Hey again,
this time I tried a teleportation code for The Legend of Zelda TP and I found the 3 axis.
Then I went to the next room and the coordinate adresses changed!!
Meaning that it was not working anymore. Has someone an idea, how I could manage this with ASM?
When I set multiple Breakpoints, the adress was almost always different! WTF
Nobody else ever made that code for the game, please help :eek:
(P.S. The new Geckodotnet fixed the freezing problem with all codes, yay so cool! :D)
try pointer search :rolleyes:
go to the memory viewer and search for it
for 3 different adresses?
That sucks! And I must use WiiRD... :o
Are the addresses beside each other in memory? If so, you only need to find whatever address is first, the add 4 to it to get the next coord in mem
btw it's axis, not achsis :P
yep, they are besides each other.
3 adresses in a row.
---
thanks for correcting my spelling mistakes xD
why different?
48000000 XXXXXXXX <-- pointer address
DE000000 XXXXXXXX <-- pointer check range
140000XX XXXXXXXX <-- value + pointer
140000XX XXXXXXXX <-- value + pointer
140000XX XXXXXXXX <-- value + pointer
E0000000 80008000
okay thanks for this fast help, I´ll try that and write again :P
as I don't 100% understand deathwolf, I'll give you an example:
48000000 PPPPPPPP
4A100000 RRRRRRRR
14000000 XXXXXXXX
14000004 YYYYYYYY
14000008 ZZZZZZZZ
E0000000 80008000
PPPPPPPP - Pointer address
RRRRRRRR - Pointer offset
XXXXXXXX - X coord
XXXXXXXX - Y coord
ZZZZZZZZ - Z coord
I didn't bother putting a pointer range check in, you should tho
Quote from: matt123337 on August 18, 2010, 11:30:29 PM
as I don't 100% understand deathwolf, I'll give you an example:
48000000 PPPPPPPP
4A100000 RRRRRRRR
14000000 XXXXXXXX
14000004 YYYYYYYY
14000008 ZZZZZZZZ
E0000000 80008000
PPPPPPPP - Pointer address
RRRRRRRR - Pointer offset
XXXXXXXX - X coord
XXXXXXXX - Y coord
ZZZZZZZZ - Z coord
I didn't bother putting a pointer range check in, you should tho
would freez because you forgot DE check line.
48000000 PPPPPPPP <--- pointer address
DE000000 XXXXXXXX <--- check line
4A100000 RRRRRRRR <--- RR pointer value + PPPP address
140000XX SSSSSSSS <--- SSSS value, XX pointer
140000XX YYYYYYYY <--- YYYY value, XX pointer
140000XX ZZZZZZZZ<--- ZZZZ value, XX pointer
E0000000 80008000
Quote from: Deathwolf on August 18, 2010, 11:35:18 PM
would freez because you forgot DE check line.
I know it would freeze
Quote from: matt123337 on August 18, 2010, 11:30:29 PM
I didn't bother putting a pointer range check in, you should tho
oh sry I didn't read this.
lol, I hardly do pointer codes so I thought I would eff it up :P the DE line would be:
DE000000 80008100
right? And the check should be below the line that adds the offset.
yes that's right^^
yay :)
I found a halftime working teleport code without Pointers (they were fail) :p
I just took the 2 places of the adresses and voila.
But it does not work everywhere, just in hyrule castle and maybe more.
Now, it changed again, not working :mad:
the instruction is not everytime the same
pointer it
- When I found coordinates, they go away, if I get link to another loading zone (door or whatever)
- Pointer search of the first coordinate gives me about 20 best results, but every result was without any offset!
Like this: [xxxxxxxx]
- Breakpoint Read and Write gave me everytime, it hit (which did always instantly) another adress with instructions!!
It must be possible to create this save/load coordinates code, isn´t it?
I am planless at the moment! :confused:
@Matthew_Wi:
Please try to help... :eek:
Quote from: Bully@Wiiplaza on August 19, 2010, 01:40:40 PM
- Pointer search of the first coordinate gives me about 20 best results, but every result was without any offset!
Like this: [xxxxxxxx]
Then the offset is 00000000, and there are probably multiple ASM routines that write to the coords. And what region is the game from?
