D0FE7 9B5D0FEF
93BD03A0 93BD03A4
38000001 981D03A8
3C608034 6063XXXX
A0030000 2C00RRRR
41820034 2C00SSSS
41820038 2C00TTTT
41820088 2C00UUUU
41820094 2C00ZZZZ
418200EC 38000000
901D03AA 981D03AE
48000108 390003AA
38E00001 4800000C
390003AB 38E00000
7C08E8AE 2C000000
41820014 2C000001
40A200AC 38000002
480000A4 38000001
887D03A9 809D03A0
3CA01000 1C630004
7CA51C30 2C070001
40A2000C 7C842A14
48000008 7C852050
909D03A0 48000070
390003AC 38A0FFFF
38C0FFFF 38E00000
48000014 390003AD
38A00001 38C00008
38E00007 7C08E8AE
2C000000 41820014
2C000001 40A20038
38000002 48000030
38000001 887D03A9
7C632A14 7C033000
40A20008 7CE33B78
987D03A9 939D0FE7
939D0FEB 63A60FE7
7F6331AE 7C08E9AE
48000030 881D03AE
2C000000 41820014
2C000001 40A20018
38000002 48000010
38000001 807D03A0
907D03A4 981D03AE
63A303A0 63A40FDE
38A00004 39400001
4800004D 9B5D0FE6
807D03A4 63A40FF0
38A00040 39400000
48000035 38600005
38800005 38A00001
63A60FDE 3FE08002
63FE1DB0 7FC803A6
4E800021 63FE1D90
7FC803A6 4E800021
4800008C 3863FFFF
3884FFFE 39200000
8CC30001 54C7E13E
54C8073E 2807000A
4180000C 38E70037
48000008 38E70030
54E7402E 2808000A
4180000C 39080037
48000008 39080030
7CE74378 B4E40002
2C0A0001 41820028
39290001 2C090010
41A00010 39200000
38C0000A 48000008
38C00020 9CC40002
3884FFFF 34A5FFFF
4082FF90 99240002
4E800020 B8610008
38210080 81830000
60000000 00000000

NTSC-K
C200A538 00000007
9421FF80 BC610008
806DA380 80630044
80630000 3D808002
618C24E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009788 00000051
9421FF80 BC610008
3FA08000 3F802020
639C2020 3B60005E
3B40000A 881D03A8
2C000000 40A20024
939D0FE7 939D0FEB
9B7D0FE7 9B5D0FEF
93BD03A0 93BD03A4
38000001 981D03A8
3C608033 6063XXXX
A0030000 2C00RRRR
41820034 2C00SSSS
41820038 2C00TTTT
41820088 2C00UUUU
41820094 2C00ZZZZ
418200EC 38000000
901D03AA 981D03AE
48000108 390003AA
38E00001 4800000C
390003AB 38E00000
7C08E8AE 2C000000
41820014 2C000001
40A200AC 38000002
480000A4 38000001
887D03A9 809D03A0
3CA01000 1C630004
7CA51C30 2C070001
40A2000C 7C842A14
48000008 7C852050
909D03A0 48000070
390003AC 38A0FFFF
38C0FFFF 38E00000
48000014 390003AD
38A00001 38C00008
38E00007 7C08E8AE
2C000000 41820014
2C000001 40A20038
38000002 48000030
38000001 887D03A9
7C632A14 7C033000
40A20008 7CE33B78
987D03A9 939D0FE7
939D0FEB 63A60FE7
7F6331AE 7C08E9AE
48000030 881D03AE
2C000000 41820014
2C000001 40A20018
38000002 48000010
38000001 807D03A0
907D03A4 981D03AE
63A303A0 63A40FDE
38A00004 39400001
4800004D 9B5D0FE6
807D03A4 63A40FF0
38A00040 39400000
48000035 38600005
38800005 38A00001
63A60FDE 3FE08002
63FE1EF0 7FC803A6
4E800021 63FE1ED0
7FC803A6 4E800021
4800008C 3863FFFF
3884FFFE 39200000
8CC30001 54C7E13E
54C8073E 2807000A
4180000C 38E70037
48000008 38E70030
54E7402E 2808000A
4180000C 39080037
48000008 39080030
7CE74378 B4E40002
2C0A0001 41820028
39290001 2C090010
41A00010 39200000
38C0000A 48000008
38C00020 9CC40002
3884FFFF 34A5FFFF
4082FF90 99240002
4E800020 B8610008
38210080 81830000
60000000 00000000



