Welcome, Guest |
You have to register before you can post on our site.
|
Forum Statistics |
» Members: 646
» Latest member: Luca1337
» Forum threads: 1,815
» Forum posts: 14,003
Full Statistics
|
Online Users |
There are currently 93 online users. » 1 Member(s) | 90 Guest(s) Bing, Google, JerryHatrick
|
Latest Threads |
Make it to 10,000
Forum: General Discussion
Last Post: Cealgair
56 minutes ago
» Replies: 7,340
» Views: 5,673,438
|
MKW Coder/Developer of th...
Forum: Coding & Hacking General Discussion
Last Post: Fifty
9 hours ago
» Replies: 11
» Views: 13,884
|
Allow Pausing Before Race...
Forum: Offline Non-Item
Last Post: Vega
Yesterday, 07:47 PM
» Replies: 0
» Views: 25
|
Top 10 Most Influential C...
Forum: Coding & Hacking General Discussion
Last Post: Vega
Yesterday, 03:27 PM
» Replies: 2
» Views: 7,364
|
Show Ice Cube on Online P...
Forum: Online Non-Item
Last Post: _Ro
Yesterday, 08:23 AM
» Replies: 0
» Views: 39
|
CPU Control Cycler [Ro]
Forum: Offline Non-Item
Last Post: _Ro
Yesterday, 07:56 AM
» Replies: 7
» Views: 1,024
|
Thunder Cloud Effect Modi...
Forum: Offline; Item
Last Post: JerryHatrick
01-10-2025, 11:13 PM
» Replies: 11
» Views: 1,100
|
Miniturbos and Inside Dri...
Forum: Coding & Hacking General Discussion
Last Post: JerryHatrick
01-10-2025, 09:54 AM
» Replies: 1
» Views: 861
|
Code request???
Forum: Code Support / Help / Requests
Last Post: DrTap
01-09-2025, 06:06 PM
» Replies: 3
» Views: 4,967
|
CPUs/Online Players Have ...
Forum: Visual & Sound Effects
Last Post: Zeraora
01-09-2025, 02:26 AM
» Replies: 2
» Views: 517
|
|
|
How to Make Codes Execute on Set Intervals |
Posted by: Vega - 12-21-2019, 06:17 PM - Forum: PowerPC Assembly
- Replies (1)
|
|
How to make Codes Execute on Set Intervals
This has been a requested tutorial for quite some time, so here ya guys go.
Requirements:
Already an intermediate-level (beyond pure beginner) ASM Coder
This thread will teach you how to take a basic code and make the code execute on set timed intervals. This will imitate an automated off-on switch or vice versa.
Method using the Race Timer:
This is by far the easiest method for the beginner ASM Coder. For this method, we will want to use Hamster's Invisible Racing code (NTSC-U) located HERE. We will utilize the seconds value of the Race Timer to determine whether or not the Invisible Racing code will be off or on. We want the code to execute whenever the seconds of the race timer is an odd number.
NTSC-U Invisible Racing
04559228 38000001
We will need to modify Hamster's code into a short ASM write. Two ASM Codes are required. One for the Invisible Racing Code and the other ASM will need to use an address that contains a register which tracks the race timer seconds. We will have the turn off for 1 full second, then turn on for 1 second, and repeat for the entirety of the race.
Bully's Millisecond Modifier code https://mkwii.com/showthread.php?tid=102 is a good code for this. r28 at this address contains the seconds value of the race timer.
Let's first write our ASM for Bully's Millisecond Modifier (NTSC-U). We will simply take r28's value and store it to the Exception Vectors. Before we write any ASM for this, launch Dolphin, set an Instruction BP on the address, and take a look at the code view. We do this just in case you have any weird scenario in regards to Register Safety.
We see in the Code View this is our default instruction...
We can set the default instruction at the end of the source and use r5 safely. Let's write our ASM...
Code: lis r5, 0x8000 #Setup upper bits of Exception Vector Address
stw r28, 0x1398 (r5) #Store seconds value to 0x80001398
lhz r5, 0x0024 (sp) #Default Instruction
Our first ASM is completed. Now we need to make an ASM out of the Invisible Racing Code that will load this value and execute accordingly.