Game Region = PAL
Issue = not solved yet!! :-\
did you try all pointers? If you did, and none of them work, you're going to make to make it a ASM code :( Do you know any ASM?
since you're going into different rooms every time a teleporter in one location would put you in a totally different location in another room.
hyrule field is much larger than a boss room. If you use a xyz coord set from hyrule field you could find yourself in an abyss D:
But the code should be useful to teleport around in the same room and not to teleport to other locations, because it will just give you a black "hell" if you do. May not be as useful as the code below.
---------------------------------
Another cool thing would be "freefly", you can increase the X,Y,Z buttons with specific buttons...
if they aren´t pressed, it stops writing at them.
Isn´t it fatal to find the coordinates and then you aren´t able to make anything out of it! <.<
Some Ideas from Mathew_Wi:
"I can give you a basic idea on how to do it. (Teleport part.)
I assume from the BP info you send, that r28 is the pointer for the Y coord.
So 80EFD3C0 + 1232 would be the Y coordinate address.
So, if that brings you to the Y. I can only assume X is left and Z is right next to it.
I don't know about the lifting/moving the character in mid air, seems like it would fail."
-----------------------------------
I´ll post the breakpoint later, the adress I got was always executed when I am by feet and NOT when I was sitting on Epona (horse)
could be correct though.
To sum it up:
- everytime the breakpoint hits, it´s another adress and instruction (doesn´t matter if using read or write)
- Pointer Search Fails, it doesn´t give me results (and I know how to do it: find the 1. coordinate, rightclick pointer 1, dump 80/90, where the code is (in this case: 80) Then move to another room and find the coordinates, dump pointer 2 from the 1st adress of the coordinates in the mem viewer again and click dump 80, then pointer search. -> No results also for Pointer in Pointer, I tried 2 times)
- Every other room, the adress moved, fail with direct RAM write (load in to gecko register)
damn... Should I better give up this time? I could never manage it by myself...
Look which epicness I could experience only by poking the 3 coordinates:
[spoiler]
http://img524.imageshack.us/i/rzdp01003.png/ -> stay IN things!
http://img207.imageshack.us/i/rzdp01004.png/ -> walk in them! (after you poked you inside)
http://img708.imageshack.us/i/rzdp01006.png/ -> super moonjump! (Poke with high Y Value)
[/spoiler]
You almost all do own the game, you could try for your own though, it´s a great challenge to create such float button activated increase/decrease ASM code!! :D Show us guys, who has learned a lot from all the hacking time xD
look at this address (it's a pointer):
804334D0
NOTE: at the time of posting this the pointer above took me to 80EFA2FC and i was in Faron Woods. I made the code below to store my co-ords in the gecko registers by pressing Z & C and then i could restore them by pressing Z & A
It just needs some work to make it use 804334D0
20433A6E 00006000
82200000 80EFA2FC <-- needs to read in pointer at 804334D0
82200001 80EFA300 <-- needs to read in pointer at 804334D0 + 0x4
82200002 80EFA304 <-- needs to read in pointer at 804334D0 + 0x8
E0000000 80008000
20433A6E 00002800
84200000 80EFA2FC <-- needs to write to pointer at 804334D0
84200001 80EFA300 <-- needs to write to pointer at 804334D0 + 0x4
84200002 80EFA304 <-- needs to write to pointer at 804334D0 + 0x8
E0000000 80008000
Ok, try this using Z&C to store and Z&A to teleport back
[Teleport]
20433A6E 00006000
48000000 804334D0
92210000 00000000
92210001 00000004
92210002 00000008
E0000000 80008000
20433A6E 00002800
48000000 804334D0
94210000 00000000
94210001 00000004
94210002 00000008
E0000000 80008000
Quote from: Panda On Smack on October 11, 2010, 02:18:53 PM
look at this address (it's a pointer):
804334D0
NOTE: at the time of posting this the pointer above took me to 80EFA2FC and i was in Faron Woods.
1.) wait, you tried this pointer and it seemed valid? :o
2.) Anyway, aren´t the button activators also working with 28?
3.) Also, should your posted code work like it is, or does it need other modifications on adresses and stuff?
4.) My breakpoint was from the PAL game, are you PAL,too?
Thx dude :p
I'm PAL also. I got the pointer from a Moon Jump code by Lunar so it should be fine.
http://wiird.l0nk.org/forum/index.php/topic,1109.msg20379.html#msg20379
Does the teleport code work for you?
