Can't disable codes.

Started by toonlink444, January 26, 2011, 11:17:39 PM

Previous topic - Next topic

toonlink444

I can't disable any codes made with ASM. I know this because when I use an ASM code made or not made by me I can't disable it unless I turn the wii off. This is in ssbb and maybe in other games. oh yeah I'm using Gecko dotNet
In the begining there was nothing. Then it exploded
New blog!! Check it out for hacking Smash Bros Brawl!! http://letshackblank.blogspot.com/

dcx2

You may need to unhook C2 codes.

A C2 code replaces the hook address with a branch.  If you disable the codes, the branch is still there, but your C2 code is gone!  So the game crashes.

To unhook a C2 code, replace the hook address with the original instruction, aka the anti-code.

toonlink444

But even premade codes don't work. I'm I suppsed to edit them?
In the begining there was nothing. Then it exploded
New blog!! Check it out for hacking Smash Bros Brawl!! http://letshackblank.blogspot.com/

dcx2

C2 codes are not designed to be disabled.  So yes, if you wanted to disable a C2 code, you'd have to edit the code yourself.

toonlink444

Is there a off on code I can insert into a code or a prefix to cut it off. because I might not know the origanal instruction
In the begining there was nothing. Then it exploded
New blog!! Check it out for hacking Smash Bros Brawl!! http://letshackblank.blogspot.com/

dcx2

You have to know the anticode (original instruction)

If you don't know it, you'll have to start the game without the code, and look at the hook address.

Usually, but not always, the anti-code is the last real instruction before the end of the C2 code.  Because all C2 codes should make sure they execute the instruction that they're replacing.

toonlink444

The hook address???(noob question)
In the begining there was nothing. Then it exploded
New blog!! Check it out for hacking Smash Bros Brawl!! http://letshackblank.blogspot.com/

dcx2

A C2 code "hooks" the ASM at a specific address.

For instance, C2345678 would hook the address 80345678.

toonlink444

so my 99 lives in stock code is
C281C544 00000001
38600063 00000000

to disable it the code will be
8081C544 00000001
38600063 00000000
In the begining there was nothing. Then it exploded
New blog!! Check it out for hacking Smash Bros Brawl!! http://letshackblank.blogspot.com/

dcx2

No.

Whatever instruction existed at the address 8081C544 before your hook was applied will need to be put back there.  It was probably an lwz or something, right?

Also, if your C2 code consists of a single instruction, you can write that instruction with an 04 code.  A C2 is only needed if you have *multiple* ASM instructions that you want to run.

The following code achieves the same effect as your C2

0481C544 38600063

toonlink444

OK so to find lwz would you set a breakpoint at the hook address?
In the begining there was nothing. Then it exploded
New blog!! Check it out for hacking Smash Bros Brawl!! http://letshackblank.blogspot.com/

toonlink444

Ok but if you want to disable someone elses do you manualy have to find the oniganal address
In the begining there was nothing. Then it exploded
New blog!! Check it out for hacking Smash Bros Brawl!! http://letshackblank.blogspot.com/

dcx2

nonono.

If you want to disable a C2 code someone else wrote, you do not need to find their address.  The address is given to you for free.  It's the address part of the C2, the same way you get an address out of an 04 write.  Your C2 code began with C281C544; so I know your address is 8081C544.

However, if you use someone else's C2, you do need to find the instruction that used to live there.  This is as simple as booting the game with no codes and looking at the address in Memory Viewer.  The value in that cell is your original instruction in binary.  That's the tricky part.

---

The hook address is the address where you want your ASM to run.  You probably found this address using a breakpoint.  In this case, the hook address is 8081C544.  That's why your C2 code starts with C281C544.

Before you apply any codes, there's an instruction that lives at the hook address.  It is the "original instruction" aka anticode.

I guessed that you used a read breakpoint to find the hook address.  So the original instruction at that address was probably an lwz.  In fact, it's probably lwz r3, or something of that nature.

If you look at that address after applying your C2 code, it won't be an lwz anymore.  The original instruction does not live at the hook address anymore; it was evicted and the C2 code put a b there (which stands for "branch always").  The b will make the CPU take a detour to your C2 code's ASM before coming back.  If you simply disable a C2 code, then the detour sign is still up, but the road now goes off a cliff!  That makes the CPU crash.

Your C2 code consists of one instruction; li r3,99.  You could simply use an 04 write to put this instruction at the hook address, because it's only a single instruction.  C2 codes are for complex operations that require more than a single ASM instruction to be changed.

When writing such a code that only requires a single instruction change, you can go to it in the Disassembler, and then type the new instruction that you want to replace it in the One Line Assembler box.  It will automatically change that instruction for you.  Then, you can right-click the new instruction and select "GCT Code" and it will create an 04 code that writes the selected instruction to that address.

dcx2

Okay, let's take Sharkbyte's levitate code for Hot Wheels.

This is the line he uses to write the anti-code.

04583C24 D3A30134

He probably used a write breakpoint to find the ASM address 80583C24.  This is what the Disassembler probably looked like for that line if you had no C2 code applied.

80583C24: D3A30134      stfs f29,308(r3)

The green value is the original instruction.  D3A30134 might look like 8 random digits to you, but to a PowerPC processor it means stfs f29,308(r3).  They are one and the same.

The first part of the code is always writing the original instruction back.  The C2 code runs depending on the switch; don't worry about understanding switches for now, just know the C2 sometimes runs and sometimes doesn't.  If the C2 runs, then that line in the Disassembler will be changed to a b instead of the original stfs.  I use .'s for digits that will probably be different.

80583C24: 48......      b 0x8000....

One thing to note is that the anti-code is quite often actually a part of the real code.  This is because you should make sure that you execute the instruction that the C2 code's branch replaced, otherwise the game could get messed up.

C2583C24 00000003
3D8041C0 91830134
C3A30134 D3A30134
60000000 00000000

Bully@Wiiplaza

lol this isn´t really that hard.

let´s say, the instruction on adress 80123456 is stw r0,0 (r1)

You replaced it with nop, which does nothing.

To disable this code, put stw r0,0 (r1) back to adress 80123456, where your nop can be seen.
Keep playing and the code is OFF.

My Wii hacking site...
http://bullywiihacks.com/

My youtube account with a lot of hacking videos...
http://www.youtube.com/user/BullyWiiPlaza

~Bully