Welcome, Guest
You have to register before you can post on our site.

Username
  

Password
  





Search Forums

(Advanced Search)

Forum Statistics
» Members: 444
» Latest member: Phantom
» Forum threads: 1,500
» Forum posts: 8,963

Full Statistics

Online Users
There are currently 39 online users.
» 0 Member(s) | 37 Guest(s)
Bing, Google

Latest Threads
Make it to 10,000
Forum: General Discussion
Last Post: Cealgair
3 hours ago
» Replies: 3,240
» Views: 2,358,413
PowerPC Page Tables Tutor...
Forum: PowerPC Assembly
Last Post: Vega
12-01-2022, 08:47 PM
» Replies: 0
» Views: 74
Allow invalid ghosts [jaw...
Forum: Time Trials & Battle
Last Post: jawa
11-29-2022, 02:53 PM
» Replies: 0
» Views: 42
Ultimate Stockpile Items ...
Forum: Incomplete & Outdated Codes
Last Post: Deez Nutz
11-28-2022, 02:43 PM
» Replies: 0
» Views: 45
Boot into any menu [Melg]
Forum: Misc/Other
Last Post: Zeraora
11-26-2022, 10:34 PM
» Replies: 3
» Views: 1,404
Coding Questions and othe...
Forum: Code Support / Help / Requests
Last Post: Vega
11-25-2022, 04:54 PM
» Replies: 121
» Views: 44,579
Remove invisible walls [j...
Forum: Visual & Sound Effects
Last Post: jawa
11-21-2022, 02:53 PM
» Replies: 5
» Views: 186
Hey all!
Forum: Introductions
Last Post: Vega
11-20-2022, 02:31 PM
» Replies: 1
» Views: 397
Fast Race Music Modifier ...
Forum: Visual & Sound Effects
Last Post: Zeraora
11-16-2022, 11:24 PM
» Replies: 0
» Views: 89
Normal Race Music Modifie...
Forum: Visual & Sound Effects
Last Post: Zeraora
11-16-2022, 11:22 PM
» Replies: 0
» Views: 81

 
  Fun Fact about Broadway
Posted by: Vega - 06-28-2022, 01:00 AM - Forum: Hacking General Discussion - No Replies

Fun Fact about Broadway

Every Broadway processor in your Wii Console contains an 88-bit unique identifier known as the Chip ID. It is NOT the processor version (aka PVR). No two Broadway processors can possess the same Chip ID.

Due to being 88-bits in size, you need to access 3 Special Purpose Registers to retrieve the Chip ID. What's odd is that the Chip ID is mentioned nowhere in the Broadway manual. Not only that, Broadway manual doesn't even list the Chip ID's SPR numbers as being valid SPR numbers.

Since no two Broadway processors can have the same Chip ID, this value could be used as a part of a moderation/ban tool for future implementations of an MKWii online service.

The SPR's containing the Chip ID are 925, 926, 927. The names of the SPRs are ECID1, ECID2, and ECID3. You cannot write to these registers. Attempting to do so will not change the Chip ID plus an exception will occur.

Using SwareJonge's Draw-Text Code (based on Star/Rii's original Draw-Text code), I mocked up a simple code so you can see what your Chip ID is. Obviously, this won't work on Dolphin Emulator. Also, the processor on the Wii U is not a Broadway processor. It is still a PPC processor, but it is called Espresso. It is possible that Espresso has a unique Chip ID of some sorts and store it's Chip ID values to the same SPRs. If somebody can test this on the Wii U and let me know how it works, I would appreciate it. Anyway, here's a code to do that (NTSC-U, too lazy to port this).

