String Writes in ASM

Started by Bully@Wiiplaza, February 08, 2012, 10:14:34 AM

Previous topic - Next topic

Bully@Wiiplaza

Is there some general and efficient way of doing string writes in ASM? (like the WiiRd 06 codestype)
I don´t want to lis, ori & stw all the time to write longer strings...

After I read this -> http://wiird.l0nk.org/forum/index.php/topic,7952.0.html
I´m still not sure how to use it like dcx2 & Y.S. did.

I basically need a template where I paste the string lines directly (like on 06 codes) and also insert the assembly address (and if needed, the characters to write). That would make it a C2 code. Hope someone can help with this. ;D
My Wii hacking site...
http://bullywiihacks.com/

My youtube account with a lot of hacking videos...
http://www.youtube.com/user/BullyWiiPlaza

~Bully

megazig

#1
not sure I get exactly what you're going for, but:

li r3, stringlength;
mtctr r3
addi r4, r4, -1;
addi r5,r5,-1;

loop:
lbu r3, 1(r5)
stbu r3, 1(r4)
bdnz loop


you could make something like that a macro. you could also make it a strnlen based loop and check for lbu grabbing a 0

edit: stupid fix (used subi and -1)

Bully@Wiiplaza

Quote from: megazig on February 08, 2012, 04:13:04 PM
not sure I get exactly what you're going for, but:

li r3, stringlength;
mtctr r3
addi r4, r4, -1;
addi r5,r5,-1;

loop:
lbu r3, 1(r5)
stbu r3, 1(r4)
bdnz loop


you could make something like that a macro. you could also make it a strnlen based loop and check for lbu grabbing a 0

edit: stupid fix (used subi and -1)
yeah, I need some way to write strings in ASM by only pasting the string like on a 06 code.
To make things easier, I invent a quick example for which I need a template in ASM.

06123458 00000010
42756C6C 79405769
69706C61 7A610000
# Write "Bully@Wiiplaza"

Now I e.g. set a BP Read on Address 80123458 and receive the following:

80567890: lbz r0, 0 (r3)

while Register 3 also has the value of 80123458 when Register 20 has value 0.

Hook: 80567890

cmpwi r20, 0
bne- _NOWRITE

"ASM for Write Bully@Wiiplaza"

_NOWRITE:
lbz r0, 0 (r3)
My Wii hacking site...
http://bullywiihacks.com/

My youtube account with a lot of hacking videos...
http://www.youtube.com/user/BullyWiiPlaza

~Bully

dcx2

Use the ASM to set a flag.  The code handler can check that flag and execute the string write conditionally.

---

cmpwi r20, 0
bne- _NOWRITE
# set a flag in gr0
_NOWRITE:
lbz r0, 0 (r3)


28 code type on gr0 testing for flag
06 string write
E0 terminator
04 write to clear gr0

EDIT: moved the clear-flag to after the Gecko code types; the C2 code may not always execute, so if it executed once and then took a long time to execute, it would do a lot of string writes that you might not want it doing

Stuff

Here's a piece of my "Friend Sort" source code even though I think you've been answered.


stwu r1,-80(r1) ##I wasn't sure what would be safe. so 2 extra lines >.<
stmw r14,8(r1)

bl 0x34

##0x34 bytes of text

mflr r6
mr r20, r6
....
....
addi r6, r20, 0x27
add r7, r22, r8
addi r7, r7, 0x14
bl _READ
....
....
_READ:
lbzu r5, 1(r6)
stbu r5, 1(r7)
cmplwi r5, 0
bne -0xC
blr

It would've probably been a better idea to name it _COPY instead of _READ. I wanted to include the null byte in the copy as well, so the check is after the stbu. I also don't like using so much space. It might not be good practice, but I'm not compiling a whole game. I bl over my text so the LR points to my text. An 06 would put the text in some place as well as the codelist and then you want to copy from it. bl'ing over the text just has the text in the codelist for you to copy from.(or in my case, to/from).

Checking for null is good for unknown string length. I also used the "allocated space" to check for "button presses" and "button presses 1st time". It would probably be shorter and better than using gr to check.

cmpwi r20, 0
bne- _NOWRITE
bl ##some bytes

##Text here

mflr r12

lbzu r11, 1(r12)
stbu r11, 1(r3)
cmplwi r11, 0
bne -0xC

_NOWRITE:
lbz r0, 0 (r3)

That would be about 2 lines shorter.
.make Stuff happen.
Dropbox. If you don't have one, get it NOW! +250MB free if you follow my link :p.

