Automated License Unlock and/or VR+BR Modifier [Vega]
#1
Automated License Unlock and/or VR+BR Modifier [Vega]

This code will do one or both of the following...
1. Unlock Everything for all 4 licenses FOR ALL YOUR DATA SAVES (no star rank applied)
2. Set VR+BR for all 4 licenses FOR ALL YOUR DATA SAVES

Instructions for filling in X,Y,Z values:

Set your 'user option' (this is the part of the code that has the X value). Here are the options you can set-
0 = Unlock Everything, Set VR & BR
1 = Unlock Everything, no VR & BR changes
2 = Set VR & BR, don't unlock

If you chose to do option 0 or 1~
If a license slot doesn't have a license made, the code will make a new blank license for that slot (with no Mii applied). That way all 4 License Slots for all your Data Saves will have everything unlocked.

The YYYY value in the code is the VR rating and the ZZZZ value is the BR rating. If your user option is 1, then set the YYYY/ZZZZ values to anything random, it doesn't matter as the code will NOT apply the VR/BR changes.

Example YYYY/ZZZZ value:
270F = 9999 VR/BR

Instructions on using the code:
All you have to do is boot MKWii. After a few seconds (your TV screen may show blackscreen or have a visual glitch, this is normal), you will automatically be returned to the Wii Main Menu. And... that's it!!! You're done. You only need this run this code once. Congratz.

NOTE: If using this on Dolphin, the automatic return to the Wii Menu will likely fail (emulation freezes/glitches) but the code will still take effect.

NTSC-U
C20095F4 0000003F
3AE0000X 3F00YYYY
6318ZZZZ 3C600002
60638000 7C791B78
38800020 80ADA358
80A50024 7CBA2B78
3D808022 618C9490
7D8803A6 4E800021
7C7B1B78 3FA08016
3AC03430 3AD60001
2C16343A 41820020
2C163467 41820020
2C16353A 41820020
28163561 4181017C
48000018 3AC03461
48000010 3AC03530
48000008 3AC03561
4800002D 2F746974
6C652F30 30303130
3030342F 35323464
34335858 2F646174
612F726B 7379732E
64617400 7C6802A6
B2C30016 7C7E1B78
38800001 63BCADBC
7F8803A6 4E800021
2C03FF96 41A2FF78
2C030000 4180010C
7C7F1B78 7F64DB78
7F25CB78 63BCB15C
7F8803A6 4E800021
7C03C800 408200EC
7FE3FB78 63BCB2E4
7F8803A6 4E800021
38DB0038 3CE08CC0
54E7843E 38600004
8886FFD0 2C040000
40820010 3C80524B
60845044 9086FFD0
2C170001 4082002D
38800000 3884FFFF
3CA0031F 60A5FFFC
90860000 90A60004
3463FFFF 7CC63A14
4082FFC0 48000014
93060080 2C170002
41A2FFE8 4E800020
7F63DB78 3899FFFC
3D80801D 618C1C00
7D8803A6 4E800021
3C9B0002 90647FFC
7FC3F378 38800002
63BCADBC 7F8803A6
4E800021 2C030000
41800038 7C7F1B78
7F64DB78 7F25CB78
63BCB220 7F8803A6
4E800021 7C03C800
40820018 7FE3FB78
63BCB2E4 7F8803A6
4E800021 4BFFFE68
3D80801A 618C87B8
7D8803A6 4E800020
60000000 00000000