You can go ahead and also set an Instruction BP on this address to check out the Register Safety. After a quick glance, it appears it will be easier just to use r12 instead of searching for safe registers to use. r0 cannot be used due to being read by the CPU as a pure 0 in certain instructions that we will be using for our ASM write. We will have the code only execute when the seconds value is an even number. Let's write it...
Code: lbz r0, 0x0020 (r5) #Default Instruction
lis r12, 0x8000 #Set upper bits of Exception Vector Address
lwz r12, 0x1398 (r12) #Load seconds value back into r12 as r12's first value of 0x8000 isn't needed anymore
Okay at this point, we have our seconds value in r12. Now we need a proper efficient way to know if the current seconds value is odd or even when being read. To do this, we need to go over binary just a quick bit. What is binary? Hex numbers are actually compiled readable form of binary numbers. Binary numbers are 0 or 1. As usual a word is 32 bits in length aka it has 32 binary numbers (0/1's). Thus each Hex number digit has 4 bits.
When a Hex number is even, it's far-right most bit is 0. If it's odd that bit will be 1. So here's an easy instruction that will check if value in a register is even or odd.
The above instruction (Clear Left Word Immediate) will clear out all the bits except the last bit (which can referred to as the least significant bit). What's great about the clrlwi instruction is that you can use the 'record' feature for a free use of cmpwi rX, 0. Let's use the record feature and add in our branch instruction.
Code: clrlwi. r12, r12, 31
beq- number_was_even #If equal to 0, number was even. Skip execution of code.
Going back to Hamster's code, he was able to make the code by replacing the default instruction with li r0, 1. Thus we will have that Load Immediate instruction be executed if our seconds value is even. Let's write in the rest of the source and view it as completed.
Code: lbz r0, 0x0020 (r5) #Default Instruction
lis r12, 0x8000 #Set upper bits of Exception Vector Address
lwz r12, 0x1398 (r12) #Load seconds value back into r12 as r12's first value of 0x8000 isn't needed anymore
clrlwi. r12, r12, 31 #Clear all bits of r12 except final bit, then execute a cmpwi r12, 0
beq- number_was_even #If equal to 0, number was even. Skip execution of code.
li r0, 1 #Execute the code, replace r0's value with 1
number_was_even: #li r0, 1 will be skipped if the beq branch was taken thus not executing the code
After compiling both of your own ASM's. Add them to your GCT/Cheat-Manager. If they fail, double check your work for errors and also remember to check Register Safety. Here are the two compiled ASMs of what we did wrote in this tutorial (NTSC-U). The code below has already been tested and works.
C25310A0 00000002
3CA08000 93851398
A0A10024 00000000
C2559228 00000004
88050020 3D808000
818C1398 558C07FF
41820008 38000001
60000000 00000000
NOTE: For codes that you want to modify are 32 bit RAM Writes (that aren't replacing branch routes), you can actually do this with one ASM via just using Bully's Code. However, learning it the way explained in the tutorial is easier for the beginner.
Conclusion:
If the code you are wanting to utilize for set intervals is already an ASM code, then just simply add in the extra instructions for the seconds load-and-check. If you need to code to execute quicker, keep in mind that r5 in Bully's code contains the millisecond value. You can utilize that value to make codes go off/on in less than a second. For codes you need to execute off/on all the time regardless of whether or not you are in a live race, you will need to find an address that keeps track of some sort of timer value that can set an Instruction Breakpoint anywhere in game.
|
|
|
Temp Pause Item Roulette & Animations [Vega] |
Posted by: Vega - 12-18-2019, 03:54 AM - Forum: Offline; Item
- No Replies
|
|
Temp Pause Item Roulette & Animations [Vega]
Silly code I made when helping a friend on Discord on something else, kind of funny so here it is. Press and hold your activator to pause/stop item roulette and item animations.
When activated before hitting a box, the item roulette will appear but never spin (until you deactivate ofc). If you activate during the roulette spin, it will pause itself and resume once you deactivate. Depending on certain times of activation, you can force temp TC glitches, cause items to float mid air, and other animations (such as fibs not rotating when they are sitting on the floor).
