TAS Code (Wii Remote) [Bully]

NOTE: Outdated by Vega's version which works for all controllers

Works for any Wii Remote Dependent Controller (Wheel, Chuck, & Classic) This is simply a Live Replay Code with an activator and deactivator. Allows you to create Tool Assisted Speedruns.

NTSC-U 
2834XXXX YYYYZZZZ
C251C7C0 00000002
B01ED81C B01E0004
60000000 00000000
C251C87C 00000002
D01E000C D01ED824
D07ED820 00000000
C251C8B4 00000005
98DE0012 98DED82A
899E0010 999ED828
899E0011 999ED829
899E0013 999ED82B
60000000 00000000
E0000000 00000000
2834XXXX YYYYZZZZ
0451C7C0 B01E0004
0451C87C D01E000C
0451C8B4 98DE0012
E0000000 80008000

PAL
2834XXXX YYYYZZZZ
C2520C34 00000002
B01ED81C B01E0004
60000000 00000000
C2520CF0 00000002
D01E000C D01ED824
D07ED820 00000000
C2520D28 00000005
98DE0012 98DED82A
899E0010 999ED828
899E0011 999ED829
899E0013 999ED82B
60000000 00000000
E0000000 00000000
2834XXXX YYYYZZZZ
04520C34 B01E0004
04520CF0 D01E000C
04520D28 98DE0012
E0000000 80008000

NTSC-J
2834XXXX YYYYZZZZ
C25205B4 00000002
B01ED81C B01E0004
60000000 00000000
C2520670 00000002
D01E000C D01ED824
D07ED820 00000000
C25206A8 00000005
98DE0012 98DED82A
899E0010 999ED828
899E0011 999ED829
899E0013 999ED82B
60000000 00000000
E0000000 00000000
2834XXXX YYYYZZZZ
045205B4 B01E0004
04520670 D01E000C
045206A8 98DE0012
E0000000 80008000

NTSC-K 
2833XXXX YYYYZZZZ
C250EC58 00000002
B01ED81C B01E0004
60000000 00000000
C250ED14 00000002
D01E000C D01ED824
D07ED820 00000000
C250ED4C 00000005
98DE0012 98DED82A
899E0010 999ED828
899E0011 999ED829
899E0013 999ED82B
60000000 00000000
E0000000 00000000
2833XXXX YYYYZZZZ
0450EC58 B01E0004
0450ED14 D01E000C
0450ED4C 98DE0012
E0000000 80008000

Code creator: Bully
Code credits: Mdmwii (original GCN live replay)

This is an excel doc I made in Libreoffice which contains every country code name, every region residence code name (town/province/country within Country), every region residence byte value, every country code byte value, and a lot of globe location (hex; word) values.

If you post/host/share this any where else, please credit me. This took a lot of work to make.

Download link - http://mkwii.com/downloads/MKWRegionDatabase.zip

Sha256 Linux checksum - http://mkwii.com/downloads/MKWRegionDatabaseSha256.txt

The Wii can have any country code hex value from 0 to FF (0 to 255 in decimal). Many users know plenty of these values such as 1: Japan, 31: USA, 88: S.Korea, etc.

Normally to get your flag to work on MKWii, your town/province/county within your country needs to be set. When this is set the byte immediately after your country code hex value (in your SYSCONF file) goes from 00 to any number higher than 00 (depends on which town/province/county you choose for your country when operating through MKWii Region Settings).

I saw an ASM function in the early parts of the main.dol that had to do with 'FFFF'. Which is country code (decimal) 255 with the town/province/county byte value at its max (FF in hex of course).

So I set my country code FF along with my town/province/county code, then went online.

Here's what happened...

Whatever values you have for your globe position are nullified, and you are placed on the default geolocation of whatever Region ID you are on (w/ no flag image). Obviously, you can't do this on Taiwan Region ID or AUS/NZ Region ID because your country code has to be 255/FF.

Discovered by me on Aug 5, 2018 

Hide Your Wii ID on User Record [Vega]

This code will allow you to put a spoofed Wii ID number on your USER record/packet. This will NOT spoof the Wii ID number that is read by the server when getting online! This code is just meant to stop Mem90 RAM Viewers/Packet sniffers from seeing your real Wii ID number when they are in your WW.

NTSC-U
C2660FB0 00000004
3D80XXXX 618CYYYY
91847580 3D80WWWW
618CZZZZ 91847584
80047580 00000000

PAL
C2663094 00000004
3D80XXXX 618CYYYY
91847580 3D80WWWW
618CZZZZ 91847584
80047580 00000000

NTSC-J
C2662700 00000004
3D80XXXX 618CYYYY
91847580 3D80WWWW
618CZZZZ 91847584
80047580 00000000

NTSC-K
C26513AC 00000004
3D80XXXX 618CYYYY
91847580 3D80WWWW
618CZZZZ 91847584
80047580 00000000

XXXXYYYYWWWWZZZZ = Spoofed Wii ID number in Hex

Source
lis r12, 0xXXXX #Load XXXX value into higher 16 bits of register 12. Lower 16 bits are cleared
ori r12, r12, 0xYYYY #Load YYYY value into lower 16 bits of register 12
stw r12, 0x7580 (r4) #Store the word of Register 12 at address of Register 4 plus offset 0x7580
lis r12, 0xWWWW #Load WWWW value into higher 16 bits of register 12
ori r12, r12, 0xZZZZ #Load ZZZZ value into lower 16 bits of register 12
stw r12, 0x7584 (r4) #Store the word of Register 12 at address of Register 4 plus offset 0x7584
lwz r0, 0x7580 (r4) #Load the word at address Register 4 plus offset 7580 into Register 0; Default ASM