PAL
C2009634 0000003F
3AE0000X 3F00YYYY
6318ZZZZ 3C600002
60638000 7C791B78
38800020 80ADA360
80A50024 7CBA2B78
3D808022 618C9814
7D8803A6 4E800021
7C7B1B78 3FA08016
3AC03430 3AD60001
2C16343A 41820020
2C163467 41820020
2C16353A 41820020
28163561 4181017C
48000018 3AC03461
48000010 3AC03530
48000008 3AC03561
4800002D 2F746974
6C652F30 30303130
3030342F 35323464
34335858 2F646174
612F726B 7379732E
64617400 7C6802A6
B2C30016 7C7E1B78
38800001 63BCAE5C
7F8803A6 4E800021
2C03FF96 41A2FF78
2C030000 4180010C
7C7F1B78 7F64DB78
7F25CB78 63BCB1FC
7F8803A6 4E800021
7C03C800 408200EC
7FE3FB78 63BCB384
7F8803A6 4E800021
38DB0038 3CE08CC0
54E7843E 38600004
8886FFD0 2C040000
40820010 3C80524B
60845044 9086FFD0
2C170001 4082002D
38800000 3884FFFF
3CA0031F 60A5FFFC
90860000 90A60004
3463FFFF 7CC63A14
4082FFC0 48000014
93060080 2C170002
41A2FFE8 4E800020
7F63DB78 3899FFFC
3D80801D 618C1CA0
7D8803A6 4E800021
3C9B0002 90647FFC
7FC3F378 38800002
63BCAE5C 7F8803A6
4E800021 2C030000
41800038 7C7F1B78
7F64DB78 7F25CB78
63BCB2C0 7F8803A6
4E800021 7C03C800
40820018 7FE3FB78
63BCB384 7F8803A6
4E800021 4BFFFE68
3D80801A 618C8858
7D8803A6 4E800020
60000000 00000000

NTSC-J
C2009590 0000003F
3AE0000X 3F00YYYY
6318ZZZZ 3C600002
60638000 7C791B78
38800020 80ADA360
80A50024 7CBA2B78
3D808022 618C9734
7D8803A6 4E800021
7C7B1B78 3FA08016
3AC03430 3AD60001
2C16343A 41820020
2C163467 41820020
2C16353A 41820020
28163561 4181017C
48000018 3AC03461
48000010 3AC03530
48000008 3AC03561
4800002D 2F746974
6C652F30 30303130
3030342F 35323464
34335858 2F646174
612F726B 7379732E
64617400 7C6802A6
B2C30016 7C7E1B78
38800001 63BCAD7C
7F8803A6 4E800021
2C03FF96 41A2FF78
2C030000 4180010C
7C7F1B78 7F64DB78
7F25CB78 63BCB11C
7F8803A6 4E800021
7C03C800 408200EC
7FE3FB78 63BCB2A4
7F8803A6 4E800021
38DB0038 3CE08CC0
54E7843E 38600004
8886FFD0 2C040000
40820010 3C80524B
60845044 9086FFD0
2C170001 4082002D
38800000 3884FFFF
3CA0031F 60A5FFFC
90860000 90A60004
3463FFFF 7CC63A14
4082FFC0 48000014
93060080 2C170002
41A2FFE8 4E800020
7F63DB78 3899FFFC
3D80801D 618C1BC0
7D8803A6 4E800021
3C9B0002 90647FFC
7FC3F378 38800002
63BCAD7C 7F8803A6
4E800021 2C030000
41800038 7C7F1B78
7F64DB78 7F25CB78
63BCB1E0 7F8803A6
4E800021 7C03C800
40820018 7FE3FB78
63BCB2A4 7F8803A6
4E800021 4BFFFE68
3D80801A 618C8778
7D8803A6 4E800020
60000000 00000000

NTSC-K
C200973C 0000003F
3AE0000X 3F00YYYY
6318ZZZZ 3C600002
60638000 7C791B78
38800020 80ADA380
80A50024 7CBA2B78
3D808022 618C9B88
7D8803A6 4E800021
7C7B1B78 3FA08016
3AC03430 3AD60001
2C16343A 41820020
2C163467 41820020
2C16353A 41820020
28163561 4181017C
48000018 3AC03461
48000010 3AC03530
48000008 3AC03561
4800002D 2F746974
6C652F30 30303130
3030342F 35323464
34335858 2F646174
612F726B 7379732E
64617400 7C6802A6
B2C30016 7C7E1B78
38800001 63BCAEF8
7F8803A6 4E800021
2C03FF96 41A2FF78
2C030000 4180010C
7C7F1B78 7F64DB78
7F25CB78 63BCB298
7F8803A6 4E800021
7C03C800 408200EC
7FE3FB78 63BCB420
7F8803A6 4E800021
38DB0038 3CE08CC0
54E7843E 38600004
8886FFD0 2C040000
40820010 3C80524B
60845044 9086FFD0
2C170001 4082002D
38800000 3884FFFF
3CA0031F 60A5FFFC
90860000 90A60004
3463FFFF 7CC63A14
4082FFC0 48000014
93060080 2C170002
41A2FFE8 4E800020
7F63DB78 3899FFFC
3D80801D 618C1FFC
7D8803A6 4E800021
3C9B0002 90647FFC
7FC3F378 38800002
63BCAEF8 7F8803A6
4E800021 2C030000
41800038 7C7F1B78
7F64DB78 7F25CB78
63BCB35C 7F8803A6
4E800021 7C03C800
40820018 7FE3FB78
63BCB420 7F8803A6
4E800021 4BFFFE68
3D80801A 618C8BB4
7D8803A6 4E800020
60000000 00000000