Mod code Generator ~50% complete but very usable:
http://dl.dropbox.com/u/24514984/modcodes/modcodes.htm

Bully@Wiiplaza

#5
ah, this gave me an idea...

cmpwi r20, 0
bne- _NOWRITE

lis r12, 0x8000
stw r3, 0x1600 (r12) # store starting address of string write @ 80001600

_NOWRITE:
lbz r0, 0 (r3)

00001600 00000006 # Keep the 06 codestype
82200001 80001600 # Load our starting address in gr1
4E000000 00000000 # store pointer to next line?
06000000 000000YY # amount of letters to write in HEX
XXXXXXX XXXXXXX # write String

Though, I´ve the feeling that the 4E part won´t work, yet...

To me, dxc2´s template looks like if I only want the 06 write to do it´s job when my C2 code executes (once). But that´s not the point:
I´m assuming that my 06 address is dynamic and my C2 code should get me the right address each time. And where in memory are gecko registers stored?
My Wii hacking site...
http://bullywiihacks.com/

My youtube account with a lot of hacking videos...
http://www.youtube.com/user/BullyWiiPlaza

~Bully

Stuff

bl over the text. The LR will point to your text after that.

gr are at 80001808 to that + 0xF*4 iirc. And then blocks are right after that.
.make Stuff happen.
Dropbox. If you don't have one, get it NOW! +250MB free if you follow my link :p.

Mod code Generator ~50% complete but very usable:
http://dl.dropbox.com/u/24514984/modcodes/modcodes.htm

Bully@Wiiplaza

#7
Quote from: Stuff on February 09, 2012, 02:22:17 PM
bl over the text. The LR will point to your text after that.

gr are at 80001808 to that + 0xF*4 iirc. And then blocks are right after that.
how to put it?
The following doesn´t compile:

cmpwi r20, 0
bne- _NOWRITE
bl _END

Bully@Wiiplaza

_END:
mflr r12

lbzu r11, 1(r12)
stbu r11, 1(r3)
cmplwi r11, 0
bne -0xC

_NOWRITE:
lbz r0, 0 (r3)

Please make it with a concrete example this time, then I will understand how to do it for anything.
My Wii hacking site...
http://bullywiihacks.com/

My youtube account with a lot of hacking videos...
http://www.youtube.com/user/BullyWiiPlaza

~Bully

Stuff

oh oops. You can use .string "string here" and it'll compile with the string and branch properly. But for some reason it adds a null byte at the end AND if it's not a multiple of 4 it won't compile with other instructions. So you have to add \0 until it's a multiple of 4. Bully@WiiPlaza is 14 bytes + 1 null byte = 15. You need to add \0 to it. Stuff is 5+1 null = 6 so it needs \0\0 added to it.
.string "Stuff\0\0"
etc.

Instead of counting characters, I would just compile until it's ok. I wonder if there's a better...class than string.

This is your code. It looks like you expect r3 to point to the destination. It'll copy your string ending with 00.

cmpwi r20, 0
bne- _NOWRITE
bl _END

.string "Bully@Wiiplaza\0" ##compiles as 42756C6C 79405769
                                       ##                69706C61 7A610000

_END:
mflr r12

lbzu r11, 1(r12)
stbu r11, 1(r3)
cmplwi r11, 0
bne -0xC

_NOWRITE:
lbz r0, 0 (r3)
.make Stuff happen.
Dropbox. If you don't have one, get it NOW! +250MB free if you follow my link :p.

Mod code Generator ~50% complete but very usable:
http://dl.dropbox.com/u/24514984/modcodes/modcodes.htm

megazig

you can also use the .align directive to make sure it is 4byte aligned

Stuff

#10
That's fucken awesome. Never again will I use \0.

cmpwi r20, 0
bne- _NOWRITE
bl _END

.string "Bully@Wiiplaza" ##compiles as 42756C6C 79405769
.align 2                        ##                69706C61 7A610000

_END:
mflr r12

lbzu r11, 1(r12)
stbu r11, 1(r3)
cmplwi r11, 0
bne -0xC

_NOWRITE:
lbz r0, 0 (r3)

EDIT:
.align is a power of 2. So 2 is 2^2=4. I had 4 before.
.make Stuff happen.
Dropbox. If you don't have one, get it NOW! +250MB free if you follow my link :p.

Mod code Generator ~50% complete but very usable:
http://dl.dropbox.com/u/24514984/modcodes/modcodes.htm

Bully@Wiiplaza

#11
finally, that´s what I needed... ;D
Great, thx a lot guys! Brainstorming is win.
My Wii hacking site...
http://bullywiihacks.com/

My youtube account with a lot of hacking videos...
http://www.youtube.com/user/BullyWiiPlaza

~Bully