Code creator: Vega
Code credits: Star & RiiDefi (Draw Text to Screen)



Source:

1st ASM (When Game loads StaticR.rel, Get Render Mode & Call Direct Print Setup Frame Buffer)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~#
# Address Ports #
#~~~~~~~~~~~~~~~#

#NTSC-U = 0x8000A3F0
#PAL = 0x8000A430
#NTSC-J = 0x8000A38C
#NTSC-K = 0x8000A538

#~~~~~~~~~~~~~~~~#
# Register Notes #
#~~~~~~~~~~~~~~~~#

#No need to backup r0 or LR

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.macro push_stack
    stwu r1, -0x80 (sp)
    stmw r3, 0x8 (sp)
.endm

.macro pop_stack
    lmw r3, 0x8 (sp)
    addi r1, r1, 0x80
.endm

.macro call_link address
    lis r12, \address@h
    ori r12, r12, \address@l
    mtlr r12
    blrl
.endm

.macro default_instruction
    lwz r0, 0x0014 (sp)
.endm

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
    .set nw4r_db_DirectPrint_SetupFB, 0x800223E0
.elseif (region == 'P' || region == 'p') # RMCP
    .set nw4r_db_DirectPrint_SetupFB, 0x80022480
.elseif (region == 'J' || region == 'j') # RMCJ
    .set nw4r_db_DirectPrint_SetupFB, 0x800223A0
.elseif (region == 'K' || region == 'k') # RMCK
    .set nw4r_db_DirectPrint_SetupFB, 0x800224E0
.else # Invalid Region
    .err
.endif

#~~~~~~~~~~~~~~~~~~~~~~~#
# Start Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~#

push_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Get Render Mode (RKSystem->mpVideo()->pRenderMode) #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.if (region == 'E' || region == 'e') # RMCE
    lwz r3, -0x5CA8 (r13)
.elseif (region == 'P' || region == 'p') # RMCP
    lwz r3, -0x5CA0 (r13)
.elseif (region == 'J' || region == 'j') # RMCJ
    lwz r3, -0x5CA0 (r13)
.elseif (region == 'K' || region == 'k') # RMCK
    lwz r3, -0x5C80 (r13)
.else # Invalid Region
    .err
.endif

lwz r3, 0x0044(r3)
lwz r3, 0 (r3)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Call nw4r::db: DirectPrint_SetupFB #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#r3 = Render Mode

call_link nw4r_db_DirectPrint_SetupFB

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# End Register Safety; Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

pop_stack
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

===============================

2nd ASM (Grab RAM Data, Convert it all to ASCII, Handle Button Statuses, Draw RAM on Screen)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~#
# Address Ports #
#~~~~~~~~~~~~~~~#

#NTSC-U = 0x80009640
#PAL = 0x80009680
#NTSC-J = 0x800095DC
#NTSC-K = 0x80009788

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Compilation Region Setting #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.set region, '' #Set this to e,p,j, or k

#~~~~~~~~#
# Macros #
#~~~~~~~~#

.macro push_stack
    stwu sp, -0x80 (sp)
    stmw r3, 0x8 (sp)
.endm

.macro pop_stack
    lmw r3, 0x8 (sp)
    addi sp, sp, 0x80
.endm

.macro call_nw4r address
    ori r30, r31, \address@l
    mtlr r30
    blrl
.endm

.macro default_instruction
    lwz r12, 0 (r3)
.endm

#~~~~~~~~~~~~#
# Statements #
#~~~~~~~~~~~~#

.if (region == 'E' || region == 'e') # RMCE
    .set nw4r_db_DirectPrint_Printf, 0x1DF0
    .set nw4r_db_DirectPrint_StoreCache, 0x1DD0
.elseif (region == 'P' || region == 'p') # RMCP
    .set nw4r_db_DirectPrint_Printf, 0x1E90
    .set nw4r_db_DirectPrint_StoreCache, 0x1E70
.elseif (region == 'J' || region == 'j') # RMCJ
    .set nw4r_db_DirectPrint_Printf, 0x1DB0
    .set nw4r_db_DirectPrint_StoreCache, 0x1D90
.elseif (region == 'K' || region == 'k') # RMCK
    .set nw4r_db_DirectPrint_Printf, 0x1EF0
    .set nw4r_db_DirectPrint_StoreCache, 0x1ED0
.else # Invalid Region
    .err
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~#
# Register & Memory Notes #
#~~~~~~~~~~~~~~~~~~~~~~~~~#