Code creator: Vega

Code credits: RiiDefi (EGG::Heap::alloc & helped w/ NetCalc function), Megazig (All ISFS functions)



Source:

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~#
# Macros and Variables #
#~~~~~~~~~~~~~~~~~~~~~~#

.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm

.macro call_isfs address
ori r28, r29, \address@l
mtlr r28
blrl
.endm

.macro call_nolink address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blr
.endm

.set region, '' #Fill in E, P, J, or K within the quotes for your region when Compiling! Lowercase letters can also be used.

.if (region == 'E' || region == 'e') # RMCE
.set ISFS_Open, 0xADBC
.set ISFS_Read, 0xB15C
.set ISFS_Write, 0xB220
.set ISFS_Close, 0xB2E4
.set Wii_Menu, 0x801A87B8
.set Egg_Alloc, 0x80229490
.set NET_Calc, 0x801D1C00
.elseif (region == 'P' || region == 'p') # RMCP
.set ISFS_Open, 0xAE5C
.set ISFS_Read, 0xB1FC
.set ISFS_Write, 0xB2C0
.set ISFS_Close, 0xB384
.set Wii_Menu, 0x801A8858
.set Egg_Alloc, 0x80229814
.set NET_Calc, 0x801D1CA0
.elseif (region == 'J' || region == 'j') # RMCJ
.set ISFS_Open, 0xAD7C
.set ISFS_Read, 0xB11C
.set ISFS_Write, 0xB1E0
.set ISFS_Close, 0xB2A4
.set Wii_Menu, 0x801A8778
.set Egg_Alloc, 0x80229734
.set NET_Calc, 0x801D1BC0
.elseif (region == 'K' || region == 'k') # RMCK
.set ISFS_Open, 0xAEF8
.set ISFS_Read, 0xB298
.set ISFS_Write, 0xB35C
.set ISFS_Close, 0xB420
.set Wii_Menu, 0x801A8BB4
.set Egg_Alloc, 0x80229B88
.set NET_Calc, 0x801D1FFC
.else # Invalid Region
.err
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Register Notes: #
# r31 = fd #
# r30 = File Path Address #
# r29 & r28 = Part of call_isfs Macro #
# r27 = Heap Address Pointer / Data Save Contents Address Pointer #
# r26 = System Heap Calc Address #
# r25 = Read/Write's 3rd Arg #
# r24 = VR then BR #
# r23 = User Option #
# r22 = Data Save ASCII Halfword #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Data Save (rksys.dat) Contents 'Map' #
# 0x0008 License 1 RKPD Magic
# 0x0038 License 1 Unlock String Doubleword #
# 0x00B8 License 1 VR Halfword #
# 0x00BA License 1 BR Halfword #
# 0x8CC8 License 2 RKPD Magic
# 0x8CF8 License 2 Unlock String Doubleword #
# 0x8D78 License 2 VR Halfword #
# 0x8D7A License 2 BR Halfword #
# 0x11988 License 3 RKPD Magic
# 0x119B8 License 3 Unlock String Doubleword #
# 0x11A38 License 3 VR Halfword #
# 0x11A3A License 3 BR Halfword #
# 0x1A648 License 4 RKPD Magic
# 0x1A678 License 4 Unlock String Doubleword #
# 0x1A6F8 License 4 VR Halfword #
# 0x1A6FA License 4 BR Halfword #
# 0x27FFC CRC-32 Checksum Word #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# No need to backup anything, code ends in a function blr call; Set User's Options of Code #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r23, 0x0 #User Option, zero used just for compilation
lis r24, 0x270F #VR, random value for compilation
ori r24, r24, 0x270E #BR, random value for compilation