Quote from: Panda On Smack on October 11, 2010, 05:42:07 PM
I'm PAL also. I got the pointer from a Moon Jump code by Lunar so it should be fine.
http://wiird.l0nk.org/forum/index.php/topic,1109.msg20379.html#msg20379
Does the teleport code work for you?
but I am not sure if it´s the same adress pattern...
I should try now and let you know ;)
Also, how would you make an x,z axis increase/decrease with dpad all 4 directions and levitate with A button (y increase), fall down with B (stop writing to y) code? This freefly would be godlike!!!
The codes serve different purposes, i just used his pointer
A free fly code would be possible i guess by loading the current x,y and z and adding to them etc
Quote from: Panda On Smack on October 11, 2010, 06:04:38 PM
The codes serve different purposes, i just used his pointer
A free fly code would be possible i guess by loading the current x,y and z and adding to them etc
yeah this is my aim, actually, besides the teleportation...
I can´t test today, but tomorrow hopefully
My teleportation code for SMG2 can also do "free-flying" (aka levitation). Here's how mine worked.
The Y axis of the left analog stick was used as a "throttle" so you could speed up and slow down the levitation. Otherwise you always levitate at the same speed and it is difficult to "land".
The orientation of the Wiimote was used to control the direction of levitation. (this should be easier in Zelda, because you aren't upside down half the time) This provided the full range of motion in XYZ axes.
Levitation was engaged by holding down the button combo for Restore Coordinates. So that way, when you were restoring coordinates, you could "adjust" the coordinates you were restoring, and this was in effect levitation.
Quote from: dcx2 on October 11, 2010, 07:08:15 PM
My teleportation code for SMG2 can also do "free-flying" (aka levitation). Here's how mine worked.
The Y axis of the left analog stick was used as a "throttle" so you could speed up and slow down the levitation. Otherwise you always levitate at the same speed and it is difficult to "land".
The orientation of the Wiimote was used to control the direction of levitation. (this should be easier in Zelda, because you aren't upside down half the time) This provided the full range of motion in XYZ axes.
Levitation was engaged by holding down the button combo for Restore Coordinates. So that way, when you were restoring coordinates, you could "adjust" the coordinates you were restoring, and this was in effect levitation.
seems to be useful, but very hard to use this features in a code, at least for me (I don´t even know, how you could find vertical/horizontal wiimote value position or Nunchuck Stick Activators). Is there a TuT, it makes code so much better! :P
Examples:
[spoiler]
Wiimote pitch controls flight speed [dcx2]
C23EB034 00000005
C02212D8 EC41082A
EC22102A EC22082A
3D808075 618C0A00
C04C0014 FC401210
EC2100B2 00000000
Shake Nunchuck to fly [dcx2]
C23EE754 00000005
A06306F8 3D808075
618C0A00 818C0074
3C003FA0 7C006040
41810008 38600007
60000000 00000000
[/spoiler]
!!!:o
You are right that you are seldomly upside down in Zelda, but sometimes you are! :o
If you are walking with the Iron Boots on the "blanket". It´s possible in one dungeon.
Anyway, I really should try your cool levitation/teleportations codes, I didn´t do it yet, but I wanted to once xDDDD. Freefly and Stalking Hack (Fly above another racer at will, also able to change victim) were so freaking funny in Mario Kart, you can´t imagine I bet. For sure, they are never used to hack for the win... it´s a lot funnier to mess around, if you have fun with such things :P
Wiimore orientation and Nunchuck analog stick values are stored as floats a small distance away from the address used for button activators. Open Gecko.NET, go to Memory Viewer, find your button activator's address, switch the View Mode to Single, and then move the analog stick. It will become readily apparent what address the analog stick values live at.
Using the same process, you can turn the Wiimote around and you will see the orientation data.
All the values will go from -1 to 1.
There's also another address that gets "big" (i.e. it goes from 0 to like 2.0 or 3.0) when you shake. This is how I did "shake nunchuck to fly".
cool, in the time you were posting, I edited exact the same codes, you were talking about to the spoiler xD
Is it before or after the actual button adress and are the values different in every game?
I think so...