NTSC-U
04790844 9421FFD0
2834XXXX YYYYZZZZ
04790844 4E800020
E0000000 80008000
PAL
04799850 9421FFD0
2834XXXX YYYYZZZZ
04799850 4E800020
E0000000 80008000
NTSC-J
04798EBC 9421FFD0
2834XXXX YYYYZZZZ
04798EBC 4E800020
E0000000 80008000
NTSC-K
04787C10 9421FFD0
2833XXXX YYYYZZZZ
04787C10 4E800020
E0000000 80008000
'Source'
blr replaces stwu sp, -0x30 (sp)
Code creator: Vega
|
|
|
Basic ASM Code Debugging and Analysis for the Beginner Coder |
Posted by: Vega - 12-15-2019, 04:37 AM - Forum: PowerPC Assembly
- Replies (5)
|
|
Basic ASM Code Debugging and Analysis for the Beginner Coder
Chapter 1: Intro
After learning how to make very basic ASM Codes, the beginner coder may have trouble progressing to a higher skill level. Analyzing other already made ASM codes is one of the best ways to improve your ASM coding skills. Dolphin comes with many features to assist you.
Chapter 2: Setting up Hot Keys & Info About Other Features
Hotkeys (keyboard button shortcuts) are very useful for quick debugging. Open up your Dolphin Emulator. Under Options, select Hotkey Settings.
There's basically only 2 hotkeys that are useful for debugging. In the General tab, there is a Hotkey setting for 'Toggle Pause'.
Right click on the button for Toggle Pause to bring up the window to change its Hotkey configuration.
Whenever you bring up the Configure Input window for a Hotkey, you can select from a list or just type it in the lower larger box. Click Apply, then OK to save changes.
For the next hotkey, go to the Debugging tab.
There is a hotkey setting for 'Step-In'. This is by far the most important feature of debugging anything in Dolphin, and you will be using this Hotkey a ton.
What is Step-In?
Step-In will force Dolphin to execute the next ASM Instruction and that's it, noting else. Step-In is usually called 'stepping' by coders. When a coder says 'step by step' the code, they want you to debug the code utilizing the Step-In feature of Dolphin. Stepping codes is very helpful, as it allows you to execute a code one instruction at a time at whatever pace you want.
Chapter 3: Understanding How the Gecko Code Handler implements ASM Codes into Memory
According to the Gecko Documentation HERE, ASM Codes (C2 type) have the name of 'Insert ASM'. This name is sort of misleading as it's impossible to insert within memory itself. What actually happens is this...
- At the code's address, a branch instruction (replacing the default instruction) is placed in by the code handler (a backwards branch). View the picture below...
- The backwards branch instruction jumps to the first instruction of the ASM code where the code's instructions are placed into memory by the code handler (codes are placed in memory usually around 0x800022xx thru 0x800023xx)
- The amount to jump for the backwards branch instruction itself is auto calculated by the code handler
- The code instructions are thus executed. After the last instruction of the code, a forward branch instruction (also auto added by the code handler) will automatically jump back to the address directly below/after the code's address, thus continuing the game's instructions. The amount of jump for the forward branch instruction is auto calculated by the code handler
For example let's take a look at the old historical version of the shared item code (PAL version, with 00 for the WW value) - https://mariokartwii.com/showthread.php?tid=111
Code: C27BA164 00000002
38600000 90770020
60000000 00000000
At the address 807BA164 is a backwards branch instruction that will jump to where the code's contents reside in memory (where the code contents were dumped by the code handler). A C2 Insert ASM Code's Address (where this backwards branch instruction resides at) is called the Hook Address. So when another coder/dev mentions the term Hook Address, you now understand what they are referring to.
To follow where any branch-type instruction leads to, right click on the instruction and choose Follow Branch.
The backwards branch leads to the ASM code's contents (first instruction of the code highlighted in blue).
The following is the code's contents plus the forward branch instruction that will jump back to where the CPU execution came from to continue running the game.
