WiiRd forum

Wii & Gamecube Hacking => Wii Game hacking help => Topic started by: Patedj on April 13, 2011, 08:34:30 AM

Title: ASM Remote condition
Post by: Patedj on April 13, 2011, 08:34:30 AM
042E85C4 60000000 ---> nop timer
[spoiler]C2000B00 0000000E
9421FFB0 BDC10008
3DC0802E 61CE85C0
3DE0806F 61EF0CD8
3A000001 3A200002
91D20000 91F30000
2C130010 41A20024
2C130011 41A20008
48000029 A9720000
39800001 396C000B
B16E0000 48000015
A9720000 39800001
396CFFF5 B16E0000
B9C10008 38210050
60000000 00000000
[/spoiler]
ASM
[spoiler]stwu r1,-80(r1)
stmw r14,8(r1)
lis r14, -32722
ori r14,r14, 34240
lis r15, -32657
ori r15,r15,3288
li r16, 0x0401
li r17, 0x0402
stw r14,0(r18)
stw r15, 0(r19)
cmpwi r19, r16
beq SUBTRACT
cmpwi r19,r17
beq ADD
bl END
ADD:lha r11,0(r18)
li r12, 1
addi r11,r12,r11
sth r11, 0(r14)
bl END

SUBTRACT:
lha r11, 0(r18)
li r12, 1
subi r11,r12,r11
sth r11,0(r14)
END:
lmw r14,8(r1)
addi r1,r1,80[/spoiler]

Why isn't it working?
ASM2
[spoiler]stwu r1,-80(r1)
stmw r14,8(r1)
lwz r14, 62(r3)
lis r15, -32657
ori r15,r15,3288
li r16, 0x1
li r17, 0x2
stw r14,0(r18)
stw r15, 0(r19)
cmpwi r19, r16
beq+ SUBTRACT
cmpwi r19,r17
beq+ ADD
bl END
ADD:lha r11,0(r18)
li r12, 1
addi r11,r12,r11
sth r11, 0(r14)
bl END