#No need to backup r0 or LR
#r31 = Part of nw4r macro
#r30 = Part of nw4r macro
#r29 = 0x80000000
#r28 = 0x20202020 #ASCII spaces for navigating "^" symbol
#r27 = 0x5E #ASCII "^"
#r26 = 0x0A #ASCII 'enter'

#0x800003A0 = [FAKE] Address In Hex being used for Temp Display
#0x800003A4 = [REAL] Address for start of RAM actually being displayed
#0x800008A8 = Byte to indicate if code has been executed after first time
#0x800003A9 = Left/Right Digit Max/Min Checker
#0x800003AA = Up Status
#0x800003AB = Down Status
#0x800003AC = Left Status
#0x800003AD = Right Status
#0x800003AE = Enter Status
#0x80000FDE thru 0x800000FE5 = Converted [FAKE] Address in Temp Display
#0x80000FE6 = ASCII 'enter' (0x0A)
#0x80000FE7 thru 0x80000FEE = Available spaces where "^" (0x5E) can be
#0x80000FEF = ASCII 'enter' (0x0A)
#0x80000FF0 thru 0x800010B0 = ASCII of displayed RAM

#~~~~~~~~~~~~~~~~~~~~~~#
# Push Stack, Set GPRs #
#~~~~~~~~~~~~~~~~~~~~~~#

push_stack
lis r29, 0x8000
lis r28, 0x2020
ori r28, r28, 0x2020
li r27, 0x5E
li r26, 0x0A

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Check If First Run Thru Of Code Has Been Done #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lbz r0, 0x03A8 (r29)
cmpwi r0, 0
bne+ skip_initial_setup

#0x800003A9 digit slot left/right tracker already set to 0

stw r28, 0xFE7 (r29)
stw r28, 0xFEB (r29)
stb r27, 0xFE7 (r29)
stb r26, 0xFEF (r29) #Can't store r26 to first 0x0A spot cuz its get nulled by hex_ascii_conv subroutine later

stw r29, 0x03A0 (r29) #Store 0x80000000 to both [FAKE] and [REAL] Address spots
stw r29, 0x03A4 (r29)
li r0, 1
stb r0, 0x03A8 (r29)

skip_initial_setup:

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Controller Address & Load Inputs #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.if    (region == 'E' || region == 'e') # RMCE
    lis r3, 0x8034
.elseif (region == 'P' || region == 'p') # RMCP
    lis r3, 0x8034
.elseif (region == 'J' || region == 'j') # RMCJ
    lis r3, 0x8034
.elseif (region == 'K' || region == 'k') # RMCK
    lis r3, 0x8033
.else # Invalid Region
    .err
.endif

ori r3, r3, 0x3E80 #XXXX Controller Address; GCN USA Port 1 used just for compilation
lhz r0, 0 (r3)

#~~~~~~~~~~~~~~#
# Check Inputs #
#~~~~~~~~~~~~~~#

cmpwi r0, 0x88 #Up #GCN Up used just for compilation
beq- up
cmpwi r0, 0x84 #Down #GCN Down used just for compilation
beq- down
cmpwi r0, 0x81 #Left #GCN Left used just for compilation
beq- left
cmpwi r0, 0x82 #Right #GCN Right used just for compilation
beq- right
cmpwi r0, 0x0480 #Enter #GCN X used just for compilation
beq- enter

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Nothing Pressed, Set Null on All Button Statuses #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r0, 0
stw r0, 0x03AA (r29)
stb r0, 0x03AE (r29)
b hex_ascii_fake_display

#~~~~~~~~~~~~~~~~~~~~~~#
# Button Status Checks #
#~~~~~~~~~~~~~~~~~~~~~~#

#0 = Not Pressed
#1 = Just Pressed ('jp' in label names)
#2 = Held After Pressed

#~~~~~~~~~~~#
# Up / Down #
#~~~~~~~~~~~#

up:
li r8, 0x03AA
li r7, 1 #Flag for adding

b up_down

down:
li r8, 0x03AB
li r7, 0 #Flag for subtracting

up_down:
lbzx r0, r8, r29 #Load Up/Down Status, 0x998 for Up, 0x0999 for Down
cmpwi r0, 0
beq- set_jp_updown
cmpwi r0, 1
bne+ store_updownleftright

li r0, 2
b store_updownleftright

set_jp_updown:
li r0, 1

lbz r3, 0x03A9 (r29) #Load left/right digit slot tracker
lwz r4, 0x03A0 (r29) #Load [FAKE] Address Value for Temp Display

