Button and if codes in ASM [Enable/Dissable]

Started by Deathwolf, July 21, 2010, 07:27:14 PM

Previous topic - Next topic

dcx2

Alright, fine, don't listen to me, but don't act surprised if your code doesn't work.

The vast majority of button activators I ever see are the last 16-bits of their corresponding 32-bit word.  For instance, SMG2 is 28750A02.  SMG is 2861D342.  And so on.

      0  1  2  3
i.e. 0000XXXX where XXXX is the buttons.

A 16-bit code reading E0 will read the 0000 and not the XXXX.

Deathwolf

#16
it's like codetype 02 but only IF equal.
every button address is anywhere on every game.

28 is reading the last 4 bytes by E0.
lolz

Deathwolf

do u think this works too?

2840A5E0 0000YYYY
C2056578 00000003   
3DC04100 61CE0000
91DC01AC 80DC01AC
60000000 00000000
E2100000 00000000   
C2056578 00000003   
3DC080DC 61CE01AC
91DC01AC 80DC01AC
60000000 00000000
lolz

dcx2


Deathwolf

now?

2840A5E0 0000YYYY
C2056578 00000003   
3DC04100 61CE0000
91DC01AC 80DC01AC
60000000 00000000
E2100000 00000000   
C2056578 00000003   
3DC080DC 61CE01AC
91DC01AC 80DC01AC
60000000 00000000
E0000000 80008000

I think 60000000 and E0000000 will freez?
lolz

dcx2

It seems like you did everything right  ;D , but I don't know what your hooks are.

Advice: The bolded parts will usually be the same for all codes.  The not bolded parts will change depending on what the code should do (health, ammo, time, etc).  The not bolded parts can be C2 codes or 04 RAM writes or any other WiiRD codes; be creative.  The addresses should match. 

2840A5E0 0000YYYY   # if (button YYYY)
C2056578 00000003   # {
3DC04100 61CE0000   #   C2Hook1();
91DC01AC 80DC01AC
60000000 00000000   # }   
E2100000 00000000      # else
C2056578 00000003      # {
3DC080DC 61CE01AC   #   C2Hook2();
91DC01AC 80DC01AC
60000000 00000000
E0000000 80008000   # }   

Bully@Wiiplaza

#21
lol I noticed that it was your moonjump code for Water Warfare.

Here you go:

[Moonjump [Deathwolf] modded by Bully@Wiiplaza
04056578 80DC01AC --> writes back original instruction if button is not pressed
2840A5E0 DFFF2000 --> Button Activator Z
C2056578 00000003 --> (C2 code with lis, ori,stw blabla)
3DC04100 61CE0000
91DC01AC 80DC01AC
60000000 00000000

You can force the game to write the original instruction to adress xxxxxxxx, if you use the 04 line above your code, which restores original instruction at this adress (branch). This is, what I did, before I read this topic :P

-Tested, works-
My Wii hacking site...
http://bullywiihacks.com/

My youtube account with a lot of hacking videos...
http://www.youtube.com/user/BullyWiiPlaza

~Bully

Deathwolf

lolz

dcx2

Thanks, Bully, for actually giving the necessary details.  One thing...you forgot the terminator.  You need one because you used an if code.  Without the terminator, any codes after that code will get screwed up.

I've done that basic approach with CC codes too.  I call it "pre-patching the anti-code", because you write the original instruction (or anti-code, as wiiztec referred to it) every frame, and then conditionally over-write the anti-code with your code based on a button activator.  To verify, you can set a write breakpoint on 8040A5E0 and you will see that it writes once when the activator is not true and twice when the activator is true.

Here's that same code, in if-else format.  In contrast, the if-else format will only write one or the other, but not both in the same frame.  However, it requires an additional line.  Since it's functionally identical to Bully's code, this code is only good for practice with else.

2840A5E0 DFFF2000
C2056578 00000003   
3DC04100 61CE0000
91DC01AC 80DC01AC
60000000 00000000
E2100000 00000000   
04056578 80DC01AC
E0000000 80008000

---

Here's that code, in ASM format.  Notice that the original code used the mask DFFF.  In order to do the same with ASM we will use andi..  Notice the . at the end of andi., because it is required.  Also note that when Z is not pressed, the andi. results in a 0, and 0 is tested for with beq-.

lis r12,0x8040      # r12 = controller pointer
ori r12,r12,0xA5E0
lhz r12,0(r12)      # r12 = controller value
andi. r12,0x2000     # mask Z bit
beq- 0x0C         # if equal to 0, no Z bit, branch
lis r12,0x4100      # if not equal, Z bit is set, write 41000000...
stw r12,428(r28)      # ...to 428(r28)
lwz r6,428(r28)      # original instruction; bne- would take you here

Deathwolf

you can't assembly this:

lis r12,0x8040
ori r12,r12,0xA5E0
lhz r12,0(r12)   
andi. r12,0x2000
beq- 0x0C
lis r12,0x4100
stw r12,428(r28)
lwz r6,428(r28)

operand out of range (0x00002000 is not between 0x00000000 and 0x0000001f)
lolz

dcx2

Doh!  Forgot the source register.

lis r12,0x8040
ori r12,r12,0xA5E0
lhz r12,0(r12)   
andi. r12,r12,0x2000
beq- 0x0C
lis r12,0x4100
stw r12,428(r28)
lwz r6,428(r28)

Deathwolf

assembly:

C2000000 00000005
3D808040 618CA5E0
A18C0000 718C2000
4182000C 3D804100
919C01AC 80DC01AC
60000000 00000000


and which hook address?
lolz

dcx2

It's your code that I modified...you should already know the hook address.

Deathwolf

not really because there are 2 addresses.

one for the button and the second of the address.
lolz

dcx2

Are you even trying?  Or do you just expect me to do all of the work for you?

Adding a button activator doesn't change the hook address. 

You wrote the original C2 code!  You should know what address you want to hook.  I don't even have this game.