SUBTRACT:
lha r11, 0(r18)
li r12, 1
subi r11,r12,r11
sth r11,0(r14)
END:
sth r14,62(r3)
lmw r14,8(r1)
addi r1,r1,80[/spoiler]
Function for NOP
[spoiler]802E859C:  9421FFA0   stwu   r1,-96(r1)
802E85A0:  7C0802A6   mflr   r0
802E85A4:  90010064   stw   r0,100(r1)
802E85A8:  39610060   addi   r11,r1,96
802E85AC:  4825875D   bl   0x80540d08
802E85B0:  7C7F1B78   mr   r31,r3
802E85B4:  880DD071   lbz   r0,-12175(r13)
802E85B8:  2C000000   cmpwi   r0,0
802E85BC:  40820014   bne-   0x802e85d0
802E85C0:  A803003E   lha   r0,62(r3)  -> read
802E85C4:  60000000   nop    -> addi r0,r0,r4
802E85C8:  B003003E   sth   r0,62(r3) -> write
802E85CC:  4800000C   b   0x802e85d8
802E85D0:  38000000   li   r0,0
802E85D4:  980DD071   stb   r0,-12175(r13)
802E85D8:  A80293BE   lha   r0,-27714(r2)
802E85DC:  A883003E   lha   r4,62(r3)
802E85E0:  7C040000   cmpw   r4,r0
802E85E4:  418000C4   blt-   0x802e86a8
802E85E8:  7C002050   sub   r0,r4,r0
802E85EC:  B003003E   sth   r0,62(r3)
802E85F0:  A883003C   lha   r4,60(r3)
802E85F4:  38040001   addi   r0,r4,1
802E85F8:  B003003C   sth   r0,60(r3)
802E85FC:  A88293BC   lha   r4,-27716(r2)
802E8600:  7C000734   extsh   r0,r0
802E8604:  7C002000   cmpw   r0,r4
802E8608:  418000A0   blt-   0x802e86a8
802E860C:  7C040050   sub   r0,r0,r4
802E8610:  B003003C   sth   r0,60(r3)
802E8614:  A8830032   lha   r4,50(r3)
802E8618:  38040001   addi   r0,r4,1
802E861C:  B0030032   sth   r0,50(r3)
802E8620:  3BC00001   li   r30,1
802E8624:  9BC50000   stb   r30,0(r5)
802E8628:  A8E293BA   lha   r7,-27718(r2)
802E862C:  A8A30032   lha   r5,50(r3)
802E8630:  7C053800   cmpw   r5,r7
802E8634:  41800074   blt-   0x802e86a8
802E8638:  A883006A   lha   r4,106(r3)
802E863C:  38040001   addi   r0,r4,1
802E8640:  B003006A   sth   r0,106(r3)
802E8644:  7C072850   sub   r0,r5,r7
802E8648:  B0030032   sth   r0,50(r3)
802E864C:  A8830034   lha   r4,52(r3)
802E8650:  38040001   addi   r0,r4,1
802E8654:  B0030034   sth   r0,52(r3)
802E8658:  9BC60000   stb   r30,0(r6)
802E865C:  4BDBE03D   bl   0x800a6698
802E8660:  4BF6C881   bl   0x80254ee0
802E8664:  A88293B4   lha   r4,-27724(r2)
802E8668:  A81F0034   lha   r0,52(r31)
802E866C:  7C002000   cmpw   r0,r4
802E8670:  40810038   ble-   0x802e86a8
802E8674:  B3DF0034   sth   r30,52(r31)
802E8678:  A87F0040   lha   r3,64(r31)
802E867C:  38030001   addi   r0,r3,1
802E8680:  B01F0040   sth   r0,64(r31)
802E8684:  7C030734   extsh   r3,r0
802E8688:  A80293B8   lha   r0,-27720(r2)
802E868C:  7C030000   cmpw   r3,r0
802E8690:  40810014   ble-   0x802e86a4
802E8694:  B3DF0040   sth   r30,64(r31)
802E8698:  A87F0042   lha   r3,66(r31)
802E869C:  38030001   addi   r0,r3,1
802E86A0:  B01F0042   sth   r0,66(r31)
802E86A4:  B09F006C   sth   r4,108(r31)
