+- Mario Kart Wii Gecko Codes, Cheats, & Hacks (https://mariokartwii.com)
+-- Forum: Cheat Codes (https://mariokartwii.com/forumdisplay.php?fid=51)
+--- Forum: Misc/Other (https://mariokartwii.com/forumdisplay.php?fid=55)
+--- Thread: SYSCONF MKW Region Settings NAND Editor [Vega] (/showthread.php?tid=1082)
SYSCONF MKW Region Settings NAND Editor [Vega] - Vega - 02-25-2019
SYSCONF MKW Region Settings NAND Editor [Vega]
This code will allow you to make permanent changes to your SYSCONF file regarding your country code, region residence code (set Flag), and globe location. I made this so you wouldn't need to use an HBC application to extract the SYSCONF file from the NAND to later Hex-edit it on a computer. Ofc, you could use some other Country/Globe Changer code, but all of those are temporary. This code makes permanent edits to your NAND.
You only need to run this code once.
XX = Country Code
YY values:
00 = No Flag, use Default Region ID Globe Location
01 = Flag On
ZZZZZZZZ = Globe Location, YY value must be 01 for this to take effect. Use a value of 00000000 if your YY value is 00.
Instructions:
Simply boot MKWii. After a split second, the TV screen will flicker a bit, then you will automatically be navigated to the Wii Main Menu. And that's it. SYSCONF edits have been made.
If you are using this code on Dolphin, the navigation to the Wii Menu might fail, but the SYSCONF edits will still be successful.
NTSC-U
C20095F4 00000028
38604000 38800020
80ADA358 80A50024
7CBA2B78 3D808022
618C9490 7D8803A6
4E800021 7C7E1B78
3F808016 4800001D
2F736861 72656432
2F737973 2F535953
434F4E46 00000000
7C6802A6 7C7D1B78
38800001 639BADBC
7F6803A6 4E800021
2C030000 418000C8
7C7F1B78 7FC4F378
38A04000 639BB15C
7F6803A6 4E800021
2C034000 408200A8
7FE3FB78 639BB2E4
7F6803A6 4E800021
2C030000 41800090
387EFFFF 38A04000
8C830001 2C040007
40A20028 88C3FFFF
2C060010 4082001C
3C80XXYY 90830001
3C80ZZZZ 6084ZZZZ
90831005 4800000C
34A5FFFF 4082FFCC
7FA3EB78 38800002
639BADBC 7F6803A6
4E800021 2C030000
41800034 7C7F1B78
7FC4F378 38A04000
639BB220 7F6803A6
4E800021 2C034000
40820014 7FE3FB78
639BB2E4 7F6803A6
4E800021 3D80801A
618C87B8 7D8803A6
4E800020 00000000
PAL
C2009634 00000028
38604000 38800020
80ADA360 80A50024
7CBA2B78 3D808022
618C9814 7D8803A6
4E800021 7C7E1B78
3F808016 4800001D
2F736861 72656432
2F737973 2F535953
434F4E46 00000000
7C6802A6 7C7D1B78
38800001 639BAE5C
7F6803A6 4E800021
2C030000 418000C8
7C7F1B78 7FC4F378
38A04000 639BB1FC
7F6803A6 4E800021
2C034000 408200A8
7FE3FB78 639BB384
7F6803A6 4E800021
2C030000 41800090
387EFFFF 38A04000
8C830001 2C040007
40A20028 88C3FFFF
2C060010 4082001C
3C80XXYY 90830001
3C80ZZZZ 6084ZZZZ
90831005 4800000C
34A5FFFF 4082FFCC
7FA3EB78 38800002
639BAE5C 7F6803A6
4E800021 2C030000
41800034 7C7F1B78
7FC4F378 38A04000
639BB2C0 7F6803A6
4E800021 2C034000
40820014 7FE3FB78
639BB384 7F6803A6
4E800021 3D80801A
618C8858 7D8803A6
4E800020 00000000
NTSC-J
C2009590 00000028
38604000 38800020
80ADA360 80A50024
7CBA2B78 3D808022
618C9734 7D8803A6
4E800021 7C7E1B78
3F808016 4800001D
2F736861 72656432
2F737973 2F535953
434F4E46 00000000
7C6802A6 7C7D1B78
38800001 639BAD7C
7F6803A6 4E800021
2C030000 418000C8
7C7F1B78 7FC4F378
38A04000 639BB11C
7F6803A6 4E800021
2C034000 408200A8
7FE3FB78 639BB2A4
7F6803A6 4E800021
2C030000 41800090
387EFFFF 38A04000
8C830001 2C040007
40A20028 88C3FFFF
2C060010 4082001C
3C80XXYY 90830001
3C80ZZZZ 6084ZZZZ
90831005 4800000C
34A5FFFF 4082FFCC
7FA3EB78 38800002
639BAD7C 7F6803A6
4E800021 2C030000
41800034 7C7F1B78
7FC4F378 38A04000
639BB1E0 7F6803A6
4E800021 2C034000
40820014 7FE3FB78
639BB2A4 7F6803A6
4E800021 3D80801A
618C8778 7D8803A6
4E800020 00000000
NTSC-K
C200973C 00000028
38604000 38800020
80ADA380 80A50024
7CBA2B78 3D808022
618C9B88 7D8803A6
4E800021 7C7E1B78
3F808016 4800001D