C2009640 00000011
9421FF80 BC610008
3FE08002 806D9FA0
3CA0802A 80A5307C
A0850004 A0A50008
63EC1D90 7D8903A6
4E800421 38600006
388000DC 38A00001
7CFDE2A6 54E7023E
7D1EE2A6 7D3FE2A6
48000015 25303858
20253038 58202530
38580000 7CC802A6
63EC1DF0 7D8903A6
4E800421 63EC1DD0
7D8903A6 4E800421
B8610008 38210080
81830000 00000000

Code:
#Address (NTSC-U) = 80009640

#Push Stack
stwu sp, -0x80 (sp)
stmw r3, 0x8 (sp)

#Set r31 for Direct Print Calling
lis r31, 0x8002

#Get current XFB (alternates between two FB's)
lwz r3, -0x6060 (r13)

#Get width and height for XFB
lis r5, 0x802A #Memory constant
lwz r5, 0x307C (r5) #Load XFB Width Height Pointer
lhz r4, 0x4 (r5)
lhz r5, 0x8 (r5)

#Change XFB for Direct Print (r3 = FB, r4 = Width, r5 = Height)
ori r12, r31, 0x1D90
mtctr r12
bctrl

#Setup Args for Direct Print
li r3, 6
li r4, 0xDC
li r5, 1

#Grab Chip IDs
#Chip ID is a 88-bit identifier
mfspr r7, 925
rlwinm r7, r7, 0, 8, 31 #CIDH
mfspr r8, 926 #CIDM
mfspr r9, 927 #CIDL

bl our_text
.string "%08X %08X %08X"
.align 2
our_text:
mflr r6

#Print to Screen
ori r12, r31, 0x1DF0
mtctr r12
bctrl

#Store Cache
ori r12, r31, 0x1DD0
mtctr r12
bctrl

#Pop Stack
lmw r3, 0x8 (sp)
addi sp, sp, 0x80

#Default Instruction
lwz r12, 0 (r3)

Print this item

  A blast from the past
Posted by: Fzerowii - 06-24-2022, 03:09 PM - Forum: General Discussion - Replies (2)

So if y’all wanna see me on this domain wayyyy back in the day (probably before some people on here we’re born or we’re still in diapers ) if you go to waybackmachine.org and type in this domain and go back to September 15th 2008 and go to introductions and thread on the 4th page last one down is me.  I screenshot it but it won’t allow me to upload photos here.  But yeah that was me back when I was only 15 (almost 16).  If you were a teenager or adult then you probably remember how exciting Mario kart wii was when it was brand new.  I don’t think hacking or custom levels had even become a thing yet.

Print this item

  VR/BR assigned to Guest Modifier [Unnamed]
Posted by: Unnamed - 06-22-2022, 07:21 AM - Forum: Online Non-Item - No Replies

VR/BR assigned to Guest Modifier [Unnamed]



This code changes the VR/BR Value that is assigned to the Guest(s) when calculating the VR/BR Changes.
Important Note: Only you will see the effects on your screen. Other players will still have normal VR/BR Changes with a VR/BR of 5000 for the Guest(s).


NTSC-U
0461DE68 39C0XXXX

PAL
0465117C 39C0XXXX

NTSC-J
046507E8 39C0XXXX

NTSC-K
0463F494 39C0XXXX


XXXX: VR/BR Value in Hex

Examples:
1388 = 5000 (Default Value)
270F = 9999


Code Creator: Unnamed

Print this item

  Gain/Lose XX Amount of VR/BR Every Race [TheNinjaKingOW]
Posted by: Zeraora - 06-17-2022, 02:25 AM - Forum: Online Non-Item - Replies (2)

This code (as the name implies) sets the amount of VR/BR you gain/lose every race to a custom value.

NTSC-U:
C2528e00 00000002
3880XXXX 7C002214
60000000 00000000

PAL:
C252D274 00000002
3880XXXX 7C002214
60000000 00000000

NTSC-J:
C252CBF4 00000002
3880XXXX 7C002214
60000000 00000000

NTSC-K:
C251B2CC 00000002
3880XXXX 7C002214
60000000 00000000

XXXX = The amount you want

Print this item

  Late Trick Bot [Vega]
Posted by: Vega - 06-06-2022, 02:47 PM - Forum: Offline Non-Item - No Replies

Late Trick Bot [Vega]

Video~



Works for every controller.

Always get a perfect last frame trick. There's 2 different configurations to this code.

1st Config: Literally no action required on your behalf. Just launch off any ramp (don't even have to press anything / swing remote) and the late trick is auto generated. However, you can't choose what style of tricks you perform.

