WiiRd forum

Wii & Gamecube Hacking => Wii Game hacking help => Topic started by: Sharkbyte on February 06, 2010, 05:59:10 PM

Title: Help w/ Negative offset pointers
Post by: Sharkbyte on February 06, 2010, 05:59:10 PM
Do I write negative offset pointers any different than regular po? my address 1 is 810927E0 and address 2 is 8108D8A0. I only get results when I allow a negative offset. I checked one of the best results and found the other memory address and it seems to be responding as health goes down. I have the code as is
48000000 80412918
14000FB8 40800000
E0000000 80008000

with FB8 being a negative offset.
Title: Re: Help w/ Negative offset pointers
Post by: wiiztec on February 06, 2010, 09:01:19 PM
It's the same thing as a regular offset cept in the other direction, you subtract from the pointer address value address instead of adding to it, up in memveiwer instead of down
Title: Re: Help w/ Negative offset pointers
Post by: brkirch on February 07, 2010, 01:06:37 AM
IIRC there is no code type that directly supports negative offsets, but you can move the pointer value to a Gecko register, subtract the offset (by adding the two's complement (http://en.wikipedia.org/wiki/Two%27s_complement) of the negative offset) and move the Gecko register value back to po.

Try this:
82200000 80412918 # Load 80412918 to gr0
86000000 FFFFF048 # Add FFFFF048 to gr0 (Two's complement of -FB8)
4A001000 00000000 # Move gr0 to po
DE000000 80008180 # Checks that po is in the [80000000,81800000] range
66000001 00000000 # Skip next line if the code execution status is set to true
DE000001 90009380 # Endif, then checks that po is in the [90000000,93800000] range
14000000 40800000 # Set 32-bit value at po to 40800000
E0000000 80008000 # Code terminator, reset ba and po to 80000000


This code is untested, so let me know if you have any issues with it.
Title: Re: Help w/ Negative offset pointers
Post by: dcx2 on February 17, 2010, 05:33:40 PM
You could use an asm code type.  C2's require you to hook something, and if that hook isn't called every frame, then you could use a C0, which I think is executed during the code handler.  You'll need two unused registers to do it, but I'm not sure what registers are free during a C0 code (perhaps the code handler pushes all the registers onto the stack before executing C0's?)

This small assembly routine ought to do what you want.  To make it a code, I suggest asmwiird; it does C2 codes, but you can just replace the C2 line with a C0 line.  The only thing left, I think, is that C0's need to end with blr.

lis r0, 0x8041
ori r0, r0, 0x2918   # load pointer into r0
lis r3, 0x4080       # load value into r3
stw r3,-4024(r0)     # write the value from r3 to the address r0 - 4024
blr                  # terminator for C0 code type


Note that if your value had anything in the lower 16 bits, you would need to use an ori r3, r3, [value], similar to how r0 was loaded with the pointer 0x80412918.