2F736861 72656432
2F737973 2F535953
434F4E46 00000000
7C6802A6 7C7D1B78
38800001 639BAEF8
7F6803A6 4E800021
2C030000 418000C8
7C7F1B78 7FC4F378
38A04000 639BB298
7F6803A6 4E800021
2C034000 408200A8
7FE3FB78 639BB420
7F6803A6 4E800021
2C030000 41800090
387EFFFF 38A04000
8C830001 2C040007
40A20028 88C3FFFF
2C060010 4082001C
3C80XXYY 90830001
3C80ZZZZ 6084ZZZZ
90831005 4800000C
34A5FFFF 4082FFCC
7FA3EB78 38800002
639BAEF8 7F6803A6
4E800021 2C030000
41800034 7C7F1B78
7FC4F378 38A04000
639BB35C 7F6803A6
4E800021 2C034000
40820014 7FE3FB78
639BB420 7F6803A6
4E800021 3D80801A
618C8BB4 7D8803A6
4E800020 00000000
Code creator: Vega
Code credits: Megazig (ISFS functions, _OSShutdownToSBY), RiiDefi (EGG functions), Star (Helped with Source, and provided info for certain Arguments of certain Functions)
#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#
#~~~~~~~~~~~~~~~#
# Address Ports #
#~~~~~~~~~~~~~~~#
#800095F4 = NTSC-U
#80009634 = PAL
#80009590 = NTSC-J
#8000973C = NTSC-K
#~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Source Region Compilation #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~#
.set region, '' #Fill in E, P, J, or K within the quotes for your region when Compiling! Lowercase letters can also be used.
#~~~~~~~~~~~~~~~~~~~~~~#
# Macros and Variables #
#~~~~~~~~~~~~~~~~~~~~~~#
.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm
.macro call_isfs address
ori r27, r28, \address@l
mtlr r27
blrl
.endm
.macro call_nolink address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blr
.endm
.if (region == 'E' || region == 'e') # RMCE
.set ISFS_Open, 0xADBC
.set ISFS_Read, 0xB15C
.set ISFS_Write, 0xB220
.set ISFS_Close, 0xB2E4
.set Wii_Menu, 0x801A87B8
.set Egg_Alloc, 0x80229490
.elseif (region == 'P' || region == 'p') # RMCP
.set ISFS_Open, 0xAE5C
.set ISFS_Read, 0xB1FC
.set ISFS_Write, 0xB2C0
.set ISFS_Close, 0xB384
.set Wii_Menu, 0x801A8858
.set Egg_Alloc, 0x80229814
.elseif (region == 'J' || region == 'j') # RMCJ
.set ISFS_Open, 0xAD7C
.set ISFS_Read, 0xB11C
.set ISFS_Write, 0xB1E0
.set ISFS_Close, 0xB2A4
.set Wii_Menu, 0x801A8778
.set Egg_Alloc, 0x80229734
.elseif (region == 'K' || region == 'k') # RMCK
.set ISFS_Open, 0xAEF8
.set ISFS_Read, 0xB298
.set ISFS_Write, 0xB35C
.set ISFS_Close, 0xB420
.set Wii_Menu, 0x801A8BB4
.set Egg_Alloc, 0x80229B88
.else # Invalid Region
.err
.endif
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Register Notes: #
# No need to backup anything as final function is OSReturnToMenu #
# r31 = Backup Register for File Descriptor Values #
# r30 = Backup Register for Heap Address Pointer #
# r29 = Backup Register for File Path for ISFS_Open #
# r28 = Used for ISFS Macros #
# r27 = Used for ISFS Macros #
# r26 = Backup for System Heap Calc Address #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#~~~~~~~~~~~~~~~~~~~~~~~#
# Egg::Heap::alloc #
# r3 = Size of Heap #
# r4 = Alignment #
# r5 = System Heap Calc #
#~~~~~~~~~~~~~~~~~~~~~~~#
li r3, 0x4000 #Size of SYSCONF is 0x4000
li r4, 0x20 #32 bit alignment
.if (region == 'E' || region == 'e')
lwz r5, -0x5CA8(r13)
.elseif (region == 'P' || region == 'p')
lwz r5, -0x5CA0(r13)
.elseif (region == 'J' || region == 'j')
lwz r5, -0x5CA0(r13)
.elseif (region == 'K' || region == 'k')
lwz r5, -0x5C80(r13)
.endif
lwz r5, 0x0024 (r5)
mr r26, r5 #Backup System Heap Calc Address
call_link Egg_Alloc
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Backup Heap Pointer; Set ISFS Function 1st Half Address #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
mr r30, r3
lis r28, 0x8016
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Open (#1) Arguments #
# r3 = Address Pointer To File Path #
# r4 = 0x1 for ISFS_Read Permission #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
bl file_path
.llong 0x2F73686172656432 #String for /shared2/sys/SYSCONF
