WiiRd forum

USB Gecko Related => Gecko OS & USB Gecko => Topic started by: Mathew_Wi on April 24, 2010, 04:18:52 AM

Title: Hacking Gamecube Games?
Post by: Mathew_Wi on April 24, 2010, 04:18:52 AM
(Don't use backups)
Title: Re: Hacking Gamecube Games?
Post by: WiiPower on April 24, 2010, 10:10:57 AM
Can you boot a retail disc with it? I need the memory 0x80001800-0x80003000 when running a game from the Gecko OS for gamecube edition. I'm trying to make it easier to use Ocarina/Wiird for gamecube games, but it won't lead to Ocarina/Wiird for backups.
Title: Re: Hacking Gamecube Games?
Post by: biolizard89 on May 14, 2010, 06:55:54 AM
Quote from: WiiPower on April 24, 2010, 10:10:57 AM
Can you boot a retail disc with it? I need the memory 0x80001800-0x80003000 when running a game from the Gecko OS for gamecube edition. I'm trying to make it easier to use Ocarina/Wiird for gamecube games, but it won't lead to Ocarina/Wiird for backups.
Hi WiiPower, did you ever get the dump of that memrange?  If you still need it, there's a chance I could get it for you (I'm definitely interested in Ocarina/WiiRd for GameCube).  Let me know.  (And I'm curious, why is it apparently so hard to make Ocarina/WiiRd work with GameCube backups?  I was under the impression that the cMIOS would handle it so that it looks like an original disc to the GeckoOS game launcher, but clearly that is not the case.  Any explanation why?)
Title: Re: Hacking Gamecube Games?
Post by: WiiPower on May 14, 2010, 10:50:57 AM
I still want it. Can't you just dump the memory 0x80001800-0x80003000 in Wiird?

Ocarina + backups on softmod is not possible, because the MIOS just boots the game and doesn't do anything when the game is running! The backup launching works by patching the read calls to use other read calls that are written to 0x80001800.
Title: Re: Hacking Gamecube Games?
Post by: ultrafoxus on May 14, 2010, 01:34:07 PM
this is very good information  ;D ;D
Title: Re: Hacking Gamecube Games?
Post by: biolizard89 on May 16, 2010, 12:40:59 AM
I'm not sure if Mathew_Wi was able to dump it yet, but if not, here is the dump: http://biolizard89.looking-glass-house.com/usbgecko/gcncodehandler.bin  (Thanks to my brother, Super Martio, for letting me use his Wii to get the dump.)

Hope this helps you out; I'd love to be able to use Ocarina/WiiRd on the GameCube without having to boot the old GeckoOS disc I burned.
Title: Re: Hacking Gamecube Games?
Post by: WiiPower on May 19, 2010, 03:49:53 PM
Thank you very much. I got Wiird to work on F-Zero now. I think this confirms that the new code handler is not compatible with GC games.

If i knew the code list start for this code handler i could do some tests with Ocarina.
Title: Re: Hacking Gamecube Games?
Post by: giantpune on May 19, 2010, 09:40:31 PM
since you can hook the game with wiird, why not just upload a GCT file full of 0x69696969 or something. then just look for your 0x69696969 and the gct header and youre all set.
Title: Re: Hacking Gamecube Games?
Post by: dcx2 on May 19, 2010, 11:04:24 PM
I think the code region is prefixed with a few 0xC0DE's.  So you could also try doing a 16-bit search for C0DE
Title: Re: Hacking Gamecube Games?
Post by: WiiPower on May 22, 2010, 07:22:55 PM
The code list start for this code handler is 0x800027B0 and the codes work as well when no usb gecko is connected. Now i need to pass the codes from wii mode to gc mode, should be easy, but it's some work to do.

The loader for you guys is going to take a while longer, but i still plan to release one.
Title: Re: Hacking Gamecube Games?
Post by: wiiztec on May 23, 2010, 12:07:51 AM
You're making a gamecube ocarina for people without USB Geckos?
Title: Re: Hacking Gamecube Games?
Post by: WiiPower on May 23, 2010, 12:38:28 AM
Quote from: wiiztec on May 23, 2010, 12:07:51 AM
You're making a gamecube ocarina for people without USB Geckos?