Code: Address Instruction
80002348 li r3, 0
8000234C stw r3, 0x0020 (r23)
80002350 nop
80002354 b => 0x807BA168
The '00000000' word of the assembled Shared Item code is read by the code handler and the code handler will know to replace it with a branch (to address below/after code's address) instruction after the last instruction of the Code.
If you follow the 'b => 0x807BA168', it will lead to the instruction highlighted in blue in the following pic...
As you can see the instruction highlighted in blue is the very next instruction below/after the Code's Address. Let's go back to the Dolphin's Code View of the Code itself but zoomed out just a bit.
You will see there are other instructions nearby the code. In this tutorial, I have simply applied only the Shared Item Code via Dolphin's Cheat Manager and nothing else. Dolphin simulates the code being contained in a GCT file (like how codes are normally loaded to a real Wii via an SD card).
The nop at 80002334 is placed by the Gecko Code Handler. I haven't gone over the entire source of the Gecko code handler personally, so I'm not sure what the purpose of this nop is.
The next two instructions after that are both '(ill) 00d0code'. (ill) stands for illegal instruction. The (ill) is given to any word value in memory that would not assemble to a valid PowerPC instruction. Dolphin will slap the (ill) tag and then display the hex contents of that particular word value.
'00d0code 00d0code' is the Header of the GCT file. Every GCT file has this Header. The lfs instruction at 80002340 is not an lfs instruction, it is actually the 'C27BA164' part of the Shared Item Code. Dolphin is attempting to disassemble that word as a PowerPC instruction. The '(ill) 00000002' is what you would expect, it's the '00000002' part of the Shared Item code. Next 4 lines are the code contents plus the branch instruction to branch forward to the Address that is right below/after the Code's Address.
The psq_st instruction at 80002358 is the 1st half of the Final Terminator of the GCT file. The final terminator of a GCT file is 'F0000000 00000000. Any time there is a word of null in memory, Dolphin's Code View will simply place ' --- '. Hence why you see ' --- ' at 8000235C.
Understanding how C2 Codes get executed:
This is important to know if you haven't figured this out by now. C2 ASM Codes only get executed whenever its Hook Address gets executed by the CPU. They are NOT constantly executing every time the Code Handler itself is being executed. The amount of times different C2 codes gets executed within a specific time period varies so much as it's based on so many factors. For example, the Shared Item Code. It's Hook Address only gets executed whenever a player picks up a box. Some C2 ASM Codes may execute every frame, some only once per race, some only once during the booting of the game, it all depends.
Chapter 4. Debugging/Analyzing ASM Codes
First apply whatever C2 ASM code that you want to debug/analyze. If the code's Hook Address gets executed during the early booting stages of the Game, or is executed every frame, we need to adjust a Dolphin setting. If not, go ahead and launch your Game, and skip over the next paragraph.
At the top of the Dolphin main menu, click Options. Select 'Boot to Pause'. Now launch your Game. This will cause the game to halt when it executes its very first instruction.
Okay at this point your Game should be booted up as paused or running. Open up your Breakpoint tab/window. Set an Instruction Breakpoint using the value for the code's address. Remember to covert it from a C2XXXXXX to 80XXXXXX for a valid Mem80 Address.
Once the Breakpoint has been set, un-pause the emulation if it was paused if you've applied 'Boot to Pause'. If you didn't use Boot-to-Pause, do whatever action you need to do to make your Code execute (i.e. Shared Item Code would be executed from picking up an Item Box). If you did in fact use the Boot-to-Pause, simply resume the Emulation.
The Breakpoint should be hit and Dolphin will pause itself. Once that has occurred, take a look at the Code View. You will be at the code's address and you will see the backwards branch instruction that was mentioned earlier.
Remember the Hotkey you configured for Stepping (Step-in)? Use that hotkey to make the code execute one instruction at a time at whatever pace you like. When you execute the first instruction, the backwards branch instruction will be executed, and you will be at the beginning of the ASM code's instructions.
Things to note during stepping:
Whatever instruction highlighted in Green in Code View is the instruction that is GOING to execute. However, this is NOT true for any Memory Breakpoint hits! This is because Dolphin has no idea that the Memory BP was hit until after the responsible store/load instruction gets executed.