Code creator: Vega

DWC_Authdata Spoofer [Vega]

Also known as User ID Spoofer. This code allows a user to have a fully spoofed DWC_Authdata/User ID. Do not exceed the value of 000009184E729FFF (9999999999999 in decimal). Legit authdatas cannot exceed that limit. If you exceed that limit, a server mod/admin will instantly know you are using spoofing codes. Thus, if you follow this rule, your WWWW value will always be 0000.

Another thing to know, is that you can only make new FCs with your spoofed DWC_Authdata. If you use this code and connect online with an FC made on your 'legit' DWC_Authdata, you will receive error code 60000.

NTSC-U
C20ED364 00000004
3CE0WWWW 60E7XXXX
90E601B0 3CE0YYYY
60E7ZZZZ 90E601B4
80E601B0 00000000

PAL
C20ED404 00000004
3CE0WWWW 60E7XXXX
90E601B0 3CE0YYYY
60E7ZZZZ 90E601B4
80E601B0 00000000

NTSC-J
C20ED324 00000004
3CE0WWWW 60E7XXXX
90E601B0 3CE0YYYY
60E7ZZZZ 90E601B4
80E601B0 00000000

NTSC-K
C20ED47C 00000004
3CE0WWWW 60E7XXXX
90E601B0 3CE0YYYY
60E7ZZZZ 90E601B4
80E601B0 00000000

WWWWXXXXYYYYZZZZ = Your desired DWC_Authdata in HEX

Spoof FC on User Record [Vega]

This code will spoof the FC that is sent on your USER record/packet in Mem90. If anybody is viewing the USER packets (via a RAM viewer or packet sniffer program) of a race/WW, they will read your spoofed FC. If you are too lazy to fill in the values, you can simply nop the address to put the FC as 0000000000000001 (0000-0000-0001).

And No, this doesn't hide your FC on the Wiimmfi MKW page.

NTSC-U
C2660FD4 00000004
3C60XXXX 6063YYYY
907F00B0 3C60WWWW
6063ZZZZ 907F00B4
60000000 00000000

PAL
C26630B8 00000004
3C60XXXX 6063YYYY
907F00B0 3C60WWWW
6063ZZZZ 907F00B4
60000000 00000000

NTSC-J
C2662724 00000004
3C60XXXX 6063YYYY
907F00B0 3C60WWWW
6063ZZZZ 907F00B4
60000000 00000000

NTSC-K
C26513D0 00000004
3C60XXXX 6063YYYY
907F00B0 3C60WWWW
6063ZZZZ 907F00B4
60000000 00000000

XXXXYYYYWWWWZZZZ = Spoofed FC in HEX.

For example, if you want the spoofed FC to be 2468-0990-5553. Put that value in a decimal to hex converter (with no dashes), and use the hex result for the code.

Source
lis r3, 0xXXXX #Load XXXX value into higher 16 bits of Register 3. Lower 16 bits are cleared.
ori r3, r3, 0xYYYY #Load YYYY value into lower 16 bits of Register 3.
stw r3, 0x00B0 (r31) #Store the word (XXXXYYYY value) to the address of Register 31 plus offset of 0x00B0; Default ASM
lis r3, 0xWWWW #Load WWWW value into higher 16 bits of Register 3. Lower 16 bits are cleared.
ori r3, r3, 0xZZZZ #Load ZZZZ value into lower 16 bits of Register 3.
stw r3, 0x00B4 (r31) #Store the word (WWWWZZZZ value) to the address of Register 31 plus offset of 0x00B4
nop #Necessary nop for odd amount of ASM instructions

Code creator: Vega

Item Wheel Hack [Bully]

Also known as Super 13 Items Modifier.

This code allows you to hack at will a selection of 13 desired items. No need to pick up a Box. Works everywhere. Feel free to shorten the code if you don't need 13 hacked items. The code comes supplied with the ability to deactivate the Item Wheel completely and re-activate it later. If you don't want this feature, remove the first 3 lines of the code (so the C2 line will now be the first line of the code).

In regards to deactivating the Item Wheel, this doesn't mean that whatever Item you have in inventory is cleared. It means, that once you use your Item, nothing is left in your inventory (normal functions of picking up items from boxes occurs) because the Item Wheel Hack is turned off.

When the race begins you will always start off with a default green shell, do NOT use it or else you will freeze. Simply just activate one of your hacked items and everything will then function normally. Obviously, if you want to use your own hacked green shell as the first item of the race, be sure you activate your green shell first, so you aren't using the default green shell.