This is the Teleporter/Levitation code for SMG2. It's disassembled so you can see the comments and such. I'll warn you...it can be overwhelming to look at.
http://wiird.l0nk.org/forum/index.php/topic,6517.msg55339.html#msg55339
Here are my notes from that game
Quotecontroller at 80750A00
button offset = 2
Y axis offset = 100
xyz orientation offset = 12/16/20
So that means that the typical Button Activator for SMG2 NTSC will be 80750A02. The Wiimote orientation data will be 80750A0C, 80750A10, and 80750A14. The nunchuck Y axis will be 80750A64. If you just go to a button activator address and look in Memory Viewer with auto-update and View Mode single, you'll see it.
Here's the part that levitates. I take the max speed, 32.0, and I scale it by the Y axis of the Nunchuck. No Y axis means 0 * 32 = 0 means no levitation. Full Y axis means 1 * 32 = 32. Half Y axis means 16. etc. This is the "scale"
Then, I set up a loop to process each axis. I read the Wiimote orientation of an axis, multiply it by the scale, and subtract it from the current position on that axis.
[spoiler]LEVITATE:
# r31 has pointer to data
# r12 still has controller pointer
# r30 has pointer to data coords
lfs f0,FLOAT_OFFSET(r31)
lfs f1,YAXIS_OFFSET(r12)
# f0 has max speed float stored in data area
# f1 has the value of the Y axis from p1's nunchuck
fmuls f0,f0,f1 # scale = max speed * Y axis
# set up a loop
# note that lfsu requires pointing 4 bytes _before_ the first value
li r0,3
mtctr r0
addi r31,r12,XYZ_ORIENT_OFFSET-4
subi r12,r30,4 # work on a cached copy of r30
# f0 has the scale value
# r31 has p1 wiimote orientation pointer
# r12 has a pointer to code's stored coordinates
TOP_OF_LOOP:
lfsu f1,4(r31)
lfsu f2,4(r12)
fnmsubs f1,f0,f1,f2 # f1 = coords â€" (scale * orientation)
stfs f1,0(r12)
bdnz+ TOP_OF_LOOP[/spoiler]
oh yeah, it was the thread I looked into and got scared of all the ASM instructions xD
MAYBE I can use this to create something useful out of this with my own skills... thanks for the stuff.
I was wondering, how you could force the game to think that you are permanentely shaking the Wiimote/Nuchuck or pressing a Button VERY fast, it can be useful for some games...
That code is just reading the values and adjusting the hack based on what it found. Convincing the game that buttons are being pressed when they aren't is more difficult.
You could do it, but you'd need to figure out where the game is reading the button data, and hook that.
Hmm I thought so, because direct RAM write or a breakpoint on the button adress doesn´t help without further researches (like "calling the stack") yeah I read your tut... :) Let´s call it a day now.
I decided to try and find the hookshot cursor X,Y and Z to see if it was usable in terms of teleporting and it turns out it is.
Hold B to bring up the hookshot cursor and aim where you want then with that held down press Z to store where its pointing and press C to move there.
[Telehook]
20433A6C 00002400
48000000 804334D0
92210000 00001BC0
92210001 00001BC4
92210002 00001BC8
E0000000 80008000
20433A6C 00004400
48000000 804334D0
94210000 00000000
94210001 00000004
94210002 00000008
E0000000 80008000
http://www.youtube.com/watch?v=_Kl5n8su7iQ
dude... you are a genious.
AWESOME! ;D
Thank you so much :D
no worries, would be even better if I can find the normal fairy cursor so you don't need the hook shot out to do it
Quote from: Panda On Smack on October 22, 2010, 04:36:18 PM
no worries, would be even better if I can find the normal fairy cursor so you don't need the hook shot out to do it
I tried it out, and if I teleport with C, I always fall down and I am under the stage.
Why? I pressed B+ Z ON the stage... :o
Nice, reminds me of the P2GrabWarp I made for SMG2...P2 would click on an enemy or coin or item, and P1 could warp to there.
I don't know that the normal fairy cursor will give you a 3d coordinate like you want. The hookshot probably has a "clipping" range, i.e. the game tries to figure out how far the hookshot can go, and when it finds the answer it stores a 3d coordinate for that point, and that's probably what you found. For instance, does the telehook work if you don't have the yellow crosshair?
I'll see if I can mod this into a levitation code, too. Though I'd need someone else to test.
Bully...try and point at the floor if possible as if you point at walls you often appear in them and end up falling out of the map
I'm sure its possible to make the code compare you current coordinates to the pointer and deduct some so that you teleport just short of the target
Thanks for the info dcx, let me know what you come up with