2nd Config: Simply removes the nop (1st line) of 1st config. This means you still need to legitimately initiate the trick, but you no longer need to try to time it for that perfect late trick. That way you can still choose your trick styles.

1st Config Codes~
NTSC-U
0456F344 60000000
0456F374 2805000A

PAL
04575BA8 60000000
04575BD8 2805000A

NTSC-J
04575528 60000000
04575558 2805000A

NTSC-K
04563C00 60000000
04563C30 2805000A

2nd Config Codes~
NTSC-U
0456F374 2805000A

PAL
04575BD8 2805000A

NTSC-J
04575558 2805000A

NTSC-K
04563C30 2805000A



Code creator: Vega
Code credits: Stebler and Seeky (player.h and mkw-structures github repo)



Sources for RAM Writes

First 32-bit RAM Write replaces 'beq 0x64' with a nop. The conditional branch would be taken if the player did not press their trick button within the correct time/frame window to initiate a trick. By nopping this, we always do a trick off any trickable surface.

Second 32-bit RAM Write replaces 'cmplwi r5, 3' with 'cmplwi r5, 10'. It's important to explain that if you hit trick button after 10 frames already being in air, you can't trick. There is also a lower bound Air frame check for when the trick can start animation. It's normally 3. This means that if you press your trick button at 3 frames already in air or earlier, the end result is the same --- quickest trick off ramp is done. Think of it like a Trick Animation Starter. By making this change from 3 to 10 via the cmplwi instruction modification, we force the game to only start tricks at the same exact frame that is required for latest possible trick. Thus, if you pair this with the 1st RAM Write (i.e. 1st config), you get an auto generated late trick bot. If you don't pair with 1st RAM Write (i.e. 2nd config), you still need to legitimately initiate the trick, but if you get that done, you will always get the late trick.

Print this item

  Trick Timing + Difficulty Modifier [Vega]
Posted by: Vega - 06-06-2022, 02:44 PM - Forum: Offline Non-Item - No Replies

Trick Timing + Difficulty Modifier [Vega]

Video~



This code edits 3 variables of the Trick:

  1. Frame Window required to be within from the time of pressing your Trick Button (or swinging remote) while on Trickable Surface to the time of when you get into Air
  2. Latest Possible Frame in Air that you can still get a Trick performed
  3. When the Trick Animation will Start

This may not make sense at first, so please be sure to also read the explanation below.

Under normal conditions, once you are on a trickable surface and you press your trick button (or swing remote), you have to be within 14 frames to the point of getting airtime or else the trick won't occur.

At this point the game will wait til the 3rd frame you are suspended in the air to generate your trick. So this means if you press your Trick Button (or swing remote) before the 4th air-frame, you will execute the earliest trick animation possible.

Obviously a player can wait to do 'late tricks'. You can wait up to 10 frames being suspended in the air. Once you go past 10 frames, you can no longer be able to generate a trick.

The reason I'm explaining all of this is for you to understand how to use this code correctly and how each value will effect your Tricks. With all of that being said here for Code values and their ranges

XXXX = Button Trickable Surface Frame Window (Default is 000E aka 14)
YYYY = Button Air Frame Window Upper Bound (Default is 000A aka 10)
ZZZZ = Button Trick Animation Frame Start Value (Default is 0003)

XXXX can be anything from 0001 thru 7FFF (8000+ are treated as negative numbers, can't use those values)
YYYY & ZZZZ can be anything from 0000 thru FFFF (8000+ are still treated as positive numbers)

ZZZZ must be lower than YYYY, and ZZZZ cannot be zero. XXXX also cannot be 0 or else you simply disable tricks entirely, lol.