802E86A8:  A88293B4   lha   r4,-27724(r2)
802E86AC:  38000033   li   r0,51
802E86B0:  7C6023D6   divw   r3,r0,r4
802E86B4:  7C0321D6   mullw   r0,r3,r4
802E86B8:  23C00033   subfic   r30,r0,51
802E86BC:  3BA30001   addi   r29,r3,1
802E86C0:  7FE3FB78   mr   r3,r31
802E86C4:  38800001   li   r4,1
802E86C8:  4BDCFA4D   bl   0x800b8114
802E86CC:  7C7C0734   extsh   r28,r3
802E86D0:  7FE3FB78   mr   r3,r31
802E86D4:  38800007   li   r4,7
802E86D8:  4BDCFA3D   bl   0x800b8114
802E86DC:  7C7B0734   extsh   r27,r3
802E86E0:  7FE3FB78   mr   r3,r31
802E86E4:  38800000   li   r4,0
802E86E8:  4BDCFA2D   bl   0x800b8114
802E86EC:  7C7A0734   extsh   r26,r3
802E86F0:  7FE3FB78   mr   r3,r31
802E86F4:  38800005   li   r4,5
802E86F8:  4BDCFA1D   bl   0x800b8114
802E86FC:  7C600734   extsh   r0,r3
802E8700:  7C9BE800   cmpw   cr1,r27,r29
802E8704:  41850048   bgt-   cr1,0x802e874c
802E8708:  7C1CF000   cmpw   r28,r30
802E870C:  40810008   ble-   0x802e8714
802E8710:  4186003C   beq-   cr1,0x802e874c
802E8714:  2C1A0006   cmpwi   r26,6
802E8718:  40810014   ble-   0x802e872c
802E871C:  7C1CF000   cmpw   r28,r30
802E8720:  4082000C   bne-   0x802e872c
802E8724:  7C1BE800   cmpw   r27,r29
802E8728:  41820024   beq-   0x802e874c
802E872C:  2C00001E   cmpwi   r0,30
802E8730:  41800078   blt-   0x802e87a8
802E8734:  2C1A0006   cmpwi   r26,6
802E8738:  40820070   bne-   0x802e87a8
802E873C:  7C1CF000   cmpw   r28,r30
802E8740:  40820068   bne-   0x802e87a8
802E8744:  7C1BE800   cmpw   r27,r29
802E8748:  40820060   bne-   0x802e87a8
802E874C:  3861001C   addi   r3,r1,28
802E8750:  38800000   li   r4,0
802E8754:  7FE5FB78   mr   r5,r31
802E8758:  3CC08058   lis   r6,-32680
802E875C:  38C627D0   addi   r6,r6,10192
802E8760:  480000AD   bl   0x802e880c
802E8764:  38610030   addi   r3,r1,48
802E8768:  3881001C   addi   r4,r1,28
802E876C:  4800005D   bl   0x802e87c8
802E8770:  80610030   lwz   r3,48(r1)
802E8774:  80010034   lwz   r0,52(r1)
802E8778:  90610008   stw   r3,8(r1)
802E877C:  9001000C   stw   r0,12(r1)
802E8780:  80610038   lwz   r3,56(r1)
802E8784:  8001003C   lwz   r0,60(r1)
802E8788:  90610010   stw   r3,16(r1)
802E878C:  90010014   stw   r0,20(r1)
802E8790:  80010040   lwz   r0,64(r1)
802E8794:  90010018   stw   r0,24(r1)
802E8798:  481197D1   bl   0x80401f68
802E879C:  38800001   li   r4,1
802E87A0:  38A10008   addi   r5,r1,8
802E87A4:  48119E45   bl   0x804025e8
802E87A8:  387F00C4   addi   r3,r31,196
802E87AC:  48008461   bl   0x802f0c0c
802E87B0:  39610060   addi   r11,r1,96
802E87B4:  482585A1   bl   0x80540d54
802E87B8:  80010064   lwz   r0,100(r1)
802E87BC:  7C0803A6   mtlr   r0
802E87C0:  38210060   addi   r1,r1,96
802E87C4:  4E800020   blr   
[/spoiler]