.llong 0x2F7379732F535953
.long 0x434F4E46
.space 4 #4 bytes of zeros added for alignment
file_path:
mflr r3
mr r29, r3 #Backup File Path Address Pointer to r29 for later 2nd use of ISFS_Open
li r4, 1
call_isfs ISFS_Open
cmpwi r3, 0
blt- the_end
mr r31, r3 #Backup file descriptor
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Read Arguments #
# r3 = File Descriptor #
# r4 = Address Pointer to Dump Data from File to (32 bit aligned) #
# r5 = Amount of Bytes to Dump #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
mr r4, r30
li r5, 0x4000
call_isfs ISFS_Read
cmpwi r3, 0x4000
bne- the_end
#~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Close (#1) Arguments #
# r3 = File Descriptor #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~#
mr r3, r31 #Move backed up file descriptor to r3
call_isfs ISFS_Close
cmpwi r3, 0
blt- the_end
#~~~~~~~~~~~~~~~~~#
# Pre-Loop Config #
#~~~~~~~~~~~~~~~~~#
addi r3, r30, -1 #Minus one from the heap address pointer, result in r3
li r5, 0x4000
#~~~~~~~~~~#
# the_loop #
#~~~~~~~~~~#
the_loop:
lbzu r4, 0x1 (r3) #Every time this instruction is executed, r3 increases by 0x1
cmpwi r4, 0x7 #The value after the byte 0x07 is usually the country code, but we have to double check
bne+ decrement_loop #Most likely byte value is not 7, if not 7, decrement the loop
#~~~~~~~~~~~~~~~~~~~~~~~~~#
# Double Check Byte Value #
#~~~~~~~~~~~~~~~~~~~~~~~~~#
lbz r6, -0x1 (r3) #Load Byte value that is -0x1 away from 0x7 (have to do offset of -0x2 because of the lbzu instruction)
cmpwi r6, 0x10 #Compare Byte to 0x10
bne- decrement_loop #If not equal to 0x10, we are still not in the correct spot of SYSCONF, decrement loop. Unsure about branch probability, left it default (less likely)
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# On Correct Location of SYSCONF, Write New Values #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
lis r4, 0x8801 #Country Code followed by Region Residence Code (set flag); Korea w/ Flag On used purely for Compilation!
stw r4, 0x1 (r3) #Store Country Code and Region Residence Code to our temp SYSCONF file
lis r4, 0x3FFF #Set 1st half Globe Location (north pole with slight spin used purely for Compilation!)
ori r4, r4, 0x7500 #Set 2nd half Globe Location
stw r4, 0x1005 (r3) #Store Globe Location to our temp SYSCONF file
b start_open_write #No need for loop to continue since edits to file are completed
#~~~~~~~~~~~~~~~~#
# Decrement Loop #
#~~~~~~~~~~~~~~~~#
decrement_loop:
subic. r5, r5, 1 #Every time this instruction is executed, subtract 1 from r5. Update the Condition Register (cmpwi r5, 0x0)
bne+ the_loop #If not equal to 0x0, run the loop again
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Open (2nd time) #
# r4 is now 0x2 for ISFS_Write Permissions #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
start_open_write:
mr r3, r29 #Move backed up file path address pointer to r3
li r4, 0x2
call_isfs ISFS_Open
cmpwi r3, 0
blt- the_end
mr r31, r3 #Backup new file descriptor
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Write Arguments #
# r3 = File Descriptor #
# r4 = Address Pointer to Data that will be Written to File #
# r5 = Amount of Bytes to Write #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
mr r4, r30 #Move backed up Heap Address Pointer to r4
li r5, 0x4000
call_isfs ISFS_Write
cmpwi r3, 0x4000
bne- the_end
#~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Close (#1) Arguments #
# r3 = File Descriptor #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~#
mr r3, r31 #Place fd back into r3
call_isfs ISFS_Close
#No need to check return of Close since code is now ending
#~~~~~~~~~~~~~~~~#
# OSReturnToMenu #
#~~~~~~~~~~~~~~~~#
the_end:
call_nolink Wii_Menu
#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#