NTSC-U
0456F31C 3800XXXX
0456F348 2805YYYY
0456F374 2805ZZZZ

PAL
04575B80 3800XXXX
04575BAC 2805YYYY
04575BD8 2805ZZZZ

NTSC-J
04575500 3800XXXX
0457552C 2805YYYY
04575558 2805ZZZZ

NTSC-K
04563BD8 3800XXXX
04563C04 2805YYYY
04563C30 2805ZZZZ



Code creator: Vega
Code credits: Stebler (player.h), Seeky (mkw-structures github repo)



Sources~
1st RAM Write: 'li r0, 0x000E' has its 16-big signed value changed. This sets the Trickable Surface Frame Window which gets decremented til it hits 0
2nd RAM Write: 'cmplwi r5,  0x000A' has its 16-bit logical/unsigned value changed. This is the upper bound check for longest allow time you've been in the Air (frames)
3rd RAM Write: 'cmplwi r5,  0x0003' has its 16-bit logical/unsigned value changed. This is the earliest the game can start a trick animation in regards to how long it waits for you to stay suspended in the air.

Print this item

  Trick Anywhere Anytime [Vega]
Posted by: Vega - 06-05-2022, 02:44 AM - Forum: Offline Non-Item - Replies (2)

Trick Anywhere Anytime [Vega]

Video~



You can *almost* trick anywhere at anytime. There are still a few instances where you can't (such as after already being mid air by Halfpipe Ramps on DKS).

Here's a list of some of the new scenarios where you can now trick

- Can trick in cannons (trick sparkles and sound will work, but can't change cannon tradjectory)
- Can trick multiple times in the air during one jump
- Can trick w/o hopping
- Can trick w/o any speed or in reverse
- Can trick on any surface
- Can trick during the countdown (only sparkles and sound work)

Yes you 'trick' while in a Bullet Bill, but once you do that, your Bill will have a mind of its own and will travel to god knows where, lol.

You also have the ability to use something other than the trick button for tricks, so that way you can do both normal tricks and 'hacked' tricks.

Not only that, this also serves as a proxy 'Rapid Trick' code. Simple hold down your ZZZZ button and you will be tricking every frame.

NTSC-U
0456F538 80850004
0456F330 80A4001C
2834XXXX YYYYZZZZ
C256F538 00000007
80850004 817C0000
816B0000 896B0010
3D80809C 818C8F68
898C0B84 7C0B6000
40A20014 3D608056
616BF610 7D6803A6
4E800020 00000000
C256F330 00000007
80A4001C 817C0000
816B0000 896B0010
3D80809C 818C8F68
898C0B84 7C0B6000
40A20014 3D608056
616BF37C 7D6803A6
4E800020 00000000
E0000000 80008000

PAL
04575D9C 80850004
04575B94 80A4001C
2834XXXX YYYYZZZZ
C2575D9C 00000007
80850004 817C0000
816B0000 896B0010
3D80809C 818CD728
898C0B84 7C0B6000
40A20014 3D608057
616B5E74 7D6803A6
4E800020 00000000
C2575B94 00000007
80A4001C 817C0000
816B0000 896B0010
3D80809C 818CD728
898C0B84 7C0B6000
40A20014 3D608057
616B5BE0 7D6803A6
4E800020 00000000
E0000000 80008000

NTSC-J
0457571C 80850004
04575514 80A4001C
2834XXXX YYYYZZZZ
C257571C 00000007
80850004 817C0000
816B0000 896B0010
3D80809C 818CC788
898C0B84 7C0B6000
40A20014 3D608057
616B57F4 7D6803A6
4E800020 00000000
C2575514 00000007
80A4001C 817C0000
816B0000 896B0010
3D80809C 818CC788
898C0B84 7C0B6000
40A20014 3D608057
616B5560 7D6803A6
4E800020 00000000
E0000000 80008000

NTSC-K
04563DF4 80850004
04563BEC 80A4001C
2833XXXX YYYYZZZZ
C2563DF4 00000007
80850004 817C0000
816B0000 896B0010
3D80809B 818CBD68
898C0B84 7C0B6000
40A20014 3D608056
616B3ECC 7D6803A6
4E800020 00000000
C2563BEC 00000007
80A4001C 817C0000
816B0000 896B0010
3D80809B 818CBD68
898C0B84 7C0B6000
40A20014 3D608056
616B3C38 7D6803A6
4E800020 00000000
E0000000 80008000

Code creator: Vega
Code credits: Stebler (player.h and slot checking mechanism), Seeky (player.h, mkw_structures github repo)