#~~~~~~~~~~~~~~~~~~~~~~~#
# EGG::Heap::alloc #
# r3 = Size of Heap #
# r4 = Alignment #
# r5 = System Heap Calc #
#~~~~~~~~~~~~~~~~~~~~~~~#

lis r3, 0x0002
ori r3, r3, 0x8000

mr r25, r3 #Backup Size of Data Save for later use of ISFS_Read & ISFS_Write

li r4, 0x20

.if (region == 'E' || region == 'e')
lwz r5, -0x5CA8(r13)
.elseif (region == 'P' || region == 'p')
lwz r5, -0x5CA0(r13)
.elseif (region == 'J' || region == 'j')
lwz r5, -0x5CA0(r13)
.elseif (region == 'K' || region == 'k')
lwz r5, -0x5C80(r13)
.endif

lwz r5, 0x0024 (r5)
mr r26, r5 #Backup System Heap Calc Address

call_link Egg_Alloc
mr r27, r3 #Backup Heap Address Pointer

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set ISFS Macro Prefix, Setup/Check ASCII Mega Loop #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r29, 0x8016 #Set 1st half address for all ISFS Functions

#41 = 3431 = RMCA
#42 = 3432 = RMCB
#43 = 3433 = RMCC
#44 = 3434 = RMCD
#45 = 3435 = RMCE
#46 = 3436 = RMCF
#47 = 3437 = RMCG
#48 = 3438 = RMCH
#49 = 3439 = RMCI
# first step
#4a = 3461 = RMCJ
#4b = 3462 = RMCK
#4c = 3463 = RMCL
#4d = 3464 = RMCM
#4e = 3465 = RMCN
#4f = 3466 = RMCO
# second step
#50 = 3530 = RMCP
#51 = 3531 = RMCQ
#52 = 3532 = RMCR
#53 = 3533 = RMCS
#54 = 3534 = RMCT
#55 = 3535 = RMCU
#56 = 3536 = RMCV
#57 = 3537 = RMCW
#58 = 3538 = RMCX
#59 = 3539 = RMCY
# third step
#5a = 3561 = RMCZ

li r22, 0x3430 #This is 1 before "41" in ASCII for Data Save ID

mega_loop:
addi r22, r22, 1

cmpwi r22, 0x343A
beq- first_step

cmpwi r22, 0x3467
beq- second_step

cmpwi r22, 0x353A
beq- third_step

cmplwi r22, 0x3561
bgt- launch_menu #Data Save checklist completed, we're completely done

b start_isfs_open

first_step:
li r22, 0x3461
b start_isfs_open

second_step:
li r22, 0x3530
b start_isfs_open

third_step:
li r22, 0x3561

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Open #
# r3 = File Path #
# r4 = 0x1 for Read Permissions #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

start_isfs_open:
bl open_datasave

.string "/title/00010004/524d43XX/data/rksys.dat"

open_datasave:
mflr r3

sth r22, 0x16 (r3) #Update the file path with current data save ascii

mr r30, r3 #Backup file path address pointer
li r4, 0x1

call_isfs ISFS_Open

cmpwi r3, -106
beq- mega_loop #FFFFFF96 = File not found, try next Ascii

cmpwi r3, 0x0 #If negative value (not -106), then error occured.
blt- launch_menu

mr r31, r3 #Backup file descriptor

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Read #
# r3 = fd #
# r4 = Address Pointer to dump read Data to #
# r5 = Amount of Bytes to read & dump #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

mr r4, r27
mr r5, r25 #Backed up size arg from Egg Alloc moved to r5

call_isfs ISFS_Read
cmpw r3, r25 #r3 should return r5's aka r25's value. If negative value, then error occured.
bne- launch_menu