lis r5, 0x1000 #Zero shift is adding/subtracing this amount by default
mulli r3, r3, 4 #Multiply  digit slot tracker by 4. Each digit is 4 bits in length ofc
srw r5, r5, r3 #Shift default add/sub amount 1 'digit' to proper place based on digit slot tracker equation

cmpwi r7, 1
bne+ decrement_down

add r4, r4, r5
b update_fake

decrement_down:
subf r4, r5, r4

update_fake:
stw r4, 0x03A0 (r29) #Store updated [FAKE] Address value, NO Update on digit slot tracker, that covers left/right pos

b store_updownleftright

#~~~~~~~~~~~~~~#
# Left / Right #
#~~~~~~~~~~~~~~#

left:
li r8, 0x03AC
li r5, -1
li r6, -1
li r7, 0
b left_right

right:
li r8, 0x03AD
li r5, 1
li r6, 8
li r7, 7

left_right:
lbzx r0, r8, r29 #Load Left/Right Status, 0x99A for left, 0x99B for right
cmpwi r0, 0
beq- set_jp_leftright
cmpwi r0, 1
bne+ store_updownleftright

li r0, 2
b store_updownleftright

set_jp_leftright:
li r0, 1

lbz r3, 0x03A9 (r29) #Load digit slot tracker
add r3, r3, r5 #r5 is -1 for left, is 1 for right

cmpw r3, r6 #r6 is -1 for left, is 8 for right, 0 - 7 is digit slot tracker range
bne+ update_leftright

mr r3, r7 #Set r3 to 0 for left, set it to 7 for right

update_leftright:
stb r3, 0x03A9 (r29) #Update digit slot tracker

#~~~~~~~~~~~~~~~~~~~~~#
# Handle "^" Position #
#~~~~~~~~~~~~~~~~~~~~~#

stw r28, 0x0FE7 (r29) #Clear out w/e position the "^" is at
stw r28, 0x0FEB (r29)
ori r6, r29, 0x0FE7 #Set r6 to 0x80000FE7
stbx r27, r3, r6 #Update "^" to its new position

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Update Up/Down/Left/Right Status #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

store_updownleftright:
stbx r0, r8, r29 #Update Up/DownLeft/Right Status
b hex_ascii_fake_display

#~~~~~~~#
# Enter #
#~~~~~~~#

enter:
lbz r0, 0x03AE (r29) #Load Enter Status
cmpwi r0, 0
beq- set_jp_enter
cmpwi r0, 1
bne+ store_enter

li r0, 2 #Change the status byte from 1 to 2 (just pressed to has been pressed)
b store_enter

set_jp_enter:
li r0, 1

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Update [REAL] Address Value since Status Byte = 1 #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lwz r3, 0x03A0 (r29)
stw r3, 0x03A4 (r29) #Update [REAL] address value!

store_enter:
stb r0, 0x03AE (r29) #Update Enter Status

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Hex to ASCII for Address Field Display #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#r3 = Where unconverted data is
#r4 = Where converted contents will be dumped to
#r5 = 4 for 4 bytes

hex_ascii_fake_display:
ori r3, r29, 0x3A0 #Where temp [FAKE] address value is located
ori r4, r29, 0xFDE #0x80000FDE is where ASCII temp address needs to be at
li r5, 4
li r10, 1 #Set secondary flag (no gridding)

bl hex_ascii_conv

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Store ASCII Enter (1st one), 2nd one written Earlier #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

stb r26, 0x0FE6 (r29)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Hex to ASCII for Hex Grid View Converter #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#r3 = Where unconverted data is
#r4 = Where converted contents will be dumped to
#r5 = 0x40 for 64 bytes (16 words)

lwz r3, 0x03A4 (r29) #Where [REAL] RAM is at
ori r4, r29, 0x0FF0
li r5, 0x40
li r10, 0 #Remove secondary flag (yes on gridding)

bl hex_ascii_conv

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# DirectPrint Printf & Store Cache #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r3, 0x5 #X coordinate (starts far left)
li r4, 0x5 #Y coordinate (starts at very top)
li r5, 0x1 #0 = No wrap, 1 = wrap
ori r6, r29, 0x0FDE