You can also take a look at the PC register in the Registers Tab/Window, that will also tell you what instruction is GOING to execute, but once again this does NOT apply on any Memory Breakpoint hit. PC register will function correctly once you step just one time after a Memory Breakpoint hit.
When you perform a Step-In, if a register gets modified from the stepped instruction, that register will turn red in color on the Registers tab/window. That red register will go back to black if it's not modified if you decide to step again.
FYI, on your first emulation pause after launching a game on Dolphin, any registers not zero will start off as red color. This is on any first-time emulation pause, regardless of how the pause occurred.
Chapter 5: More Tips
To quickly set an Instruction Breakpoint on an address, simply left click to the immediate left of the Address value in Code View. A grey dot will appear signaling an Instruction Breakpoint has been set for that particular address.
Need to quickly copy an address value? Right click on the address in Code View, select Copy Address.
You can also use this right-click method to quickly replace instructions. Right click on an address, you will see shortcuts to quickly replace the address's instruction with a nop or a blr. The nop feature can be really handy for beginner coders. You may not know what a blr is. If not, don't worry about that til you get to the point of learning about function calls. Or even better, use this guide on a code that has a blr instruction and analyze it to understand what it does.
You can also edit in any custom valid PowerPC instruction you want with the 'Replace Instruction' feature, but you will need to enter in the assembled form of the instruction (its hexadecimal word value). If you set in a custom instruction of any kind, or a quick nop/blr, you can use the 'Restore Instruction' feature to recover the address's original instruction.
Need to edit register values by hand? Easy to to do. Simply double click within any register you need to edit, and type in the custom value then hit Enter on your keyboard.
By the way, on the left side of the Code View is the call stack. It's a trace back of function calls. Once again, if you are a beginner coder, you don't need to worry about this as this deals with function calls.
Chapter 6: Intro to Exceptions
While stepping through your code, you may have ran into an incident where you've jumped to a weird spot in memory, but you have noticed the memory addresses do not start with '8', but instead with '0'.
You are currently on one of Broadway's Exception Routines. Whenever your code crashes, you will hit one of these Exception Routines. The true technical term for any crash is called an Exception.
Exceptions can happen for a variety of reasons, and knowing which particular Exception Routine you have landed on, can tell you a lot about what is wrong with your code.
First thing's first,you need a quick lesson on Virtual Memory vs Physical Memory. The standard Memory that you are already familiar with is called Virtual Memory. It's a representation of Physical Memory but incorporates what is called Cache. Don't worry about what Cache is, beginner's don't need to know that for ASM Codes.
Exception routines always execute in Physical Memory.
To convert a mem80/81 address form Virtual to Physical, simply change the leading '8' to '0'.
To convert a mem9 address from Virtual to Physical, simply change the leading '9' to '1'.
- Example: 0x80345AB0 ---> 0x00345AB0
- Example: 0x921C0008 ---> 0x121C0008
- Example: 0x817FFFFF ---> 0x017FFFFF
There are a total of 13 Exception Routines that Broadway has implemented for Wii games. However for beginner debugging, we only need to go over 6.
-
DSI (0x00000300)
Storing/loading to/from an invalid memory address
External Interrupt (0x00000500)
Some piece of external hardware needs to temporarily halt normal operation of Broadway.
Alignment (0x00000600)
Effective Address of a stmw, lmw, or any floating point load/store instruction was not word aligned (divisible by 4).
Floating Point Unavailable (0x00000800)
Broadway currently not configured to run floating point instructions.
Decrementer (0x00000900)
When the Decrementer Register has completed decrementing. Basically there is a Timer that is always decrementing, once it hits below 0, this Exception will occur.
System Call (0x00000C00)
Whenever a 'sc' (system call) instruction is executed, Broadway will jump to the System Call Exception Routine. This routine contains cache-related tasks.
---
External Interrupt, Floating Point Unavailable, Decrementer, and System Call happen periodically which is normal. You may encounter these when stepping thru your codes.