Yes. And Wiird with just Wii + usb gecko, without additional crap. It's actually pretty easy and i wonder why nobody else did make it.
Title: Re: Hacking Gamecube Games?
Post by: WiiPower on May 23, 2010, 01:39:07 PM
Done. My loader supports Ocarina on gamecube games now, but the non backup related release is taking a while.
Title: Re: Hacking Gamecube Games?
Post by: giantpune on May 23, 2010, 06:27:44 PM
what hooks did you get?  i just fired up nuke's "usb client 1.0 beta 5 'cheat edition' " and it has several different hooktypes available for GC games.
Pad Read
Verticle Blank
Verticle Blank Set Next
Title: Re: Hacking Gamecube Games?
Post by: WiiPower on May 23, 2010, 06:34:32 PM
If you could get me the code for those hooks, i will add them. I'm using some VI hook i found commented in freedom's source. Too bad the hooks Nicksasa created for me don't work. Hmm, maybe you can create some? First you should try to recreate one of the wii hooks, and then use the symbol file found on the Mario Sunshine disc to create GC hooks. Well if you want to.
Title: Re: Hacking Gamecube Games?
Post by: giantpune on May 23, 2010, 07:21:34 PM
if i had any idea how these tools were meant to be used, id give it a try.  i have the geckoclient.exe and it can connect to my usb gecko fine.  but i have no idea what app it expects to be running on the wii.   it came with geckoregionfree 1.3 and a main.dol.
ive tried these...
geckoRF 1.3 --  (packaged with the exe file im trying) code dumps when trying to load a GC game
geckoOS 1.7 (wii) -- talks with geckoclient.exe enough to dump GC saves.  but doesnt respond to me trying to start any type of game
geckoOS 1.7 (GC) -- doesnt respond to commands from the exe
GeckoOS 1.9.3.1  -- doesnt respond to commands from the exe

im sure that if i could figure out which app needs to be running to get it to hook the games and load them, i could find the hooks in it.
Title: Re: Hacking Gamecube Games?
Post by: biolizard89 on May 23, 2010, 08:32:04 PM
Quote from: WiiPower on May 23, 2010, 01:39:07 PM
Done. My loader supports Ocarina on gamecube games now, but the non backup related release is taking a while.
Nice, thanks for your work on this.

I don't know much about hooks, but I believe that GCNrd was able to hook using the pad read.  Not 100% sure on that, but if that is correct, I could take a RAM dump of a GameCube game and post it along with a decrypted AR hook code that I made with a GCNrd hook a few years ago.  I assume that would get you what you need, at least for that hook type?  (I'd also post the CodeJunkies AR hook code, which is different, so you'd possibly get 2 hook types.)

Let me know if you're interested.
Title: Re: Hacking Gamecube Games?
Post by: 111 on May 23, 2010, 08:41:11 PM
Thanks for this!  Been hoping for something like this for awhile.

A somewhat unrelated question, but I was wondering how difficult it would be to make a version of the Twilight Hack for the GameCube version of Twilight Princess, that would boot into a program like the GameCube version of GeckoOS?  I remember that Nuke had talked about this a long time ago, but it apparently never came to be.  Perhaps it could be installed to a GameCube Memory Card by using one of those Wii homebrew applications, or even something like a USB device to connect the Memory Card to a computer.  This could potentially allow two things...

1.  To run it, and use codes, without a custom MIOS.  (I personally prefer not to install many "custom" things to the Wii, although I wouldn't have a problem in this case.)

2.  It would potentially allow you to run homebrew code on an actual GameCube console.

One negative that I see is that you would need to have something like an SD Gecko, to connect an SD card to the Memory Card slot.  Anyway, just curious about how difficult it may be to create a GameCube version of the Twilight Hack.
Title: Re: Hacking Gamecube Games?
Post by: biolizard89 on May 24, 2010, 01:31:47 AM
Quote from: biolizard89 on May 23, 2010, 08:32:04 PMNice, thanks for your work on this.

I don't know much about hooks, but I believe that GCNrd was able to hook using the pad read.  Not 100% sure on that, but if that is correct, I could take a RAM dump of a GameCube game and post it along with a decrypted AR hook code that I made with a GCNrd hook a few years ago.  I assume that would get you what you need, at least for that hook type?  (I'd also post the CodeJunkies AR hook code, which is different, so you'd possibly get 2 hook types.)