Title: Re: ASM Remote condition
Post by: Patedj on April 13, 2011, 09:29:58 AM
The reason seems to be with my cmpwi and my beq... they won't branch.
Title: Re: ASM Remote condition
Post by: Patedj on April 13, 2011, 09:39:49 AM
V3 with injection directly in the sth's address
[spoiler]stwu r1,-80(r1)
stmw r14,8(r1)
lha r14, 62(r3)
lis r15, -32657
ori r15,r15,3288
lwz r19, 0(r15)
cmpwi r19, 1
beq- SUBTRACT
cmpwi r19,2
beq- ADD
bl END
ADD:
li r12, 1
addi r14,r12,r14
bl END

SUBTRACT:
li r12, 1
subi r14,r12,r14
END:
sth r14,62(r3)
lmw r14,8(r1)
addi r1,r1,80[/spoiler]

this is it's log[spoiler]
802E85C8:  4BD1A310   b   0x800028d8
   ...   ...   ...   ...
800028D8:  9421FFB0   stwu   r1,-80(r1)   r1 = 80F53A08   r1 = 80F53A08   [80F539B8] = 00000002
800028DC:  BDC10008   stmw   r14,8(r1)   r14 = 00000000   r1 = 80F539B8   [80F539C0] = 00000000
800028E0:  A9C3003E   lha   r14,62(r3)   r14 = 00000000   r3 = 8128E018   [8128E056] = 001EFFF3
800028E4:  3DE0806F   lis   r15,-32657   r15 = 00000000
800028E8:  61EF0CD8   ori   r15,r15,3288   r15 = 806F0000   r15 = 806F0000
800028EC:  826F0000   lwz   r19,0(r15)   r19 = 00000000   r15 = 806F0CD8   [806F0CD8] = 00000001
800028F0:  2C130001   cmpwi   r19,1      r19 = 00000001
800028F4:  4182001C   beq-   0x80002910
   ...   ...   ...   ...
80002910:  39800001   li   r12,1      r12 = 800292F0
80002914:  39CCFFF2   subi   r14,r12,14   r14 = FFFFFFF3   r12 = 00000001
80002918:  B1C3003E   sth   r14,62(r3)   r14 = FFFFFFF3   r3 = 8128E018   [8128E056] = 001EFFF3
8000291C:  B9C10008   lmw   r14,8(r1)   r14 = FFFFFFF3   r1 = 80F539B8   [80F539C0] = 00000000
80002920:  38210050   addi   r1,r1,80   r1 = 80F539B8   r1 = 80F539B8

802E85C8:  4BD1A310   b   0x800028d8
   ...   ...   ...   ...
[/spoiler]
This technically works but I want and add function so I'll make addi an add and see what happens
Title: Re: ASM Remote condition
Post by: Patedj on April 13, 2011, 10:06:13 AM
This works. I'll have to add to the r12 though adding and subbing is not fast enough.
[spoiler]stwu r1,-80(r1)
stmw r14,8(r1)
lha r14, 62(r3)
lis r15, -32657
ori r15,r15,3288
lwz r19, 0(r15)
cmpwi r19, 1
beq- SUBTRACT
cmpwi r19,8
beq- ADD
bl END
ADD:
li r12, 1
add r14,r12,r14
bl END

SUBTRACT:
li r12, 1
sub r14,r14,r12
END:
sth r14,62(r3)
lmw r14,8(r1)
addi r1,r1,80[/spoiler]

Time for sim3 Left button and up button changes the time (i'd like to make it b+up and b+left in v4)
[spoiler]042E85C4 60000000
042E85C8 B003003C
C22E85C8 0000000A
9421FFB0 BDC10008
A9C3003E 3DE0806F
61EF0CD8 826F0000
2C130001 4182001C
2C130008 41820008
48000019 39800001
7DCC7214 4800000D
39800001 7DCC7050
B1C3003E B9C10008
38210050 00000000
E0000000 80008000
[/spoiler]
Title: Re: ASM Remote condition
Post by: Patedj on April 13, 2011, 10:07:40 AM
V4 Age Timer for Sims3. It advances the time, but doesn't rewind the time. Nonetheless the age does I think.
[spoiler]042E85C4 60000000
042E85C8 B003003C
C22E85C8 0000000A
9421FFB0 BDC10008
A9C3003E 3DE0806F
61EF0CD8 826F0000
2C130401 4182001C
2C130408 41820008
48000019 3980000A
7DCC7214 4800000D
3980000A 7DCC7050
B1C3003E B9C10008
38210050 00000000
E0000000 80008000
[/spoiler]
Title: Re: ASM Remote condition
Post by: dcx2 on April 13, 2011, 02:00:36 PM
Quote from: Patedj on April 13, 2011, 09:29:58 AM
The reason seems to be with my cmpwi and my beq... they won't branch.

cmpwi r19, r16
beq+ SUBTRACT
cmpwi r19,r17
beq+ ADD

cmpwi = CoMPare Word Immediate.  Are r16 and r17 immediates?  Nope...they're registers.  You wanted cmpw.  Also, watch out for cmplw and cmplwi.  the L means "logical", this is used for *unsigned* comparisons, on numbers that are not interpreted as negative.

---

802E85C4:  60000000   nop    -> addi r0,r0,r4

r4 comes from the caller.  If you go to the caller's frame, you might be able to modify r4 before it is passed into this function.