MEM2 Code Making help needed

[g6flavor]

I need help making a code that's in the MEM2 Range.

I know that 8, 16, 32bit codes starts with 00,02,04 followed by address (6digits long) example 8bit = 00xxxxxx
But, what if the address is 7 digitals long

For example if the memory address in wiird is
91531490 with value 000003E7

How do I make that into a code?

[TNTkryzt]

If I'm not mistaken, you'd use 0x91xxxxxx as the base address (ba);

(in example Mem2 16bit write (ba))
42000000 91000000
02531492 000003E7
E0000000 80008000

as for 0x81xxxxxx the Constant Write code type must be incremented, ie; 32bit value write (04) becomes 05.
Mind you I've been using an old version of WiiRD so the handler may have changed.

[brkirch]

If I'm not mistaken, you'd use 0x91xxxxxx as the base address (ba);

(in example Mem2 16bit write (ba))
42000000 91000000
02531492 000003E7
E0000000 80008000

ba is aligned to be divisible by 0x2000000, so 91000000 won't work as expected.  It should instead be:

42000000 90000000
03531490 000003E7
E0000000 80008000

Of course, that is assuming that you want a 16-bit write.  For 32-bit it would be:

42000000 90000000
05531490 000003E7
E0000000 80008000

Alternatively, you could use po (this example does a 32-bit write):

4A000000 91531490
14000000 000003E7
E0000000 80008000

Or you could use po like this, it would work since po isn't realigned:

4A000000 91000000
14531490 000003E7
E0000000 80008000

Mind you I've been using an old version of WiiRD so the handler may have changed.

WiiRD doesn't load the code handler into memory, Gecko OS does.  Only the Gecko OS version will make a difference in regards to which codes do or don't work.

[TNTkryzt]

In that case I had better update my gecko OS  :eek:
For the "92" and "93" areas, you would use the "92 ba/po" plus incrementing the code type for "93" area.

(0x92531492) 16bit ba
42000000 92000000
02531492 000003E7
E0000000 80008000

(0x93531492) 16bit ba
42000000 92000000
03531492 000003E7
E0000000 80008000

[g6flavor]

Obviously, I failed on making the code since the address changes on every boot and using Pointer Search didn't yield any results. But those infos should come in handy in the future...Thank You both!

[TNTkryzt]

Just place a read breakpoint on the address and trace back to see how the address is fomulated, thats how I do it.

[g6flavor]

I tried to use a breakpoint...it does prevent the value from decreasing but it also affects the game making it unable to advance after nop the breakpoint address.

[TNTkryzt]

The breakpoint suggestion was so you could find a pointer for the address. Which game is it, I may have it and could help if not, just post the routine of the address you broke on. For read and write breaks if possible.

[g6flavor]

It's a max Coupon code for Pokemon Battle Revolution (U) [RPBE01] and the address is always in between 91909300 to 91909400.
I found the address and then right click it and choose BreakPoint, then goto the Break Point tab, choose Write and click on Set....you need the infos in the assembly box?

[TNTkryzt]

Nah I don't have that game. Just post the line it breaks on and preferably a couple of lines before the line it broke at.

[g6flavor]

Ok, I put down the address then Set Breakpoint to Read and found these results

80167624 7CA5002E      lwzr      r5, r5, r0
80167628 80C40004      lwz       r6, 4 (r4)
8016762C 209D0020      subfic   r4, r29, 32
80167630 5C70103A      rlwinm   r0, r30, 2, 0, 29
80167634 3863E4A0      subi      r3, r3, 7008

If I nop this address 80167624, I get tons of Coupons, over 9mil but couldn't get out of the shop.

Set Breakpoint to Write and found these results

80167538 90050000                          stw      r0, 0 (r5)
8016753C 41800068                          blt-      0x801675a4
80167540 38E6FFE0                          subi      r7, r6, 32
80167544 80C50004                          lwz       r6, 4 (r5)
80167548 5E0103A (<missed1digit)      rlwinm   r0, r7, 2, 0 ,29

If I nop this address 80167538 Coupons won't decrease when buying something, but you can't go into any battles.

One possible solution I can think of is use Button Activate (nop, un-nop), but if there's another better solution to it then it would be even better.

[TNTkryzt]

The routines are most likely used by other function calls, I'll be getting the game soon so I can have a closer look at it.

Ok, I had a look at it and the routines load and store to other areas of the block so you're better off branching off to your own routine where you'd need to run a check.

The following sub-routine will run a check on r27, which is when the desired address is present in r5, which we'll be writing our new value too.

817F3000:  2C1B0002   cmpwi   r27,2
817F3004:  40820008   bne-   0x817f300C
817F3008:  3800270F   li   r0,9999
817F300C:  90050000   stw   r0,0(r5)
817F3010:  4A97452C   b   0x8016753C

80167538:  4968BAC8   b   0x817f3000

Have 9,999 Coupons
077F3000 00000014
2C1B0002 40820008
3800270F 90050000
4A97452C 00000000
04167538 4968BAC8

..or you could target the main calculation;
8014211C:  7C9E1850   sub   r4,r3,r30

and either nop it or have it increase your coupons when buying
8014211C:  7C83F214   add   r4,r3,r30

Spend to Increase Coupons
0414211C 7C83F214

PP address
803BAD08:  7C170050   sub   r0,r0,r23

Incidently, here's a pointer to the main poke block pointers;
[80628890]
+30h = plyr [+2d42 =strength] [+2d8c =HP]

[g6flavor]

Not quite understand what all those stuff means but I tested the 9999 Coupon code and it works good. Thanks! You should post the codes in the USA Codes section or database to get credit.

[TNTkryzt]

Turns out this game was already hacked by juan.

http://wiird.l0nk.org/forum/index.php?topic=1510.0

[g6flavor]

They are different codes and ported from Zit's...and some people have problems when used both codes together.