Let me know if you're interested.
Actually, I just dug through my files and found what I think are the hooks that GCNrd uses.  There are 4 revisions of the PADRead routine that show up in games; I suppose you would need to try all 4 of them when booting the game to reliably hook PADRead.

#Data for ahook command
ahook.0 = {
#PADRead() #Kernel:  Jul 19 2001  05:43:42
38000000   #li      r0, 0
9815000A   #stb     r0, 0xA(r21)
A0150000   #lhz     r0, 0(r21)
5400066E   #rlwinm  r0, r0, 0,25,23
B0150000   #sth     r0, 0(r21)
3AF70001   #addi    r23, r23, 1
2C170004   #cmpwi   r23, 4
3B7B0004   #addi    r27, r27, 4
3B5A0002   #addi    r26, r26, 2
3B39000C   #addi    r25, r25, 0xC
3AB5000C   #addi    r21, r21, 0xC
4180FD38   #blt     label_up
7EC3B378   #mr      r3, r22
BAA1001C   #lmw     r21, 0x48+var_2C(sp)
8001004C   #lwz     r0, 0x48+arg_4(sp)
38210048   #addi    sp, sp, 0x48
7C0803A6   #mtlr    r0
}
ahook.1 = {
#PADRead() #Kernel:  Oct  2 2001  11:02:22
38000000   #li      r0, 0
981F000A   #stb     r0, 0xA(r31)
A01F0000   #lhz     r0, 0(r31)
5400066E   #rlwinm  r0, r0, 0,25,23
B01F0000   #sth     r0, 0(r31)
3AB50001   #addi    r21, r21, 1
2C150004   #cmpwi   r21, 4
3B18000C   #addi    r24, r24, 0xC
3BFF000C   #addi    r31, r31, 0xC
4180FCC0   #blt     label_up
7EC3B378   #mr      r3, r22
00000000   #bl      OSRestoreInterrupts
7E83A378   #mr      r3, r20
BA810018   #lmw     r20, 0x48+var_30(sp)
8001004C   #lwz     r0, 0x48+arg_4(sp)
38210048   #addi    sp, sp, 0x48
7C0803A6   #mtlr    r0
}
ahook.2 = {
#PADRead() #Kernel:  Jun  5 2002 02:09:12  -  Sep  5 2002 05:34:25  -  Mar 17 2003 04:20:41
38000000   #li      r0, 0
981F000A   #stb     r0, 0xA(r31)
A01F0000   #lhz     r0, 0(r31)
5400066E   #rlwinm  r0, r0, 0,25,23
B01F0000   #sth     r0, 0(r31)
3AB50001   #addi    r21, r21, 1
2C150004   #cmpwi   r21, 4
3B18000C   #addi    r24, r24, 0xC
3BFF000C   #addi    r31, r31, 0xC
4180FCC8   #blt     label_up
7EC3B378   #mr      r3, r22
00000000   #bl      OSRestoreInterrupts
7E83A378   #mr      r3, r20
BA810020   #lmw     r20, 0x50+var_30(sp)
80010054   #lwz     r0, 0x50+arg_4(sp)
38210050   #addi    sp, sp, 0x50
7C0803A6   #mtlr    r0
}
ahook.3 = {
#PADRead() #Kernel:  Jul 23 2003 11:27:16
38000000   #li      r0, 0
9817000A   #stb     r0, 0xA(r23)
A0170000   #lhz     r0, 0(r23)
5400066E   #rlwinm  r0, r0, 0,25,23
B0170000   #sth     r0, 0(r23)
3B390001   #addi    r25, r25, 1
2C190004   #cmpwi   r25, 4
3B9C000C   #addi    r28, r28, 0xC
3AF7000C   #addi    r23, r23, 0xC
4180FD6C   #blt     label_up
7F43D378   #mr      r3, r26
00000000   #bl      OSRestoreInterrupts
7F03C378   #mr      r3, r24
BAC10018   #lmw     r22, 0x40+var_28(sp)
80010044   #lwz     r0, 0x40+arg_4(sp)
38210040   #addi    sp, sp, 0x40
7C0803A6   #mtlr    r0
}


Hope this helps!