#NOTE FOR BOTH ASM's
#1st ASM skips over the check for the game seeign if you are already in a trick (PAL 80575e5c, gets executed every frame) and skips over the speed check (PAL 80575e70)
#2nd ASM skips over..
#Airtime = 0 frames
#Airtime > 10 frames
#Airtime < 3 frames
#Trick Button hit within 14-frame window of when youre already on surface to when you're in air at 10 frames or less
#Trickable Surface
#Already in Trick (this check is also present in what's skipped in first ASM; keep in my mind not the same exact instruction at same address)
#First frame of Trick
#Over a Zipper

#START ASSEMBLY

#Address Ports
#PAL = 80575D9C
#NTSC-U = 8056F538
#NTSC-J = 8057571C
#NTSC-K = 80563DF4

#Region Compilation Setting

.set region, '' #Fill in P, E, J, or K (case sensitive)

.if (region == 'P')
        .set ptr_raceData, 0x809bd728
        .set landing_spot, 0x80575E74
.elseif (region == 'E')
        .set ptr_raceData, 0x809b8f68
        .set landing_spot, 0x8056F610
.elseif (region == 'J')
        .set ptr_raceData, 0x809bc788
        .set landing_spot, 0x805757F4
.elseif (region == 'K')
        .set ptr_raceData, 0x809abd68
        .set landing_spot, 0x80563ECC
.else
        .err
.endif

#Register Notes
#LR = safe
#r28 is w/e pointer that can be used for slot checking (idk the name, lol)

#Original Instruction
lwz r4, 0x0004 (r5)

#Get Slot function is hooked on
lwz r11, 0 (r28)
lwz r11, 0 (r11)
lbz r11, 0x10 (r11)

#Get Your Slot (added this so code works on both offline and online)
lis r12, ptr_raceData@ha
lwz r12, ptr_raceData@l (r12)
lbz r12, 0xb84 (r12)

#Check em'
cmpw r11, r12
bne+ end_code

#Jump 0xD4 ahead
lis r11, landing_spot@h
ori r11, r11, landing_spot@l
mtlr r11
blr

#End code
end_code:

#END ASSEMBLY

=====

#START ASSEMBLY

#Address Ports
#PAL = 80575B94
#NTSC-U = 8056F330
#NTSC-J = 80575514
#NTSC-K = 80563BEC

#Region Compilation Setting

.set region, '' #Fill in P, E, J, or K (case sensitive)

.if (region == 'P')
        .set ptr_raceData, 0x809bd728
        .set landing_spot, 0x80575BE0
.elseif (region == 'E')
        .set ptr_raceData, 0x809b8f68
        .set landing_spot, 0x8056F37C
.elseif (region == 'J')
        .set ptr_raceData, 0x809bc788
        .set landing_spot, 0x80575560
.elseif (region == 'K')
        .set ptr_raceData, 0x809abd68
        .set landing_spot, 0x80563C38
.else
        .err
.endif

#Register Notes
#LR = safe
#r28 & r29 is w/e pointer that can be used for slot checking (idk the name, lol)

#Original Instruction; load bitfield1 (line 431 of player.h)
lwz r5, 0x001C (r4)

#Get Slot function is hooked on
lwz r11, 0 (r28)
lwz r11, 0 (r11)
lbz r11, 0x10 (r11)

#Get Your Slot (added this so code works on both offline and online)
lis r12, ptr_raceData@ha
lwz r12, ptr_raceData@l (r12)
lbz r12, 0xb84 (r12)

#Check em'
cmpw r11, r12
bne+ end_code

#Jump 0x4C ahead
lis r11, landing_spot@h
ori r11, r11, landing_spot@l
mtlr r11
blr

#End code
end_code:

#END ASSEMBLY

Print this item

  Hop Anywhere Anytime [Vega]
Posted by: Vega - 05-26-2022, 02:14 PM - Forum: Offline Non-Item - No Replies

Hop Anywhere Anytime [Vega]

Video~



Can Hop anywhere at anytime, you can hop multiple times while in the air. Thus you can keep hopping up and up into the sky. Won't work in cannons (hop sound will still occur) but you can't change the cannon trajectory.