WWWW = Controller Address for Item Wheel Deactivation/Re-Activate later
QQQQ = Button Activator for Item Wheel Deactivation/Re-Activate later
XXXX are standard Controller Address values (for the hacked Items)
YYYY are standard YYYY values
ZZZZ are standard Button values (for the hacked items)

Item Values (RR/K Values):
Green Shell = 00/1
Red Shell = 01/1
Banana = 02/1
Fake Item Box = 03/1
Mushroom = 04/1
Triple Mushroom = 05/3
Bob-omb = 06/1
Blue Shell = 07/1
Lightning = 08/1
Star = 09/1
Golden Mushroom = 0A/1
Mega Mushroom = 0B/1
Blooper = 0C/1
POW Block = 0D/1
Cloud = 0E/1
Bullet Bill = 0F/1
Triple Green Shell = 10/3
Triple Red Shell = 11/3
Triple Banana = 12/3
Nothing = 14/0

NTSC-U
2834WWWW YYYYQQQQ
047E4B88 8004008C
CC000000 00000000
C27E4B88 00000003
3D808000 A16C1626
B1640092 A00C1624
B004008E 00000000
E0000000 80008000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 80008000

PAL
2834WWWW YYYYQQQQ
047EEE98 8004008C
CC000000 00000000
C27EEE98 00000003
3D808000 A16C1626
B1640092 A00C1624
B004008E 00000000
E0000000 80008000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 80008000

NTSC-J
2834WWWW YYYYQQQQ
047EE504 8004008C
CC000000 00000000
C27EE504 00000003
3D808000 A16C1626
B1640092 A00C1624
B004008E 00000000
E0000000 80008000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2834XXXX YYYYZZZZ
04001624 00RR000K
E0000000 80008000

NTSC-K
2833WWWW YYYYQQQQ
047DD258 8004008C
CC000000 00000000
C27DD258 00000003
3D808000 A16C1626
B1640092 A00C1624
B004008E 00000000
E0000000 80008000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 00000000
2833XXXX YYYYZZZZ
04001624 00RR000K
E0000000 80008000

Code creator: Bully

Stop All Opponents Online [Vega]

Join an online race. Activate the code after the countdown has initiated. Everyone will be stopped on your screen. On everyone else's screen, they will see you stopped instead. If you deactivate anytime during the race, you will instantly DC. If you don't deactivate and finish the race, the race will stall and you will eventually DC. Be sure to deactivate the code before going back online, or else you will get EC 23400.

NTSC-U
2834XXXX YYYYZZZZ
041D1898 60000000
E0000000 00000000
2834XXXX YYYYZZZZ
041D1898 91660010
E0000000 80008000

PAL
2834XXXX YYYYZZZZ
041D1938 60000000
E0000000 00000000
2834XXXX YYYYZZZZ
041D1938 91660010
E0000000 80008000

NTSC-J
2834XXXX YYYYZZZZ
041D1858 60000000
E0000000 00000000
2834XXXX YYYYZZZZ
041D1858 91660010
E0000000 80008000

NTSC-K
2833XXXX YYYYZZZZ
041D1C94 60000000
E0000000 00000000
2833XXXX YYYYZZZZ
041D1C94 91660010
E0000000 80008000

Code created by: Vega

Change User Record Game Letter/ASCii Hex [Vega]

This code will allow you to set a spoofed game letter/ascii hex digit (4th digit of game ID) on your USER record/packet. If someone is reading USER packets in a WW, they will not know the true MKW Disc/ISO that you are on.

NTSC-U
04661080 380000XX

PAL
04663164 380000XX

NTSC-J
046627D0 380000XX

NTSC-K
0465147C 380000XX

XX = Game ID 4th letter
45 = American MKW (E)
4A = Japan MKW (J)
4B = Korean MKW (K)
50 = PAL MKW (P)

'Source'
lbz r0, 0x0003 (r3) changed to li r0, 0xXX

Code creator: Vega

Region ID Changer #2 [Vega]

Outdated by both Anarion's Version and Vega's #1 Version

This code will set the Region ID to a new one via the X value. The Region ID changes only take effect for actual races/battle & idle open rooms since this code gets executed whenever a new online WW/Room is created or connected to. Therfore this code will NOT change the Region ID for TT Leaderboards.

NTSC-U
C266108C 00000002
3800000X 90030084
60000000 00000000

PAL
C2663170 00000002
3800000X 90030084
60000000 00000000

NTSC-J
C26627DC 00000002
3800000X 90030084
60000000 00000000

NTSC-K
C2651488 00000002
3800000X 90030084
60000000 00000000

X = Region ID
0 = Japan, red line
1 = Americas, blue line
2 = Europe, green line
3 = AUS/NZ, yellow line
4 = Taiwan, white line
5 = S. Korea, purple line
6 = China, white line

Source:
#Hooked at the spot of SK_UserHandler_createSendPacket__mkw_form_user_record function where it loads the Region ID from Static Memory to store it at the USER Packet
li r0, 0xX #X is Region ID
stw r0, 0x0084 (r3) #Original Instruction

Code creator: Vega