#~~~~~~~~~~~~#
# ISFS_Close #
# r3 = fd #
#~~~~~~~~~~~~#

mr r3, r31

call_isfs ISFS_Close

#~~~~~~~~~~~~~~~~~#
# Pre-Loop Config #
#~~~~~~~~~~~~~~~~~#

addi r6, r27, 0x0038 #This is the exact spot for unlock doubleword of License 1
lis r7, 0x8CC0 #Each License is separated by a gap of 0x8CC0 bytes, can't load this amount via Li. Load it via Lis.
srwi r7, r7, 16 #Shift r17 (8CC00000) to result as 00008CC0

li r3, 0x4 #For 4 Licenses

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Check If License Exists, If not, make it #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

license_loop:
lbz r4, -0x30 (r6) #Check for 'R' of RKPD Magic ASCII
cmpwi r4, 0x0
bne- check_user_option

lis r4, 0x524B #RKPD Magic ASCII
ori r4, r4, 0x5044
stw r4, -0x30 (r6) #Create License

#~~~~~~~~~~~~~~~~~~~#
# Check User Option #
#~~~~~~~~~~~~~~~~~~~#

check_user_option:
cmpwi r23, 0x1
bnel- vrbr_writes #If user didn't set Option No 1, then they want to modifer VR+BR

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# License Unlock, r6 holds exact location for first word of Unlock String #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r4, 0
addi r4, r4, -1 #Everything unlocked has a doubleword of 0xFFFFFFFF031FFFFC. Use r15 and r16 for that doubleword
lis r5, 0x031F
ori r5, r5, 0xFFFC
stw r4, 0 (r6) #Unlock everything for current license
stw r5, 0x4 (r6) #Unlock everything for current license

skip_unlocker:
subic. r3, r3, 1
add r6, r6, r7
bne+ license_loop
b start_checksum

#~~~~~~~~~~~~~~~~~~#
# VR/BR Subroutine #
#~~~~~~~~~~~~~~~~~~#

vrbr_writes:
stw r24, 0x80 (r6) #Write VR and BR amount of current license
cmpwi r23, 0x2
beq- skip_unlocker #If user set Option No 2, they don't want to unlock anything
blr

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# NETCalcCRC32 #
# r3 = File Contents Address Pointer #
# r4 = Amount of Bytes to use for Calculation #
# r3's return value = CRC32 Word #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

start_checksum:
mr r3, r27 #Move backed up Heap Address Pointer to r3
addi r4, r25, -0x4 #Subtract 0x4 from data save size alloc to get byte size amount, 0x27FFC

call_link NET_Calc

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Store CRC32 Word to spot in Data Save Contents #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

addis r4, r27, 0x0002 #Add 0x00020000 to r27
stw r3, 0x7FFC (r4) #Store CRC32 Word to spot (which is final word location of entire contents)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Open #
# r3 = File Path #
# r4 = 0x2 for Write Permissions #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

mr r3, r30 #Move backed up file path address pointer to r3
li r4, 0x2

call_isfs ISFS_Open
cmpwi r3, 0x0
blt- launch_menu

mr r31, r3 #Backup file descriptor

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Write #
# r3 = fd #
# r4 = Address Pointer where String Data that will used for writes is located #
# r5 = Amount of Bytes to Write to File #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

mr r4, r27 #r3 already set by ISFS_Open return value. Move backed up Heap Address Pointer to r4
mr r5, r25 #Move backed up Byte Write Size to r5

call_isfs ISFS_Write
cmpw r3, r25 #r3 should return r5's aka r25's value. If negative value, then error occured.
bne- launch_menu

#~~~~~~~~~~~~#
# ISFS_Close #
# r3 = fd #
#~~~~~~~~~~~~#

mr r3, r31

call_isfs ISFS_Close
b mega_loop #Start Loop all over again

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Return to Wii Menu. No need to free the Heap. #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

launch_menu:
call_nolink Wii_Menu

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#


Reply
#2
Y'all better use this it's a one of a kind Tongue

Great job!
Reply
#3
(04-18-2019, 08:45 PM)Dorian Wrote: Y'all better use this it's a one of a kind Tongue

Great job!

Thanks Dorian.  Tongue
Reply
#4
Bump, the code (if user option is 0 or 1) now makes licenses for your data save if the particular license slot doesn't have one made beforehand.
Reply
#5
Huge Bump!

The code will now make changes to every data save you have on your NAND Wink
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)