Chapter 7: Setting Breakpoints in Exception Routines & srr0
If you are in a hurry and do not want to step thru all of your code but still want to be notified of any Exceptions, set Instruction Breakpoints on the following addresses before test running your code
These are physical addresses and must be entered in as such
If one of these Instruction BPs get triggered, there is really only one register you need to examine. And that is srr0. srr0 contains the address of the instruction that caused the Exception.
At this point, you can copy the address that's in srr0 and paste it into Code View. But there's an issue... You won't see anything listed in Code View.
That is because you are paused while Broadway is executing in Physical Memory. Thus, take your address that's in srr0, and change the leading '8' to a '0'. Plug that new address into Code View, and you should now see the instruction that is causing you a lot of trouble.
Chapter 8: Trying to Solve the cause of your Exception
DSI's are the most common type of Exceptions. If a DSI exception occurred, then the instruction located at srr0's address will be a load or a store instruction. Said load/store instruction has loaded/stored via an invalid memory address. Be sure to check the earlier parts of your code to find out why the Source Register of the load/store instruction contains a invalid memory address.
The #1 mistake by beginners for ending up with an invalid memory address is using r0 as a source register in an instruction that treats r0 as literal zero (i.e. stw) The following will show how easy this mistake can be made...
Code: #Set r0 to 0x80000000
lis r0, 0x8000
#Store contents of r12 to 0x80001640
stw r12, 0x1640 (r0)
And boom a DSI exception has now occurred.
If an Alignment exception occurred, check any present stmw and lmw instructions. As a Beginner, working on stmw and lmw instructions can cause some issues as it is easy to forget the rule that any Effective Address must be divisible by 0x4. This should be an easy fix if you run into this.
NOTE: There are other exceptions that could occur (such as ISI 0x400 & Program 0x700), but the reasons for these exceptions are usually NOT something that can be triggered accidentally from Beginner ASM Coders.
Chapter 9. Stepping Issues in regards to Exceptions
As mentioned earlier, External Interrupt, Floating Point Unavailable, Decrementer, and System Call Exceptions may occur "randomly", and they may occur while you are stepping through a code. If such an event occurs, take the address in srr0 (do NOT convert it to physical in this case), add 4 to it, and place an Instruction BP on it. Press play on Dolphin Emulator, and in a split second, you should now be at srr0+4, ready to continue stepping through the code.
Another note is that if you are at an Exception Routine, you cannot simply step thru the 'rest of it', and think you will simply jump back to your code. Your Wii game will go through a multitude of other processes after the Exception Routine before even getting close to coming back to your code. Thus, once you are something such as a DSI exception, take a look at srr0, notch down some notes, and then close the game. Trying to resume a DSI (or Alignment) exception will just result in the game halting/freezing.
Chapter 10. Conclusion
As I always tell person after person, the best way to get better at coding, is to take other people's codes (that are a little above your own skill level) and analyze them on Dolphin. Set the Breakpoints, step by step necessary instructions, and take plenty of notes. Happy coding!
|
|
|
ASM vid series in the future? |
Posted by: Vega - 12-10-2019, 05:05 AM - Forum: Coding & Hacking General Discussion
- Replies (14)
|
|
After a few requests, I was pondering the idea of doing an ASM YouTube video series. It will essentially be the video version of the thread "Go from complete noob to ASM coder", but without the Wii console specific stuff (i.e. softmod guide, add iso to usb, etc).
Question: I use Debian Linux, does anybody know a good cheap mic that will work out of the box? My mics on all my headsets are garbage and have too much static.
|
|
|
RNS |
Posted by: Callum694 - 12-09-2019, 11:28 PM - Forum: Introductions
- Replies (8)
|
|
I'm the RealNigga.
I assist Vega in making codes, tbh i make most of them, he just takes credit.