#r7 thru r10 = standard prtinf format args
#f1 thru f13 = standard printf float format args

lis r31, 0x8002 #For nw4r macro

call_nw4r nw4r_db_DirectPrint_Printf
call_nw4r nw4r_db_DirectPrint_StoreCache

b the_end

#~~~~~~~~~~~~~~~~~~~~~~~~#
# Hex to ASCII Converter #
#~~~~~~~~~~~~~~~~~~~~~~~~#

hex_ascii_conv:
addi r3, r3, -1
addi r4, r4, -2

li r9, 0 #For grid row track keeping

conversion_loop:
lbzu r6, 0x1 (r3)

srwi r7, r6, 4 #Left digit into r7
clrlwi r8, r6, 28 #Right digit into r8

cmplwi r7, 0xA
blt- addthirty

addi r7, r7, 0x37
b done_one

addthirty:
addi r7, r7, 0x30

done_one:
slwi r7, r7, 8

cmplwi r8, 0xA
blt- addthirty_again

addi r8, r8, 0x37
b build_halfword

addthirty_again:
addi r8, r8, 0x30

build_halfword:
or r7, r7, r8

sthu r7, 0x2 (r4)

cmpwi r10, 1 #Flag check for whether or not a grid is to be made
beq- skip_grid_instructions

addi r9, r9, 1

cmpwi r9, 16
blt+ new_row

li r9, 0
li r6, 0x0A
b store_byte

new_row:
li r6, 0x20

store_byte:
stbu r6, 0x2 (r4)
addi r4, r4, -1

skip_grid_instructions:
subic. r5, r5, 1
bne+ conversion_loop

stb r9, 0x2 (r4) #r9 will be 0 at this point. Append Null at end (after final 0x0A) so printf won't continue forever and forever...

blr

#~~~~~~~~~#
# The End #
#~~~~~~~~~#

the_end:
pop_stack
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

Print this item

  Respawn Height Modifier [davidevgen]
Posted by: JoshuaMK - 11-09-2019, 07:51 AM - Forum: Offline Non-Item - No Replies

Respawn Height Modifier [davidevgen]



NTSC-U
048B12F8 XXXXXXXX

PAL
048B5BB8 XXXXXXXX

NTSC-J
048B4D18 XXXXXXXX

NTSC-K
048A4030 XXXXXXXX



Normal Value = 442F0000



Code created by: davidevgen

Print this item

  Code Requests
Posted by: Vega - 11-08-2019, 11:01 PM - Forum: Hacking General Discussion - Replies (5)

If any coder out there has some spare time, can you attempt to make the following codes? (I don't have much time myself and I lack creativity tbh)

- Auto POW Dodge (the current POW blocker code shows to others that you cheated the pow blocker)
- Millisecond Display Modifier that works in Battle
- Auto Press A at Wii Remote strap screen
- (For usa game only) Never display the ESRB rating screen, bypass it
- A 100% true invincible code (the current one is nearly perfect, but quite not there)

Print this item

  Random Halfword Generator PPC ASM
Posted by: Vega - 11-08-2019, 09:23 PM - Forum: Hacking General Discussion - Replies (3)

I haven't tested this yet, but this is my attempt of writing the Middle Square Theorem (using the Weyl sequence to prevent convergence). I had to 'downsize' though since my Seed is 32 bits instead of 64. Thus, halfword output is used for the random output instead of a word.

The seed is using the lower 32 bits of the TB. Ofc, including the upper 32 bits is not a good idea.

For more info, visit this link - https://pthree.org/2018/07/30/middle-squ...ence-prng/

======

Args:
r3 = Amount of times to cycle the generator (recommend that this number be at least 4)
r3 must be anything from 1 to 0xFFFFFFFF (value treated logically for # of cycles)

Error Code:
r3 = 0 if r3's arg was invalid

Source: #The following snippet of code is meant to be used as a subroutine reached via a branch-link instruction

cmpwi r3, 0
beqlr-

mtctr r3 #LR doesn't need to be backed up for this subroutine
mftbl r4 #Seed register

li r3, 0 #Square-value register, start at 0
li r5, 0 #Starting Weyl variable, start at 0

clrlwi. r0, r4, 31 #Seed needs to be an odd number
bne- loop

addi r4, r4, 1 #Make seed odd

loop:
mullw r3, r3, r3 #Square the Value

add r5, r4, r5 #Add the constant seed to Weyl variable. Result is new Weyl variable
add r3, r3, r5 #Add Weyl variable to squared value

srwi r3, r3, 16 #Place upper 16 bits into lower 16 bits, upper 16 bits are now cleared
bdnz+ loop

blr #r3 contains random halfword result

Print this item