You also have the ability to use something other than the Hop button for Hops, so that way you can do both normal hops and 'hacked' hops.

Not only that, this code serves as a proxy 'Rapid Hop' code. Simple hold down your ZZZZ button and you will be hopping every frame.

Press ZZZZ to hop at anytime regardless of where you are at.

W (PAL only) values:
4 = Non-GCN
5 = GCN

XXXX = Controller Address
ZZZZ = Button for Universal Hop (must be a single button that is chosen, no double/triple/etc button combos)

If using GCN, use the Wavebird values for the ZZZZ values.

NTSC-U
C2577668 00000008
3D808034 A18CXXXX
718CZZZZ 41820028
819D0000 818C0000
898C0010 3D60809C
816B8F68 896B0B84
7C0B6000 40A20008
38600001 2C030000
60000000 00000000

PAL
C257DECC 00000008
3D80803W A18CXXXX
718CZZZZ 41820028
819D0000 818C0000
898C0010 3D60809C
816BD728 896B0B84
7C0B6000 40A20008
38600001 2C030000
60000000 00000000

NTSC-J
C257D84C 00000008
3D808034 A18CXXXX
718CZZZZ 41820028
819D0000 818C0000
898C0010 3D60809C
816BC788 896B0B84
7C0B6000 40A20008
38600001 2C030000
60000000 00000000

NTSC-K
C256BF24 00000008
3D808033 A18CXXXX
718CZZZZ 41820028
819D0000 818C0000
898C0010 3D60809B
816BBD68 896B0B84
7C0B6000 40A20008
38600001 2C030000
60000000 00000000

Code creator: Vega
Code credits: Stebler (get slot function code, ptr_race data code and addresses; also used his documentation on Seeky's mkw-structure github of 'virtual boot canHop() to go back into the Callstack to find Hook Address), Seeky (mkw-structure github page)



#START ASSEMBLY (C2)

#Address Ports
#NTSC-U = 80577668
#PAL = 8057DECC
#NTSC-J = 8057D84C
#NTSC-K = 8056BF24

#Region Compilation Setting

.set region, '' #Fill in P, E, J, or K (case sensitive)

.if (region == 'P')
        .set ptr_raceData, 0x809bd728
.elseif (region == 'E')
        .set ptr_raceData, 0x809b8f68
.elseif (region == 'J')
        .set ptr_raceData, 0x809bc788
.elseif (region == 'K')
        .set ptr_raceData, 0x809abd68
.else
        .err
.endif

#Load current Button Halfword combo
lis r12, 0x8035 #PAL GCN used for compilation, adjust this accordingly
lhz r12, 0xFFFF8200 (r12) #PAL GCN port 1 used, adjust accordingly

#Check it for B button activation, feel free to adjust the button activator
andi. r12, r12, 0x0200
beq- original_instruction

#Get Slot function is hooked on
lwz r12, 0x0 (r29)
lwz r12, 0x0 (r12)
lbz r12, 0x10 (r12)

#Get Your Slot (added this so code works on both offline and online)
lis r11, ptr_raceData@ha
lwz r11, ptr_raceData@l (r11)
lbz r11, 0xb84 (r11)

#Check em'
cmpw r11, r12
bne+ original_instruction

#Force universal Hop
li r3, 1

#Original Instruction; check return value from previous function call (Can Hop? Function call). r3 = can't hop. r3 = can hop
original_instruction:
cmpwi r3, 0

#END ASSEMBLY

Print this item

  I'm trying to make code that can do tricks infinitely in the air
Posted by: Ryuk - 05-26-2022, 07:18 AM - Forum: Code Support / Help / Requests - Replies (5)

deleted

Print this item

  cr1 Float Comparison Type for RC bit; Ordered or Unordered?
Posted by: Vega - 05-24-2022, 11:10 PM - Forum: Code Support / Help / Requests - Replies (2)

For a float instruction that simultaneously also updates cr1 (i.e. fadds. f0, f0, f1), is the float comparison Ordered or Unordered? Thanks in advance.

Print this item