#RealNigga #VegaIsFakeNews
|
|
|
I exist now |
Posted by: Seeky - 12-06-2019, 06:01 PM - Forum: Introductions
- Replies (2)
|
|
Hi, I've been modding mkwii for around a year now; I make cts and rarely finish them and I'm learning asm at the minute. I've also messed with modding mario sports mix and plan to make mario galaxy mods at some point.
|
|
|
Disable All Bumping [JoshuaMK] |
Posted by: JoshuaMK - 12-02-2019, 06:50 AM - Forum: Online Non-Item
- Replies (1)
|
|
Disable All Bumping [JoshuaMK]
Bumping no longer occurs causing players to push instead, you can wheelie into other players and not collapse nor lose speed. Collision still exists so you don't phase through players.
(NTSC-U)
0456B8F0 480005C0
(PAL)
04570740 480005C0
(NTSC-J)
045700C0 480005C0
(NTSC-K)
0455E798 480005C0
Code Creator: JoshuaMK
|
|
|
Race as Ghost on Ghost Replay [Vega] |
Posted by: Vega - 11-30-2019, 08:05 PM - Forum: Time Trials & Battle
- Replies (1)
|
|
Race as Ghost on Ghost Replay [Vega]
This code will allow you to race as the ghost when you select ghost replay, be sure to read the instructions below. Also, if you choose to race the ghost in an actual TT, the ghost will mimic your movements. If you want that ghost to mimic you 100% exact (like a reverse live replay), you need to make sure you have the same character, vehicle, transmission, and controller that the ghost used.
INSTRUCTIONS:
Before doing the ghost replay, race against the desired ghost normally for a split second. Pick any character/vehicle, doesn't matter (unless you are wanting to a reverse live replay). Pause the game a split second after the TT starts, and go back to course selection. Select the track you were just on, but this time choose ghost replay for the ghost you had just raced against. The ghost replay will load, you will be the ghost (with the ability to drive it) using its character, vehicle, transmission, etc. Congratz.
XXXX = Controller type
XXXX values:
GCN controller = FC94
Any Wii Remote type controller = D814
NOTE: This code makes use of memory addresses 0x814D0000 thru 0x814D0003. Make sure no other codes in your GCT/Cheat-Manager are using those addresses.
NTSC-U
C251CE84 00000004
807E0004 3D80814D
816C0000 2C0B0000
41820008 7D635B78
60000000 00000000
C251C8BC 00000003
981E0014 3D60814D
3B7EXXXX 936B0000
60000000 00000000
PAL
C25212F8 00000004
807E0004 3D80814D
816C0000 2C0B0000
41820008 7D635B78
60000000 00000000
C2520D30 00000003
981E0014 3D60814D
3B7EXXXX 936B0000
60000000 00000000
NTSC-J
C2520C78 00000004
807E0004 3D80814D
816C0000 2C0B0000
41820008 7D635B78
60000000 00000000
C25206B0 00000003
981E0014 3D60814D
3B7EXXXX 936B0000
60000000 00000000
NTSC-K
C250F31C 00000004
807E0004 3D80814D
816C0000 2C0B0000
41820008 7D635B78
60000000 00000000
C250ED54 00000003
981E0014 3D60814D
3B7EXXXX 936B0000
60000000 00000000
Code creator: Vega
Code credits: Mdmwii (original GCN live replay), Bully (original Wii Remote live replay)
Sources:
#1st ASM (Constantly load pointer, once valid pointer is read, replace ghost pointer w/ player inputs pointer)
#Address Ports
#NTSC-U = 8051CE84
#PAL = 805212F8
#NTSC-J = 80520C78
#NTSC-K = 8050F31C
lwz r3, 0x0004 (r30) #Default instruction, load pointer that references where to load opp ghost inputs from
lis r12, 0x814D
lwz r11, 0 (r12)
cmpwi r11, 0 #Check for valid pointer, valid will NOT be null
beq- end
mr r3, r11 #Change the pointer to point to our inputs instead
end:
==========
#2nd ASM (Once TT race loads, store the player inputs pointer)
#Address Ports
#NTSC-U = 8051C8BC
#PAL = 80520D30
#NTSC-J = 805206B0
#NTSC-K = 8050ED54
stb r0, 0x0014 (r30) #Default instruction
lis r11, 0x814D
addi r27, r30, -0x36C #GCN used for compilation , use -0x27EC for wiimote if desired
stw r27, 0 (r11) #Store the player input pointer
|
|
|
|